Summary
The sensitive attribute on base_cli_option declarations is documented, validated, and stored, but nothing in the library ever reads it back to redact output.
Details
lib/bash/cli/lib_cli.sh:97 — attribute accepted:117 — validated as bool:450, :491 — stored in meta|...|sensitive:626 — base_cli_help prints default unconditionally: [[ -n "$default" ]] && help="$help (default: $default)"lib/bash/cli/README.md:18 documents sensitive as a declarable attribute; lib/bash/cli/tests/lib_cli.bats never references it (zero test coverage).- Compare with
lib/bash/app/lib_app.sh's secret attribute, which does redact values in base_app_config_report:501.
Impact
A sensitive=true default=$TOKEN-style option declaration still leaks the value in --help output — a documented security contract that silently does nothing.
Suggested fix
Either implement redaction (skip/mask default display and any future logging paths when sensitive=true) or remove the attribute and update the README until implemented.
Summary
The
sensitiveattribute onbase_cli_optiondeclarations is documented, validated, and stored, but nothing in the library ever reads it back to redact output.Details
lib/bash/cli/lib_cli.sh:97— attribute accepted:117— validated as bool:450,:491— stored inmeta|...|sensitive:626—base_cli_helpprintsdefaultunconditionally:[[ -n "$default" ]] && help="$help (default: $default)"lib/bash/cli/README.md:18documentssensitiveas a declarable attribute;lib/bash/cli/tests/lib_cli.batsnever references it (zero test coverage).lib/bash/app/lib_app.sh'ssecretattribute, which does redact values inbase_app_config_report:501.Impact
A
sensitive=true default=$TOKEN-style option declaration still leaks the value in--helpoutput — a documented security contract that silently does nothing.Suggested fix
Either implement redaction (skip/mask default display and any future logging paths when
sensitive=true) or remove the attribute and update the README until implemented.