[42m4n]

Summary

• rc alias set required the access key and the secret key on the command line.
• A command such as rc alias set local http://localhost:9000 MYKEY MYSECRET is saved in bash history as plain text.
• Anyone who reads ~/.bash_history, or the terminal scrollback, can see the credentials.
• Keys on the command line also appear in ps output while the command runs.
• Prompt for the missing keys when stdin is a terminal and output is not JSON. Prompted input is not saved in shell history.

Changes

• Prompt with Enter Access Key: and read the value with echo on.
• Prompt with Enter Secret Key: and read the value with echo off.
• No prompt when --json is set or stdin is not a terminal. Non-interactive runs keep the current error:
  Access key and secret key are required unless --anonymous is set, exit code 2.
• Prompt failures report the existing error mapping. An interrupt exits with 130.
• Document the new behavior in docs/reference/rc/alias.md.

Behavior notes

• This matches mc alias set from MinIO.
• No breaking change. Existing invocations with both keys still work with the same output and exit codes.
• Scripts that run with an attached tty and no keys now wait for input instead of failing fast.
  This is the same trade-off as mc.

Testing

• cargo fmt --all --check — pass
• cargo clippy --workspace -- -D warnings — pass
• cargo test --workspace — pass
• Verified in a pty: the access key is echoed, the secret key is not echoed, and an interrupt exits with 130.