fix: do not surface hidden options in implications error (#2540) - #2587

Summary

yargs.implications() (used by .implies()) currently includes the names of hidden options in its "Implications failed" error. Hidden options are marked hidden: true precisely so they stay out of user-facing output (help, completion), so leaking their names in a validation error is a bug. Reported in #2540.

Reproduction

yargs(['--remote-debugging-port', '9222'])
  .option('hidden-debug', {type: 'boolean', hidden: true})
  .option('remote-debugging-port', {hidden: true})
  .implies('remote-debugging-port', 'hidden-debug')
  .parse();

Before this change, the failure message was:

Implications failed:
 remote-debugging-port -> hidden-debug

disclosing both internal option names.

Fix

In lib/validation.ts, self.implications() now skips any implication where either the key or the value is a hidden option, using the same yargs.getOptions().hiddenOptions source of truth that help and completion already use. Hidden options are internal, so they should not produce (or appear in) user-facing validation errors.

Test

Added a regression test in test/validation.mjs asserting that an implication involving only hidden options does not surface their names (and raises no error).

npm test passes — 833 passing, lint clean.