Limit SHOPIFY_ environment variables and credential flags in analytics

[isaacroldan]

WHY are these changes introduced?

The analytics payload is printed by outputDebug, including under --verbose and when analytics are disabled, so credential values shouldn't be in it. Two gaps let them through, plus a bug in the redaction itself:

• sanitizePayload() only knew about shptka_ tokens and --store-password, so flags like --client-secret passed through, and so did the environment variables the CLI reads its own tokens from.
• It rewrites the already-serialised payload and parses it back, and its patterns didn't account for JSON escaping. --store-password "" unbalanced the string, the closing JSON.parse threw, and the whole event was dropped. Credential keys nested inside metadata were missed for the same reason.

WHAT is this pull request doing?

Widening what the sanitizer redacts. Nothing is dropped from the payload that main reports today, and getShopifyEnvironmentVariables is untouched.

Two passes over the payload, and one extra over the copies that get printed.

sanitizePayload matches any flag or key whose name contains password, token, secret or credential — covering args, a command line quoted into error_message, and keys at any nesting depth inside metadata, cmd_all_environment_flags and env_shopify_variables. This replaces the two --store-password rules, which it is a superset of. Values are matched escape-aware so a replacement can't cut a \" in half and leave the payload unparseable — --store-password "" used to do exactly that, and the event was dropped.

auth is excluded from the name matching on purpose, so env_auth_method keeps reporting.

key is handled separately, in private/node/analytics/redact-output.ts. It marks a credential in the environment — SHOPIFY_PROXY_KEY holds a signed token and SHOPIFY_FLAG_GRAPHIQL_KEY is derived from the app secret — but api_key is an app's public client ID that Monorail is meant to receive. So the name is redacted only in the copies outputDebug prints, which is what --verbose turns on. Telemetry keeps the values; a terminal, and whatever scrapes it, does not see them.

Still best effort. A credential whose name gives no hint is not redacted, and neither is a non-string value like {"password": 12345}, since the key rule expects a quoted value.

#8205 stacks on this and notes in the --verbose help that the output may include sensitive data.

How to test your changes?

pnpm test packages/cli-kit/src/public/node/analytics.test.ts

SHOPIFY_FLAG_VERBOSE=1 SHOPIFY_CLI_PARTNERS_TOKEN=atkn_fake_value \
  node packages/cli/bin/run.js version --verbose --client-secret cs_fake_value

env_shopify_variables shows SHOPIFY_CLI_PARTNERS_TOKEN with its value as *****, and args shows --client-secret *****.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is not user-facing — internal hardening of what the analytics payload reports, so no changeset

🤖 Generated with Claude Code

[graygilmore]

Makes sense!

[isaacroldan]

• Limit SHOPIFY_ environment variables and credential flags in analytics #8198 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

packages/cli-kit/dist/private/node/analytics/redact-output.d.ts

/**
 * Redacts the copy of the analytics payload that gets printed.
 *
 * The payload itself is already sanitized for Monorail. This is the extra pass for
 * the `outputDebug` sinks that `--verbose` turns on, where the audience is a
 * terminal and whatever scrapes it rather than a sensitive Monorail field.
 *
 * `key` is the whole reason this exists. It marks a credential in the environment
 * -- SHOPIFY_PROXY_KEY holds a signed token, SHOPIFY_FLAG_GRAPHIQL_KEY is derived
 * from the app secret -- but `api_key` is an app's public client ID that Monorail
 * is meant to receive, so the payload rules leave the name alone.
 *
 * @param payload - The already-sanitized analytics payload.
 * @returns A copy with the values of `key`-named entries replaced.
 */
export declare function redactForOutput<T>(payload: T): T;

Existing type declarations

We found no diffs with existing type declarations