@wirecat/cli-core 0.441.0 → 0.442.0

package/CHANGELOG.md

@@ -7,6 +7,37 @@ shape of this file.
 
 ## Unreleased
 
+## 0.442.0 — 26.10.2026
+
+### Security
+
+- **A run record and a kept error message now find a secret by what it looks like, not only by the flag's name.**
+  The secret is replaced by `[redacted]` inside the word and the words around it stay:
+  - a token in a known format: GitHub (`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`, `github_pat_`), OpenAI and
+    Anthropic (`sk-`), Slack (`xoxb-` and the like), an AWS access key id (`AKIA`, `ASIA`), a Google API key
+    (`AIza`), a Stripe secret or restricted key (`sk_live_`, `rk_live_` and the `_test_` ones; a `pk_` key is public
+    and stays), an npm token (`npm_`), a Telegram bot token, a JWT, and a PEM private key block;
+  - a `Bearer` or `Basic` credential;
+  - the value of a pair whose name says it is a secret, `password=…`, `API_TOKEN=…`, `client_secret:…`,
+    `"accessToken":"…"`, the name kept;
+  - a random-looking string of 20 or more characters: mixed upper and lower case with a digit or symbol, entropy of
+    at least 3.5 bits a character, case changing often and cut into short pieces. Words, camelCase names, UUIDs,
+    hex hashes, run ids, dates, paths and URLs without a password in them stay.
+
+  A profile name or a mistyped command word that looks like a secret is now `[redacted]` even with `record_input`
+  off.
+
+- **A config that will not load no longer lets a run record keep the typed words.** When `recordRuns` or
+  `commandRuns` could not read the CLI's settings, it fell back to the defaults, so `record_input` counted as on and
+  the command line was kept as typed, even from a config that says `record_input: false`. A failed settings read now
+  masks every value that may be content, as cli-core's own commands already did.
+
+### Changed — may break callers
+
+- **`recordRuns` keeps the command line in the run record by itself.** A CLI with its own program (cli-memo,
+  drive-cli) kept no `argv` unless it passed the typed words through `run()`; the words its `parseAsync` is given are
+  now kept, secrets hidden, and masked when `settings()` returns `recordInput: false`.
+
 ## 0.441.0 — 26.10.2026
 
 ### Added

package/dist/cli/command-runs.d.ts

@@ -18,7 +18,10 @@ export interface RunSettings {
 export declare const runSettings: (flag: boolean | undefined, saved?: SavedRunSettings) => RunSettings;
 export interface CommandRunOptions {
     app: AppIdentity;
-    /** The owner's saved choice. One that throws — a config that will not load — leaves the defaults. */
+    /**
+     * The owner's saved choice. One that throws — a config that will not load — leaves the defaults, except that the
+     * typed words are masked: the broken config may be the one that says `record_input: false`.
+     */
     settings: () => SavedRunSettings;
     /**
      * The profile the command runs for; one that throws or is empty leaves the run without one. Given only by a CLI

package/dist/cli/command-runs.js

@@ -21,7 +21,7 @@ const pathOf = (command) => {
         words.unshift(at.name());
     return words;
 };
-const tracker = (options) => {
+const tracker = (options, typed) => {
     let recording;
     const open = (program, words, flag, format) => {
         recording = undefined;
@@ -33,7 +33,9 @@ const tracker = (options) => {
         try {
             saved = options.settings();
         }
-        catch { }
+        catch {
+            saved = { recordInput: false };
+        }
         let profile;
         try {
             profile = options.profile?.() || undefined;
@@ -59,7 +61,7 @@ const tracker = (options) => {
                 bin: options.app.command,
                 command: words.length > 0 ? command : "",
                 program: rootOf(program),
-                ...(environment.argv ? { argv: environment.argv } : {}),
+                ...((environment.argv ?? typed) ? { argv: environment.argv ?? typed } : {}),
                 env: env ?? process.env,
                 recordInput: saved.recordInput !== false,
             }),
@@ -153,7 +155,8 @@ export const recordRuns = (program, options) => {
     });
     const parseAsync = program.parseAsync.bind(program);
     program.parseAsync = (argv, settings) => {
-        const parse = { runs: tracker(options), started: false };
+        const args = settings?.from === "user" ? (argv ?? []) : (argv ?? process.argv).slice(2);
+        const parse = { runs: tracker(options, args), started: false };
         return parses.run(parse, async () => {
             try {
                 const parsed = await parseAsync(argv, settings);
@@ -164,7 +167,6 @@ export const recordRuns = (program, options) => {
                 if (!isHelpExit(error) && !wasSettled(error)) {
                     try {
                         if (!parse.started) {
-                            const args = settings?.from === "user" ? (argv ?? []) : (argv ?? process.argv).slice(2);
                             const flag = args.includes("--no-record") ? false : args.includes("--record") ? true : undefined;
                             const json = args.some((arg) => arg === "--json" || arg.startsWith("--json=") || arg === "--jsonl");
                             const words = pathFromArgs(program, args, options.profile !== undefined);

package/dist/runs/error-detail.d.ts

@@ -39,7 +39,8 @@ export declare const INTERNATIONAL_PHONE: string;
 export declare const BARE_PHONE: string;
 /**
  * An error's sentence with what could be somebody's words or a secret taken out: anything in quotes, an email, a
- * phone number, a bot token, a bearer or a long opaque string, a URL's query, the home directory. A second line of
- * defence — errors here are written to name things, not quote them — so it errs toward masking.
+ * phone number, a secret `withoutSecrets` finds, a bot token, a bearer or a long opaque string, a URL's query, the
+ * home directory. A second line of defence — errors here are written to name things, not quote them — so it errs
+ * toward masking.
  */
 export declare const redactText: (text: string) => string;

package/dist/runs/error-detail.js

@@ -1,6 +1,7 @@
 import { homedir } from "node:os";
 import { isCliFailure } from "../errors/failures.js";
 import { providerErrorKey } from "./events.js";
+import { withoutSecrets } from "./secrets.js";
 const MESSAGE_AT_MOST = 500;
 const CAUSES_AT_MOST = 5;
 const FRAMES_AT_MOST = 15;
@@ -114,14 +115,14 @@ export const INTERNATIONAL_PHONE = /\+\d[\d\s()-]{6,}\d/.source;
 export const BARE_PHONE = /(^|[^\w-])\d{11,15}\b/.source;
 /**
  * An error's sentence with what could be somebody's words or a secret taken out: anything in quotes, an email, a
- * phone number, a bot token, a bearer or a long opaque string, a URL's query, the home directory. A second line of
- * defence — errors here are written to name things, not quote them — so it errs toward masking.
+ * phone number, a secret `withoutSecrets` finds, a bot token, a bearer or a long opaque string, a URL's query, the
+ * home directory. A second line of defence — errors here are written to name things, not quote them — so it errs
+ * toward masking.
  */
 export const redactText = (text) => {
     const home = homedir();
     let out = home && home !== "/" ? text.split(home).join("~") : text;
-    out = out
-        .replace(/"[^"\n]*"|“[^”\n]*”|«[^»\n]*»/g, '"[redacted]"')
+    out = withoutSecrets(out.replace(/"[^"\n]*"|“[^”\n]*”|«[^»\n]*»/g, '"[redacted]"'))
         .replace(/\b(bearer|basic|token|key|password|secret)(\s*[:=]\s*|\s+)[^\s'"]+/gi, "$1$2[redacted]")
         .replace(/[\w.+-]+@[\w-]+\.[\w.-]+/g, "[email]")
         .replace(new RegExp(INTERNATIONAL_PHONE, "g"), "[number]")

package/dist/runs/run-context.js

@@ -1,5 +1,6 @@
 import { isContentKey } from "@wirecat/cli-base/standards";
 import { BARE_PHONE, INTERNATIONAL_PHONE } from "./error-detail.js";
+import { secretNamed, withoutSecrets } from "./secrets.js";
 export const REDACTED = "[redacted]";
 /**
  * The agent is read from what each one sets in the processes it starts: Claude Code `CLAUDECODE` and
@@ -49,26 +50,6 @@ export const secretInput = (input) => {
     secretInputs.add(input);
     return input;
 };
-const SECRET_WORDS = new Set([
-    "authorization",
-    "cookie",
-    "credential",
-    "credentials",
-    "passphrase",
-    "password",
-    "secret",
-    "token",
-    "apikey",
-]);
-// Undeclared flags carry no mark, so the name is the only signal; CLIs take secrets at a prompt (WC-SECR-5) and this
-// catches the one typed anyway.
-const secretNamed = (name) => {
-    const words = name
-        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
-        .split(/[\s_.-]+/)
-        .map((word) => word.toLowerCase());
-    return words.some((word, at) => SECRET_WORDS.has(word) || (word === "api" && words[at + 1] === "key"));
-};
 // A password inside a URL, or one unbroken run of 40 token characters, is a credential wherever it was typed.
 const secretShaped = (word) => /:\/\/[^/@\s:]+:[^/@\s]+@/.test(word) || /(^|[^A-Za-z0-9_-])[A-Za-z0-9_-]{40,}($|[^A-Za-z0-9_-])/.test(word);
 // Messaging CLIs promise a phone number reaches no log, so it goes even from text the record otherwise keeps.
@@ -88,7 +69,7 @@ export const maskArgv = (program, words, { keep = false } = {}) => {
     let positional = 0;
     let profileSeen = false;
     let lost = false;
-    const raw = (word) => (keep && !secretShaped(word) ? withoutPhones(word) : REDACTED);
+    const raw = (word) => (keep && !secretShaped(word) ? withoutPhones(withoutSecrets(word, REDACTED)) : REDACTED);
     const keptValue = (name, value, input) => keep
         ? (input && secretInputs.has(input)) || secretNamed(name)
             ? REDACTED
@@ -151,7 +132,7 @@ export const maskArgv = (program, words, { keep = false } = {}) => {
             }
             if (current === program && !profileSeen) {
                 profileSeen = true;
-                argv.push(keep ? raw(word) : PROFILE.test(word) && withoutPhones(word) === word ? word : REDACTED);
+                argv.push(keep ? raw(word) : PROFILE.test(word) && withoutPhones(withoutSecrets(word)) === word ? word : REDACTED);
                 continue;
             }
             if (current.commands.length > 0 && current.registeredArguments.length === 0) {
@@ -171,7 +152,7 @@ export const maskArgv = (program, words, { keep = false } = {}) => {
 const NUMBER = /^-?\d+(\.\d+)?$/;
 const PROFILE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 /** A mistyped command word is kept so the typo can be seen; anything shaped like a sentence or an address is not. */
-const commandLike = (word) => (/^[a-z][a-z0-9-]{0,31}$/i.test(word) ? word : REDACTED);
+const commandLike = (word) => /^[a-z][a-z0-9-]{0,31}$/i.test(word) && withoutSecrets(word) === word ? word : REDACTED;
 const maskedValue = (name, value, choices) => {
     if (isContentKey(name))
         return REDACTED;

package/dist/runs/secrets.d.ts

@@ -0,0 +1,12 @@
+export declare const secretNamed: (name: string) => boolean;
+/**
+ * Whether a run of token characters is a random string rather than words: long, mixed case, high Shannon entropy,
+ * cut into short pieces (`Kz9vQ2mX`) where a name is cut into words (`InlineQueryResultMpeg4Gif`).
+ */
+export declare const looksRandom: (run: string) => boolean;
+/**
+ * Text with each secret inside it replaced by `mark` and the words around it kept: a token of a known vendor format,
+ * a private key, a `Bearer`/`Basic` credential, the value of a secret-named `name=value` or `name: value`, and a
+ * random-looking string of 20 or more printable characters (`looksRandom`).
+ */
+export declare const withoutSecrets: (text: string, mark?: string) => string;

package/dist/runs/secrets.js

@@ -0,0 +1,88 @@
+const SECRET_WORDS = new Set([
+    "authorization",
+    "cookie",
+    "credential",
+    "credentials",
+    "passphrase",
+    "password",
+    "secret",
+    "token",
+    "apikey",
+]);
+// Undeclared flags carry no mark, so the name is the only signal; CLIs take secrets at a prompt (WC-SECR-5) and this
+// catches the one typed anyway.
+export const secretNamed = (name) => {
+    const words = name
+        .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+        .split(/[\s_.-]+/)
+        .map((word) => word.toLowerCase());
+    return words.some((word, at) => SECRET_WORDS.has(word) || (word === "api" && words[at + 1] === "key"));
+};
+const START = "(?<![A-Za-z0-9_-])";
+const END = "(?![A-Za-z0-9_-])";
+// Vendors print these prefixes so scanners can find their keys; a Stripe `pk_` key is public by design.
+const KNOWN_TOKENS = new RegExp(`${[
+    "gh[pousr]_[A-Za-z0-9]{36,}",
+    "github_pat_[A-Za-z0-9_]{22,}",
+    "sk-[A-Za-z0-9_-]{20,}",
+    "xox[abprs]-[A-Za-z0-9-]{10,}",
+    "(?:AKIA|ASIA)[A-Z0-9]{16}",
+    "AIza[A-Za-z0-9_-]{35}",
+    "(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{10,}",
+    "npm_[A-Za-z0-9]{36}",
+    "eyJ[A-Za-z0-9_-]{5,}\\.eyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]*",
+]
+    .map((pattern) => `${START}${pattern}${END}`)
+    .join("|")}|(?<!\\d)\\d{8,10}:[A-Za-z0-9_-]{35}${END}`, "g");
+const PRIVATE_KEY = /-----BEGIN[A-Z ]* PRIVATE KEY-----[\s\S]*?(?:-----END[A-Z ]* PRIVATE KEY-----|$)/g;
+// Capitalised, as in a header, and not followed by a plain word: "the Basic plan" is somebody's words.
+const SCHEME = /(?<![A-Za-z])(Bearer|Basic)(\s+)(?![A-Z]?[a-z]+(?![A-Za-z0-9]))[A-Za-z0-9._~+/=-]{8,}/g;
+const NAMED_PAIR = /(?<![A-Za-z0-9])([A-Za-z0-9_.-]*(?:token|password|passphrase|secret|credential|cookie|authorization|api[_-]?key)[A-Za-z0-9_.-]*)(["']?\s*[:=]\s*["']?)((?:Bearer\s+|Basic\s+)?)([^\s"'&,;]+)/gi;
+/**
+ * Whether a run of token characters is a random string rather than words: long, mixed case, high Shannon entropy,
+ * cut into short pieces (`Kz9vQ2mX`) where a name is cut into words (`InlineQueryResultMpeg4Gif`).
+ */
+export const looksRandom = (run) => {
+    if (run.length < 20)
+        return false;
+    const classes = [/[a-z]/, /[A-Z]/, /\d/, /[^A-Za-z0-9]/].filter((kind) => kind.test(run)).length;
+    if (classes < 3)
+        return false;
+    let switches = 0;
+    for (let at = 1; at < run.length; at++) {
+        const [before, after] = [run[at - 1], run[at]];
+        if ((/[a-z]/.test(before) && /[A-Z]/.test(after)) || (/[A-Z]/.test(before) && /[a-z]/.test(after)))
+            switches += 1;
+    }
+    if (switches / run.length < 0.15)
+        return false;
+    const pieces = run.match(/[A-Z]?[a-z]+|[A-Z]+(?![a-z])|\d+/g) ?? [];
+    if (pieces.join("").length / Math.max(pieces.length, 1) >= 2.75)
+        return false;
+    return entropy(run) >= 3.5;
+};
+const entropy = (text) => {
+    const counts = new Map();
+    for (const char of text)
+        counts.set(char, (counts.get(char) ?? 0) + 1);
+    let bits = 0;
+    for (const count of counts.values())
+        bits -= (count / text.length) * Math.log2(count / text.length);
+    return bits;
+};
+/**
+ * Text with each secret inside it replaced by `mark` and the words around it kept: a token of a known vendor format,
+ * a private key, a `Bearer`/`Basic` credential, the value of a secret-named `name=value` or `name: value`, and a
+ * random-looking string of 20 or more printable characters (`looksRandom`).
+ */
+export const withoutSecrets = (text, mark = "[redacted]") => text
+    .replace(PRIVATE_KEY, mark)
+    .replace(KNOWN_TOKENS, mark)
+    .replace(SCHEME, `$1$2${mark}`)
+    .replace(NAMED_PAIR, (whole, name, separator, scheme) => secretNamed(name) ? `${name}${separator}${scheme}${mark}` : whole)
+    .replace(/[!-~]{20,}/g, (token) => 
+// A URL or a path is somebody's address, not a key; a credential in one is caught by the rules above.
+token.includes("://") || /^(?:\/|~\/|\.\.?\/)/.test(token)
+    ? token
+    : token.replace(RUN, (run) => (looksRandom(run) ? mark : run)));
+const RUN = /(?<![A-Za-z0-9_+/-])[A-Za-z0-9_+/-]{20,}/g;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wirecat/cli-core",
-  "version": "0.441.0",
+  "version": "0.442.0",
   "description": "The messenger-neutral half of a messaging CLI: domain model, message locators, rendering, name resolution, the SQLite seam, the command skeleton and shared read commands, the send guard, run records and the message store",
   "license": "Apache-2.0",
   "author": "Viacheslav Ptsarev",