[codex] WOR-72: Hide raw JSON command structures in task details and activities

[0xroylee]

Workflow task: WOR-72

This PR was created by the devos.ing ADHD (Agentic Development Hub & Daemon) workflow.

Includes:

• plan + implement session output
• separate review/testing session

[0xroylee]

Review failed.

bun test passed with 1101 tests, but one WOR-72 acceptance case is still uncovered: raw structured payload/detail dumps can leak when a pretty-printed JSON block is embedded inside surrounding prose instead of being the entire field value.

Bug to fix:

• Embedded payload dumps leak nested fields
  • Repro:
    bun -e 'import { formatOperatorActivityText } from "./packages/web/src/components/issues-board/issue-activity-display-utils.ts"; const input = ["prefix", "{", " \"command\": \"codex exec --prompt secret\",", " \"payload\": {", " \"prompt\": \"internal prompt\"", " }", "}", "suffix"].join("\n"); console.log(formatOperatorActivityText(input));'
  • Observed: output still includes "prompt": "internal prompt" after only the outer raw JSON field lines are removed.
  • Expected: embedded raw command JSON/payload/detail dump blocks should be fully suppressed while preserving readable surrounding prose such as prefix and suffix.
  • Likely path: packages/web/src/components/issues-board/issue-activity-display-utils.ts, especially formatText, formatLine, and isRawJsonDumpLine.
  • Fix expectation: drop full raw structured blocks when a command/payload/detail dump starts inside mixed prose, including nested object/array lines, while still extracting safe fields from whole JSON values.

Please add a focused test in packages/web/tests/issue-activity-display-utils.test.ts, then run:

bun test packages/web/tests/issue-activity-display-utils.test.ts packages/web/tests/issue-activity-copy-utils.test.ts

and the full:

bun test

[0xroylee]

devos.ing implementation feedback for WOR-72

Review/testing summary:
bun test ran successfully with 1101 passing tests, but the formatter still leaks nested payload/detail contents when a raw pretty-printed JSON block is embedded inside surrounding prose instead of being the entire field value. This falls inside WOR-72’s acceptance scope because task detail/activity surfaces should suppress raw command payloads and detail dumps, not only top-level command/payload lines.

Fix instructions for the implementation agent:
Address every item below, use each body as the repair checklist, and rerun the listed verification checks.

Bugs to fix:

1. Embedded payload dumps leak nested fields
   Failing command/repro: bun -e 'import { formatOperatorActivityText } from "./packages/web/src/components/issues-board/issue-activity-display-utils.ts"; const input = ["prefix", "{", " \\"command\\": \\"codex exec --prompt secret\\",", " \\"payload\\": {", " \\"prompt\\": \\"internal prompt\\"", " }", "}", "suffix"].join("\\n"); console.log(formatOperatorActivityText(input));'
   Observed: The output keeps "prompt": "internal prompt" after removing only the outer raw JSON field lines.
   Expected: Embedded raw command JSON/payload/detail dump blocks should be fully suppressed while preserving readable surrounding prose such as prefix and suffix.
   Likely files/code path: packages/web/src/components/issues-board/issue-activity-display-utils.ts, especially line-oriented filtering in formatText, formatLine, and isRawJsonDumpLine.
   Fix expectation: Teach the sanitizer to drop full raw structured blocks when a command/payload/detail dump starts inside mixed prose, including nested object/array lines, while still extracting safe fields from whole JSON values.
   Verification: Add a focused test in packages/web/tests/issue-activity-display-utils.test.ts for embedded pretty-printed payload blocks, then run bun test packages/web/tests/issue-activity-display-utils.test.ts packages/web/tests/issue-activity-copy-utils.test.ts and bun test.

[0xroylee]

Review failed with one acceptance-scope bug.

bun test passed with 1102 tests, but the new activity formatter can still leak embedded JSON payload content when readable result text contains unbalanced brace/bracket characters.

Bug: Embedded JSON block parsing can leak payload text

Repro:

bun --eval 'import { formatOperatorActivityText } from "./packages/web/src/components/issues-board/issue-activity-display-utils.ts"; const text = prefix\n{\n "result": "Remove the trailing } character.",\n "payload": {\n "prompt": "secret"\n }\n}\nsuffix; console.log(formatOperatorActivityText(text));'

Observed: output includes raw JSON fragments and leaks "prompt": "secret".

Expected: output should preserve readable text such as Result: Remove the trailing } character. and suffix, while suppressing raw JSON structure and payload fields.

Likely path: packages/web/src/components/issues-board/issue-activity-display-utils.ts, especially readJsonBlock / jsonBalanceDelta.

Fix expectation: replace delimiter counting that includes characters inside JSON strings with a safer block reader, such as incrementally appending lines and attempting JSON.parse until a complete JSON value parses, or implementing string-aware brace/bracket scanning.

Please add a formatter test for embedded pretty-printed structured output whose result contains an unmatched } or ], assert no payload/prompt/raw JSON leaks, then run:

bun test packages/web/tests/issue-activity-display-utils.test.ts packages/web/tests/issue-activity-copy-utils.test.ts

and the full:

bun test

[0xroylee]

devos.ing implementation feedback for WOR-72

Review/testing summary:
Review found one acceptance-scope bug in the new activity formatter: bun test ran successfully with 1102 passing tests, but embedded pretty-printed JSON can still leak payload content when readable result text contains unbalanced brace/bracket characters.

Fix instructions for the implementation agent:
Address every item below, use each body as the repair checklist, and rerun the listed verification checks.

Bugs to fix:

1. Embedded JSON block parsing can leak payload text
   Failing command/repro: bun --eval 'import { formatOperatorActivityText } from "./packages/web/src/components/issues-board/issue-activity-display-utils.ts"; const text = prefix\n{\n "result": "Remove the trailing } character.",\n "payload": {\n "prompt": "secret"\n }\n}\nsuffix; console.log(formatOperatorActivityText(text));'
   Observed: Output includes raw JSON fragments and leaks "prompt": "secret" instead of cleanly extracting the readable result.
   Expected: Output should preserve readable text such as Result: Remove the trailing } character. and suffix while suppressing raw JSON structure and payload fields.
   Likely files/code path: packages/web/src/components/issues-board/issue-activity-display-utils.ts, especially readJsonBlock and jsonBalanceDelta around lines 35-48 and 141-148.
   Fix expectation: Replace delimiter counting that includes characters inside JSON strings with a safer block reader, for example incrementally append lines and attempt JSON.parse until a complete JSON value parses, or implement string-aware brace/bracket scanning.
   Verification: Add a formatter test for embedded pretty-printed structured output whose result contains an unmatched } or ], assert no payload/prompt/raw JSON leaks, then run bun test packages/web/tests/issue-activity-display-utils.test.ts packages/web/tests/issue-activity-copy-utils.test.ts and bun test.

[0xroylee]

Review passed for WOR-72.

The issue-board activity/detail/card/copy surfaces now format readable result, thinking, and planning text while suppressing command JSON and payload dumps. Focused coverage was added for the sanitizer and copy path.

Validation:

• Focused tests passed
• bun test passed: 1103 tests, 0 failures