@wirecat/cli-base 0.60.0 → 0.61.0

package/CHANGELOG.md

@@ -8,6 +8,19 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.61.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **A run record keeps the command line as typed**
+  ([Security](docs/standards/security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)).
+  The handbook said a run record never holds message text; a run's `argv` now keeps the words typed, so the owner can
+  read back what was run. A secret stays hidden: an option or argument marked with cli-core's `secretInput(...)`, one
+  named for a token, password, secret, credential, cookie, authorization or API key, a password in a URL, a long
+  opaque string. `record_input: false` in a CLI's config masks as before. A CLI's tests that assert a typed marker is
+  absent from its run folder now look outside `argv` ([Testing](docs/standards/testing.md)), and a CLI's own document
+  that says its run log hides what was typed needs the same change.
+
 ## 0.60.0 — 26.10.2026
 
 ### Added

package/docs/standards/lifecycle.md

@@ -14,8 +14,8 @@ A "one-shot" command does one job and ends: most commands. A "long-running" comm
 `lifetime: "persistent"` (it runs until it is stopped, such as `serve` or `watch`) or `lifetime: "interactive"` (it
 waits for a person, such as a login).
 
-A "run" is one command's record: what it was, how it ended, and its events, never content. The rules on what a
-run's events may hold are [WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)
+A "run" is one command's record: what it was, as typed, how it ended, and its events, which never hold content. The
+rules on what a run may hold are [WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)
 and [WC-SECR-2](security.md#wc-secr-2--a-log-keeps-only-known-attribute-keys-and-hides-content-keys).
 
 ### Who follows these rules today
@@ -198,7 +198,10 @@ provider's limit as often as it ends. These three rules make the next run carry
 ### WC-LIFE-15 · Keep a run log through cli-core, and read it back with `runs`
 
 A failed command is always kept as a run, unless the person turned recording off with `--no-record` or
-`record: false` in the config. `--record` keeps every run of a command that does its work inside cli-core's run
+`record: false` in the config. A run keeps the command line as typed, secrets hidden; `record_input: false` masks
+every value that may be content
+([WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)).
+`--record` keeps every run of a command that does its work inside cli-core's run
 (`context.run`, or `startRecording` in a program of its own). A run is a folder `<state>/runs/<day>/<run_id>/` with
 `run.json` and `events.jsonl`, one log record per line. `runs list` and `runs show` read it.
 

package/docs/standards/security.md

@@ -21,13 +21,27 @@ Rule ids on this page are `WC-SECR-<n>`. How to read a rule, how ids work and wh
 ### WC-SECR-1 · Private data and secrets never reach a log, a fixture or a committed document
 
 Command output is the only place where a message the owner asked to read may appear. A log, a run record, a test
-fixture, a document and a commit message never hold message text, a token or a phone number.
+fixture, a document and a commit message never hold message text, a token or a phone number — with one exception:
+a run record keeps the command line the person typed.
+
+A run record's `argv` keeps the words as typed by default, so the history of what was run can be read back. A secret
+in them is always `[redacted]`: the value of an option or argument the CLI marks with cli-core's `secretInput(...)`,
+one whose name says token, password, secret, credential, cookie, authorization or API key, a password inside a URL,
+and a long opaque string. `record_input: false` in the CLI's config masks every value that may be content, and a
+config that will not load masks the same way. A problem report sent to other people (`doctor reports create`) masks
+the typed words always.
 
 - **Why:** a log or a repository is copied and kept far longer than anyone remembers; private data in it is a leak.
 - **Enforced by:** `node-ci.yml:secrets`.
 - **Example:** a log line says `{ "event": "send", "outcome": "sent", "count": 1 }`, not the text that was sent.
-- **Exceptions:** none. The scanners catch secrets of known shapes; message text and names are caught only in review.
-- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
+  `tg messages send Mom "see you at 5"` is kept in its run as typed; `tg bot api set-webhook --body '{…}'` keeps
+  `--body [redacted]`, since cli-core marks `--body` with `secretInput`. A CLI's own option that takes a secret is
+  declared `secretInput(new Option("--pin <code>"))` — although under
+  [WC-SECR-5](#wc-secr-5--a-secret-is-never-taken-on-the-command-line) such an option should not exist.
+- **Exceptions:** a run record's `argv`, as above: messaging CLIs already keep every message in the store, so the
+  words typed are not hidden from the owner's own run log. The scanners catch secrets of known shapes; message text
+  and names elsewhere are caught only in review.
+- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-1829.
 
 ### WC-SECR-2 · A log keeps only known attribute keys, and hides content keys
 

package/docs/standards/testing.md

@@ -124,7 +124,8 @@ and which run after merge is in [CI](ci.md).
 - **Enforced by:** review only.
 - **Example:** test data is visibly fake: `synthetic text ${id}`, the phone number `+71234567890`, the device id
   `00000000-0000-0000-0000-000000000001`, `your-token-here`. Content that must stay hidden carries a unique marker,
-  and the test asserts that the marker is absent from output, errors and run events, while the id is present:
+  and the test asserts that the marker is absent from output, errors and run events (a run's `argv` keeps what was
+  typed, so a marker typed on the command line is looked for outside it), while the id is present:
   `expect(err).not.toContain(token)`. The positive check stops the test from passing by recording nothing.
 - **Exceptions:** none.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.60.0",
+  "version": "0.61.0",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",