@automattic/vip 4.1.3 → 4.1.4

package/cmd/vip-next/commands/app_debug_test.go

@@ -0,0 +1,89 @@
+package commands
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestAppDeployDebugPhases(t *testing.T) {
+	for _, selector := range []string{"", "@automattic/vip:bin:vip-app-deploy", "@automattic/vip:bin:vip-app-deploy-validate"} {
+		t.Run(selector, func(t *testing.T) {
+			for _, key := range []string{"VIP_PROXY", "vip_proxy", "VIP_USE_SYSTEM_PROXY", "vip_use_system_proxy"} {
+				t.Setenv(key, "")
+			}
+			stub := &deployStub{}
+			out := newDeployCmd(stub, t)
+			t.Setenv("WPVIP_DEPLOY_TOKEN", "private-deploy-token")
+			t.Setenv("DO_NOT_TRACK", "1")
+			var diagnostics bytes.Buffer
+			cmd := AppDeployCmd()
+			cmd.SetOut(out)
+			cmd.SetErr(&diagnostics)
+			cmd.SetContext(debuglog.WithLogger(context.Background(), selector, &diagnostics))
+			_ = cmd.Flags().Set("app", "private-app")
+			_ = cmd.Flags().Set("env", "private-env")
+			_ = cmd.Flags().Set("message", "private-release-description")
+			_ = cmd.Flags().Set("skip-confirmation", "true")
+			archive := deployArchive(t, "private-archive.tar.gz")
+			if err := runAppDeploy(cmd, []string{archive}); err != nil {
+				t.Fatal(err)
+			}
+			want := ""
+			if selector == "@automattic/vip:bin:vip-app-deploy" {
+				want = "@automattic/vip:bin:vip-app-deploy Validating custom deploy key...\n" +
+					"@automattic/vip:bin:vip-app-deploy Validating file...\n" +
+					"@automattic/vip:bin:vip-app-deploy Upload complete. Initiating the deploy.\n"
+			}
+			if diagnostics.String() != want {
+				t.Errorf("diagnostics = %q, want %q", diagnostics.String(), want)
+			}
+			if strings.Contains(out.String(), "Validating") || strings.Contains(out.String(), "Initiating") {
+				t.Errorf("diagnostics leaked to stdout: %q", out.String())
+			}
+		})
+	}
+}
+
+func TestAppDeployDebugMissingKeyStopsBeforeValidation(t *testing.T) {
+	t.Setenv("WPVIP_DEPLOY_TOKEN", "")
+	var diagnostics bytes.Buffer
+	cmd := AppDeployCmd()
+	cmd.SetContext(debuglog.WithLogger(context.Background(), "@automattic/vip:bin:vip-app-deploy", &diagnostics))
+	err := runAppDeploy(cmd, []string{deployArchive(t, "archive.tar.gz")})
+	if err == nil || err.Error() != "Valid custom deploy key is required." {
+		t.Fatalf("error = %v", err)
+	}
+	if got, want := diagnostics.String(), "@automattic/vip:bin:vip-app-deploy Validating custom deploy key...\n"; got != want {
+		t.Errorf("diagnostics = %q, want %q", got, want)
+	}
+}
+
+func TestAppDeployValidateDebug(t *testing.T) {
+	for _, selector := range []string{"", "@automattic/vip:bin:vip-app-deploy-validate", "@automattic/vip:bin:vip-app-deploy"} {
+		t.Run(selector, func(t *testing.T) {
+			t.Setenv("DO_NOT_TRACK", "1")
+			var out, diagnostics bytes.Buffer
+			cmd := AppDeployValidateCmd()
+			cmd.SetOut(&out)
+			cmd.SetErr(&diagnostics)
+			cmd.SetContext(debuglog.WithLogger(context.Background(), selector, &diagnostics))
+			if err := runAppDeployValidate(cmd, []string{deployArchive(t, "private-archive.tar.gz")}); err != nil {
+				t.Fatal(err)
+			}
+			want := ""
+			if selector == "@automattic/vip:bin:vip-app-deploy-validate" {
+				want = "@automattic/vip:bin:vip-app-deploy-validate Validating file...\n"
+			}
+			if diagnostics.String() != want {
+				t.Errorf("diagnostics = %q, want %q", diagnostics.String(), want)
+			}
+			if strings.Contains(out.String(), "Validating file") {
+				t.Errorf("diagnostics leaked to stdout: %q", out.String())
+			}
+		})
+	}
+}

package/cmd/vip-next/commands/app_deploy.go

@@ -13,6 +13,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/customdeploy"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/gql"
 	"github.com/Automattic/vip/internal/tui"
 	"github.com/Automattic/vip/internal/upload"
@@ -97,6 +98,7 @@ func runAppDeploy(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("Unable to access file %s", fileName)
 	}
 
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-app-deploy", "Validating custom deploy key...")
 	deployToken := os.Getenv("WPVIP_DEPLOY_TOKEN")
 	if deployToken == "" {
 		// custom-deploy.ts:33.
@@ -112,6 +114,7 @@ func runAppDeploy(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-app-deploy", "Validating file...")
 	if err := customdeploy.ValidateFile(meta, 0); err != nil {
 		trackEvent("deploy_app_command_error", map[string]any{"error_type": "invalid-file"})
 		return err
@@ -169,6 +172,7 @@ func runAppDeploy(cmd *cobra.Command, args []string) error {
 		_ = pt.StepFailed("upload")
 		return failWithError(err)
 	}
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-app-deploy", "Upload complete. Initiating the deploy.")
 	_ = pt.StepSuccess("upload")
 	trackEvent("deploy_app_upload_complete", nil)
 

package/cmd/vip-next/commands/app_deploy_validate.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/customdeploy"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/upload"
 )
 
@@ -34,6 +35,7 @@ func runAppDeployValidate(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("Unable to access file %s", fileName)
 	}
 
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-app-deploy-validate", "Validating file...")
 	if err := customdeploy.ValidateFile(meta, 0); err != nil {
 		return err
 	}

package/cmd/vip-next/commands/config_debug_test.go

@@ -0,0 +1,137 @@
+package commands
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+// These tests catch missing command diagnostics and accidental logging of
+// environment values, file paths, response objects, or unrelated namespaces.
+func TestConfigEnvvarDebugRequests(t *testing.T) {
+	const secret = "CONFIG_SECRET_SENTINEL"
+	valuePath := filepath.Join(t.TempDir(), "CONFIG_PRIVATE_PATH")
+	if err := os.WriteFile(valuePath, []byte(secret), 0600); err != nil {
+		t.Fatal(err)
+	}
+	for _, tc := range []struct {
+		name     string
+		newCmd   func() *cobra.Command
+		run      func(*cobra.Command) error
+		response string
+		want     string
+	}{
+		{"get", ConfigEnvvarGetCmd, func(c *cobra.Command) error { return runEnvvarGet(c, []string{"my_var"}) }, `{"data":{"app":{"environments":[{"environmentVariables":{"total":1,"nodes":[{"name":"MY_VAR","value":"CONFIG_SECRET_SENTINEL"}]}}]}}}`, `Get environment variable "MY_VAR"`},
+		{"get-all", ConfigEnvvarGetAllCmd, func(c *cobra.Command) error { _, err := runEnvvarGetAll(c, nil); return err }, `{"data":{"app":{"environments":[{"environmentVariables":{"total":1,"nodes":[{"name":"MY_VAR","value":"CONFIG_SECRET_SENTINEL"}]}}]}}}`, "Get all environment variables"},
+		{"list", ConfigEnvvarListCmd, func(c *cobra.Command) error { _, err := runEnvvarList(c, nil); return err }, `{"data":{"app":{"environments":[{"environmentVariables":{"total":1,"nodes":[{"name":"MY_VAR"}]}}]}}}`, "list environment variables"},
+		{"set", ConfigEnvvarSetCmd, func(c *cobra.Command) error {
+			_ = c.Flags().Set("from-file", valuePath)
+			_ = c.Flags().Set("skip-confirmation", "true")
+			return runEnvvarSet(c, []string{"my_var"})
+		}, `{"data":{"addEnvironmentVariable":{"environmentVariables":{"total":1,"nodes":[{"name":"MY_VAR"}]}}}}`, `Set environment variable "MY_VAR"`},
+		{"delete", ConfigEnvvarDeleteCmd, func(c *cobra.Command) error {
+			_ = c.Flags().Set("skip-confirmation", "true")
+			return runEnvvarDelete(c, []string{"my_var"})
+		}, `{"data":{"deleteEnvironmentVariable":{"environmentVariables":{"total":0,"nodes":[]}}}}`, `Delete environment variable "MY_VAR"`},
+	} {
+		for _, selector := range []string{"@automattic/vip:bin:config:envvar", "unrelated", ""} {
+			t.Run(tc.name+"/"+selector, func(t *testing.T) {
+				srv := envvarStubServer(t, tc.response)
+				defer srv.Close()
+				setupEnvvarConfig(srv)
+				defer SetConfig(Config{})
+				cmd := tc.newCmd()
+				var stdout, stderr bytes.Buffer
+				cmd.SetOut(&stdout)
+				cmd.SetErr(&stderr)
+				cmd.SetContext(debuglog.WithLogger(ctxWithAppEnv(42, 7), selector, &stderr))
+				if err := tc.run(cmd); err != nil {
+					t.Fatal(err)
+				}
+				if selector == "@automattic/vip:bin:config:envvar" {
+					for _, want := range []string{selector, "Request: " + tc.want, "app_id=42", "env_id=7"} {
+						if !strings.Contains(stderr.String(), want) {
+							t.Errorf("missing %q in diagnostics %q", want, stderr.String())
+						}
+					}
+				} else if stderr.Len() != 0 {
+					t.Errorf("unselected diagnostics: %q", stderr.String())
+				}
+				for _, private := range []string{secret, valuePath, srv.URL} {
+					if strings.Contains(stderr.String(), private) {
+						t.Errorf("private data in diagnostics: %q", stderr.String())
+					}
+				}
+				if strings.Contains(stdout.String(), "@automattic/vip:") {
+					t.Errorf("diagnostics polluted stdout: %q", stdout.String())
+				}
+				if tc.name == "get" && strings.TrimSpace(stdout.String()) != secret {
+					t.Errorf("get stdout changed: %q", stdout.String())
+				}
+			})
+		}
+	}
+}
+
+func TestConfigSoftwareDebugSummaries(t *testing.T) {
+	const namespace = "@automattic/vip:bin:config-software"
+	for _, tc := range []struct {
+		name      string
+		responses []string
+		want      []string
+		wantError bool
+	}{
+		{"success", []string{softwareUpdateSettingsBody, softwareUpdateMutationOKBody, jobInProgress, jobSuccess}, []string{"Triggering update", "component=wordpress", "app_id=1", "env_id=2", "Triggered update with result: success", "Getting update result", "Latest job result: present=true in_progress=true", "Sleep for", "Latest job result: present=true in_progress=false"}, false},
+		{"no-job", []string{softwareUpdateSettingsBody, softwareUpdateMutationOKBody, `{"data":{"app":{"environments":[{"jobs":[]}]}}}`}, []string{"Latest job result: present=false"}, false},
+		{"failure", []string{softwareUpdateSettingsBody, `{"errors":[{"message":"CONFIG_SECRET_SENTINEL https://private.invalid/secret"}]}`}, []string{"Triggering update"}, true},
+		{"failed-job", []string{softwareUpdateSettingsBody, softwareUpdateMutationOKBody, strings.ReplaceAll(jobFailed, "Apply", "CONFIG_SECRET_SENTINEL")}, []string{"Latest job result: present=true in_progress=false"}, true},
+	} {
+		for _, selector := range []string{namespace, "unrelated", ""} {
+			t.Run(tc.name+"/"+selector, func(t *testing.T) {
+				seq := &softwareUpdateSequence{responses: tc.responses}
+				srv := seq.start(t)
+				setupSoftwareUpdateConfig(srv)
+				defer SetConfig(Config{})
+				oldInterval := softwareUpdatePollInterval
+				softwareUpdatePollInterval = time.Millisecond
+				defer func() { softwareUpdatePollInterval = oldInterval }()
+				cmd := ConfigSoftwareUpdateCmd()
+				_ = cmd.Flags().Set("yes", "true")
+				var stdout, stderr bytes.Buffer
+				cmd.SetOut(&stdout)
+				cmd.SetErr(&stderr)
+				ctx := appctx.WithAppEnv(ctxWithAppEnv(1, 2), ctxWithAppEnvTyped(1, 2, 2))
+				cmd.SetContext(debuglog.WithLogger(ctx, selector, &stderr))
+				err := runConfigSoftwareUpdate(cmd, []string{"wordpress", "6.4"})
+				if (err != nil) != tc.wantError {
+					t.Fatalf("unexpected error: %v", err)
+				}
+				if selector == namespace {
+					for _, want := range append([]string{namespace}, tc.want...) {
+						if !strings.Contains(stderr.String(), want) {
+							t.Errorf("missing %q in diagnostics %q", want, stderr.String())
+						}
+					}
+				} else if stderr.Len() != 0 {
+					t.Errorf("unselected diagnostics: %q", stderr.String())
+				}
+				for _, private := range []string{"CONFIG_SECRET_SENTINEL", "https://", srv.URL, "{", "}"} {
+					if strings.Contains(stderr.String(), private) {
+						t.Errorf("raw response data in diagnostics: %q", stderr.String())
+					}
+				}
+				if strings.Contains(stdout.String(), namespace) {
+					t.Errorf("diagnostics polluted stdout: %q", stdout.String())
+				}
+			})
+		}
+	}
+}

package/cmd/vip-next/commands/config_envvar_delete.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/envvar"
 	"github.com/Automattic/vip/internal/exit"
 )
@@ -76,6 +77,7 @@ func runEnvvarDelete(cmd *cobra.Command, args []string) error {
 		}
 	}
 
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Request: Delete environment variable %q for app_id=%d env_id=%d", name, ae.App.ID, ae.Env.ID)
 	if err := envvar.ValidateName(name); err != nil {
 		fmt.Fprintln(cmd.OutOrStdout(), color.RedString(err.Error()))
 		trackEvent("envvar_delete_command_error", map[string]any{"error": "invalid_name"})

package/cmd/vip-next/commands/config_envvar_get.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/envvar"
 )
 
@@ -50,6 +51,7 @@ func runEnvvarGet(cmd *cobra.Command, args []string) error {
 		return errors.New("appctx not set; this is a wiring bug")
 	}
 	cfg := GetConfig()
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Request: Get environment variable %q for app_id=%d env_id=%d", name, ae.App.ID, ae.Env.ID)
 
 	trackEvent("envvar_get_command_execute", map[string]any{"variable_name": name})
 	v, err := envvar.Get(cmd.Context(), cfg.GQLClient, ae.App.ID, ae.Env.ID, name)

package/cmd/vip-next/commands/config_envvar_get_all.go

@@ -8,6 +8,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/envvar"
 	"github.com/Automattic/vip/internal/output"
 )
@@ -33,6 +34,7 @@ func runEnvvarGetAll(cmd *cobra.Command, args []string) (any, error) {
 		return nil, errors.New("appctx not set; this is a wiring bug")
 	}
 	cfg := GetConfig()
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Request: Get all environment variables for app_id=%d env_id=%d", ae.App.ID, ae.Env.ID)
 	trackEvent("envvar_get_all_command_execute", nil)
 	vars, err := envvar.GetAll(cmd.Context(), cfg.GQLClient, ae.App.ID, ae.Env.ID)
 	if err != nil {

package/cmd/vip-next/commands/config_envvar_list.go

@@ -8,6 +8,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/envvar"
 	"github.com/Automattic/vip/internal/output"
 )
@@ -33,6 +34,7 @@ func runEnvvarList(cmd *cobra.Command, args []string) (any, error) {
 		return nil, errors.New("appctx not set; this is a wiring bug")
 	}
 	cfg := GetConfig()
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Request: list environment variables for app_id=%d env_id=%d", ae.App.ID, ae.Env.ID)
 	trackEvent("envvar_list_command_execute", nil)
 	names, err := envvar.List(cmd.Context(), cfg.GQLClient, ae.App.ID, ae.Env.ID)
 	if err != nil {

package/cmd/vip-next/commands/config_envvar_set.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/envvar"
 	"github.com/Automattic/vip/internal/exit"
 )
@@ -75,6 +76,7 @@ func runEnvvarSet(cmd *cobra.Command, args []string) error {
 	}
 
 	// Validate name (Node parity: validateName, then NEW_RELIC block).
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Request: Set environment variable %q for app_id=%d env_id=%d", name, ae.App.ID, ae.Env.ID)
 	if err := envvar.ValidateName(name); err != nil {
 		fmt.Fprintln(cmd.OutOrStdout(), color.RedString(err.Error()))
 		trackEvent("envvar_set_command_error", map[string]any{"error": "invalid_name"})

package/cmd/vip-next/commands/config_software_update.go

@@ -18,6 +18,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/gql"
 	"github.com/Automattic/vip/internal/softwaresettings"
 )
@@ -126,6 +127,7 @@ func runConfigSoftwareUpdate(cmd *cobra.Command, args []string) error {
 	}
 
 	// Fire the mutation.
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Triggering update: app_id=%d env_id=%d component=%s version=%s", ae.App.ID, ae.Env.ID, resolvedComponent, resolvedVersion)
 	_, err = gql.UpdateSoftwareSettings(cmd.Context(), cfg.GQLClient, ae.App.ID, ae.Env.ID, resolvedComponent, resolvedVersion)
 	if err != nil {
 		trackEvent("config_software_update_error", map[string]any{"error": err.Error()})
@@ -133,6 +135,7 @@ func runConfigSoftwareUpdate(cmd *cobra.Command, args []string) error {
 	}
 
 	trackEvent("config_software_update_mutation_success", nil)
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Triggered update with result: success")
 
 	// Poll until the update job completes.
 	if err := pollSoftwareUpdateJob(cmd, cfg, ae); err != nil {
@@ -160,6 +163,7 @@ type jobIface = gql.SoftwareUpdateJobAppEnvironmentsAppEnvironmentJobsJobInterfa
 //   - success when no job or progress.status == "success"
 //   - failure: find a step with status "failed" → "Failed during step: <name>" else "Software update failed"
 func pollSoftwareUpdateJob(cmd *cobra.Command, cfg Config, ae *appctx.AppEnv) error {
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Getting update result: app_id=%d env_id=%d", ae.App.ID, ae.Env.ID)
 	for {
 		resp, err := gql.SoftwareUpdateJob(cmd.Context(), cfg.GQLClient, ae.App.ID, ae.Env.ID)
 		if err != nil {
@@ -168,11 +172,13 @@ func pollSoftwareUpdateJob(cmd *cobra.Command, cfg Config, ae *appctx.AppEnv) er
 
 		// Navigate to jobs.
 		if resp.App == nil || len(resp.App.Environments) == 0 || resp.App.Environments[0] == nil {
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Latest job result: present=false")
 			// No environment data → treat as success (job gone).
 			return nil
 		}
 		jobs := resp.App.Environments[0].GetJobs()
 		if len(jobs) == 0 {
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Latest job result: present=false")
 			// No jobs → update complete (Node parity: "no job" = success).
 			return nil
 		}
@@ -200,12 +206,16 @@ func pollSoftwareUpdateJob(cmd *cobra.Command, cfg Config, ae *appctx.AppEnv) er
 			}
 		}
 		if latestPtr == nil || *latestPtr == nil {
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Latest job result: present=false")
 			return nil
 		}
 		latest := *latestPtr
+		lock := latest.GetInProgressLock()
+		debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Latest job result: present=true in_progress=%t", lock != nil && *lock)
 
 		// Still in-progress → wait and retry.
-		if lock := latest.GetInProgressLock(); lock != nil && *lock {
+		if lock != nil && *lock {
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Sleep for %s", softwareUpdatePollInterval)
 			time.Sleep(softwareUpdatePollInterval)
 			continue
 		}
@@ -232,6 +242,7 @@ func pollSoftwareUpdateJob(cmd *cobra.Command, cfg Config, ae *appctx.AppEnv) er
 		// arrives with inProgressLock=false. That is a hang risk, not a silent
 		// success — and this loop has no 6 h poll.Timeout ceiling either.
 		if status != "" && status != "failed" {
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config-software", "Sleep for %s", softwareUpdatePollInterval)
 			time.Sleep(softwareUpdatePollInterval)
 			continue
 		}

package/cmd/vip-next/commands/devenv_create_test.go

@@ -21,8 +21,8 @@ func TestResolveCreateConfigNonInteractiveDefaults(t *testing.T) {
 	if cfg.MultisiteMode != "" {
 		t.Fatalf("MultisiteMode default = %q, want single site", cfg.MultisiteMode)
 	}
-	if cfg.PHP != "" {
-		t.Fatalf("PHP default = %q, want empty (NewView resolves to recommended)", cfg.PHP)
+	if cfg.PHP != "8.4" {
+		t.Fatalf("PHP default = %q, want 8.4", cfg.PHP)
 	}
 	if cfg.PHPMyAdmin || cfg.Xdebug || cfg.Mailpit || cfg.Photon || cfg.Elasticsearch {
 		t.Fatalf("service toggles should default off: %+v", cfg)
@@ -235,13 +235,13 @@ func TestResolveCreateConfigFlagsWin(t *testing.T) {
 }
 
 func TestPHPVersionForLabel(t *testing.T) {
-	if phpVersionForLabel("8.2 (recommended)") != "8.2" {
-		t.Fatal("recommended label should map to 8.2")
+	if phpVersionForLabel("8.4 (recommended)") != "8.4" {
+		t.Fatal("recommended label should map to 8.4")
 	}
 	if phpVersionForLabel("8.5 (experimental)") != "8.5" {
 		t.Fatal("experimental label should map to 8.5")
 	}
-	if phpVersionForLabel("8.4") != "8.4" {
+	if phpVersionForLabel("8.2") != "8.2" {
 		t.Fatal("plain label should map to its version")
 	}
 }

package/cmd/vip-next/commands/devenv_debug_test.go

@@ -0,0 +1,34 @@
+package commands
+
+import (
+	"bytes"
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestDevEnvEnvvarDebugDoesNotLeakValue(t *testing.T) {
+	seedEnvvarEnv(t)
+	for _, ns := range []string{"@automattic/vip:bin:config:envvar", "@automattic/vip:bin:dev-environment"} {
+		var out, diagnostic bytes.Buffer
+		cmd := newDevEnvEnvvarCmd()
+		cmd.SetOut(&out)
+		cmd.SetErr(&out)
+		cmd.SetContext(debuglog.WithLogger(context.Background(), ns, &diagnostic))
+		cmd.SetArgs([]string{"set", "PASSWORD", "secret-env-value", "--slug", "only-one"})
+		if err := cmd.Execute(); err != nil {
+			t.Fatal(err)
+		}
+		if ns == "@automattic/vip:bin:config:envvar" && (!strings.Contains(diagnostic.String(), "set") || !strings.Contains(diagnostic.String(), "PASSWORD")) {
+			t.Fatalf("missing envvar diagnostic: %s", &diagnostic)
+		}
+		if strings.Contains(diagnostic.String(), "secret-env-value") {
+			t.Fatalf("secret in diagnostics: %s", &diagnostic)
+		}
+		if strings.Contains(out.String(), "@automattic") {
+			t.Fatalf("debug contaminated stdout: %s", &out)
+		}
+	}
+}

package/cmd/vip-next/commands/devenv_envvar.go

@@ -9,6 +9,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/devenv"
 	"github.com/Automattic/vip/internal/envvar"
 	"github.com/Automattic/vip/internal/output"
@@ -37,6 +38,7 @@ func envvarGetCmd() *cobra.Command {
 			}
 			// Node trims but does NOT validate here (vip-dev-env-envvar-get.js:33).
 			name := strings.TrimSpace(args[0])
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Will get variable %q for environment %q", name, slug)
 			v, ok, err := devenv.EnvVarGet(slug, name)
 			if err != nil {
 				return err
@@ -59,6 +61,7 @@ func envvarGetAllCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Will get all variables for environment %q", slug)
 			all, err := devenv.EnvVarGetAll(slug)
 			if err != nil {
 				return err
@@ -83,6 +86,7 @@ func envvarListCmd() *cobra.Command {
 			if err != nil {
 				return err
 			}
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Will list variable names for environment %q", slug)
 			names, err := devenv.EnvVarList(slug)
 			if err != nil {
 				return err
@@ -117,6 +121,7 @@ func envvarSetCmd() *cobra.Command {
 			if err := envvar.ValidateName(name); err != nil {
 				return err
 			}
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Will set variable %q for environment %q: fromFile=%t", name, slug, fromFile != "")
 			var value string
 			switch {
 			case len(args) == 2:
@@ -156,6 +161,7 @@ func envvarDeleteCmd() *cobra.Command {
 			}
 			// Node trims but does NOT validate here (vip-dev-env-envvar-delete.js:32).
 			name := strings.TrimSpace(args[0])
+			debuglog.Printf(cmd.Context(), "@automattic/vip:bin:config:envvar", "Will delete variable %q for environment %q", name, slug)
 			removed, err := devenv.EnvVarDelete(slug, name)
 			if err != nil {
 				return err

package/cmd/vip-next/commands/devenv_lifecycle.go

@@ -152,16 +152,24 @@ const devEnvWizardIntro = "This is a wizard to help you set up your local dev en
 	"matching flags (or --non-interactive) to skip the wizard, and use --slug to\n" +
 	"create multiple environments with different settings.\n\n"
 
-// devEnvPHPChoices are the offered PHP versions with Node's labels
+// devEnvPHPChoices are the offered PHP versions with Node's base labels
 // (DEV_ENVIRONMENT_PHP_VERSIONS); the value is the bare version, which NewView
-// resolves to the php-fpm image. The first entry is the recommended default.
+// resolves to the php-fpm image. phpChoiceLabel marks the configured default as
+// recommended without depending on list order.
 var devEnvPHPChoices = []struct{ Label, Version string }{
-	{"8.2 (recommended)", "8.2"},
+	{"8.2", "8.2"},
 	{"8.3", "8.3"},
 	{"8.4", "8.4"},
 	{"8.5 (experimental)", "8.5"},
 }
 
+func phpChoiceLabel(label, version string) string {
+	if version == compose.DefaultPHPVersion {
+		return label + " (recommended)"
+	}
+	return label
+}
+
 // validatePHPVersion ports resolvePhpVersion's rejection
 // (dev-environment-cli.ts:778-782): an unsupported version must fail BEFORE the
 // environment is written, otherwise a typo only surfaces later as an opaque
@@ -188,7 +196,7 @@ func validatePHPVersion(php string) error {
 func phpLabels() []string {
 	labels := make([]string, len(devEnvPHPChoices))
 	for i, c := range devEnvPHPChoices {
-		labels[i] = c.Label
+		labels[i] = phpChoiceLabel(c.Label, c.Version)
 	}
 	return labels
 }
@@ -196,7 +204,7 @@ func phpLabels() []string {
 // phpVersionForLabel maps a wizard PHP label back to its bare version.
 func phpVersionForLabel(label string) string {
 	for _, c := range devEnvPHPChoices {
-		if c.Label == label {
+		if phpChoiceLabel(c.Label, c.Version) == label {
 			return c.Version
 		}
 	}
@@ -208,12 +216,19 @@ func phpVersionForLabel(label string) string {
 func phpLabelForVersion(version string) string {
 	for _, c := range devEnvPHPChoices {
 		if c.Version == version {
-			return c.Label
+			return phpChoiceLabel(c.Label, c.Version)
 		}
 	}
 	return ""
 }
 
+func phpDefaultLabel(version string) string {
+	if version == "" {
+		version = compose.DefaultPHPVersion
+	}
+	return phpLabelForVersion(version)
+}
+
 // selectWithDefault prompts with options, moving dflt to the front so it is the
 // pre-selected default when present; otherwise the first option is the default.
 func selectWithDefault(cmd *cobra.Command, message string, options []string, dflt string) (string, error) {
@@ -441,22 +456,26 @@ func resolveCreateConfig(cmd *cobra.Command, defaults *createDefaults) (devenv.C
 		cfg.MultisiteMode = normalizeMultisite(msDefaultChoice)
 	}
 
-	// php (default from the app env, else recommended; empty => NewView resolves
-	// to php-fpm:8.2). The wizard lists the versions with Node's
-	// recommended/experimental labels, pre-selecting the app's version.
+	// php (default from the app env, else recommended). The wizard lists the
+	// versions with Node's recommended/experimental labels, pre-selecting the
+	// app's version.
+	phpDefaultVersion := d.PHP
+	if phpDefaultVersion == "" {
+		phpDefaultVersion = compose.DefaultPHPVersion
+	}
 	if f.Changed("php") {
 		cfg.PHP, _ = f.GetString("php")
 		if err := validatePHPVersion(cfg.PHP); err != nil {
 			return cfg, err
 		}
 	} else if interactive {
-		sel, err := selectWithDefault(cmd, "PHP version", phpLabels(), phpLabelForVersion(d.PHP))
+		sel, err := selectWithDefault(cmd, "PHP version", phpLabels(), phpDefaultLabel(d.PHP))
 		if err != nil {
 			return cfg, err
 		}
 		cfg.PHP = phpVersionForLabel(sel)
 	} else {
-		cfg.PHP = d.PHP
+		cfg.PHP = phpDefaultVersion
 	}
 
 	// wordpress (default from the app env, else trunk; empty => NewView resolves

package/cmd/vip-next/commands/devenv_update.go

@@ -77,7 +77,7 @@ func resolveUpdateConfig(cmd *cobra.Command, cur *instancedata.InstanceData) (de
 		v, _ := f.GetString("php")
 		c.PHP = &v
 	} else if interactive {
-		sel, err := selectWithDefault(cmd, "PHP version", phpLabels(), phpLabelForVersion(currentPHPVersion(cur)))
+		sel, err := selectWithDefault(cmd, "PHP version", phpLabels(), phpDefaultLabel(currentPHPVersion(cur)))
 		if err != nil {
 			return c, err
 		}