refactor(wrangler): add safe command/args handling for telemetry

- Rename 'command' to 'safeCommand' (without 'wrangler ' prefix) and 'args' to 'safeArgs' in telemetry events
- Add 'logArgs' boolean to control whether command arguments are included in telemetry
- Commands must explicitly opt-in via metadata.logArgs: true to log arguments
- Safe commands (list, info, get, etc.) that don't handle sensitive data opt-in to logging
- Sensitive commands (secret put/delete/bulk, hyperdrive create) intentionally do not opt-in
- Update fallback telemetry in index.ts to use new format with logArgs: false

Author: petebacondarwin

.changeset/safe-command-args-metrics.md

@@ -0,0 +1,18 @@
+---
+"wrangler": patch
+---
+
+Sanitize commands in telemetry to prevent accidentally capturing sensitive information that users may have mistakenly pasted as command arguments.
+
+The following commands will no longer collect any telemetry on argument usage:
+
+- All secret commands: `wrangler secret put/bulk`, `wrangler pages secret put/bulk`, `wrangler versions secret put/bulk`
+- `wrangler login`
+- `wrangler kv key put`, `wrangler kv bulk put`
+- `wrangler hyperdrive create/update`
+- `wrangler r2 bucket sippy enable`
+- `wrangler d1 execute`
+- `wrangler secrets-store secret create/update`
+- `wrangler workflows trigger`, `wrangler workflows instances send-event`
+- Generally commands with file paths that could reveal sensitive structure
+- Any command not explicitly marked as safe

packages/wrangler/src/__tests__/metrics.test.ts

@@ -241,8 +241,9 @@ describe("metrics", () => {
 				argsUsed: [],
 				argsCombination: "",
 				agent: null,
-				command: "wrangler docs",
-				args: {},
+				safeCommand: "docs",
+				safeArgs: {},
+				logArgs: true,
 			};
 			beforeEach(() => {
 				// Default: no agent detected
@@ -480,7 +481,7 @@ describe("metrics", () => {
 
 				expect(requests.count).toBe(2);
 				expect(std.debug).toContain('"argsCombination":""');
-				expect(std.debug).toContain('"command":"wrangler login"');
+				expect(std.debug).toContain('"safeCommand":"login"');
 			});
 
 			it("should include args provided by the user", async () => {

packages/wrangler/src/ai/listCatalog.ts

@@ -8,6 +8,7 @@ export const aiModelsCommand = createCommand({
 		description: "List catalog models",
 		status: "stable",
 		owner: "Product: AI",
+		logArgs: true,
 	},
 	behaviour: {
 		printBanner: (args) => !args.json,

packages/wrangler/src/ai/listFinetune.ts

@@ -9,6 +9,7 @@ export const aiFineTuneListCommand = createCommand({
 		description: "List your finetune files",
 		status: "stable",
 		owner: "Product: AI",
+		logArgs: true,
 	},
 	behaviour: {
 		printBanner: (args) => !args.json,

packages/wrangler/src/core/register-yargs-command.ts

@@ -214,9 +214,17 @@ function createHandler(
 					}
 				}
 
+				// Compute safe telemetry properties
+				// Strip "wrangler " prefix to get safeCommand (e.g., "wrangler dev" -> "dev")
+				const safeCommand = commandName.replace(/^wrangler\s*/, "");
+				const logArgs = def.metadata.logArgs ?? false;
+				// If logArgs is false, send empty object; otherwise pass full args
+				const safeArgs = logArgs ? args : {};
+
 				dispatcher.sendCommandEvent("wrangler command started", {
-					command: commandName,
-					args,
+					safeCommand,
+					safeArgs,
+					logArgs,
 				});
 
 				try {
@@ -230,8 +238,9 @@ function createHandler(
 
 					const durationMs = Date.now() - startTime;
 					dispatcher.sendCommandEvent("wrangler command completed", {
-						command: commandName,
-						args,
+						safeCommand,
+						safeArgs,
+						logArgs,
 						durationMs,
 						durationSeconds: durationMs / 1000,
 						durationMinutes: durationMs / 1000 / 60,
@@ -247,8 +256,9 @@ function createHandler(
 
 					const durationMs = Date.now() - startTime;
 					dispatcher.sendCommandEvent("wrangler command errored", {
-						command: commandName,
-						args,
+						safeCommand,
+						safeArgs,
+						logArgs,
 						durationMs,
 						durationSeconds: durationMs / 1000,
 						durationMinutes: durationMs / 1000 / 60,

packages/wrangler/src/core/types.ts

@@ -76,6 +76,13 @@ export type Metadata = {
 	 * Commands without a category will appear under the default "COMMANDS" group.
 	 */
 	category?: MetadataCategory;
+	/**
+	 * If true, arguments for this command will be included in telemetry.
+	 *
+	 * @default false - Arguments are not logged by default.
+	 * Set to `true` to explicitly include this command's args in telemetry.
+	 */
+	logArgs?: boolean;
 };
 
 export type ArgDefinition = Omit<PositionalOptions, "type"> &

packages/wrangler/src/d1/delete.ts

@@ -14,6 +14,7 @@ export const d1DeleteCommand = createCommand({
 		status: "stable",
 		epilogue: "This command acts on remote D1 Databases.",
 		owner: "Product: D1",
+		logArgs: true,
 	},
 	behaviour: {
 		printBanner: true,

packages/wrangler/src/d1/info.ts

@@ -16,6 +16,7 @@ export const d1InfoCommand = createCommand({
 		epilogue: "This command acts on remote D1 Databases.",
 		status: "stable",
 		owner: "Product: D1",
+		logArgs: true,
 	},
 	behaviour: {
 		printBanner: (args) => !args.json,

packages/wrangler/src/d1/insights.ts

@@ -60,6 +60,7 @@ export const d1InsightsCommand = createCommand({
 		epilogue: "This command acts on remote D1 Databases.",
 		status: "experimental",
 		owner: "Product: D1",
+		logArgs: true,
 	},
 	behaviour: {
 		printBanner: (args) => !args.json,

packages/wrangler/src/d1/list.ts

@@ -11,6 +11,7 @@ export const d1ListCommand = createCommand({
 		epilogue: "This command acts on remote D1 Databases.",
 		status: "stable",
 		owner: "Product: D1",
+		logArgs: true,
 	},
 	behaviour: {
 		printBanner: (args) => !args.json,