@tikoci/centrs 0.1.9-next.0 → 0.1.9-next.23

package/src/cli/common.ts

@@ -6,7 +6,51 @@
  * together.
  */
 
-import { CentrsError } from "../errors.ts";
+import type { Tip, Warning } from "../core/envelope.ts";
+import { CentrsError, terminalSafeLine } from "../errors.ts";
+import { redactTargetInput } from "../resolver/target.ts";
+import { formatTipsText } from "./missing-target.ts";
+
+/**
+ * Warnings that a single-target text-mode CLI leaves out (#470).
+ * `transport/provider-trust` rides every quickchr run over TLS or SSH, so
+ * printing it would be noise. `--json` keeps every warning.
+ */
+const TEXT_QUIET_WARNING_CODES: readonly string[] = [
+	"transport/provider-trust",
+];
+
+/**
+ * One `warning [<code>]: <message>` line per envelope warning, in the same form
+ * as fan-out text, minus {@link TEXT_QUIET_WARNING_CODES}.
+ */
+export function textWarningLines(warnings: readonly Warning[]): string[] {
+	return warnings
+		.filter((warning) => !TEXT_QUIET_WARNING_CODES.includes(warning.code))
+		.map((warning) =>
+			terminalSafeLine(`warning [${warning.code}]: ${warning.message}`),
+		);
+}
+
+/**
+ * #470: in text mode a single-target command's stdout is its data and nothing
+ * else. The notes around the data go to stderr: the `--verbose` header before
+ * it ({@link printTextHeader}), then warnings and tips after it. This applies
+ * on success and on failure, so a write whose outcome is unknown still says so.
+ */
+export function printTextNotes(envelope: {
+	warnings: readonly Warning[];
+	tips: readonly Tip[];
+}): void {
+	for (const line of textWarningLines(envelope.warnings)) console.error(line);
+	const tips = formatTipsText(envelope.tips);
+	if (tips) console.error(tips);
+}
+
+/** The `--verbose` header of a text-mode result, on stderr (#470). */
+export function printTextHeader(lines: readonly string[]): void {
+	if (lines.length > 0) console.error(lines.join("\n"));
+}
 
 export interface CliCommandOption {
 	flag: string;
@@ -106,6 +150,141 @@ export function unknownFlagError(
 	});
 }
 
+/** Single-quote a token for a shell line a user can copy, unless it is plain. */
+function shellQuote(token: string): string {
+	return /^[\w/:=.,@%+-]+$/.test(token)
+		? token
+		: `'${token.replaceAll("'", `'\\''`)}'`;
+}
+
+/**
+ * A centrs flag written after a bare `--` (#459).
+ *
+ * `--` makes every later token RouterOS input, so a trailing `--json` (the
+ * habitual position: `execute r1 -- '/cmd' --json`) went to the router and
+ * failed there as `unknown-attribute`. The RouterOS command is one quoted
+ * argument in every documented form, so a later token that is exactly one of
+ * this command's LONG flags (or its `--flag=value` spelling) is this mistake.
+ * Short aliases (`-u`, `-h`) are left alone: a lone `-x` is plausible
+ * RouterOS input, `--json` is not. A command that really needs such a token
+ * can carry it inside the quoted command.
+ *
+ * Throws `usage/flag-after-separator` with the command line rewritten with the
+ * flags (and their values) moved before `--`. Password values are never
+ * echoed. A no-op when there is no `--`.
+ */
+export function rejectFlagsAfterSeparator(
+	command: string,
+	args: readonly string[],
+	options: readonly CliCommandOption[],
+): void {
+	const optionByFlag = new Map<string, CliCommandOption>();
+	for (const option of options) {
+		for (const token of option.flag.split("/")) {
+			const trimmed = token.trim();
+			if (trimmed.startsWith("-") && trimmed !== "--") {
+				optionByFlag.set(trimmed, option);
+			}
+		}
+	}
+	let separator = -1;
+	for (let index = 0; index < args.length; index += 1) {
+		const token = args[index] ?? "";
+		if (token === "--") {
+			separator = index;
+			break;
+		}
+		// A flag's value may itself be `--`; only the parser's separator counts.
+		if (optionByFlag.get(token)?.valueName !== undefined) index += 1;
+	}
+	if (separator === -1) return;
+	const secret = (flag: string) =>
+		flag.startsWith("-") && flag.includes("password");
+	const before: string[] = [];
+	for (let index = 0; index < separator; index += 1) {
+		const token = args[index] ?? "";
+		const [name = ""] = token.split("=");
+		const equal = token.indexOf("=");
+		if (equal >= 0 && optionByFlag.get(name)?.valueName !== undefined) {
+			before.push(
+				name,
+				secret(name) ? "<password>" : redactTargetInput(token.slice(equal + 1)),
+			);
+			continue;
+		}
+		if (equal >= 0 && secret(name)) {
+			before.push(`${name}=<password>`);
+			continue;
+		}
+		before.push(redactTargetInput(token));
+		if (optionByFlag.get(name)?.valueName !== undefined || secret(name)) {
+			const value = args[index + 1];
+			if (index + 1 < separator && value !== undefined) {
+				before.push(secret(name) ? "<password>" : redactTargetInput(value));
+				index += 1;
+			}
+		}
+	}
+	const unsupportedInlineBooleans: string[] = [];
+	const moved: string[] = [];
+	const kept: string[] = [];
+	const flags: string[] = [];
+	const after = args.slice(separator + 1);
+	for (let index = 0; index < after.length; index += 1) {
+		const token = after[index] ?? "";
+		const [name = "", ...valueParts] = token.split("=");
+		const option = name.startsWith("--") ? optionByFlag.get(name) : undefined;
+		if (option === undefined) {
+			kept.push(token);
+			continue;
+		}
+		flags.push(name);
+		// The parsers take a value flag's value as the next token (`--timeout 30s`,
+		// never `--timeout=30s`), so the fixed line splits it; only a boolean's
+		// supported `=` form (`--validate=no`) is kept as typed.
+		if (valueParts.length > 0) {
+			if (option.valueName === undefined) {
+				if (command !== "execute" || name !== "--validate") {
+					unsupportedInlineBooleans.push(name);
+				}
+				moved.push(token);
+			} else {
+				moved.push(name, secret(name) ? "<password>" : valueParts.join("="));
+			}
+			continue;
+		}
+		moved.push(name);
+		const value = after[index + 1];
+		if (option.valueName !== undefined && value !== undefined) {
+			moved.push(secret(name) ? "<password>" : value);
+			index += 1;
+		}
+	}
+	if (flags.length === 0) return;
+	// A moved --host value needs the same redaction as a positional target.
+	// Keep the RouterOS command itself verbatim; it is not a target.
+	const fixed = [
+		"centrs",
+		command,
+		...before,
+		...moved.map((token) => redactTargetInput(token)),
+		"--",
+		...kept,
+	]
+		.map(shellQuote)
+		.join(" ");
+	const list = flags.map((flag) => `\`${flag}\``).join(", ");
+	throw new CentrsError({
+		code: "usage/flag-after-separator",
+		summary: `${list} ${flags.length === 1 ? "comes" : "come"} after \`--\`, so ${flags.length === 1 ? "it" : "they"} would be sent to RouterOS as part of the command.`,
+		remediation:
+			unsupportedInlineBooleans.length > 0
+				? `Put centrs flags before \`--\`. These flags accept no value: ${unsupportedInlineBooleans.map((flag) => `\`${flag}\``).join(", ")}. Use a bare flag to enable it, or omit it to keep the default.`
+				: `Put centrs flags before \`--\`: \`${fixed}\``,
+		context: { flags },
+	});
+}
+
 export function renderCommandHelp(
 	describe: string,
 	command: CliCommandMetadata,

package/src/cli/devices.ts

@@ -746,10 +746,8 @@ export async function runDevicesCli(args: readonly string[]): Promise<number> {
 			centrsError,
 		);
 		if (format === "json" || format === "yaml") {
-			// codeql[js/clear-text-logging] password reaches here only as SettingSource provenance ({kind,key}), never the value — see CommonSettingsMeta.password in src/core/envelope.ts.
 			console.error(renderDevicesEnvelope(envelope, format));
 		} else {
-			// codeql[js/clear-text-logging] password reaches here only as SettingSource provenance ({kind,key}), never the value — see CommonSettingsMeta.password in src/core/envelope.ts.
 			console.error(formatCentrsErrorText(centrsError));
 		}
 		return 1;

package/src/cli/discover.ts

@@ -207,7 +207,6 @@ export async function runDiscoverCli(args: readonly string[]): Promise<number> {
 			remediation:
 				"Use `centrs discover --help` to inspect the supported flags.",
 		});
-		// codeql[js/clear-text-logging] password reaches here only as SettingSource provenance ({kind,key}), never the value — see CommonSettingsMeta.password in src/core/envelope.ts.
 		console.error(formatCentrsErrorText(centrsError));
 		return 1;
 	}

package/src/cli/execute.ts

@@ -10,6 +10,7 @@ import {
 	type ExecuteRequest,
 	executeEnvelope,
 	executeOutputFormats,
+	executeVerboseLines,
 	renderExecuteEnvelope,
 } from "../execute.ts";
 import {
@@ -27,6 +28,9 @@ import { assertNoQuickchrOverrideConflict } from "../resolver/index.ts";
 import {
 	type CliCommandMetadata,
 	expectValue,
+	printTextHeader,
+	printTextNotes,
+	rejectFlagsAfterSeparator,
 	renderCommandHelp,
 	unknownFlagError,
 } from "./common.ts";
@@ -155,12 +159,12 @@ export const executeCommand: CliCommandMetadata = {
 		},
 		{
 			flag: "--verbose",
-			description: "Include additional context in text output.",
+			description: "Include additional context in text output, on stderr.",
 		},
 		{
 			flag: "--",
 			description:
-				"End centrs option parsing: every following token is the literal RouterOS command, even flag-shaped ones (e.g. `-- /interface print where disabled=yes`).",
+				"End centrs option parsing: every following token is the literal RouterOS command (e.g. `-- /interface print where disabled=yes`). Put centrs flags before it; one of execute's own long flags after it is refused as `usage/flag-after-separator`.",
 		},
 	],
 };
@@ -175,6 +179,7 @@ interface ExecuteCliArgs extends ExecuteRequest {
 }
 
 export function parseExecuteCliArgs(args: readonly string[]): ExecuteCliArgs {
+	rejectFlagsAfterSeparator("execute", args, executeCommand.options);
 	const parsed: ExecuteCliArgs = { command: "" };
 	const selectionFlags = emptySelectionFlags();
 	const positional: string[] = [];
@@ -399,15 +404,20 @@ export async function runExecuteCli(args: readonly string[]): Promise<number> {
 			)?.request?.format ??
 			parsed.format ??
 			"text";
+		const text = resolvedFormat === "text";
+		if (text && parsed.verbose) {
+			printTextHeader(executeVerboseLines(envelope));
+		}
 		const rendered = renderExecuteEnvelope(envelope, resolvedFormat, {
 			verbose: parsed.verbose,
 		});
 		if (envelope.ok) {
 			console.log(rendered);
-			return 0;
+		} else {
+			console.error(rendered);
 		}
-		console.error(rendered);
-		return 1;
+		if (text) printTextNotes(envelope);
+		return envelope.ok ? 0 : 1;
 	} catch (error) {
 		// Parse/usage errors land here too: surface them through the same typed
 		// envelope as every other runner (no raw message, no exit code 2).
@@ -424,14 +434,12 @@ export async function runExecuteCli(args: readonly string[]): Promise<number> {
 				tips,
 			);
 			console.error(
-				// codeql[js/clear-text-logging] No secret reaches this sink. The tainted 'password' flows in only as provenance (SettingSource={kind,key}), never the value — see CommonSettingsMeta.password in src/core/envelope.ts.
 				renderExecuteEnvelope(envelope, format, {
 					verbose: parsed?.verbose ?? false,
 				}),
 			);
 		} else {
 			console.error(
-				// codeql[js/clear-text-logging] Same false-positive pattern: password parsed from args never reaches error.message in the text-format catch path.
 				formatCentrsErrorText(
 					asCentrsError(error, {
 						code: "input/invalid-command",
@@ -477,7 +485,6 @@ async function runExecuteFanoutCli(
 	} catch (error) {
 		const envelope = buildExecuteFanoutErrorEnvelope(parsed, error);
 		console.error(
-			// codeql[js/clear-text-logging] Twin of #80/#81/#83/#84. No secret logged: buildExecuteFanoutErrorEnvelope meta is {target:{},via,settings:{}}; CodeQL taints the whole request object but the builder projects the password away.
 			renderExecuteFanoutEnvelope(envelope, format, {
 				verbose: parsed.verbose ?? false,
 			}),
@@ -581,6 +588,12 @@ async function runExecuteCmrCli(
 	}
 }
 
+/**
+ * The output format for an error that may have struck before parsing finished.
+ * Reads the argv the way the parser does: only tokens before `--` (after it is
+ * RouterOS input), last format flag wins, and a value-taking flag's value is
+ * skipped, so `--format yaml -- '/x' --json` renders YAML.
+ */
 function inferExecuteFormat(
 	args: readonly string[],
 	parsed?: ExecuteCliArgs,
@@ -588,22 +601,33 @@ function inferExecuteFormat(
 	if (parsed?.format) {
 		return parsed.format;
 	}
-	if (args.includes("--json")) {
-		return "json";
-	}
-	const index = args.indexOf("--format");
-	if (index >= 0) {
-		const value = args[index + 1];
-		if (
-			value !== undefined &&
-			executeOutputFormats.includes(value as ExecuteOutputFormat)
-		) {
-			return value as ExecuteOutputFormat;
+	let format: ExecuteOutputFormat = "text";
+	for (let index = 0; index < args.length; index += 1) {
+		const arg = args[index];
+		if (arg === undefined || arg === "--") break;
+		if (arg === "--json") {
+			format = "json";
+		} else if (arg === "--format") {
+			const value = args[index + 1];
+			if (executeOutputFormats.includes(value as ExecuteOutputFormat)) {
+				format = value as ExecuteOutputFormat;
+			}
+			index += 1;
+		} else if (EXECUTE_VALUE_FLAGS.has(arg)) {
+			index += 1;
 		}
 	}
-	return "text";
+	return format;
 }
 
+const EXECUTE_VALUE_FLAGS: ReadonlySet<string> = new Set(
+	executeCommand.options.flatMap((option) =>
+		option.valueName === undefined
+			? []
+			: option.flag.split("/").map((token) => token.trim()),
+	),
+);
+
 function parseIntegerFlag(value: string, flag: string): number {
 	const parsed = Number.parseInt(value, 10);
 	if (!Number.isInteger(parsed)) {

package/src/cli/explain.ts

@@ -51,6 +51,7 @@ import type { ResolvedSetting } from "../resolver/settings.ts";
 import {
 	type CliCommandMetadata,
 	expectValue,
+	rejectFlagsAfterSeparator,
 	renderCommandHelp,
 	unknownFlagError,
 } from "./common.ts";
@@ -118,6 +119,7 @@ export interface ExplainCliArgs {
 }
 
 export function parseExplainCliArgs(args: readonly string[]): ExplainCliArgs {
+	rejectFlagsAfterSeparator("explain", args, explainCliCommand.options);
 	const parsed: ExplainCliArgs = {
 		positionals: [],
 		failOn: "error",

package/src/cli/mcp.ts

@@ -101,7 +101,6 @@ export async function runMcpCli(args: readonly string[]): Promise<number> {
 		return 0;
 	} catch (error) {
 		console.error(
-			// codeql[js/clear-text-logging] password reaches here only as SettingSource provenance ({kind,key}), never the value — see CommonSettingsMeta.password in src/core/envelope.ts.
 			formatCentrsErrorText(
 				asCentrsError(error, {
 					code: "internal/mcp-start",

package/src/cli/retrieve.ts

@@ -15,17 +15,20 @@ import {
 	buildRetrieveFanoutErrorEnvelope,
 	describeCentrs,
 	fanoutExitCode,
+	isStreamDataLine,
 	type ResolvedRetrieveRequest,
 	type RetrieveOutputFormat,
 	type RetrieveRequest,
 	renderRetrieveEnvelope,
 	renderRetrieveFanoutEnvelope,
 	renderRetrieveStreamLine,
+	resolveRetrieveOutputFormat,
 	retrieve,
 	retrieveFanout,
 	retrieveFollow,
 	retrieveOutputFormats,
 	retrieveSample,
+	retrieveVerboseLines,
 	retrieveWait,
 	type ValidationTrace,
 	validateRetrieveRequestShape,
@@ -34,6 +37,8 @@ import { assertNoQuickchrOverrideConflict } from "../resolver/index.ts";
 import {
 	type CliCommandMetadata,
 	expectValue,
+	printTextHeader,
+	printTextNotes,
 	renderCommandHelp,
 	unknownFlagError,
 } from "./common.ts";
@@ -125,13 +130,13 @@ export const retrieveCommand: CliCommandMetadata = {
 		{
 			flag: "--follow",
 			description:
-				"Keep the menu's rows current over native-api `listen`: snapshot frames, a `synced` line, then a line per change, then a summary (NDJSON for json/yaml/ndjson). Single target, list menus whose print takes follow-only.",
+				"Keep the menu's rows current over native-api `listen`: a `started` line, snapshot frames, a `synced` line, then a line per change, then a summary (NDJSON for json/yaml/ndjson). Single target, list menus whose print takes follow-only.",
 		},
 		{
 			flag: "--sample",
 			valueName: "<interval>",
 			description:
-				"Read the menu again every interval (with a unit, e.g. `5s`): one line per complete read, then a summary. With --wait, sets polling cadence and returns one final envelope. Sees counters and state listen never reports. Single target; rest-api or native-api.",
+				"Read the menu again every interval (with a unit, e.g. `5s`): a `started` line, one line per complete read, then a summary. With --wait, sets polling cadence and returns one final envelope. Sees counters and state listen never reports. Single target; rest-api or native-api.",
 		},
 		{
 			flag: "--wait",
@@ -206,7 +211,7 @@ export const retrieveCommand: CliCommandMetadata = {
 		},
 		{
 			flag: "--verbose",
-			description: "Show resolved setting sources in text output.",
+			description: "Show resolved setting sources in text output, on stderr.",
 		},
 	],
 };
@@ -283,6 +288,10 @@ export async function runRetrieveCli(args: readonly string[]): Promise<number> {
 					request?: { format?: RetrieveOutputFormat };
 				}
 			)?.request?.format ?? "text";
+		const text = resolvedFormat === "text";
+		if (text && request.verbose) {
+			printTextHeader(retrieveVerboseLines(envelope));
+		}
 		console.log(
 			renderRetrieveEnvelope(
 				envelope as Parameters<typeof renderRetrieveEnvelope>[0],
@@ -290,6 +299,7 @@ export async function runRetrieveCli(args: readonly string[]): Promise<number> {
 				{ verbose: request.verbose },
 			),
 		);
+		if (text) printTextNotes(envelope);
 		return 0;
 	} catch (error) {
 		const format = inferRequestedFormat(args, request);
@@ -313,14 +323,12 @@ export async function runRetrieveCli(args: readonly string[]): Promise<number> {
 				tips,
 			);
 			console.error(
-				// codeql[js/clear-text-logging] Twin of the established redacted-request dismissals: error builders carry only targetInput (host)+via (protocol); the raw password never reaches this render.
 				renderRetrieveEnvelope(envelope, format, {
 					verbose: request?.verbose ?? false,
 				}),
 			);
 		} else {
 			console.error(
-				// codeql[js/clear-text-logging] Same false-positive pattern: password parsed from args never reaches error.message in the text-format catch path.
 				formatCentrsErrorText(
 					asCentrsError(error, {
 						code: "input/invalid-command",
@@ -340,14 +348,21 @@ export async function runRetrieveCli(args: readonly string[]): Promise<number> {
 
 /**
  * Every `--follow`/`--sample` envelope goes to stdout, one per line, errors
- * included; any failure sets exit 1, even after successful lines. Ctrl-C asks
- * for a bounded stop that still ends with a summary.
+ * included; any failure sets exit 1, even after successful lines. In text,
+ * stdout is data (#470, #473): only `frame`/`sample` rows go there, and the
+ * status lines, tips, warnings and errors go to stderr. Ctrl-C asks for a
+ * bounded stop that still ends with a summary.
  */
 async function runRetrieveStreamCli(
 	request: RetrieveCliArgs,
 	args: readonly string[],
 ): Promise<number> {
-	const format = inferRequestedFormat(args, request);
+	// Resolved once, up front: a config-file `CENTRS_FORMAT` is not in `args`,
+	// and follow frame lines carry no request (#462). An invalid format is
+	// reported by the stream's own error line, rendered as the args ask.
+	const format = await resolveRetrieveOutputFormat(request, Bun.env).catch(() =>
+		inferRequestedFormat(args, request),
+	);
 	const controller = new AbortController();
 	const onSigint = (): void => controller.abort();
 	process.on("SIGINT", onSigint);
@@ -357,9 +372,14 @@ async function runRetrieveStreamCli(
 		for await (const envelope of stream(request, Bun.env, {
 			signal: controller.signal,
 		})) {
-			// A config-file `CENTRS_FORMAT` is known only after resolution.
-			const resolvedFormat = envelope.meta.operation?.request.format ?? format;
-			console.log(renderRetrieveStreamLine(envelope, resolvedFormat));
+			const line = renderRetrieveStreamLine(envelope, format);
+			if (format !== "text" || isStreamDataLine(envelope)) {
+				console.log(line);
+			} else {
+				// `started` renders its own tips; the summary repeats them.
+				if (line) console.error(line);
+				printTextNotes({ warnings: envelope.warnings, tips: [] });
+			}
 			if (!envelope.ok) exitCode = 1;
 		}
 	} finally {
@@ -379,14 +399,17 @@ async function runRetrieveWaitCli(
 		const envelope = await retrieveWait(request, Bun.env, {
 			signal: controller.signal,
 		});
+		const format =
+			envelope.meta.operation?.request.format ??
+			inferRequestedFormat(args, request);
+		const text = format === "text";
+		if (text && request.verbose) {
+			printTextHeader(retrieveVerboseLines(envelope));
+		}
 		console.log(
-			renderRetrieveEnvelope(
-				envelope,
-				envelope.meta.operation?.request.format ??
-					inferRequestedFormat(args, request),
-				{ verbose: request.verbose },
-			),
+			renderRetrieveEnvelope(envelope, format, { verbose: request.verbose }),
 		);
+		if (text) printTextNotes(envelope);
 		return envelope.ok ? 0 : 1;
 	} finally {
 		process.off("SIGINT", onSigint);
@@ -423,7 +446,6 @@ async function runRetrieveFanoutCli(
 	} catch (error) {
 		const envelope = buildRetrieveFanoutErrorEnvelope(request, error);
 		console.error(
-			// codeql[js/clear-text-logging] Twin of #80/#81/#83. No secret logged: error builders carry only targetInput (host)+via (protocol); serializeCentrsError holds code/summary/remediation/context.
 			renderRetrieveFanoutEnvelope(envelope, format, {
 				verbose: request.verbose ?? false,
 			}),

package/src/cli/settings.ts

@@ -244,7 +244,6 @@ export async function runSettingsCli(args: readonly string[]): Promise<number> {
 		}
 
 		const format = parsed.format ?? "text";
-		// codeql[js/clear-text-logging] passwordSet is a has-password boolean, never the secret; the property-NAME heuristic (maybePassword) matches the field name, not its value type.
 		console.log(renderSettingsEnvelope(envelope, format));
 		return 0;
 	} catch (error) {
@@ -263,10 +262,8 @@ export async function runSettingsCli(args: readonly string[]): Promise<number> {
 			centrsError,
 		);
 		if (format === "json" || format === "yaml") {
-			// codeql[js/clear-text-logging] sink renders only a literal error string (e.g. "Missing value for --password."), never the real value; CodeQL over-taints via shared expectValue/CentrsError code.
 			console.error(renderSettingsEnvelope(envelope, format));
 		} else {
-			// codeql[js/clear-text-logging] sink renders only a literal error string (e.g. "Missing value for --password."), never the real value; CodeQL over-taints via shared expectValue/CentrsError code.
 			console.error(formatCentrsErrorText(centrsError));
 		}
 		return 1;

package/src/cli/terminal.ts

@@ -188,12 +188,10 @@ export async function runTerminalCli(args: readonly string[]): Promise<number> {
 		if (format === "json" || format === "yaml") {
 			const envelope = withTips(buildTerminalErrorEnvelope(error), tips);
 			console.error(
-				// codeql[js/clear-text-logging] CLI error renderer false positive; password reaches neither the error nor the stderr renderers. Dismissed across all CLI commands.
 				format === "yaml" ? toYaml(envelope) : JSON.stringify(envelope),
 			);
 		} else {
 			console.error(
-				// codeql[js/clear-text-logging] Password parsed from args never reaches error.message in the text-format catch path; the parsed request (which holds the raw password) is never rendered.
 				formatCentrsErrorText(
 					asCentrsError(error, {
 						code: "input/invalid-command",

package/src/cli/transfer.ts

@@ -21,12 +21,15 @@ import {
 	transferEnvelope,
 	transferFanout,
 	transferOutputFormats,
+	transferVerboseLines,
 	transferVerbs,
 } from "../index.ts";
 import { assertNoQuickchrOverrideConflict } from "../resolver/index.ts";
 import {
 	type CliCommandMetadata,
 	expectValue,
+	printTextHeader,
+	printTextNotes,
 	renderCommandHelp,
 	unknownFlagError,
 } from "./common.ts";
@@ -167,7 +170,7 @@ export const transferCommand: CliCommandMetadata = {
 		},
 		{
 			flag: "--verbose",
-			description: "Show the resolved transport in text output.",
+			description: "Show the resolved transport in text output, on stderr.",
 		},
 	],
 };
@@ -206,11 +209,12 @@ export async function runTransferCli(
 		const rendered = renderTransferEnvelope(envelope, format, {
 			verbose: request.verbose,
 		});
+		if (format === "text" && request.verbose) {
+			printTextHeader(transferVerboseLines(envelope));
+		}
 		if (!envelope.ok) {
-			console.error(
-				// codeql[js/clear-text-logging] The envelope carries auth provenance only (`username`, `passwordProvided`, setting sources), never the password; see buildTransferErrorEnvelopeFromResolved.
-				format === "text" ? rendered + formatTipsText(envelope.tips) : rendered,
-			);
+			console.error(rendered);
+			if (format === "text") printTextNotes(envelope);
 			return 1;
 		}
 		// A download to stdout (`local === "-"`) has already streamed the file bytes
@@ -221,6 +225,7 @@ export async function runTransferCli(
 		} else {
 			console.log(rendered);
 		}
+		if (format === "text") printTextNotes(envelope);
 		return 0;
 	} catch (error) {
 		// Drop credential fields before any renderer touches the request: error
@@ -243,14 +248,12 @@ export async function runTransferCli(
 				tips,
 			);
 			console.error(
-				// codeql[js/clear-text-logging] The transfer error path redacts password/cdbPassword before any renderer (redactTransferRequest), and buildTransferErrorEnvelope only emits targetInput.
 				renderTransferEnvelope(envelope, format, {
 					verbose: safeRequest?.verbose ?? false,
 				}),
 			);
 		} else {
 			console.error(
-				// codeql[js/clear-text-logging] Credentials are redacted from the request before rendering (redactTransferRequest) and never reach the error/stderr; same known false positive dismissed across all CLI commands.
 				formatCentrsErrorText(
 					asCentrsError(error, {
 						code: "input/invalid-command",
@@ -297,7 +300,6 @@ async function runTransferFanoutCli(
 			error,
 		);
 		console.error(
-			// codeql[js/clear-text-logging] No secret logged: request is redactTransferRequest'd (password/cdbPassword stripped) before the builder; fan-out error meta is {target:{},via,settings:{}}.
 			renderTransferFanoutEnvelope(envelope, format, {
 				verbose: request.verbose ?? false,
 			}),