#989: allow expressions in template variable definitions

CHANGELOG.adoc

@@ -29,6 +29,7 @@ Release with new features and bugfixes:
 * https://github.com/devonfw/IDEasy/issues/2251[#2251]: Provide generic uninstall support for globally installed tools (windows)
 * https://github.com/devonfw/IDEasy/issues/1135[#1135]: Fix PowerShell env variable initialization on Windows by sourcing functions from the PowerShell profile
 * https://github.com/devonfw/IDEasy/issues/741[#741]: Add a warning message for legacy devonfw-ide settings users
+* https://github.com/devonfw/IDEasy/issues/989[#989]: Allow expressions in template variable definitions
 * https://github.com/devonfw/IDEasy/issues/1933[#1933]: Added a console panel to the GUI
 
 The full list of changes for this release can be found in https://github.com/devonfw/IDEasy/milestone/49?closed=1[milestone 2026.08.002].

cli/src/main/java/com/devonfw/tools/ide/context/AbstractIdeContext.java

@@ -10,13 +10,15 @@
 import java.time.LocalDateTime;
 import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Objects;
 import java.util.Properties;
+import java.util.Set;
 import java.util.function.Predicate;
 import java.util.logging.FileHandler;
 import java.util.logging.LogManager;
@@ -178,8 +180,18 @@ public abstract class AbstractIdeContext implements IdeContext, IdeLogArgFormatt
 
   private WindowsHelper windowsHelper;
 
+  /** The replacement used to mask a secret in log output. */
+  private static final String SECRET_MASK = "********";
+
+  /** Minimum length of a value to be masked as a secret in log output. Masking a very short value would corrupt unrelated log messages. */
+  private static final int SECRET_MIN_LENGTH = 3;
+
   private final Map<String, String> privacyMap;
 
+  private final Set<String> secrets;
+
+  private final Set<String> secretVariables;
+
   private Path bash;
 
   private boolean julConfigured;
@@ -200,6 +212,8 @@ public AbstractIdeContext(IdeStartContextImpl startContext, Path workingDirector
     this.startContext = startContext;
     this.startContext.setArgFormatter(this);
     this.privacyMap = new HashMap<>();
+    this.secrets = new HashSet<>();
+    this.secretVariables = new HashSet<>();
     this.systemInfo = SystemInfoImpl.INSTANCE;
     if (isTest()) {
       configureJavaUtilLogging(null);
@@ -1050,9 +1064,41 @@ public String formatArgument(Object argument) {
       }
       result = PrivacyUtil.removeSensitivePathInformation(result);
     }
+    // Secrets are masked independent of the privacy mode: a value the user entered as a secret or that belongs to a
+    // variable marked as secret must never appear in any log output. This is done here since formatArgument is the
+    // single place all log arguments pass through, so no individual log statement can be forgotten.
+    for (String secret : this.secrets) {
+      result = result.replace(secret, SECRET_MASK);
+    }
     return result;
   }
 
+  @Override
+  public void addSecretVariable(String name) {
+
+    if ((name != null) && !name.isEmpty()) {
+      this.secretVariables.add(name);
+    }
+  }
+
+  @Override
+  public void addSecretValue(String name, String value) {
+
+    if (this.secretVariables.contains(name)) {
+      addSecret(value);
+    }
+  }
+
+  /**
+   * @param secret the secret value to mask in all log output. Ignored if {@code null} or shorter than {@link #SECRET_MIN_LENGTH}.
+   */
+  protected void addSecret(String secret) {
+
+    if ((secret != null) && (secret.length() >= SECRET_MIN_LENGTH)) {
+      this.secrets.add(secret);
+    }
+  }
+
   /**
    * @param path the sensitive {@link Path} to
    * @param replacement the replacement to mask the {@link Path} in log output.
@@ -1082,6 +1128,27 @@ private void resetPrivacyMap() {
   @Override
   public String askForInput(String message, String defaultValue) {
 
+    return ask(message, defaultValue, false);
+  }
+
+  @Override
+  public String askForSecret(String message, String defaultValue) {
+
+    return ask(message, defaultValue, true);
+  }
+
+  /**
+   * Asks the user for a value, re-asking while the input is empty and a default value is given.
+   *
+   * @param message the question to ask.
+   * @param defaultValue the value to return if the user accepts the default (by entering an empty value) or {@code null} to re-ask until a value is
+   *     entered.
+   * @param secret - {@code true} to read the input in a masked way (see {@link #readSecretLine()}) and to mask it in the log output, {@code false} to
+   *     read it as plain text.
+   * @return the entered value or the default value.
+   */
+  private String ask(String message, String defaultValue, boolean secret) {
+
     while (true) {
       if (!message.isBlank()) {
         IdeLogLevel.INTERACTION.log(LOG, message);
@@ -1093,11 +1160,18 @@ public String askForInput(String message, String defaultValue) {
           throw new CliAbortException();
         }
       }
-      String input = readLine().trim();
+      // for a secret the input is not trimmed so that a leading or trailing whitespace that is part of the password or a pasted token is preserved
+      String input = secret ? readSecretLine() : readLine().trim();
       if (!input.isEmpty()) {
+        if (secret) {
+          addSecret(input);
+        }
         return input;
       } else {
         if (defaultValue != null) {
+          if (secret) {
+            addSecret(defaultValue);
+          }
           return defaultValue;
         }
       }
@@ -1171,6 +1245,15 @@ private static String computeOptionKey(String option) {
    */
   protected abstract String readLine();
 
+  /**
+   * @return the secret input from the end-user (e.g. read from the console without echoing it). The default implementation simply delegates to
+   *     {@link #readLine()} so that sub-classes without a secure console (e.g. in tests) work out of the box.
+   */
+  protected String readSecretLine() {
+
+    return readLine();
+  }
+
   private static <O> void addMapping(Map<String, O> mapping, String key, O option) {
 
     O duplicate = mapping.put(key, option);

cli/src/main/java/com/devonfw/tools/ide/context/IdeContext.java

@@ -280,6 +280,42 @@ default String askForInput(String message) {
     return askForInput(message, null);
   }
 
+  /**
+   * Asks the user for a single secret input (e.g. a password or API token). Unlike {@link #askForInput(String, String)} the input is not echoed to the console
+   * if a secure console is available.
+   *
+   * @param message The information message to display.
+   * @param defaultValue The default value to return when no input is provided or {@code null} to keep asking until the user entered a non empty value.
+   * @return The secret input from the user, or the default value if no input is provided.
+   */
+  String askForSecret(String message, String defaultValue);
+
+  /**
+   * Asks the user for a single secret input (e.g. a password or API token).
+   *
+   * @param message The information message to display.
+   * @return The secret input from the user.
+   */
+  default String askForSecret(String message) {
+    return askForSecret(message, null);
+  }
+
+  /**
+   * Marks the variable with the given name as secret so that its value is masked in all log output, even if the value is not entered by the user but read from
+   * an existing {@code ide.properties}.
+   *
+   * @param name the name of the variable (e.g. "MY_API_TOKEN").
+   */
+  void addSecretVariable(String name);
+
+  /**
+   * Registers the value of a variable as secret if the variable was marked via {@link #addSecretVariable(String)}. Has to be called before the value is logged.
+   *
+   * @param name the name of the variable.
+   * @param value the value of the variable.
+   */
+  void addSecretValue(String name, String value);
+
   /**
    * @param question the question to ask.
    * @param args arguments for filling the templates

cli/src/main/java/com/devonfw/tools/ide/context/IdeContextConsole.java

@@ -52,6 +52,21 @@ protected String readLine() {
     }
   }
 
+  @Override
+  protected String readSecretLine() {
+
+    if (this.scanner == null) {
+      char[] password = System.console().readPassword();
+      if (password == null) {
+        return "";
+      }
+      return new String(password);
+    } else {
+      LOG.warn("System console not available - secret input will be visible while typing.");
+      return this.scanner.nextLine();
+    }
+  }
+
   @Override
   public IdeProgressBar newProgressBar(String title, long size, String unitName, long unitSize) {
 

cli/src/main/java/com/devonfw/tools/ide/environment/AbstractEnvironmentVariables.java

@@ -12,6 +12,9 @@
 import org.slf4j.event.Level;
 
 import com.devonfw.tools.ide.context.IdeContext;
+import com.devonfw.tools.ide.expression.ExpressionContext;
+import com.devonfw.tools.ide.expression.ExpressionFunctionManager;
+import com.devonfw.tools.ide.expression.ExpressionParser;
 import com.devonfw.tools.ide.variable.IdeVariables;
 import com.devonfw.tools.ide.variable.VariableDefinition;
 import com.devonfw.tools.ide.variable.VariableSyntax;
@@ -34,6 +37,8 @@ public abstract class AbstractEnvironmentVariables implements EnvironmentVariabl
 
   private static final int MAX_RECURSION = 9;
 
+  private static final ExpressionParser EXPRESSION_PARSER = new ExpressionParser(ExpressionFunctionManager.get());
+
   /**
    * @see #getParent()
    */
@@ -206,14 +211,19 @@ private String resolveRecursive(String value, Object source, int recursion, Abst
     }
     recursion++;
 
+    // Expressions are evaluated before plain variables so that a function argument may contain variables and so that a variable value can never change
+    // the structure of an enclosing expression (e.g. by containing a quote or a parenthesis). Note that the variable pass below still scans the result
+    // of a function, exactly like it scans the value of a plain variable, so a resolved value containing "$[" is resolved further.
+    String withExpressions = EXPRESSION_PARSER.resolve(value, new EnvironmentExpressionContext(source, recursion, resolvedVars, context));
+
     String resolved;
     if (context.syntax == null) {
-      resolved = resolveWithSyntax(value, source, recursion, resolvedVars, context, VariableSyntax.SQUARE);
+      resolved = resolveWithSyntax(withExpressions, source, recursion, resolvedVars, context, VariableSyntax.SQUARE);
       if (context.legacySupport) {
         resolved = resolveWithSyntax(resolved, source, recursion, resolvedVars, context, VariableSyntax.CURLY);
       }
     } else {
-      resolved = resolveWithSyntax(value, source, recursion, resolvedVars, context, context.syntax);
+      resolved = resolveWithSyntax(withExpressions, source, recursion, resolvedVars, context, context.syntax);
     }
     return resolved;
   }
@@ -357,6 +367,60 @@ public String toString() {
     return getSource().toString();
   }
 
+  /**
+   * Implementation of {@link ExpressionContext} that connects an {@link com.devonfw.tools.ide.expression.ExpressionFunction} with this
+   * {@link EnvironmentVariables} hierarchy.
+   */
+  private final class EnvironmentExpressionContext implements ExpressionContext {
+
+    private final Object src;
+
+    private final int recursion;
+
+    private final AbstractEnvironmentVariables resolvedVars;
+
+    private final ResolveContext context;
+
+    private EnvironmentExpressionContext(Object src, int recursion, AbstractEnvironmentVariables resolvedVars, ResolveContext context) {
+
+      super();
+      this.src = src;
+      this.recursion = recursion;
+      this.resolvedVars = resolvedVars;
+      this.context = context;
+    }
+
+    @Override
+    public IdeContext getIdeContext() {
+
+      return AbstractEnvironmentVariables.this.context;
+    }
+
+    @Override
+    public String resolve(String value) {
+
+      return this.resolvedVars.resolveRecursive(value, this.src, this.recursion, this.resolvedVars, this.context);
+    }
+
+    @Override
+    public String getVariable(String name) {
+
+      return this.resolvedVars.getValue(name, false);
+    }
+
+    @Override
+    public void setVariable(String name, String value, EnvironmentVariablesType type) {
+
+      EnvironmentVariables variables = getByType(type);
+      if (variables instanceof EnvironmentVariablesPropertiesFile propertiesFile) {
+        propertiesFile.set(name, value);
+        propertiesFile.save();
+      } else {
+        LOG.warn("Cannot persist variable {} since no configuration file is available for {}.", name, type);
+      }
+    }
+  }
+
   /**
    * Simple record for the immutable arguments of recursive resolve methods.
    *

cli/src/main/java/com/devonfw/tools/ide/environment/EnvironmentVariablesMap.java

@@ -38,6 +38,9 @@ public String getFlat(String name) {
     if (value == null) {
       LOG.trace("{}: Variable {} is undefined.", getSource(), name);
     } else {
+      // register the value before it is logged so that a secret variable read from an existing ide.properties is
+      // masked as well, not only a value that was just entered by the user
+      this.context.addSecretValue(name, value);
       LOG.trace("{}: Variable {}={}", getSource(), name, value);
       WindowsPathSyntax pathSyntax = this.context.getPathSyntax();
       if (pathSyntax != null) {

cli/src/main/java/com/devonfw/tools/ide/expression/ExpressionContext.java

@@ -0,0 +1,41 @@
+package com.devonfw.tools.ide.expression;
+
+import com.devonfw.tools.ide.context.IdeContext;
+import com.devonfw.tools.ide.environment.EnvironmentVariablesType;
+
+/**
+ * Interface for the context available to an {@link ExpressionFunction} while an expression is evaluated.
+ */
+public interface ExpressionContext {
+
+  /**
+   * @return the {@link IdeContext}.
+   */
+  IdeContext getIdeContext();
+
+  /**
+   * Resolves variables in the given value. Used to resolve arguments of a function that may themselves contain
+   * variables or nested expressions (e.g. {@code @path('$[IDE_HOME]/software/node')}).
+   *
+   * @param value the value to resolve.
+   * @return the given value with variables and nested expressions resolved.
+   */
+  String resolve(String value);
+
+  /**
+   * @param name the name of the variable.
+   * @return the value of the variable or {@code null} if not defined in any level of the hierarchy.
+   */
+  String getVariable(String name);
+
+  /**
+   * Persists the given variable to the {@code ide.properties} of the given {@link EnvironmentVariablesType configuration location} so the user is not asked
+   * again.
+   *
+   * @param name the name of the variable.
+   * @param value the value to persist.
+   * @param type the {@link EnvironmentVariablesType} determining the {@code ide.properties} to write to.
+   */
+  void setVariable(String name, String value, EnvironmentVariablesType type);
+
+}