Need a better error message when using extensions without `--enable-ext`

[xdxxxdx]

Prerequisites:

• cwltool 3.2.20260413085819
• I have saved https://github.com/common-workflow-language/cwltool/blob/8949fc2d68efe128ce841739d1190645dbd233bb/tests/wf/secret_job.cwl as job.cwl

Scenario:

I run:

cwltool job.cwl --pw="password"

Current result:

I’m not sure whether the secrets are being handled correctly, as I see the following warning in the logs:

WARNING job.cwl:7:3: Warning: checking item
             Warning:   Field 'class' contains undefined reference to
             'http://commonwl.org/cwltool#Secrets'

Thanks.

[mr-c]

Hello @xdxxxdx ; please try again with cwltool --enable-ext job.cwl --pw="password"

[xdxxxdx]

Hey @mr-c ,

Thanks so much for your reply, I added the tag, and the warning is gone. What I am trying to do actually is try to pass the secret token into the docker container which is configured as a requirement for a CommandLineTool.

Environment

• cwltool: 3.1.20260315121657 (from my run output)
• docker backend (cwltool is launching containers)
• I run cwltool with: --enable-ext --leave-container

What I did

• In my workflow I marked an input as secret using the cwltool secret hint, e.g.:

hints:
  "cwltool:Secrets":
    secrets: [stats_rate]

• The workflow defines stats_rate as a string input and passes it to a CommandLineTool step that runs a Docker image.

Observed behaviour

• cwltool masks the value in logs and the generated docker command shows the masked placeholder being passed as an argument to the container, for example:

...snip of the important log fragment...
INFO [job run_sst_step] /tmp/... docker run ... container:1.0.0 \
  ... \
  --stats_rate \
  '(secret-115d2ff6-72c5-4a6a-a5ba-ef5472b52d8c)' \
  ...
...snip...

Current behavior:

• The container process receives the masked placeholder '(secret-...)' and fails because that string is not a valid runtime value for the tool (it expects something like "1000ps"). The job exits with status 1.

My expectation

• I expected that marking an input as secret would cause the runner to (a) avoid logging the literal secret, and (b) still ensure the runtime command inside the container receives the real secret value.

Questions

1. Is it expected behaviour for cwltool to pass the literal masked placeholder (e.g., '(secret-...)') into the container process (i.e. the container gets only the placeholder and not the original cleartext)? Or is this a sign of my misconfiguration/limited runner support?

Thanks so much

[mr-c]

Hey @mr-c ,

Thanks so much for your reply, I added the tag, and the warning is gone. What I am trying to do actually is try to pass the secret token into the docker container which is configured as a requirement for a CommandLineTool.

Environment

* cwltool: 3.1.20260315121657 (from my run output)

* docker backend (cwltool is launching containers)

* I run cwltool with: --enable-ext --leave-container

What I did

* In my workflow I marked an input as secret using the cwltool secret hint, e.g.:

hints:
"cwltool:Secrets":
secrets: [stats_rate]

* The workflow defines `stats_rate` as a string input and passes it to a CommandLineTool step that runs a Docker image.

Observed behaviour

* cwltool masks the value in logs and the generated docker command shows the masked placeholder being passed as an argument to the container, for example:

...snip of the important log fragment...
INFO [job run_sst_step] /tmp/... docker run ... container:1.0.0 \
  ... \
  --stats_rate \
  '(secret-115d2ff6-72c5-4a6a-a5ba-ef5472b52d8c)' \
  ...
...snip...

This is correct, the secret should not be printed to the log, even here in the docker command.

Current behavior:

* The container process receives the masked placeholder '(secret-...)' and fails because that string is not a valid runtime value for the tool (it expects something like "1000ps"). The job exits with status 1.

Are you sure the container did not receive the correct password?

When I change the example from your original post as thusly

diff --git a/tests/wf/secret_job.cwl b/tests/wf/secret_job.cwl
index 061e7128..c9a6a29d 100755
--- a/tests/wf/secret_job.cwl
+++ b/tests/wf/secret_job.cwl
@@ -17,4 +17,4 @@ inputs:
   pw: string
 outputs:
   out: stdout
-arguments: [cat, example.conf]
+arguments: [echo, $(inputs.pw)]

And I run it, the docker command is censored, but the correct output is captured

$ cwltool --enable-ext --leave-container tests/wf/secret_wf.cwl --pw="password_23"
INFO /home/michael/cwltool/env3.14/bin/cwltool 3.2.20260413085820.dev10+g6f0ae648e
INFO Resolved 'tests/wf/secret_wf.cwl' to 'file:///home/michael/cwltool/tests/wf/secret_wf.cwl'
INFO [workflow ] start
INFO [workflow ] starting step step1
INFO [step step1] start
INFO [job step1] /tmp/fwram2ng$ docker \
    run \
    -i \
    --mount=type=bind,source=/tmp/fwram2ng,target=/TUbjsU \
    --mount=type=bind,source=/tmp/b9n6l2yi,target=/tmp \
    --workdir=/TUbjsU \
    --read-only=true \
    --log-driver=none \
    --user=1000:1000 \
    --rm \
    --cidfile=/tmp/wyy03115/20260630143745-394200.cid \
    --env=TMPDIR=/tmp \
    --env=HOME=/TUbjsU \
    docker.io/debian:stable-slim \
    echo \
    '(secret-c3cb8579-77fd-4fb5-9441-5e192b429e34)' > /tmp/fwram2ng/c2e199feaa3fb6a91312250923c2a04aeaae9851
INFO [job step1] completed success
INFO [step step1] completed success
INFO [workflow ] completed success
{
    "out": {
        "location": "file:///home/michael/cwltool/c2e199feaa3fb6a91312250923c2a04aeaae9851",
        "basename": "c2e199feaa3fb6a91312250923c2a04aeaae9851",
        "class": "File",
        "checksum": "sha1$0499f224e4b5f5764636f11766a77857ec6befae",
        "size": 12,
        "path": "/home/michael/cwltool/c2e199feaa3fb6a91312250923c2a04aeaae9851"
    }
}
INFO Final process status is success
$ cat c2e199feaa3fb6a91312250923c2a04aeaae9851
password_23