Token protection for the aube config list command

[klaseca]

npm doesn't show the actual token:

$ npm config list

//registry.npmjs.org/:_authToken = (protected)

aube, on the other hand, shows it:

$ aube config list

//registry.npmjs.org/:_authToken=npm_RealTokenValue

It seems that the actual token, just like the one from npm, shouldn't be displayed. There may be other information that should be kept confidential.

Versions:
npm - 11.16.0
aube - 2.2.4 windows-x64 (2026-08-31)

[jdx]

Thanks for reporting this — confirmed. aube config list was rendering raw authentication values in both text and JSON output.

I opened PR #1483, which replaces authentication values with (protected), redacts credentials embedded in URLs, and also prevents aube config set from repeating a secret in its success message. The underlying stored value remains unchanged.

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.