@kaynooo/cli-docker 0.4.0 → 0.5.1

package/README.md

@@ -12,11 +12,13 @@ bun install -g @kaynooo/cli-docker
 | --- | --- |
 | `dc <compose args>` | `docker compose` on the nearest compose file (or `.env` setting `COMPOSE_FILE`) up to the repository root |
 | `dc <project> <compose args>` | the same on a stack that came up from other files (`-f docker-compose.prod.yaml --env-file .env.prod`), found through the labels compose put on its containers |
-| `dx` | picks a service with fzf: enter opens its shell (or brings it up), ctrl-l follows its logs, ctrl-r restarts, ctrl-x stops, ctrl-b rebuilds; the ones acted on last come first. Without fzf or a terminal it lists them with their state, ports and image (`--json` for the full record) |
+| `dx` | without a terminal or fzf (a script, a pipe, an agent) it lists the services with their state, ports and image, `--json` for the full record: that is the form to use there. On a terminal with fzf it picks one instead: enter opens its shell (or brings it up), ctrl-l follows its logs, ctrl-r restarts, ctrl-x stops, ctrl-b rebuilds; the ones acted on last come first |
 | `dx -` | the last action again |
 | `dx <service> [action]` | `shell` (the default, `up` for a stopped service), `logs`, `restart`, `up`, `stop` or `build` |
-| `dlog [service...]` | one line per service with its state and health, then the last distinct error lines of its logs (`-n` per service, `--since 1h`), a repeated message once with `×N` and secrets masked as `redact` does; `--all` adds the last lines of a quiet service. Exits 1 when a service is down or unhealthy or logged an error |
-| `sf` | picks a Symfony console command with fzf and runs it, asking for each required argument; the commands run last come first, and the picker opens on the list cached from the last run. It runs in the php service of the nearest compose stack, else with the local php. Without fzf or a terminal it lists the commands |
+| `dx <service> logs --tail 50 --no-follow` | `--tail N` sets the lines (200), `--no-follow` prints them once and exits instead of following, so a script or an agent gets them without hanging; both are refused for any other action |
+| `dlog [service...]` | one line per service with its state and health, then the last distinct error lines of its logs (`-n` per service, `--since 1h`), a repeated message once with `×N` and secrets masked as `redact` does; `--all` adds the last lines of a quiet service. `--level warn` keeps warnings too and `--grep <regex>` keeps the lines matching a case insensitive regex instead of the error words. Exits 1 when a service is down or unhealthy or logged a line; `--fail-on down|unhealthy|errors` (repeatable, all three by default) picks what counts, so `--fail-on down --fail-on unhealthy` gates on health and ignores an old error still inside `--since` |
+| `sf` | without a terminal or fzf (a script, a pipe, an agent) it lists the Symfony console commands with their description, `sf --list --json` adding arguments and options: that is the form to use there. On a terminal with fzf it picks a command and runs it, asking for each required argument; the commands run last come first, and the picker opens on the list cached from the last run. It runs in the php service of the nearest compose stack, else with the local php |
+| `sf --list --json` | every command with its console folder, signature, arguments and options as JSON |
 | `sf -` | the last command again, with the arguments it ran with |
 | `sf <command> [args...]` | runs without the picker; a name the list does not hold goes to the console as is, which resolves `c:c` to `cache:clear` itself |
 

package/dist/dc-cli.js

@@ -1,9 +1,8 @@
-#!/usr/bin/env bun
+#!/usr/bin/env -S bun --no-env-file
 // @bun
 
 // src/dc-cli.ts
 import process9 from "process";
-
 // ../kit/src/args.ts
 import process4 from "process";
 import { parseArgs } from "util";
@@ -306,17 +305,23 @@ var FULL_STOP = /\.$/;
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
-  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces, exits = [] } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exitRows(exits, colors), ...exampleRows(examples, colors)].join(`
 `);
 }
+function exitRows(exits, colors = paint(process3.stdout)) {
+  if (exits.length === 0)
+    return [];
+  const width = Math.max(...exits.map(([code]) => String(code).length));
+  return ["", colors.bold("Exits:"), ...exits.map(([code, meaning]) => `  ${colors.cyan(String(code).padEnd(width))}  ${meaning}`)];
+}
 function replacesRows(replaces, colors = paint(process3.stdout)) {
   return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
 }
 function wantsHelpJson(env = process3.env) {
   return env.KIT_HELP === "json";
 }
-function description(usage, { examples = [], replaces } = {}) {
+function description(usage, { examples = [], replaces, exits } = {}, options) {
   const lines = usage.replace(USAGE_PREFIX, "").split(`
 `);
   const first = lines[0];
@@ -327,7 +332,9 @@ function description(usage, { examples = [], replaces } = {}) {
     synopsis: colon === -1 ? first : first.slice(0, colon),
     summary: colon === -1 ? fallback : first.slice(colon + 2),
     ...replaces === undefined ? {} : { replaces },
-    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] }),
+    ...exits === undefined ? {} : { exits: exits.map(([code, meaning]) => ({ code, meaning })) },
+    ...options === undefined ? {} : { options: Object.entries(options).map(([name, { short, description }]) => ({ name, ...short === undefined ? {} : { short }, ...description === undefined ? {} : { description } })) }
   };
 }
 function exampleRows(examples, colors = paint(process3.stdout)) {
@@ -369,6 +376,16 @@ function closest(name, names) {
   const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
   return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
 }
+// ../kit/src/input.ts
+var WHOLE = /^\d+$/;
+function wholeNumber(value, name, fallback, min = 1) {
+  if (value === undefined)
+    return fallback;
+  const number = Number(value);
+  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
+  return number;
+}
 
 // ../kit/src/args.ts
 var DASHES = /^-+/;
@@ -442,7 +459,7 @@ function parse(args, usage, options, settings = {}) {
   const { own, rest } = settings.trailing === true ? splitTrailing(args, all, settings.positionals?.length ?? 0) : splitRest(args, settings.rest === true);
   let parsed;
   try {
-    parsed = parseArgs({ args: joinDashValues(withBare(own, all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(withBare(withAliases(own, all), all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     const message = parseError(error);
     throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
@@ -450,7 +467,7 @@ function parse(args, usage, options, settings = {}) {
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, listing, undefined, settings));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings, listing)) : helpText(usage, listing, undefined, settings));
     throw new HelpShown;
   }
   checkChoices(parsed.values, all);
@@ -492,6 +509,18 @@ function listed(options, allowNegative) {
     return [...option.description === undefined ? [] : [[name, option]], [`no-${name}`, { type: "boolean", description: option.negative }]];
   }));
 }
+function withAliases(args, options) {
+  const named = new Map(Object.entries(options).flatMap(([name, { aliases = [] }]) => aliases.map((alias) => [`--${alias}`, `--${name}`])));
+  if (named.size === 0)
+    return args;
+  const separator = args.indexOf("--");
+  const own = separator === -1 ? args : args.slice(0, separator);
+  return [...own.map((arg) => {
+    const at = arg.indexOf("=");
+    const current = named.get(at === -1 ? arg : arg.slice(0, at));
+    return current === undefined ? arg : `${current}${at === -1 ? "" : arg.slice(at)}`;
+  }), ...separator === -1 ? [] : args.slice(separator)];
+}
 function withBare(args, options) {
   const bare = new Map(Object.entries(options).flatMap(([name, { short, optional }]) => optional === undefined ? [] : [[`--${name}`, optional], ...short === undefined ? [] : [[`-${short}`, optional]]]));
   if (bare.size === 0)
@@ -582,6 +611,8 @@ var ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x
 var RESET_STYLE = `${ESC}[0m`;
 var CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
 // ../kit/src/cli.ts
+import { readFileSync, realpathSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
 import process6 from "process";
 
 // ../kit/src/usage.ts
@@ -724,11 +755,22 @@ async function printCandidates(found) {
     console.log(line);
   return 0;
 }
+function packageVersion(entry = Bun.main) {
+  for (let dir = dirname2(realpathSync(entry));; dir = dirname2(dir)) {
+    try {
+      const { version } = JSON.parse(readFileSync(join2(dir, "package.json"), "utf8"));
+      if (typeof version === "string")
+        return version;
+    } catch {}
+    if (dirname2(dir) === dir)
+      return "0.0.0";
+  }
+}
 async function runMain({ name, version, run, redact, usage }, argv = process6.argv.slice(2)) {
   if (argv[0] === COMPLETE)
     return printCandidates(leafCandidates(run, argv.slice(1)));
   if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-    console.log(version);
+    console.log(version ?? packageVersion());
     return 0;
   }
   let code;
@@ -737,42 +779,410 @@ async function runMain({ name, version, run, redact, usage }, argv = process6.ar
   } catch (error) {
     code = reportThrown(name, error, redact, wantsJson(argv));
   }
-  if (usage !== false)
-    recordUsage(usageEntry(name, undefined, argv, code));
+  if (usage !== false) {
+    try {
+      recordUsage(usageEntry(name, undefined, argv, code));
+    } catch {}
+  }
   return code;
 }
+// ../kit/src/compose.ts
+async function captureOutput(argv, { cwd, env } = {}) {
+  const run = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, env: { ...process.env, ...env }, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, code] = await Promise.all([run.stdout.text(), run.stderr.text(), run.exited]);
+  return { code, stdout, stderr };
+}
+function composeError({ code, stderr }) {
+  const last = stderr.trim().split(`
+`).at(-1) ?? "";
+  return last === "" ? `exit ${code}` : last;
+}
 // ../kit/src/secrets.ts
+var SECRET_PART = /token|secret|passw|credential|private|dsn|apikey|accesskey|key$/i;
 var SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
+var WORD_BREAKS = /[^a-zA-Z\d]+|(?<=[a-z\d])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/;
+function isSecretName(name) {
+  return SECRET_PART.test(name) || name.split(WORD_BREAKS).some((word) => SECRET_WORDS.has(word.toLowerCase()));
+}
 // ../kit/src/sessions.ts
 var {Glob } = globalThis.Bun;
 var SESSION_FILES = new Glob("*.json");
 var ACCOUNT_DIRS = new Glob("*/sessions");
-// package.json
-var version = "0.4.0";
-
 // src/dc.ts
 import process8 from "process";
 
 // src/stack.ts
-import { existsSync, readdirSync, readFileSync } from "fs";
-import { dirname as dirname2, join as join2, relative, resolve } from "path";
+import { existsSync, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname4, join as join4, relative, resolve } from "path";
+
+// ../env/src/files.ts
+import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
+import { basename, dirname as dirname3, join as join3 } from "path";
+
+// ../env/src/dotenv.ts
+var ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i;
+var INLINE_COMMENT = /\s+#.*$/;
+var CARRIAGE_RETURN = /\r$/;
+var ESCAPES = { n: `
+`, r: "\r", t: "\t", '"': '"', "\\": "\\", $: "$" };
+function closingQuote(text, quote) {
+  for (let index = 0;index < text.length; index++) {
+    if (quote === '"' && text[index] === "\\")
+      index++;
+    else if (text[index] === quote)
+      return index;
+  }
+  return -1;
+}
+function unescapeDollar(text) {
+  return text.replaceAll("\\$", "$");
+}
+function unescapeDouble(text) {
+  let out = "";
+  for (let index = 0;index < text.length; index++) {
+    const next = text[index + 1];
+    if (text[index] === "\\" && next !== undefined && next in ESCAPES) {
+      out += ESCAPES[next];
+      index++;
+    } else {
+      out += text[index];
+    }
+  }
+  return out;
+}
+function parseDotenv(text) {
+  const physical = text.split(`
+`);
+  const lines = [];
+  for (let index = 0;index < physical.length; index++) {
+    const line = physical[index] ?? "";
+    const match = ASSIGNMENT.exec(line.replace(CARRIAGE_RETURN, ""));
+    if (match === null) {
+      lines.push({ raw: line });
+      continue;
+    }
+    const [, key = "", rest = ""] = match;
+    const start = rest.trimStart();
+    const quote = start[0];
+    if (quote !== '"' && quote !== "'" && quote !== "`") {
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, "").trim()) });
+      continue;
+    }
+    let body = start.slice(1);
+    let raw = line;
+    let end = closingQuote(body, quote);
+    while (end === -1 && index + 1 < physical.length) {
+      index++;
+      body += `
+${(physical[index] ?? "").replace(CARRIAGE_RETURN, "")}`;
+      raw += `
+${physical[index] ?? ""}`;
+      end = closingQuote(body, quote);
+    }
+    const inner = end === -1 ? body : body.slice(0, end);
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) });
+  }
+  return { lines };
+}
+function entries(file) {
+  const map = new Map;
+  for (const line of file.lines) {
+    if (line.key !== undefined)
+      map.set(line.key, line.value ?? "");
+  }
+  return map;
+}
+
+// ../env/src/mask.ts
+var MIN_KNOWN_LENGTH = 4;
+var KEY_MASK = "*** private key redacted ***";
+var PLAIN_VALUE = /^(?:true|false|null|none|nil|yes|no|on|off|undefined)$/i;
+var PLACEHOLDER = /^[$%{<(*/]/;
+var URL_PASSWORD = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]*:([^\s'"]{1,1024})@/dgi;
+var PORT = /^\d{1,5}$/;
+var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
+function isPlaceholder(value) {
+  return PLACEHOLDER.test(value) || PLAIN_VALUE.test(value);
+}
+var TOKEN_FORMATS = [
+  { kind: "GitHub token", pattern: /\b(?:gh[pousr]_|github_pat_)\w{20,}/dg },
+  { kind: "GitLab token", pattern: /\bglpat-[\w-]{20,}/dg },
+  { kind: "API key", pattern: /\bsk-[\w-]{20,}/dg },
+  { kind: "Slack token", pattern: /\bx(?:ox[abprs]|app)-[\w-]{10,}/dg },
+  { kind: "JWT", pattern: /\beyJ[\w-]+\.[\w-]+\.[\w-]+/dg },
+  { kind: "AWS access key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/dg },
+  { kind: "npm token", pattern: /\bnpm_[A-Za-z0-9]{30,}/dg },
+  { kind: "Stripe key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{10,}/dg },
+  { kind: "Google API key", pattern: /\bAIza[\w-]{35}/dg },
+  { kind: "SendGrid key", pattern: /\bSG\.[\w-]{16,}\.[\w-]{16,}/dg },
+  { kind: "Authorization header", pattern: /\bAuthorization["']?\s*[:=]\s*["']?(?:Bearer|Basic|Token|Digest)\s+([^\s"',;]{8,})/dgi, skip: isPlaceholder },
+  { kind: "Bearer token", pattern: /\bBearer\s+((?=[\w.~+/=-]*\d)[\w.~+/=-]{20,})/dg },
+  { kind: "password", pattern: /(?<![\w-])(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?=([^\s"'&;,]{4,})/dgi, skip: isPlaceholder },
+  { kind: "password", pattern: /(?<![\w-])["']?(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?["']?\s*[:=]\s*(["'])((?:\\.|(?!\1)[^\\\n]){4,})\1/dgi, skip: isPlaceholder }
+];
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_BODY = /(?<=-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)(?:(?!-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)[\s\S])+/dg;
+var PEM_BEGIN_ALL = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/g;
+var URL_PARTS = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
+var PATH_SEGMENT = /[^/]+/g;
+var SECRET_PARAM = /^(?:token|[a-z]+_token|key|api[_-]?key|access[_-]?key|secret|[a-z]+_secret|password|passwd|pwd|sig|signature|auth|authorization)$/i;
+var WEBHOOK_FORMATS = [
+  ["Discord webhook", /(?:^|\.)discord(?:app)?\.com\/api\/(?:v\d+\/)?webhooks\/\d+\/([\w-]+)/di],
+  ["Slack webhook", /^hooks\.slack\.com\/(?:services|workflows)\/(?:[\w-]+\/)*([\w-]+)/di],
+  ["Uptime Kuma push URL", /\/api\/push\/([\w-]+)/di],
+  ["healthchecks.io ping URL", /^hc-ping\.com\/([\w-]+)/di]
+];
+var OPAQUE_SEGMENT = /^(?:(?=[\w-]{20,}$)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\w-]+|(?=[A-Za-z\d]{32,}$)(?=.*[A-Za-z])(?=.*\d).+)$/;
+function hint(value) {
+  const shown = Math.min(3, Math.floor(value.length / 4));
+  return `${value.slice(0, shown)}***(${value.length})`;
+}
+function forms(value) {
+  return [...new Set([value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])];
+}
+function knownSecrets(pairs) {
+  const keys = new Map;
+  for (const [key, value] of pairs) {
+    if (value.length < MIN_KNOWN_LENGTH || PLAIN_VALUE.test(value))
+      continue;
+    for (const form of forms(value)) {
+      if (!keys.has(form))
+        keys.set(form, key);
+    }
+  }
+  if (keys.size === 0)
+    return { pattern: undefined, keys };
+  const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
+  return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
+}
+function passwordSpans(text) {
+  const spans = [];
+  for (const url of text.matchAll(URL_PASSWORD)) {
+    const [start, end] = url.indices?.[1] ?? [];
+    const password = url[1] ?? "";
+    const slash = password.indexOf("/");
+    if (start !== undefined && end !== undefined && !(slash !== -1 && PORT.test(password.slice(0, slash))))
+      spans.push([start, end]);
+  }
+  return spans;
+}
+function urlPasswords(text) {
+  return passwordSpans(text).map(([start, end]) => text.slice(start, end));
+}
+function urlTokens(line) {
+  const found = [];
+  const add = (kind, start, value) => {
+    found.push({ start, end: start + value.length, kind, mask: hint(value) });
+  };
+  for (const url of line.matchAll(URL_PARTS)) {
+    const [authority, path = "", query] = [url[1] ?? "", url[2] ?? "", url[3]];
+    const authorityStart = url.indices?.[1]?.[0];
+    const pathStart = url.indices?.[2]?.[0];
+    const queryStart = url.indices?.[3]?.[0];
+    if (authorityStart === undefined || pathStart === undefined)
+      continue;
+    const hostAt = authority.lastIndexOf("@") + 1;
+    const target = authority.slice(hostAt) + path;
+    for (const [kind, pattern] of WEBHOOK_FORMATS) {
+      const [start, end] = pattern.exec(target)?.indices?.[1] ?? [];
+      if (start !== undefined && end !== undefined)
+        add(kind, authorityStart + hostAt + start, target.slice(start, end));
+    }
+    for (const segment of path.matchAll(PATH_SEGMENT)) {
+      if (OPAQUE_SEGMENT.test(segment[0]))
+        add("URL token", pathStart + segment.index, segment[0]);
+    }
+    if (query === undefined || queryStart === undefined)
+      continue;
+    let offset = 0;
+    for (const param of query.split("&")) {
+      const equals = param.indexOf("=");
+      if (equals > 0 && equals < param.length - 1 && SECRET_PARAM.test(param.slice(0, equals)))
+        add("URL token", queryStart + offset + equals + 1, param.slice(equals + 1));
+      offset += param.length + 1;
+    }
+  }
+  return found.filter((match) => match.end > match.start);
+}
+function findSecrets(line, known) {
+  const found = [];
+  for (const [start, end] of passwordSpans(line))
+    found.push({ start, end, kind: "URL password", mask: "***" });
+  for (const body of line.matchAll(PEM_BODY)) {
+    const [start, end] = body.indices?.[0] ?? [];
+    if (start !== undefined && end !== undefined)
+      found.push({ start, end, kind: "private key", mask: KEY_MASK });
+  }
+  for (const { kind, pattern, skip } of TOKEN_FORMATS) {
+    for (const token of line.matchAll(pattern)) {
+      const [start, end] = token.indices?.at(-1) ?? [];
+      if (start === undefined || end === undefined)
+        continue;
+      const value = line.slice(start, end);
+      if (!skip?.(value))
+        found.push({ start, end, kind, mask: hint(value) });
+    }
+  }
+  found.push(...urlTokens(line));
+  if (known?.pattern !== undefined) {
+    for (const value of line.matchAll(known.pattern))
+      found.push({ start: value.index, end: value.index + value[0].length, kind: `value of ${known.keys.get(value[0])}`, mask: hint(value[0]) });
+  }
+  found.sort((a, b) => a.start - b.start || b.end - a.end);
+  const kept = [];
+  for (const match of found) {
+    if (match.start >= (kept.at(-1)?.end ?? 0))
+      kept.push(match);
+  }
+  return kept;
+}
+function openKeyBody(line) {
+  const last = [...line.matchAll(PEM_BEGIN_ALL)].at(-1);
+  if (last === undefined)
+    return;
+  const after = line.slice(last.index + last[0].length);
+  return PEM_END.test(after) ? undefined : after.trim();
+}
+function maskLine(line, known) {
+  let out = "";
+  let at = 0;
+  for (const match of findSecrets(line, known)) {
+    out += line.slice(at, match.start) + match.mask;
+    at = match.end;
+  }
+  return out + line.slice(at);
+}
+
+// ../env/src/files.ts
+var ENV_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.envrc)$/;
+var KNOWN_DEPTH = 3;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+async function isFileEntry(entry, path) {
+  if (entry.isFile())
+    return true;
+  if (!entry.isSymbolicLink())
+    return false;
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function secretPairs(file) {
+  const pairs = [];
+  for (const [key, value] of entries(file)) {
+    if (isSecretName(key))
+      pairs.push([key, value]);
+    else
+      pairs.push(...urlPasswords(value).map((password) => [key, password]));
+  }
+  return pairs;
+}
+async function envFilesBelow(folder, depth = 0) {
+  const found = [];
+  let children;
+  try {
+    children = await readdir(folder, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of children) {
+    const path = join3(folder, entry.name);
+    if (entry.isDirectory() && depth < KNOWN_DEPTH && !SKIPPED.has(entry.name))
+      found.push(...await envFilesBelow(path, depth + 1));
+    else if (ENV_FILE.test(entry.name) && await isFileEntry(entry, path))
+      found.push(path);
+  }
+  return found;
+}
+async function loadKnown(folder = process.cwd(), extra = []) {
+  const pairs = extra.flatMap(secretPairs);
+  for (const path of await envFilesBelow(folder)) {
+    try {
+      pairs.push(...secretPairs(parseDotenv(await Bun.file(path).text())));
+    } catch {}
+  }
+  return knownSecrets(pairs);
+}
+
+// ../env/src/redactor.ts
+var MAX_PENDING = 1 << 18;
+var OVERLAP = 1 << 13;
+
+class Redactor {
+  known;
+  pending = "";
+  inKey = false;
+  hidden = false;
+  constructor(known) {
+    this.known = known;
+  }
+  push(chunk) {
+    const end = chunk.lastIndexOf(`
+`);
+    this.pending += chunk;
+    if (end === -1)
+      return this.pending.length > MAX_PENDING ? this.cut() : "";
+    const split = this.pending.length - chunk.length + end + 1;
+    const complete = this.pending.slice(0, split);
+    this.pending = this.pending.slice(split);
+    return complete.split(`
+`).slice(0, -1).map((line) => this.line(line)).filter((line) => line !== undefined).map((line) => `${line}
+`).join("");
+  }
+  cut() {
+    const limit = this.pending.length - OVERLAP;
+    const space = this.pending.lastIndexOf(" ", limit);
+    const at = space > 0 ? space + 1 : limit;
+    const head = this.pending.slice(0, at);
+    this.pending = this.pending.slice(at);
+    return this.line(head) ?? "";
+  }
+  end() {
+    const rest = this.pending;
+    this.pending = "";
+    return rest === "" ? "" : this.line(rest) ?? "";
+  }
+  line(line) {
+    if (this.inKey) {
+      const end = PEM_END.exec(line);
+      if (end === null) {
+        if (this.hidden)
+          return;
+        this.hidden = true;
+        return KEY_MASK;
+      }
+      this.inKey = false;
+      return (end.index > 0 && !this.hidden ? KEY_MASK : "") + this.line(line.slice(end.index));
+    }
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      this.inKey = true;
+      this.hidden = body !== "";
+    }
+    return maskLine(line, this.known);
+  }
+}
+
+// src/stack.ts
 var LABEL_FORMAT = ["project", "project.config_files", "project.environment_file", "project.working_dir"].map((label) => `{{.Label "com.docker.compose.${label}"}}`).join("\t");
 var COMPOSE_FILE_VAR = /^\s*(?:export\s+)?COMPOSE_FILE\s*=\s*\S/m;
 var COMPOSE_FILES = ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"];
-var SKIPPED = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
+var SKIPPED2 = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
 var ACTIONS = ["shell", "logs", "restart", "up", "stop", "build"];
 function from(dir, command) {
   return dir === "." ? command : ["env", "-C", dir, ...command];
 }
 function children(dir = ".") {
-  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED.has(child.name)).map((child) => child.name).sort();
+  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED2.has(child.name)).map((child) => child.name).sort();
 }
 function up(dir) {
   const dirs = [];
-  for (let current = dir;; current = join2(current, "..")) {
+  for (let current = dir;; current = join4(current, "..")) {
     dirs.push(current);
     const absolute = resolve(current);
-    if (existsSync(join2(current, ".git")) || dirname2(absolute) === absolute)
+    if (existsSync(join4(current, ".git")) || dirname4(absolute) === absolute)
       return dirs;
   }
 }
@@ -780,10 +1190,10 @@ function stackAt(dir) {
   return { dir, run: from(dir, ["docker", "compose"]), list: { argv: ["docker", "compose"], cwd: resolve(dir), env: process.env } };
 }
 function holdsStack(dir) {
-  if (COMPOSE_FILES.some((name) => existsSync(join2(dir, name))))
+  if (COMPOSE_FILES.some((name) => existsSync(join4(dir, name))))
     return true;
   try {
-    return COMPOSE_FILE_VAR.test(readFileSync(join2(dir, ".env"), "utf-8"));
+    return COMPOSE_FILE_VAR.test(readFileSync2(join4(dir, ".env"), "utf-8"));
   } catch {
     return false;
   }
@@ -831,13 +1241,8 @@ async function recordedNearby() {
   return (await labels()).filter((stack) => dirs.has(stack.workdir));
 }
 async function attempt(stack, args) {
-  const proc = Bun.spawn([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env, stdout: "pipe", stderr: "pipe" });
-  const [text, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
-  if (code === 0)
-    return { text, error: undefined };
-  const last = stderr.trim().split(`
-`).at(-1) ?? "";
-  return { text: "", error: last === "" ? `exit ${code}` : last };
+  const result = await captureOutput([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env });
+  return result.code === 0 ? { text: result.stdout, error: undefined } : { text: "", error: composeError(result) };
 }
 async function output(stack, args) {
   return (await attempt(stack, args)).text;
@@ -881,13 +1286,14 @@ function key(service) {
 async function shellOf(service) {
   return await output(service.stack, ["exec", "-T", service.name, "sh", "-c", "command -v bash"]) ? "bash" : "sh";
 }
-async function commandFor(service, action) {
+var LOGS_TAIL = 200;
+async function commandFor(service, action, logs = {}) {
   const run = service.stack.run;
   switch (action) {
     case "shell":
       return [...run, "exec", service.name, await shellOf(service)];
     case "logs":
-      return [...run, "logs", "-f", "--tail=200", service.name];
+      return [...run, "logs", ...logs.follow === false ? [] : ["-f"], `--tail=${logs.tail ?? LOGS_TAIL}`, service.name];
     case "restart":
       return [...run, "restart", service.name];
     case "up":
@@ -913,8 +1319,12 @@ async function serviceNamed(dir, name, project) {
   const stack = recorded === undefined ? stackAt(dir) : labelledStack(dir, recorded);
   return (await services(stack)).find((candidate) => candidate.name === name);
 }
+function maskLog(text, known) {
+  const redactor = new Redactor(known);
+  return redactor.push(text) + redactor.end();
+}
 async function logsOf(stack, name) {
-  return output(stack, ["logs", "--tail=30", "--no-log-prefix", name]);
+  return maskLog(await output(stack, ["logs", "--tail=30", "--no-log-prefix", name]), await loadKnown());
 }
 
 // src/dc.ts
@@ -976,4 +1386,4 @@ async function main(args) {
   }
   return dc(args);
 }
-process9.exitCode = await runMain({ name: "dc", version, run: main });
+process9.exitCode = await runMain({ name: "dc", run: main });