@open-mercato/cli 0.10.1-develop.7787.1.96c7cfc66f → 0.10.1-develop.7792.1.b0ce6289cf

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7787.1.96c7cfc66f",
+  "version": "0.10.1-develop.7792.1.b0ce6289cf",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/queue": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/shared": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/telemetry": "0.10.1-develop.7787.1.96c7cfc66f",
+    "@open-mercato/events": "0.10.1-develop.7792.1.b0ce6289cf",
+    "@open-mercato/queue": "0.10.1-develop.7792.1.b0ce6289cf",
+    "@open-mercato/shared": "0.10.1-develop.7792.1.b0ce6289cf",
+    "@open-mercato/telemetry": "0.10.1-develop.7792.1.b0ce6289cf",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7787.1.96c7cfc66f"
+    "@open-mercato/shared": "0.10.1-develop.7792.1.b0ce6289cf"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7787.1.96c7cfc66f",
+    "@open-mercato/shared": "0.10.1-develop.7792.1.b0ce6289cf",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/__tests__/mercato.test.ts

@@ -189,6 +189,93 @@ describe('padByCodePointWidth', () => {
   })
 })
 
+describe('module command argument logging', () => {
+  beforeEach(() => {
+    jest.restoreAllMocks()
+  })
+
+  it('redacts legacy encryption keys before logging module command arguments', async () => {
+    const rotateEncryptionKey = jest.fn().mockResolvedValue(undefined)
+    registerCliModules([
+      {
+        id: 'entities',
+        cli: [{ command: 'rotate-encryption-key', run: rotateEncryptionKey }],
+      } as Module,
+    ])
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+
+    expect(await run([
+      'node',
+      'mercato',
+      'entities',
+      'rotate-encryption-key',
+      '--old-key',
+      'argument-secret',
+    ])).toBe(0)
+    expect(await run([
+      'node',
+      'mercato',
+      'entities',
+      'rotate-encryption-key',
+      '--oldKey=inline-secret',
+    ])).toBe(0)
+
+    const output = consoleLogSpy.mock.calls.flat().map(String).join('\n')
+    expect(output).not.toContain('argument-secret')
+    expect(output).not.toContain('inline-secret')
+    expect(output).toContain('--old-key ****')
+    expect(output).toContain('--oldKey=****')
+    expect(rotateEncryptionKey).toHaveBeenCalledTimes(2)
+    consoleLogSpy.mockRestore()
+  })
+
+  // The echoed command line lands in terminal scrollback and CI logs, so every option that
+  // carries a credential has to be covered — not just the one the encryption work introduced.
+  it('redacts passwords and API keys passed to any module command', async () => {
+    const setup = jest.fn().mockResolvedValue(undefined)
+    const chat = jest.fn().mockResolvedValue(undefined)
+    registerCliModules([
+      { id: 'auth', cli: [{ command: 'setup', run: setup }] } as Module,
+      { id: 'ai_assistant', cli: [{ command: 'chat', run: chat }] } as Module,
+    ])
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+
+    expect(await run(['node', 'mercato', 'auth', 'setup', '--password', 'hunter2-secret'])).toBe(0)
+    expect(await run(['node', 'mercato', 'ai_assistant', 'chat', '--api-key', 'sk-live-secret'])).toBe(0)
+    expect(await run(['node', 'mercato', 'ai_assistant', 'chat', '--apiKey=sk-inline-secret'])).toBe(0)
+
+    const output = consoleLogSpy.mock.calls.flat().map(String).join('\n')
+    expect(output).not.toContain('hunter2-secret')
+    expect(output).not.toContain('sk-live-secret')
+    expect(output).not.toContain('sk-inline-secret')
+    expect(output).toContain('--password ****')
+    expect(output).toContain('--api-key ****')
+    expect(output).toContain('--apiKey=****')
+    consoleLogSpy.mockRestore()
+  })
+
+  // `--key` is key material in `seeds encrypt|decrypt|load` and a custom-field key in
+  // `entities add-field`, so the redaction has to be per-command rather than global.
+  it('redacts --key only for the commands where it carries key material', async () => {
+    const encrypt = jest.fn().mockResolvedValue(undefined)
+    const addField = jest.fn().mockResolvedValue(undefined)
+    registerCliModules([
+      { id: 'seeds', cli: [{ command: 'encrypt', run: encrypt }] } as Module,
+      { id: 'entities', cli: [{ command: 'add-field', run: addField }] } as Module,
+    ])
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+
+    expect(await run(['node', 'mercato', 'seeds', 'encrypt', '--key', 'base64-seed-key'])).toBe(0)
+    expect(await run(['node', 'mercato', 'entities', 'add-field', '--key', 'priority_level'])).toBe(0)
+
+    const output = consoleLogSpy.mock.calls.flat().map(String).join('\n')
+    expect(output).not.toContain('base64-seed-key')
+    expect(output).toContain('--key ****')
+    expect(output).toContain('--key priority_level')
+    consoleLogSpy.mockRestore()
+  })
+})
+
 describe('--help never triggers side effects (issue #5581)', () => {
   beforeEach(() => {
     jest.restoreAllMocks()

package/src/lib/generators/__tests__/module-package-sources.test.ts

@@ -89,6 +89,8 @@ describe('generateModulePackageSources', () => {
     const pinnedTime = new Date('2020-01-01T00:00:00.000Z')
     fs.utimesSync(outFile, pinnedTime, pinnedTime)
     fs.utimesSync(checksumFile, pinnedTime, pinnedTime)
+    const outputMtimeBefore = fs.statSync(outFile).mtimeMs
+    const checksumMtimeBefore = fs.statSync(checksumFile).mtimeMs
 
     fs.writeFileSync(path.join(packageRoot, 'src', 'unrelated-runtime.ts'), 'export const unrelated = true\n')
     const result = await generateModulePackageSources({ resolver, quiet: true })
@@ -96,8 +98,8 @@ describe('generateModulePackageSources', () => {
     expect(result.filesWritten).toEqual([])
     expect(result.filesUnchanged).toEqual([outFile])
     expect(fs.readFileSync(outFile, 'utf8')).toBe(outputBefore)
-    expect(fs.statSync(outFile).mtimeMs).toBe(pinnedTime.getTime())
-    expect(fs.statSync(checksumFile).mtimeMs).toBe(pinnedTime.getTime())
+    expect(fs.statSync(outFile).mtimeMs).toBe(outputMtimeBefore)
+    expect(fs.statSync(checksumFile).mtimeMs).toBe(checksumMtimeBefore)
     expect(readChecksumRecord(checksumFile)).toEqual(checksumBefore)
   })
 
@@ -123,12 +125,13 @@ describe('generateModulePackageSources', () => {
     const initialStructure = readChecksumRecord(checksumFile)?.structure
     const pinnedTime = new Date('2020-01-01T00:00:00.000Z')
     fs.utimesSync(outFile, pinnedTime, pinnedTime)
+    const outputMtimeBefore = fs.statSync(outFile).mtimeMs
 
     await generateModulePackageSources({ resolver: alternateResolver, quiet: true })
     const alternateStructure = readChecksumRecord(checksumFile)?.structure
     expect(alternateStructure).not.toBe(initialStructure)
     expect(fs.readFileSync(outFile, 'utf8')).toBe(outputBefore)
-    expect(fs.statSync(outFile).mtimeMs).toBe(pinnedTime.getTime())
+    expect(fs.statSync(outFile).mtimeMs).toBe(outputMtimeBefore)
 
     const packageJsonPath = path.join(packageRoot, 'package.json')
     const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8')) as Record<string, unknown>
@@ -140,7 +143,7 @@ describe('generateModulePackageSources', () => {
     expect(result.filesWritten).toEqual([])
     expect(result.filesUnchanged).toEqual([outFile])
     expect(fs.readFileSync(outFile, 'utf8')).toBe(outputBefore)
-    expect(fs.statSync(outFile).mtimeMs).toBe(pinnedTime.getTime())
+    expect(fs.statSync(outFile).mtimeMs).toBe(outputMtimeBefore)
   })
 
   it('keeps official package validation as the source inclusion gate', async () => {

package/src/mercato.ts

@@ -232,6 +232,39 @@ function formatCliFailureMessage(modName: string, cmdName: string, error: unknow
   return fallbackMessage
 }
 
+// Options that carry key material or credentials in every command that accepts them, so the
+// echoed command line must never reproduce their values: argv is world-readable through
+// `ps`/`/proc`, and this line additionally lands in terminal scrollback and CI logs.
+const SENSITIVE_MODULE_CLI_OPTIONS = new Set([
+  '--old-key',
+  '--oldKey',
+  '--password',
+  '--api-key',
+  '--apiKey',
+])
+
+// `--key` is ambiguous: it is a base64 encryption key in `seeds encrypt|decrypt|load` but a
+// custom-field key in `entities add-field`, so it is redacted only where it means a secret.
+const SENSITIVE_MODULE_CLI_OPTIONS_BY_COMMAND = new Map<string, string[]>([
+  ['seeds:encrypt', ['--key']],
+  ['seeds:decrypt', ['--key']],
+  ['seeds:load', ['--key']],
+])
+
+function redactSensitiveModuleCliArgs(args: string[], commandKey: string): string[] {
+  const sensitive = new Set(SENSITIVE_MODULE_CLI_OPTIONS)
+  for (const option of SENSITIVE_MODULE_CLI_OPTIONS_BY_COMMAND.get(commandKey) ?? []) sensitive.add(option)
+  return args.map((argument, index) => {
+    const separatorIndex = argument.indexOf('=')
+    if (separatorIndex > 0) {
+      const option = argument.slice(0, separatorIndex)
+      if (sensitive.has(option)) return `${option}=****`
+    }
+    if (index > 0 && sensitive.has(args[index - 1]!)) return '****'
+    return argument
+  })
+}
+
 function formatInitFailureMessage(error: unknown): string {
   const fallbackMessage = getFallbackErrorMessage(error)
   const databaseIssue = detectDatabaseConnectionIssue(error)
@@ -2810,9 +2843,10 @@ export async function run(argv = process.argv) {
 
   console.log('')
   const started = Date.now()
-  const loggedArgs = modName === 'deploy' && cmdName === 'railway'
+  const commandArgs = modName === 'deploy' && cmdName === 'railway'
     ? (await import('./lib/deploy/railway/options')).redactRailwayCliArgs(rest)
     : rest
+  const loggedArgs = redactSensitiveModuleCliArgs(commandArgs, `${modName}:${cmdName}`)
   console.log(`🚀 Running ${modName}:${cmdName} ${loggedArgs.join(' ')}`)
   try {
     const commandExitCode = await runWithCapturedExitCode(async () => {