@biffo/cli 0.223.2 → 0.224.0

package/dist/index.js

@@ -965,10 +965,10 @@ var GitAdapter = class {
    * `token`, when given, authenticates the clone against a private repo by
    * embedding it in the URL's userinfo (`https://x-access-token:<token>@...`
    * — the standard scheme for a GitHub PAT/App token over HTTPS) before
-   * handing it to `git clone`. The *rewritten* URL is only ever passed to
-   * `execa`, never logged or included in a thrown error message — errors
-   * reference the original `repoUrl` so a token can't leak into CLI output
-   * or a crash report.
+   * handing it to `git clone`. The failure path runs the underlying error
+   * through `redactSecrets` before reporting it: `execa` echoes the argv it
+   * ran, so the tokenized URL *is* present in that message and interpolating
+   * it raw leaked the token into CLI output and CI logs (#1169).
    */
   async cloneToTemp(repoUrl, namePrefix, token) {
     const dir = mkdtempSync2(join6(tmpdir2(), `${namePrefix}-${randomUUID().slice(0, 8)}-`));
@@ -977,7 +977,7 @@ var GitAdapter = class {
       await execa2("git", ["clone", "--depth", "1", cloneUrl, dir]);
     } catch (err) {
       rmSync2(dir, { recursive: true, force: true });
-      throw new Error(`Failed to clone ${repoUrl}: ${err.message}`);
+      throw gitFailure(`Failed to clone ${repoUrl}`, err, [token]);
     }
     const gitDir = join6(dir, ".git");
     if (existsSync6(gitDir)) rmSync2(gitDir, { recursive: true, force: true });
@@ -1000,7 +1000,7 @@ var GitAdapter = class {
       await execa2("git", ["clone", cloneUrl, dir]);
     } catch (err) {
       rmSync2(dir, { recursive: true, force: true });
-      throw new Error(`Failed to clone ${repoUrl}: ${err.message}`);
+      throw gitFailure(`Failed to clone ${repoUrl}`, err, [token]);
     }
     return dir;
   }
@@ -1182,9 +1182,15 @@ var GitAdapter = class {
   /**
    * Push the current HEAD to `branch` on the remote. When `token` is given and
    * the remote is HTTPS, it's embedded in the push URL for auth (SSH/file
-   * remotes push with ambient credentials). The authenticated URL is never
-   * logged or included in a thrown error — a push failure references only the
-   * remote name, so a token can't leak into CLI output or a crash report.
+   * remotes push with ambient credentials).
+   *
+   * The failure path reports git's own error, redacted (#1135). It previously
+   * discarded it entirely — a defensible-looking choice, since the argv `execa`
+   * echoes contains the tokenized URL, but it made **every** push failure in
+   * the CLI indistinguishable: a rejected pre-push hook, an unresolvable
+   * remote and a bad token all produced the same sentence. That is why #1040
+   * ("`core upgrade --apply` aborts at the push step") survived two sessions of
+   * diagnosis without its cause ever being established.
    */
   async push(cwd, branch, opts = {}) {
     const remote = opts.remote ?? "origin";
@@ -1196,8 +1202,8 @@ var GitAdapter = class {
     }
     try {
       await execa2("git", ["push", target, `HEAD:refs/heads/${branch}`], { cwd });
-    } catch {
-      throw new Error(`Failed to push branch '${branch}' to remote '${remote}'.`);
+    } catch (err) {
+      throw gitFailure(`Failed to push branch '${branch}' to remote '${remote}'`, err, [opts.token]);
     }
     await this.setUpstreamAfterPush(cwd, branch, remote);
   }
@@ -1263,6 +1269,22 @@ function injectToken(repoUrl, token) {
   parsed.password = token;
   return parsed.toString();
 }
+var REDACTED = "***";
+var MIN_REDACTABLE = 8;
+function redactSecrets(text, secrets) {
+  let out = text;
+  for (const secret of secrets) {
+    if (secret === void 0 || secret.length < MIN_REDACTABLE) continue;
+    for (const form of /* @__PURE__ */ new Set([secret, encodeURIComponent(secret)])) {
+      out = out.split(form).join(REDACTED);
+    }
+  }
+  return out;
+}
+function gitFailure(summary, err, secrets) {
+  const detail = redactSecrets(err.message, secrets);
+  return new Error(`${summary}: ${detail}`);
+}
 
 // src/adapters/source-control/github/index.ts
 import { execSync } from "child_process";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.223.2",
+  "version": "0.224.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",