task 20: hide do info UUID unless HEXAI_DEBUG is set

3 files changed, 94 insertions, 11 deletions

diff --git a/internal/askcli/command_info_add_test.go b/internal/askcli/command_info_add_test.go
index 0a07479..8ca14a2 100644
--- a/internal/askcli/command_info_add_test.go
+++ b/internal/askcli/command_info_add_test.go
@@ -12,6 +12,7 @@ import (
 )
 
 func TestHandleInfo_Success(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
 	oldNow := nowTaskAliasCache
@@ -47,8 +48,8 @@ func TestHandleInfo_Success(t *testing.T) {
 	if !strings.Contains(output, "ID:          0") {
 		t.Fatalf("output missing alias ID: %s", output)
 	}
-	if !strings.Contains(output, "test-uuid") {
-		t.Fatalf("output missing UUID: %s", output)
+	if strings.Contains(output, "UUID:") || strings.Contains(output, "test-uuid") {
+		t.Fatalf("output leaked UUID in default mode: %s", output)
 	}
 	if !strings.Contains(output, "H") {
 		t.Fatalf("output missing priority: %s", output)
@@ -61,6 +62,46 @@ func TestHandleInfo_Success(t *testing.T) {
 	}
 }
 
+func TestHandleInfo_Success_DebugShowsUUID(t *testing.T) {
+	t.Setenv("HEXAI_DEBUG", "true")
+	dir := t.TempDir()
+	oldRoot := taskAliasCacheRoot
+	oldNow := nowTaskAliasCache
+	taskAliasCacheRoot = func() (string, error) { return filepath.Join(dir, "hexai"), nil }
+	nowTaskAliasCache = func() time.Time { return time.Date(2026, 3, 26, 12, 0, 0, 0, time.UTC) }
+	defer func() {
+		taskAliasCacheRoot = oldRoot
+		nowTaskAliasCache = oldNow
+	}()
+
+	writeTaskAliasCacheForTest(t, taskAliasCache{
+		NextID: 1,
+		Entries: []taskAliasCacheEntry{
+			{UUID: "test-uuid", Alias: "0", CreatedAt: nowTaskAliasCache()},
+		},
+	})
+
+	jsonData := `[{"uuid":"test-uuid","description":"Test task","status":"pending","priority":"H","tags":["cli","agent"],"urgency":15.0,"depends":[],"annotations":[]}]`
+	d := NewDispatcher(&spyRunner{runFn: func(ctx context.Context, args []string, stdin io.Reader, stdout, stderr io.Writer) (int, error) {
+		if len(args) > 0 && strings.HasPrefix(args[0], "uuid:") {
+			_, _ = io.WriteString(stdout, jsonData)
+		}
+		return 0, nil
+	}})
+
+	var stdout, stderr bytes.Buffer
+	code, _ := d.Dispatch(context.Background(), []string{"info", "test-uuid"}, nil, &stdout, &stderr)
+	if code != 0 {
+		t.Fatalf("info code = %d, want 0", code)
+	}
+	if !strings.Contains(stdout.String(), "UUID:        test-uuid") {
+		t.Fatalf("output missing UUID in debug mode: %s", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), "ID:          0") {
+		t.Fatalf("output missing alias ID in debug mode: %s", stdout.String())
+	}
+}
+
 func TestHandleInfo_AssignsDependencyAliasesFromInfo(t *testing.T) {
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
@@ -102,6 +143,7 @@ func TestHandleInfo_AssignsDependencyAliasesFromInfo(t *testing.T) {
 }
 
 func TestHandleInfo_AliasSelector(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
 	oldNow := nowTaskAliasCache
@@ -132,8 +174,11 @@ func TestHandleInfo_AliasSelector(t *testing.T) {
 	if code != 0 {
 		t.Fatalf("info code = %d, want 0", code)
 	}
-	if !strings.Contains(stdout.String(), "ID:          0") || !strings.Contains(stdout.String(), "UUID:        test-uuid") {
-		t.Fatalf("stdout = %q, want alias and UUID", stdout.String())
+	if !strings.Contains(stdout.String(), "ID:          0") {
+		t.Fatalf("stdout = %q, want alias ID", stdout.String())
+	}
+	if strings.Contains(stdout.String(), "UUID:") || strings.Contains(stdout.String(), "test-uuid") {
+		t.Fatalf("stdout = %q, want UUID hidden by default", stdout.String())
 	}
 }
 
@@ -196,6 +241,7 @@ func TestHandleInfo_NumericID(t *testing.T) {
 }
 
 func TestHandleInfo_MissingUUID(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	dir := t.TempDir()
 	oldRoot := taskAliasCacheRoot
 	oldNow := nowTaskAliasCache
@@ -218,8 +264,11 @@ func TestHandleInfo_MissingUUID(t *testing.T) {
 	if code != 0 {
 		t.Fatalf("info code = %d, want 0 for implicit started task", code)
 	}
-	if !strings.Contains(stdout.String(), "ID:          0") || !strings.Contains(stdout.String(), "UUID:        started-uuid") {
-		t.Fatalf("output missing alias and started task UUID: %s", stdout.String())
+	if !strings.Contains(stdout.String(), "ID:          0") {
+		t.Fatalf("output missing alias: %s", stdout.String())
+	}
+	if strings.Contains(stdout.String(), "UUID:") || strings.Contains(stdout.String(), "started-uuid") {
+		t.Fatalf("output leaked started task UUID in default mode: %s", stdout.String())
 	}
 }
 
diff --git a/internal/askcli/formatter.go b/internal/askcli/formatter.go
index fc4a1d9..5d2ed76 100644
--- a/internal/askcli/formatter.go
+++ b/internal/askcli/formatter.go
@@ -3,6 +3,7 @@ package askcli
 import (
 	"fmt"
 	"io"
+	"os"
 	"slices"
 	"strings"
 
@@ -139,7 +140,9 @@ func detectTaskListTerminalWidth(w io.Writer) int {
 func FormatTaskInfo(t TaskExport, alias string, dependencyAliases map[string]string) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "ID:          %s\n", alias)
-	fmt.Fprintf(&b, "UUID:        %s\n", t.UUID)
+	if debugEnabled() {
+		fmt.Fprintf(&b, "UUID:        %s\n", t.UUID)
+	}
 	fmt.Fprintf(&b, "Description: %s\n", t.Description)
 	fmt.Fprintf(&b, "Status:      %s\n", t.Status)
 	fmt.Fprintf(&b, "Started:     %s\n", formatTaskStarted(t))
@@ -163,6 +166,11 @@ func FormatTaskInfo(t TaskExport, alias string, dependencyAliases map[string]str
 	return b.String()
 }
 
+func debugEnabled() bool {
+	_, ok := os.LookupEnv("HEXAI_DEBUG")
+	return ok
+}
+
 // FormatSuccess returns the success string written to stdout after a task command runs.
 func FormatSuccess(alias string) string {
 	return fmt.Sprintf("ok %s\n", alias)
diff --git a/internal/askcli/formatter_test.go b/internal/askcli/formatter_test.go
index 61ede0a..e473ed4 100644
--- a/internal/askcli/formatter_test.go
+++ b/internal/askcli/formatter_test.go
@@ -2,10 +2,24 @@ package askcli
 
 import (
 	"fmt"
+	"os"
 	"strings"
 	"testing"
 )
 
+func unsetTestEnv(t *testing.T, key string) {
+	t.Helper()
+	oldValue, hadValue := os.LookupEnv(key)
+	_ = os.Unsetenv(key)
+	t.Cleanup(func() {
+		if !hadValue {
+			_ = os.Unsetenv(key)
+			return
+		}
+		_ = os.Setenv(key, oldValue)
+	})
+}
+
 func TestFormatTaskList(t *testing.T) {
 	tasks := []TaskExport{
 		{UUID: "uuid-1", Description: "Short task", Status: "pending", Priority: "H", Tags: []string{"cli"}, Urgency: 15.0},
@@ -145,6 +159,7 @@ func TestFormatTaskListForWidth_TruncatesDescriptionWhenTerminalIsNarrow(t *test
 }
 
 func TestFormatTaskInfo(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	task := TaskExport{
 		UUID:        "test-uuid",
 		Description: "Test description",
@@ -165,8 +180,8 @@ func TestFormatTaskInfo(t *testing.T) {
 	if !strings.Contains(output, "ID:          0") {
 		t.Fatalf("FormatTaskInfo missing alias ID: %s", output)
 	}
-	if !strings.Contains(output, "test-uuid") {
-		t.Fatalf("FormatTaskInfo missing UUID: %s", output)
+	if strings.Contains(output, "UUID:") || strings.Contains(output, "test-uuid") {
+		t.Fatalf("FormatTaskInfo leaked UUID in default mode: %s", output)
 	}
 	if !strings.Contains(output, "H") {
 		t.Fatalf("FormatTaskInfo missing priority H: %s", output)
@@ -188,6 +203,16 @@ func TestFormatTaskInfo(t *testing.T) {
 	}
 }
 
+func TestFormatTaskInfo_DebugShowsUUID(t *testing.T) {
+	t.Setenv("HEXAI_DEBUG", "1")
+	task := TaskExport{UUID: "test-uuid", Description: "Test description", Status: "pending", Priority: "H", Urgency: 1}
+
+	output := FormatTaskInfo(task, "0", nil)
+	if !strings.Contains(output, "UUID:        test-uuid") {
+		t.Fatalf("FormatTaskInfo missing UUID in debug mode: %s", output)
+	}
+}
+
 func TestFormatSuccess(t *testing.T) {
 	output := FormatSuccess("0")
 	if !strings.Contains(output, "ok") || !strings.Contains(output, "0") {
@@ -266,6 +291,7 @@ func TestRejectNumericID(t *testing.T) {
 }
 
 func TestFormatTaskInfo_NoOptionalFields(t *testing.T) {
+	unsetTestEnv(t, "HEXAI_DEBUG")
 	task := TaskExport{
 		UUID:        "simple-uuid",
 		Description: "Simple task",
@@ -275,8 +301,8 @@ func TestFormatTaskInfo_NoOptionalFields(t *testing.T) {
 		Urgency:     0,
 	}
 	output := FormatTaskInfo(task, "0", nil)
-	if !strings.Contains(output, "simple-uuid") {
-		t.Fatalf("FormatTaskInfo missing UUID: %s", output)
+	if strings.Contains(output, "UUID:") || strings.Contains(output, "simple-uuid") {
+		t.Fatalf("FormatTaskInfo leaked UUID in default mode: %s", output)
 	}
 	if !strings.Contains(output, "Started:     no") {
 		t.Fatalf("FormatTaskInfo should show Started: no when not started: %s", output)