@launchfile/macos-dev 0.8.0 → 0.9.0

package/dist/bootstrap.d.ts

@@ -101,6 +101,13 @@ export type BootstrapExec = (cmd: string, args: string[], opts: {
 export declare function launchBootstrap(opts?: {
     component?: string;
     projectDir?: string;
+    /**
+     * Print sensitive captures instead of masking them — the operator's
+     * explicit act on the invoking command (`launchfile bootstrap
+     * --reveal`). Display only: the values are registered with the
+     * redactor either way.
+     */
+    reveal?: boolean;
     exec?: BootstrapExec;
 }): Promise<BootstrapResult[]>;
 //# sourceMappingURL=bootstrap.d.ts.map

package/dist/bootstrap.js

@@ -16,10 +16,10 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
-import { parseDurationMs, readLaunch, resolveExpression, } from "@launchfile/sdk";
+import { formatCaptures, parseDurationMs, readLaunch, resolveExpression, sensitiveCaptureValues, } from "@launchfile/sdk";
 import { loadState, saveState } from "./state.js";
 import { buildResolverContext, computeAppProperties, resolveComponentEnv, resolveGenerators, } from "./env-writer.js";
-import { redactSecrets } from "./redact.js";
+import { redactSecrets, registerDeclaredSecret } from "./redact.js";
 import { getProvisioner } from "./resources/index.js";
 /** Default budget for a bootstrap command when no `timeout` is declared. */
 export const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 120_000;
@@ -184,6 +184,7 @@ const defaultExec = (cmd, args, opts) => new Promise((resolveP) => {
  */
 export async function launchBootstrap(opts = {}) {
     const projectDir = opts.projectDir ?? process.cwd();
+    const reveal = opts.reveal === true;
     const launchfileContent = await readFile(join(projectDir, "Launchfile"), "utf8");
     const launch = readLaunch(launchfileContent);
     const state = await loadState(projectDir);
@@ -259,26 +260,31 @@ export async function launchBootstrap(opts = {}) {
             env,
             timeoutMs: item.timeoutMs,
         });
+        const captureMeta = item.capture ?? {};
         const captures = item.capture ? extractCaptures(stdout, item.capture) : {};
+        // A `sensitive: true` capture is a declared secret (D-18): it registers
+        // before any result or printed line is built, so the value can leak
+        // through neither (CWE-532). `--reveal` changes what the display loop
+        // below prints, never this.
+        for (const value of sensitiveCaptureValues(captures, captureMeta)) {
+            registerDeclaredSecret(value);
+        }
         results.push({
             component: name,
             command: item.command,
             ok: exitCode === 0,
             exitCode,
             captures,
-            captureMeta: item.capture ?? {},
+            captureMeta,
             stdout,
             stderr,
         });
         // Print captures inline so the user sees them immediately.
-        if (Object.keys(captures).length > 0) {
-            console.log("\n  Captured:");
-            for (const [key, value] of Object.entries(captures)) {
-                const meta = item.capture?.[key];
-                const displayValue = meta?.sensitive ? "***" : value;
-                const desc = meta?.description ? ` — ${meta.description}` : "";
-                console.log(`    ${key}: ${displayValue}${desc}`);
-            }
+        const lines = formatCaptures(captures, captureMeta, reveal);
+        if (lines.length > 0) {
+            console.log("");
+            for (const line of lines)
+                console.log(line);
         }
         if (exitCode !== 0) {
             console.error(`  \u2717 Bootstrap [${name}] failed with exit code ${exitCode}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@launchfile/macos-dev",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "macOS dev provider for Launchfile — run apps locally via brew services and native runtimes",
   "os": [
     "darwin"
@@ -36,7 +36,7 @@
     "directory": "providers/macos-dev"
   },
   "dependencies": {
-    "@launchfile/sdk": "^0.8.0",
+    "@launchfile/sdk": "^0.9.0",
     "semver": "^7.7.4"
   },
   "devDependencies": {