Redact sensitive device authorization debug output

[dmerand]

WHY are these changes introduced?

The device authorization debug log serialized the full server response. In verbose mode this wrote device_code — a live credential while the flow is pending — and verification_uri_complete to the terminal and to anything that captures CLI output.

WHAT is this pull request doing?

• Log only non-sensitive metadata after device authorization: HTTP status, interval, expires_in. Omitted optional fields render as not provided.
• Keep user-facing output unchanged: the user code and verification link still appear in info output, and the returned values are untouched.
• Add regression tests that assert the secrets are absent from debug output, the retained diagnostics are present (so a later cleanup cannot silently empty the support channel), and the fallback rendering works.

How to test your changes?

Run shopify auth logout, then any authenticated command with --verbose (for example shopify theme list --verbose). Confirm the "Received device authorization response" debug line shows only status/interval/expiry, while the login prompt still shows the user code and link.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[Copilot]

Pull request overview

This PR prevents sensitive OAuth device authorization values (notably device_code and verification_uri_complete) from being emitted in verbose/debug logs, reducing the risk of credential leakage in captured CLI output while keeping the interactive login experience unchanged.

Changes:

• Replaced debug logging of the full device authorization response with a redacted, metadata-only message (HTTP status, interval, expires_in with a not provided fallback).
• Added regression tests to ensure debug output excludes sensitive fields while preserving expected user-facing info output.
• Added a patch changeset for @shopify/cli-kit documenting the user-visible fix.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
packages/cli-kit/src/private/node/session/device-authorization.ts	Redacts debug output to avoid logging live device authorization credentials.
packages/cli-kit/src/private/node/session/device-authorization.test.ts	Adds tests asserting secrets are absent from debug logs and fallback markers render correctly.
.changeset/redact-device-authorization-log.md	Patch changeset describing the redaction fix.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.