Stop implicit argv logging

CHANGELOG.md

@@ -25,6 +25,12 @@ and versions are tracked in the repo-root `VERSION` file.
   timestamps and an explicit `UTC` marker when `LOG_UTC=1`, keeping Bash log
   formatting aligned with Base's Python CLI logs.
 
+### Security
+
+- Stopped emitting the caller's unredacted argument vector when wrapper
+  diagnostics are enabled, preventing sensitive option and positional values
+  from entering terminal or persistent logs.
+
 ### Deprecated
 
 - Deprecated the Bash-only `VERBOSE` level, `log_verbose*` helpers, and

lib/bash/std/README.md

@@ -312,6 +312,11 @@ set_log_category_level -l base_bash_libs.git DEBUG
 `base_bash_libs` DEBUG gate. The deprecated `--verbose-wrapper` continues to
 enable both at VERBOSE during the compatibility window.
 
+`lib_std.sh` does not log the process argument vector automatically. Arguments
+may contain credentials or other sensitive data; applications that need
+invocation diagnostics should apply schema-aware redaction before calling
+`log_debug`.
+
 Use `log_is_enabled` to avoid constructing an expensive diagnostic unless a
 terminal or persistent sink will consume it:
 

lib/bash/std/lib_std.sh

@@ -316,7 +316,6 @@ __stdlib_init__() {
         fi
     done
     __init_colors__
-    log_debug -l base_bash_libs.std "Command line: $0 ${__SCRIPT_ARGS__[*]}"
     return 0
 }
 

lib/bash/std/tests/lib_std.bats

@@ -146,6 +146,7 @@ EOF
     [[ "$output" == *"terminal-level=5"* ]]
     [[ "$output" == *"library-level=5"* ]]
     [[ "$output" != *"deprecated"* ]]
+    [[ "$output" != *"Command line:"* ]]
 }
 
 @test "--debug-wrapper enables caller and reusable-library DEBUG" {
@@ -171,6 +172,49 @@ EOF
     [[ "$output" == *"library-level=4"* ]]
 }
 
+@test "stdlib never logs process arguments automatically" {
+    local script="$TEST_TMPDIR/check-argv-logging.sh"
+    local primary_log="$TEST_TMPDIR/check-argv-logging.log"
+    local primary_content secret
+    local separate_secret="separate-secret-191"
+    local inline_secret="inline-secret-191"
+    local positional_secret="positional-secret-191"
+    local url_secret="url-secret-191"
+
+    create_script "$script" <<EOF
+#!/usr/bin/env bash
+export BASE_CLI_PRIMARY_LOG="$primary_log"
+source "$STDLIB_PATH"
+log_debug -l base_bash_libs.std "safe explicit diagnostic"
+printf 'argv-count=%s\n' "\$#"
+EOF
+
+    bats_run bash "$script" \
+        --debug-wrapper \
+        --api-token "$separate_secret" \
+        "--token=$inline_secret" \
+        "$positional_secret" \
+        "https://user:$url_secret@example.invalid/path"
+
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"safe explicit diagnostic"* ]]
+    [[ "$output" == *"argv-count=5"* ]]
+    [[ "$output" != *"Command line:"* ]]
+
+    primary_content="$(cat "$primary_log")"
+    [[ "$primary_content" == *"safe explicit diagnostic"* ]]
+    [[ "$primary_content" != *"Command line:"* ]]
+
+    for secret in \
+        "$separate_secret" \
+        "$inline_secret" \
+        "$positional_secret" \
+        "$url_secret"; do
+        [[ "$output" != *"$secret"* ]]
+        [[ "$primary_content" != *"$secret"* ]]
+    done
+}
+
 @test "sourcing stdlib stops filtering wrapper flags after --" {
     local script="$TEST_TMPDIR/check-init-escape.sh"