chore(privacy): stop publishing absolute home paths - #222
Conversation
Removes 146 occurrences of the operator's absolute home path from documentation, prose and shell defaults in this public repo. Functional config, test fixtures and generated files are untouched: $HOME is not expanded by JSON/YAML parsers and tests may assert the literal path. 1 such occurrences remain and need per-file review.
The earlier commit on this branch redacted documentation and stopped there.
Code, configuration, test fixtures and generated run artifacts still carried the
absolute home path, which is what the published branch actually exposes.
Substitutions used, and why they differ:
~ prose, shell command strings, and opaque fixture values,
none of which resolve the path
/Users/example/... fixtures that must stay a detectable private path. The
portfolio-truth validator keys on /users|home|root/, not
on the account name, so an anonymous account keeps every
assertion meaningful while naming nobody
Left alone deliberately, because each is a test that enforces the very thing
this branch is doing and redacting it would remove what the test proves:
package-surface.test.ts asserts five named operator surfaces do not contain
the path; the literal there is the needle, not a leak
the sealed local-execution evidence is SHA-256 pinned by its own contract test,
so a text edit invalidates the proof rather than redacting it. That one needs
a re-qualification run, not a substitution.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: efef96dea4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - [src-tauri/src/commands/mod.rs](~/AssistSupport/src-tauri/src/commands/mod.rs) had grown into a multi-thousand-line command hotspot. | ||
| - [src-tauri/src/lib.rs](~/AssistSupport/src-tauri/src/lib.rs) still owned one giant `generate_handler!` block, so registration and permission coverage depended on the same brittle file shape. |
There was a problem hiding this comment.
When these Markdown files are viewed on GitHub or another renderer, ~ is not expanded to the reader's home directory; it is treated as a literal relative URL component, so these links resolve under a nonexistent path such as docs/adr/~/AssistSupport/.... The same replacement breaks the source and evidence links throughout the changed documentation; use paths relative to each document or repository-root URLs instead.
Useful? React with 👍 / 👎.
1 participant
Replaces absolute home paths with
~in tracked files, so the repository stopspublishing the operator's macOS account name and local directory layout.
This is one of 31 identical branches across the portfolio. Every one of them was
committed and pushed but none was ever opened as a pull request, so the paths
stayed on the default branch and stayed public. Merging this is what actually
removes them.
No credential, token, key material or personal name was exposed. What leaks is
the account name and the shape of the directories under it, which is a
fingerprinting signal rather than a breach.
Some occurrences are deliberately left in place, and should not be redacted in a
follow-up:
there is the needle the test searches for, not a leak.
Redacting the path removes the thing the test proves.
invalidates the proof rather than redacting it; those need a re-run that
produces a fresh receipt, not a substitution.
Test fixtures that must stay a detectable private path use
/Users/example/...rather than
~, because the validator they exercise keys on/users|home|root/and not on the account name. That keeps each assertion meaningful while naming
nobody.