CLI prints the API token (and other secrets) in full under --format json/pretty and --debug, regardless of --show-sensitive

Summary

After setting an instance token via context add, I don't want the CLI to ever print that token back out unless I explicitly ask for it. This matters a lot for using the CLI from scripts/AI agents: any command's output can end up in a log file, a transcript, or an agent's context window, and today there's no safe way to guarantee the token (or other secrets) won't be in there.

Fields like the instance token are already tagged sensitive:"true" in the model structs and are correctly hidden by the default table output unless --show-sensitive/-s is passed. That protection only exists in the table formatter, though.

Bug

internal/output/json.go and internal/output/pretty.go marshal structs directly with encoding/json.Encoder, which has no concept of the sensitive struct tag at all. So fetching context/instance details with the json or pretty output format prints the real token in plaintext, even without --show-sensitive. The same is true for every other sensitive:"true" field across the codebase — SSH private/public keys (the private-key commands), webhook secrets, OAuth client secrets, database/service environment variable values, server IP/user, etc. A few individual commands (cloud-token, s3, cloudinit) have their own hand-rolled redaction for their one specific field, but most commands have none, so the underlying model's real value goes straight to stdout.

Separately, debug mode logs full request/response bodies to stderr and only masks the literal JSON key named "token" — every other sensitive field above is printed there too, independent of the output format or show-sensitive flag entirely.

Impact

This already leaked a live Coolify API token (and, separately, private key material) into an AI coding agent's transcript, just from running an ordinary structured-output command for inspection.

Expected behavior

Any field marked sensitive:"true" should be hidden (********) under every output format — table, json, and pretty — unless --show-sensitive/-s is explicitly passed, exactly like table output already behaves. Debug logging should never print real secret values regardless of flags, since it's a diagnostic trace, not a deliberate request to reveal a value.

Fix

I've written and verified a fix (reflection-based redaction shared across all three formatters, plus closing the same gap in the debug logger) and will open a PR against main shortly.

Start with internal/output/json.go and internal/output/pretty.go, then trace the debug logger that writes full request and response bodies to stderr. Verify how the existing sensitive:"true" tags and --show-sensitive flag are handled by the table formatter. Done means sensitive fields are masked in JSON and pretty output unless explicitly requested, while debug output never exposes their real values.