@flowscripter/dynamic-cli-framework 9.1.3 → 10.1.0

package/dist/src/util/envVarHelper.js

@@ -8,11 +8,12 @@ function getKeySegment(segment) {
     }
     return keySegment;
 }
-function getSubCommandArgumentKeyPrefix(cliConfig, command, subCommandArgument) {
+function getSubCommandArgumentKeyPrefix(cliConfig, command, subCommandArgument, groupCommand) {
     if (subCommandArgument.configurationKey) {
         return subCommandArgument.configurationKey;
     }
-    return `${getKeySegment(cliConfig.name)}_${getKeySegment(command.name)}_${getKeySegment(subCommandArgument.name)}`;
+    const groupSegment = groupCommand ? `${getKeySegment(groupCommand.name)}_` : "";
+    return `${getKeySegment(cliConfig.name)}_${groupSegment}${getKeySegment(command.name)}_${getKeySegment(subCommandArgument.name)}`;
 }
 function getGlobalArgumentKeyPrefix(cliConfig, command, globalCommandArgument) {
     if (globalCommandArgument.configurationKey) {
@@ -146,13 +147,15 @@ function getOptionValuesFromEnvVars(envVarValues, potentialEnvVarNames, env, opt
  * @param cliConfig the {@link CLIConfig} to use for determining the default configuration key.
  * @param command the {@link SubCommand} to use for determining the default configuration key and containing
  * {@link Positional} and {@link Option} instances to populate values for.
+ * @param groupCommand the {@link GroupCommand} if the command is a group member, in which case the group name
+ * is an additional env var name segment.
  */
-export function getSubCommandValuesFromEnvVars(cliConfig, command) {
+export function getSubCommandValuesFromEnvVars(cliConfig, command, groupCommand) {
     const envVarValues = Object.create(null);
     if (command.options) {
         for (const option of command.options) {
             const potentialEnvVarNames = Object.keys(process.env);
-            const optionPrefix = getSubCommandArgumentKeyPrefix(cliConfig, command, option);
+            const optionPrefix = getSubCommandArgumentKeyPrefix(cliConfig, command, option, groupCommand);
             getOptionValuesFromEnvVars(envVarValues, potentialEnvVarNames, process.env ?? {}, option, optionPrefix);
         }
     }
@@ -163,7 +166,7 @@ export function getSubCommandValuesFromEnvVars(cliConfig, command) {
                 positional.name === "prototype") {
                 throw new Error(`Unsafe key name in use: ${positional.name}, CodeQL Rule ID: js/prototype-polluting-assignment`);
             }
-            let envVarNamePrefix = getSubCommandArgumentKeyPrefix(cliConfig, command, positional);
+            let envVarNamePrefix = getSubCommandArgumentKeyPrefix(cliConfig, command, positional, groupCommand);
             if (positional.isVarargMultiple) {
                 envVarNamePrefix = `${envVarNamePrefix}_`;
                 const matches = Object.keys(process.env).filter((envVarName) => envVarName.startsWith(envVarNamePrefix));

package/dist/src/util/helpHelper.d.ts

@@ -19,7 +19,7 @@ export interface HelpSection {
 export declare function printHelpSections(printerService: PrinterService, tableGeneratorService: TableGeneratorService, sections: Array<HelpSection>): Promise<void>;
 export declare function getGlobalArgumentHelpEntry(cliConfig: CLIConfig, includeEnvVars: boolean, globalCommand: GlobalCommand): HelpEntry;
 export declare function getSubCommandArgumentsSyntax(subCommand: SubCommand): string;
-export declare function getCommandArgsHelpSections(cliConfig: CLIConfig, includeEnvVars: boolean, subCommand: SubCommand, isSingleCommandApp: boolean): Array<HelpSection>;
+export declare function getCommandArgsHelpSections(cliConfig: CLIConfig, includeEnvVars: boolean, subCommand: SubCommand, isSingleCommandApp: boolean, groupCommand?: GroupCommand): Array<HelpSection>;
 export declare function getCommandExamplesHelpSections(printerService: PrinterService, context: Context, subCommand: SubCommand): Array<HelpSection>;
 export declare function getMultiCommandAppSyntax(context: Context, globalModifierCommands: ReadonlyArray<GlobalModifierCommand>, globalCommands: ReadonlyArray<GlobalCommand>, groupCommands: ReadonlyArray<GroupCommand>, subCommands: ReadonlyArray<SubCommand>): string;
 export declare function findPossibleCommandNames(commandName: string, groupCommands: ReadonlyArray<GroupCommand>, subCommands: ReadonlyArray<SubCommand>): string[];

package/dist/src/util/helpHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpHelper.d.ts","sourceRoot":"","sources":["../../../src/util/helpHelper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAG7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAIvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAM5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAG9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAiCrF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CACxC;AAsDD,wBAAsB,iBAAiB,CACrC,cAAc,EAAE,cAAc,EAC9B,qBAAqB,EAAE,qBAAqB,EAC5C,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CA2Cf;AA2BD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EACvB,aAAa,EAAE,aAAa,GAC3B,SAAS,CA6DX;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CA+C3E;AAkLD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,UAAU,EACtB,kBAAkB,EAAE,OAAO,GAC1B,KAAK,CAAC,WAAW,CAAC,CAoBpB;AACD,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,UAAU,GACrB,KAAK,CAAC,WAAW,CAAC,CAgCpB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,sBAAsB,EAAE,aAAa,CAAC,qBAAqB,CAAC,EAC5D,cAAc,EAAE,aAAa,CAAC,aAAa,CAAC,EAC5C,aAAa,EAAE,aAAa,CAAC,YAAY,CAAC,EAC1C,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,GACrC,MAAM,CA8IR;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,aAAa,CAAC,YAAY,CAAC,EAC1C,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,GACrC,MAAM,EAAE,CAkBV"}
+{"version":3,"file":"helpHelper.d.ts","sourceRoot":"","sources":["../../../src/util/helpHelper.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAG7E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAIvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yCAAyC,CAAC;AAM5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yCAAyC,CAAC;AAG9E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AAiCrF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;CACxC;AAsDD,wBAAsB,iBAAiB,CACrC,cAAc,EAAE,cAAc,EAC9B,qBAAqB,EAAE,qBAAqB,EAC5C,QAAQ,EAAE,KAAK,CAAC,WAAW,CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CA2Cf;AA2BD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EACvB,aAAa,EAAE,aAAa,GAC3B,SAAS,CA6DX;AAED,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CA+C3E;AA8LD,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,SAAS,EACpB,cAAc,EAAE,OAAO,EACvB,UAAU,EAAE,UAAU,EACtB,kBAAkB,EAAE,OAAO,EAC3B,YAAY,CAAC,EAAE,YAAY,GAC1B,KAAK,CAAC,WAAW,CAAC,CA4BpB;AACD,wBAAgB,8BAA8B,CAC5C,cAAc,EAAE,cAAc,EAC9B,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,UAAU,GACrB,KAAK,CAAC,WAAW,CAAC,CAgCpB;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,OAAO,EAChB,sBAAsB,EAAE,aAAa,CAAC,qBAAqB,CAAC,EAC5D,cAAc,EAAE,aAAa,CAAC,aAAa,CAAC,EAC5C,aAAa,EAAE,aAAa,CAAC,YAAY,CAAC,EAC1C,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,GACrC,MAAM,CA8IR;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,aAAa,CAAC,YAAY,CAAC,EAC1C,WAAW,EAAE,aAAa,CAAC,UAAU,CAAC,GACrC,MAAM,EAAE,CAkBV"}

package/dist/src/util/helpHelper.js

@@ -216,7 +216,7 @@ export function getSubCommandArgumentsSyntax(subCommand) {
     });
     return syntax;
 }
-function getOptionHelpEntry(cliConfig, includeEnvVars, command, option, subEntryIndent = 0, optionAncestry = []) {
+function getOptionHelpEntry(cliConfig, includeEnvVars, command, option, subEntryIndent = 0, optionAncestry = [], groupCommand) {
     let subEntries;
     let optionCharacters = "--";
     let aliasCharacter = "-";
@@ -230,10 +230,7 @@ function getOptionHelpEntry(cliConfig, includeEnvVars, command, option, subEntry
     if (option.type === ComplexValueTypeName.COMPLEX) {
         subEntries = [];
         option.properties.forEach((property) => {
-            subEntries.push(getOptionHelpEntry(cliConfig, includeEnvVars, command, property, newSubEntryIndent, [
-                ...optionAncestry,
-                option,
-            ]));
+            subEntries.push(getOptionHelpEntry(cliConfig, includeEnvVars, command, property, newSubEntryIndent, [...optionAncestry, option], groupCommand));
         });
     }
     else {
@@ -279,10 +276,7 @@ function getOptionHelpEntry(cliConfig, includeEnvVars, command, option, subEntry
         notesItems.push("array");
     }
     if (includeEnvVars && option.type !== ComplexValueTypeName.COMPLEX) {
-        const configurationKey = getSubCommandArgumentConfigurationKey(cliConfig, command, [
-            ...optionAncestry,
-            option,
-        ]);
+        const configurationKey = getSubCommandArgumentConfigurationKey(cliConfig, command, [...optionAncestry, option], groupCommand);
         if (configurationKey !== undefined) {
             notesItems.push(`env var: ${configurationKey}`);
         }
@@ -303,7 +297,7 @@ function getOptionHelpEntry(cliConfig, includeEnvVars, command, option, subEntry
         helpSubEntries: subEntries,
     };
 }
-function getPositionalHelpEntry(cliConfig, includeEnvVars, command, positional) {
+function getPositionalHelpEntry(cliConfig, includeEnvVars, command, positional, groupCommand) {
     const notesItems = [];
     if (positional.allowableValues !== undefined && positional.allowableValues.length > 0) {
         notesItems.push(`valid values: ${userInputList(positional.allowableValues, "|")}`);
@@ -341,9 +335,7 @@ function getPositionalHelpEntry(cliConfig, includeEnvVars, command, positional)
         notesItems.push("array");
     }
     if (includeEnvVars) {
-        const configurationKey = getSubCommandArgumentConfigurationKey(cliConfig, command, [
-            positional,
-        ]);
+        const configurationKey = getSubCommandArgumentConfigurationKey(cliConfig, command, [positional], groupCommand);
         if (configurationKey !== undefined) {
             notesItems.push(`env var: ${configurationKey}`);
         }
@@ -362,7 +354,7 @@ function getPositionalHelpEntry(cliConfig, includeEnvVars, command, positional)
         description,
     };
 }
-export function getCommandArgsHelpSections(cliConfig, includeEnvVars, subCommand, isSingleCommandApp) {
+export function getCommandArgsHelpSections(cliConfig, includeEnvVars, subCommand, isSingleCommandApp, groupCommand) {
     const helpSections = [];
     if (subCommand.options.length > 0 || subCommand.positionals.length > 0) {
         const argumentsSection = {
@@ -370,10 +362,10 @@ export function getCommandArgsHelpSections(cliConfig, includeEnvVars, subCommand
             helpEntries: [],
         };
         subCommand.options.forEach((option) => {
-            argumentsSection.helpEntries.push(getOptionHelpEntry(cliConfig, includeEnvVars, subCommand, option));
+            argumentsSection.helpEntries.push(getOptionHelpEntry(cliConfig, includeEnvVars, subCommand, option, 0, [], groupCommand));
         });
         subCommand.positionals.forEach((positional) => {
-            argumentsSection.helpEntries.push(getPositionalHelpEntry(cliConfig, includeEnvVars, subCommand, positional));
+            argumentsSection.helpEntries.push(getPositionalHelpEntry(cliConfig, includeEnvVars, subCommand, positional, groupCommand));
         });
         helpSections.push(argumentsSection);
     }

package/dist/src/util/runnerHelper.d.ts

@@ -1,3 +1,4 @@
+import type { SecretAwareParseResult } from "../runtime/parser.ts";
 import type { ParseResult } from "../runtime/parser.ts";
 import type { Context } from "@flowscripter/dynamic-cli-framework-api";
 import type { CommandRegistry } from "@flowscripter/dynamic-cli-framework-api";
@@ -7,4 +8,5 @@ export declare function printRuntimeError(context: Context, err: Error): Promise
 export declare function printNoCommandSpecifiedError(context: Context): Promise<void>;
 export declare function printNoCommandRecognisedError(context: Context, commandRegistry: CommandRegistry, availableArgs: ReadonlyArray<string>): Promise<void>;
 export declare function printUnusedArgsWarning(context: Context, overallUnusedArgs: ReadonlyArray<string>): Promise<void>;
+export declare function printSecretArgsWarning(context: Context, parseResult: SecretAwareParseResult): Promise<void>;
 //# sourceMappingURL=runnerHelper.d.ts.map

package/dist/src/util/runnerHelper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runnerHelper.d.ts","sourceRoot":"","sources":["../../../src/util/runnerHelper.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAY/E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,KAAK,EACV,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,iBAMnE;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,iBAGlE;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,eAAe,EAChC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,iBAgCrC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,iBAQzC"}
+{"version":3,"file":"runnerHelper.d.ts","sourceRoot":"","sources":["../../../src/util/runnerHelper.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yCAAyC,CAAC;AAEvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAY/E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,KAAK,EACV,gBAAgB,UAAQ,iBAiBzB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,iBAMnE;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,iBAGlE;AAED,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,eAAe,EAChC,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC,iBAgCrC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,iBAQzC;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,sBAAsB,iBAapC"}

package/dist/src/util/runnerHelper.js

@@ -78,3 +78,13 @@ export async function printUnusedArgsWarning(context, overallUnusedArgs) {
         await printerService.warn(`Unused args: ${overallUnusedArgs.join(" ")}\n\n`, Icon.ALERT);
     }
 }
+export async function printSecretArgsWarning(context, parseResult) {
+    const secretArgumentNames = parseResult.secretArgumentNames;
+    if (!secretArgumentNames || secretArgumentNames.length === 0) {
+        return;
+    }
+    const printerService = context.getServiceById(PRINTER_SERVICE_ID);
+    await printerService.warn(`SECRET value passed as a plain argument: ${secretArgumentNames.join(", ")}. ` +
+        "This is not recommended as it may be exposed via shell history and process listings. " +
+        "Use an environment variable, a prompt or a configuration file default instead.\n\n", Icon.ALERT);
+}

package/dist/src/util/secretRedaction.d.ts

@@ -0,0 +1,11 @@
+import { type GlobalCommand, type PopulatedSingleValueType, type PopulatedValues, type SubCommand } from "@flowscripter/dynamic-cli-framework-api";
+export declare const REDACTED = "***";
+/**
+ * Copy of the provided values suitable for logging, with the values of any SECRET options or positionals replaced.
+ */
+export declare function redactSubCommandValues<T extends PopulatedValues | undefined>(subCommand: SubCommand, values: T): T;
+/**
+ * Copy of the provided value suitable for logging, with the value replaced if the global command argument is a SECRET.
+ */
+export declare function redactGlobalCommandValue(globalCommand: GlobalCommand, value: PopulatedSingleValueType): PopulatedSingleValueType;
+//# sourceMappingURL=secretRedaction.d.ts.map

package/dist/src/util/secretRedaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretRedaction.d.ts","sourceRoot":"","sources":["../../../src/util/secretRedaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAElB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EAEpB,KAAK,UAAU,EAChB,MAAM,yCAAyC,CAAC;AAGjD,eAAO,MAAM,QAAQ,QAAQ,CAAC;AA4C9B;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,eAAe,GAAG,SAAS,EAC1E,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,CAAC,GACR,CAAC,CAKH;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,wBAAwB,GAC9B,wBAAwB,CAK1B"}

package/dist/src/util/secretRedaction.js

@@ -0,0 +1,45 @@
+import { ValueTypeName, } from "@flowscripter/dynamic-cli-framework-api";
+import { isComplexOption } from "../runtime/argument/ArgumentTypeGuards.js";
+export const REDACTED = "***";
+function redactValue(definition, value) {
+    if (value === undefined || value === null) {
+        return value;
+    }
+    if (isComplexOption(definition)) {
+        const properties = definition.properties;
+        if (Array.isArray(value)) {
+            return value.map((v) => redactValue(definition, v));
+        }
+        return redactDefinedValues(properties, [], value);
+    }
+    if (definition.type === ValueTypeName.SECRET) {
+        return Array.isArray(value) ? value.map(() => REDACTED) : REDACTED;
+    }
+    return value;
+}
+function redactDefinedValues(options, positionals, values) {
+    const redacted = {};
+    for (const [name, value] of Object.entries(values)) {
+        const definition = options.find((o) => o.name === name) ?? positionals.find((p) => p.name === name);
+        redacted[name] = definition ? redactValue(definition, value) : value;
+    }
+    return redacted;
+}
+/**
+ * Copy of the provided values suitable for logging, with the values of any SECRET options or positionals replaced.
+ */
+export function redactSubCommandValues(subCommand, values) {
+    if (values === undefined) {
+        return values;
+    }
+    return redactDefinedValues(subCommand.options, subCommand.positionals, values);
+}
+/**
+ * Copy of the provided value suitable for logging, with the value replaced if the global command argument is a SECRET.
+ */
+export function redactGlobalCommandValue(globalCommand, value) {
+    if (value !== undefined && globalCommand.argument?.type === ValueTypeName.SECRET) {
+        return REDACTED;
+    }
+    return value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowscripter/dynamic-cli-framework",
-  "version": "9.1.3",
+  "version": "10.1.0",
   "description": "A framework for developing CLI applications which supports dynamic discovery and installation of new commands",
   "keywords": [
     "bun",

package/src/command/MultiCommandCliHelpCommand.ts

@@ -288,7 +288,13 @@ abstract class MultiCommandCliAbstractHelpCommand {
     });
 
     helpSections.push(
-      ...getCommandArgsHelpSections(context.cliConfig, this.#includeEnvVars, subCommand, false),
+      ...getCommandArgsHelpSections(
+        context.cliConfig,
+        this.#includeEnvVars,
+        subCommand,
+        false,
+        groupCommand,
+      ),
     );
 
     helpSections.push(...getCommandExamplesHelpSections(printerService, context, subCommand));

package/src/runtime/command/CommandValidator.ts

@@ -165,6 +165,7 @@ function validateSubCommandArgument(subCommandArgument: SubCommandArgument): voi
 export default class CommandValidator {
   readonly #cliConfig: CLIConfig;
   readonly #configurationKeys: Array<string> = [];
+  #currentGroupCommand: GroupCommand | undefined;
 
   public constructor(cliConfig: CLIConfig) {
     this.#cliConfig = cliConfig;
@@ -265,7 +266,12 @@ export default class CommandValidator {
         );
       }
       subCommandNames.push(subCommand.name);
-      this.#validateSubCommand(subCommand);
+      this.#currentGroupCommand = groupCommand;
+      try {
+        this.#validateSubCommand(subCommand);
+      } finally {
+        this.#currentGroupCommand = undefined;
+      }
     });
   }
 
@@ -365,6 +371,7 @@ export default class CommandValidator {
         this.#cliConfig,
         command,
         argumentAncestry,
+        this.#currentGroupCommand,
       );
 
       if (configurationKey !== undefined) {

package/src/runtime/parser.ts

@@ -13,6 +13,7 @@ import {
   validatePositionalValue,
 } from "./values/argumentValueValidation.ts";
 import getLogger from "../util/logger.ts";
+import { redactGlobalCommandValue, redactSubCommandValues } from "../util/secretRedaction.ts";
 import populateSubCommandValues from "./values/subCommandValuePopulation.ts";
 import type { GlobalCommand } from "@flowscripter/dynamic-cli-framework-api";
 import type { SubCommand } from "@flowscripter/dynamic-cli-framework-api";
@@ -21,6 +22,13 @@ const logger = getLogger("parser");
 
 export type { ParseResult } from "@flowscripter/dynamic-cli-framework-api";
 
+/**
+ * A {@link ParseResult} which also reports any SECRET arguments supplied as plain command line arguments.
+ */
+export type SecretAwareParseResult = ParseResult & {
+  readonly secretArgumentNames?: ReadonlyArray<string>;
+};
+
 /**
  * Parse the arguments for the specified {@link CommandClause} assuming it contains a {@link SubCommand}.
  *
@@ -30,7 +38,7 @@ export type { ParseResult } from "@flowscripter/dynamic-cli-framework-api";
 export function parseSubCommandClause(
   commandClause: CommandClause,
   defaultValues?: PopulatedValues,
-): ParseResult {
+): SecretAwareParseResult {
   const command = commandClause.command as SubCommand;
   const potentialArgs = commandClause.potentialArgs;
   const groupCommand = commandClause.groupCommand;
@@ -48,11 +56,8 @@ export function parseSubCommandClause(
     };
   }
 
-  const { populatedArgumentValues, unusedArgs, invalidArgument } = populateSubCommandValues(
-    command,
-    potentialArgs,
-    defaultValues,
-  );
+  const { populatedArgumentValues, unusedArgs, invalidArgument, secretArgumentNames } =
+    populateSubCommandValues(command, potentialArgs, defaultValues);
 
   if (invalidArgument) {
     invalidArguments.push(invalidArgument);
@@ -73,7 +78,7 @@ export function parseSubCommandClause(
 
     logger.debug(
       "Command arguments after options validated: %O with invalid args: %O",
-      populatedArgumentValues,
+      redactSubCommandValues(command, populatedArgumentValues),
       invalidArguments,
     );
 
@@ -91,11 +96,12 @@ export function parseSubCommandClause(
       });
       logger.debug(
         "Command arguments after positionals validated: %O with invalid args: %O",
-        populatedArgumentValues,
+        redactSubCommandValues(command, populatedArgumentValues),
         invalidArguments,
       );
     }
   }
+  const secrets = secretArgumentNames ? { secretArgumentNames } : {};
   if (groupCommand) {
     return {
       command,
@@ -103,6 +109,7 @@ export function parseSubCommandClause(
       groupCommand,
       invalidArguments,
       unusedArgs,
+      ...secrets,
     };
   }
   return {
@@ -110,6 +117,7 @@ export function parseSubCommandClause(
     populatedArgumentValues,
     invalidArguments,
     unusedArgs: unusedArgs,
+    ...secrets,
   };
 }
 
@@ -122,7 +130,7 @@ export function parseSubCommandClause(
 export function parseGlobalCommandClause(
   commandClause: CommandClause,
   defaultValue?: PopulatedSingleValueType,
-): ParseResult {
+): SecretAwareParseResult {
   const command = commandClause.command as GlobalCommand;
   const potentialArgs = commandClause.potentialArgs;
   const invalidArguments: Array<InvalidArgument> = [];
@@ -137,11 +145,8 @@ export function parseGlobalCommandClause(
     };
   }
 
-  let { populatedArgumentValue, unusedArgs, invalidArgument } = populateGlobalCommandValue(
-    command,
-    potentialArgs,
-    defaultValue,
-  );
+  let { populatedArgumentValue, unusedArgs, invalidArgument, secretArgumentNames } =
+    populateGlobalCommandValue(command, potentialArgs, defaultValue);
 
   if (invalidArgument) {
     invalidArguments.push(invalidArgument);
@@ -150,7 +155,7 @@ export function parseGlobalCommandClause(
   logger.debug(
     "Command arguments for command: %s after value population: %O with invalid args: %O and unused args: %O",
     command.name,
-    populatedArgumentValue,
+    redactGlobalCommandValue(command, populatedArgumentValue),
     invalidArguments,
     unusedArgs,
   );
@@ -170,7 +175,7 @@ export function parseGlobalCommandClause(
   logger.debug(
     "Command arguments for command: %s after value validation: %O with invalid args: %O",
     command.name,
-    populatedArgumentValue,
+    redactGlobalCommandValue(command, populatedArgumentValue),
     invalidArguments,
   );
 
@@ -179,5 +184,6 @@ export function parseGlobalCommandClause(
     populatedArgumentValues: populatedArgumentValue,
     invalidArguments,
     unusedArgs,
+    ...(secretArgumentNames && { secretArgumentNames }),
   };
 }

package/src/runtime/runner.ts

@@ -15,6 +15,7 @@ import {
   printNoCommandRecognisedError,
   printNoCommandSpecifiedError,
   printParseResultError,
+  printSecretArgsWarning,
   printUnusedArgsWarning,
 } from "../util/runnerHelper.ts";
 import { scanForGlobalModifierCommandClauses, scanForNonModifierCommandClause } from "./scanner.ts";
@@ -198,6 +199,7 @@ async function findAndExecuteGlobalModifierCommands(
         globalModifierCommandClause,
         defaultArgumentValues as PopulatedSingleValueType,
       );
+      await printSecretArgsWarning(context, parseResult);
 
       if (parseResult.invalidArguments.length > 0) {
         await printParseResultError(context, parseResult);
@@ -314,6 +316,7 @@ async function findAndExecuteNonModifierCommand(
       ? await configurationServiceProvider.getDefaultArgumentValues(
           context.cliConfig,
           scanResult.nonModifierCommandClause.command,
+          scanResult.nonModifierCommandClause.groupCommand,
         )
       : undefined;
 
@@ -328,6 +331,7 @@ async function findAndExecuteNonModifierCommand(
         defaultArgumentValues as PopulatedValues,
       );
     }
+    await printSecretArgsWarning(context, parseResult);
 
     if (parseResult.invalidArguments.length > 0) {
       const prompted = await attemptPromptForMissingArguments(parseResult, context);
@@ -463,6 +467,7 @@ async function findAndExecuteDefaultNonModifierCommand(
         defaultArgumentValues as PopulatedValues,
       );
     }
+    await printSecretArgsWarning(context, parseResult);
 
     // add any unused args back to the list of still unused args
     if (parseResult.unusedArgs.length > 0) {

package/src/runtime/values/ValuePopulationResult.ts

@@ -17,6 +17,11 @@ export interface ValuePopulationResult {
    * Any invalid argument discovered while populating values.
    */
   readonly invalidArgument?: InvalidArgument;
+
+  /**
+   * Names of any SECRET arguments whose values were supplied as plain command line arguments.
+   */
+  readonly secretArgumentNames?: ReadonlyArray<string>;
 }
 
 /**

package/src/runtime/values/globalCommandValuePopulation.ts

@@ -3,6 +3,7 @@ import type { GlobalCommandValuePopulationResult } from "./ValuePopulationResult
 import { ValueTypeName } from "@flowscripter/dynamic-cli-framework-api";
 import type { PopulatedSingleValueType } from "@flowscripter/dynamic-cli-framework-api";
 import getLogger from "../../util/logger.ts";
+import { REDACTED } from "../../util/secretRedaction.ts";
 import { InvalidArgumentReason } from "@flowscripter/dynamic-cli-framework-api";
 
 const logger = getLogger("globalCommandValuePopulation");
@@ -19,16 +20,21 @@ export default function populateGlobalCommandValue(
   potentialArgs: ReadonlyArray<string>,
   defaultValue: PopulatedSingleValueType,
 ): GlobalCommandValuePopulationResult {
+  const argument = globalCommand.argument!;
+  const isSecret = argument.type === ValueTypeName.SECRET;
   logger.debug(() => {
-    const message = `Populating value for global command: '${globalCommand.name}' using potential args: ${potentialArgs.join(
-      " ",
-    )}`;
+    const message = `Populating value for global command: '${globalCommand.name}' using potential args: ${(isSecret
+      ? potentialArgs
+          .slice(0, 1)
+          .map(() => REDACTED)
+          .concat(potentialArgs.slice(1))
+      : potentialArgs
+    ).join(" ")}`;
     if (defaultValue !== undefined) {
-      return `${message} and configured value: '${defaultValue}'`;
+      return `${message} and configured value: '${isSecret ? REDACTED : defaultValue}'`;
     }
     return message;
   });
-  const argument = globalCommand.argument!;
 
   // default to defined argument default value
   let populatedArgumentValue = argument.defaultValue;
@@ -83,5 +89,6 @@ export default function populateGlobalCommandValue(
   return {
     populatedArgumentValue,
     unusedArgs,
+    ...(isSecret && potentialArgs.length > 0 && { secretArgumentNames: [globalCommand.name] }),
   };
 }

package/src/runtime/values/subCommandValuePopulation.ts

@@ -8,6 +8,7 @@ import {
   type PopulatedValueType,
 } from "@flowscripter/dynamic-cli-framework-api";
 import getLogger from "../../util/logger.ts";
+import { REDACTED, redactSubCommandValues } from "../../util/secretRedaction.ts";
 import argumentValueMerge from "./argumentValueMerge.ts";
 import type { SubCommandValuePopulationResult } from "./ValuePopulationResult.ts";
 import type { ComplexOption } from "@flowscripter/dynamic-cli-framework-api";
@@ -87,6 +88,20 @@ class ParseContext {
    */
   currentPositionalIndex;
 
+  /**
+   * Set when the most recent argument supplied a value for a SECRET option or positional.
+   */
+  secretArgument?: { name: string; inline: boolean };
+
+  /**
+   * Return and clear the {@link secretArgument} recorded by the most recent {@link parse}.
+   */
+  takeSecretArgument(): { name: string; inline: boolean } | undefined {
+    const secretArgument = this.secretArgument;
+    this.secretArgument = undefined;
+    return secretArgument;
+  }
+
   /**
    * Use to store lazily created map of option paths e.g. --alpha.b.g and -a.b.gamma for {@link ComplexOption} or {@link Option} instances.
    */
@@ -351,7 +366,10 @@ class ParseContext {
    * @return `false` if there is a problem populating the value, in which case the {@link state} will be set to
    * {@link ParseState.ERROR} and {@link invalidArgument} will be populated.
    */
-  setOptionValue(value: SingleValueType): boolean {
+  setOptionValue(value: SingleValueType, inline = false): boolean {
+    if (this.currentOption!.type === ValueTypeName.SECRET) {
+      this.secretArgument = { name: this.currentOption!.name, inline };
+    }
     let optionValue: Array<PopulatedValues> | PopulatedValues | PopulatedValueType =
       this.populatedArgumentValues;
     const optionPath = this.currentOptionPath as Array<string | number>;
@@ -439,6 +457,10 @@ class ParseContext {
     const positional = this.subCommand.positionals[this.currentPositionalIndex]!;
     const currentValue = this.populatedArgumentValues[positional.name];
 
+    if (positional.type === ValueTypeName.SECRET) {
+      this.secretArgument = { name: positional.name, inline: false };
+    }
+
     // if we haven't populated the argument value before...
     if (currentValue === undefined) {
       if (positional.isVarargMultiple) {
@@ -546,7 +568,7 @@ class ParseContext {
           // try to set the value if we have one
           if (potentialOptionValue !== undefined) {
             // set the value
-            this.setOptionValue(potentialOptionValue);
+            this.setOptionValue(potentialOptionValue, true);
 
             // return regardless
             return;
@@ -587,24 +609,23 @@ export default function populateSubCommandValues(
   potentialArgs: ReadonlyArray<string>,
   defaultValues: PopulatedValues | undefined,
 ): SubCommandValuePopulationResult {
-  logger.debug(() => {
-    const message = `Populating values for sub-command: '${subCommand.name}' using potential args: ${potentialArgs.join(
-      " ",
-    )}`;
-    if (defaultValues !== undefined) {
-      return `${message} and configured values: ${JSON.stringify(defaultValues)}`;
-    }
-    return message;
-  });
-
   const parseContext = new ParseContext(subCommand);
   const unusedArgs: Array<string> = [];
+  const loggedArgs = [...potentialArgs];
+  const secretArgumentNames = new Set<string>();
 
   for (let i = 0; i < potentialArgs.length; i++) {
     const potentialArg = potentialArgs[i]!;
 
     // parse the next arg
     parseContext.parse(potentialArg);
+    const secretArgument = parseContext.takeSecretArgument();
+    if (secretArgument) {
+      secretArgumentNames.add(secretArgument.name);
+      loggedArgs[i] = secretArgument.inline
+        ? `${potentialArg.slice(0, potentialArg.indexOf("=") + 1)}${REDACTED}`
+        : REDACTED;
+    }
 
     // check if we had a parsing error, record the error, flush the remaining args and stop parsing
     if (parseContext.state === ParseState.ERROR) {
@@ -620,6 +641,18 @@ export default function populateSubCommandValues(
     }
   }
 
+  logger.debug(() => {
+    const message = `Populated values for sub-command: '${subCommand.name}' using potential args: ${loggedArgs.join(
+      " ",
+    )}`;
+    if (defaultValues !== undefined) {
+      return `${message} and configured values: ${JSON.stringify(
+        redactSubCommandValues(subCommand, defaultValues),
+      )}`;
+    }
+    return message;
+  });
+
   // Check if the last arg specified an option but no value
   if (parseContext.state === ParseState.OPTION_VALUE_EXPECTED) {
     // special case if the last arg was for a boolean option where the value was implicitly `true`
@@ -639,6 +672,7 @@ export default function populateSubCommandValues(
       populatedArgumentValues: parseContext.populatedArgumentValues,
       unusedArgs: unusedArgs,
       invalidArgument: parseContext.invalidArgument,
+      ...(secretArgumentNames.size > 0 && { secretArgumentNames: [...secretArgumentNames] }),
     };
   }
 
@@ -651,5 +685,6 @@ export default function populateSubCommandValues(
   return {
     populatedArgumentValues,
     unusedArgs: unusedArgs,
+    ...(secretArgumentNames.size > 0 && { secretArgumentNames: [...secretArgumentNames] }),
   };
 }