task 20: hide do info UUID unless HEXAI_DEBUG is set

7 files changed, 187 insertions, 38 deletions

diff --git a/Magefile.go b/Magefile.go
index fb19689..e5d744d 100644
--- a/Magefile.go
+++ b/Magefile.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"regexp"
 	"strconv"
@@ -131,9 +132,41 @@ func Install() error {
 			return err
 		}
 	}
+	return installFishCompletion(filepath.Join(bin, "do"))
+}
+
+func installFishCompletion(doBin string) error {
+	fishConfigDir, err := resolveFishConfigDir()
+	if err != nil {
+		return err
+	}
+	completionsDir := filepath.Join(fishConfigDir, "completions")
+	if err := os.MkdirAll(completionsDir, 0o755); err != nil {
+		return err
+	}
+	out, err := exec.Command(doBin, "fish").Output()
+	if err != nil {
+		return fmt.Errorf("generate fish completion: %w", err)
+	}
+	dst := filepath.Join(completionsDir, "do.fish")
+	if err := os.WriteFile(dst, out, 0o644); err != nil {
+		return err
+	}
+	fmt.Printf("installed %s\n", dst)
 	return nil
 }
 
+func resolveFishConfigDir() (string, error) {
+	if xdg := os.Getenv("XDG_CONFIG_HOME"); xdg != "" {
+		return filepath.Join(xdg, "fish"), nil
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return "", fmt.Errorf("resolve home: %w", err)
+	}
+	return filepath.Join(home, ".config", "fish"), nil
+}
+
 // RunTmuxAction runs the hexai-tmux-action TUI via go run (reads stdin).
 func RunTmuxAction() error {
 	printCoverage()
diff --git a/docs/buildandinstall.md b/docs/buildandinstall.md
index 379d310..7d29c71 100644
--- a/docs/buildandinstall.md
+++ b/docs/buildandinstall.md
@@ -11,7 +11,8 @@ Hexai uses Mage for developer tasks. Install Mage, then run targets like build,
 - In restricted sandboxes/CI (no sockets), skip network-based tests:
   - `HEXAI_TEST_SKIP_NET=1 go test ./... -cover`
 - Install binaries to `GOPATH/bin`: `mage install`
-- Load Fish completions in the current shell: `~/go/bin/do fish | source`
+- `mage install` also writes Fish completion to `~/.config/fish/completions/do.fish` (or `$XDG_CONFIG_HOME/fish/completions/do.fish`)
+- Load Fish completions in the current shell immediately after install: `~/go/bin/do fish | source`
 
 Note: `mage lint` uses `golangci-lint`. Install via `mage devinstall` if needed.
 
diff --git a/docs/fish-completion.md b/docs/fish-completion.md
index 95de56a..c582800 100644
--- a/docs/fish-completion.md
+++ b/docs/fish-completion.md
@@ -32,3 +32,5 @@ end
 ```
 
 No external `do.fish` file is required.
+
+If you installed with `mage install`, the installer also writes an autoloadable completion file to `~/.config/fish/completions/do.fish` (or `$XDG_CONFIG_HOME/fish/completions/do.fish`), so new Fish sessions should pick it up automatically.
diff --git a/integrationtests/do_test.go b/integrationtests/do_test.go
index 8462f3f..56e4372 100644
--- a/integrationtests/do_test.go
+++ b/integrationtests/do_test.go
@@ -83,6 +83,19 @@ func runDoWithStdin(ctx context.Context, args []string, stdin string) (stdout, s
 	return stdout, stderr, ee.ExitCode()
 }
 
+func unsetTestEnv(t *testing.T, key string) {
+	t.Helper()
+	oldValue, hadValue := os.LookupEnv(key)
+	_ = os.Unsetenv(key)
+	t.Cleanup(func() {
+		if !hadValue {
+			_ = os.Unsetenv(key)
+			return
+		}
+		_ = os.Setenv(key, oldValue)
+	})
+}
+
 func runTask(ctx context.Context, args []string) (stdout, stderr bytes.Buffer, exitCode int) {
 	cmd := exec.CommandContext(ctx, "task", args...)
 	cmd.Dir = repoRoot
@@ -117,7 +130,7 @@ func runTaskWithStdin(ctx context.Context, args []string, stdin string) (stdout,
 }
 
 // createTask creates a new task via do add and returns its UUID.
-// do add prints a human-facing created-task message, so we resolve the created UUID via do info.
+// do add prints a human-facing created-task message, so we resolve the created UUID from task export.
 func createTask(ctx context.Context, desc string) (string, error) {
 	stdout, stderr, code := runDo(ctx, []string{"add", "+integrationtest", desc})
 	if code != 0 {
@@ -127,14 +140,28 @@ func createTask(ctx context.Context, desc string) (string, error) {
 	if id == "" {
 		return "", fmt.Errorf("could not extract task ID from do add output: %s", stdout.String())
 	}
-	info, ok := getTaskInfoFast(ctx, id)
-	if !ok {
-		return "", fmt.Errorf("could not resolve task ID %q after do add", id)
+	uuid, err := findTaskUUIDByDescription(ctx, desc)
+	if err != nil {
+		return "", fmt.Errorf("could not resolve task UUID for %q after do add: %w", desc, err)
+	}
+	return uuid, nil
+}
+
+func findTaskUUIDByDescription(ctx context.Context, desc string) (string, error) {
+	stdout, stderr, code := runTask(ctx, []string{"export", "project:hexai", "+integrationtest"})
+	if code != 0 {
+		return "", fmt.Errorf("task export failed (code %d): stdout=%s stderr=%s", code, stdout.String(), stderr.String())
+	}
+	var tasks []askcli.TaskExport
+	if err := json.Unmarshal(stdout.Bytes(), &tasks); err != nil {
+		return "", fmt.Errorf("failed to parse task export: %w", err)
 	}
-	if info.UUID == "" {
-		return "", fmt.Errorf("do info %q did not return a UUID", id)
+	for _, task := range tasks {
+		if task.Description == desc && task.Status == "pending" {
+			return task.UUID, nil
+		}
 	}
-	return info.UUID, nil
+	return "", fmt.Errorf("pending task %q not found in export", desc)
 }
 
 func extractTaskIDFromAddOutput(output string) string {
@@ -353,11 +380,16 @@ func TestAddReturnsAlias(t *testing.T) {
 	}
 	rawOutput := strings.TrimSpace(stdout.String())
 	id := extractTaskIDFromAddOutput(rawOutput)
-	info, ok := getTaskInfoFast(ctx, id)
+	uuid, err := findTaskUUIDByDescription(ctx, "uuid format check")
+	if err != nil {
+		t.Fatalf("failed to resolve created task UUID: %v", err)
+	}
+	defer deleteTask(ctx, uuid)
+
+	info, ok := getTaskInfoFast(ctx, uuid)
 	if !ok {
-		t.Fatalf("do info %q failed after add", id)
+		t.Fatalf("do info %q failed after add", uuid)
 	}
-	defer deleteTask(ctx, info.UUID)
 
 	if id == "" {
 		t.Fatal("do add returned an empty task ID")
@@ -371,8 +403,8 @@ func TestAddReturnsAlias(t *testing.T) {
 	if info.ID != id {
 		t.Fatalf("do info ID = %q, want %q", info.ID, id)
 	}
-	if !uuidFormatRx.MatchString(info.UUID) {
-		t.Fatalf("do info UUID = %q, want valid UUID", info.UUID)
+	if info.UUID != uuid {
+		t.Fatalf("do info UUID = %q, want %q", info.UUID, uuid)
 	}
 }
 
@@ -411,16 +443,15 @@ func TestAddWithDependsModifier(t *testing.T) {
 		t.Fatalf("do add with depends modifier failed with code %d: stdout=%s stderr=%s", code, stdout.String(), stderr.String())
 	}
 
-	id := extractTaskIDFromAddOutput(stdout.String())
-	info, ok := getTaskInfoFast(ctx, id)
-	if !ok {
-		t.Fatalf("do info %q failed after add", id)
+	uuid, err := findTaskUUIDByDescription(ctx, "integration test task with inline depends")
+	if err != nil {
+		t.Fatalf("failed to resolve created task UUID: %v", err)
 	}
-	defer deleteTask(ctx, info.UUID)
+	defer deleteTask(ctx, uuid)
 
-	raw, ok := getTaskInfoRaw(ctx, info.UUID)
+	raw, ok := getTaskInfoRaw(ctx, uuid)
 	if !ok {
-		t.Fatalf("raw info for created task %s failed", info.UUID)
+		t.Fatalf("raw info for created task %s failed", uuid)
 	}
 	if !strings.Contains(raw, dep1Alias+" ("+dep1UUID+")") || !strings.Contains(raw, dep2Alias+" ("+dep2UUID+")") {
 		t.Fatalf("created task info missing formatted dependencies: %s", raw)
@@ -497,6 +528,7 @@ func TestInfo(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
 	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	unsetTestEnv(t, "HEXAI_DEBUG")
 
 	uuid, err := createTask(ctx, "integration test task for info")
 	if err != nil {
@@ -508,9 +540,6 @@ func TestInfo(t *testing.T) {
 	if !ok {
 		t.Fatalf("info failed or returned no output")
 	}
-	if ti.UUID != uuid {
-		t.Errorf("info uuid mismatch: got %s, want %s", ti.UUID, uuid)
-	}
 	if ti.ID == "" {
 		t.Errorf("info output missing alias ID")
 	}
@@ -525,8 +554,8 @@ func TestInfo(t *testing.T) {
 	if !strings.Contains(aliasOutput, "ID:          "+ti.ID) {
 		t.Errorf("info by alias output missing alias line: %s", aliasOutput)
 	}
-	if !strings.Contains(aliasOutput, "UUID:        "+uuid) {
-		t.Errorf("info by alias output missing uuid line: %s", aliasOutput)
+	if strings.Contains(aliasOutput, "UUID:") || strings.Contains(aliasOutput, uuid) {
+		t.Errorf("info by alias output leaked uuid in default mode: %s", aliasOutput)
 	}
 }
 
@@ -1061,6 +1090,7 @@ func TestAliasSelectorsAcrossUUIDCommands(t *testing.T) {
 	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Second)
 	defer cancel()
 	t.Setenv("XDG_CACHE_HOME", t.TempDir())
+	unsetTestEnv(t, "HEXAI_DEBUG")
 
 	uuid, err := createTask(ctx, "integration test task for alias selectors")
 	if err != nil {
@@ -1074,8 +1104,8 @@ func TestAliasSelectorsAcrossUUIDCommands(t *testing.T) {
 	if !ok {
 		t.Fatalf("info by alias failed")
 	}
-	if !strings.Contains(infoOut, "UUID:        "+uuid) {
-		t.Fatalf("info by alias did not resolve the task: %s", infoOut)
+	if !strings.Contains(infoOut, "ID:          "+alias) || strings.Contains(infoOut, "UUID:") || strings.Contains(infoOut, uuid) {
+		t.Fatalf("info by alias did not resolve the task without leaking UUID: %s", infoOut)
 	}
 
 	note := "integration alias annotation"
diff --git a/internal/askcli/command_info_add_test.go b/internal/askcli/command_info_add_test.go
index 0a07479..8ca14a2 100644
--- a/internal/askcli/command_info_add_test.go
+++ b/internal/askcli/command_info_add_test.go
@@ -12,6 +12,7 @@ import (
 )
 
 func TestHandleInfo_Success(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
 	oldNow := nowTaskAliasCache
@@ -47,8 +48,8 @@ func TestHandleInfo_Success(t *testing.T) {
 	if !strings.Contains(output, "ID:          0") {
 		t.Fatalf("output missing alias ID: %s", output)
 	}
-	if !strings.Contains(output, "test-uuid") {
-		t.Fatalf("output missing UUID: %s", output)
+	if strings.Contains(output, "UUID:") || strings.Contains(output, "test-uuid") {
+		t.Fatalf("output leaked UUID in default mode: %s", output)
 	}
 	if !strings.Contains(output, "H") {
 		t.Fatalf("output missing priority: %s", output)
@@ -61,6 +62,46 @@ func TestHandleInfo_Success(t *testing.T) {
 	}
 }
 
+func TestHandleInfo_Success_DebugShowsUUID(t *testing.T) {
+	t.Setenv("HEXAI_DEBUG", "true")
+	dir := t.TempDir()
+	oldRoot := taskAliasCacheRoot
+	oldNow := nowTaskAliasCache
+	taskAliasCacheRoot = func() (string, error) { return filepath.Join(dir, "hexai"), nil }
+	nowTaskAliasCache = func() time.Time { return time.Date(2026, 3, 26, 12, 0, 0, 0, time.UTC) }
+	defer func() {
+		taskAliasCacheRoot = oldRoot
+		nowTaskAliasCache = oldNow
+	}()
+
+	writeTaskAliasCacheForTest(t, taskAliasCache{
+		NextID: 1,
+		Entries: []taskAliasCacheEntry{
+			{UUID: "test-uuid", Alias: "0", CreatedAt: nowTaskAliasCache()},
+		},
+	})
+
+	jsonData := `[{"uuid":"test-uuid","description":"Test task","status":"pending","priority":"H","tags":["cli","agent"],"urgency":15.0,"depends":[],"annotations":[]}]`
+	d := NewDispatcher(&spyRunner{runFn: func(ctx context.Context, args []string, stdin io.Reader, stdout, stderr io.Writer) (int, error) {
+		if len(args) > 0 && strings.HasPrefix(args[0], "uuid:") {
+			_, _ = io.WriteString(stdout, jsonData)
+		}
+		return 0, nil
+	}})
+
+	var stdout, stderr bytes.Buffer
+	code, _ := d.Dispatch(context.Background(), []string{"info", "test-uuid"}, nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("info code = %d, want 0", code)
+	}
+	if !strings.Contains(stdout.String(), "UUID:        test-uuid") {
+		t.Fatalf("output missing UUID in debug mode: %s", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), "ID:          0") {
+		t.Fatalf("output missing alias ID in debug mode: %s", stdout.String())
+	}
+}
+
 func TestHandleInfo_AssignsDependencyAliasesFromInfo(t *testing.T) {
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
@@ -102,6 +143,7 @@ func TestHandleInfo_AssignsDependencyAliasesFromInfo(t *testing.T) {
 }
 
 func TestHandleInfo_AliasSelector(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
 	oldNow := nowTaskAliasCache
@@ -132,8 +174,11 @@ func TestHandleInfo_AliasSelector(t *testing.T) {
 	if code != 0 {
 		t.Fatalf("info code = %d, want 0", code)
 	}
-	if !strings.Contains(stdout.String(), "ID:          0") || !strings.Contains(stdout.String(), "UUID:        test-uuid") {
-		t.Fatalf("stdout = %q, want alias and UUID", stdout.String())
+	if !strings.Contains(stdout.String(), "ID:          0") {
+		t.Fatalf("stdout = %q, want alias ID", stdout.String())
+	}
+	if strings.Contains(stdout.String(), "UUID:") || strings.Contains(stdout.String(), "test-uuid") {
+		t.Fatalf("stdout = %q, want UUID hidden by default", stdout.String())
 	}
 }
 
@@ -196,6 +241,7 @@ func TestHandleInfo_NumericID(t *testing.T) {
 }
 
 func TestHandleInfo_MissingUUID(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
 	oldNow := nowTaskAliasCache
@@ -218,8 +264,11 @@ func TestHandleInfo_MissingUUID(t *testing.T) {
 	if code != 0 {
 		t.Fatalf("info code = %d, want 0 for implicit started task", code)
 	}
-	if !strings.Contains(stdout.String(), "ID:          0") || !strings.Contains(stdout.String(), "UUID:        started-uuid") {
-		t.Fatalf("output missing alias and started task UUID: %s", stdout.String())
+	if !strings.Contains(stdout.String(), "ID:          0") {
+		t.Fatalf("output missing alias: %s", stdout.String())
+	}
+	if strings.Contains(stdout.String(), "UUID:") || strings.Contains(stdout.String(), "started-uuid") {
+		t.Fatalf("output leaked started task UUID in default mode: %s", stdout.String())
 	}
 }
 
diff --git a/internal/askcli/formatter.go b/internal/askcli/formatter.go
index fc4a1d9..5d2ed76 100644
--- a/internal/askcli/formatter.go
+++ b/internal/askcli/formatter.go
@@ -3,6 +3,7 @@ package askcli
 import (
 	"fmt"
 	"io"
+	"os"
 	"slices"
 	"strings"
 
@@ -139,7 +140,9 @@ func detectTaskListTerminalWidth(w io.Writer) int {
 func FormatTaskInfo(t TaskExport, alias string, dependencyAliases map[string]string) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "ID:          %s\n", alias)
-	fmt.Fprintf(&b, "UUID:        %s\n", t.UUID)
+	if debugEnabled() {
+		fmt.Fprintf(&b, "UUID:        %s\n", t.UUID)
+	}
 	fmt.Fprintf(&b, "Description: %s\n", t.Description)
 	fmt.Fprintf(&b, "Status:      %s\n", t.Status)
 	fmt.Fprintf(&b, "Started:     %s\n", formatTaskStarted(t))
@@ -163,6 +166,11 @@ func FormatTaskInfo(t TaskExport, alias string, dependencyAliases map[string]str
 	return b.String()
 }
 
+func debugEnabled() bool {
+	_, ok := os.LookupEnv("HEXAI_DEBUG")
+	return ok
+}
+
 // FormatSuccess returns the success string written to stdout after a task command runs.
 func FormatSuccess(alias string) string {
 	return fmt.Sprintf("ok %s\n", alias)
diff --git a/internal/askcli/formatter_test.go b/internal/askcli/formatter_test.go
index 61ede0a..e473ed4 100644
--- a/internal/askcli/formatter_test.go
+++ b/internal/askcli/formatter_test.go
@@ -2,10 +2,24 @@ package askcli
 
 import (
 	"fmt"
+	"os"
 	"strings"
 	"testing"
 )
 
+func unsetTestEnv(t *testing.T, key string) {
+	t.Helper()
+	oldValue, hadValue := os.LookupEnv(key)
+	_ = os.Unsetenv(key)
+	t.Cleanup(func() {
+		if !hadValue {
+			_ = os.Unsetenv(key)
+			return
+		}
+		_ = os.Setenv(key, oldValue)
+	})
+}
+
 func TestFormatTaskList(t *testing.T) {
 	tasks := []TaskExport{
 		{UUID: "uuid-1", Description: "Short task", Status: "pending", Priority: "H", Tags: []string{"cli"}, Urgency: 15.0},
@@ -145,6 +159,7 @@ func TestFormatTaskListForWidth_TruncatesDescriptionWhenTerminalIsNarrow(t *test
 }
 
 func TestFormatTaskInfo(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	task := TaskExport{
 		UUID:        "test-uuid",
 		Description: "Test description",
@@ -165,8 +180,8 @@ func TestFormatTaskInfo(t *testing.T) {
 	if !strings.Contains(output, "ID:          0") {
 		t.Fatalf("FormatTaskInfo missing alias ID: %s", output)
 	}
-	if !strings.Contains(output, "test-uuid") {
-		t.Fatalf("FormatTaskInfo missing UUID: %s", output)
+	if strings.Contains(output, "UUID:") || strings.Contains(output, "test-uuid") {
+		t.Fatalf("FormatTaskInfo leaked UUID in default mode: %s", output)
 	}
 	if !strings.Contains(output, "H") {
 		t.Fatalf("FormatTaskInfo missing priority H: %s", output)
@@ -188,6 +203,16 @@ func TestFormatTaskInfo(t *testing.T) {
 	}
 }
 
+func TestFormatTaskInfo_DebugShowsUUID(t *testing.T) {
+	t.Setenv("HEXAI_DEBUG", "1")
+	task := TaskExport{UUID: "test-uuid", Description: "Test description", Status: "pending", Priority: "H", Urgency: 1}
+
+	output := FormatTaskInfo(task, "0", nil)
+	if !strings.Contains(output, "UUID:        test-uuid") {
+		t.Fatalf("FormatTaskInfo missing UUID in debug mode: %s", output)
+	}
+}
+
 func TestFormatSuccess(t *testing.T) {
 	output := FormatSuccess("0")
 	if !strings.Contains(output, "ok") || !strings.Contains(output, "0") {
@@ -266,6 +291,7 @@ func TestRejectNumericID(t *testing.T) {
 }
 
 func TestFormatTaskInfo_NoOptionalFields(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	task := TaskExport{
 		UUID:        "simple-uuid",
 		Description: "Simple task",
@@ -275,8 +301,8 @@ func TestFormatTaskInfo_NoOptionalFields(t *testing.T) {
 		Urgency:     0,
 	}
 	output := FormatTaskInfo(task, "0", nil)
-	if !strings.Contains(output, "simple-uuid") {
-		t.Fatalf("FormatTaskInfo missing UUID: %s", output)
+	if strings.Contains(output, "UUID:") || strings.Contains(output, "simple-uuid") {
+		t.Fatalf("FormatTaskInfo leaked UUID in default mode: %s", output)
 	}
 	if !strings.Contains(output, "Started:     no") {
 		t.Fatalf("FormatTaskInfo should show Started: no when not started: %s", output)