@kaynooo/cli-docker 0.4.0 → 0.5.0

package/dist/dx-cli.js

@@ -3,7 +3,6 @@
 
 // src/dx-cli.ts
 import process11 from "process";
-
 // ../kit/src/args.ts
 import process4 from "process";
 import { parseArgs } from "util";
@@ -306,17 +305,23 @@ var FULL_STOP = /\.$/;
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
-  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces, exits = [] } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exitRows(exits, colors), ...exampleRows(examples, colors)].join(`
 `);
 }
+function exitRows(exits, colors = paint(process3.stdout)) {
+  if (exits.length === 0)
+    return [];
+  const width = Math.max(...exits.map(([code]) => String(code).length));
+  return ["", colors.bold("Exits:"), ...exits.map(([code, meaning]) => `  ${colors.cyan(String(code).padEnd(width))}  ${meaning}`)];
+}
 function replacesRows(replaces, colors = paint(process3.stdout)) {
   return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
 }
 function wantsHelpJson(env = process3.env) {
   return env.KIT_HELP === "json";
 }
-function description(usage, { examples = [], replaces } = {}) {
+function description(usage, { examples = [], replaces, exits } = {}, options) {
   const lines = usage.replace(USAGE_PREFIX, "").split(`
 `);
   const first = lines[0];
@@ -327,7 +332,9 @@ function description(usage, { examples = [], replaces } = {}) {
     synopsis: colon === -1 ? first : first.slice(0, colon),
     summary: colon === -1 ? fallback : first.slice(colon + 2),
     ...replaces === undefined ? {} : { replaces },
-    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] }),
+    ...exits === undefined ? {} : { exits: exits.map(([code, meaning]) => ({ code, meaning })) },
+    ...options === undefined ? {} : { options: Object.entries(options).map(([name, { short, description }]) => ({ name, ...short === undefined ? {} : { short }, ...description === undefined ? {} : { description } })) }
   };
 }
 function exampleRows(examples, colors = paint(process3.stdout)) {
@@ -369,6 +376,16 @@ function closest(name, names) {
   const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
   return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
 }
+// ../kit/src/input.ts
+var WHOLE = /^\d+$/;
+function wholeNumber(value, name, fallback, min = 1) {
+  if (value === undefined)
+    return fallback;
+  const number = Number(value);
+  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
+  return number;
+}
 
 // ../kit/src/args.ts
 var DASHES = /^-+/;
@@ -442,7 +459,7 @@ function parse(args, usage, options, settings = {}) {
   const { own, rest } = settings.trailing === true ? splitTrailing(args, all, settings.positionals?.length ?? 0) : splitRest(args, settings.rest === true);
   let parsed;
   try {
-    parsed = parseArgs({ args: joinDashValues(withBare(own, all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(withBare(withAliases(own, all), all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     const message = parseError(error);
     throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
@@ -450,7 +467,7 @@ function parse(args, usage, options, settings = {}) {
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, listing, undefined, settings));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings, listing)) : helpText(usage, listing, undefined, settings));
     throw new HelpShown;
   }
   checkChoices(parsed.values, all);
@@ -492,6 +509,18 @@ function listed(options, allowNegative) {
     return [...option.description === undefined ? [] : [[name, option]], [`no-${name}`, { type: "boolean", description: option.negative }]];
   }));
 }
+function withAliases(args, options) {
+  const named = new Map(Object.entries(options).flatMap(([name, { aliases = [] }]) => aliases.map((alias) => [`--${alias}`, `--${name}`])));
+  if (named.size === 0)
+    return args;
+  const separator = args.indexOf("--");
+  const own = separator === -1 ? args : args.slice(0, separator);
+  return [...own.map((arg) => {
+    const at = arg.indexOf("=");
+    const current = named.get(at === -1 ? arg : arg.slice(0, at));
+    return current === undefined ? arg : `${current}${at === -1 ? "" : arg.slice(at)}`;
+  }), ...separator === -1 ? [] : args.slice(separator)];
+}
 function withBare(args, options) {
   const bare = new Map(Object.entries(options).flatMap(([name, { short, optional }]) => optional === undefined ? [] : [[`--${name}`, optional], ...short === undefined ? [] : [[`-${short}`, optional]]]));
   if (bare.size === 0)
@@ -582,6 +611,8 @@ var ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x
 var RESET_STYLE = `${ESC}[0m`;
 var CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
 // ../kit/src/cli.ts
+import { readFileSync, realpathSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
 import process6 from "process";
 
 // ../kit/src/usage.ts
@@ -724,11 +755,22 @@ async function printCandidates(found) {
     console.log(line);
   return 0;
 }
+function packageVersion(entry = Bun.main) {
+  for (let dir = dirname2(realpathSync(entry));; dir = dirname2(dir)) {
+    try {
+      const { version } = JSON.parse(readFileSync(join2(dir, "package.json"), "utf8"));
+      if (typeof version === "string")
+        return version;
+    } catch {}
+    if (dirname2(dir) === dir)
+      return "0.0.0";
+  }
+}
 async function runMain({ name, version, run, redact, usage }, argv = process6.argv.slice(2)) {
   if (argv[0] === COMPLETE)
     return printCandidates(leafCandidates(run, argv.slice(1)));
   if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-    console.log(version);
+    console.log(version ?? packageVersion());
     return 0;
   }
   let code;
@@ -737,26 +779,392 @@ async function runMain({ name, version, run, redact, usage }, argv = process6.ar
   } catch (error) {
     code = reportThrown(name, error, redact, wantsJson(argv));
   }
-  if (usage !== false)
-    recordUsage(usageEntry(name, undefined, argv, code));
+  if (usage !== false) {
+    try {
+      recordUsage(usageEntry(name, undefined, argv, code));
+    } catch {}
+  }
   return code;
 }
+// ../kit/src/compose.ts
+async function captureOutput(argv, { cwd, env } = {}) {
+  const run = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, env: { ...process.env, ...env }, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, code] = await Promise.all([run.stdout.text(), run.stderr.text(), run.exited]);
+  return { code, stdout, stderr };
+}
+function composeError({ code, stderr }) {
+  const last = stderr.trim().split(`
+`).at(-1) ?? "";
+  return last === "" ? `exit ${code}` : last;
+}
 // ../kit/src/secrets.ts
+var SECRET_PART = /token|secret|passw|credential|private|dsn|apikey|accesskey|key$/i;
 var SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
+var WORD_BREAKS = /[^a-zA-Z\d]+|(?<=[a-z\d])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/;
+function isSecretName(name) {
+  return SECRET_PART.test(name) || name.split(WORD_BREAKS).some((word) => SECRET_WORDS.has(word.toLowerCase()));
+}
 // ../kit/src/sessions.ts
 var {Glob } = globalThis.Bun;
 var SESSION_FILES = new Glob("*.json");
 var ACCOUNT_DIRS = new Glob("*/sessions");
-// package.json
-var version = "0.4.0";
-
 // src/dx.ts
 import process10 from "process";
 
+// ../env/src/files.ts
+import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
+import { basename, dirname as dirname3, join as join3 } from "path";
+
+// ../env/src/dotenv.ts
+var ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i;
+var INLINE_COMMENT = /\s+#.*$/;
+var CARRIAGE_RETURN = /\r$/;
+var ESCAPES = { n: `
+`, r: "\r", t: "\t", '"': '"', "\\": "\\", $: "$" };
+function closingQuote(text, quote) {
+  for (let index = 0;index < text.length; index++) {
+    if (quote === '"' && text[index] === "\\")
+      index++;
+    else if (text[index] === quote)
+      return index;
+  }
+  return -1;
+}
+function unescapeDollar(text) {
+  return text.replaceAll("\\$", "$");
+}
+function unescapeDouble(text) {
+  let out = "";
+  for (let index = 0;index < text.length; index++) {
+    const next = text[index + 1];
+    if (text[index] === "\\" && next !== undefined && next in ESCAPES) {
+      out += ESCAPES[next];
+      index++;
+    } else {
+      out += text[index];
+    }
+  }
+  return out;
+}
+function parseDotenv(text) {
+  const physical = text.split(`
+`);
+  const lines = [];
+  for (let index = 0;index < physical.length; index++) {
+    const line = physical[index] ?? "";
+    const match = ASSIGNMENT.exec(line.replace(CARRIAGE_RETURN, ""));
+    if (match === null) {
+      lines.push({ raw: line });
+      continue;
+    }
+    const [, key = "", rest = ""] = match;
+    const start = rest.trimStart();
+    const quote = start[0];
+    if (quote !== '"' && quote !== "'" && quote !== "`") {
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, "").trim()) });
+      continue;
+    }
+    let body = start.slice(1);
+    let raw = line;
+    let end = closingQuote(body, quote);
+    while (end === -1 && index + 1 < physical.length) {
+      index++;
+      body += `
+${(physical[index] ?? "").replace(CARRIAGE_RETURN, "")}`;
+      raw += `
+${physical[index] ?? ""}`;
+      end = closingQuote(body, quote);
+    }
+    const inner = end === -1 ? body : body.slice(0, end);
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) });
+  }
+  return { lines };
+}
+function entries(file) {
+  const map = new Map;
+  for (const line of file.lines) {
+    if (line.key !== undefined)
+      map.set(line.key, line.value ?? "");
+  }
+  return map;
+}
+
+// ../env/src/mask.ts
+var MIN_KNOWN_LENGTH = 4;
+var KEY_MASK = "*** private key redacted ***";
+var PLAIN_VALUE = /^(?:true|false|null|none|nil|yes|no|on|off|undefined)$/i;
+var PLACEHOLDER = /^[$%{<(*/]/;
+var URL_PASSWORD = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]*:([^\s'"]{1,1024})@/dgi;
+var PORT = /^\d{1,5}$/;
+var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
+function isPlaceholder(value) {
+  return PLACEHOLDER.test(value) || PLAIN_VALUE.test(value);
+}
+var TOKEN_FORMATS = [
+  { kind: "GitHub token", pattern: /\b(?:gh[pousr]_|github_pat_)\w{20,}/dg },
+  { kind: "GitLab token", pattern: /\bglpat-[\w-]{20,}/dg },
+  { kind: "API key", pattern: /\bsk-[\w-]{20,}/dg },
+  { kind: "Slack token", pattern: /\bx(?:ox[abprs]|app)-[\w-]{10,}/dg },
+  { kind: "JWT", pattern: /\beyJ[\w-]+\.[\w-]+\.[\w-]+/dg },
+  { kind: "AWS access key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/dg },
+  { kind: "npm token", pattern: /\bnpm_[A-Za-z0-9]{30,}/dg },
+  { kind: "Stripe key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{10,}/dg },
+  { kind: "Google API key", pattern: /\bAIza[\w-]{35}/dg },
+  { kind: "SendGrid key", pattern: /\bSG\.[\w-]{16,}\.[\w-]{16,}/dg },
+  { kind: "Authorization header", pattern: /\bAuthorization["']?\s*[:=]\s*["']?(?:Bearer|Basic|Token|Digest)\s+([^\s"',;]{8,})/dgi, skip: isPlaceholder },
+  { kind: "Bearer token", pattern: /\bBearer\s+((?=[\w.~+/=-]*\d)[\w.~+/=-]{20,})/dg },
+  { kind: "password", pattern: /(?<![\w-])(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?=([^\s"'&;,]{4,})/dgi, skip: isPlaceholder },
+  { kind: "password", pattern: /(?<![\w-])["']?(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?["']?\s*[:=]\s*(["'])((?:\\.|(?!\1)[^\\\n]){4,})\1/dgi, skip: isPlaceholder }
+];
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_BODY = /(?<=-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)(?:(?!-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)[\s\S])+/dg;
+var PEM_BEGIN_ALL = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/g;
+var URL_PARTS = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
+var PATH_SEGMENT = /[^/]+/g;
+var SECRET_PARAM = /^(?:token|[a-z]+_token|key|api[_-]?key|access[_-]?key|secret|[a-z]+_secret|password|passwd|pwd|sig|signature|auth|authorization)$/i;
+var WEBHOOK_FORMATS = [
+  ["Discord webhook", /(?:^|\.)discord(?:app)?\.com\/api\/(?:v\d+\/)?webhooks\/\d+\/([\w-]+)/di],
+  ["Slack webhook", /^hooks\.slack\.com\/(?:services|workflows)\/(?:[\w-]+\/)*([\w-]+)/di],
+  ["Uptime Kuma push URL", /\/api\/push\/([\w-]+)/di],
+  ["healthchecks.io ping URL", /^hc-ping\.com\/([\w-]+)/di]
+];
+var OPAQUE_SEGMENT = /^(?:(?=[\w-]{20,}$)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\w-]+|(?=[A-Za-z\d]{32,}$)(?=.*[A-Za-z])(?=.*\d).+)$/;
+function hint(value) {
+  const shown = Math.min(3, Math.floor(value.length / 4));
+  return `${value.slice(0, shown)}***(${value.length})`;
+}
+function forms(value) {
+  return [...new Set([value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])];
+}
+function knownSecrets(pairs) {
+  const keys = new Map;
+  for (const [key, value] of pairs) {
+    if (value.length < MIN_KNOWN_LENGTH || PLAIN_VALUE.test(value))
+      continue;
+    for (const form of forms(value)) {
+      if (!keys.has(form))
+        keys.set(form, key);
+    }
+  }
+  if (keys.size === 0)
+    return { pattern: undefined, keys };
+  const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
+  return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
+}
+function passwordSpans(text) {
+  const spans = [];
+  for (const url of text.matchAll(URL_PASSWORD)) {
+    const [start, end] = url.indices?.[1] ?? [];
+    const password = url[1] ?? "";
+    const slash = password.indexOf("/");
+    if (start !== undefined && end !== undefined && !(slash !== -1 && PORT.test(password.slice(0, slash))))
+      spans.push([start, end]);
+  }
+  return spans;
+}
+function urlPasswords(text) {
+  return passwordSpans(text).map(([start, end]) => text.slice(start, end));
+}
+function urlTokens(line) {
+  const found = [];
+  const add = (kind, start, value) => {
+    found.push({ start, end: start + value.length, kind, mask: hint(value) });
+  };
+  for (const url of line.matchAll(URL_PARTS)) {
+    const [authority, path = "", query] = [url[1] ?? "", url[2] ?? "", url[3]];
+    const authorityStart = url.indices?.[1]?.[0];
+    const pathStart = url.indices?.[2]?.[0];
+    const queryStart = url.indices?.[3]?.[0];
+    if (authorityStart === undefined || pathStart === undefined)
+      continue;
+    const hostAt = authority.lastIndexOf("@") + 1;
+    const target = authority.slice(hostAt) + path;
+    for (const [kind, pattern] of WEBHOOK_FORMATS) {
+      const [start, end] = pattern.exec(target)?.indices?.[1] ?? [];
+      if (start !== undefined && end !== undefined)
+        add(kind, authorityStart + hostAt + start, target.slice(start, end));
+    }
+    for (const segment of path.matchAll(PATH_SEGMENT)) {
+      if (OPAQUE_SEGMENT.test(segment[0]))
+        add("URL token", pathStart + segment.index, segment[0]);
+    }
+    if (query === undefined || queryStart === undefined)
+      continue;
+    let offset = 0;
+    for (const param of query.split("&")) {
+      const equals = param.indexOf("=");
+      if (equals > 0 && equals < param.length - 1 && SECRET_PARAM.test(param.slice(0, equals)))
+        add("URL token", queryStart + offset + equals + 1, param.slice(equals + 1));
+      offset += param.length + 1;
+    }
+  }
+  return found.filter((match) => match.end > match.start);
+}
+function findSecrets(line, known) {
+  const found = [];
+  for (const [start, end] of passwordSpans(line))
+    found.push({ start, end, kind: "URL password", mask: "***" });
+  for (const body of line.matchAll(PEM_BODY)) {
+    const [start, end] = body.indices?.[0] ?? [];
+    if (start !== undefined && end !== undefined)
+      found.push({ start, end, kind: "private key", mask: KEY_MASK });
+  }
+  for (const { kind, pattern, skip } of TOKEN_FORMATS) {
+    for (const token of line.matchAll(pattern)) {
+      const [start, end] = token.indices?.at(-1) ?? [];
+      if (start === undefined || end === undefined)
+        continue;
+      const value = line.slice(start, end);
+      if (!skip?.(value))
+        found.push({ start, end, kind, mask: hint(value) });
+    }
+  }
+  found.push(...urlTokens(line));
+  if (known?.pattern !== undefined) {
+    for (const value of line.matchAll(known.pattern))
+      found.push({ start: value.index, end: value.index + value[0].length, kind: `value of ${known.keys.get(value[0])}`, mask: hint(value[0]) });
+  }
+  found.sort((a, b) => a.start - b.start || b.end - a.end);
+  const kept = [];
+  for (const match of found) {
+    if (match.start >= (kept.at(-1)?.end ?? 0))
+      kept.push(match);
+  }
+  return kept;
+}
+function openKeyBody(line) {
+  const last = [...line.matchAll(PEM_BEGIN_ALL)].at(-1);
+  if (last === undefined)
+    return;
+  const after = line.slice(last.index + last[0].length);
+  return PEM_END.test(after) ? undefined : after.trim();
+}
+function maskLine(line, known) {
+  let out = "";
+  let at = 0;
+  for (const match of findSecrets(line, known)) {
+    out += line.slice(at, match.start) + match.mask;
+    at = match.end;
+  }
+  return out + line.slice(at);
+}
+
+// ../env/src/files.ts
+var ENV_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.envrc)$/;
+var KNOWN_DEPTH = 3;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+async function isFileEntry(entry, path) {
+  if (entry.isFile())
+    return true;
+  if (!entry.isSymbolicLink())
+    return false;
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function secretPairs(file) {
+  const pairs = [];
+  for (const [key, value] of entries(file)) {
+    if (isSecretName(key))
+      pairs.push([key, value]);
+    else
+      pairs.push(...urlPasswords(value).map((password) => [key, password]));
+  }
+  return pairs;
+}
+async function envFilesBelow(folder, depth = 0) {
+  const found = [];
+  let children;
+  try {
+    children = await readdir(folder, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of children) {
+    const path = join3(folder, entry.name);
+    if (entry.isDirectory() && depth < KNOWN_DEPTH && !SKIPPED.has(entry.name))
+      found.push(...await envFilesBelow(path, depth + 1));
+    else if (ENV_FILE.test(entry.name) && await isFileEntry(entry, path))
+      found.push(path);
+  }
+  return found;
+}
+async function loadKnown(folder = process.cwd(), extra = []) {
+  const pairs = extra.flatMap(secretPairs);
+  for (const path of await envFilesBelow(folder)) {
+    try {
+      pairs.push(...secretPairs(parseDotenv(await Bun.file(path).text())));
+    } catch {}
+  }
+  return knownSecrets(pairs);
+}
+
+// ../env/src/redactor.ts
+var MAX_PENDING = 1 << 18;
+var OVERLAP = 1 << 13;
+
+class Redactor {
+  known;
+  pending = "";
+  inKey = false;
+  hidden = false;
+  constructor(known) {
+    this.known = known;
+  }
+  push(chunk) {
+    const end = chunk.lastIndexOf(`
+`);
+    this.pending += chunk;
+    if (end === -1)
+      return this.pending.length > MAX_PENDING ? this.cut() : "";
+    const split = this.pending.length - chunk.length + end + 1;
+    const complete = this.pending.slice(0, split);
+    this.pending = this.pending.slice(split);
+    return complete.split(`
+`).slice(0, -1).map((line) => this.line(line)).filter((line) => line !== undefined).map((line) => `${line}
+`).join("");
+  }
+  cut() {
+    const limit = this.pending.length - OVERLAP;
+    const space = this.pending.lastIndexOf(" ", limit);
+    const at = space > 0 ? space + 1 : limit;
+    const head = this.pending.slice(0, at);
+    this.pending = this.pending.slice(at);
+    return this.line(head) ?? "";
+  }
+  end() {
+    const rest = this.pending;
+    this.pending = "";
+    return rest === "" ? "" : this.line(rest) ?? "";
+  }
+  line(line) {
+    if (this.inKey) {
+      const end = PEM_END.exec(line);
+      if (end === null) {
+        if (this.hidden)
+          return;
+        this.hidden = true;
+        return KEY_MASK;
+      }
+      this.inKey = false;
+      return (end.index > 0 && !this.hidden ? KEY_MASK : "") + this.line(line.slice(end.index));
+    }
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      this.inKey = true;
+      this.hidden = body !== "";
+    }
+    return maskLine(line, this.known);
+  }
+}
+
 // ../kit/src/fzf.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname4, join as join4 } from "path";
 import process8 from "process";
 var REMEMBERED = 20;
 function table(rows) {
@@ -812,12 +1220,12 @@ function heightFor(count) {
   return String(Math.max(15, Math.ceil((count + 4) / 0.6)));
 }
 function historyFile(name) {
-  return join2(process8.env.XDG_CACHE_HOME ?? join2(homedir2(), ".cache"), name, "history.json");
+  return join4(process8.env.XDG_CACHE_HOME ?? join4(homedir2(), ".cache"), name, "history.json");
 }
 function history(name) {
   try {
     const file = historyFile(name);
-    return existsSync(file) ? JSON.parse(readFileSync(file, "utf-8")) : {};
+    return existsSync(file) ? JSON.parse(readFileSync2(file, "utf-8")) : {};
   } catch {
     return {};
   }
@@ -829,7 +1237,7 @@ function record(name, run) {
   const all = history(name);
   const file = historyFile(name);
   all[process8.cwd()] = [run, ...(all[process8.cwd()] ?? []).filter((earlier) => earlier.id !== run.id)].slice(0, REMEMBERED);
-  mkdirSync2(dirname2(file), { recursive: true });
+  mkdirSync2(dirname4(file), { recursive: true });
   writeFileSync(file, JSON.stringify(all));
 }
 function byRecency(items, previous, idOf) {
@@ -855,25 +1263,25 @@ function list(rows) {
 import process9 from "process";
 
 // src/stack.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname3, join as join3, relative, resolve } from "path";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname5, join as join5, relative, resolve } from "path";
 var LABEL_FORMAT = ["project", "project.config_files", "project.environment_file", "project.working_dir"].map((label) => `{{.Label "com.docker.compose.${label}"}}`).join("\t");
 var COMPOSE_FILE_VAR = /^\s*(?:export\s+)?COMPOSE_FILE\s*=\s*\S/m;
 var COMPOSE_FILES = ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"];
-var SKIPPED = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
+var SKIPPED2 = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
 var ACTIONS = ["shell", "logs", "restart", "up", "stop", "build"];
 function from(dir, command) {
   return dir === "." ? command : ["env", "-C", dir, ...command];
 }
 function children(dir = ".") {
-  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED.has(child.name)).map((child) => child.name).sort();
+  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED2.has(child.name)).map((child) => child.name).sort();
 }
 function up(dir) {
   const dirs = [];
-  for (let current = dir;; current = join3(current, "..")) {
+  for (let current = dir;; current = join5(current, "..")) {
     dirs.push(current);
     const absolute = resolve(current);
-    if (existsSync2(join3(current, ".git")) || dirname3(absolute) === absolute)
+    if (existsSync2(join5(current, ".git")) || dirname5(absolute) === absolute)
       return dirs;
   }
 }
@@ -881,10 +1289,10 @@ function stackAt(dir) {
   return { dir, run: from(dir, ["docker", "compose"]), list: { argv: ["docker", "compose"], cwd: resolve(dir), env: process.env } };
 }
 function holdsStack(dir) {
-  if (COMPOSE_FILES.some((name) => existsSync2(join3(dir, name))))
+  if (COMPOSE_FILES.some((name) => existsSync2(join5(dir, name))))
     return true;
   try {
-    return COMPOSE_FILE_VAR.test(readFileSync2(join3(dir, ".env"), "utf-8"));
+    return COMPOSE_FILE_VAR.test(readFileSync3(join5(dir, ".env"), "utf-8"));
   } catch {
     return false;
   }
@@ -932,13 +1340,8 @@ async function recordedNearby() {
   return (await labels()).filter((stack) => dirs.has(stack.workdir));
 }
 async function attempt(stack, args) {
-  const proc = Bun.spawn([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env, stdout: "pipe", stderr: "pipe" });
-  const [text, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
-  if (code === 0)
-    return { text, error: undefined };
-  const last = stderr.trim().split(`
-`).at(-1) ?? "";
-  return { text: "", error: last === "" ? `exit ${code}` : last };
+  const result = await captureOutput([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env });
+  return result.code === 0 ? { text: result.stdout, error: undefined } : { text: "", error: composeError(result) };
 }
 async function output(stack, args) {
   return (await attempt(stack, args)).text;
@@ -982,13 +1385,14 @@ function key(service) {
 async function shellOf(service) {
   return await output(service.stack, ["exec", "-T", service.name, "sh", "-c", "command -v bash"]) ? "bash" : "sh";
 }
-async function commandFor(service, action) {
+var LOGS_TAIL = 200;
+async function commandFor(service, action, logs = {}) {
   const run = service.stack.run;
   switch (action) {
     case "shell":
       return [...run, "exec", service.name, await shellOf(service)];
     case "logs":
-      return [...run, "logs", "-f", "--tail=200", service.name];
+      return [...run, "logs", ...logs.follow === false ? [] : ["-f"], `--tail=${logs.tail ?? LOGS_TAIL}`, service.name];
     case "restart":
       return [...run, "restart", service.name];
     case "up":
@@ -1014,8 +1418,12 @@ async function serviceNamed(dir, name, project) {
   const stack = recorded === undefined ? stackAt(dir) : labelledStack(dir, recorded);
   return (await services(stack)).find((candidate) => candidate.name === name);
 }
+function maskLog(text, known) {
+  const redactor = new Redactor(known);
+  return redactor.push(text) + redactor.end();
+}
 async function logsOf(stack, name) {
-  return output(stack, ["logs", "--tail=30", "--no-log-prefix", name]);
+  return maskLog(await output(stack, ["logs", "--tail=30", "--no-log-prefix", name]), await loadKnown());
 }
 
 // src/picker.ts
@@ -1048,13 +1456,14 @@ function pickService(services) {
 var usage2 = `dx [service] [action]
 dx -
 
-Without a service, picks one with fzf when it is installed and a terminal is attached: enter opens its shell (or brings a stopped service up), ctrl-l follows its logs, ctrl-r restarts, ctrl-x stops and ctrl-b rebuilds it. The services last acted on come first, per folder. Without fzf or a terminal it lists them instead.
-\`dx -\` does the last action again, \`dx <service> [action]\` acts without the picker: \`shell\` (bash when the container has it), \`logs\` (follows the last 200 lines), \`restart\`, \`up\`, \`stop\` or \`build\` (up with a rebuild).
-The services are the stack of this folder or its nearest parent, the ones of the child folders (keyed \`api/php\`), and stacks found only through their containers (keyed \`<project>:php\`).
-
-Exits with the code of the command it ran, 1 when there is no compose service here or none by that name.`;
+Without a terminal or without fzf (a script, a pipe, an agent) \`dx\` lists the services with their state, ports and image: that listing is the form to use there, \`--json\` giving the full record. On a terminal with fzf it picks one instead: enter opens its shell (or brings a stopped service up), ctrl-l follows its logs, ctrl-r restarts, ctrl-x stops and ctrl-b rebuilds it. The services last acted on come first, per folder.
+\`dx -\` does the last action again, \`dx <service> [action]\` acts without the picker: \`shell\` (bash when the container has it), \`logs\` (follows the last ${LOGS_TAIL} lines; \`--tail N\` changes the count and \`--no-follow\` prints them once and exits, for a script), \`restart\`, \`up\`, \`stop\` or \`build\` (up with a rebuild).
+The services are the stack of this folder or its nearest parent, the ones of the child folders (keyed \`api/php\`), and stacks found only through their containers (keyed \`<project>:php\`).`;
+var EXITS = [["the code of the command it ran", "a listing, a shell, logs, restart, up, stop or build"], [0, "it listed the services"], [1, "no compose service here or none by that name"], [2, "a usage error"]];
 var options = {
-  json: jsonOption("[{ key, project, name, state, status, ports, image }]")
+  json: jsonOption("[{ key, project, name, state, status, ports, image }]"),
+  tail: { type: "string", description: `log lines shown by the logs action (${LOGS_TAIL})` },
+  follow: { type: "boolean", negative: "print the logs once and exit instead of following them" }
 };
 function table2(services) {
   const colors = paint(process10.stdout);
@@ -1108,6 +1517,20 @@ async function hidden(flag, rest, services) {
   }
   return;
 }
+function maskedLogs(command, redactPath = Bun.which("redact")) {
+  if (redactPath === null)
+    fail("redact is not installed, so the logs would not be masked", 1);
+  return ["sh", "-c", '"$@" | redact', "sh", ...command];
+}
+async function followMasked(command) {
+  const redactor = new Redactor(await loadKnown());
+  const decoder = new TextDecoder;
+  const proc = Bun.spawn(command, { stdio: ["inherit", "pipe", "inherit"] });
+  for await (const chunk of proc.stdout)
+    process10.stdout.write(redactor.push(decoder.decode(chunk, { stream: true })));
+  process10.stdout.write(redactor.end());
+  return proc.exited;
+}
 async function dx(args) {
   const [flag = ""] = args;
   if (flag === "--show" || flag === "--list" || flag === "--names") {
@@ -1117,7 +1540,7 @@ async function dx(args) {
     return await hidden(flag, args.slice(1), services) ?? 0;
   }
   const emit = flag === "--emit";
-  const parsed = parse(emit ? args.slice(1) : args, usage2, options, { replaces: "docker compose exec <service> bash, logs -f and restart typed per service", examples: ["dx", ["dx php", "a shell in php, or php brought up when stopped"], ["dx php logs", "follow its logs"], ["dx -", "the last action again"]] });
+  const parsed = parse(emit ? args.slice(1) : args, usage2, options, { allowNegative: true, exits: EXITS, replaces: "docker compose exec <service> bash, logs -f and restart typed per service", examples: ["dx", ["dx php", "a shell in php, or php brought up when stopped"], ["dx php logs", "follow its logs"], ["dx php logs --tail 50 --no-follow", "the last 50 lines, then exit"], ["dx -", "the last action again"]] });
   const [named, asked] = parsed.positionals;
   const services = await allServices();
   if (services.length === 0)
@@ -1155,15 +1578,18 @@ async function dx(args) {
     action = asked;
   }
   const chosen = action ?? defaultAction(service);
-  const command = await commandFor(service, chosen);
+  const { tail, follow } = parsed.values;
+  if ((tail !== undefined || follow !== undefined) && chosen !== "logs")
+    fail("--tail and --no-follow apply to the logs action: dx <service> logs");
+  const command = await commandFor(service, chosen, { tail: tail === undefined ? undefined : wholeNumber(tail, "tail", LOGS_TAIL, 0), follow });
   record("dx", { id: key(service), args: [chosen] });
   if (emit) {
-    console.log(["run", action === undefined ? key(service) : `${key(service)} ${action}`, "", ...command.map((word) => `=${word}`)].join(`
+    console.log(["run", action === undefined ? key(service) : `${key(service)} ${action}`, "", ...(chosen === "logs" ? maskedLogs(command) : command).map((word) => `=${word}`)].join(`
 `));
     return 0;
   }
-  return Bun.spawn(command, { stdio: ["inherit", "inherit", "inherit"] }).exited;
+  return chosen === "logs" ? followMasked(command) : Bun.spawn(command, { stdio: ["inherit", "inherit", "inherit"] }).exited;
 }
 
 // src/dx-cli.ts
-process11.exitCode = await runMain({ name: "dx", version, run: dx });
+process11.exitCode = await runMain({ name: "dx", run: dx });