@automattic/vip 4.1.3 → 4.1.4

package/cmd/vip-next/commands/devenv_update_test.go

@@ -59,14 +59,40 @@ func TestCurrentPHPVersion(t *testing.T) {
 }
 
 func TestPHPLabelForVersion(t *testing.T) {
-	if phpLabelForVersion("8.2") != "8.2 (recommended)" {
-		t.Fatal("8.2 should map to the recommended label")
+	if phpLabelForVersion("8.4") != "8.4 (recommended)" {
+		t.Fatal("8.4 should map to the recommended label")
+	}
+	if phpLabelForVersion("8.2") != "8.2" {
+		t.Fatal("8.2 should map to its plain label")
 	}
 	if phpLabelForVersion("9.9") != "" {
 		t.Fatal("unknown version should map to empty")
 	}
 }
 
+func TestPHPDefaultLabelUsesRecommendedVersionWhenCurrentVersionIsMissing(t *testing.T) {
+	if got := phpDefaultLabel(""); got != "8.4 (recommended)" {
+		t.Fatalf("phpDefaultLabel(\"\") = %q, want 8.4 (recommended)", got)
+	}
+	if got := phpDefaultLabel("8.2"); got != "8.2" {
+		t.Fatalf("phpDefaultLabel(\"8.2\") = %q, want 8.2", got)
+	}
+}
+
+func TestPHPDefaultSelectionUsesRecommendedVersion(t *testing.T) {
+	t.Setenv("VIP_NON_INTERACTIVE", "1")
+	got, err := selectWithDefault(&cobra.Command{}, "PHP version", phpLabels(), phpDefaultLabel(""))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "8.4 (recommended)" {
+		t.Fatalf("default PHP selection = %q, want 8.4 (recommended)", got)
+	}
+	if version := phpVersionForLabel(got); version != "8.4" {
+		t.Fatalf("selected PHP version = %q, want 8.4", version)
+	}
+}
+
 func TestRawTruthy(t *testing.T) {
 	if !rawTruthy(json.RawMessage("true")) {
 		t.Fatal("true should be truthy")

package/cmd/vip-next/commands/import_debug_test.go

@@ -0,0 +1,110 @@
+package commands
+
+import (
+	"bytes"
+	"io"
+	"strings"
+	"testing"
+
+	"github.com/Khan/genqlient/graphql"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestImportSQLDebugSafeRemoteSummary(t *testing.T) {
+	stub := &importStub{}
+	srv := stub.start(t)
+	SetConfig(Config{GQLClient: graphql.NewClient(srv.URL+"/graphql", srv.Client()), APIHost: srv.URL, Token: "TOKEN_SECRET"})
+	defer SetConfig(Config{})
+	t.Setenv("VIP_IMPORT_SQL_INTERVAL_MS", "1")
+	restore := stubImportPrompts("EXAMPLE.COM", true)
+	defer restore()
+	cmd := ImportSQLCmd()
+	var logs bytes.Buffer
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	cmd.SetContext(debuglog.WithLogger(importCtx(42, 7, 2), "@automattic/vip:bin:vip-import-sql", &logs))
+	_ = cmd.Flags().Set("header", "Authorization: HEADER_SECRET")
+	_ = cmd.Flags().Set("search-replace", "FROM_SECRET,TO_SECRET")
+	if err := runImportSQL(cmd, []string{"https://URL_SECRET.example/dump.sql?token=QUERY_SECRET"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"remote=true", "headers=1", "replacements=1", "Import queued"} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("missing %q in %s", want, &logs)
+		}
+	}
+	for _, secret := range []string{"TOKEN_SECRET", "HEADER_SECRET", "FROM_SECRET", "TO_SECRET", "URL_SECRET", "QUERY_SECRET"} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}
+
+func TestImportSQLDebugValidation(t *testing.T) {
+	for _, skip := range []bool{false, true} {
+		t.Run(map[bool]string{false: "validate", true: "skip"}[skip], func(t *testing.T) {
+			cmd := ImportSQLCmd()
+			var logs bytes.Buffer
+			cmd.SetOut(io.Discard)
+			cmd.SetContext(debuglog.WithLogger(importCtx(42, 7, 2), "*", &logs))
+			path := writeTempSQL(t, cleanWPDump)
+			if _, err := validateAndGetTableNames(cmd, nil, 42, 7, path, skip, nil, false); err != nil {
+				t.Fatal(err)
+			}
+			want := "target_multisite=false dump_multisite=false"
+			if skip {
+				want = "Validation was skipped"
+			}
+			if !strings.Contains(logs.String(), want) {
+				t.Errorf("missing %q in %s", want, &logs)
+			}
+			if strings.Contains(logs.String(), path) || strings.Contains(logs.String(), "wp_posts") {
+				t.Errorf("file data leaked: %s", &logs)
+			}
+		})
+	}
+}
+
+func TestImportMediaDebugSafeRemoteSummary(t *testing.T) {
+	stub := &mediaStub{progressBodies: []string{mediaProgress("COMPLETED", 1, 1, "")}}
+	setupMediaTest(t, stub)
+	cmd := ImportMediaCmd()
+	var logs bytes.Buffer
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	cmd.SetContext(debuglog.WithLogger(importCtx(42, 7, 2), "vip:vip-import-media", &logs))
+	if err := runImportMedia(cmd, []string{"https://URL_SECRET.example/up.zip?token=QUERY_SECRET"}); err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{"local=false", "Import queued"} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("missing %q in %s", want, &logs)
+		}
+	}
+	for _, secret := range []string{"URL_SECRET", "QUERY_SECRET"} {
+		if strings.Contains(logs.String(), secret) {
+			t.Errorf("leaked %q", secret)
+		}
+	}
+}
+
+func TestImportValidationDebugSilence(t *testing.T) {
+	for _, namespace := range []string{"", "vip:unrelated"} {
+		t.Run(namespace, func(t *testing.T) {
+			cmd := ImportSQLCmd()
+			var logs, stdout bytes.Buffer
+			cmd.SetOut(&stdout)
+			cmd.SetContext(debuglog.WithLogger(importCtx(42, 7, 2), namespace, &logs))
+			if _, err := validateAndGetTableNames(cmd, nil, 42, 7, "UNREAD_PATH_SECRET", true, nil, false); err != nil {
+				t.Fatal(err)
+			}
+			if logs.Len() != 0 {
+				t.Errorf("unexpected diagnostics: %s", &logs)
+			}
+			if stdout.String() != "Skipping SQL file validation.\n" {
+				t.Errorf("changed stdout: %q", stdout.String())
+			}
+		})
+	}
+}

package/cmd/vip-next/commands/import_media.go

@@ -18,6 +18,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/gql"
 	"github.com/Automattic/vip/internal/httpproxy"
 	"github.com/Automattic/vip/internal/mediaimport"
@@ -136,6 +137,7 @@ func runImportMedia(cmd *cobra.Command, args []string) error {
 			return err
 		}
 		fmt.Fprint(out, "\n")
+		debuglog.Printf(cmd.Context(), "vip:vip-import-media", "Upload complete: bytes=%d", res.Meta.FileSize)
 
 		pre, err := uc.GetSignedUploadRequestData(cmd.Context(), upload.SignedRequestArgs{
 			Action: "GetObject", AppID: ae.App.ID, EnvID: ae.Env.ID, BaseName: res.Meta.BaseName,
@@ -146,6 +148,7 @@ func runImportMedia(cmd *cobra.Command, args []string) error {
 		archiveURL = pre.URL
 	}
 
+	debuglog.Printf(cmd.Context(), "vip:vip-import-media", "Options: local=%t overwrite_existing=%t import_intermediate_images=%t", sourceIsLocal, overwriteExistingFiles, importIntermediateImages)
 	trackEvent("import_media_start_execute", nil)
 
 	tracker := mediaimport.NewTracker()
@@ -181,6 +184,7 @@ func runImportMedia(cmd *cobra.Command, args []string) error {
 		return nil
 	}
 
+	debuglog.Printf(cmd.Context(), "vip:vip-import-media", "Import queued")
 	return mediaImportCheckStatusCmd(cmd, tracker, ae, exportJSON, saveErrorLog)
 }
 

package/cmd/vip-next/commands/import_sql.go

@@ -18,6 +18,7 @@ import (
 	"golang.org/x/term"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/gql"
 	"github.com/Automattic/vip/internal/searchreplace"
 	"github.com/Automattic/vip/internal/siteimport"
@@ -343,6 +344,7 @@ func importSQLGates(g gateInput) error {
 func validateAndGetTableNames(cmd *cobra.Command, client graphql.Client, appID, envID int64, fileName string, skipValidate bool, searchReplace []string, isMultiSite bool) ([]string, error) {
 	out := cmd.OutOrStdout()
 	if skipValidate {
+		debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-import-sql", "Validation was skipped. No playbook information will be displayed.")
 		fmt.Fprintln(out, "Skipping SQL file validation.")
 		return []string{}, nil
 	}
@@ -359,6 +361,7 @@ func validateAndGetTableNames(cmd *cobra.Command, client graphql.Client, appID,
 	wpSiteCapture := siteimport.NewMultilineCapture("INSERT INTO `wp_site`")
 	var wpSiteStatements [][]string
 	ticker := newImportLineTicker(out, isTerminalWriter(out))
+	debuglog.Printf(cmd.Context(), "vip:validations:line-by-line", "Validations: static SQL checks and site type")
 	res, scanErr := sqlvalidation.ValidateWithLineHook(f, func(line string, lineNum int) {
 		if lineNum%500 == 0 {
 			ticker.tick(lineNum) // sql.ts:533 trailing space
@@ -370,6 +373,7 @@ func validateAndGetTableNames(cmd *cobra.Command, client graphql.Client, appID,
 		return nil, fmt.Errorf("Error validating input file: %s", scanErr)
 	}
 	isMultiSiteSqlDump := res.IsMultiSite
+	debuglog.Printf(cmd.Context(), "vip:vip-import-sql", "Site type: target_multisite=%t dump_multisite=%t", isMultiSite, isMultiSiteSqlDump)
 
 	// Static-validation report (import mode): problems throw with the
 	// joined error output + --skip-validate advice (vip-import-sql.js:436).
@@ -744,6 +748,8 @@ func runImportSQL(cmd *cobra.Command, args []string) error {
 		output = ""
 	}
 
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-import-sql", "Options: remote=%t skip_validate=%t skip_backup=%t headers=%d replacements=%d", isURL, skipValidate, skipBackup, len(headers), len(searchReplace))
+
 	trackEvent("import_sql_command_execute", map[string]any{"is_url": isURL})
 
 	if err := importSQLGates(gateInput{
@@ -831,7 +837,7 @@ func runImportSQL(cmd *cobra.Command, args []string) error {
 	switch {
 	case localSearchReplaceNeeded(isURL, inPlace, output, searchReplace):
 		_ = pt.StepRunning("replace")
-		res, srErr := searchreplace.Run(fileNameOrURL, searchReplace, searchreplace.Options{
+		res, srErr := searchreplace.RunContext(cmd.Context(), fileNameOrURL, searchReplace, searchreplace.Options{
 			InPlace: inPlace, Output: output,
 		})
 		if srErr != nil {
@@ -902,6 +908,7 @@ func runImportSQL(cmd *cobra.Command, args []string) error {
 		input.Md5 = &checksum
 		input.SearchReplace = []*gql.AppEnvironmentImportSearchReplace{}
 		_ = pt.StepSuccess("upload")
+		debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-import-sql", "Upload complete. Initiating the import.")
 		trackEvent("import_sql_upload_complete", nil)
 	}
 
@@ -917,6 +924,7 @@ func runImportSQL(cmd *cobra.Command, args []string) error {
 		_ = pt.StepFailed("queue_import")
 		return failWithError(fmt.Errorf("StartImport call failed: %s", err))
 	}
+	debuglog.Printf(cmd.Context(), "@automattic/vip:bin:vip-import-sql", "Import queued")
 	_ = pt.StepSuccess("queue_import")
 
 	return importSQLCheckStatus(cmd, pt, renderer, ae, domain, false)

package/cmd/vip-next/commands/logout.go

@@ -27,7 +27,7 @@ func LogoutCmd() *cobra.Command {
 			store := auth.NewStore(k)
 
 			if raw, err := store.LoadPrimary(); err == nil && raw != "" {
-				_ = auth.PostLogout(cfg.APIHost, raw)
+				_ = auth.PostLogoutContext(cmd.Context(), cfg.APIHost, raw)
 			}
 			if err := store.Delete(); err != nil && !errors.Is(err, auth.ErrNoToken) {
 				return err

package/cmd/vip-next/commands/searchreplace.go

@@ -8,6 +8,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/searchreplace"
 )
 
@@ -45,7 +46,7 @@ func SearchReplaceCmd() *cobra.Command {
 					return nil
 				}
 			}
-			res, err := searchreplace.Run(args[0], pairs, searchreplace.Options{InPlace: inPlace, Output: output})
+			res, err := searchreplace.RunContext(cmd.Context(), args[0], pairs, searchreplace.Options{InPlace: inPlace, Output: output})
 			if err != nil {
 				return err
 			}
@@ -53,6 +54,7 @@ func SearchReplaceCmd() *cobra.Command {
 			// file to stdout and remove the temp file (Node: "output to STDOUT by
 			// default").
 			if !inPlace && output == "" {
+				debuglog.Printf(cmd.Context(), "@automattic/vip:lib:search-and-replace", "input=file output=stdout")
 				f, err := os.Open(res.OutputFileName)
 				if err != nil {
 					return err

package/cmd/vip-next/commands/searchreplace_debug_test.go

@@ -0,0 +1,82 @@
+package commands
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestSearchReplaceDiagnosticsKeepSQLOutputSeparate(t *testing.T) {
+	const namespace = "@automattic/vip:lib:search-and-replace"
+	for _, tc := range []struct {
+		name, selector      string
+		fileOutput, enabled bool
+	}{
+		{name: "disabled"},
+		{name: "library stdout", selector: namespace, enabled: true},
+		{name: "library file", selector: namespace, fileOutput: true, enabled: true},
+		{name: "wildcard", selector: "@automattic/vip:*", enabled: true},
+		{name: "excluded", selector: "*,-" + namespace},
+		{name: "unsafe bin omitted", selector: "@automattic/vip:bin:vip-search-replace"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv("VIP_SEARCH_REPLACE_BIN", fakeSearchReplaceBinary(t))
+			dir := t.TempDir()
+			input := filepath.Join(dir, "sensitive-input.sql")
+			output := filepath.Join(dir, "sensitive-output.sql")
+			if err := os.WriteFile(input, []byte("private_sql_payload\n"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			var stdout, diagnostics bytes.Buffer
+			cmd := SearchReplaceCmd()
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&diagnostics)
+			cmd.SetContext(debuglog.WithLogger(context.Background(), tc.selector, &diagnostics))
+			args := []string{input, "--search-replace=https://private-user:private-password@example.test,private-replacement"}
+			if tc.fileOutput {
+				args = append(args, "--output="+output)
+			}
+			cmd.SetArgs(args)
+			if err := cmd.Execute(); err != nil {
+				t.Fatal(err)
+			}
+			if tc.fileOutput {
+				got, err := os.ReadFile(output)
+				if err != nil || string(got) != "PRIVATE_SQL_PAYLOAD\n" || stdout.Len() != 0 {
+					t.Fatalf("file output=%q stdout=%q err=%v", got, stdout.String(), err)
+				}
+			} else if stdout.String() != "PRIVATE_SQL_PAYLOAD\n" {
+				t.Fatalf("SQL stdout contaminated: %q", stdout.String())
+			}
+			log := diagnostics.String()
+			if !tc.enabled {
+				if log != "" {
+					t.Fatalf("unexpected diagnostics: %q", log)
+				}
+				return
+			}
+			for _, want := range []string{namespace, "input=file", "stage=completed"} {
+				if !strings.Contains(log, want) {
+					t.Errorf("missing %q in %q", want, log)
+				}
+			}
+			route := "output=stdout"
+			if tc.fileOutput {
+				route = "output=file"
+			}
+			if !strings.Contains(log, route) {
+				t.Errorf("missing route %q in %q", route, log)
+			}
+			for _, secret := range []string{dir, "sensitive-input", "sensitive-output", "private-user", "private-password", "private-replacement", "example.test", "private_sql_payload", "PRIVATE_SQL_PAYLOAD", "--search-replace"} {
+				if strings.Contains(log, secret) {
+					t.Errorf("diagnostics expose %q: %q", secret, log)
+				}
+			}
+		})
+	}
+}

package/cmd/vip-next/commands/whoami.go

@@ -1,6 +1,7 @@
 package commands
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -58,6 +59,9 @@ func GetConfig() Config { return pkgConfig }
 const meQuery = `{"operationName":"Me","query":"query Me {\n  me {\n    id\n    displayName\n    isVIP\n  }\n}"}`
 
 type WhoamiDeps struct {
+	// Context carries invocation-scoped diagnostics and cancellation. Nil uses
+	// context.Background for callers predating command context propagation.
+	Context context.Context
 	APIHost string
 	Token   string
 	Client  *gql.Client
@@ -65,6 +69,9 @@ type WhoamiDeps struct {
 }
 
 func RunWhoami(deps WhoamiDeps) error {
+	if deps.Context == nil {
+		deps.Context = context.Background()
+	}
 	if deps.Stdout == nil {
 		deps.Stdout = os.Stdout
 	}
@@ -75,7 +82,7 @@ func RunWhoami(deps WhoamiDeps) error {
 			Middleware: pkgConfig.Middleware,
 		})
 	}
-	req, err := http.NewRequest("POST", deps.APIHost+"/graphql", strings.NewReader(meQuery))
+	req, err := http.NewRequestWithContext(deps.Context, "POST", deps.APIHost+"/graphql", strings.NewReader(meQuery))
 	if err != nil {
 		return err
 	}
@@ -137,8 +144,10 @@ func NewWhoamiCmd() *cobra.Command {
 				host = defaultAPIHost()
 			}
 			return RunWhoami(WhoamiDeps{
+				Context: cmd.Context(),
 				APIHost: host,
 				Token:   pkgConfig.Token,
+				Stdout:  cmd.OutOrStdout(),
 			})
 		},
 	}

package/cmd/vip-next/commands/whoami_debug_test.go

@@ -0,0 +1,79 @@
+package commands
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestWhoamiCommandHTTPDebug(t *testing.T) {
+	t.Setenv("VIP_PROXY", "")
+	t.Setenv("WPVIP_DEPLOY_TOKEN", "")
+	previous := GetConfig()
+	t.Cleanup(func() { SetConfig(previous) })
+
+	for _, tc := range []struct {
+		name       string
+		namespaces string
+		wantDebug  bool
+	}{
+		{name: "enabled", namespaces: "@automattic/vip:http", wantDebug: true},
+		{name: "disabled"},
+		{name: "excluded", namespaces: "*,-@automattic/vip:http"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			const token = "whoami-test-bearer-secret"
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPost || r.URL.Path != "/graphql" {
+					t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+				}
+				if got := r.Header.Get("Authorization"); got != "Bearer "+token {
+					t.Error("request did not retain the configured bearer token")
+				}
+				body, err := io.ReadAll(r.Body)
+				if err != nil {
+					t.Errorf("read request: %v", err)
+				}
+				if string(body) != `{"operationName":"Me","query":"query Me {\n  me {\n    id\n    displayName\n    isVIP\n  }\n}"}` {
+					t.Errorf("unexpected request body: %s", body)
+				}
+				w.Header().Set("Content-Type", "application/json")
+				_, _ = io.WriteString(w, `{"data":{"me":{"id":42,"displayName":"private-user@example.test","isVIP":true}}}`)
+			}))
+			defer srv.Close()
+			SetConfig(Config{APIHost: srv.URL, Token: token})
+
+			var stdout, stderr bytes.Buffer
+			cmd := NewWhoamiCmd()
+			cmd.SetArgs(nil)
+			cmd.SetOut(&stdout)
+			cmd.SetErr(&stderr)
+			ctx := debuglog.WithLogger(context.Background(), tc.namespaces, &stderr)
+			if err := cmd.ExecuteContext(ctx); err != nil {
+				t.Fatalf("execute whoami: %v", err)
+			}
+			wantDebug := ""
+			if tc.wantDebug {
+				wantDebug = "@automattic/vip:http running fetch " + srv.URL + "/graphql\n"
+			}
+			if got := stderr.String(); got != wantDebug {
+				t.Errorf("diagnostics = %q, want %q", got, wantDebug)
+			}
+			const wantOutput = "- Howdy private-user@example.test!\n- Your user ID is 42\n- Your account has VIP Staff permissions\n"
+			if got := stdout.String(); got != wantOutput {
+				t.Errorf("stdout = %q, want %q", got, wantOutput)
+			}
+			for _, secret := range []string{token, "private-user@example.test", "displayName", "query Me", "Authorization"} {
+				if strings.Contains(stderr.String(), secret) {
+					t.Errorf("diagnostics exposed %q", secret)
+				}
+			}
+		})
+	}
+}

package/cmd/vip-next/commands/wp.go

@@ -16,6 +16,7 @@ import (
 	"golang.org/x/term"
 
 	"github.com/Automattic/vip/internal/appctx"
+	"github.com/Automattic/vip/internal/debuglog"
 	"github.com/Automattic/vip/internal/exit"
 	"github.com/Automattic/vip/internal/gql"
 	"github.com/Automattic/vip/internal/output"
@@ -161,6 +162,7 @@ func dispatchWP(cmd *cobra.Command, ae *appctx.AppEnv, info *wpEnvInfo, args []s
 		Id:            &ae.App.ID,
 		EnvironmentId: &ae.Env.ID,
 	}
+	debuglog.Printf(cmd.Context(), "@automattic/vip:wp/ssh", "Requesting SSH authentication")
 	triggerCtx := gql.WithAllowGQLErrors(cmd.Context())
 	resp, err := gql.TriggerWPCLICommand(triggerCtx, cfg.GQLClient, triggerInput)
 	if err != nil {

package/cmd/vip-next/commands/wp_debug_test.go

@@ -0,0 +1,32 @@
+package commands
+
+import (
+	"bytes"
+	"strings"
+	"testing"
+
+	"github.com/Automattic/vip/internal/debuglog"
+)
+
+func TestWPSSHAuthenticationDiagnosticsExcludeCommand(t *testing.T) {
+	stub := &wpStub{body: wpEnvInfoBodyWithStrategy(2, "ssh", "develop"), triggerBody: `{"data":null,"errors":[{"message":"secret-api-error"}]}`}
+	setupWPTest(t, stub)
+	cmd := WPCmd()
+	var stdout, diagnostics bytes.Buffer
+	cmd.SetOut(&stdout)
+	cmd.SetErr(&diagnostics)
+	cmd.SetContext(debuglog.WithLogger(wpCtx(42, 7, 2, "develop"), "@automattic/vip:wp/ssh", &diagnostics))
+	err := runWP(cmd, []string{"user", "update", "secret-user", "--user_pass=secret-password", "--debug"})
+	if err == nil {
+		t.Fatal("expected trigger error")
+	}
+	if !strings.Contains(diagnostics.String(), "Requesting SSH authentication") {
+		t.Fatalf("missing stage: %q", diagnostics.String())
+	}
+	if strings.Contains(diagnostics.String(), "secret-") || strings.Contains(diagnostics.String(), "--debug") {
+		t.Fatalf("private command or API data in diagnostics: %q", diagnostics.String())
+	}
+	if !strings.Contains(stdout.String(), "secret-api-error") {
+		t.Fatal("existing error output changed")
+	}
+}

package/cmd/vip-next/debug_args.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+// Normalize debug's optional value before command discovery: otherwise Cobra
+// can mistake a separated namespace for a subcommand. Stop at raw passthrough
+// commands and --, and never consume the value of another flag.
+func normalizeDebugValues(root *cobra.Command, argv []string) []string {
+	target := root
+	out := make([]string, 0, len(argv))
+	child := func(name string) *cobra.Command {
+		for _, c := range target.Commands() {
+			if c.Name() == name || c.HasAlias(name) {
+				return c
+			}
+		}
+		return nil
+	}
+	for i := 0; i < len(argv); i++ {
+		arg := argv[i]
+		if arg == "--" {
+			return append(out, argv[i:]...)
+		}
+		if arg == "--debug" || arg == "-d" {
+			if i+1 < len(argv) && (argv[i+1] == "-" || !strings.HasPrefix(argv[i+1], "-")) && child(argv[i+1]) == nil {
+				i++
+				arg += "=" + argv[i]
+			}
+			out = append(out, arg)
+			continue
+		}
+		out = append(out, arg)
+		if !strings.HasPrefix(arg, "-") {
+			if c := child(arg); c != nil {
+				target = c
+				if c.DisableFlagParsing {
+					return append(out, argv[i+1:]...)
+				}
+			}
+			continue
+		}
+		if strings.Contains(arg, "=") {
+			continue
+		}
+		flags := target.Flags()
+		flags.AddFlagSet(target.InheritedFlags())
+		flags.AddFlagSet(target.PersistentFlags())
+		name := strings.TrimPrefix(arg, "--")
+		flag := flags.Lookup(name)
+		if len(arg) == 2 {
+			flag = flags.ShorthandLookup(arg[1:])
+		}
+		if flag != nil && flag.NoOptDefVal == "" && i+1 < len(argv) {
+			i++
+			out = append(out, argv[i])
+		}
+	}
+	return out
+}