@kaynooo/cli-docker 0.4.0 → 0.5.1

package/dist/dlog-cli.js

@@ -1,9 +1,8 @@
-#!/usr/bin/env bun
+#!/usr/bin/env -S bun --no-env-file
 // @bun
 
 // src/dlog-cli.ts
 import process9 from "process";
-
 // ../kit/src/args.ts
 import process4 from "process";
 import { parseArgs } from "util";
@@ -306,17 +305,23 @@ var FULL_STOP = /\.$/;
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
-  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces, exits = [] } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exitRows(exits, colors), ...exampleRows(examples, colors)].join(`
 `);
 }
+function exitRows(exits, colors = paint(process3.stdout)) {
+  if (exits.length === 0)
+    return [];
+  const width = Math.max(...exits.map(([code]) => String(code).length));
+  return ["", colors.bold("Exits:"), ...exits.map(([code, meaning]) => `  ${colors.cyan(String(code).padEnd(width))}  ${meaning}`)];
+}
 function replacesRows(replaces, colors = paint(process3.stdout)) {
   return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
 }
 function wantsHelpJson(env = process3.env) {
   return env.KIT_HELP === "json";
 }
-function description(usage, { examples = [], replaces } = {}) {
+function description(usage, { examples = [], replaces, exits } = {}, options) {
   const lines = usage.replace(USAGE_PREFIX, "").split(`
 `);
   const first = lines[0];
@@ -327,7 +332,9 @@ function description(usage, { examples = [], replaces } = {}) {
     synopsis: colon === -1 ? first : first.slice(0, colon),
     summary: colon === -1 ? fallback : first.slice(colon + 2),
     ...replaces === undefined ? {} : { replaces },
-    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] }),
+    ...exits === undefined ? {} : { exits: exits.map(([code, meaning]) => ({ code, meaning })) },
+    ...options === undefined ? {} : { options: Object.entries(options).map(([name, { short, description }]) => ({ name, ...short === undefined ? {} : { short }, ...description === undefined ? {} : { description } })) }
   };
 }
 function exampleRows(examples, colors = paint(process3.stdout)) {
@@ -369,6 +376,16 @@ function closest(name, names) {
   const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
   return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
 }
+// ../kit/src/input.ts
+var WHOLE = /^\d+$/;
+function wholeNumber(value, name, fallback, min = 1) {
+  if (value === undefined)
+    return fallback;
+  const number = Number(value);
+  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
+  return number;
+}
 
 // ../kit/src/args.ts
 var DASHES = /^-+/;
@@ -442,7 +459,7 @@ function parse(args, usage, options, settings = {}) {
   const { own, rest } = settings.trailing === true ? splitTrailing(args, all, settings.positionals?.length ?? 0) : splitRest(args, settings.rest === true);
   let parsed;
   try {
-    parsed = parseArgs({ args: joinDashValues(withBare(own, all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(withBare(withAliases(own, all), all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     const message = parseError(error);
     throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
@@ -450,7 +467,7 @@ function parse(args, usage, options, settings = {}) {
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, listing, undefined, settings));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings, listing)) : helpText(usage, listing, undefined, settings));
     throw new HelpShown;
   }
   checkChoices(parsed.values, all);
@@ -492,6 +509,18 @@ function listed(options, allowNegative) {
     return [...option.description === undefined ? [] : [[name, option]], [`no-${name}`, { type: "boolean", description: option.negative }]];
   }));
 }
+function withAliases(args, options) {
+  const named = new Map(Object.entries(options).flatMap(([name, { aliases = [] }]) => aliases.map((alias) => [`--${alias}`, `--${name}`])));
+  if (named.size === 0)
+    return args;
+  const separator = args.indexOf("--");
+  const own = separator === -1 ? args : args.slice(0, separator);
+  return [...own.map((arg) => {
+    const at = arg.indexOf("=");
+    const current = named.get(at === -1 ? arg : arg.slice(0, at));
+    return current === undefined ? arg : `${current}${at === -1 ? "" : arg.slice(at)}`;
+  }), ...separator === -1 ? [] : args.slice(separator)];
+}
 function withBare(args, options) {
   const bare = new Map(Object.entries(options).flatMap(([name, { short, optional }]) => optional === undefined ? [] : [[`--${name}`, optional], ...short === undefined ? [] : [[`-${short}`, optional]]]));
   if (bare.size === 0)
@@ -582,6 +611,8 @@ var ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x
 var RESET_STYLE = `${ESC}[0m`;
 var CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
 // ../kit/src/cli.ts
+import { readFileSync, realpathSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
 import process6 from "process";
 
 // ../kit/src/usage.ts
@@ -724,11 +755,22 @@ async function printCandidates(found) {
     console.log(line);
   return 0;
 }
+function packageVersion(entry = Bun.main) {
+  for (let dir = dirname2(realpathSync(entry));; dir = dirname2(dir)) {
+    try {
+      const { version } = JSON.parse(readFileSync(join2(dir, "package.json"), "utf8"));
+      if (typeof version === "string")
+        return version;
+    } catch {}
+    if (dirname2(dir) === dir)
+      return "0.0.0";
+  }
+}
 async function runMain({ name, version, run, redact, usage }, argv = process6.argv.slice(2)) {
   if (argv[0] === COMPLETE)
     return printCandidates(leafCandidates(run, argv.slice(1)));
   if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-    console.log(version);
+    console.log(version ?? packageVersion());
     return 0;
   }
   let code;
@@ -737,28 +779,124 @@ async function runMain({ name, version, run, redact, usage }, argv = process6.ar
   } catch (error) {
     code = reportThrown(name, error, redact, wantsJson(argv));
   }
-  if (usage !== false)
-    recordUsage(usageEntry(name, undefined, argv, code));
+  if (usage !== false) {
+    try {
+      recordUsage(usageEntry(name, undefined, argv, code));
+    } catch {}
+  }
   return code;
 }
+// ../kit/src/compose.ts
+async function captureOutput(argv, { cwd, env } = {}) {
+  const run = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, env: { ...process.env, ...env }, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, code] = await Promise.all([run.stdout.text(), run.stderr.text(), run.exited]);
+  return { code, stdout, stderr };
+}
+function composeError({ code, stderr }) {
+  const last = stderr.trim().split(`
+`).at(-1) ?? "";
+  return last === "" ? `exit ${code}` : last;
+}
 // ../kit/src/secrets.ts
+var SECRET_PART = /token|secret|passw|credential|private|dsn|apikey|accesskey|key$/i;
 var SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
+var WORD_BREAKS = /[^a-zA-Z\d]+|(?<=[a-z\d])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/;
+function isSecretName(name) {
+  return SECRET_PART.test(name) || name.split(WORD_BREAKS).some((word) => SECRET_WORDS.has(word.toLowerCase()));
+}
 // ../kit/src/sessions.ts
 var {Glob } = globalThis.Bun;
 var SESSION_FILES = new Glob("*.json");
 var ACCOUNT_DIRS = new Glob("*/sessions");
-// package.json
-var version = "0.4.0";
-
 // src/dlog.ts
 import process8 from "process";
 
+// ../env/src/files.ts
+import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
+import { basename, dirname as dirname3, join as join3 } from "path";
+
+// ../env/src/dotenv.ts
+var ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i;
+var INLINE_COMMENT = /\s+#.*$/;
+var CARRIAGE_RETURN = /\r$/;
+var ESCAPES = { n: `
+`, r: "\r", t: "\t", '"': '"', "\\": "\\", $: "$" };
+function closingQuote(text, quote) {
+  for (let index = 0;index < text.length; index++) {
+    if (quote === '"' && text[index] === "\\")
+      index++;
+    else if (text[index] === quote)
+      return index;
+  }
+  return -1;
+}
+function unescapeDollar(text) {
+  return text.replaceAll("\\$", "$");
+}
+function unescapeDouble(text) {
+  let out = "";
+  for (let index = 0;index < text.length; index++) {
+    const next = text[index + 1];
+    if (text[index] === "\\" && next !== undefined && next in ESCAPES) {
+      out += ESCAPES[next];
+      index++;
+    } else {
+      out += text[index];
+    }
+  }
+  return out;
+}
+function parseDotenv(text) {
+  const physical = text.split(`
+`);
+  const lines = [];
+  for (let index = 0;index < physical.length; index++) {
+    const line = physical[index] ?? "";
+    const match = ASSIGNMENT.exec(line.replace(CARRIAGE_RETURN, ""));
+    if (match === null) {
+      lines.push({ raw: line });
+      continue;
+    }
+    const [, key = "", rest = ""] = match;
+    const start = rest.trimStart();
+    const quote = start[0];
+    if (quote !== '"' && quote !== "'" && quote !== "`") {
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, "").trim()) });
+      continue;
+    }
+    let body = start.slice(1);
+    let raw = line;
+    let end = closingQuote(body, quote);
+    while (end === -1 && index + 1 < physical.length) {
+      index++;
+      body += `
+${(physical[index] ?? "").replace(CARRIAGE_RETURN, "")}`;
+      raw += `
+${physical[index] ?? ""}`;
+      end = closingQuote(body, quote);
+    }
+    const inner = end === -1 ? body : body.slice(0, end);
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) });
+  }
+  return { lines };
+}
+function entries(file) {
+  const map = new Map;
+  for (const line of file.lines) {
+    if (line.key !== undefined)
+      map.set(line.key, line.value ?? "");
+  }
+  return map;
+}
+
 // ../env/src/mask.ts
+var MIN_KNOWN_LENGTH = 4;
 var KEY_MASK = "*** private key redacted ***";
 var PLAIN_VALUE = /^(?:true|false|null|none|nil|yes|no|on|off|undefined)$/i;
 var PLACEHOLDER = /^[$%{<(*/]/;
 var URL_PASSWORD = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]*:([^\s'"]{1,1024})@/dgi;
 var PORT = /^\d{1,5}$/;
+var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
 function isPlaceholder(value) {
   return PLACEHOLDER.test(value) || PLAIN_VALUE.test(value);
 }
@@ -781,6 +919,7 @@ var TOKEN_FORMATS = [
 var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
 var PEM_END = /-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
 var PEM_BODY = /(?<=-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)(?:(?!-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)[\s\S])+/dg;
+var PEM_BEGIN_ALL = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/g;
 var URL_PARTS = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
 var PATH_SEGMENT = /[^/]+/g;
 var SECRET_PARAM = /^(?:token|[a-z]+_token|key|api[_-]?key|access[_-]?key|secret|[a-z]+_secret|password|passwd|pwd|sig|signature|auth|authorization)$/i;
@@ -795,6 +934,24 @@ function hint(value) {
   const shown = Math.min(3, Math.floor(value.length / 4));
   return `${value.slice(0, shown)}***(${value.length})`;
 }
+function forms(value) {
+  return [...new Set([value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])];
+}
+function knownSecrets(pairs) {
+  const keys = new Map;
+  for (const [key, value] of pairs) {
+    if (value.length < MIN_KNOWN_LENGTH || PLAIN_VALUE.test(value))
+      continue;
+    for (const form of forms(value)) {
+      if (!keys.has(form))
+        keys.set(form, key);
+    }
+  }
+  if (keys.size === 0)
+    return { pattern: undefined, keys };
+  const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
+  return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
+}
 function passwordSpans(text) {
   const spans = [];
   for (const url of text.matchAll(URL_PASSWORD)) {
@@ -806,6 +963,9 @@ function passwordSpans(text) {
   }
   return spans;
 }
+function urlPasswords(text) {
+  return passwordSpans(text).map(([start, end]) => text.slice(start, end));
+}
 function urlTokens(line) {
   const found = [];
   const add = (kind, start, value) => {
@@ -873,6 +1033,13 @@ function findSecrets(line, known) {
   }
   return kept;
 }
+function openKeyBody(line) {
+  const last = [...line.matchAll(PEM_BEGIN_ALL)].at(-1);
+  if (last === undefined)
+    return;
+  const after = line.slice(last.index + last[0].length);
+  return PEM_END.test(after) ? undefined : after.trim();
+}
 function maskLine(line, known) {
   let out = "";
   let at = 0;
@@ -883,26 +1050,139 @@ function maskLine(line, known) {
   return out + line.slice(at);
 }
 
+// ../env/src/files.ts
+var ENV_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.envrc)$/;
+var KNOWN_DEPTH = 3;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+async function isFileEntry(entry, path) {
+  if (entry.isFile())
+    return true;
+  if (!entry.isSymbolicLink())
+    return false;
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function secretPairs(file) {
+  const pairs = [];
+  for (const [key, value] of entries(file)) {
+    if (isSecretName(key))
+      pairs.push([key, value]);
+    else
+      pairs.push(...urlPasswords(value).map((password) => [key, password]));
+  }
+  return pairs;
+}
+async function envFilesBelow(folder, depth = 0) {
+  const found = [];
+  let children;
+  try {
+    children = await readdir(folder, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of children) {
+    const path = join3(folder, entry.name);
+    if (entry.isDirectory() && depth < KNOWN_DEPTH && !SKIPPED.has(entry.name))
+      found.push(...await envFilesBelow(path, depth + 1));
+    else if (ENV_FILE.test(entry.name) && await isFileEntry(entry, path))
+      found.push(path);
+  }
+  return found;
+}
+async function loadKnown(folder = process.cwd(), extra = []) {
+  const pairs = extra.flatMap(secretPairs);
+  for (const path of await envFilesBelow(folder)) {
+    try {
+      pairs.push(...secretPairs(parseDotenv(await Bun.file(path).text())));
+    } catch {}
+  }
+  return knownSecrets(pairs);
+}
+
+// src/stack.ts
+import { existsSync, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname4, join as join4, relative, resolve } from "path";
+
+// ../env/src/redactor.ts
+var MAX_PENDING = 1 << 18;
+var OVERLAP = 1 << 13;
+
+class Redactor {
+  known;
+  pending = "";
+  inKey = false;
+  hidden = false;
+  constructor(known) {
+    this.known = known;
+  }
+  push(chunk) {
+    const end = chunk.lastIndexOf(`
+`);
+    this.pending += chunk;
+    if (end === -1)
+      return this.pending.length > MAX_PENDING ? this.cut() : "";
+    const split = this.pending.length - chunk.length + end + 1;
+    const complete = this.pending.slice(0, split);
+    this.pending = this.pending.slice(split);
+    return complete.split(`
+`).slice(0, -1).map((line) => this.line(line)).filter((line) => line !== undefined).map((line) => `${line}
+`).join("");
+  }
+  cut() {
+    const limit = this.pending.length - OVERLAP;
+    const space = this.pending.lastIndexOf(" ", limit);
+    const at = space > 0 ? space + 1 : limit;
+    const head = this.pending.slice(0, at);
+    this.pending = this.pending.slice(at);
+    return this.line(head) ?? "";
+  }
+  end() {
+    const rest = this.pending;
+    this.pending = "";
+    return rest === "" ? "" : this.line(rest) ?? "";
+  }
+  line(line) {
+    if (this.inKey) {
+      const end = PEM_END.exec(line);
+      if (end === null) {
+        if (this.hidden)
+          return;
+        this.hidden = true;
+        return KEY_MASK;
+      }
+      this.inKey = false;
+      return (end.index > 0 && !this.hidden ? KEY_MASK : "") + this.line(line.slice(end.index));
+    }
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      this.inKey = true;
+      this.hidden = body !== "";
+    }
+    return maskLine(line, this.known);
+  }
+}
+
 // src/stack.ts
-import { existsSync, readdirSync, readFileSync } from "fs";
-import { dirname as dirname2, join as join2, relative, resolve } from "path";
 var LABEL_FORMAT = ["project", "project.config_files", "project.environment_file", "project.working_dir"].map((label) => `{{.Label "com.docker.compose.${label}"}}`).join("\t");
 var COMPOSE_FILE_VAR = /^\s*(?:export\s+)?COMPOSE_FILE\s*=\s*\S/m;
 var COMPOSE_FILES = ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"];
-var SKIPPED = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
+var SKIPPED2 = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
 var ACTIONS = ["shell", "logs", "restart", "up", "stop", "build"];
 function from(dir, command) {
   return dir === "." ? command : ["env", "-C", dir, ...command];
 }
 function children(dir = ".") {
-  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED.has(child.name)).map((child) => child.name).sort();
+  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED2.has(child.name)).map((child) => child.name).sort();
 }
 function up(dir) {
   const dirs = [];
-  for (let current = dir;; current = join2(current, "..")) {
+  for (let current = dir;; current = join4(current, "..")) {
     dirs.push(current);
     const absolute = resolve(current);
-    if (existsSync(join2(current, ".git")) || dirname2(absolute) === absolute)
+    if (existsSync(join4(current, ".git")) || dirname4(absolute) === absolute)
       return dirs;
   }
 }
@@ -910,10 +1190,10 @@ function stackAt(dir) {
   return { dir, run: from(dir, ["docker", "compose"]), list: { argv: ["docker", "compose"], cwd: resolve(dir), env: process.env } };
 }
 function holdsStack(dir) {
-  if (COMPOSE_FILES.some((name) => existsSync(join2(dir, name))))
+  if (COMPOSE_FILES.some((name) => existsSync(join4(dir, name))))
     return true;
   try {
-    return COMPOSE_FILE_VAR.test(readFileSync(join2(dir, ".env"), "utf-8"));
+    return COMPOSE_FILE_VAR.test(readFileSync2(join4(dir, ".env"), "utf-8"));
   } catch {
     return false;
   }
@@ -961,13 +1241,8 @@ async function recordedNearby() {
   return (await labels()).filter((stack) => dirs.has(stack.workdir));
 }
 async function attempt(stack, args) {
-  const proc = Bun.spawn([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env, stdout: "pipe", stderr: "pipe" });
-  const [text, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
-  if (code === 0)
-    return { text, error: undefined };
-  const last = stderr.trim().split(`
-`).at(-1) ?? "";
-  return { text: "", error: last === "" ? `exit ${code}` : last };
+  const result = await captureOutput([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env });
+  return result.code === 0 ? { text: result.stdout, error: undefined } : { text: "", error: composeError(result) };
 }
 async function output(stack, args) {
   return (await attempt(stack, args)).text;
@@ -1011,13 +1286,14 @@ function key(service) {
 async function shellOf(service) {
   return await output(service.stack, ["exec", "-T", service.name, "sh", "-c", "command -v bash"]) ? "bash" : "sh";
 }
-async function commandFor(service, action) {
+var LOGS_TAIL = 200;
+async function commandFor(service, action, logs = {}) {
   const run = service.stack.run;
   switch (action) {
     case "shell":
       return [...run, "exec", service.name, await shellOf(service)];
     case "logs":
-      return [...run, "logs", "-f", "--tail=200", service.name];
+      return [...run, "logs", ...logs.follow === false ? [] : ["-f"], `--tail=${logs.tail ?? LOGS_TAIL}`, service.name];
     case "restart":
       return [...run, "restart", service.name];
     case "up":
@@ -1043,8 +1319,12 @@ async function serviceNamed(dir, name, project) {
   const stack = recorded === undefined ? stackAt(dir) : labelledStack(dir, recorded);
   return (await services(stack)).find((candidate) => candidate.name === name);
 }
+function maskLog(text, known) {
+  const redactor = new Redactor(known);
+  return redactor.push(text) + redactor.end();
+}
 async function logsOf(stack, name) {
-  return output(stack, ["logs", "--tail=30", "--no-log-prefix", name]);
+  return maskLog(await output(stack, ["logs", "--tail=30", "--no-log-prefix", name]), await loadKnown());
 }
 
 // src/dlog.ts
@@ -1052,15 +1332,21 @@ var usage2 = `dlog [service...]
 
 One line per compose service with its state and health, then the last distinct error lines of the services that log some or are not healthy, repeats collapsed to one line with a count and secrets masked as redact does.
 With service names, only those are read. The stacks are the ones dx lists: this folder's, its child folders' and the ones only their containers tell of.
-
-Exits 0 when every service is up and quiet, 1 when one is down, unhealthy or still starting, logged an error or has logs compose could not read, so it can gate a script, 1 too when there is no compose service here. A service that exited with code 0 (a migration, an init) is not down.`;
+\`--level warn\` keeps warnings too, \`--grep <regex>\` keeps the lines matching a case insensitive regex instead of the error words. What fails the exit is \`--fail-on\`: by default a service down, unhealthy or still starting, an error line or logs compose could not read, so it can gate a script; \`--fail-on down\` leaves out an old error line that \`--since\` has not aged out yet. A service that exited with code 0 (a migration, an init) is not down.`;
+var EXITS = [[0, "nothing the --fail-on list names: every service is up and quiet"], [1, "a service is down, unhealthy or still starting, logged a matching line or has logs compose could not read (as --fail-on keeps them), or there is no compose service here"], [2, "a usage error"]];
+var FAIL_ON = ["down", "unhealthy", "errors"];
 var options = {
   lines: { type: "string", short: "n", default: "5", description: "error lines kept per service" },
   since: { type: "string", default: "1h", description: "how far back the logs are read (compose --since: 30m, 2h, a timestamp)" },
+  level: { type: "string", choices: ["error", "warn"], default: "error", description: "lowest level of the lines kept: error (the default) or warn, warnings too" },
+  grep: { type: "string", description: "keep the lines matching this regex, case insensitive, instead of the --level words" },
+  "fail-on": { type: "string", multiple: true, choices: FAIL_ON, description: "what makes the exit 1, repeatable: down, unhealthy or errors (all three)" },
   all: { type: "boolean", short: "a", description: "the last log lines of a service with no error too" },
-  json: jsonOption("[{ key, state, health, status, errors: [{ line, count }], tail }]")
+  json: jsonOption("[{ key, state, health, status, errors: [{ line, count }], tail, down, unhealthy }]")
 };
 var ERROR = /\b(?:error|err|fatal|exception|panic|critical|crit|traceback|failed|failure|refused|denied|timeout|timed out|oom|killed)\b/i;
+var WARNING = /\b(?:warn|warning|deprecated|deprecation)\b/i;
+var LEVELS = { error: ERROR, warn: new RegExp(`${ERROR.source}|${WARNING.source}`, "i") };
 var TAIL = 500;
 var MAX_WIDTH = 220;
 var TIMESTAMP = /\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}(?:[.,]\d+)?(?:Z|[+-]\d{2}:?\d{2})?|\d{2}[/-][A-Za-z]{3}[/-]\d{4}:\d{2}:\d{2}:\d{2}(?: [+-]\d{4})?|\d{2}:\d{2}:\d{2}(?:[.,]\d+)?/g;
@@ -1074,24 +1360,38 @@ function shape(line) {
 function clip(line) {
   return line.length > MAX_WIDTH ? `${line.slice(0, MAX_WIDTH - 1)}\u2026` : line;
 }
-function errorLines(log, limit) {
+function errorLines(log, limit, known, matches = ERROR) {
   const seen = new Map;
   for (const raw of log.split(`
 `)) {
     const line = stripAnsi(raw).trim();
-    if (line === "" || !ERROR.test(line))
+    if (line === "" || !matches.test(line))
       continue;
     const shared = shape(line);
     const before = seen.get(shared);
     seen.delete(shared);
-    seen.set(shared, { line: clip(maskLine(line)), count: (before?.count ?? 0) + 1 });
+    seen.set(shared, { line: clip(maskLine(line, known)), count: (before?.count ?? 0) + 1 });
   }
   return [...seen.values()].slice(-limit);
 }
+function isUp(state, container) {
+  return state === "running" || state === "exited" && container?.ExitCode === 0;
+}
 function healthOf(state, container) {
   const health = (container?.Health ?? "") || (STATUS_HEALTH.exec(container?.Status ?? "")?.[1]?.replace("health: ", "") ?? "");
-  const finished = state === "exited" && container?.ExitCode === 0;
-  return { health, fine: (state === "running" || finished) && (health === "" || health === "healthy") };
+  return { health, fine: isUp(state, container) && (health === "" || health === "healthy") };
+}
+function needsLook(report, failOn) {
+  return failOn.has("down") && (report.down || report.unreadable !== undefined) || failOn.has("unhealthy") && report.unhealthy || failOn.has("errors") && (report.errors.length > 0 || report.unreadable !== undefined);
+}
+function matcherOf(level, grep) {
+  if (grep === undefined)
+    return LEVELS[level];
+  try {
+    return new RegExp(grep, "i");
+  } catch {
+    return badUsage(`--grep takes a regex, ${grep} is not one`);
+  }
 }
 async function read(service, since) {
   const [ps, logs] = await Promise.all([
@@ -1128,10 +1428,11 @@ function show(reports) {
   }
 }
 async function dlog(args) {
-  const parsed = parse(args, usage2, options, { replaces: "docker compose ps, logs --tail | grep -i error and docker inspect for health", examples: ["dlog", ["dlog php db", "only those services"], ["dlog -n 10 --since 15m", "ten error lines of the last quarter of an hour"], ["dlog --json", "the report as JSON"]] });
-  const limit = Number(parsed.values.lines);
-  if (!Number.isInteger(limit) || limit < 1)
-    fail("--lines takes a positive whole number");
+  const parsed = parse(args, usage2, options, { exits: EXITS, replaces: "docker compose ps, logs --tail | grep -i error and docker inspect for health", examples: ["dlog", ["dlog php db", "only those services"], ["dlog -n 10 --since 15m", "ten error lines of the last quarter of an hour"], ["dlog --level warn", "warnings too"], ['dlog --grep "timeout|5\\d\\d"', "the lines matching a regex"], ["dlog --fail-on down --fail-on unhealthy", "a gate that ignores old errors"], ["dlog --json", "the report as JSON"]] });
+  const limit = wholeNumber(parsed.values.lines, "lines", 5);
+  const matches = matcherOf(parsed.values.level === "warn" ? "warn" : "error", parsed.values.grep);
+  const failOn = new Set((parsed.values["fail-on"] ?? []).length > 0 ? parsed.values["fail-on"] ?? FAIL_ON : FAIL_ON);
+  const known = await loadKnown();
   const services = await allServices();
   if (services.length === 0)
     fail("no compose service here", 1);
@@ -1146,19 +1447,19 @@ async function dlog(args) {
     const lines = withoutKeys(log.split(`
 `));
     const errors = errorLines(lines.join(`
-`), limit);
-    const tail = parsed.values.all === true && errors.length === 0 ? lines.map((text) => clip(maskLine(stripAnsi(text).trim()))).filter(Boolean).slice(-limit) : [];
-    return { key: key(service), state: service.state, health, status: service.status, errors, tail, unreadable, fine };
+`), limit, known, matches);
+    const tail = parsed.values.all === true && errors.length === 0 ? lines.map((text) => clip(maskLine(stripAnsi(text).trim(), known))).filter(Boolean).slice(-limit) : [];
+    return { key: key(service), state: service.state, health, status: service.status, errors, tail, unreadable, fine, down: !isUp(service.state, container), unhealthy: isUp(service.state, container) && !fine };
   }));
   if (parsed.values.json === true)
     printJson(reports);
   else
     show(reports);
-  const down = reports.filter((report) => !report.fine || report.unreadable !== undefined || report.errors.length > 0);
+  const down = reports.filter((report) => needsLook(report, failOn));
   if (parsed.values.json !== true && down.length > 0)
     console.error(paint(process8.stderr).dim(`${down.length} of ${reports.length} services need a look: ${down.map((report) => report.key).join(", ")}`));
   return down.length > 0 ? 1 : 0;
 }
 
 // src/dlog-cli.ts
-process9.exitCode = await runMain({ name: "dlog", version, run: dlog });
+process9.exitCode = await runMain({ name: "dlog", run: dlog });