Did you actually try using the CLI tool, or did you only read the documentation? The documentation isn't super clear, but in actual usage your password (nor your email) doesn't get entered into shell history or otherwise.

You can pass your email and password as arguments to the "bw login [email] [password]" command, which will put them into your history, but the default way of typing "bw login" will then prompt you for them both, masking your password just like any other CLI tool does.

If if you can do this, the fact that the documentation encourages you to do otherwise is extremely worrisome. Securely-written tools shouldn't even allow you to do this in the first place, much less promote it.

https://help.bitwarden.com/article/cli/

I don't think it's extremely worrisome. The arguments are in brackets a.k.a. they are optional. If a user doesn't know that they probably shouldn't be using the command line tool in the first place. Besides, if you run help on the cli tool the first example it suggests is "bw login" (without the arguments).

Regardless that this is one way to operate it (just like many CLI commands can also prompt for password) you're aware you can tell your shell to not save commands to its history?

You mean the cli doesn’t prompt you to type the pwd separate from the cli command itself, akin to how Postgres ‘psql -p’ works?

According to the docs, all of the relevant commands accept the password as an argument to the binary itself.

https://help.bitwarden.com/article/cli/

It does. In fact, when you --help in the cli tool the first example it suggests is to login with "bw login" command which is the default way.