@quonfig/cli 0.4.0 → 0.6.0

package/dist/commands/info.js

@@ -1,6 +1,7 @@
 import { Flags } from '@oclif/core';
 import { getEnvironments } from '../api/get-environments.js';
 import { APICommand } from '../index.js';
+import { redactedDisplay, redactedSummary } from '../util/redact.js';
 import autocomplete from '../util/autocomplete.js';
 import { getAppUrl } from '../util/domain-urls.js';
 import isInteractive from '../util/is-interactive.js';
@@ -278,14 +279,17 @@ Related commands:
     formatValue(value, includeQuotes = true) {
         if (!value)
             return 'null';
-        // Handle encrypted values
-        if (value.decryptWith) {
-            return '[encrypted]';
-        }
-        // Handle confidential values
-        if (value.confidential) {
-            return '[confidential]';
-        }
+        // Handle provided values (ENV_VAR). The stored value is the env var NAME,
+        // not a secret, so it is shown even when the value is confidential.
+        // Shape: {type: 'provided', value: {source, lookup}} (qfg-r3a47).
+        const provided = (value.type === 'provided' ? value.value : value.provided);
+        if (provided && typeof provided === 'object') {
+            return `\`${provided.lookup}\` via ENV`;
+        }
+        // Secrets and confidential values show the redacted fingerprint (qfg-r3a47).
+        const redacted = this.redactedValue(value);
+        if (redacted)
+            return redacted;
         // Handle weighted values (A/B testing)
         if (Array.isArray(value.weightedValues)) {
             const weights = value.weightedValues
@@ -297,16 +301,6 @@ Related commands:
             });
             return weights.join(', ');
         }
-        // Handle provided values (ENV_VAR)
-        if (value.provided) {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            let str = `${value.provided.lookup}`;
-            if (value.confidential) {
-                str = `\`${str}\``;
-            }
-            str += ' via ENV';
-            return str;
-        }
         // Handle simple values
         // For config display, extract raw value without quotes
         if (!includeQuotes) {
@@ -336,23 +330,23 @@ Related commands:
         }
         return this.extractSimpleValue(value);
     }
-    // Anything that is not a catch-all targets someone. Both live catch-all
-    // spellings (`criteria: []` and all-ALWAYS_TRUE) are unconditional — one
+    // The redacted display for an encrypted or confidential value, or undefined
+    // for a value that may be shown. An encrypted value hashes its ciphertext,
+    // a confidential one its plaintext, matching the SDK (src/util/redact.ts).
     // shared predicate, qfg-9kr8.
     hasNonTrivialCriteria(rule) {
         return !isCatchAllRule(rule);
     }
-    // A rule value is a "simple scalar" if it carries a literal value that can be
-    // rendered inline next to "[override]". Rollouts ({type: 'weighted_values',
-    // ...}, or anything else where `value.value` is itself an object) cannot —
-    // String(obj) yields "[object Object]" (qfg-5j9i), and a percent split is
-    // never a one-token override anyway.
+    // Anything that is not a catch-all targets someone. Both live catch-all
+    // spellings (`criteria: []` and all-ALWAYS_TRUE) are unconditional — one
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     isSimpleScalarRuleValue(value) {
         if (!value || typeof value !== 'object')
             return false;
         if (value.type === 'weighted_values' || Array.isArray(value.weightedValues))
             return false;
+        if (value.type === 'provided' || value.provided)
+            return true;
         // Old format: {type: 'string'|'bool'|'int'|'double'|'stringList'|'json', value: X}
         if (typeof value.type === 'string' && value.value !== undefined) {
             // A `json` payload may legitimately be an object — render it as JSON, not [object Object].
@@ -368,6 +362,11 @@ Related commands:
             value.stringList !== undefined ||
             value.json !== undefined);
     }
+    // A rule value is a "simple scalar" if it carries a literal value that can be
+    // rendered inline next to "[override]". Rollouts ({type: 'weighted_values',
+    // ...}, or anything else where `value.value` is itself an object) cannot —
+    // String(obj) yields "[object Object]" (qfg-5j9i), and a percent split is
+    // never a one-token override anyway.
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     parseConfig(config, environments, url) {
         const contents = [];
@@ -418,7 +417,11 @@ Related commands:
                     const overrideRule = envConfig.rules.find((r) => this.hasNonTrivialCriteria(r));
                     if (overrideRule && this.isSimpleScalarRuleValue(overrideRule.value)) {
                         const overrideValue = this.formatValue(overrideRule.value, false);
-                        displayValue = `[override] \`${overrideValue}\``;
+                        // A redacted display or `VAR` via ENV is already delimited.
+                        displayValue =
+                            this.redactedValue(overrideRule.value) || overrideValue.startsWith('`')
+                                ? `[override] ${overrideValue}`
+                                : `[override] \`${overrideValue}\``;
                     }
                     else {
                         // Rollouts / weighted_values / anything we can't render inline → defer to the URL (qfg-5j9i).
@@ -426,12 +429,21 @@ Related commands:
                     }
                 }
                 else {
-                    // Only has unconditional rules - show [see rules] to indicate env has custom config
-                    displayValue = '[see rules]';
+                    // Only has unconditional rules - show [see rules] to indicate env has
+                    // custom config. A secret / provided fallback shows its redacted
+                    // fingerprint or env var instead, so a rotation can be confirmed per
+                    // environment without revealing it (qfg-r3a47).
+                    const fallbackRule = envConfig.rules.find((r) => isCatchAllRule(r));
+                    const fallbackValue = fallbackRule?.value;
+                    displayValue =
+                        fallbackValue && (this.redactedValue(fallbackValue) || fallbackValue.type === 'provided')
+                            ? this.formatValue(fallbackValue, false)
+                            : '[see rules]';
                 }
             }
             contents.push(`- ${envConfig.name}: ${displayValue}`);
-            const envUrl = envConfig.id ? `${url}?environment=${envConfig.id}` : `${url}?environment=undefined`;
+            // [Default] has no environment id; its URL is the flag page itself (qfg-r3a47).
+            const envUrl = envConfig.id ? `${url}?environment=${envConfig.id}` : url;
             json[envConfig.name] = {
                 url: envUrl,
             };
@@ -440,7 +452,15 @@ Related commands:
                 if (envConfig.name === 'Default') {
                     // For Default, show the unconditional fallback value
                     const fallbackRule = envConfig.rules.find((r) => isCatchAllRule(r));
-                    const valueToShow = fallbackRule ? fallbackRule.value.value : envConfig.rules[0].value.value;
+                    const shownRule = fallbackRule ?? envConfig.rules[0];
+                    // qfg-38lp: a confidential (unencrypted) value is redacted, as in text mode.
+                    const valueToShow = shownRule.value?.confidential && !shownRule.value?.decryptWith
+                        ? redactedDisplay(redactedSummary({
+                            plaintext: typeof shownRule.value.value === 'string'
+                                ? shownRule.value.value
+                                : JSON.stringify(shownRule.value.value),
+                        }))
+                        : shownRule.value.value;
                     json[envConfig.name].value = valueToShow;
                 }
                 else {
@@ -453,8 +473,11 @@ Related commands:
                         // eslint-disable-next-line @typescript-eslint/no-explicit-any
                         const overrideRule = envConfig.rules.find((r) => this.hasNonTrivialCriteria(r));
                         if (overrideRule) {
-                            // Extract just the value without formatting
-                            const overrideValue = overrideRule.value.value;
+                            // Extract just the value without formatting; a confidential
+                            // override is redacted, never the plaintext (qfg-r3a47).
+                            const overrideValue = overrideRule.value?.confidential && !overrideRule.value?.decryptWith
+                                ? this.redactedValue(overrideRule.value)
+                                : overrideRule.value.value;
                             json[envConfig.name].override = overrideValue;
                         }
                     }
@@ -464,6 +487,20 @@ Related commands:
         this.log(contents.join('\n').trim());
         return json;
     }
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    redactedValue(value) {
+        if (!value || typeof value !== 'object')
+            return undefined;
+        if (value.type === 'provided' || value.provided)
+            return undefined;
+        const raw = value.value ?? value.string;
+        const text = typeof raw === 'string' ? raw : JSON.stringify(raw);
+        if (value.decryptWith)
+            return redactedDisplay(redactedSummary({ ciphertext: text }));
+        if (value.confidential)
+            return redactedDisplay(redactedSummary({ plaintext: text }));
+        return undefined;
+    }
     transformEvaluationStatsForJson(statsPerEnv, environments, startTime, endTime) {
         const envResults = [];
         let grandTotal = 0;

package/dist/commands/set-default.d.ts

@@ -11,6 +11,8 @@ export default class SetDefault extends APICommand {
         secret: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         'secret-key-name': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         confirm: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'value-from-env': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+        'value-stdin': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         confidential: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         'env-var': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         environment: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;

package/dist/commands/set-default.js

@@ -12,7 +12,9 @@ import { makeConfidentialValue } from '../util/encryption.js';
 import isInteractive from '../util/is-interactive.js';
 import nameArg from '../util/name-arg.js';
 import { catchAllRule, countTargetingRules, keptTargetingNote, replacedTargetingNote, seedScopeRules, seededFromDefaultNote, upsertEnvRules, upsertFallbackRule, } from '../util/rules.js';
+import { redactedDisplay, redactedSummary } from '../util/redact.js';
 import secretFlags, { parsedSecretFlags } from '../util/secret-flags.js';
+import { resolveValueSource, valueSourceFlags } from '../util/value-source.js';
 export default class SetDefault extends APICommand {
     static aliases = ['toggle'];
     static args = { ...nameArg };
@@ -31,6 +33,16 @@ rules (they stay in git history).
 To set a percentage rollout (gradual rollout / A/B test / canary deploy) instead:
   qfg set-rollout my.flag --environment production --true-percent 20
 
+Secrets (--secret, or any config whose value is already encrypted) are
+STRING-ONLY. To store a JSON secret, make it a string secret holding the JSON
+and JSON.parse it in your app. The CLI never prints a secret's plaintext; it
+shows a redacted fingerprint like [encrypted *****3fa9c, 51 chars, ends …a1b2].
+Rotate a secret without the value entering argv / shell history:
+  pbpaste | qfg set-default stripe.api-key --environment production --secret --value-stdin --confirm
+  qfg set-default stripe.api-key --environment production --secret --value-from-env STRIPE_API_KEY --confirm
+(--env-var is different: it stores NO value and tells the SDK to read one from
+that env var at runtime.)
+
 To see all current values and rules for a flag:
   qfg info my.flag
 
@@ -41,7 +53,11 @@ To target specific organizations or users, write rules on their KEY
         '<%= config.bin %> <%= command.id %> my.flag.name                                          # prompts for value and env',
         '<%= config.bin %> <%= command.id %> my.flag.name --value=true --environment=staging',
         '<%= config.bin %> <%= command.id %> my.flag.name --value=false --environment=production --replace-targeting   # kill-switch: off for everyone',
-        '<%= config.bin %> <%= command.id %> my.flag.name --value=true --secret',
+        '# Rotate a secret without the value entering argv:',
+        'pbpaste | <%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-stdin --confirm',
+        '<%= config.bin %> <%= command.id %> my.secret --environment=production --secret --value-from-env=MY_SECRET --confirm',
+        '# Write the [Default] rules (inherited by every environment without its own):',
+        '<%= config.bin %> <%= command.id %> my.secret --environment="[Default]" --secret --value-from-env=MY_SECRET --confirm',
         '<%= config.bin %> <%= command.id %> my.config.name --env-var=MY_ENV_VAR_NAME --environment=production',
         '# For a percentage rollout, use set-rollout instead:',
         '<%= config.bin %> set-rollout my.flag.name --environment production --true-percent 20',
@@ -49,16 +65,24 @@ To target specific organizations or users, write rules on their KEY
         '<%= config.bin %> pull && <%= config.bin %> config-schema',
     ];
     static flags = {
-        confidential: Flags.boolean({ default: false, description: 'mark the value as confidential' }),
-        'env-var': Flags.string({ description: 'environment variable to use as default value' }),
-        environment: Flags.string({ description: 'environment to change' }),
+        confidential: Flags.boolean({
+            allowNo: true,
+            description: 'mark the value as confidential. Auto-detected when the key already holds a confidential value; pass --no-confidential to store it in the clear',
+        }),
+        'env-var': Flags.string({
+            description: 'store no value: the SDK reads it from this env var at RUNTIME. To read a value from a local env var NOW, use --value-from-env',
+        }),
+        environment: Flags.string({
+            description: 'environment to change, e.g. production. Use "[Default]" for the default rules that every environment without its own rules inherits',
+        }),
         'replace-targeting': Flags.boolean({
             default: false,
             description: "set the value for EVERYONE: delete this environment's targeting rules instead of keeping them (they stay in git history)",
         }),
-        value: Flags.string({ description: 'new default value' }),
+        value: Flags.string({ description: 'new default value (for secrets prefer --value-stdin / --value-from-env)' }),
+        ...valueSourceFlags,
         ...confirmFlag,
-        ...secretFlags('encrypt the value of this item'),
+        ...secretFlags('encrypt the value of this item (string-only; the CLI never prints the plaintext)'),
     };
     async run() {
         const { args, flags } = await this.parse(SetDefault);
@@ -69,7 +93,12 @@ To target specific organizations or users, write rules on their KEY
         if (flags['env-var'] && secret.selected) {
             return this.err('cannot specify both --env-var and --secret');
         }
-        if (flags.confidential && secret.selected) {
+        // qfg-38lp: --value / --value-stdin / --value-from-env all resolve here.
+        const valueSource = await resolveValueSource(flags);
+        if (!valueSource.ok) {
+            return this.err(valueSource.error ? valueSource.message : 'Value is required');
+        }
+        if (flags.confidential === true && secret.selected) {
             console.warn("Note: --confidential is implied when using --secret, so you don't need to specify both.");
         }
         // Validate required arguments before making API calls
@@ -107,6 +136,13 @@ To target specific organizations or users, write rules on their KEY
             return this.err(`Could not find config named ${key}`);
         }
         this.verboseLog('Selected config:', config);
+        // qfg-38lp: secrets are string-only end to end. Say so here instead of
+        // letting the server answer with a bare 422.
+        if (secret.selected && config.valueType.toLowerCase() !== 'string') {
+            return this.err(`secrets are string-only; ${key} is type ${config.valueType}. ` +
+                'Store JSON (or any structured value) as a string secret instead — e.g. ' +
+                '`qfg create <new-key> --type string --secret --value-stdin < value.json` — and JSON.parse it in your app.', { key, phase: 'validation', valueType: config.valueType });
+        }
         // Fetch the stored document ONCE. It drives encryption auto-detection,
         // the targeting-rule count in the confirmation prompt, the rules the write
         // is applied to, and the commitSha for optimistic concurrency.
@@ -119,18 +155,27 @@ To target specific organizations or users, write rules on their KEY
         }
         const currentConfig = detailRequest.json;
         this.verboseLog('Config details:', currentConfig);
-        // Check if existing config has encrypted values
-        if (!secret.selected && currentConfig.default?.rules) {
-            for (const rule of currentConfig.default.rules) {
-                if (rule.value?.decryptWith) {
-                    this.verboseLog('Auto-detected encryption from existing config');
-                    secret = {
-                        keyName: secret.keyName,
-                        selected: true,
-                    };
-                    break;
-                }
-            }
+        // Auto-detect from EVERY stored rule value, default and per-environment
+        // (qfg-r3a47): an update to an encrypted or confidential key must not
+        // silently store the new value in the clear.
+        const storedValues = [
+            ...(currentConfig.default?.rules ?? []),
+            ...(currentConfig.environments ?? []).flatMap((env) => env.rules ?? []),
+        ].map((rule) => rule.value);
+        if (!secret.selected && storedValues.some((value) => value?.decryptWith)) {
+            this.verboseLog('Auto-detected encryption from existing config');
+            secret = {
+                keyName: secret.keyName,
+                selected: true,
+            };
+        }
+        let confidential = flags.confidential === true;
+        if (flags.confidential === undefined &&
+            !secret.selected &&
+            storedValues.some((value) => value?.confidential && value.type !== 'provided')) {
+            confidential = true;
+            this.logToStderr(`Note: ${key} already holds a confidential value, so the new value is stored confidential too. ` +
+                'Pass --no-confidential to store it in the clear.');
         }
         // Get the environment
         const environment = await getEnvironment({
@@ -157,9 +202,8 @@ To target specific organizations or users, write rules on their KEY
         const keptPhrase = targetingRuleCount > 0 ? ` (${targetingRuleCount} targeting rule${targetingRuleCount === 1 ? '' : 's'} kept)` : '';
         const deletePhrase = targetingRuleCount > 0 ? `, deleting ${targetingRuleCount} targeting rule(s)` : '';
         const confirmMessage = (valuePhrase) => replaceTargeting
-            ? `Confirm: set ${key} in ${environment.name} to ${valuePhrase} for EVERYONE${deletePhrase}? yes/no`
-            : `Confirm: set the fallback for ${key} in ${environment.name} to ${valuePhrase}?${keptPhrase} yes/no`;
-        const { confidential } = flags;
+            ? `Confirm: set ${key} in ${environment.name} to ${valuePhrase} for EVERYONE${deletePhrase}?`
+            : `Confirm: set the fallback for ${key} in ${environment.name} to ${valuePhrase}?${keptPhrase}`;
         // Get the value
         if (flags['env-var']) {
             if (!(await getConfirmation({ flags, message: confirmMessage(`be provided by \`${flags['env-var']}\``) }))) {
@@ -179,18 +223,23 @@ To target specific organizations or users, write rules on their KEY
                 targetingRuleCount,
             });
         }
-        let value = flags.value;
+        let value = valueSource.value;
+        // A secret / confidential value is masked while typed and never shown.
+        const hideValue = secret.selected || confidential;
         if (!value && isInteractive(flags)) {
             value = await getString({
                 allowBlank: true,
-                message: 'Default value',
+                mask: hideValue,
+                message: hideValue ? 'Secret value (input is masked)' : 'Default value',
             });
         }
         if (value === undefined) {
             return this.err('Value is required');
         }
-        const secretMaybe = secret.selected ? ' (encrypted)' : '';
-        if (!(await getConfirmation({ flags, message: confirmMessage(`\`${value}\`${secretMaybe}`) }))) {
+        const promptPhrase = hideValue
+            ? redactedDisplay(redactedSummary({ encrypted: secret.selected, plaintext: value }))
+            : `\`${value}\``;
+        if (!(await getConfirmation({ flags, message: confirmMessage(promptPhrase) }))) {
             return;
         }
         return this.submitChange({
@@ -225,8 +274,17 @@ To target specific organizations or users, write rules on their KEY
         // "be provided by `MY_ENV_VAR`" — plus any (encrypted)/(confidential) note.
         let valuePhrase;
         let modifiers = '';
+        // Set whenever the value must not be printed (secret or confidential), qfg-38lp.
+        let redacted;
+        // How the value may appear in an error message.
+        let shownValue = value;
         if (envVar === undefined) {
             valuePhrase = `\`${value}\``;
+            if (confidential && !secret.selected) {
+                redacted = redactedSummary({ plaintext: value });
+                valuePhrase = redactedDisplay(redacted);
+                shownValue = valuePhrase;
+            }
             if (secret.selected) {
                 // Handle encrypted values using shared utility
                 const encryptedValueResult = await makeConfidentialValue(this, value, secret, environment.name);
@@ -234,7 +292,9 @@ To target specific organizations or users, write rules on their KEY
                     return this.err(encryptedValueResult.message || 'Failed to encrypt value');
                 }
                 configValue = mapConfigValueToDto(encryptedValueResult.value, ConfigValueType.String);
-                modifiers += ' (encrypted)';
+                redacted = redactedSummary({ ciphertext: String(encryptedValueResult.value.value), plaintext: value });
+                valuePhrase = redactedDisplay(redacted);
+                shownValue = valuePhrase;
             }
             else {
                 // Parse the value based on type and build value object
@@ -249,7 +309,7 @@ To target specific organizations or users, write rules on their KEY
                     case 'bool': {
                         const lowerValue = value.toLowerCase();
                         if (lowerValue !== 'true' && lowerValue !== 'false') {
-                            return this.err(`'${value}' is not a valid value for ${key}`);
+                            return this.err(`'${shownValue}' is not a valid value for ${key}`);
                         }
                         variantValue = lowerValue === 'true';
                         break;
@@ -258,14 +318,14 @@ To target specific organizations or users, write rules on their KEY
                         // Shared strict grammar with qfg create (qfg-2agi.23).
                         variantValue = parseIntValue(value);
                         if (variantValue === undefined) {
-                            return this.err(`Invalid default value for int: ${value}`);
+                            return this.err(`Invalid default value for int: ${shownValue}`);
                         }
                         break;
                     }
                     case 'double': {
                         variantValue = parseDoubleValue(value);
                         if (variantValue === undefined) {
-                            return this.err(`Invalid default value for double: ${value}`);
+                            return this.err(`Invalid default value for double: ${shownValue}`);
                         }
                         break;
                     }
@@ -274,7 +334,7 @@ To target specific organizations or users, write rules on their KEY
                             variantValue = JSON.parse(value);
                         }
                         catch {
-                            return this.err(`Invalid JSON value: ${value}`);
+                            return this.err(`Invalid JSON value: ${shownValue}`);
                         }
                         break;
                     }
@@ -285,7 +345,7 @@ To target specific organizations or users, write rules on their KEY
                     case 'duration': {
                         // Stored verbatim as the ISO 8601 string; no conversions (qfg-2agi.3).
                         if (!isValidIsoDuration(value)) {
-                            return this.err(`Invalid value for duration: ${value}. ${DURATION_FORMAT_HINT}`);
+                            return this.err(`Invalid value for duration: ${shownValue}. ${DURATION_FORMAT_HINT}`);
                         }
                         break;
                     }
@@ -305,7 +365,9 @@ To target specific organizations or users, write rules on their KEY
         }
         if (confidential && !secret.selected) {
             configValue.confidential = true;
-            modifiers += ' (confidential)';
+            // the redacted display already says "confidential"
+            if (!redacted)
+                modifiers += ' (confidential)';
         }
         // Surgical by default (qfg-qjdm): the fallback rule's value is replaced
         // in place and every targeting rule around it is kept. --replace-targeting
@@ -374,13 +436,14 @@ To target specific organizations or users, write rules on their KEY
                 },
                 key,
                 success: true,
-                value,
+                // qfg-38lp: a secret/confidential value is reported redacted, never verbatim.
+                value: redacted ?? value,
                 ...counts,
             };
         }
         this.verboseLog(request.error);
         const errMsg = request.status === 400
-            ? `Failed to change default: ${request.status} -- is ${value || envVar} a valid value?`
+            ? `Failed to change default: ${request.status} -- is ${shownValue || envVar} a valid value?`
             : `Failed to change default: ${request.status}`;
         return this.err(errMsg, { key, serverError: request.error });
     }

package/dist/commands/set-rollout.js

@@ -182,8 +182,8 @@ To inspect the current rollout:
         const keptPhrase = targetingRuleCount > 0 ? ` (${targetingRuleCount} targeting rule${targetingRuleCount === 1 ? '' : 's'} kept)` : '';
         const deletePhrase = targetingRuleCount > 0 ? `, deleting ${targetingRuleCount} targeting rule(s)` : '';
         const message = replaceTargeting
-            ? `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}] for EVERYONE${deletePhrase}? yes/no`
-            : `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}]?${keptPhrase} yes/no`;
+            ? `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}] for EVERYONE${deletePhrase}?`
+            : `Confirm: set rollout for ${key} in ${environment.name} to [${rolloutDescription}]?${keptPhrase}`;
         if (!(await getConfirmation({ flags, message }))) {
             return;
         }

package/dist/index.d.ts

@@ -50,6 +50,12 @@ export declare abstract class BaseCommand extends Command {
     protected toErrorJson(err: unknown): {
         error: JsonObj;
     };
+    /**
+     * qfg-38lp: a value typed as a stray positional (`qfg set-default KEY <secret>`)
+     * comes back from oclif as `Unexpected argument: <secret>`. On commands that
+     * take a value, hide the offending tokens instead of echoing them.
+     */
+    private redactValueParseError;
 }
 export declare abstract class APICommand extends BaseCommand {
     static baseFlags: {

package/dist/index.js

@@ -1,6 +1,7 @@
 export { run } from '@oclif/core';
 import { Command, Errors, Flags } from '@oclif/core';
 import rawGetClient, { unwrapRequest } from './util/get-client.js';
+import { scrubForLog } from './util/redact.js';
 const globalFlags = {
     interactive: Flags.boolean({
         allowNo: true,
@@ -109,11 +110,15 @@ export class BaseCommand extends Command {
     verboseLog = (category, message) => {
         if (!this.isVerbose)
             return;
+        // qfg-38lp: verbose output (request bodies, API responses, stored config
+        // documents) must never carry a confidential plaintext.
         if (message) {
-            this.logToStderr(`[${category}] ${typeof message === 'string' ? message : JSON.stringify(message)}`);
+            const scrubbed = scrubForLog(message);
+            this.logToStderr(`[${category}] ${typeof scrubbed === 'string' ? scrubbed : JSON.stringify(scrubbed)}`);
         }
         else {
-            this.logToStderr(typeof category === 'string' ? category : JSON.stringify(category));
+            const scrubbed = scrubForLog(category);
+            this.logToStderr(typeof scrubbed === 'string' ? scrubbed : JSON.stringify(scrubbed));
         }
     };
     async catch(err) {
@@ -127,6 +132,7 @@ export class BaseCommand extends Command {
         if (err instanceof Errors.ExitError || err.code === 'EEXIT') {
             throw err;
         }
+        this.redactValueParseError(err);
         // qfg-hzmb: `this.log()` is a documented no-op whenever jsonEnabled(), so
         // this override used to print NOTHING for a failing `--json` run — empty
         // stdout was indistinguishable from an empty success. Emit the structured
@@ -162,9 +168,12 @@ export class BaseCommand extends Command {
         // An Error's own *enumerable* properties are the structured payload handed
         // to `err()` — keep those. `oclif` is internal bookkeeping (surfaced as
         // `exitCode`), and `stack` is dropped on purpose (oclif.stacktrace=false).
+        // `parse` is oclif's parse-error context: hundreds of KB of config dump
+        // that includes the raw argv, so a `--value=<secret>` landed on stdout
+        // (qfg-38lp). The message already names the bad flag; drop the dump.
         const payload = {};
         for (const [key, value] of Object.entries(err)) {
-            if (key !== 'oclif' && key !== 'stack')
+            if (key !== 'oclif' && key !== 'stack' && key !== 'parse')
                 payload[key] = value;
         }
         const { code } = err;
@@ -177,6 +186,29 @@ export class BaseCommand extends Command {
             },
         };
     }
+    /**
+     * qfg-38lp: a value typed as a stray positional (`qfg set-default KEY <secret>`)
+     * comes back from oclif as `Unexpected argument: <secret>`. On commands that
+     * take a value, hide the offending tokens instead of echoing them.
+     */
+    redactValueParseError(err) {
+        const flags = this.ctor.flags ?? {};
+        if (!('value' in flags))
+            return;
+        if (err.message.startsWith('Unexpected argument')) {
+            const count = Array.isArray(err.args) ? err.args.length : 1;
+            err.message =
+                `Unexpected argument${count === 1 ? '' : 's'} (${count} hidden, in case ${count === 1 ? 'it is' : 'they are'} a value). ` +
+                    'Pass a value with --value, --value-stdin or --value-from-env=VAR, not as a positional argument.';
+            delete err.args;
+            return;
+        }
+        if (err.message.startsWith('Nonexistent flag')) {
+            err.message = err.message.replaceAll(/=\S+/g, '=<hidden>');
+            if (Array.isArray(err.flags))
+                err.flags = err.flags.map((f) => String(f).replace(/=.*$/, '=<hidden>'));
+        }
+    }
 }
 export class APICommand extends BaseCommand {
     static baseFlags = {

package/dist/interactive-prompt.d.ts

@@ -1,2 +1,20 @@
 import { Config } from '@oclif/core/lib/interfaces/index.js';
+import Create from './commands/create.js';
+import GenerateNewHexKey from './commands/generate-new-hex-key.js';
+import Get from './commands/get.js';
+import Info from './commands/info.js';
+import List from './commands/list.js';
+import Override from './commands/override.js';
+import SetDefault from './commands/set-default.js';
+type SuggestedCommand = {
+    command: typeof Create | typeof GenerateNewHexKey | typeof Get | typeof Info | typeof List | typeof Override | typeof SetDefault;
+    description: string;
+    displayCommandName: string;
+    id: string;
+    implicitFlags: string[];
+};
+declare const commands: SuggestedCommand[];
+type AvailableCommand = (typeof commands)[number];
+export declare const getFlags: (flags: AvailableCommand["command"]["flags"], commandId: string, implicitFlags: string[], command: SuggestedCommand["command"]) => Promise<string[]>;
 export declare const interactivePrompt: (config: Config) => Promise<void>;
+export {};

package/dist/interactive-prompt.js

@@ -94,14 +94,23 @@ const getArgs = async (args, commandId, command) => {
     // Filter out undefined values (OAuth commands handle their own name prompting)
     return values.filter((v) => v !== undefined);
 };
-const getFlags = async (flags, commandId, implicitFlags, command) => {
+export const getFlags = async (flags, commandId, implicitFlags, command) => {
     if (!flags && implicitFlags.length === 0) {
         return [];
     }
     const inputs = [];
     const promiseInputs = [];
+    // qfg-38lp: secrets are string-only, so "create --secret" never asks for a type.
+    const forceStringType = commandId === 'create' && implicitFlags.includes('secret');
     for (const [key, arg] of Object.entries(flags)) {
-        if (arg.required || implicitFlags.includes(key)) {
+        if (forceStringType && key === 'type') {
+            inputs.push('--type=string');
+            continue;
+        }
+        // `create --type` is optional on the command line (--secret implies string)
+        // but the interactive create still asks for it.
+        const promptForType = commandId === 'create' && key === 'type';
+        if (arg.required || promptForType || implicitFlags.includes(key)) {
             if (arg.type === 'boolean') {
                 inputs.push(`--${key}`);
             }

package/dist/migrate/quonfig-target/operators.js

@@ -9,8 +9,10 @@
  * provider extends the table rather than reinventing the dispatch.
  */
 /**
- * Operators that have a direct negated form in Quonfig. `negate: true` simply
- * selects the negated operator — semantics-preserving, always converted.
+ * Operators that have a direct negated form in Quonfig. `negate: true` selects
+ * the negated operator and always converts. LD never matches a context missing
+ * the attribute, so `clauseToCriteria` (ruleset.ts) ANDs an IS_PRESENT guard in
+ * front of each negated property operator to keep that (qfg-goi1.5.10).
  */
 const NEGATABLE = {
     contains: { negated: 'PROP_DOES_NOT_CONTAIN_ONE_OF', plain: 'PROP_CONTAINS_ONE_OF' },