Harden redacted share prompt handling

Author: ozymandiashh

CHANGELOG.md

@@ -3,7 +3,7 @@
 ## Unreleased
 
 ### Added (CLI)
-- **Redacted share bundles.** New `codeburn share` command writes a local JSON support bundle with project/session/turn structure while pseudonymizing project labels and redacting common emails, local paths, credentials, bearer tokens, and API keys. Supports period, date range, provider, project, exclude, and output-path filters.
+- **Redacted share bundles.** New `codeburn share` command writes a local JSON support bundle with project/session/turn structure while pseudonymizing project labels and redacting common emails, local paths, credentials, bearer tokens, and API keys. Prompt text is omitted by default and can be explicitly included with `--include-prompts`. Supports period, date range, provider, project, exclude, and output-path filters.
 - **Multiple subscription plans can be tracked at the same time.**
   `codeburn plan set` now stores plans in a provider-keyed `plans` map, so
   setting a Codex custom plan no longer overwrites an existing Claude plan.

README.md

@@ -78,7 +78,7 @@ codeburn status                 # compact one-liner (today + month)
 codeburn status --format json
 codeburn export                 # CSV with today, 7 days, 30 days
 codeburn export -f json         # JSON export
-codeburn share                  # redacted JSON bundle for support/debugging
+codeburn share                  # redacted JSON bundle; prompts omitted by default
 codeburn optimize               # find waste, get copy-paste fixes
 codeburn optimize -p week       # scope the scan to last 7 days
 codeburn compare                # side-by-side model comparison
@@ -344,9 +344,10 @@ codeburn share                         # 7-day redacted JSON bundle
 codeburn share -p 30days               # last 30 days
 codeburn share --provider claude       # provider-specific bundle
 codeburn share --project api -o api-share.json
+codeburn share --include-prompts       # opt in to redacted prompt text
 ```
 
-The bundle keeps enough structure to debug provider parsing and cost attribution: pseudonymous projects, sessions, turns, models, token usage, tools, activity categories, and costs. Redaction is best-effort; review the generated file before posting it publicly.
+The default bundle omits prompt text (`userMessage: null`) and keeps enough structure to debug provider parsing and cost attribution: pseudonymous projects, sessions, turns, models, token usage, tools, activity categories, and costs. `--include-prompts` keeps best-effort redacted prompt text for cases where maintainers explicitly need it. Review the generated file before posting it publicly.
 
 ## Menu Bar
 

src/main.ts

@@ -706,6 +706,7 @@ program
   .option('--provider <provider>', 'Filter by provider (e.g. claude, gemini, cursor, copilot)', 'all')
   .option('--project <name>', 'Include only projects matching name (repeatable)', collect, [])
   .option('--exclude <name>', 'Exclude projects matching name (repeatable)', collect, [])
+  .option('--include-prompts', 'Include redacted user prompts. By default prompts are omitted.')
   .action(async (opts) => {
     let customRange: DateRange | null = null
     try {
@@ -744,6 +745,7 @@ program
       provider: opts.provider,
       project: opts.project,
       exclude: opts.exclude,
+      includePrompts: opts.includePrompts === true,
     })
     const savedPath = await writeRedactedShare(share, outputPath)
     console.log(`\n  Redacted share exported to: ${savedPath}`)

src/share.ts

@@ -13,6 +13,7 @@ export type RedactedShareOptions = {
   provider: string
   project: string[]
   exclude: string[]
+  includePrompts?: boolean
 }
 
 type RedactedCall = {
@@ -37,7 +38,7 @@ type RedactedTurn = {
   subCategory?: string
   retries: number
   hasEdits: boolean
-  userMessage: string
+  userMessage: string | null
   assistantCalls: RedactedCall[]
 }
 
@@ -78,6 +79,7 @@ export type RedactedShare = {
   redaction: {
     applied: true
     placeholders: Record<RedactionKind, string>
+    prompts: 'omitted' | 'redacted'
     uniqueReplacements: RedactionStats
   }
   summary: {
@@ -241,20 +243,20 @@ function redactCall(call: ParsedApiCall, redactor: StableRedactor): RedactedCall
   }
 }
 
-function redactTurn(turn: ClassifiedTurn, redactor: StableRedactor): RedactedTurn {
+function redactTurn(turn: ClassifiedTurn, redactor: StableRedactor, includePrompts: boolean): RedactedTurn {
   return {
     timestamp: turn.timestamp,
     sessionId: redactor.redactText(turn.sessionId),
     category: turn.category,
     ...(turn.subCategory ? { subCategory: redactor.redactText(turn.subCategory) } : {}),
     retries: turn.retries,
     hasEdits: turn.hasEdits,
-    userMessage: redactor.redactText(turn.userMessage),
+    userMessage: includePrompts && turn.userMessage ? redactor.redactText(turn.userMessage) : null,
     assistantCalls: turn.assistantCalls.map(call => redactCall(call, redactor)),
   }
 }
 
-function redactSession(session: SessionSummary, redactor: StableRedactor): RedactedSession {
+function redactSession(session: SessionSummary, redactor: StableRedactor, includePrompts: boolean): RedactedSession {
   return {
     sessionId: redactor.redactText(session.sessionId),
     firstTimestamp: session.firstTimestamp,
@@ -265,12 +267,13 @@ function redactSession(session: SessionSummary, redactor: StableRedactor): Redac
     totalCacheReadTokens: session.totalCacheReadTokens,
     totalCacheWriteTokens: session.totalCacheWriteTokens,
     apiCalls: session.apiCalls,
-    turns: session.turns.map(turn => redactTurn(turn, redactor)),
+    turns: session.turns.map(turn => redactTurn(turn, redactor, includePrompts)),
   }
 }
 
 export function buildRedactedShare(projects: ProjectSummary[], options: RedactedShareOptions): RedactedShare {
   const redactor = new StableRedactor()
+  const includePrompts = options.includePrompts ?? false
   const sessions = projects.flatMap(project => project.sessions)
   const turns = sessions.flatMap(session => session.turns)
 
@@ -283,7 +286,7 @@ export function buildRedactedShare(projects: ProjectSummary[], options: Redacted
     projectPath: redactor.redactText(project.projectPath),
     totalCostUSD: roundCost(project.totalCostUSD),
     totalApiCalls: project.totalApiCalls,
-    sessions: project.sessions.map(session => redactSession(session, redactor)),
+    sessions: project.sessions.map(session => redactSession(session, redactor, includePrompts)),
   }))
 
   const uniqueReplacements = redactor.stats()
@@ -309,6 +312,7 @@ export function buildRedactedShare(projects: ProjectSummary[], options: Redacted
         project: '[project:<index>]',
         secret: '[secret:<index>]',
       },
+      prompts: includePrompts ? 'redacted' : 'omitted',
       uniqueReplacements,
     },
     summary: {

tests/share.test.ts

@@ -77,7 +77,7 @@ describe('redacted share', () => {
     }
   })
 
-  it('builds a useful redacted support bundle', () => {
+  it('omits user prompts from support bundles by default', () => {
     const projects: ProjectSummary[] = [{
       project: 'client-a',
       projectPath: '/Users/husam/work/client-a',
@@ -147,8 +147,60 @@ describe('redacted share', () => {
     expect(share.projects[0]!.project).toBe('[project:1]')
     expect(share.projects[0]!.projectPath).toBe('[path:1]')
     expect(share.projects[0]!.sessions[0]!.totalCostUSD).toBe(1.2346)
-    const message = share.projects[0]!.sessions[0]!.turns[0]!.userMessage
     const call = share.projects[0]!.sessions[0]!.turns[0]!.assistantCalls[0]!
+    expect(share.redaction.prompts).toBe('omitted')
+    expect(share.projects[0]!.sessions[0]!.turns[0]!.userMessage).toBeNull()
+    expect(call.skills).toEqual(['browser-use'])
+    expect(call.hasAgentSpawn).toBe(true)
+    expect(call.hasPlanMode).toBe(true)
+  })
+
+  it('can include redacted prompts when explicitly requested', () => {
+    const projects: ProjectSummary[] = [{
+      project: 'client-a',
+      projectPath: '/Users/husam/work/client-a',
+      totalCostUSD: 1.23456,
+      totalApiCalls: 1,
+      sessions: [{
+        sessionId: 'session-1',
+        project: 'client-a',
+        firstTimestamp: '2026-05-05T10:00:00.000Z',
+        lastTimestamp: '2026-05-05T10:01:00.000Z',
+        totalCostUSD: 1.23456,
+        totalInputTokens: 1000,
+        totalOutputTokens: 200,
+        totalCacheReadTokens: 50,
+        totalCacheWriteTokens: 25,
+        apiCalls: 1,
+        turns: [{
+          userMessage: 'fix client-a at /Users/husam/work/client-a for husam@example.com with token=secret-token-12345',
+          assistantCalls: [],
+          timestamp: '2026-05-05T10:00:00.000Z',
+          sessionId: 'session-1',
+          category: 'debugging',
+          retries: 1,
+          hasEdits: true,
+        }],
+        modelBreakdown: {},
+        toolBreakdown: {},
+        mcpBreakdown: {},
+        bashBreakdown: {},
+        categoryBreakdown: {},
+        skillBreakdown: {},
+      }],
+    }]
+
+    const share = buildRedactedShare(projects, {
+      label: '7 Days',
+      range: { start: new Date('2026-05-01T00:00:00.000Z'), end: new Date('2026-05-07T23:59:59.999Z') },
+      provider: 'all',
+      project: [],
+      exclude: [],
+      includePrompts: true,
+    })
+
+    const message = share.projects[0]!.sessions[0]!.turns[0]!.userMessage
+    expect(share.redaction.prompts).toBe('redacted')
     expect(message).not.toContain('/Users/husam')
     expect(message).not.toContain('husam@example.com')
     expect(message).not.toContain('secret-token-12345')
@@ -157,9 +209,54 @@ describe('redacted share', () => {
     expect(message).toContain('[email:1]')
     expect(message).toContain('[project:1]')
     expect(message).toContain('[secret:1]')
-    expect(call.skills).toEqual(['browser-use'])
-    expect(call.hasAgentSpawn).toBe(true)
-    expect(call.hasPlanMode).toBe(true)
+  })
+
+  it('keeps null user prompts null even when prompt redaction is enabled', () => {
+    const projects = [{
+      project: 'client-a',
+      projectPath: '/Users/husam/work/client-a',
+      totalCostUSD: 0.01,
+      totalApiCalls: 1,
+      sessions: [{
+        sessionId: 'session-1',
+        project: 'client-a',
+        firstTimestamp: '2026-05-05T10:00:00.000Z',
+        lastTimestamp: '2026-05-05T10:01:00.000Z',
+        totalCostUSD: 0.01,
+        totalInputTokens: 10,
+        totalOutputTokens: 5,
+        totalCacheReadTokens: 0,
+        totalCacheWriteTokens: 0,
+        apiCalls: 1,
+        turns: [{
+          userMessage: null,
+          assistantCalls: [],
+          timestamp: '2026-05-05T10:00:00.000Z',
+          sessionId: 'session-1',
+          category: 'debugging',
+          retries: 0,
+          hasEdits: false,
+        }],
+        modelBreakdown: {},
+        toolBreakdown: {},
+        mcpBreakdown: {},
+        bashBreakdown: {},
+        categoryBreakdown: {},
+        skillBreakdown: {},
+      }],
+    }] as unknown as ProjectSummary[]
+
+    const share = buildRedactedShare(projects, {
+      label: '7 Days',
+      range: { start: new Date('2026-05-01T00:00:00.000Z'), end: new Date('2026-05-07T23:59:59.999Z') },
+      provider: 'all',
+      project: [],
+      exclude: [],
+      includePrompts: true,
+    })
+
+    expect(share.redaction.prompts).toBe('redacted')
+    expect(share.projects[0]!.sessions[0]!.turns[0]!.userMessage).toBeNull()
   })
 
   it('redacts project labels without mangling unrelated substrings', () => {
@@ -203,6 +300,7 @@ describe('redacted share', () => {
       provider: 'all',
       project: ['api'],
       exclude: ['client-a'],
+      includePrompts: true,
     })
 
     const message = share.projects[0]!.sessions[0]!.turns[0]!.userMessage
@@ -256,6 +354,7 @@ describe('redacted share', () => {
       provider: 'all',
       project: [],
       exclude: [],
+      includePrompts: true,
     })
 
     expect(share.projects[0]!.sessions[0]!.turns[0]!.userMessage).toBe('[project:1] uses token=[secret:1]')