@@ -0,0 +1,7 @@
+---
+"nostream": patch
+---
+
+fix(cli): reject placeholder secret inherited from env or prompt in setup (#1018)
+
+Setup now rejects the default placeholder secret (`change_me_to_something_long_and_random`) when read from inherited environment variables or interactive prompt input, and validates the resolved secret before persisting to `.env`. If a placeholder is detected, setup automatically generates a fresh cryptographically secure 64-byte random hex secret.
@@ -29,42 +29,102 @@ class SetupCancelledError extends Error {
   }
 }
 
+const stripQuotes = (value: string): string => {
+  const trimmed = value.trim()
+  if ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'"))) {
+    return trimmed.slice(1, -1).trim()
+  }
+  return trimmed
+}
+
+const parseEnvValue = (rawValue: string): string => {
+  const trimmed = rawValue.trim()
+  if (!trimmed) {
+    return ''
+  }
+
+  if (trimmed.startsWith('"')) {
+    let closingIndex = -1
+    for (let i = 1; i < trimmed.length; i += 1) {
+      if (trimmed[i] === '"' && trimmed[i - 1] !== '\\') {
+        closingIndex = i
+        break
+      }
+    }
+    if (closingIndex !== -1) {
+      return trimmed.slice(1, closingIndex).replace(/\\"/g, '"')
+    }
+    return trimmed.slice(1)
+  }
+
+  if (trimmed.startsWith("'")) {
+    const closingIndex = trimmed.indexOf("'", 1)
+    if (closingIndex !== -1) {
+      return trimmed.slice(1, closingIndex)
+    }
+    return trimmed.slice(1)
+  }
+
+  const [unquoted] = trimmed.split('#', 1)
+  return unquoted.trim()
+}
+
 const readEnvSecret = (content: string): string | undefined => {
   for (const line of content.split(/\r?\n/)) {
     const trimmed = line.trim()
     if (!trimmed || trimmed.startsWith('#') || !trimmed.startsWith('SECRET=')) {
       continue
     }
 
-    const [rawValue] = trimmed.slice('SECRET='.length).split('#', 1)
-    return rawValue.trim()
+    const raw = trimmed.slice('SECRET='.length)
+    return parseEnvValue(raw)
   }
 
   return undefined
 }
 
 const needsSecretReplacement = (secret: string | undefined): boolean => {
-  return !secret || secret === SECRET_PLACEHOLDER
+  const unquoted = secret ? stripQuotes(secret) : undefined
+  return !unquoted || unquoted === SECRET_PLACEHOLDER
 }
 
 const resolveSecret = async (assumeYes: boolean): Promise<string> => {
-  if (process.env.SECRET?.trim()) {
-    return process.env.SECRET.trim()
+  const inheritedSecret = process.env.SECRET?.trim()
+  if (inheritedSecret && !needsSecretReplacement(inheritedSecret)) {
+    return stripQuotes(inheritedSecret)
   }
 
   if (!assumeYes && process.stdin.isTTY) {
     const value = await setupPrompts.text({
       message: 'SECRET env var value (hex recommended)',
       placeholder: 'openssl rand -hex 128',
-      validate: (input) => (input.trim() ? undefined : 'SECRET is required'),
+      validate: (input) => {
+        const trimmed = stripQuotes(input)
+        if (!trimmed) {
+          return 'SECRET is required'
+        }
+        if (needsSecretReplacement(trimmed)) {
+          return 'SECRET cannot be the default placeholder'
+        }
+        if (input.includes('#')) {
+          return 'SECRET cannot contain "#"'
+        }
+        if (/[\r\n]/.test(input)) {
+          return 'SECRET cannot contain newlines'
+        }
+        return undefined
+      },
     })
 
     if (setupPrompts.isCancel(value)) {
       setupPrompts.cancel('Setup cancelled')
       throw new SetupCancelledError()
     }
 
-    return value.trim()
+    const trimmed = value.trim()
+    if (!needsSecretReplacement(trimmed)) {
+      return trimmed
+    }
   }
 
   return randomBytes(64).toString('hex')
@@ -119,7 +179,11 @@ const ensureEnvFile = async (assumeYes: boolean): Promise<boolean> => {
 
   const current = fs.readFileSync(envPath, 'utf-8')
 
-  if (!needsSecretReplacement(readEnvSecret(current))) {
+  const envFileSecret = readEnvSecret(current)
+  if (!needsSecretReplacement(envFileSecret)) {
+    if (needsSecretReplacement(process.env.SECRET) && envFileSecret) {
+      process.env.SECRET = envFileSecret
+    }
     return true
   }
 
@@ -133,6 +197,11 @@ const ensureEnvFile = async (assumeYes: boolean): Promise<boolean> => {
     throw error
   }
 
+  if (needsSecretReplacement(secret)) {
+    secret = randomBytes(64).toString('hex')
+  }
+
+  process.env.SECRET = secret
   fs.writeFileSync(envPath, upsertSecret(current, secret), 'utf-8')
   return true
 }
 
@@ -114,4 +114,118 @@ describe('runSetup', () => {
     expect(outroStub.notCalled).to.equal(true)
     expect(readEnv()).to.equal('SECRET=change_me_to_something_long_and_random\n')
   })
+
+  it('rejects an inherited placeholder secret from process.env.SECRET and generates a fresh secret', async () => {
+    fs.writeFileSync(path.join(tempDir, '.env.example'), 'SECRET=change_me_to_something_long_and_random\n', 'utf-8')
+    process.env.SECRET = 'change_me_to_something_long_and_random'
+
+    const code = await setupCommand.runSetup({ yes: true })
+
+    expect(code).to.equal(0)
+    const generatedSecret = readEnv().match(/^SECRET=([a-f0-9]+)$/m)?.[1]
+    expect(generatedSecret).to.not.equal(undefined)
+    expect(generatedSecret).to.not.equal('change_me_to_something_long_and_random')
+    expect(generatedSecret).to.have.length(128)
+    expect(process.env.SECRET).to.equal(generatedSecret)
+  })
+
+  it('validates secret input in interactive mode and rejects empty or placeholder values', async () => {
+    process.stdin.isTTY = true
+    fs.writeFileSync(path.join(tempDir, '.env.example'), 'SECRET=change_me_to_something_long_and_random\n', 'utf-8')
+
+    let validateFn: ((input: string) => string | undefined) | undefined
+    sinon.stub(setupCommand.setupPrompts, 'text').callsFake((opts: any) => {
+      validateFn = opts.validate
+      return Promise.resolve('my-strong-interactive-secret')
+    })
+    sinon.stub(setupCommand.setupPrompts, 'confirm').resolves(false as any)
+
+    const code = await setupCommand.runSetup({ yes: false })
+
+    expect(code).to.equal(0)
+    expect(validateFn).to.be.a('function')
+    expect(validateFn!('')).to.equal('SECRET is required')
+    expect(validateFn!('   ')).to.equal('SECRET is required')
+    expect(validateFn!('change_me_to_something_long_and_random')).to.equal('SECRET cannot be the default placeholder')
+    expect(validateFn!('  change_me_to_something_long_and_random  ')).to.equal(
+      'SECRET cannot be the default placeholder',
+    )
+    expect(validateFn!('my-strong-interactive-secret')).to.equal(undefined)
+    expect(validateFn!('secret#comment')).to.equal('SECRET cannot contain "#"')
+    expect(validateFn!('secret\nnewline')).to.equal('SECRET cannot contain newlines')
+
+    expect(readEnv()).to.include('SECRET=my-strong-interactive-secret')
+    expect(process.env.SECRET).to.equal('my-strong-interactive-secret')
+  })
+
+  it('replaces placeholder with generated secret if interactive input somehow resolves to placeholder', async () => {
+    process.stdin.isTTY = true
+    fs.writeFileSync(path.join(tempDir, '.env.example'), 'SECRET=change_me_to_something_long_and_random\n', 'utf-8')
+
+    sinon.stub(setupCommand.setupPrompts, 'text').resolves('change_me_to_something_long_and_random')
+    sinon.stub(setupCommand.setupPrompts, 'confirm').resolves(false as any)
+
+    const code = await setupCommand.runSetup({ yes: false })
+
+    expect(code).to.equal(0)
+    const generatedSecret = readEnv().match(/^SECRET=([a-f0-9]+)$/m)?.[1]
+    expect(generatedSecret).to.not.equal(undefined)
+    expect(generatedSecret).to.not.equal('change_me_to_something_long_and_random')
+    expect(generatedSecret).to.have.length(128)
+    expect(process.env.SECRET).to.equal(generatedSecret)
+  })
+
+  it('replaces a quoted placeholder secret in .env', async () => {
+    fs.writeFileSync(path.join(tempDir, '.env'), 'SECRET="change_me_to_something_long_and_random"\nFOO=bar\n', 'utf-8')
+
+    const code = await setupCommand.runSetup({ yes: true })
+
+    expect(code).to.equal(0)
+    const generatedSecret = readEnv().match(/^SECRET=([a-f0-9]+)$/m)?.[1]
+    expect(generatedSecret).to.not.equal(undefined)
+    expect(generatedSecret).to.not.equal('change_me_to_something_long_and_random')
+    expect(generatedSecret).to.have.length(128)
+    expect(process.env.SECRET).to.equal(generatedSecret)
+  })
+
+  it('syncs process.env.SECRET from an existing valid .env secret when process.env.SECRET held a placeholder', async () => {
+    fs.writeFileSync(path.join(tempDir, '.env'), 'SECRET="persisted-real-secret"\n', 'utf-8')
+    process.env.SECRET = 'change_me_to_something_long_and_random'
+
+    const code = await setupCommand.runSetup({ yes: true })
+
+    expect(code).to.equal(0)
+    expect(process.env.SECRET).to.equal('persisted-real-secret')
+  })
+
+  it('preserves full quoted secret containing # from .env and does not truncate at #', async () => {
+    fs.writeFileSync(path.join(tempDir, '.env'), 'SECRET="abc#def" # trailing comment\n', 'utf-8')
+
+    const code = await setupCommand.runSetup({ yes: true })
+
+    expect(code).to.equal(0)
+    expect(process.env.SECRET).to.equal('abc#def')
+    expect(readEnv()).to.equal('SECRET="abc#def" # trailing comment\n')
+  })
+
+  it('preserves explicitly supplied valid process.env.SECRET when .env contains a different valid secret', async () => {
+    fs.writeFileSync(path.join(tempDir, '.env'), 'SECRET="file-secret"\n', 'utf-8')
+    process.env.SECRET = 'operator-supplied-secret'
+
+    const code = await setupCommand.runSetup({ yes: true })
+
+    expect(code).to.equal(0)
+    expect(process.env.SECRET).to.equal('operator-supplied-secret')
+    expect(readEnv()).to.equal('SECRET="file-secret"\n')
+  })
+
+  it('correctly handles escaped quotes inside double-quoted secrets', async () => {
+    fs.writeFileSync(path.join(tempDir, '.env'), 'SECRET="sec\\"ret#with#hashes" # comment\n', 'utf-8')
+
+    const code = await setupCommand.runSetup({ yes: true })
+
+    expect(code).to.equal(0)
+    expect(process.env.SECRET).to.equal('sec"ret#with#hashes')
+    expect(readEnv()).to.equal('SECRET="sec\\"ret#with#hashes" # comment\n')
+  })
 })