AIT-256: mask the email in login identity echoes

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}

src/auth/__tests__/bootstrap.test.ts

@@ -244,7 +244,7 @@ describe('hookmyapp login --code', () => {
  // Identity echo present in stdout.
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
 
  // runWizard was invoked — the /workspaces apiClient mock confirms it.
@@ -399,11 +399,14 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).toMatch(
- /Replaced previous session \(was: old@other\.com, workspace "Old Workspace"\)/,
+ /Replaced previous session \(was: ol\*\*\*@o\*\*\*\.com, workspace "Old Workspace"\)/,
  );
  expect(out).toMatch(
- /Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
+ // Raw addresses must never reach the human-readable output.
+ expect(out).not.toContain('info@ordvir.com');
+ expect(out).not.toContain('old@other.com');
  // "was:" MUST appear before the "Logged in as" line.
  const wasIdx = out.search(/Replaced previous session/);
  const loggedIdx = out.search(/Logged in as/);
@@ -440,7 +443,8 @@ describe('hookmyapp login --code', () => {
 
  const out = logSpy.mock.calls.flat().join('\n');
  expect(out).not.toMatch(/Replaced previous session/);
- expect(out).toMatch(/Logged in as info@ordvir\.com/);
+ expect(out).toMatch(/Logged in as in\*\*\*@o\*\*\*\.com, workspace/);
+ expect(out).not.toContain('info@ordvir.com');
  logSpy.mockRestore();
  });
 
@@ -582,7 +586,7 @@ describe('hookmyapp login --code', () => {
  // literal "Logged in as", email, comma, space, workspace name in
  // double quotes. House style bans em-dashes in user-facing copy.
  expect(out).toMatch(
- /\u2713.*Logged in as info@ordvir\.com, workspace "Or's Workspace"/,
+ /\u2713.*Logged in as in\*\*\*@o\*\*\*\.com, workspace "Or's Workspace" \(ws_/,
  );
  logSpy.mockRestore();
  });

src/auth/login.ts

@@ -3,6 +3,7 @@ import { saveCredentials, peekIdentity } from './store.js';
 import { AuthError, NetworkError, ValidationError } from '../output/error.js';
 import { addExamples } from '../output/help.js';
 import { c, icon } from '../output/color.js';
+import { displayEmail } from '../output/mask.js';
 import { cliCommandPrefix } from '../output/cli-self.js';
 import {
  getEffectiveApiUrl,
@@ -468,11 +469,11 @@ export async function runBootstrapCodeExchange(
  (prior.email !== data.user.email || prior.workspaceSlug !== data.workspace.name)
  ) {
  console.log(
- `${c.success(icon.success)} Replaced previous session (was: ${prior.email}, workspace "${prior.workspaceSlug}")`,
+ `${c.success(icon.success)} Replaced previous session (was: ${displayEmail(prior.email)}, workspace "${prior.workspaceSlug}")`,
  );
  }
  console.log(
- `${c.success(icon.success)} Logged in as ${data.user.email}, workspace "${data.workspace.name}"`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(data.user.email)}, workspace "${data.workspace.name}" (${data.workspace.id})`,
  );
 
  await runWizard({ phone: opts.phone, next: opts.next, json: opts.json });
@@ -598,7 +599,7 @@ async function persistAgentCredential(
  }
  const n = cred.scopes.length;
  console.log(
- `${c.success(icon.success)} Logged in as ${email} (${n} scope${n === 1 ? '' : 's'})`,
+ `${c.success(icon.success)} Logged in as ${displayEmail(email)} (${n} scope${n === 1 ? '' : 's'})`,
  );
 }
 

src/output/__tests__/mask.test.ts

@@ -0,0 +1,24 @@
+import { describe, test, expect } from 'vitest';
+import { displayEmail } from '../mask.js';
+
+// Lockstep contract: these expectations mirror maskEmail in the hookmyapp
+// backend instruction template (AIT-256). If one side changes, both must.
+describe('displayEmail', () => {
+ test('masks local part after 2 chars and domain to first char + tld', () => {
+ expect(displayEmail('info@ordvir.com')).toBe('in***@o***.com');
+ expect(displayEmail('edgargov55@gmail.com')).toBe('ed***@g***.com');
+ });
+
+ test('never emits the raw address', () => {
+ for (const raw of ['info@ordvir.com', 'edgargov55@gmail.com']) {
+ expect(displayEmail(raw)).not.toContain(raw);
+ expect(displayEmail(raw)).not.toContain(raw.split('@')[0]);
+ }
+ });
+
+ test('degrades safely on malformed input without leaking it', () => {
+ expect(displayEmail('nodomain')).toBe('***');
+ expect(displayEmail('@lead.com')).toBe('***');
+ expect(displayEmail('a@b')).toBe('a***@b***');
+ });
+});

src/output/mask.ts

@@ -0,0 +1,27 @@
+/**
+ * Deterministic display mask for the login identity echo (AIT-256).
+ *
+ * MUST stay byte-for-byte in lockstep with `maskEmail` in the hookmyapp
+ * backend (`backend/src/auth/bootstrap/instruction-template.ts`): the
+ * bootstrap instruction block renders the Expected-output line masked, and
+ * the executing AI compares this CLI's echo against it. Same mask on both
+ * sides keeps the paste-into-wrong-AI safety net working while the raw
+ * address never appears on screen (screen-recording safety).
+ *
+ * Collision resistance comes from the workspace publicId rendered next to
+ * the workspace name in the same echo line (random id, customer-visible,
+ * zero PII) — NOT from an email hash, which would leak an enumerable
+ * identifier onto public surfaces.
+ *
+ * `--json` output is exempt: machine consumers get the raw email.
+ */
+export function displayEmail(email: string): string {
+ const at = email.indexOf('@');
+ if (at <= 0) return '***';
+ const local = email.slice(0, at);
+ const domain = email.slice(at + 1);
+ const lastDot = domain.lastIndexOf('.');
+ const tld = lastDot > 0 ? domain.slice(lastDot) : '';
+ const domainName = lastDot > 0 ? domain.slice(0, lastDot) : domain;
+ return `${local.slice(0, 2)}***@${domainName.charAt(0)}***${tld}`;
+}