[ergofobe]

Closes #33.

What was wrong

imogen profiles --json serialised the whole Config with out.json(&config), and Profile carries access_token and refresh_token with skip_serializing_if only for None. On any logged-in machine that command put live bearer credentials into whatever consumed the stream — a pipe, a CI log, a shell history, a bug report, an agent transcript.

The table immediately below showed name, server, browser|token and scopes, and no secret. The two audiences disagreed about what was safe to print, and the machine one got strictly more — the extra part being the credential.

What changed

--json now answers with a ProfilesView: the same four things the table shows, plus expiresAt (unix ms) where there is one. The top-level shape — current and a profiles map keyed by name — is unchanged, so anything reading .current or .profiles.home.server still works.

This is a wider break of the profiles --json contract than just the credentials, and worth stating plainly: client_id, expires_in and obtained_at are gone from the output too. Nothing is lost — signedInVia stands in for client_id, and expiresAt for the other two — but anyone scripting against .profiles.*.expires_in has to move.

$ imogen profiles --json
{
  "current": "home",
  "profiles": {
    "family": { "server": "https://family.example.com", "signedInVia": "token", "scope": "" },
    "home":   { "server": "https://photos.example.com", "signedInVia": "browser",
                "scope": "library:read", "expiresAt": 1700003600000 }
  }
}

A view struct, not #[serde(skip_serializing)] on the token fields. Both close today's leak. The attribute has to be remembered by whoever adds the next credential to Config — the same omission that caused this bug, waiting to happen again. A struct that names everything it prints has to be extended on purpose, so it cannot leak a new field by omission. The test greps the serialised bytes for the secret rather than checking fields one by one, for the same reason.

The table's "signed in via" and its notion of which profile is current now come from the same two helpers the view uses, so the two audiences cannot drift apart again. current_profile also fixes a small honesty problem the old default_profile_name() had here: it invents "default" for an empty config, which is right when naming a profile about to be written and wrong when describing what is saved.

Nothing needs the token via --json today. login --json already answers with profile, server, user and the credentials path; logout --json with a name and a flag. Nothing in the repo reads a token back out of a --json stream — auth.rs and context.rs take it from Config in process. If a token is ever wanted on stdout it should be an explicit, separate, deliberate command, not a side effect of listing profiles.

Nothing on the wire changes.

Verify

cargo test --locked && cargo fmt --check && cargo clippy --all-targets --locked -- -D warnings && cargo build --release --locked

test result: ok. 128 passed; 0 failed; 2 ignored — fmt, clippy and the release build clean.

The reproducing test was written first and watched fail, printing the leak verbatim:

the access token reached stdout: {"current":"home","profiles":{"home":{...,"access_token":"at-SECRET-ACCESS","refresh_token":"rt-SECRET-REFRESH",...}}}

Review

code-review at medium, three iterations, scoped by PR URL — main...HEAD in the worktree pointed the tool at an unrelated repo. Two findings fixed, both as their own commits:

• significant — current_profile skipped a current naming a profile that is no longer saved and fell to the first key, while every other command resolves through Config::default_profile_name, which returns it verbatim. profiles would have reported and painted one login while ls failed on another — the same disagreement between audiences this PR exists to remove. It now gives default_profile_name's answer, departing only for the empty config.
• significant — the new keys were snake_case while every key this program synthesises is camelCase. Aligned before the shape is public.

The final run reported zero blockers and zero significants.

Found, not fixed

Nothing. session.rs is the only place that serialises a Config, and no other command puts a token on stdout.

🤖 Generated with Claude Code