BASH_XTRACEFD Since bash 4.1: Always-On Traces or a Gated Debug Descriptor

BASH_XTRACEFD, introduced in bash 4.1, names a file descriptor that receives all set -x trace output. Assigning it lets a deployment script route xtrace lines to a dedicated log while stderr continues to carry only genuine errors — relevant when a CI runner treats captured stderr as the failure signal.

The behavior is version- and interpreter-bound. Before bash 4.1, and under POSIX sh, dash or ash, the variable has no effect, so tracing changes silently if the deployment runner swaps interpreters. If the descriptor is unset, closed or invalid, trace output is suppressed or the shell reports an error, which can leave a failed run looking untraced.

The unresolved operational choice is whether xtrace runs unconditionally or behind a debug flag. Traces record commands as expanded, so credentials passed through environment variables or arguments can appear verbatim; gating avoids that exposure but may leave failed runs without diagnostics.

• Should xtrace be enabled by default in deployment scripts, or only when a debug flag is set?
• How should a script detect that BASH_XTRACEFD is unavailable or that the target descriptor is invalid before depending on it?
• What redaction approach keeps expanded secrets out of trace logs while preserving enough context to reconstruct a failing command?