@wirecat/cli-base 0.60.0 → 0.61.1

package/CHANGELOG.md

@@ -8,6 +8,40 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.61.1 — 26.10.2026
+
+### Fixed
+
+- **The `--record` flag's meaning says what a run keeps now.** It read "keep this run under runs: ids and timings,
+  never content", which stopped being true when a run started keeping the command line as typed. It now reads cli-core
+  0.440.0's help line: "keep this run, with the command as typed and secrets hidden; record_input false leaves the
+  typed words out". cli-core's option catalogue picks it up at its next cli-base bump.
+  [Lifecycle](docs/standards/lifecycle.md#runs) also says how a CLI with a program of its own hands cli-core the
+  words it parsed, without which its runs keep no command line.
+
+### Security
+
+- **The secret-handling rule lists what a run record hides by content.** Besides secret-named flags, a URL password
+  and a long opaque string, cli-core finds a token of a known format, a `Bearer` or `Basic` credential, the value of a
+  secret-named `name=value` pair and a random-looking string of 20 or more characters inside any typed word, and the
+  same in a kept error message (`WC-SECR-1`).
+- **`release-checks.yml` runs CodeQL action v4.39.1, pinned by its commit.** It was pinned to the `v4` tag object,
+  which still pointed at v4.38.3. A caller gets the newer analysis when it moves its `release-checks.yml` pin to the
+  release that carries this.
+
+## 0.61.0 — 26.10.2026
+
+### Changed — may break callers
+
+- **A run record keeps the command line as typed**
+  ([Security](docs/standards/security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)).
+  The handbook said a run record never holds message text; a run's `argv` now keeps the words typed, so the owner can
+  read back what was run. A secret stays hidden: an option or argument marked with cli-core's `secretInput(...)`, one
+  named for a token, password, secret, credential, cookie, authorization or API key, a password in a URL, a long
+  opaque string. `record_input: false` in a CLI's config masks as before. A CLI's tests that assert a typed marker is
+  absent from its run folder now look outside `argv` ([Testing](docs/standards/testing.md)), and a CLI's own document
+  that says its run log hides what was typed needs the same change.
+
 ## 0.60.0 — 26.10.2026
 
 ### Added

package/dist/standards/flags-how.js

@@ -330,7 +330,7 @@ export const HOW_FLAGS = [
         name: "--record",
         role: "mode",
         type: "switch",
-        meaning: "keep this run under runs: ids and timings, never content",
+        meaning: "keep this run, with the command as typed and secrets hidden; record_input false leaves the typed words out",
     },
     { name: "--regex", role: "mode", type: "switch", meaning: "the words are one regular expression" },
     { name: "--silent", role: "mode", type: "switch", meaning: "deliver without a notification" },

package/docs/standards/lifecycle.md

@@ -14,8 +14,8 @@ A "one-shot" command does one job and ends: most commands. A "long-running" comm
 `lifetime: "persistent"` (it runs until it is stopped, such as `serve` or `watch`) or `lifetime: "interactive"` (it
 waits for a person, such as a login).
 
-A "run" is one command's record: what it was, how it ended, and its events, never content. The rules on what a
-run's events may hold are [WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)
+A "run" is one command's record: what it was, as typed, how it ended, and its events, which never hold content. The
+rules on what a run may hold are [WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)
 and [WC-SECR-2](security.md#wc-secr-2--a-log-keeps-only-known-attribute-keys-and-hides-content-keys).
 
 ### Who follows these rules today
@@ -198,7 +198,10 @@ provider's limit as often as it ends. These three rules make the next run carry
 ### WC-LIFE-15 · Keep a run log through cli-core, and read it back with `runs`
 
 A failed command is always kept as a run, unless the person turned recording off with `--no-record` or
-`record: false` in the config. `--record` keeps every run of a command that does its work inside cli-core's run
+`record: false` in the config. A run keeps the command line as typed, secrets hidden; `record_input: false` masks
+every value that may be content
+([WC-SECR-1](security.md#wc-secr-1--private-data-and-secrets-never-reach-a-log-a-fixture-or-a-committed-document)).
+`--record` keeps every run of a command that does its work inside cli-core's run
 (`context.run`, or `startRecording` in a program of its own). A run is a folder `<state>/runs/<day>/<run_id>/` with
 `run.json` and `events.jsonl`, one log record per line. `runs list` and `runs show` read it.
 
@@ -207,6 +210,8 @@ A failed command is always kept as a run, unless the person turned recording off
   returns the owner's `record` and `keep_runs_for_days` as `keepFailedRuns` and `keepRunsForDays`, never fixed values.
 - A CLI with a program of its own opens each command's run with `startRecording` from `@wirecat/cli-core/cli`,
   ends it with `succeed` or `fail`, adds `--record` and `--no-record` at the root and registers `runsCommand(app)`.
+  Its run keeps the command line only when cli-core is given the words it parsed: `context: runContextOf({ program,
+  argv, … })` to `startRecording`, or `argv` in the program's environment (`provide`) under `recordRuns`.
 
 - **Why:** when a command fails, a person or an agent needs to see what it did, in the same place and shape in every
   CLI. Without the rule, three CLIs shipped with no run log, and one switched cli-core's off.

package/docs/standards/security.md

@@ -21,13 +21,31 @@ Rule ids on this page are `WC-SECR-<n>`. How to read a rule, how ids work and wh
 ### WC-SECR-1 · Private data and secrets never reach a log, a fixture or a committed document
 
 Command output is the only place where a message the owner asked to read may appear. A log, a run record, a test
-fixture, a document and a commit message never hold message text, a token or a phone number.
+fixture, a document and a commit message never hold message text, a token or a phone number — with one exception:
+a run record keeps the command line the person typed.
+
+A run record's `argv` keeps the words as typed by default, so the history of what was run can be read back. A secret
+in them is always `[redacted]`: the value of an option or argument the CLI marks with cli-core's `secretInput(...)`,
+one whose name says token, password, passphrase, secret, credential, cookie, authorization or API key, a password
+inside a URL, and a long opaque string. Inside any typed word cli-core also finds a secret by its content and replaces
+only the secret: a token of a known format (GitHub `ghp_…`/`github_pat_…`, `sk-…`, Slack `xox…-`, AWS `AKIA…`, Google
+`AIza…`, Stripe `sk_`/`rk_`, npm `npm_…`, a Telegram bot token, a JWT, a PEM private key), a `Bearer` or `Basic`
+credential, the value of a secret-named pair (`password=…`, `API_TOKEN=…`, `client_secret:…`), a random-looking string
+of 20 or more characters, and a phone number. The same search runs on a kept error message. `record_input: false` in the CLI's config masks every value that may be content, and a
+config that will not load masks the same way. A problem report sent to other people (`doctor reports create`) masks
+the typed words always.
 
 - **Why:** a log or a repository is copied and kept far longer than anyone remembers; private data in it is a leak.
 - **Enforced by:** `node-ci.yml:secrets`.
 - **Example:** a log line says `{ "event": "send", "outcome": "sent", "count": 1 }`, not the text that was sent.
-- **Exceptions:** none. The scanners catch secrets of known shapes; message text and names are caught only in review.
-- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.
+  `tg messages send Mom "see you at 5"` is kept in its run as typed; `tg bot api set-webhook --body '{…}'` keeps
+  `--body [redacted]`, since cli-core marks `--body` with `secretInput`. A CLI's own option that takes a secret is
+  declared `secretInput(new Option("--pin <code>"))` — although under
+  [WC-SECR-5](#wc-secr-5--a-secret-is-never-taken-on-the-command-line) such an option should not exist.
+- **Exceptions:** a run record's `argv`, as above: messaging CLIs already keep every message in the store, so the
+  words typed are not hidden from the owner's own run log. The scanners catch secrets of known shapes; message text
+  and names elsewhere are caught only in review.
+- **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** NEED-1829.
 
 ### WC-SECR-2 · A log keeps only known attribute keys, and hides content keys
 

package/docs/standards/testing.md

@@ -124,7 +124,8 @@ and which run after merge is in [CI](ci.md).
 - **Enforced by:** review only.
 - **Example:** test data is visibly fake: `synthetic text ${id}`, the phone number `+71234567890`, the device id
   `00000000-0000-0000-0000-000000000001`, `your-token-here`. Content that must stay hidden carries a unique marker,
-  and the test asserts that the marker is absent from output, errors and run events, while the id is present:
+  and the test asserts that the marker is absent from output, errors and run events (a run's `argv` keeps what was
+  typed, so a marker typed on the command line is looked for outside it), while the id is present:
   `expect(err).not.toContain(token)`. The positive check stops the test from passing by recording nothing.
 - **Exceptions:** none.
 - **Applies to:** all CLIs. **Since:** cli-base 0.41.0. **Rulings:** none.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.60.0",
+  "version": "0.61.1",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",