feat(cli): add redacted share bundles

[ozymandiashh]

Summary

CodeBurn users sometimes need to share enough local telemetry to debug provider parsing, cost attribution, or a suspicious session, but the existing JSON/reporting surfaces are not safe to paste into GitHub issues. Raw reports can include project names, absolute local paths, prompts, shell fragments, emails, and tokens.

This adds codeburn share, a local-only redacted JSON support bundle. It keeps the useful debugging structure (projects, sessions, turns, models, token usage, tools, activity categories, and costs) while replacing sensitive strings with stable placeholders such as [project:1], [path:1], [email:1], and [secret:1].

What changed

• Add codeburn share with period, custom date range, provider, project, exclude, output-path, and --include-prompts options.
• Add src/share.ts for building codeburn.share.v1 bundles from parsed project summaries.
• Omit prompt text by default with userMessage: null; prompt text is only included through explicit --include-prompts opt-in.
• Add redaction.prompts metadata so bundle consumers can distinguish omitted from redacted.
• Pseudonymize project labels, including values passed through --project and --exclude.
• Redact common sensitive values: emails, macOS/Linux/Windows/UNC/relative paths, URL basic-auth credentials, bearer/basic auth headers, API key / token / password-style assignments, and common token formats.
• Preserve useful non-content debugging signals such as models, token usage, costs, tools, skills, agent-spawn flags, plan-mode flags, and timestamps.
• Write default bundles with a timestamped filename to avoid accidental same-day overwrites.
• Document the command and add an Unreleased changelog entry.

Privacy model

The command does not upload anything and does not add a support service. It writes a local JSON file and tells users to review the output before posting it publicly. Redaction is intentionally best-effort: it covers common leak patterns while preserving enough structure for maintainers to understand parser and cost attribution issues.

Prompt text is omitted by default. --include-prompts is intended only for cases where maintainers explicitly need prompt text, and even then prompt redaction is best-effort.

The tests construct secret-like fixture values at runtime instead of storing literal credentials in the repository, so the redaction cases remain covered without tripping repository secret scanning.

Validation

• npx vitest run tests/share.test.ts tests/export.test.ts tests/cli-date.test.ts — 25/25 tests passed.
• npm run build — passed.
• git diff --check — passed.
• Structural smoke on a locally generated bundle: redaction.prompts=omitted, non_null_user_messages=0; temporary bundle deleted after the check.
• Claude Opus 4.7 effort max review — PASS.
• Gemini 3.1 Pro Preview review — PASS.

[ozymandiashh]

Validation run on macOS arm64 with real local usage data. No project names, prompts, paths, session IDs, or internal product details are included here.

Commands run:

• npx vitest run tests/share.test.ts tests/export.test.ts tests/cli-date.test.ts
• npx tsx src/cli.ts share --period today --provider claude --output <tmp-file>
• local redaction scan on the generated bundle for home path, obvious email patterns, and common API-token patterns

Results:

• Targeted tests passed: 21/21.
• A real-data share bundle was generated successfully.
• The redaction scan found 0 occurrences of the local home path, obvious email pattern, and common API-token patterns checked.
• The generated bundle was deleted after validation.

Caveat: the generated bundle can still contain conversation text in userMessage after pattern-based redaction. I would not attach a real-data bundle publicly unless userMessage content is intentionally omitted or separately scrubbed.

[ozymandiashh]

Follow-up patch rebased onto current main and pushed as 397a118.

What changed:

• Default codeburn share bundles omit prompt text with userMessage: null.
• --include-prompts is an explicit opt-in for best-effort redacted prompt text.
• redaction.prompts metadata distinguishes omitted from redacted.
• Null prompt values stay null even when prompt inclusion is enabled.
• README/changelog and regression coverage were updated.

Validation/proof:

• npx vitest run tests/share.test.ts tests/export.test.ts tests/cli-date.test.ts — 25/25 tests passed.
• npm run build — passed.
• git diff --check — passed.
• Structural smoke on a locally generated bundle: redaction.prompts=omitted, non_null_user_messages=0; temporary bundle deleted.
• Claude Opus 4.7 effort max review — PASS.
• Gemini 3.1 Pro Preview review — PASS.

No local project names, prompts, paths, session IDs, or usage details are included here.

[ozymandiashh]

Closing this — it's an unsolicited feature PR that's gone stale, and per CONTRIBUTING these should start from an issue with maintainer buy-in. Cleaning up my open-PR queue; happy to revisit via an issue if there's interest.