fix: redact session credentials from user --json --full output

[lmjabreu]

Overview

tdc user --json --full printed every field the API returns for the session user, including the SDK's token and cometChannel. The backend only includes session credentials when the bearer is a session-type token, so COMMS_API_TOKEN=<session token> tdc user --json --full would print a live credential to stdout.

The fix is in the shared formatter (filterEntityFields in src/lib/output.ts): for a top-level user entity, token and cometChannel are omitted on the curated and --full paths. formatJson, formatNdjson and the paginated formatters all go through it, so the status commands in #77 (which call formatJson(user, 'user', true)) are covered once it lands. #77 is not merged, so I did not test them here. Redaction is top-level only: a user nested inside another object is not redacted, and nothing prints one today.

Omit vs placeholder: omitted. A "[redacted]" string would look like a real value to scripts, and absence is what an OAuth login already produces.

Fields: token is the session credential. cometChannel is a judgement call: it is the user's realtime subscription channel, paired with cometServer, so I treated it as secret, but nothing in the repo or SDK confirms that. cometServer and clientId stay; worth a check with the backend owner that neither is sensitive.

Reference

Follow-up to #77. SDK: UserSchema in @doist/comms-sdk.

Test plan

1. On main, with a session user containing token/cometChannel, run tdc user --json --full; the credentials are printed.
2. On this branch, repeat:
   • tdc user --json --full has no token or cometChannel, other full fields (lang, shortName) remain
   • Curated tdc user --json output is unchanged

The users --json/--ndjson --full tests are defence in depth: the SDK already strips these fields from workspace users, so getSessionUser is the only real carrier.

Not verified: what the real backend returns for a session token. This rests on the _include_session_credentials behaviour described in the task and the SDK schema.

Adversarial review

Reviewer	Head	Raised	Fixed	Refuted	Deferred	Reviewer tokens
Fable (2 passes: conventions, bounds)	0cf3dee	7	5	1	1	362,526

Doistbot: 3 rounds, no P1 or P2, 7 P3 notes in total (4 fixed, 3 refuted, one of them raised twice). Last review was on cd3c931; e3b5d2a only changes a return type.

🤖 Generated with Claude Code

[lmjabreu]

@doistbot /review

[doistbot]

This PR redacts session credentials (token and cometChannel) from tdc user --json / --ndjson output, including --full and paginated paths, by applying an omitSecrets filter for top-level user entities in the shared formatter (filterEntityFields in src/lib/output.ts). Since formatJson, formatNdjson, and the paginated formatters all route through it, both the user and users commands are covered, curated output is preserved, and the filter is a no-op for non-user entities. All formatJson/formatNdjson call sites that render session-user data pass type: 'user', so the intended leak path is closed, and the documented shallow-redaction limitation has no concrete leak path today. No inline issues were flagged — the remaining open items worth confirming before merge are the backend sensitivity of cometServer/clientId and the follow-up verification of the #77 status commands once that PR lands.

I also included a few optional follow-up notes in the details below.

Optional follow-up notes (2)

• src/lib/output.ts:156: For every entity type except user, SECRET_FIELDS[type] is undefined, so this map only allocates a new array of references with no filtering benefit. --full list/paginated outputs (threads, channels, conversations, groups, workspaces) previously passed the original array straight through. Short-circuit before mapping when the type has no secrets, e.g. const secrets = SECRET_FIELDS[type]; if (!secrets) return data, and pass secrets into omitSecrets to avoid the repeated lookup per item.
• src/lib/output.test.ts:150: This matrix asserts only that the SECRET- values don't appear in the output, not that the token/cometChannel keys are omitted. Since the PR deliberately omits these fields instead of emitting a "[redacted]" placeholder, a future switch to placeholders would still pass every case here (and the users --full command test). Parse the single-object outputs (for formatPaginatedJson, check .results[0]) or inspect filterEntityFields directly, and assert not.toHaveProperty('token') / not.toHaveProperty('cometChannel') to pin the omission contract.

_{Share Feedback • Review Logs}

[lmjabreu]

@doistbot /review

[doistbot]

This PR routes all full JSON/NDJSON output for the top-level user entity through a new secret-omission filter in filterEntityFields, closing a credential leak where tdc user --json --full printed the session token and cometChannel. The redaction covers the curated, full, paginated, and NDJSON paths (all funnel through the shared formatter), curated output is preserved, and tests plus help/skill docs match the change. No inline issues were flagged — the implementation follows the existing per-entity filtering pattern, the omit-over-placeholder choice is sound, and the open question about cometChannel/clientId/cometServer sensitivity is already surfaced in the PR description for backend confirmation.

I also included a few optional follow-up notes in the details below.

Optional follow-up notes (2)

• src/commands/user.test.ts:197: This block is low-value, synthetic coverage. The PR notes the SDK already strips token/cometChannel from workspace users, so getWorkspaceUsers never returns the mocked leaky shape — the real carrier (getSessionUser) is already covered by the user --full test above. It also never asserts a full-only field survives, so it would still pass if --full were ignored and curated output were returned (curated output omits these fields too). The array redaction is already pinned in src/lib/output.test.ts. Suggest deleting this block; if the listUsers wiring is the concern, keep a single --json case that asserts a full-only field and that the parsed result has no token/cometChannel keys.
• src/lib/output.test.ts:166: This asserts reference identity (toBe), which pins the internal short-circuit optimization rather than behavior. If filterEntityFields ever returned an equal shallow copy for types without secrets — no observable change — this test would fail. toEqual(channels) (or just checking the items are unmodified) tests the same contract without coupling to the no-copy detail.

_{Share Feedback • Review Logs}

[lmjabreu]

@doistbot /review

[doistbot]

This PR closes a real credential leak by omitting the session token and cometChannel fields from top-level user JSON/NDJSON output, centralized in filterEntityFields so the curated, --full, and paginated paths are all covered while other entity types and untyped output are untouched. No inline issues were flagged. The omit-over-placeholder choice and the shared-helper approach fit the existing filtering pattern well; the follow-ups in the description (confirming cometServer/clientId sensitivity with the backend owner, and re-verifying the #77 status commands once that PR merges) are good items to track.

I also included a few optional follow-up notes in the details below.

Optional follow-up notes (3)

• src/lib/output.ts:121: omitSecrets returns T, but the object it returns has had token/cometChannel deleted (return copy as T). The signature hides the deletion, so the helper's result is typed as a complete T even though it is missing fields. Return Partial<T> (or a precise Omit keyed on the user secret fields) so the redaction is reflected in the type.
• src/lib/output.test.ts:166: This asserts reference identity (toBe), which pins the no-copy short-circuit rather than the behavior the test name describes (fields unmodified). A behaviorally equivalent filterEntityFields that returned a shallow copy for types without secrets would fail here. Use toEqual(channels) to keep the test on the contract.
• src/commands/user.test.ts:216: This block is synthetic and largely duplicates the src/lib/output.test.ts matrix. Per the PR description, the SDK already strips token/cometChannel from workspace users, so getWorkspaceUsers never returns the mocked leaky shape and this credential scenario can't occur through listUsers; the real carrier (getSessionUser) is covered by the user --json --full test above. The only unique behavior here is listUsers passing --full through to the formatter. Collapse it to a single --json case asserting lang is present and the secret keys are absent, or delete the block.

_{Share Feedback • Review Logs}