fix(auth): show the interactive login prompt instead of erasing it

[narthur]

Problem

On an interactive TTY, ynab auth login looks like it hangs: no prompt appears, just a blank line with a blinking cursor. Reported on Warp; reproducible on any terminal that applies cursor/erase escape sequences promptly.

It isn't actually a non-TTY/stdin issue — stdin, stdout, and stderr are all TTYs in the affected sessions. The bug is in the interactive prompt itself.

Root cause

const rl = createInterface({ input: process.stdin, output: process.stderr });
process.stderr.write('Enter YNAB Personal Access Token: ');  // written outside readline
rl.question('', (answer) => { ... });                        // empty query

The prompt is written directly to the output stream, then readline.question('') is called with an empty query. readline owns the current line and, when it renders, emits ESC[1G (cursor to column 1) + ESC[0J (erase to end of screen) — wiping the just-written prompt.

Captured from the real binary under a PTY, before any input:

Enter YNAB Personal Access Token: \x1b[1G\x1b[0J \x1b[1G
                                   └─ readline clears the line, erasing the prompt

Result: the prompt flashes and vanishes; the user sees nothing and assumes it's stuck. (Input still works — piping/typing a token authenticates — but nothing signals that a token is expected.)

Fix

Pass the prompt as readline's question() query so readline reprints it after its own clear instead of erasing a string it doesn't know about:

const rl = createInterface({ input, output });
rl.question('Enter YNAB Personal Access Token: ', (answer) => { ... });

Same binary under a PTY after the fix — clear first, prompt second, surviving on screen with the cursor parked after it:

\x1b[1G\x1b[0J Enter YNAB Personal Access Token: \x1b[35G

promptForToken() and readTokenFromStdin() now accept injectable streams (defaulting to the real stdio) so the prompt-rendering and stdin-parsing paths can be unit-tested, and the empty-token error gains an actionable hint.

Tests

Adds src/commands/auth.test.ts: the prompt text reaches the output stream and the typed token is returned/trimmed; stdin piping resolves/trims, empty-EOF resolves empty, and stream errors reject.

✓ src/commands/auth.test.ts (5 tests)
Test Files  4 passed (4)
     Tests  35 passed (35)

bun run typecheck and bun run lint (oxlint) pass.

🤖 Generated with Claude Code