{"record":{"id":"2a5c4b7aec17bbd0","repo":"windmill-labs/windmill","slug":"use-show-secrets-to-include-them-or-press-y-to","errorCode":null,"errorMessage":"Use --show-secrets to include them, or press Y to show them now.","messagePattern":"Use --show-secrets to include them, or press Y to show them now\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"cli/src/commands/instance/instance.ts","lineNumber":677,"sourceCode":"    return opts.instance;\n  }\n  try {\n    return await readTextFile(await getActiveInstanceFilePath());\n  } catch {\n    return undefined;\n  }\n}\n\nasync function getConfig(opts: InstanceSyncOptions & { outputFile?: string; showSecrets?: boolean }) {\n  await pickInstance(opts, false);\n  const config = await wmill.getInstanceConfig() as any;\n\n  // In interactive mode, mask secrets by default and prompt\n  const hasSecrets = config?.global_settings?.license_key || config?.global_settings?.jwt_secret;\n  let showSecrets = opts.showSecrets ?? false;\n  if (!showSecrets && hasSecrets && process.stdout.isTTY && !opts.outputFile) {\n    log.warn(\"Config contains sensitive fields (license_key, jwt_secret). They are masked by default.\");\n    log.warn(\"Use --show-secrets to include them, or press Y to show them now.\");\n    showSecrets = await Confirm.prompt({ message: \"Show secrets?\", default: false });\n  } else if (!process.stdout.isTTY || opts.outputFile) {\n    // Non-interactive or writing to file: always include secrets\n    showSecrets = true;\n  }\n\n  if (!showSecrets && config?.global_settings) {\n    if (config.global_settings.license_key) config.global_settings.license_key = \"***\";\n    if (config.global_settings.jwt_secret) config.global_settings.jwt_secret = \"***\";\n  }\n\n  const yaml = yamlStringify(config as Record<string, unknown>);\n  if (opts.outputFile) {\n    await writeFile(opts.outputFile, yaml, \"utf-8\");\n    log.info(colors.green(`Instance config written to ${opts.outputFile}`));\n  } else {\n    console.log(yaml);\n  }","sourceCodeStart":659,"sourceCodeEnd":695,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/instance/instance.ts#L659-L695","documentation":"Second half of the masking notice in `wmill instance get-config`: it tells the user the two ways to unmask — the `--show-secrets` flag or pressing Y at the confirmation prompt. It is only printed when secrets exist, stdout is a TTY, and no output file is set.","triggerScenarios":"Same conditions as the masking warning: `wmill instance get-config` with license_key/jwt_secret present, interactive TTY, no `--show-secrets`, no `--outputFile`.","commonSituations":"Users who missed the flag in `--help`; scripts that wrap interactive sessions and only capture the first warning line.","solutions":["Rerun with `--show-secrets` to include the fields without prompting.","Press Y at the 'Show secrets?' confirm for this invocation only.","Use `--output-file` to write the unmasked config to a file (kept secure)."],"exampleFix":"// before\nwmill instance get-config\n// after\nwmill instance get-config --show-secrets","handlingStrategy":"validation","validationCode":"// same pre-check as the masking notice\nconst cfg = await wmill.getInstanceConfig() as any;\nif (cfg?.global_settings?.license_key || cfg?.global_settings?.jwt_secret) {\n  console.log('run with --show-secrets to see raw values');\n}","typeGuard":"function needsShowSecrets(opts: { showSecrets?: boolean; outputFile?: string }): boolean {\n  return !opts.showSecrets && !opts.outputFile;\n}","tryCatchPattern":"null","preventionTips":["Prefer the explicit `--show-secrets` flag over the interactive prompt in scripted flows.","Treat the paired warnings as one notice: masking is active until you opt in."],"tags":["cli","secrets","security","masking"],"backgroundTag":"sensitive-output-masked","analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}