@flowscripter/dynamic-cli-framework 10.0.0 → 10.1.0

package/dist/src/runtime/parser.d.ts

@@ -2,18 +2,24 @@ import type { PopulatedSingleValueType, PopulatedValues } from "@flowscripter/dy
 import type { ParseResult } from "@flowscripter/dynamic-cli-framework-api";
 import type { CommandClause } from "./scanner.ts";
 export type { ParseResult } from "@flowscripter/dynamic-cli-framework-api";
+/**
+ * A {@link ParseResult} which also reports any SECRET arguments supplied as plain command line arguments.
+ */
+export type SecretAwareParseResult = ParseResult & {
+    readonly secretArgumentNames?: ReadonlyArray<string>;
+};
 /**
  * Parse the arguments for the specified {@link CommandClause} assuming it contains a {@link SubCommand}.
  *
  * @param commandClause the clause to parse.
  * @param defaultValues optional default {@link PopulatedValues} to use for population before parsing the provided arguments.
  */
-export declare function parseSubCommandClause(commandClause: CommandClause, defaultValues?: PopulatedValues): ParseResult;
+export declare function parseSubCommandClause(commandClause: CommandClause, defaultValues?: PopulatedValues): SecretAwareParseResult;
 /**
  * Parse the arguments for the specified {@link CommandClause} assuming it contains a {@link GlobalCommand} or {@link GlobalModifierCommand}.
  *
  * @param commandClause the clause to parse.
  * @param defaultValue optional default {@link PopulatedSingleValueType} to use for population before parsing the provided arguments.
  */
-export declare function parseGlobalCommandClause(commandClause: CommandClause, defaultValue?: PopulatedSingleValueType): ParseResult;
+export declare function parseGlobalCommandClause(commandClause: CommandClause, defaultValue?: PopulatedSingleValueType): SecretAwareParseResult;
 //# sourceMappingURL=parser.d.ts.map

package/dist/src/runtime/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/runtime/parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EACxB,eAAe,EAChB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAclD,YAAY,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAE3E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,aAAa,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC9B,WAAW,CAiFb;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,CAAC,EAAE,wBAAwB,GACtC,WAAW,CA0Db"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../src/runtime/parser.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,wBAAwB,EACxB,eAAe,EAChB,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAelD,YAAY,EAAE,WAAW,EAAE,MAAM,yCAAyC,CAAC;AAE3E;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG,WAAW,GAAG;IACjD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtD,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,aAAa,EAC5B,aAAa,CAAC,EAAE,eAAe,GAC9B,sBAAsB,CAiFxB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,CAAC,EAAE,wBAAwB,GACtC,sBAAsB,CAwDxB"}

package/dist/src/runtime/parser.js

@@ -1,6 +1,7 @@
 import populateGlobalCommandValue from "./values/globalCommandValuePopulation.js";
 import { validateGlobalCommandArgumentValue, validateOptionValue, validatePositionalValue, } from "./values/argumentValueValidation.js";
 import getLogger from "../util/logger.js";
+import { redactGlobalCommandValue, redactSubCommandValues } from "../util/secretRedaction.js";
 import populateSubCommandValues from "./values/subCommandValuePopulation.js";
 const logger = getLogger("parser");
 /**
@@ -24,7 +25,7 @@ export function parseSubCommandClause(commandClause, defaultValues) {
             unusedArgs: potentialArgs,
         };
     }
-    const { populatedArgumentValues, unusedArgs, invalidArgument } = populateSubCommandValues(command, potentialArgs, defaultValues);
+    const { populatedArgumentValues, unusedArgs, invalidArgument, secretArgumentNames } = populateSubCommandValues(command, potentialArgs, defaultValues);
     if (invalidArgument) {
         invalidArguments.push(invalidArgument);
     }
@@ -36,7 +37,7 @@ export function parseSubCommandClause(commandClause, defaultValues) {
                 populatedArgumentValues[option.name] = validatedValue;
             }
         });
-        logger.debug("Command arguments after options validated: %O with invalid args: %O", populatedArgumentValues, invalidArguments);
+        logger.debug("Command arguments after options validated: %O with invalid args: %O", redactSubCommandValues(command, populatedArgumentValues), invalidArguments);
         if (invalidArguments.length === 0) {
             // validate the positional values
             command.positionals.forEach((positional) => {
@@ -45,9 +46,10 @@ export function parseSubCommandClause(commandClause, defaultValues) {
                     populatedArgumentValues[positional.name] = validatedValue;
                 }
             });
-            logger.debug("Command arguments after positionals validated: %O with invalid args: %O", populatedArgumentValues, invalidArguments);
+            logger.debug("Command arguments after positionals validated: %O with invalid args: %O", redactSubCommandValues(command, populatedArgumentValues), invalidArguments);
         }
     }
+    const secrets = secretArgumentNames ? { secretArgumentNames } : {};
     if (groupCommand) {
         return {
             command,
@@ -55,6 +57,7 @@ export function parseSubCommandClause(commandClause, defaultValues) {
             groupCommand,
             invalidArguments,
             unusedArgs,
+            ...secrets,
         };
     }
     return {
@@ -62,6 +65,7 @@ export function parseSubCommandClause(commandClause, defaultValues) {
         populatedArgumentValues,
         invalidArguments,
         unusedArgs: unusedArgs,
+        ...secrets,
     };
 }
 /**
@@ -83,11 +87,11 @@ export function parseGlobalCommandClause(commandClause, defaultValue) {
             unusedArgs: potentialArgs,
         };
     }
-    let { populatedArgumentValue, unusedArgs, invalidArgument } = populateGlobalCommandValue(command, potentialArgs, defaultValue);
+    let { populatedArgumentValue, unusedArgs, invalidArgument, secretArgumentNames } = populateGlobalCommandValue(command, potentialArgs, defaultValue);
     if (invalidArgument) {
         invalidArguments.push(invalidArgument);
     }
-    logger.debug("Command arguments for command: %s after value population: %O with invalid args: %O and unused args: %O", command.name, populatedArgumentValue, invalidArguments, unusedArgs);
+    logger.debug("Command arguments for command: %s after value population: %O with invalid args: %O and unused args: %O", command.name, redactGlobalCommandValue(command, populatedArgumentValue), invalidArguments, unusedArgs);
     // don't validate the value if the argument is already invalid
     if (invalidArguments.length === 0) {
         const validatedValue = validateGlobalCommandArgumentValue(command, populatedArgumentValue, invalidArguments);
@@ -95,11 +99,12 @@ export function parseGlobalCommandClause(commandClause, defaultValue) {
             populatedArgumentValue = validatedValue;
         }
     }
-    logger.debug("Command arguments for command: %s after value validation: %O with invalid args: %O", command.name, populatedArgumentValue, invalidArguments);
+    logger.debug("Command arguments for command: %s after value validation: %O with invalid args: %O", command.name, redactGlobalCommandValue(command, populatedArgumentValue), invalidArguments);
     return {
         command,
         populatedArgumentValues: populatedArgumentValue,
         invalidArguments,
         unusedArgs,
+        ...(secretArgumentNames && { secretArgumentNames }),
     };
 }

package/dist/src/runtime/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAiB/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEvF,OAAO,KAAK,4BAA4B,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,uBAAuB,MAAM,qDAAqD,CAAC;AAK/F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAKvE,OAAO,qBAAqB,MAAM,6CAA6C,CAAC;AAMhF;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAmfzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,wBAAsB,GAAG,CACvB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,eAAe,EAAE,eAAe,EAChC,uBAAuB,EAAE,uBAAuB,EAChD,4BAA4B,EAAE,4BAA4B,GAAG,SAAS,EACtE,uBAAuB,EAAE,uBAAuB,GAAG,SAAS,EAC5D,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,OAAO,EACxB,cAAc,CAAC,EAAE,qBAAqB,GACrC,OAAO,CAAC,YAAY,CAAC,CAkKvB"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/runtime/runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAkB/E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEvF,OAAO,KAAK,4BAA4B,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,uBAAuB,MAAM,qDAAqD,CAAC;AAK/F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAKvE,OAAO,qBAAqB,MAAM,6CAA6C,CAAC;AAMhF;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG;IAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AAsfzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2EG;AACH,wBAAsB,GAAG,CACvB,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAC3B,eAAe,EAAE,eAAe,EAChC,uBAAuB,EAAE,uBAAuB,EAChD,4BAA4B,EAAE,4BAA4B,GAAG,SAAS,EACtE,uBAAuB,EAAE,uBAAuB,GAAG,SAAS,EAC5D,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,OAAO,EACxB,cAAc,CAAC,EAAE,qBAAqB,GACrC,OAAO,CAAC,YAAY,CAAC,CAkKvB"}

package/dist/src/runtime/runner.js

@@ -1,7 +1,7 @@
 import { RunState } from "@flowscripter/dynamic-cli-framework-api";
 import { isGlobalCommand, isSubCommand } from "./command/CommandTypeGuards.js";
 import getLogger from "../util/logger.js";
-import { printCommandExecutionError, printNoCommandRecognisedError, printNoCommandSpecifiedError, printParseResultError, printUnusedArgsWarning, } from "../util/runnerHelper.js";
+import { printCommandExecutionError, printNoCommandRecognisedError, printNoCommandSpecifiedError, printParseResultError, printSecretArgsWarning, printUnusedArgsWarning, } from "../util/runnerHelper.js";
 import { scanForGlobalModifierCommandClauses, scanForNonModifierCommandClause } from "./scanner.js";
 import { parseGlobalCommandClause, parseSubCommandClause } from "./parser.js";
 import { ARGUMENT_PROMPTER_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
@@ -113,6 +113,7 @@ async function findAndExecuteGlobalModifierCommands(availableArgSequences, unuse
                 ? await configurationServiceProvider.getDefaultArgumentValues(context.cliConfig, globalModifierCommandClause.command)
                 : undefined;
             const parseResult = parseGlobalCommandClause(globalModifierCommandClause, defaultArgumentValues);
+            await printSecretArgsWarning(context, parseResult);
             if (parseResult.invalidArguments.length > 0) {
                 await printParseResultError(context, parseResult);
                 return {
@@ -194,6 +195,7 @@ async function findAndExecuteNonModifierCommand(availableArgs, unusedArgs, nonMo
         else {
             parseResult = parseSubCommandClause(scanResult.nonModifierCommandClause, defaultArgumentValues);
         }
+        await printSecretArgsWarning(context, parseResult);
         if (parseResult.invalidArguments.length > 0) {
             const prompted = await attemptPromptForMissingArguments(parseResult, context);
             if (prompted) {
@@ -298,6 +300,7 @@ async function findAndExecuteDefaultNonModifierCommand(availableArgs, unusedArgs
                 potentialArgs: [...argSequence],
             }, defaultArgumentValues);
         }
+        await printSecretArgsWarning(context, parseResult);
         // add any unused args back to the list of still unused args
         if (parseResult.unusedArgs.length > 0) {
             unusedArgs.push(parseResult.unusedArgs);

package/dist/src/runtime/values/ValuePopulationResult.d.ts

@@ -12,6 +12,10 @@ export interface ValuePopulationResult {
      * Any invalid argument discovered while populating values.
      */
     readonly invalidArgument?: InvalidArgument;
+    /**
+     * Names of any SECRET arguments whose values were supplied as plain command line arguments.
+     */
+    readonly secretArgumentNames?: ReadonlyArray<string>;
 }
 /**
  * A container holding the result of argument values population for a {@link SubCommand}.

package/dist/src/runtime/values/ValuePopulationResult.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ValuePopulationResult.d.ts","sourceRoot":"","sources":["../../../../src/runtime/values/ValuePopulationResult.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,eAAe,EAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;CAC5C;AAED;;GAEG;AACH,MAAM,WAAW,+BAAgC,SAAQ,qBAAqB;IAC5E;;OAEG;IACH,QAAQ,CAAC,uBAAuB,EAAE,eAAe,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;CAC3D"}
+{"version":3,"file":"ValuePopulationResult.d.ts","sourceRoot":"","sources":["../../../../src/runtime/values/ValuePopulationResult.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,eAAe,EAChB,MAAM,yCAAyC,CAAC;AACjD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE/E;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAE3C;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,+BAAgC,SAAQ,qBAAqB;IAC5E;;OAEG;IACH,QAAQ,CAAC,uBAAuB,EAAE,eAAe,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,kCAAmC,SAAQ,qBAAqB;IAC/E;;OAEG;IACH,QAAQ,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;CAC3D"}

package/dist/src/runtime/values/globalCommandValuePopulation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"globalCommandValuePopulation.d.ts","sourceRoot":"","sources":["../../../../src/runtime/values/globalCommandValuePopulation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAMxF;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,0BAA0B,CAChD,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,EACpC,YAAY,EAAE,wBAAwB,GACrC,kCAAkC,CAkEpC"}
+{"version":3,"file":"globalCommandValuePopulation.d.ts","sourceRoot":"","sources":["../../../../src/runtime/values/globalCommandValuePopulation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,4BAA4B,CAAC;AAErF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AAOxF;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,0BAA0B,CAChD,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,EACpC,YAAY,EAAE,wBAAwB,GACrC,kCAAkC,CAwEpC"}

package/dist/src/runtime/values/globalCommandValuePopulation.js

@@ -1,5 +1,6 @@
 import { ValueTypeName } from "@flowscripter/dynamic-cli-framework-api";
 import getLogger from "../../util/logger.js";
+import { REDACTED } from "../../util/secretRedaction.js";
 import { InvalidArgumentReason } from "@flowscripter/dynamic-cli-framework-api";
 const logger = getLogger("globalCommandValuePopulation");
 /**
@@ -10,14 +11,20 @@ const logger = getLogger("globalCommandValuePopulation");
  * @param defaultValue optional default value to use for population before parsing the provided arguments.
  */
 export default function populateGlobalCommandValue(globalCommand, potentialArgs, defaultValue) {
+    const argument = globalCommand.argument;
+    const isSecret = argument.type === ValueTypeName.SECRET;
     logger.debug(() => {
-        const message = `Populating value for global command: '${globalCommand.name}' using potential args: ${potentialArgs.join(" ")}`;
+        const message = `Populating value for global command: '${globalCommand.name}' using potential args: ${(isSecret
+            ? potentialArgs
+                .slice(0, 1)
+                .map(() => REDACTED)
+                .concat(potentialArgs.slice(1))
+            : potentialArgs).join(" ")}`;
         if (defaultValue !== undefined) {
-            return `${message} and configured value: '${defaultValue}'`;
+            return `${message} and configured value: '${isSecret ? REDACTED : defaultValue}'`;
         }
         return message;
     });
-    const argument = globalCommand.argument;
     // default to defined argument default value
     let populatedArgumentValue = argument.defaultValue;
     // override with provided configured value
@@ -63,5 +70,6 @@ export default function populateGlobalCommandValue(globalCommand, potentialArgs,
     return {
         populatedArgumentValue,
         unusedArgs,
+        ...(isSecret && potentialArgs.length > 0 && { secretArgumentNames: [globalCommand.name] }),
     };
 }

package/dist/src/runtime/values/subCommandValuePopulation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subCommandValuePopulation.d.ts","sourceRoot":"","sources":["../../../../src/runtime/values/subCommandValuePopulation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,yCAAyC,CAAC;AAGjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAsjBlF;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,wBAAwB,CAC9C,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,EACpC,aAAa,EAAE,eAAe,GAAG,SAAS,GACzC,+BAA+B,CAkEjC"}
+{"version":3,"file":"subCommandValuePopulation.d.ts","sourceRoot":"","sources":["../../../../src/runtime/values/subCommandValuePopulation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,yCAAyC,CAAC;AAIjD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AA2kBlF;;;;;;GAMG;AACH,MAAM,CAAC,OAAO,UAAU,wBAAwB,CAC9C,UAAU,EAAE,UAAU,EACtB,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,EACpC,aAAa,EAAE,eAAe,GAAG,SAAS,GACzC,+BAA+B,CA+EjC"}

package/dist/src/runtime/values/subCommandValuePopulation.js

@@ -1,5 +1,6 @@
 import { ValueTypeName, } from "@flowscripter/dynamic-cli-framework-api";
 import getLogger from "../../util/logger.js";
+import { REDACTED, redactSubCommandValues } from "../../util/secretRedaction.js";
 import argumentValueMerge from "./argumentValueMerge.js";
 import { MAXIMUM_COMPLEX_OPTION_NESTING_DEPTH } from "@flowscripter/dynamic-cli-framework-api";
 import { isComplexOption } from "../argument/ArgumentTypeGuards.js";
@@ -62,6 +63,18 @@ class ParseContext {
      * which will be populated with a positional value if found.
      */
     currentPositionalIndex;
+    /**
+     * Set when the most recent argument supplied a value for a SECRET option or positional.
+     */
+    secretArgument;
+    /**
+     * Return and clear the {@link secretArgument} recorded by the most recent {@link parse}.
+     */
+    takeSecretArgument() {
+        const secretArgument = this.secretArgument;
+        this.secretArgument = undefined;
+        return secretArgument;
+    }
     /**
      * Use to store lazily created map of option paths e.g. --alpha.b.g and -a.b.gamma for {@link ComplexOption} or {@link Option} instances.
      */
@@ -294,7 +307,10 @@ class ParseContext {
      * @return `false` if there is a problem populating the value, in which case the {@link state} will be set to
      * {@link ParseState.ERROR} and {@link invalidArgument} will be populated.
      */
-    setOptionValue(value) {
+    setOptionValue(value, inline = false) {
+        if (this.currentOption.type === ValueTypeName.SECRET) {
+            this.secretArgument = { name: this.currentOption.name, inline };
+        }
         let optionValue = this.populatedArgumentValues;
         const optionPath = this.currentOptionPath;
         // traverse the current populated values using the validated option path elements
@@ -367,6 +383,9 @@ class ParseContext {
     setPositionalValue(value) {
         const positional = this.subCommand.positionals[this.currentPositionalIndex];
         const currentValue = this.populatedArgumentValues[positional.name];
+        if (positional.type === ValueTypeName.SECRET) {
+            this.secretArgument = { name: positional.name, inline: false };
+        }
         // if we haven't populated the argument value before...
         if (currentValue === undefined) {
             if (positional.isVarargMultiple) {
@@ -460,7 +479,7 @@ class ParseContext {
                     // try to set the value if we have one
                     if (potentialOptionValue !== undefined) {
                         // set the value
-                        this.setOptionValue(potentialOptionValue);
+                        this.setOptionValue(potentialOptionValue, true);
                         // return regardless
                         return;
                     }
@@ -491,19 +510,21 @@ class ParseContext {
  * @param defaultValues optional default {@link Values} to use for population before parsing the provided arguments.
  */
 export default function populateSubCommandValues(subCommand, potentialArgs, defaultValues) {
-    logger.debug(() => {
-        const message = `Populating values for sub-command: '${subCommand.name}' using potential args: ${potentialArgs.join(" ")}`;
-        if (defaultValues !== undefined) {
-            return `${message} and configured values: ${JSON.stringify(defaultValues)}`;
-        }
-        return message;
-    });
     const parseContext = new ParseContext(subCommand);
     const unusedArgs = [];
+    const loggedArgs = [...potentialArgs];
+    const secretArgumentNames = new Set();
     for (let i = 0; i < potentialArgs.length; i++) {
         const potentialArg = potentialArgs[i];
         // parse the next arg
         parseContext.parse(potentialArg);
+        const secretArgument = parseContext.takeSecretArgument();
+        if (secretArgument) {
+            secretArgumentNames.add(secretArgument.name);
+            loggedArgs[i] = secretArgument.inline
+                ? `${potentialArg.slice(0, potentialArg.indexOf("=") + 1)}${REDACTED}`
+                : REDACTED;
+        }
         // check if we had a parsing error, record the error, flush the remaining args and stop parsing
         if (parseContext.state === ParseState.ERROR) {
             if (i + 1 < potentialArgs.length) {
@@ -517,6 +538,13 @@ export default function populateSubCommandValues(subCommand, potentialArgs, defa
             parseContext.state = ParseState.EMPTY;
         }
     }
+    logger.debug(() => {
+        const message = `Populated values for sub-command: '${subCommand.name}' using potential args: ${loggedArgs.join(" ")}`;
+        if (defaultValues !== undefined) {
+            return `${message} and configured values: ${JSON.stringify(redactSubCommandValues(subCommand, defaultValues))}`;
+        }
+        return message;
+    });
     // Check if the last arg specified an option but no value
     if (parseContext.state === ParseState.OPTION_VALUE_EXPECTED) {
         // special case if the last arg was for a boolean option where the value was implicitly `true`
@@ -536,6 +564,7 @@ export default function populateSubCommandValues(subCommand, potentialArgs, defa
             populatedArgumentValues: parseContext.populatedArgumentValues,
             unusedArgs: unusedArgs,
             invalidArgument: parseContext.invalidArgument,
+            ...(secretArgumentNames.size > 0 && { secretArgumentNames: [...secretArgumentNames] }),
         };
     }
     // merge the configured values with the parsed values
@@ -546,5 +575,6 @@ export default function populateSubCommandValues(subCommand, potentialArgs, defa
     return {
         populatedArgumentValues,
         unusedArgs: unusedArgs,
+        ...(secretArgumentNames.size > 0 && { secretArgumentNames: [...secretArgumentNames] }),
     };
 }

package/dist/src/util/runnerHelper.d.ts

@@ -1,3 +1,4 @@
+import type { SecretAwareParseResult } from "../runtime/parser.ts";
 import type { ParseResult } from "../runtime/parser.ts";
 import type { Context } from "@flowscripter/dynamic-cli-framework-api";
 import type { CommandRegistry } from "@flowscripter/dynamic-cli-framework-api";
@@ -7,4 +8,5 @@ export declare function printRuntimeError(context: Context, err: Error): Promise
 export declare function printNoCommandSpecifiedError(context: Context): Promise<void>;
 export declare function printNoCommandRecognisedError(context: Context, commandRegistry: CommandRegistry, availableArgs: ReadonlyArray<string>): Promise<void>;
 export declare function printUnusedArgsWarning(context: Context, overallUnusedArgs: ReadonlyArray<string>): Promise<void>;
+export declare function printSecretArgsWarning(context: Context, parseResult: SecretAwareParseResult): Promise<void>;
 //# sourceMappingURL=runnerHelper.d.ts.map

package/dist/src/util/runnerHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runnerHelper.d.ts","sourceRoot":"","sources":["../../../src/util/runnerHelper.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAY/E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,KAAK,EACV,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,iBAMnE;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,iBAGlE;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,eAAe,EAChC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,iBAgCrC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,iBAQzC"}
+{"version":3,"file":"runnerHelper.d.ts","sourceRoot":"","sources":["../../../src/util/runnerHelper.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAY/E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,KAAK,EACV,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,iBAMnE;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,iBAGlE;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,eAAe,EAChC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,iBAgCrC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,iBAQzC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,sBAAsB,iBAapC"}

package/dist/src/util/runnerHelper.js

@@ -78,3 +78,13 @@ export async function printUnusedArgsWarning(context, overallUnusedArgs) {
         await printerService.warn(`Unused args: ${overallUnusedArgs.join(" ")}\n\n`, Icon.ALERT);
     }
 }
+export async function printSecretArgsWarning(context, parseResult) {
+    const secretArgumentNames = parseResult.secretArgumentNames;
+    if (!secretArgumentNames || secretArgumentNames.length === 0) {
+        return;
+    }
+    const printerService = context.getServiceById(PRINTER_SERVICE_ID);
+    await printerService.warn(`SECRET value passed as a plain argument: ${secretArgumentNames.join(", ")}. ` +
+        "This is not recommended as it may be exposed via shell history and process listings. " +
+        "Use an environment variable, a prompt or a configuration file default instead.\n\n", Icon.ALERT);
+}

package/dist/src/util/secretRedaction.d.ts

@@ -0,0 +1,11 @@
+import { type GlobalCommand, type PopulatedSingleValueType, type PopulatedValues, type SubCommand } from "@flowscripter/dynamic-cli-framework-api";
+export declare const REDACTED = "***";
+/**
+ * Copy of the provided values suitable for logging, with the values of any SECRET options or positionals replaced.
+ */
+export declare function redactSubCommandValues<T extends PopulatedValues | undefined>(subCommand: SubCommand, values: T): T;
+/**
+ * Copy of the provided value suitable for logging, with the value replaced if the global command argument is a SECRET.
+ */
+export declare function redactGlobalCommandValue(globalCommand: GlobalCommand, value: PopulatedSingleValueType): PopulatedSingleValueType;
+//# sourceMappingURL=secretRedaction.d.ts.map

package/dist/src/util/secretRedaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRedaction.d.ts","sourceRoot":"","sources":["../../../src/util/secretRedaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EAEpB,KAAK,UAAU,EAChB,MAAM,yCAAyC,CAAC;AAGjD,eAAO,MAAM,QAAQ,QAAQ,CAAC;AA4C9B;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,eAAe,GAAG,SAAS,EAC1E,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,CAAC,GACR,CAAC,CAKH;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAK1B"}

package/dist/src/util/secretRedaction.js

@@ -0,0 +1,45 @@
+import { ValueTypeName, } from "@flowscripter/dynamic-cli-framework-api";
+import { isComplexOption } from "../runtime/argument/ArgumentTypeGuards.js";
+export const REDACTED = "***";
+function redactValue(definition, value) {
+    if (value === undefined || value === null) {
+        return value;
+    }
+    if (isComplexOption(definition)) {
+        const properties = definition.properties;
+        if (Array.isArray(value)) {
+            return value.map((v) => redactValue(definition, v));
+        }
+        return redactDefinedValues(properties, [], value);
+    }
+    if (definition.type === ValueTypeName.SECRET) {
+        return Array.isArray(value) ? value.map(() => REDACTED) : REDACTED;
+    }
+    return value;
+}
+function redactDefinedValues(options, positionals, values) {
+    const redacted = {};
+    for (const [name, value] of Object.entries(values)) {
+        const definition = options.find((o) => o.name === name) ?? positionals.find((p) => p.name === name);
+        redacted[name] = definition ? redactValue(definition, value) : value;
+    }
+    return redacted;
+}
+/**
+ * Copy of the provided values suitable for logging, with the values of any SECRET options or positionals replaced.
+ */
+export function redactSubCommandValues(subCommand, values) {
+    if (values === undefined) {
+        return values;
+    }
+    return redactDefinedValues(subCommand.options, subCommand.positionals, values);
+}
+/**
+ * Copy of the provided value suitable for logging, with the value replaced if the global command argument is a SECRET.
+ */
+export function redactGlobalCommandValue(globalCommand, value) {
+    if (value !== undefined && globalCommand.argument?.type === ValueTypeName.SECRET) {
+        return REDACTED;
+    }
+    return value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowscripter/dynamic-cli-framework",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "A framework for developing CLI applications which supports dynamic discovery and installation of new commands",
   "keywords": [
     "bun",

package/src/runtime/parser.ts

@@ -13,6 +13,7 @@ import {
   validatePositionalValue,
 } from "./values/argumentValueValidation.ts";
 import getLogger from "../util/logger.ts";
+import { redactGlobalCommandValue, redactSubCommandValues } from "../util/secretRedaction.ts";
 import populateSubCommandValues from "./values/subCommandValuePopulation.ts";
 import type { GlobalCommand } from "@flowscripter/dynamic-cli-framework-api";
 import type { SubCommand } from "@flowscripter/dynamic-cli-framework-api";
@@ -21,6 +22,13 @@ const logger = getLogger("parser");
 
 export type { ParseResult } from "@flowscripter/dynamic-cli-framework-api";
 
+/**
+ * A {@link ParseResult} which also reports any SECRET arguments supplied as plain command line arguments.
+ */
+export type SecretAwareParseResult = ParseResult & {
+  readonly secretArgumentNames?: ReadonlyArray<string>;
+};
+
 /**
  * Parse the arguments for the specified {@link CommandClause} assuming it contains a {@link SubCommand}.
  *
@@ -30,7 +38,7 @@ export type { ParseResult } from "@flowscripter/dynamic-cli-framework-api";
 export function parseSubCommandClause(
   commandClause: CommandClause,
   defaultValues?: PopulatedValues,
-): ParseResult {
+): SecretAwareParseResult {
   const command = commandClause.command as SubCommand;
   const potentialArgs = commandClause.potentialArgs;
   const groupCommand = commandClause.groupCommand;
@@ -48,11 +56,8 @@ export function parseSubCommandClause(
     };
   }
 
-  const { populatedArgumentValues, unusedArgs, invalidArgument } = populateSubCommandValues(
-    command,
-    potentialArgs,
-    defaultValues,
-  );
+  const { populatedArgumentValues, unusedArgs, invalidArgument, secretArgumentNames } =
+    populateSubCommandValues(command, potentialArgs, defaultValues);
 
   if (invalidArgument) {
     invalidArguments.push(invalidArgument);
@@ -73,7 +78,7 @@ export function parseSubCommandClause(
 
     logger.debug(
       "Command arguments after options validated: %O with invalid args: %O",
-      populatedArgumentValues,
+      redactSubCommandValues(command, populatedArgumentValues),
       invalidArguments,
     );
 
@@ -91,11 +96,12 @@ export function parseSubCommandClause(
       });
       logger.debug(
         "Command arguments after positionals validated: %O with invalid args: %O",
-        populatedArgumentValues,
+        redactSubCommandValues(command, populatedArgumentValues),
         invalidArguments,
       );
     }
   }
+  const secrets = secretArgumentNames ? { secretArgumentNames } : {};
   if (groupCommand) {
     return {
       command,
@@ -103,6 +109,7 @@ export function parseSubCommandClause(
       groupCommand,
       invalidArguments,
       unusedArgs,
+      ...secrets,
     };
   }
   return {
@@ -110,6 +117,7 @@ export function parseSubCommandClause(
     populatedArgumentValues,
     invalidArguments,
     unusedArgs: unusedArgs,
+    ...secrets,
   };
 }
 
@@ -122,7 +130,7 @@ export function parseSubCommandClause(
 export function parseGlobalCommandClause(
   commandClause: CommandClause,
   defaultValue?: PopulatedSingleValueType,
-): ParseResult {
+): SecretAwareParseResult {
   const command = commandClause.command as GlobalCommand;
   const potentialArgs = commandClause.potentialArgs;
   const invalidArguments: Array<InvalidArgument> = [];
@@ -137,11 +145,8 @@ export function parseGlobalCommandClause(
     };
   }
 
-  let { populatedArgumentValue, unusedArgs, invalidArgument } = populateGlobalCommandValue(
-    command,
-    potentialArgs,
-    defaultValue,
-  );
+  let { populatedArgumentValue, unusedArgs, invalidArgument, secretArgumentNames } =
+    populateGlobalCommandValue(command, potentialArgs, defaultValue);
 
   if (invalidArgument) {
     invalidArguments.push(invalidArgument);
@@ -150,7 +155,7 @@ export function parseGlobalCommandClause(
   logger.debug(
     "Command arguments for command: %s after value population: %O with invalid args: %O and unused args: %O",
     command.name,
-    populatedArgumentValue,
+    redactGlobalCommandValue(command, populatedArgumentValue),
     invalidArguments,
     unusedArgs,
   );
@@ -170,7 +175,7 @@ export function parseGlobalCommandClause(
   logger.debug(
     "Command arguments for command: %s after value validation: %O with invalid args: %O",
     command.name,
-    populatedArgumentValue,
+    redactGlobalCommandValue(command, populatedArgumentValue),
     invalidArguments,
   );
 
@@ -179,5 +184,6 @@ export function parseGlobalCommandClause(
     populatedArgumentValues: populatedArgumentValue,
     invalidArguments,
     unusedArgs,
+    ...(secretArgumentNames && { secretArgumentNames }),
   };
 }

package/src/runtime/runner.ts

@@ -15,6 +15,7 @@ import {
   printNoCommandRecognisedError,
   printNoCommandSpecifiedError,
   printParseResultError,
+  printSecretArgsWarning,
   printUnusedArgsWarning,
 } from "../util/runnerHelper.ts";
 import { scanForGlobalModifierCommandClauses, scanForNonModifierCommandClause } from "./scanner.ts";
@@ -198,6 +199,7 @@ async function findAndExecuteGlobalModifierCommands(
         globalModifierCommandClause,
         defaultArgumentValues as PopulatedSingleValueType,
       );
+      await printSecretArgsWarning(context, parseResult);
 
       if (parseResult.invalidArguments.length > 0) {
         await printParseResultError(context, parseResult);
@@ -329,6 +331,7 @@ async function findAndExecuteNonModifierCommand(
         defaultArgumentValues as PopulatedValues,
       );
     }
+    await printSecretArgsWarning(context, parseResult);
 
     if (parseResult.invalidArguments.length > 0) {
       const prompted = await attemptPromptForMissingArguments(parseResult, context);
@@ -464,6 +467,7 @@ async function findAndExecuteDefaultNonModifierCommand(
         defaultArgumentValues as PopulatedValues,
       );
     }
+    await printSecretArgsWarning(context, parseResult);
 
     // add any unused args back to the list of still unused args
     if (parseResult.unusedArgs.length > 0) {

package/src/runtime/values/ValuePopulationResult.ts

@@ -17,6 +17,11 @@ export interface ValuePopulationResult {
    * Any invalid argument discovered while populating values.
    */
   readonly invalidArgument?: InvalidArgument;
+
+  /**
+   * Names of any SECRET arguments whose values were supplied as plain command line arguments.
+   */
+  readonly secretArgumentNames?: ReadonlyArray<string>;
 }
 
 /**

package/src/runtime/values/globalCommandValuePopulation.ts

@@ -3,6 +3,7 @@ import type { GlobalCommandValuePopulationResult } from "./ValuePopulationResult
 import { ValueTypeName } from "@flowscripter/dynamic-cli-framework-api";
 import type { PopulatedSingleValueType } from "@flowscripter/dynamic-cli-framework-api";
 import getLogger from "../../util/logger.ts";
+import { REDACTED } from "../../util/secretRedaction.ts";
 import { InvalidArgumentReason } from "@flowscripter/dynamic-cli-framework-api";
 
 const logger = getLogger("globalCommandValuePopulation");
@@ -19,16 +20,21 @@ export default function populateGlobalCommandValue(
   potentialArgs: ReadonlyArray<string>,
   defaultValue: PopulatedSingleValueType,
 ): GlobalCommandValuePopulationResult {
+  const argument = globalCommand.argument!;
+  const isSecret = argument.type === ValueTypeName.SECRET;
   logger.debug(() => {
-    const message = `Populating value for global command: '${globalCommand.name}' using potential args: ${potentialArgs.join(
-      " ",
-    )}`;
+    const message = `Populating value for global command: '${globalCommand.name}' using potential args: ${(isSecret
+      ? potentialArgs
+          .slice(0, 1)
+          .map(() => REDACTED)
+          .concat(potentialArgs.slice(1))
+      : potentialArgs
+    ).join(" ")}`;
     if (defaultValue !== undefined) {
-      return `${message} and configured value: '${defaultValue}'`;
+      return `${message} and configured value: '${isSecret ? REDACTED : defaultValue}'`;
     }
     return message;
   });
-  const argument = globalCommand.argument!;
 
   // default to defined argument default value
   let populatedArgumentValue = argument.defaultValue;
@@ -83,5 +89,6 @@ export default function populateGlobalCommandValue(
   return {
     populatedArgumentValue,
     unusedArgs,
+    ...(isSecret && potentialArgs.length > 0 && { secretArgumentNames: [globalCommand.name] }),
   };
 }

package/src/runtime/values/subCommandValuePopulation.ts

@@ -8,6 +8,7 @@ import {
   type PopulatedValueType,
 } from "@flowscripter/dynamic-cli-framework-api";
 import getLogger from "../../util/logger.ts";
+import { REDACTED, redactSubCommandValues } from "../../util/secretRedaction.ts";
 import argumentValueMerge from "./argumentValueMerge.ts";
 import type { SubCommandValuePopulationResult } from "./ValuePopulationResult.ts";
 import type { ComplexOption } from "@flowscripter/dynamic-cli-framework-api";
@@ -87,6 +88,20 @@ class ParseContext {
    */
   currentPositionalIndex;
 
+  /**
+   * Set when the most recent argument supplied a value for a SECRET option or positional.
+   */
+  secretArgument?: { name: string; inline: boolean };
+
+  /**
+   * Return and clear the {@link secretArgument} recorded by the most recent {@link parse}.
+   */
+  takeSecretArgument(): { name: string; inline: boolean } | undefined {
+    const secretArgument = this.secretArgument;
+    this.secretArgument = undefined;
+    return secretArgument;
+  }
+
   /**
    * Use to store lazily created map of option paths e.g. --alpha.b.g and -a.b.gamma for {@link ComplexOption} or {@link Option} instances.
    */
@@ -351,7 +366,10 @@ class ParseContext {
    * @return `false` if there is a problem populating the value, in which case the {@link state} will be set to
    * {@link ParseState.ERROR} and {@link invalidArgument} will be populated.
    */
-  setOptionValue(value: SingleValueType): boolean {
+  setOptionValue(value: SingleValueType, inline = false): boolean {
+    if (this.currentOption!.type === ValueTypeName.SECRET) {
+      this.secretArgument = { name: this.currentOption!.name, inline };
+    }
     let optionValue: Array<PopulatedValues> | PopulatedValues | PopulatedValueType =
       this.populatedArgumentValues;
     const optionPath = this.currentOptionPath as Array<string | number>;
@@ -439,6 +457,10 @@ class ParseContext {
     const positional = this.subCommand.positionals[this.currentPositionalIndex]!;
     const currentValue = this.populatedArgumentValues[positional.name];
 
+    if (positional.type === ValueTypeName.SECRET) {
+      this.secretArgument = { name: positional.name, inline: false };
+    }
+
     // if we haven't populated the argument value before...
     if (currentValue === undefined) {
       if (positional.isVarargMultiple) {
@@ -546,7 +568,7 @@ class ParseContext {
           // try to set the value if we have one
           if (potentialOptionValue !== undefined) {
             // set the value
-            this.setOptionValue(potentialOptionValue);
+            this.setOptionValue(potentialOptionValue, true);
 
             // return regardless
             return;
@@ -587,24 +609,23 @@ export default function populateSubCommandValues(
   potentialArgs: ReadonlyArray<string>,
   defaultValues: PopulatedValues | undefined,
 ): SubCommandValuePopulationResult {
-  logger.debug(() => {
-    const message = `Populating values for sub-command: '${subCommand.name}' using potential args: ${potentialArgs.join(
-      " ",
-    )}`;
-    if (defaultValues !== undefined) {
-      return `${message} and configured values: ${JSON.stringify(defaultValues)}`;
-    }
-    return message;
-  });
-
   const parseContext = new ParseContext(subCommand);
   const unusedArgs: Array<string> = [];
+  const loggedArgs = [...potentialArgs];
+  const secretArgumentNames = new Set<string>();
 
   for (let i = 0; i < potentialArgs.length; i++) {
     const potentialArg = potentialArgs[i]!;
 
     // parse the next arg
     parseContext.parse(potentialArg);
+    const secretArgument = parseContext.takeSecretArgument();
+    if (secretArgument) {
+      secretArgumentNames.add(secretArgument.name);
+      loggedArgs[i] = secretArgument.inline
+        ? `${potentialArg.slice(0, potentialArg.indexOf("=") + 1)}${REDACTED}`
+        : REDACTED;
+    }
 
     // check if we had a parsing error, record the error, flush the remaining args and stop parsing
     if (parseContext.state === ParseState.ERROR) {
@@ -620,6 +641,18 @@ export default function populateSubCommandValues(
     }
   }
 
+  logger.debug(() => {
+    const message = `Populated values for sub-command: '${subCommand.name}' using potential args: ${loggedArgs.join(
+      " ",
+    )}`;
+    if (defaultValues !== undefined) {
+      return `${message} and configured values: ${JSON.stringify(
+        redactSubCommandValues(subCommand, defaultValues),
+      )}`;
+    }
+    return message;
+  });
+
   // Check if the last arg specified an option but no value
   if (parseContext.state === ParseState.OPTION_VALUE_EXPECTED) {
     // special case if the last arg was for a boolean option where the value was implicitly `true`
@@ -639,6 +672,7 @@ export default function populateSubCommandValues(
       populatedArgumentValues: parseContext.populatedArgumentValues,
       unusedArgs: unusedArgs,
       invalidArgument: parseContext.invalidArgument,
+      ...(secretArgumentNames.size > 0 && { secretArgumentNames: [...secretArgumentNames] }),
     };
   }
 
@@ -651,5 +685,6 @@ export default function populateSubCommandValues(
   return {
     populatedArgumentValues,
     unusedArgs: unusedArgs,
+    ...(secretArgumentNames.size > 0 && { secretArgumentNames: [...secretArgumentNames] }),
   };
 }

package/src/util/runnerHelper.ts

@@ -1,5 +1,6 @@
 import type { PrinterService } from "@flowscripter/dynamic-cli-framework-api";
 import { Icon, PRINTER_SERVICE_ID } from "@flowscripter/dynamic-cli-framework-api";
+import type { SecretAwareParseResult } from "../runtime/parser.ts";
 import type { ParseResult } from "../runtime/parser.ts";
 import { isGlobalCommand, isGlobalModifierCommand } from "../runtime/command/CommandTypeGuards.ts";
 import type { Context } from "@flowscripter/dynamic-cli-framework-api";
@@ -122,3 +123,20 @@ export async function printUnusedArgsWarning(
     await printerService.warn(`Unused args: ${overallUnusedArgs.join(" ")}\n\n`, Icon.ALERT);
   }
 }
+
+export async function printSecretArgsWarning(
+  context: Context,
+  parseResult: SecretAwareParseResult,
+) {
+  const secretArgumentNames = parseResult.secretArgumentNames;
+  if (!secretArgumentNames || secretArgumentNames.length === 0) {
+    return;
+  }
+  const printerService = context.getServiceById(PRINTER_SERVICE_ID) as PrinterService;
+  await printerService.warn(
+    `SECRET value passed as a plain argument: ${secretArgumentNames.join(", ")}. ` +
+      "This is not recommended as it may be exposed via shell history and process listings. " +
+      "Use an environment variable, a prompt or a configuration file default instead.\n\n",
+    Icon.ALERT,
+  );
+}

package/src/util/secretRedaction.ts

@@ -0,0 +1,81 @@
+import {
+  ValueTypeName,
+  type ComplexOption,
+  type GlobalCommand,
+  type Option,
+  type PopulatedSingleValueType,
+  type PopulatedValues,
+  type PopulatedValueType,
+  type SubCommand,
+} from "@flowscripter/dynamic-cli-framework-api";
+import { isComplexOption } from "../runtime/argument/ArgumentTypeGuards.ts";
+
+export const REDACTED = "***";
+
+type NamedArgument = { readonly name: string; readonly type?: unknown };
+
+type RedactableValue =
+  | PopulatedValueType
+  | PopulatedValues
+  | Array<PopulatedValues | undefined>
+  | undefined;
+
+function redactValue(
+  definition: NamedArgument | ComplexOption,
+  value: RedactableValue | PopulatedValues,
+): unknown {
+  if (value === undefined || value === null) {
+    return value;
+  }
+  if (isComplexOption(definition as ComplexOption)) {
+    const properties = (definition as ComplexOption).properties;
+    if (Array.isArray(value)) {
+      return value.map((v) => redactValue(definition, v));
+    }
+    return redactDefinedValues(properties, [], value as PopulatedValues);
+  }
+  if (definition.type === ValueTypeName.SECRET) {
+    return Array.isArray(value) ? value.map(() => REDACTED) : REDACTED;
+  }
+  return value;
+}
+
+function redactDefinedValues(
+  options: ReadonlyArray<Option | ComplexOption>,
+  positionals: ReadonlyArray<NamedArgument>,
+  values: PopulatedValues,
+): PopulatedValues {
+  const redacted: Record<string, unknown> = {};
+  for (const [name, value] of Object.entries(values)) {
+    const definition =
+      options.find((o) => o.name === name) ?? positionals.find((p) => p.name === name);
+    redacted[name] = definition ? redactValue(definition, value) : value;
+  }
+  return redacted as PopulatedValues;
+}
+
+/**
+ * Copy of the provided values suitable for logging, with the values of any SECRET options or positionals replaced.
+ */
+export function redactSubCommandValues<T extends PopulatedValues | undefined>(
+  subCommand: SubCommand,
+  values: T,
+): T {
+  if (values === undefined) {
+    return values;
+  }
+  return redactDefinedValues(subCommand.options, subCommand.positionals, values) as T;
+}
+
+/**
+ * Copy of the provided value suitable for logging, with the value replaced if the global command argument is a SECRET.
+ */
+export function redactGlobalCommandValue(
+  globalCommand: GlobalCommand,
+  value: PopulatedSingleValueType,
+): PopulatedSingleValueType {
+  if (value !== undefined && globalCommand.argument?.type === ValueTypeName.SECRET) {
+    return REDACTED;
+  }
+  return value;
+}