Redact signup secrets from human output

Author: robzolkos

internal/commands/signup.go

@@ -400,7 +400,7 @@ func runSignupStart(cmd *cobra.Command, args []string) error {
 		data["code"] = code
 	}
 
-	printMutation(data, "Magic link sent. Check your email for a 6-digit code.", breadcrumbs)
+	printMutation(signupHumanData(data), "Magic link sent. Check your email for a 6-digit code.", breadcrumbs)
 	return nil
 }
 
@@ -445,7 +445,7 @@ func runSignupVerify(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	printDetail(result, "", nil)
+	printDetail(signupHumanData(result, "requires_signup_completion", "accounts"), "", nil)
 	return nil
 }
 
@@ -551,10 +551,26 @@ func runSignupComplete(cmd *cobra.Command, args []string) error {
 		breadcrumb("setup", "fizzy setup", "Full interactive setup"),
 	}
 
-	printMutation(result, summary, breadcrumbs)
+	printMutation(signupHumanData(result, "account", "is_new_user"), summary, breadcrumbs)
 	return nil
 }
 
+// signupHumanData removes machine-only secrets from human-facing output while
+// preserving the full payload for JSON/quiet/agent workflows.
+func signupHumanData(data map[string]any, fields ...string) map[string]any {
+	if !isHumanOutput() {
+		return data
+	}
+
+	result := make(map[string]any, len(fields))
+	for _, field := range fields {
+		if value, ok := data[field]; ok {
+			result[field] = value
+		}
+	}
+	return result
+}
+
 // signupAPIURL returns the effective API URL for signup commands, normalized without trailing slash.
 func signupAPIURL() string {
 	if cfg != nil && cfg.APIURL != "" {

internal/commands/signup_test.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/basecamp/cli/output"
 	"github.com/basecamp/fizzy-cli/internal/config"
 	"gopkg.in/yaml.v3"
 )
@@ -754,6 +755,89 @@ func TestSignupCompleteRejectsEmptyToken(t *testing.T) {
 	})
 }
 
+func TestSignupHumanOutputRedactsSecrets(t *testing.T) {
+	t.Run("signup start hides pending token in styled output", func(t *testing.T) {
+		resetSignupFlags()
+		server := newTestSignupServer(t, testSignupServerOpts{accessToken: "fizzy_test"})
+		defer server.Close()
+
+		mock := NewMockClient()
+		SetTestMode(mock)
+		SetTestFormat(output.FormatStyled)
+		SetTestConfig("", "", server.URL)
+		defer ResetTestMode()
+
+		signupStartCmd.Flags().Set("email", "test@example.com")
+		err := signupStartCmd.RunE(signupStartCmd, []string{})
+		assertExitCode(t, err, 0)
+
+		raw := TestOutput()
+		if strings.Contains(raw, "signed-pending-token-value") {
+			t.Fatalf("expected styled output to hide pending token, got:\n%s", raw)
+		}
+	})
+
+	t.Run("signup verify hides session token in styled output", func(t *testing.T) {
+		resetSignupFlags()
+		server := newTestSignupServer(t, testSignupServerOpts{
+			requiresCompletion: false,
+			accessToken:        "fizzy_test",
+		})
+		defer server.Close()
+
+		mock := NewMockClient()
+		SetTestMode(mock)
+		SetTestFormat(output.FormatStyled)
+		SetTestConfig("", "", server.URL)
+		defer ResetTestMode()
+
+		signupVerifyCmd.Flags().Set("code", "VALID1")
+		signupVerifyCmd.Flags().Set("pending-token", "signed-pending-token-value")
+		err := signupVerifyCmd.RunE(signupVerifyCmd, []string{})
+		assertExitCode(t, err, 0)
+
+		raw := TestOutput()
+		if strings.Contains(raw, "signed-session-token-value") {
+			t.Fatalf("expected styled output to hide session token, got:\n%s", raw)
+		}
+		if !strings.Contains(raw, "requires_signup_completion") {
+			t.Fatalf("expected styled output to retain non-secret fields, got:\n%s", raw)
+		}
+	})
+
+	t.Run("signup complete hides access token in styled output", func(t *testing.T) {
+		resetSignupFlags()
+		server := newTestSignupServer(t, testSignupServerOpts{
+			accessToken: "fizzy_generated_token",
+		})
+		defer server.Close()
+
+		config.SetTestConfigDir(t.TempDir())
+		defer config.ResetTestConfigDir()
+
+		mock := NewMockClient()
+		SetTestMode(mock)
+		SetTestFormat(output.FormatStyled)
+		SetTestConfig("", "", server.URL)
+		defer ResetTestMode()
+
+		restoreStdin := pipeSessionToken("signed-session-token-value")
+		defer restoreStdin()
+
+		signupCompleteCmd.Flags().Set("account", "123456")
+		err := signupCompleteCmd.RunE(signupCompleteCmd, []string{})
+		assertExitCode(t, err, 0)
+
+		raw := TestOutput()
+		if strings.Contains(raw, "fizzy_generated_token") {
+			t.Fatalf("expected styled output to hide generated token, got:\n%s", raw)
+		}
+		if !strings.Contains(raw, "123456") {
+			t.Fatalf("expected styled output to retain account, got:\n%s", raw)
+		}
+	})
+}
+
 func TestReadSessionTokenFromStdin(t *testing.T) {
 	t.Run("reads token from piped stdin", func(t *testing.T) {
 		restoreStdin := pipeSessionToken("eyJ-session-token-value")