Deploy and diff plans no longer show credentials (CLI 0.11.0)

yorker deploy and yorker diff print a plan of what would change. When a field holding a credential changed, for example a bearer token you had just rotated, the plan printed the old and the new value. In a CI job that put both tokens in the log.

From @yorker/cli@0.11.0 the plan masks credentials:

    ~ UPDATE  http  "Orders API"
        ~ configJson.auth.token  (changed, value hidden)

Two things are masked. Values that come from your secrets: list are replaced with ***REDACTED*** wherever they appear. Fields that hold credentials (auth tokens and passwords, header values, Slack webhook URLs, PagerDuty routing keys, credentials inside a URL) are masked whatever their value, which covers an old token the CLI was never given. A change to a request body or a browser script is reported without its content, because a credential can sit anywhere in either.

The path of a monitor's URL is still shown, because that is usually the thing you are checking in a plan. If a URL carries a token in its path, reference it with {{secrets.NAME}} so it is masked.

If you ran yorker deploy or yorker diff in CI with a credential change before this release, check those job logs and rotate anything that appears in them.

Breaking: the JSON plan

This is why the release is 0.11.0 and not a patch.

yorker deploy --json and yorker diff --json used to include a local and a remote object on every entry in changes, holding the whole resource, credentials included, even when nothing had changed. Those two fields are gone. Each entry now has:

• type, kind, name, remoteId and fieldChanges, as before
• checkType on checks (http, browser or mcp), which replaces reading local.type
• frequencySeconds and locationCount on checks being created

A field change whose values were masked has "redacted": true.

If a script reads changes[].local or changes[].remote, it needs to change. The details are in the CLI reference.