[cx-rahul-pidde]

Description

Adds a way for an IDE to save its sign-in as the cx CLI's own login, so other cx processes of the same user (for example the cx-devassist Copilot plugin) use the same login without a second sign-in.

• CxWrapper.configureApiKey(key) runs cx configure set --prop-name cx_apikey --prop-value <key>. cx decides where the login is stored.
• CxWrapper.clearApiKey() sets cx_apikey to an empty value, for sign-out.
• New ExecutionService.executeSensitiveCommands(...), used by both. Unlike executeCommands, it passes the arguments unchanged (no quote stripping) and never logs or returns cx's stdout or stderr, only the exit code. This matters because cx configure set prints the value it sets, so the existing path would write the key to the log.
• These methods do not add the config's --apikey, so only the given value is sent.

Not changed: existing commands and executeCommands behave as before.

References

• Jira: AST-180812 (VS Code self-healing / shared login with cx-devassist)
• Used by the VS Code extension change (PR linked from there).

Testing

• New src/tests/ConfigureApiKeyTest.test.ts (5 tests, passing). They do not need the real cx binary or credentials:
  • configureApiKey and clearApiKey send exactly configure set --prop-name cx_apikey --prop-value <value>.
  • executeSensitiveCommands returns the exit code and never puts the output in the log or the result (checked with a child process that prints a secret).
  • Arguments with quotes, commas and spaces reach the process unchanged.
  • A failure to start the binary returns exit code -1.
• tsc and eslint pass on the changed files.
• Not tested against a real cx and tenant: that an empty value actually removes cx_apikey. Please confirm.
• The full suite was not run locally: the existing tests need a real tenant and the LFS cx binaries.