Redesign write command: make it interactive to not leak secret into bash history

[jadrol]

Requestor/Issue: @jadrol
Risk (low/med/high): low
Tested (yes/no): yes, locally
Description/Why:

Old syntax for write command made us leak secret into bash history which with connection to internal security tooling made us leak secrets.

Rewrote write command to be interactive, secret is not being printed at any time, no leak to history.

> ./treasury write development/httpbingo/JAREK_TEST
Please paste your secret:
Success! Data written to: development/httpbingo/JAREK_TEST (7 characters)

There is still posibility to pass secret via pipe, see bats for examples.

[Copilot]

Pull request overview

This PR redesigns the treasury write CLI to avoid leaking secrets via command-line arguments (shell history / process list) by reading secrets interactively (TTY) or via stdin (CI/scripts), and updates docs/tests accordingly.

Changes:

• Make write accept only the key argument and read the secret from TTY (hidden) or stdin; add shared secret-input helper + unit tests.
• Update Bats + README usage examples to reflect the interactive/stdin-based workflow and new output format.
• Improve SSM backend initialization by loading ambient AWS SDK config when a caller did not provide a usable aws.Config.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
cmd/write.go	Switches write to interactive/stdin secret input and updates help text + output formatting.
cmd/secret_input.go	Adds logic for securely reading secrets from TTY (hidden) or stdin (piped) with newline trimming + validation.
cmd/secret_input_test.go	Adds unit coverage for stdin trimming/validation behavior and edge cases.
test/bats/tests.bats	Updates integration tests to pass secrets via stdin pipe and adds negative/edge test cases.
README.md	Documents interactive write behavior and safe scripting patterns.
backend/backend.go	Adjusts SSM backend to load default AWS SDK config when not provided by caller.
backend/backend_test.go	Adds test coverage for caller-provided AWS config scenario.
go.mod / go.sum	Adds golang.org/x/term dependency for hidden TTY input.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (3)

cmd/secret_input.go:42

• The interactive prompt is written to stdout via cmd.OutOrStdout(). If the user redirects stdout (e.g. treasury write key > out.txt), they won’t see the prompt and it will pollute machine-readable output. Interactive prompts should go to stderr while the success message stays on stdout.

	out := cmd.OutOrStdout()

	_, _ = fmt.Fprint(out, secretPrompt)
	//nolint:gosec // G115: a file descriptor always fits in an int
	secret, err := term.ReadPassword(int(file.Fd()))

README.md:134

• This documentation claims printf '%s\n' "${SECRET}" can be used when the secret must end with a newline, but stdin input always has a single trailing EOL stripped (see trimEOL/readSecret tests). As written, this printf example would still lose the final newline.

The single trailing newline that `echo` adds is stripped, so there is no need for `echo -n` (which is not portable between shells anyway). Any other whitespace is treated as a part of the secret. If the secret has to end with a newline, use `printf '%s\n' "${SECRET}"` or write it from a file with `--file`.

backend/backend.go:46

• When options.Region is empty, calling config.LoadDefaultConfig(..., config.WithRegion(options.Region)) risks overriding an ambient region from env/shared config with an empty value, which can later cause "missing region" errors at runtime. Only apply config.WithRegion when Region is explicitly set.

		awsConfig := options.AWSConfig
		if !isConfigured(awsConfig) {
			var err error
			awsConfig, err = config.LoadDefaultConfig(context.Background(), config.WithRegion(options.Region))
			if err != nil {