@wirecat/cli-base 0.61.0 → 0.61.1

package/CHANGELOG.md

@@ -8,6 +8,27 @@ Versions before 0.8.0 are in the [git tags](https://github.com/WireCatLabs/cli-b
 Every entry says what changed as a caller sees it, why, and what to watch for — the rules are
 [`docs/dev/CONVENTIONS.md`](docs/dev/CONVENTIONS.md#the-changelog).
 
+## 0.61.1 — 26.10.2026
+
+### Fixed
+
+- **The `--record` flag's meaning says what a run keeps now.** It read "keep this run under runs: ids and timings,
+  never content", which stopped being true when a run started keeping the command line as typed. It now reads cli-core
+  0.440.0's help line: "keep this run, with the command as typed and secrets hidden; record_input false leaves the
+  typed words out". cli-core's option catalogue picks it up at its next cli-base bump.
+  [Lifecycle](docs/standards/lifecycle.md#runs) also says how a CLI with a program of its own hands cli-core the
+  words it parsed, without which its runs keep no command line.
+
+### Security
+
+- **The secret-handling rule lists what a run record hides by content.** Besides secret-named flags, a URL password
+  and a long opaque string, cli-core finds a token of a known format, a `Bearer` or `Basic` credential, the value of a
+  secret-named `name=value` pair and a random-looking string of 20 or more characters inside any typed word, and the
+  same in a kept error message (`WC-SECR-1`).
+- **`release-checks.yml` runs CodeQL action v4.39.1, pinned by its commit.** It was pinned to the `v4` tag object,
+  which still pointed at v4.38.3. A caller gets the newer analysis when it moves its `release-checks.yml` pin to the
+  release that carries this.
+
 ## 0.61.0 — 26.10.2026
 
 ### Changed — may break callers

package/dist/standards/flags-how.js

@@ -330,7 +330,7 @@ export const HOW_FLAGS = [
         name: "--record",
         role: "mode",
         type: "switch",
-        meaning: "keep this run under runs: ids and timings, never content",
+        meaning: "keep this run, with the command as typed and secrets hidden; record_input false leaves the typed words out",
     },
     { name: "--regex", role: "mode", type: "switch", meaning: "the words are one regular expression" },
     { name: "--silent", role: "mode", type: "switch", meaning: "deliver without a notification" },

package/docs/standards/lifecycle.md

@@ -210,6 +210,8 @@ every value that may be content
   returns the owner's `record` and `keep_runs_for_days` as `keepFailedRuns` and `keepRunsForDays`, never fixed values.
 - A CLI with a program of its own opens each command's run with `startRecording` from `@wirecat/cli-core/cli`,
   ends it with `succeed` or `fail`, adds `--record` and `--no-record` at the root and registers `runsCommand(app)`.
+  Its run keeps the command line only when cli-core is given the words it parsed: `context: runContextOf({ program,
+  argv, … })` to `startRecording`, or `argv` in the program's environment (`provide`) under `recordRuns`.
 
 - **Why:** when a command fails, a person or an agent needs to see what it did, in the same place and shape in every
   CLI. Without the rule, three CLIs shipped with no run log, and one switched cli-core's off.

package/docs/standards/security.md

@@ -26,8 +26,12 @@ a run record keeps the command line the person typed.
 
 A run record's `argv` keeps the words as typed by default, so the history of what was run can be read back. A secret
 in them is always `[redacted]`: the value of an option or argument the CLI marks with cli-core's `secretInput(...)`,
-one whose name says token, password, secret, credential, cookie, authorization or API key, a password inside a URL,
-and a long opaque string. `record_input: false` in the CLI's config masks every value that may be content, and a
+one whose name says token, password, passphrase, secret, credential, cookie, authorization or API key, a password
+inside a URL, and a long opaque string. Inside any typed word cli-core also finds a secret by its content and replaces
+only the secret: a token of a known format (GitHub `ghp_…`/`github_pat_…`, `sk-…`, Slack `xox…-`, AWS `AKIA…`, Google
+`AIza…`, Stripe `sk_`/`rk_`, npm `npm_…`, a Telegram bot token, a JWT, a PEM private key), a `Bearer` or `Basic`
+credential, the value of a secret-named pair (`password=…`, `API_TOKEN=…`, `client_secret:…`), a random-looking string
+of 20 or more characters, and a phone number. The same search runs on a kept error message. `record_input: false` in the CLI's config masks every value that may be content, and a
 config that will not load masks the same way. A problem report sent to other people (`doctor reports create`) masks
 the typed words always.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-base",
-  "version": "0.61.0",
+  "version": "0.61.1",
   "description": "The parts every command line tool needs: output modes, terminal rendering, error model, exit codes, credentials, clocks",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",