@kaynooo/cli-docker 0.4.0 → 0.5.1

package/dist/sf-cli.js

@@ -1,9 +1,8 @@
-#!/usr/bin/env bun
+#!/usr/bin/env -S bun --no-env-file
 // @bun
 
 // src/sf-cli.ts
 import process11 from "process";
-
 // ../kit/src/args.ts
 import process4 from "process";
 import { parseArgs } from "util";
@@ -306,17 +305,23 @@ var FULL_STOP = /\.$/;
 function usageLine(usage, colors = paint(process3.stdout)) {
   return `${colors.bold("Usage:")} ${usage.replace(USAGE_PREFIX, "").replaceAll(OPTIONAL, (part) => colors.dim(part))}`;
 }
-function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces } = {}) {
-  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exampleRows(examples, colors)].join(`
+function helpText(usage, options, colors = paint(process3.stdout), { examples = [], replaces, exits = [] } = {}) {
+  return [usageLine(usage, colors), ...replacesRows(replaces, colors), "", colors.bold("Options:"), ...optionRows(options, colors), ...exitRows(exits, colors), ...exampleRows(examples, colors)].join(`
 `);
 }
+function exitRows(exits, colors = paint(process3.stdout)) {
+  if (exits.length === 0)
+    return [];
+  const width = Math.max(...exits.map(([code]) => String(code).length));
+  return ["", colors.bold("Exits:"), ...exits.map(([code, meaning]) => `  ${colors.cyan(String(code).padEnd(width))}  ${meaning}`)];
+}
 function replacesRows(replaces, colors = paint(process3.stdout)) {
   return replaces === undefined ? [] : ["", `${colors.bold("Instead of:")} ${replaces}`];
 }
 function wantsHelpJson(env = process3.env) {
   return env.KIT_HELP === "json";
 }
-function description(usage, { examples = [], replaces } = {}) {
+function description(usage, { examples = [], replaces, exits } = {}, options) {
   const lines = usage.replace(USAGE_PREFIX, "").split(`
 `);
   const first = lines[0];
@@ -327,7 +332,9 @@ function description(usage, { examples = [], replaces } = {}) {
     synopsis: colon === -1 ? first : first.slice(0, colon),
     summary: colon === -1 ? fallback : first.slice(colon + 2),
     ...replaces === undefined ? {} : { replaces },
-    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] })
+    examples: examples.map((example) => typeof example === "string" ? { line: example } : { line: example[0], note: example[1] }),
+    ...exits === undefined ? {} : { exits: exits.map(([code, meaning]) => ({ code, meaning })) },
+    ...options === undefined ? {} : { options: Object.entries(options).map(([name, { short, description }]) => ({ name, ...short === undefined ? {} : { short }, ...description === undefined ? {} : { description } })) }
   };
 }
 function exampleRows(examples, colors = paint(process3.stdout)) {
@@ -369,6 +376,16 @@ function closest(name, names) {
   const [best] = names.map((known) => ({ known, far: distance(name, known) })).sort((a, b) => a.far - b.far);
   return best !== undefined && best.far <= (name.length < 4 ? 1 : 2) ? best.known : undefined;
 }
+// ../kit/src/input.ts
+var WHOLE = /^\d+$/;
+function wholeNumber(value, name, fallback, min = 1) {
+  if (value === undefined)
+    return fallback;
+  const number = Number(value);
+  if (!WHOLE.test(value) || !Number.isSafeInteger(number) || number < min)
+    badUsage(`${name.startsWith("<") ? name : `--${name}`} takes a whole number from ${min}, not ${value}`);
+  return number;
+}
 
 // ../kit/src/args.ts
 var DASHES = /^-+/;
@@ -442,7 +459,7 @@ function parse(args, usage, options, settings = {}) {
   const { own, rest } = settings.trailing === true ? splitTrailing(args, all, settings.positionals?.length ?? 0) : splitRest(args, settings.rest === true);
   let parsed;
   try {
-    parsed = parseArgs({ args: joinDashValues(withBare(own, all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
+    parsed = parseArgs({ args: joinDashValues(withBare(withAliases(own, all), all), all), options: all, allowPositionals: true, allowNegative: settings.allowNegative === true, strict: true });
   } catch (error) {
     const message = parseError(error);
     throw new UsageError(message, nearestOption(message, all, settings.allowNegative === true));
@@ -450,7 +467,7 @@ function parse(args, usage, options, settings = {}) {
   const values = parsed.values;
   applyOutput("color" in output ? values.color : undefined, "plain" in output ? values.plain : undefined);
   if (values.help === true) {
-    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings)) : helpText(usage, listing, undefined, settings));
+    console.log(wantsHelpJson() ? JSON.stringify(description(usage, settings, listing)) : helpText(usage, listing, undefined, settings));
     throw new HelpShown;
   }
   checkChoices(parsed.values, all);
@@ -492,6 +509,18 @@ function listed(options, allowNegative) {
     return [...option.description === undefined ? [] : [[name, option]], [`no-${name}`, { type: "boolean", description: option.negative }]];
   }));
 }
+function withAliases(args, options) {
+  const named = new Map(Object.entries(options).flatMap(([name, { aliases = [] }]) => aliases.map((alias) => [`--${alias}`, `--${name}`])));
+  if (named.size === 0)
+    return args;
+  const separator = args.indexOf("--");
+  const own = separator === -1 ? args : args.slice(0, separator);
+  return [...own.map((arg) => {
+    const at = arg.indexOf("=");
+    const current = named.get(at === -1 ? arg : arg.slice(0, at));
+    return current === undefined ? arg : `${current}${at === -1 ? "" : arg.slice(at)}`;
+  }), ...separator === -1 ? [] : args.slice(separator)];
+}
 function withBare(args, options) {
   const bare = new Map(Object.entries(options).flatMap(([name, { short, optional }]) => optional === undefined ? [] : [[`--${name}`, optional], ...short === undefined ? [] : [[`-${short}`, optional]]]));
   if (bare.size === 0)
@@ -582,6 +611,8 @@ var ESCAPE_CODE = new RegExp(`${ESC}(?:\\[[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x
 var RESET_STYLE = `${ESC}[0m`;
 var CLOSE_LINK = `${ESC}]8;;${ESC}\\`;
 // ../kit/src/cli.ts
+import { readFileSync, realpathSync } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
 import process6 from "process";
 
 // ../kit/src/usage.ts
@@ -724,11 +755,22 @@ async function printCandidates(found) {
     console.log(line);
   return 0;
 }
+function packageVersion(entry = Bun.main) {
+  for (let dir = dirname2(realpathSync(entry));; dir = dirname2(dir)) {
+    try {
+      const { version } = JSON.parse(readFileSync(join2(dir, "package.json"), "utf8"));
+      if (typeof version === "string")
+        return version;
+    } catch {}
+    if (dirname2(dir) === dir)
+      return "0.0.0";
+  }
+}
 async function runMain({ name, version, run, redact, usage }, argv = process6.argv.slice(2)) {
   if (argv[0] === COMPLETE)
     return printCandidates(leafCandidates(run, argv.slice(1)));
   if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-    console.log(version);
+    console.log(version ?? packageVersion());
     return 0;
   }
   let code;
@@ -737,29 +779,45 @@ async function runMain({ name, version, run, redact, usage }, argv = process6.ar
   } catch (error) {
     code = reportThrown(name, error, redact, wantsJson(argv));
   }
-  if (usage !== false)
-    recordUsage(usageEntry(name, undefined, argv, code));
+  if (usage !== false) {
+    try {
+      recordUsage(usageEntry(name, undefined, argv, code));
+    } catch {}
+  }
   return code;
 }
+// ../kit/src/compose.ts
+async function captureOutput(argv, { cwd, env } = {}) {
+  const run = Bun.spawn(argv, { ...cwd === undefined ? {} : { cwd }, env: { ...process.env, ...env }, stdin: "ignore", stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, code] = await Promise.all([run.stdout.text(), run.stderr.text(), run.exited]);
+  return { code, stdout, stderr };
+}
+function composeError({ code, stderr }) {
+  const last = stderr.trim().split(`
+`).at(-1) ?? "";
+  return last === "" ? `exit ${code}` : last;
+}
 // ../kit/src/secrets.ts
+var SECRET_PART = /token|secret|passw|credential|private|dsn|apikey|accesskey|key$/i;
 var SECRET_WORDS = new Set(["key", "pass", "pwd", "auth", "salt", "cookie", "session", "jwt", "ssn", "iban", "card", "cvv", "otp"]);
+var WORD_BREAKS = /[^a-zA-Z\d]+|(?<=[a-z\d])(?=[A-Z])|(?<=[A-Z])(?=[A-Z][a-z])/;
+function isSecretName(name) {
+  return SECRET_PART.test(name) || name.split(WORD_BREAKS).some((word) => SECRET_WORDS.has(word.toLowerCase()));
+}
 // ../kit/src/sessions.ts
 var {Glob } = globalThis.Bun;
 var SESSION_FILES = new Glob("*.json");
 var ACCOUNT_DIRS = new Glob("*/sessions");
-// package.json
-var version = "0.4.0";
-
 // src/sf.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join4, resolve as resolve2 } from "path";
+import { dirname as dirname6, join as join6, resolve as resolve2 } from "path";
 import process10 from "process";
 
 // ../kit/src/fzf.ts
-import { existsSync, mkdirSync as mkdirSync2, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join2 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 import process8 from "process";
 var REMEMBERED = 20;
 function table(rows) {
@@ -815,12 +873,12 @@ function heightFor(count) {
   return String(Math.max(15, Math.ceil((count + 4) / 0.6)));
 }
 function historyFile(name) {
-  return join2(process8.env.XDG_CACHE_HOME ?? join2(homedir2(), ".cache"), name, "history.json");
+  return join3(process8.env.XDG_CACHE_HOME ?? join3(homedir2(), ".cache"), name, "history.json");
 }
 function history(name) {
   try {
     const file = historyFile(name);
-    return existsSync(file) ? JSON.parse(readFileSync(file, "utf-8")) : {};
+    return existsSync(file) ? JSON.parse(readFileSync2(file, "utf-8")) : {};
   } catch {
     return {};
   }
@@ -832,7 +890,7 @@ function record(name, run) {
   const all = history(name);
   const file = historyFile(name);
   all[process8.cwd()] = [run, ...(all[process8.cwd()] ?? []).filter((earlier) => earlier.id !== run.id)].slice(0, REMEMBERED);
-  mkdirSync2(dirname2(file), { recursive: true });
+  mkdirSync2(dirname3(file), { recursive: true });
   writeFileSync(file, JSON.stringify(all));
 }
 function byRecency(items, previous, idOf) {
@@ -945,25 +1003,377 @@ async function ask(question, { hint, terminal = process9 }, render, press) {
 }
 
 // src/stack.ts
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname3, join as join3, relative, resolve } from "path";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname5, join as join5, relative, resolve } from "path";
+
+// ../env/src/files.ts
+import { chmod, chown, readdir, realpath, rename, rm, stat, writeFile } from "fs/promises";
+import { basename, dirname as dirname4, join as join4 } from "path";
+
+// ../env/src/dotenv.ts
+var ASSIGNMENT = /^\s*(?:export\s+)?([A-Z_][\w.-]*)\s*=(.*)$/i;
+var INLINE_COMMENT = /\s+#.*$/;
+var CARRIAGE_RETURN = /\r$/;
+var ESCAPES = { n: `
+`, r: "\r", t: "\t", '"': '"', "\\": "\\", $: "$" };
+function closingQuote(text, quote) {
+  for (let index = 0;index < text.length; index++) {
+    if (quote === '"' && text[index] === "\\")
+      index++;
+    else if (text[index] === quote)
+      return index;
+  }
+  return -1;
+}
+function unescapeDollar(text) {
+  return text.replaceAll("\\$", "$");
+}
+function unescapeDouble(text) {
+  let out = "";
+  for (let index = 0;index < text.length; index++) {
+    const next = text[index + 1];
+    if (text[index] === "\\" && next !== undefined && next in ESCAPES) {
+      out += ESCAPES[next];
+      index++;
+    } else {
+      out += text[index];
+    }
+  }
+  return out;
+}
+function parseDotenv(text) {
+  const physical = text.split(`
+`);
+  const lines = [];
+  for (let index = 0;index < physical.length; index++) {
+    const line = physical[index] ?? "";
+    const match = ASSIGNMENT.exec(line.replace(CARRIAGE_RETURN, ""));
+    if (match === null) {
+      lines.push({ raw: line });
+      continue;
+    }
+    const [, key = "", rest = ""] = match;
+    const start = rest.trimStart();
+    const quote = start[0];
+    if (quote !== '"' && quote !== "'" && quote !== "`") {
+      lines.push({ raw: line, key, value: unescapeDollar(start.replace(INLINE_COMMENT, "").trim()) });
+      continue;
+    }
+    let body = start.slice(1);
+    let raw = line;
+    let end = closingQuote(body, quote);
+    while (end === -1 && index + 1 < physical.length) {
+      index++;
+      body += `
+${(physical[index] ?? "").replace(CARRIAGE_RETURN, "")}`;
+      raw += `
+${physical[index] ?? ""}`;
+      end = closingQuote(body, quote);
+    }
+    const inner = end === -1 ? body : body.slice(0, end);
+    lines.push({ raw, key, value: quote === '"' ? unescapeDouble(inner) : unescapeDollar(inner) });
+  }
+  return { lines };
+}
+function entries(file) {
+  const map = new Map;
+  for (const line of file.lines) {
+    if (line.key !== undefined)
+      map.set(line.key, line.value ?? "");
+  }
+  return map;
+}
+
+// ../env/src/mask.ts
+var MIN_KNOWN_LENGTH = 4;
+var KEY_MASK = "*** private key redacted ***";
+var PLAIN_VALUE = /^(?:true|false|null|none|nil|yes|no|on|off|undefined)$/i;
+var PLACEHOLDER = /^[$%{<(*/]/;
+var URL_PASSWORD = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]*:([^\s'"]{1,1024})@/dgi;
+var PORT = /^\d{1,5}$/;
+var ESCAPE2 = /[.*+?^${}()|[\]\\]/g;
+function isPlaceholder(value) {
+  return PLACEHOLDER.test(value) || PLAIN_VALUE.test(value);
+}
+var TOKEN_FORMATS = [
+  { kind: "GitHub token", pattern: /\b(?:gh[pousr]_|github_pat_)\w{20,}/dg },
+  { kind: "GitLab token", pattern: /\bglpat-[\w-]{20,}/dg },
+  { kind: "API key", pattern: /\bsk-[\w-]{20,}/dg },
+  { kind: "Slack token", pattern: /\bx(?:ox[abprs]|app)-[\w-]{10,}/dg },
+  { kind: "JWT", pattern: /\beyJ[\w-]+\.[\w-]+\.[\w-]+/dg },
+  { kind: "AWS access key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/dg },
+  { kind: "npm token", pattern: /\bnpm_[A-Za-z0-9]{30,}/dg },
+  { kind: "Stripe key", pattern: /\b[sr]k_(?:live|test)_[A-Za-z0-9]{10,}/dg },
+  { kind: "Google API key", pattern: /\bAIza[\w-]{35}/dg },
+  { kind: "SendGrid key", pattern: /\bSG\.[\w-]{16,}\.[\w-]{16,}/dg },
+  { kind: "Authorization header", pattern: /\bAuthorization["']?\s*[:=]\s*["']?(?:Bearer|Basic|Token|Digest)\s+([^\s"',;]{8,})/dgi, skip: isPlaceholder },
+  { kind: "Bearer token", pattern: /\bBearer\s+((?=[\w.~+/=-]*\d)[\w.~+/=-]{20,})/dg },
+  { kind: "password", pattern: /(?<![\w-])(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?=([^\s"'&;,]{4,})/dgi, skip: isPlaceholder },
+  { kind: "password", pattern: /(?<![\w-])["']?(?:[\w-]{0,30}[_-])?(?:password|passwd|secret|api[_-]?key)(?:[_-][\w-]{0,30})?["']?\s*[:=]\s*(["'])((?:\\.|(?!\1)[^\\\n]){4,})\1/dgi, skip: isPlaceholder }
+];
+var PEM_BEGIN = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_END = /-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/;
+var PEM_BODY = /(?<=-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)(?:(?!-----END [A-Z ]*PRIVATE KEY(?: BLOCK)?-----)[\s\S])+/dg;
+var PEM_BEGIN_ALL = /-----BEGIN [A-Z ]*PRIVATE KEY(?: BLOCK)?-----/g;
+var URL_PARTS = /(?<![a-z0-9+.-])[a-z][a-z0-9+.-]{0,31}:\/\/([^\s/?#'"<>`]*)([^\s?#'"<>`]*)(?:\?([^\s#'"<>`]*))?/dgi;
+var PATH_SEGMENT = /[^/]+/g;
+var SECRET_PARAM = /^(?:token|[a-z]+_token|key|api[_-]?key|access[_-]?key|secret|[a-z]+_secret|password|passwd|pwd|sig|signature|auth|authorization)$/i;
+var WEBHOOK_FORMATS = [
+  ["Discord webhook", /(?:^|\.)discord(?:app)?\.com\/api\/(?:v\d+\/)?webhooks\/\d+\/([\w-]+)/di],
+  ["Slack webhook", /^hooks\.slack\.com\/(?:services|workflows)\/(?:[\w-]+\/)*([\w-]+)/di],
+  ["Uptime Kuma push URL", /\/api\/push\/([\w-]+)/di],
+  ["healthchecks.io ping URL", /^hc-ping\.com\/([\w-]+)/di]
+];
+var OPAQUE_SEGMENT = /^(?:(?=[\w-]{20,}$)(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[\w-]+|(?=[A-Za-z\d]{32,}$)(?=.*[A-Za-z])(?=.*\d).+)$/;
+function hint(value) {
+  const shown = Math.min(3, Math.floor(value.length / 4));
+  return `${value.slice(0, shown)}***(${value.length})`;
+}
+function forms(value) {
+  return [...new Set([value, encodeURIComponent(value), JSON.stringify(value).slice(1, -1)])];
+}
+function knownSecrets(pairs) {
+  const keys = new Map;
+  for (const [key, value] of pairs) {
+    if (value.length < MIN_KNOWN_LENGTH || PLAIN_VALUE.test(value))
+      continue;
+    for (const form of forms(value)) {
+      if (!keys.has(form))
+        keys.set(form, key);
+    }
+  }
+  if (keys.size === 0)
+    return { pattern: undefined, keys };
+  const alternatives = [...keys.keys()].sort((a, b) => b.length - a.length).map((value) => value.replace(ESCAPE2, "\\$&"));
+  return { pattern: new RegExp(`(?<!\\w)(?:${alternatives.join("|")})(?!\\w)`, "g"), keys };
+}
+function passwordSpans(text) {
+  const spans = [];
+  for (const url of text.matchAll(URL_PASSWORD)) {
+    const [start, end] = url.indices?.[1] ?? [];
+    const password = url[1] ?? "";
+    const slash = password.indexOf("/");
+    if (start !== undefined && end !== undefined && !(slash !== -1 && PORT.test(password.slice(0, slash))))
+      spans.push([start, end]);
+  }
+  return spans;
+}
+function urlPasswords(text) {
+  return passwordSpans(text).map(([start, end]) => text.slice(start, end));
+}
+function urlTokens(line) {
+  const found = [];
+  const add = (kind, start, value) => {
+    found.push({ start, end: start + value.length, kind, mask: hint(value) });
+  };
+  for (const url of line.matchAll(URL_PARTS)) {
+    const [authority, path = "", query] = [url[1] ?? "", url[2] ?? "", url[3]];
+    const authorityStart = url.indices?.[1]?.[0];
+    const pathStart = url.indices?.[2]?.[0];
+    const queryStart = url.indices?.[3]?.[0];
+    if (authorityStart === undefined || pathStart === undefined)
+      continue;
+    const hostAt = authority.lastIndexOf("@") + 1;
+    const target = authority.slice(hostAt) + path;
+    for (const [kind, pattern] of WEBHOOK_FORMATS) {
+      const [start, end] = pattern.exec(target)?.indices?.[1] ?? [];
+      if (start !== undefined && end !== undefined)
+        add(kind, authorityStart + hostAt + start, target.slice(start, end));
+    }
+    for (const segment of path.matchAll(PATH_SEGMENT)) {
+      if (OPAQUE_SEGMENT.test(segment[0]))
+        add("URL token", pathStart + segment.index, segment[0]);
+    }
+    if (query === undefined || queryStart === undefined)
+      continue;
+    let offset = 0;
+    for (const param of query.split("&")) {
+      const equals = param.indexOf("=");
+      if (equals > 0 && equals < param.length - 1 && SECRET_PARAM.test(param.slice(0, equals)))
+        add("URL token", queryStart + offset + equals + 1, param.slice(equals + 1));
+      offset += param.length + 1;
+    }
+  }
+  return found.filter((match) => match.end > match.start);
+}
+function findSecrets(line, known) {
+  const found = [];
+  for (const [start, end] of passwordSpans(line))
+    found.push({ start, end, kind: "URL password", mask: "***" });
+  for (const body of line.matchAll(PEM_BODY)) {
+    const [start, end] = body.indices?.[0] ?? [];
+    if (start !== undefined && end !== undefined)
+      found.push({ start, end, kind: "private key", mask: KEY_MASK });
+  }
+  for (const { kind, pattern, skip } of TOKEN_FORMATS) {
+    for (const token of line.matchAll(pattern)) {
+      const [start, end] = token.indices?.at(-1) ?? [];
+      if (start === undefined || end === undefined)
+        continue;
+      const value = line.slice(start, end);
+      if (!skip?.(value))
+        found.push({ start, end, kind, mask: hint(value) });
+    }
+  }
+  found.push(...urlTokens(line));
+  if (known?.pattern !== undefined) {
+    for (const value of line.matchAll(known.pattern))
+      found.push({ start: value.index, end: value.index + value[0].length, kind: `value of ${known.keys.get(value[0])}`, mask: hint(value[0]) });
+  }
+  found.sort((a, b) => a.start - b.start || b.end - a.end);
+  const kept = [];
+  for (const match of found) {
+    if (match.start >= (kept.at(-1)?.end ?? 0))
+      kept.push(match);
+  }
+  return kept;
+}
+function openKeyBody(line) {
+  const last = [...line.matchAll(PEM_BEGIN_ALL)].at(-1);
+  if (last === undefined)
+    return;
+  const after = line.slice(last.index + last[0].length);
+  return PEM_END.test(after) ? undefined : after.trim();
+}
+function maskLine(line, known) {
+  let out = "";
+  let at = 0;
+  for (const match of findSecrets(line, known)) {
+    out += line.slice(at, match.start) + match.mask;
+    at = match.end;
+  }
+  return out + line.slice(at);
+}
+
+// ../env/src/files.ts
+var ENV_FILE = /^(?:\.env(?:\..+)?|.+\.env|\.envrc)$/;
+var KNOWN_DEPTH = 3;
+var SKIPPED = new Set(["node_modules", ".git", "vendor"]);
+async function isFileEntry(entry, path) {
+  if (entry.isFile())
+    return true;
+  if (!entry.isSymbolicLink())
+    return false;
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+function secretPairs(file) {
+  const pairs = [];
+  for (const [key, value] of entries(file)) {
+    if (isSecretName(key))
+      pairs.push([key, value]);
+    else
+      pairs.push(...urlPasswords(value).map((password) => [key, password]));
+  }
+  return pairs;
+}
+async function envFilesBelow(folder, depth = 0) {
+  const found = [];
+  let children;
+  try {
+    children = await readdir(folder, { withFileTypes: true });
+  } catch {
+    return found;
+  }
+  for (const entry of children) {
+    const path = join4(folder, entry.name);
+    if (entry.isDirectory() && depth < KNOWN_DEPTH && !SKIPPED.has(entry.name))
+      found.push(...await envFilesBelow(path, depth + 1));
+    else if (ENV_FILE.test(entry.name) && await isFileEntry(entry, path))
+      found.push(path);
+  }
+  return found;
+}
+async function loadKnown(folder = process.cwd(), extra = []) {
+  const pairs = extra.flatMap(secretPairs);
+  for (const path of await envFilesBelow(folder)) {
+    try {
+      pairs.push(...secretPairs(parseDotenv(await Bun.file(path).text())));
+    } catch {}
+  }
+  return knownSecrets(pairs);
+}
+
+// ../env/src/redactor.ts
+var MAX_PENDING = 1 << 18;
+var OVERLAP = 1 << 13;
+
+class Redactor {
+  known;
+  pending = "";
+  inKey = false;
+  hidden = false;
+  constructor(known) {
+    this.known = known;
+  }
+  push(chunk) {
+    const end = chunk.lastIndexOf(`
+`);
+    this.pending += chunk;
+    if (end === -1)
+      return this.pending.length > MAX_PENDING ? this.cut() : "";
+    const split = this.pending.length - chunk.length + end + 1;
+    const complete = this.pending.slice(0, split);
+    this.pending = this.pending.slice(split);
+    return complete.split(`
+`).slice(0, -1).map((line) => this.line(line)).filter((line) => line !== undefined).map((line) => `${line}
+`).join("");
+  }
+  cut() {
+    const limit = this.pending.length - OVERLAP;
+    const space = this.pending.lastIndexOf(" ", limit);
+    const at = space > 0 ? space + 1 : limit;
+    const head = this.pending.slice(0, at);
+    this.pending = this.pending.slice(at);
+    return this.line(head) ?? "";
+  }
+  end() {
+    const rest = this.pending;
+    this.pending = "";
+    return rest === "" ? "" : this.line(rest) ?? "";
+  }
+  line(line) {
+    if (this.inKey) {
+      const end = PEM_END.exec(line);
+      if (end === null) {
+        if (this.hidden)
+          return;
+        this.hidden = true;
+        return KEY_MASK;
+      }
+      this.inKey = false;
+      return (end.index > 0 && !this.hidden ? KEY_MASK : "") + this.line(line.slice(end.index));
+    }
+    const body = openKeyBody(line);
+    if (body !== undefined) {
+      this.inKey = true;
+      this.hidden = body !== "";
+    }
+    return maskLine(line, this.known);
+  }
+}
+
+// src/stack.ts
 var LABEL_FORMAT = ["project", "project.config_files", "project.environment_file", "project.working_dir"].map((label) => `{{.Label "com.docker.compose.${label}"}}`).join("\t");
 var COMPOSE_FILE_VAR = /^\s*(?:export\s+)?COMPOSE_FILE\s*=\s*\S/m;
 var COMPOSE_FILES = ["compose.yaml", "compose.yml", "docker-compose.yaml", "docker-compose.yml"];
-var SKIPPED = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
+var SKIPPED2 = new Set(["node_modules", "vendor", "dist", "build", "target", "venv", "__pycache__"]);
 var ACTIONS = ["shell", "logs", "restart", "up", "stop", "build"];
 function from(dir, command) {
   return dir === "." ? command : ["env", "-C", dir, ...command];
 }
 function children(dir = ".") {
-  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED.has(child.name)).map((child) => child.name).sort();
+  return readdirSync(dir, { withFileTypes: true }).filter((child) => child.isDirectory() && !child.name.startsWith(".") && !SKIPPED2.has(child.name)).map((child) => child.name).sort();
 }
 function up(dir) {
   const dirs = [];
-  for (let current = dir;; current = join3(current, "..")) {
+  for (let current = dir;; current = join5(current, "..")) {
     dirs.push(current);
     const absolute = resolve(current);
-    if (existsSync2(join3(current, ".git")) || dirname3(absolute) === absolute)
+    if (existsSync2(join5(current, ".git")) || dirname5(absolute) === absolute)
       return dirs;
   }
 }
@@ -971,10 +1381,10 @@ function stackAt(dir) {
   return { dir, run: from(dir, ["docker", "compose"]), list: { argv: ["docker", "compose"], cwd: resolve(dir), env: process.env } };
 }
 function holdsStack(dir) {
-  if (COMPOSE_FILES.some((name) => existsSync2(join3(dir, name))))
+  if (COMPOSE_FILES.some((name) => existsSync2(join5(dir, name))))
     return true;
   try {
-    return COMPOSE_FILE_VAR.test(readFileSync2(join3(dir, ".env"), "utf-8"));
+    return COMPOSE_FILE_VAR.test(readFileSync3(join5(dir, ".env"), "utf-8"));
   } catch {
     return false;
   }
@@ -1022,13 +1432,8 @@ async function recordedNearby() {
   return (await labels()).filter((stack) => dirs.has(stack.workdir));
 }
 async function attempt(stack, args) {
-  const proc = Bun.spawn([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env, stdout: "pipe", stderr: "pipe" });
-  const [text, stderr, code] = await Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited]);
-  if (code === 0)
-    return { text, error: undefined };
-  const last = stderr.trim().split(`
-`).at(-1) ?? "";
-  return { text: "", error: last === "" ? `exit ${code}` : last };
+  const result = await captureOutput([...stack.list.argv, ...args], { cwd: stack.list.cwd, env: stack.list.env });
+  return result.code === 0 ? { text: result.stdout, error: undefined } : { text: "", error: composeError(result) };
 }
 async function output(stack, args) {
   return (await attempt(stack, args)).text;
@@ -1072,13 +1477,14 @@ function key(service) {
 async function shellOf(service) {
   return await output(service.stack, ["exec", "-T", service.name, "sh", "-c", "command -v bash"]) ? "bash" : "sh";
 }
-async function commandFor(service, action) {
+var LOGS_TAIL = 200;
+async function commandFor(service, action, logs = {}) {
   const run = service.stack.run;
   switch (action) {
     case "shell":
       return [...run, "exec", service.name, await shellOf(service)];
     case "logs":
-      return [...run, "logs", "-f", "--tail=200", service.name];
+      return [...run, "logs", ...logs.follow === false ? [] : ["-f"], `--tail=${logs.tail ?? LOGS_TAIL}`, service.name];
     case "restart":
       return [...run, "restart", service.name];
     case "up":
@@ -1104,20 +1510,24 @@ async function serviceNamed(dir, name, project) {
   const stack = recorded === undefined ? stackAt(dir) : labelledStack(dir, recorded);
   return (await services(stack)).find((candidate) => candidate.name === name);
 }
+function maskLog(text, known) {
+  const redactor = new Redactor(known);
+  return redactor.push(text) + redactor.end();
+}
 async function logsOf(stack, name) {
-  return output(stack, ["logs", "--tail=30", "--no-log-prefix", name]);
+  return maskLog(await output(stack, ["logs", "--tail=30", "--no-log-prefix", name]), await loadKnown());
 }
 
 // src/sf.ts
 var usage2 = `sf [command] [args...]
 sf -
 
-Picks a Symfony console command with fzf and runs it, asking for each required argument it needs. The commands last run come first, per folder, and the picker opens on the list cached from the last run while the console answers.
+Without a terminal or without fzf (a script, a pipe, an agent) \`sf\` lists the commands, one per line with its description: that listing is the form to use there, and \`sf --list --json\` gives each with its arguments and options. On a terminal with fzf it picks a Symfony console command instead and runs it, asking for each required argument it needs. The commands last run come first, per folder, and the picker opens on the list cached from the last run while the console answers.
 The console is the nearest bin/console up to the repository root, then those of the child folders (keyed \`api/cache:clear\`). It runs in the php service of the nearest compose stack when there is one, else with the local php; the container's working directory is taken to be the app.
-\`sf -\` runs the last command again with the arguments it ran with, \`sf <command> [args...]\` runs without the picker: a name the list does not hold goes to the console as is, which resolves \`c:c\` to \`cache:clear\` itself. Without fzf or a terminal it lists the commands instead.
-The hidden flags --list, --names, --rows, --show, --record and --emit are for term, tmux and the shell completions.
-
-Exits with the code of the console, 1 when there is no bin/console here.`;
+\`sf -\` runs the last command again with the arguments it ran with, \`sf <command> [args...]\` runs without the picker: a name the list does not hold goes to the console as is, which resolves \`c:c\` to \`cache:clear\` itself.
+\`sf --list --json\` (or \`sf --json\`) prints every command as JSON, each with its console folder, description, signature, arguments and options.
+The hidden flags --list, --names, --rows, --show, --record and --emit are for term, tmux and the shell completions.`;
+var EXITS = [["the code of the console", "a command it ran"], [0, "it listed the commands"], [1, "no bin/console here, or it listed no command"], [2, "a usage error"]];
 var colors = paint({ isTTY: true });
 var MARKUP = /<(info|comment|question|error)>(.*?)<\/\1>/gs;
 var TAGS = { info: "green", comment: "yellow", question: "cyan", error: "red" };
@@ -1142,16 +1552,16 @@ async function consoleAt(dir) {
   return { dir, run: from(dir, ["php", "bin/console"]), list: { argv: ["php", "bin/console"], cwd: resolve2(dir), env: process10.env } };
 }
 async function consoles() {
-  const here = up(".").find((dir) => existsSync3(join4(dir, "bin/console")));
-  const dirs = [...here === undefined ? [] : [here], ...children().filter((dir) => existsSync3(join4(dir, "bin/console")))];
+  const here = up(".").find((dir) => existsSync3(join6(dir, "bin/console")));
+  const dirs = [...here === undefined ? [] : [here], ...children().filter((dir) => existsSync3(join6(dir, "bin/console")))];
   return Promise.all([...new Set(dirs)].map(consoleAt));
 }
 function cached(dir) {
-  return join4(process10.env.XDG_CACHE_HOME ?? join4(homedir3(), ".cache"), "sf", `${resolve2(dir).replaceAll("/", "%")}.json`);
+  return join6(process10.env.XDG_CACHE_HOME ?? join6(homedir3(), ".cache"), "sf", `${resolve2(dir).replaceAll("/", "%")}.json`);
 }
 function fromCache(dir) {
   try {
-    return existsSync3(cached(dir)) ? JSON.parse(readFileSync3(cached(dir), "utf-8")) : undefined;
+    return existsSync3(cached(dir)) ? JSON.parse(readFileSync4(cached(dir), "utf-8")) : undefined;
   } catch {
     return;
   }
@@ -1161,12 +1571,17 @@ async function live(app) {
   const text = await new Response(proc.stdout).text();
   if (await proc.exited !== 0)
     return fromCache(app.dir) ?? [];
-  const commands = JSON.parse(text).commands.filter((command) => !command.hidden);
-  mkdirSync3(dirname4(cached(app.dir)), { recursive: true });
+  let commands;
+  try {
+    commands = JSON.parse(text).commands.filter((command) => !command.hidden);
+  } catch {
+    return fromCache(app.dir) ?? [];
+  }
+  mkdirSync3(dirname6(cached(app.dir)), { recursive: true });
   writeFileSync2(cached(app.dir), JSON.stringify(commands));
   return commands;
 }
-async function entries(fresh) {
+async function entries2(fresh) {
   const found = await consoles();
   const lists = await Promise.all(found.map(async (app) => fresh ? live(app) : fromCache(app.dir) ?? live(app)));
   return found.flatMap((app, index) => lists[index].map((command) => ({ app, command })));
@@ -1181,6 +1596,18 @@ function named2(name) {
 function signature(command) {
   return argumentsOf(command).map((argument) => `${argument.is_required ? "<" : "["}${argument.name}${argument.is_array ? "..." : ""}${argument.is_required ? ">" : "]"}`).join(" ");
 }
+function entryJson(entry) {
+  const { command } = entry;
+  return {
+    name: key2(entry),
+    command: command.name,
+    dir: entry.app.dir,
+    description: command.description,
+    signature: signature(command),
+    arguments: argumentsOf(command).map((argument) => ({ name: argument.name, required: argument.is_required, array: argument.is_array, description: argument.description })),
+    options: optionsOf(command).map((option) => ({ name: option.name, shortcut: option.shortcut, acceptsValue: option.accept_value, description: option.description }))
+  };
+}
 function rows(found) {
   return byRecency(found, runs("sf"), key2).map((entry) => ({
     hidden: [entry.app.dir, entry.command.name],
@@ -1257,14 +1684,14 @@ async function hidden(flag, rest) {
     return 0;
   }
   if (flag === "--rows") {
-    console.log(table(rows(await entries(true))).join(`
+    console.log(table(rows(await entries2(true))).join(`
 `));
     return 0;
   }
   if (flag !== "--list" && flag !== "--names")
     return;
   const refreshed = flag === "--list" && (await consoles()).some((found) => fromCache(found.dir) !== undefined);
-  const found = await entries(false);
+  const found = await entries2(false);
   if (flag === "--names") {
     console.log(found.map((entry) => `${key2(entry)}	${entry.command.description}`).join(`
 `));
@@ -1282,6 +1709,11 @@ async function hidden(flag, rest) {
 }
 async function sf(args) {
   const [flag = ""] = args;
+  if (args.length <= 2 && args.includes("--json") && (flag === "--json" || flag === "--list")) {
+    const found = await entries2(false);
+    printJson(byRecency(found, runs("sf"), key2).map(entryJson));
+    return 0;
+  }
   const flagged = await hidden(flag, args.slice(1));
   if (flagged !== undefined)
     return flagged;
@@ -1291,13 +1723,14 @@ async function sf(args) {
   const parsed = parse(last ? [] : words, usage2, {}, {
     positionals: ["[command]"],
     trailing: true,
+    exits: EXITS,
     replaces: "bin/console typed in the php container, with the command names and arguments looked up by hand",
     examples: ["sf", ["sf cache:clear", "run it without the picker"], ["sf c:c --env=prod", "the console resolves abbreviations itself"], ["sf -", "the last command again, with its arguments"]]
   });
   const [command] = parsed.positionals;
   const given = last ? words.slice(1) : parsed.rest ?? [];
   const refreshed = command === undefined && !last && (await consoles()).some((found) => fromCache(found.dir) !== undefined);
-  const found = await entries(false);
+  const found = await entries2(false);
   if (last) {
     const previous = runs("sf")[0];
     const entry = previous && found.find((candidate) => key2(candidate) === previous.id);
@@ -1331,9 +1764,9 @@ async function sf(args) {
     preview: `${self} --show {1} {2}`,
     bind: refreshed ? [`load:unbind(load)+reload-sync(${self} --rows)`] : []
   });
-  const entry = picked && (await entries(false)).find((candidate) => candidate.app.dir === picked.hidden[0] && candidate.command.name === picked.hidden[1]);
+  const entry = picked && (await entries2(false)).find((candidate) => candidate.app.dir === picked.hidden[0] && candidate.command.name === picked.hidden[1]);
   return entry === undefined ? 1 : execute(emitting, key2(entry), key2(entry), commandFor2(entry, []));
 }
 
 // src/sf-cli.ts
-process11.exitCode = await runMain({ name: "sf", version, run: sf });
+process11.exitCode = await runMain({ name: "sf", run: sf });