wip

docs/content/using-npm/config.md

@@ -1025,13 +1025,26 @@ See also the `foreground-scripts` config.
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
+#### `logs-dir`
+
+* Default: A directory named `_logs` inside the cache
+* Type: null or Path
+
+The location of npm's log directory. See [`npm logging`](/using-npm/logging)
+for more information.
+
+<!-- automatically generated, do not edit manually -->
+<!-- see lib/utils/config/definitions.js -->
+
 #### `logs-max`
 
 * Default: 10
 * Type: Number
 
 The maximum number of log files to store.
 
+If set to 0, no log files will be written for the current run.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
@@ -1626,9 +1639,9 @@ particular, use care when overriding this setting for public packages.
 * Default: false
 * Type: Boolean
 
-If true, writes an `npm-debug` log to `_logs` and timing information to
-`_timing.json`, both in your cache, even if the command completes
-successfully. `_timing.json` is a newline delimited list of JSON objects.
+If true, writes a debug log to `logs-dir` and timing information to
+`_timing.json` in the cache, even if the command completes successfully.
+`_timing.json` is a newline delimited list of JSON objects.
 
 You can quickly view it with this [json](https://npm.im/json) command line:
 `npm exec -- json -g < ~/.npm/_timing.json`.

docs/content/using-npm/logging.md

@@ -1,13 +1,24 @@
 ---
 title: Logging
 section: 7
-description: Why, What & How we Log
+description: Why, What & How We Log
 ---
 
 ### Description
 
 The `npm` CLI has various mechanisms for showing different levels of information back to end-users for certain commands, configurations & environments.
 
+### Setting Log File Location
+
+All logs are written to a debug log, with the path to that file printed if the execution of a command fails.
+
+The default location of the logs directory is a directory named `_logs` inside the npm cache. This can be changed
+with the `logs-dir` config option.
+
+Log files will be removed from the `logs-dir` when the number of log files exceeds `logs-max`, with the oldest logs being deleted first.
+
+To turn off logs completely set `--logs-max=0`.
+
 ### Setting Log Levels
 
 #### `loglevel`
@@ -28,8 +39,6 @@ The default value of `loglevel` is `"notice"` but there are several levels/types
 
 All logs pertaining to a level proceeding the current setting will be shown.
 
-All logs are written to a debug log, with the path to that file printed if the execution of a command fails.
-
 ##### Aliases
 
 The log levels listed above have various corresponding aliases, including:
@@ -47,6 +56,15 @@ The log levels listed above have various corresponding aliases, including:
 
 The `npm` CLI began hiding the output of lifecycle scripts for `npm install` as of `v7`. Notably, this means you will not see logs/output from packages that may be using "install scripts" to display information back to you or from your own project's scripts defined in `package.json`. If you'd like to change this behavior & log this output you can set `foreground-scripts` to `true`.
 
+### Timing Information
+
+The `--timing` config can be set which does two things:
+
+1. Always shows the full path to the debug log regardless of command exit status
+1. Write timing information to a timing file in the cache or `logs-dir`
+
+This file is a newline delimited list of JSON  objects that can be inspected to see timing data for each task in a `npm` CLI run.
+
 ### Registry Response Headers
 
 #### `npm-notice`
@@ -55,6 +73,15 @@ The `npm` CLI reads from & logs any `npm-notice` headers that are returned from
 
 This header is not cached, and will not be logged if the request is served from the cache.
 
+### Logs and Sensitive Information
+
+The `npm` CLI makes a best effort to redact the following from terminal output and log files:
+
+- Passwords inside basic auth URLs
+- npm tokens
+
+However, this behavior should not be relied on to keep all possible sensitive information redacted. If you are concerned about secrets in your log file or terminal output, you can use `--loglevel=silent` and `--logs-max=0` to ensure no logs are written to your terminal or filesystem.
+
 ### See also
 
 * [config](/using-npm/config)

lib/cli.js

@@ -30,14 +30,12 @@ module.exports = async process => {
   }
 
   const log = require('./utils/log-shim.js')
-  const replaceInfo = require('./utils/replace-info.js')
-  log.verbose('cli', replaceInfo(process.argv))
-
+  // only log node and npm paths in argv initially since argv can contain
+  // sensitive info. a cleaned version will be logged later
+  log.verbose('cli', process.argv.slice(0, 2).join(' '))
   log.info('using', 'npm@%s', npm.version)
   log.info('using', 'node@%s', process.version)
 
-  const updateNotifier = require('./utils/update-notifier.js')
-
   let cmd
   // now actually fire up npm and run the command.
   // this is how to use npm programmatically:
@@ -54,8 +52,6 @@ module.exports = async process => {
       npm.config.set('usage', false, 'cli')
     }
 
-    updateNotifier(npm)
-
     cmd = npm.argv.shift()
     if (!cmd) {
       npm.output(await npm.usage)

lib/commands/bin.js

@@ -1,3 +1,4 @@
+const log = require('../utils/log-shim.js')
 const envPath = require('../utils/path.js')
 const BaseCommand = require('../base-command.js')
 
@@ -11,8 +12,7 @@ class Bin extends BaseCommand {
     const b = this.npm.bin
     this.npm.output(b)
     if (this.npm.config.get('global') && !envPath.includes(b)) {
-      // XXX: does this need to be console?
-      console.error('(not in PATH env variable)')
+      log.error('bin', '(not in PATH env variable)')
     }
   }
 }

lib/commands/doctor.js

@@ -131,10 +131,6 @@ class Doctor extends BaseCommand {
 
     if (!this.npm.silent) {
       this.npm.output(table(outTable, tableOpts))
-      if (!allOk) {
-        // TODO is this really needed?
-        console.error('')
-      }
     }
     if (!allOk) {
       throw new Error('Some problems found. See above for recommendations.')

lib/commands/view.js

@@ -1,3 +1,6 @@
+/* eslint-disable no-console */
+// XXX: remove console.log later
+
 // npm view [pkg [pkg ...]]
 
 const color = require('ansicolors')