Clean, focused PR. The password masking and re-masking logic are mechanically sound, and the test coverage for type="password" assertions is genuine. Kurapika traced the full credential lifecycle and found no new attack surface. Mafu-san confirmed scope-to-problem proportionality.

One P2 (sentinel visibility defeated), three P3s (missing autoComplete, two test gaps), one Nit, two Notes.

The PR description lists implementation bullets without stating the problem. The PR style guide says bug fixes start with what was broken. Something like: "Credential inputs displayed API keys as plaintext, visible to shoulder-surfers and screen captures."

"The prop still functions mechanically, but its user-facing purpose is defeated. An admin editing a provider cannot tell which key is saved without leaving the form." (Mafuuu)

site/src/pages/AISettingsPage/ProvidersPage/components/ProviderForm.tsx:396-401

P3 [CRF-2] Bedrock "Access key" is now type="password" without autoComplete, triggering browser password-manager interactions.

Three CredentialField usages exist. apiKey (line 339) and accessKeySecret (line 407) both pass autoComplete="new-password". This accessKey does not. Before this PR the field was type="text", so the omission was dormant. Now with type="password", browsers will offer to autofill/save it.

Since CredentialField always renders type="password", it should own the autoComplete default rather than requiring each caller to remember. The structural fix is defaulting autoComplete to "new-password" in the CredentialField props:

// CredentialField.tsx, destructured props:
autoComplete = "new-password",

This protects current and future callers while still allowing overrides.

(Hisoka P3, Mafuuu P3, Pariston P3, Nami P3, Razor P3, Chopper Nit)

🤖

🤖 This review was automatically generated with Coder Agents.

All seven R1 findings addressed cleanly. The approach pivot from type="password" to sentinel-based masking with blur-restore is well-reasoned, and the test infrastructure (SuccessfulSubmitProviderForm + deferred) is honest and deterministic. Mafuuu traced the full lifecycle end-to-end; Pariston verified against five framings of the problem. The setQueryData calls solve the stale-mask issue (CRF-7) at the right level.

One P2 (toggle-mutation credential overwrite), three P3s (missing error-path test, duplicated utility, missing paired comment).

The PR description and commit subject still claim "password input type" but the code ships type="text". After CRF-3's fix this is now factually wrong, not just restating the diff. Worth updating before merge so git log doesn't record a false statement about the security boundary.

"If someone removes or weakens the guard in a future refactor, the user types a new API key, submit fails, and the form silently replaces their key with ********. No test exercises the error path." (Bisky)

🤖 This review was automatically generated with Coder Agents.

All 15 findings across three rounds are resolved. No new findings from Netero or the panel.

The credential lifecycle is now well-covered: focus clears the mask, blur restores it, submit sends the raw value, post-submit re-masks with the server's current sentinel, failed submits preserve the typed credential, and external loading cycles (toggle) don't interfere. The didSubmit ref cleanly discriminates form submissions from toggle mutations. The shared createDeferred utility consolidates three copies. Test density is 3.4:1.

Hisoka traced four adversarial scenarios (shared mutation, form instability in deps, blur-then-submit ordering, error path timing) and all held.

"The code fought well." (Hisoka)

🤖 This review was automatically generated with Coder Agents.

Pull request overview

Fixes credential masking behavior in the AI provider form so saved credentials are restored to masked display after submit, while improving credential input legibility and reusing a shared deferred test helper.

Changes:

• Re-masks provider credential fields after successful submit and restores masks on empty blur.
• Updates AI provider cache after mutations so refreshed masked values are available promptly.
• Adds monospace styling for credential inputs and centralizes the createDeferred test helper.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.