`@std/cli`: move informational output to `stderr` (instead of `stdout`)

[jsejcksn]

Refer to the comments beginning here for context: #5002 (comment)

It appears that some modules (e.g. spinner.ts and prompt_secret.ts, but there may be more) are still writing informational output to stdout. Is this really the intended behavior?

[iuioiua]

This sounds reasonable to me. I've created #5497 to play with the idea with Spinner. The errors need fixing.

This might be a little trickier to do with promptSecret(), as it's now a stable API (as of yesterday 😅).

WDYT, @kt3k?

[kt3k]

How about making the output destination optional (like, output: "stderr") instead of changing the default behavior?

[jsejcksn]

How about making the output destination optional (like, output: "stderr") instead of changing the default behavior?

@kt3k In the linked issue that took place prior to stabilization, I explained why stdout should not be used for informational output. In short: writing to stdout by default will corrupt any expected structured output from a process (e.g. streams, piped data, structured logs, etc.)

[kt3k]

We can do that for Spinner. But we'd like to avoid changing it for promptSecret as it's already stabilized.

will corrupt any expected structured output from a process (e.g. streams, piped data, structured logs, etc.)

I think this generally doesn't apply to promptSecret because when promptSecret is used, then stdin/stdout should be the terminal

[jsejcksn]

But we'd like to avoid changing it for promptSecret as it's already stabilized.

I think this is unfortunate because these concerns were raised prior to stabilization, but no maintainer engaged them.

[iuioiua]

Apologies, @jsejcksn. Yes, this slipped under the radar before stabilization. But that might not be a big deal. As Yoshiya mentioned, we can make changes to Spinner, as it's unstable. I agree that promptSecret() should probably be kept as-is, but not because it's stable. Rather, promptSecret() should align with runtime behavior of prompt(), which outputs to stdin. So until prompt() changes, I don't think we should change promptSecret().

[jsejcksn]

Rather, promptSecret() should align with runtime behavior of prompt(), which outputs to stdin. So until prompt() changes, I don't think we should change promptSecret().

@iuioiua I think you mean that it outputs to stdout? It looks like Deno uses rustyline for its prompt op, which appears to use stdout for output. Is the design intention of promptSecret to mimic Deno's implementation of prompt as closely as possible — with the exception of concealing the input? If so, then I agree with your reasoning here.

[iuioiua]

Sorry, yes, I mean't stdout. And yes, it is intentional for promptSecret() to mimic Deno's implementation of prompt(), except for concealing the input.