From 7f1ea66af1c5f07c61de1cba7858fc0a06fe0eea Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 9 Jul 2026 03:24:14 +0000
Subject: [PATCH] Fix `ProcessManager::obscure` to handle secrets starting with
 hyphens

The `rclone obscure` command interprets secrets starting with a hyphen (like `-password`) as command flags, resulting in a fatal error. Adding `--` to the command arguments correctly forces the secret to be treated as a positional argument.

Co-authored-by: insign <1113045+insign@users.noreply.github.com>
---
 src/ProcessManager.php       | 2 +-
 tests/Unit/EdgeCasesTest.php | 8 ++++++++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/ProcessManager.php b/src/ProcessManager.php
index f7d0930..d9358f5 100644
--- a/src/ProcessManager.php
+++ b/src/ProcessManager.php
@@ -260,7 +260,7 @@ public static function obscure(string $secret): string
             throw new InvalidArgumentException('Cannot obscure an empty secret.');
         }
 
-        $process = new Process([self::getBin(), 'obscure', $secret]);
+        $process = new Process([self::getBin(), 'obscure', '--', $secret]);
         $process->setTimeout(3);
         $process->mustRun();
 
diff --git a/tests/Unit/EdgeCasesTest.php b/tests/Unit/EdgeCasesTest.php
index 00a9cd1..04e7c1a 100644
--- a/tests/Unit/EdgeCasesTest.php
+++ b/tests/Unit/EdgeCasesTest.php
@@ -169,6 +169,14 @@ public function format_bytes_edge_cases(): void
         $this->assertEquals('1 MiB', StatsParser::formatBytes(1048576));
     }
 
+    #[Test]
+    public function obscure_with_hyphen(): void
+    {
+        $obscured = \Verseles\Flyclone\ProcessManager::obscure('-my-password');
+        $this->assertNotEmpty($obscured);
+        $this->assertStringNotContainsString('-my-password', $obscured);
+    }
+
     #[Test]
     public function deeply_nested_directory_structure(): void
     {