Stop credential tokens leaking into usage output

[Soph]

Problem

Token flags registered their environment value as the pflag default:

cmd.Flags().StringVar(&auth.Token, "source-token", envOr("GITSYNC_SOURCE_TOKEN", ""), "...")

pflag prints non-empty defaults in --help, so GITSYNC_SOURCE_TOKEN=secret git-sync sync --help printed (default "secret"). Worse, the unknown-flag fallback in main.go dumps the full usage block to stderr — so a typo'd flag in a CI job with GITSYNC_*_TOKEN set wrote the credential straight into CI logs.

Verified empirically against the built binary before and after.

Fix

• Register secret flags (source/target --*-token and --*-bearer-token, including the inlined ones in convert-sha256) with empty defaults and apply the env value after parsing via a PreRunE hook, only when the flag was not given explicitly. An explicit flag still wins over the environment.
• Add chainPreRunE so independent flag helpers can each attach post-parse logic without clobbering one another; route the existing allRefsFlag through it too.
• Pair registration + env fallback in a single addSecretFlag call so a future secret flag can't re-introduce the leak by reaching for an envOr default.

Non-secret flags (--*-username, --*-insecure-skip-tls-verify) keep using env-as-default since their values are safe to print.

Tests

flags_test.go asserts both invariants: the secret never appears in usage output, and the env fallback still populates auth (with an explicit flag overriding the environment).

🤖 Generated with Claude Code

---

Note

Low Risk
CLI-only credential handling change with tests; behavior for explicit flags and env fallback is preserved, with reduced exposure in logs.

Overview
Prevents GITSYNC_* tokens and bearer values from appearing in --help and error usage dumps by no longer using envOr as the pflag default for secret flags.

Source/target --*-token and --*-bearer-token (including convert-sha256) now register with empty defaults via addSecretFlag, which applies the env value in a chained PreRunE only when the flag was not set on the command line. Explicit flags still override the environment. Non-secret auth flags keep env-as-default behavior.

chainPreRunE composes multiple post-parse hooks so allRefsFlag and secret env fallbacks do not overwrite each other’s PreRunE. New tests in flags_test.go assert secrets never show up in usage text and that env fallback plus flag precedence still work.

^{Reviewed by Cursor Bugbot for commit 7c04242. Configure here.}