Add username log censor setting

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/adapter-utils/src/log-redaction.ts

@@ -1,19 +1,29 @@
 import type { TranscriptEntry } from "./types.js";
 
-export const REDACTED_HOME_PATH_USER = "[]";
+export const REDACTED_HOME_PATH_USER = "*";
+
+export interface HomePathRedactionOptions {
+  enabled?: boolean;
+}
+
+function maskHomePathUserSegment(value: string) {
+  const trimmed = value.trim();
+  if (!trimmed) return REDACTED_HOME_PATH_USER;
+  return `${trimmed[0]}${"*".repeat(Math.max(1, Array.from(trimmed).length - 1))}`;
+}
 
 const HOME_PATH_PATTERNS = [
   {
-    regex: /\/Users\/[^/\\\s]+/g,
-    replace: `/Users/${REDACTED_HOME_PATH_USER}`,
+    regex: /\/Users\/([^/\\\s]+)/g,
+    replace: (_match: string, user: string) => `/Users/${maskHomePathUserSegment(user)}`,
   },
   {
-    regex: /\/home\/[^/\\\s]+/g,
-    replace: `/home/${REDACTED_HOME_PATH_USER}`,
+    regex: /\/home\/([^/\\\s]+)/g,
+    replace: (_match: string, user: string) => `/home/${maskHomePathUserSegment(user)}`,
   },
   {
-    regex: /([A-Za-z]:\\Users\\)[^\\/\s]+/g,
-    replace: `$1${REDACTED_HOME_PATH_USER}`,
+    regex: /([A-Za-z]:\\Users\\)([^\\/\s]+)/g,
+    replace: (_match: string, prefix: string, user: string) => `${prefix}${maskHomePathUserSegment(user)}`,
   },
 ] as const;
 
@@ -23,7 +33,8 @@ function isPlainObject(value: unknown): value is Record<string, unknown> {
   return proto === Object.prototype || proto === null;
 }
 
-export function redactHomePathUserSegments(text: string): string {
+export function redactHomePathUserSegments(text: string, opts?: HomePathRedactionOptions): string {
+  if (opts?.enabled === false) return text;
   let result = text;
   for (const pattern of HOME_PATH_PATTERNS) {
     result = result.replace(pattern.regex, pattern.replace);
@@ -31,12 +42,12 @@ export function redactHomePathUserSegments(text: string): string {
   return result;
 }
 
-export function redactHomePathUserSegmentsInValue<T>(value: T): T {
+export function redactHomePathUserSegmentsInValue<T>(value: T, opts?: HomePathRedactionOptions): T {
   if (typeof value === "string") {
-    return redactHomePathUserSegments(value) as T;
+    return redactHomePathUserSegments(value, opts) as T;
   }
   if (Array.isArray(value)) {
-    return value.map((entry) => redactHomePathUserSegmentsInValue(entry)) as T;
+    return value.map((entry) => redactHomePathUserSegmentsInValue(entry, opts)) as T;
   }
   if (!isPlainObject(value)) {
     return value;
@@ -44,12 +55,12 @@ export function redactHomePathUserSegmentsInValue<T>(value: T): T {
 
   const redacted: Record<string, unknown> = {};
   for (const [key, entry] of Object.entries(value)) {
-    redacted[key] = redactHomePathUserSegmentsInValue(entry);
+    redacted[key] = redactHomePathUserSegmentsInValue(entry, opts);
   }
   return redacted as T;
 }
 
-export function redactTranscriptEntryPaths(entry: TranscriptEntry): TranscriptEntry {
+export function redactTranscriptEntryPaths(entry: TranscriptEntry, opts?: HomePathRedactionOptions): TranscriptEntry {
   switch (entry.kind) {
     case "assistant":
     case "thinking":
@@ -57,23 +68,27 @@ export function redactTranscriptEntryPaths(entry: TranscriptEntry): TranscriptEn
     case "stderr":
     case "system":
     case "stdout":
-      return { ...entry, text: redactHomePathUserSegments(entry.text) };
+      return { ...entry, text: redactHomePathUserSegments(entry.text, opts) };
     case "tool_call":
-      return { ...entry, name: redactHomePathUserSegments(entry.name), input: redactHomePathUserSegmentsInValue(entry.input) };
+      return {
+        ...entry,
+        name: redactHomePathUserSegments(entry.name, opts),
+        input: redactHomePathUserSegmentsInValue(entry.input, opts),
+      };
     case "tool_result":
-      return { ...entry, content: redactHomePathUserSegments(entry.content) };
+      return { ...entry, content: redactHomePathUserSegments(entry.content, opts) };
     case "init":
       return {
         ...entry,
-        model: redactHomePathUserSegments(entry.model),
-        sessionId: redactHomePathUserSegments(entry.sessionId),
+        model: redactHomePathUserSegments(entry.model, opts),
+        sessionId: redactHomePathUserSegments(entry.sessionId, opts),
       };
     case "result":
       return {
         ...entry,
-        text: redactHomePathUserSegments(entry.text),
-        subtype: redactHomePathUserSegments(entry.subtype),
-        errors: entry.errors.map((error) => redactHomePathUserSegments(error)),
+        text: redactHomePathUserSegments(entry.text, opts),
+        subtype: redactHomePathUserSegments(entry.subtype, opts),
+        errors: entry.errors.map((error) => redactHomePathUserSegments(error, opts)),
       };
     default:
       return entry;

packages/adapters/codex-local/src/ui/parse-stdout.ts

@@ -1,8 +1,4 @@
-import {
-  redactHomePathUserSegments,
-  redactHomePathUserSegmentsInValue,
-  type TranscriptEntry,
-} from "@paperclipai/adapter-utils";
+import { type TranscriptEntry } from "@paperclipai/adapter-utils";
 
 function safeJsonParse(text: string): unknown {
   try {
@@ -43,12 +39,12 @@ function errorText(value: unknown): string {
 }
 
 function stringifyUnknown(value: unknown): string {
-  if (typeof value === "string") return redactHomePathUserSegments(value);
+  if (typeof value === "string") return value;
   if (value === null || value === undefined) return "";
   try {
-    return JSON.stringify(redactHomePathUserSegmentsInValue(value), null, 2);
+    return JSON.stringify(value, null, 2);
   } catch {
-    return redactHomePathUserSegments(String(value));
+    return String(value);
   }
 }
 
@@ -61,8 +57,8 @@ function parseCommandExecutionItem(
   const command = asString(item.command);
   const status = asString(item.status);
   const exitCode = typeof item.exit_code === "number" && Number.isFinite(item.exit_code) ? item.exit_code : null;
-  const safeCommand = redactHomePathUserSegments(command);
-  const output = redactHomePathUserSegments(asString(item.aggregated_output)).replace(/\s+$/, "");
+  const safeCommand = command;
+  const output = asString(item.aggregated_output).replace(/\s+$/, "");
 
   if (phase === "started") {
     return [{
@@ -109,7 +105,7 @@ function parseFileChangeItem(item: Record<string, unknown>, ts: string): Transcr
     .filter((change): change is Record<string, unknown> => Boolean(change))
     .map((change) => {
       const kind = asString(change.kind, "update");
-      const path = redactHomePathUserSegments(asString(change.path, "unknown"));
+      const path = asString(change.path, "unknown");
       return `${kind} ${path}`;
     });
 
@@ -131,13 +127,13 @@ function parseCodexItem(
 
   if (itemType === "agent_message") {
     const text = asString(item.text);
-    if (text) return [{ kind: "assistant", ts, text: redactHomePathUserSegments(text) }];
+    if (text) return [{ kind: "assistant", ts, text }];
     return [];
   }
 
   if (itemType === "reasoning") {
     const text = asString(item.text);
-    if (text) return [{ kind: "thinking", ts, text: redactHomePathUserSegments(text) }];
+    if (text) return [{ kind: "thinking", ts, text }];
     return [{ kind: "system", ts, text: phase === "started" ? "reasoning started" : "reasoning completed" }];
   }
 
@@ -153,9 +149,9 @@ function parseCodexItem(
     return [{
       kind: "tool_call",
       ts,
-      name: redactHomePathUserSegments(asString(item.name, "unknown")),
+      name: asString(item.name, "unknown"),
       toolUseId: asString(item.id),
-      input: redactHomePathUserSegmentsInValue(item.input ?? {}),
+      input: item.input ?? {},
     }];
   }
 
@@ -167,12 +163,12 @@ function parseCodexItem(
       asString(item.result) ||
       stringifyUnknown(item.content ?? item.output ?? item.result);
     const isError = item.is_error === true || asString(item.status) === "error";
-    return [{ kind: "tool_result", ts, toolUseId, content: redactHomePathUserSegments(content), isError }];
+    return [{ kind: "tool_result", ts, toolUseId, content, isError }];
   }
 
   if (itemType === "error" && phase === "completed") {
     const text = errorText(item.message ?? item.error ?? item);
-    return [{ kind: "stderr", ts, text: redactHomePathUserSegments(text || "error") }];
+    return [{ kind: "stderr", ts, text: text || "error" }];
   }
 
   const id = asString(item.id);
@@ -181,14 +177,14 @@ function parseCodexItem(
   return [{
     kind: "system",
     ts,
-    text: redactHomePathUserSegments(`item ${phase}: ${itemType || "unknown"}${meta ? ` (${meta})` : ""}`),
+    text: `item ${phase}: ${itemType || "unknown"}${meta ? ` (${meta})` : ""}`,
   }];
 }
 
 export function parseCodexStdoutLine(line: string, ts: string): TranscriptEntry[] {
   const parsed = asRecord(safeJsonParse(line));
   if (!parsed) {
-    return [{ kind: "stdout", ts, text: redactHomePathUserSegments(line) }];
+    return [{ kind: "stdout", ts, text: line }];
   }
 
   const type = asString(parsed.type);
@@ -198,8 +194,8 @@ export function parseCodexStdoutLine(line: string, ts: string): TranscriptEntry[
     return [{
       kind: "init",
       ts,
-      model: redactHomePathUserSegments(asString(parsed.model, "codex")),
-      sessionId: redactHomePathUserSegments(threadId),
+      model: asString(parsed.model, "codex"),
+      sessionId: threadId,
     }];
   }
 
@@ -221,15 +217,15 @@ export function parseCodexStdoutLine(line: string, ts: string): TranscriptEntry[
     return [{
       kind: "result",
       ts,
-      text: redactHomePathUserSegments(asString(parsed.result)),
+      text: asString(parsed.result),
       inputTokens,
       outputTokens,
       cachedTokens,
       costUsd: asNumber(parsed.total_cost_usd),
-      subtype: redactHomePathUserSegments(asString(parsed.subtype)),
+      subtype: asString(parsed.subtype),
       isError: parsed.is_error === true,
       errors: Array.isArray(parsed.errors)
-        ? parsed.errors.map(errorText).map(redactHomePathUserSegments).filter(Boolean)
+        ? parsed.errors.map(errorText).filter(Boolean)
         : [],
     }];
   }
@@ -243,21 +239,21 @@ export function parseCodexStdoutLine(line: string, ts: string): TranscriptEntry[
     return [{
       kind: "result",
       ts,
-      text: redactHomePathUserSegments(asString(parsed.result)),
+      text: asString(parsed.result),
       inputTokens,
       outputTokens,
       cachedTokens,
       costUsd: asNumber(parsed.total_cost_usd),
-      subtype: redactHomePathUserSegments(asString(parsed.subtype, "turn.failed")),
+      subtype: asString(parsed.subtype, "turn.failed"),
       isError: true,
-      errors: message ? [redactHomePathUserSegments(message)] : [],
+      errors: message ? [message] : [],
     }];
   }
 
   if (type === "error") {
     const message = errorText(parsed.message ?? parsed.error ?? parsed);
-    return [{ kind: "stderr", ts, text: redactHomePathUserSegments(message || line) }];
+    return [{ kind: "stderr", ts, text: message || line }];
   }
 
-  return [{ kind: "stdout", ts, text: redactHomePathUserSegments(line) }];
+  return [{ kind: "stdout", ts, text: line }];
 }

packages/db/src/migrations/0039_curly_maria_hill.sql

@@ -0,0 +1 @@
+ALTER TABLE "instance_settings" ADD COLUMN "general" jsonb DEFAULT '{}'::jsonb NOT NULL;

packages/db/src/migrations/meta/_journal.json

@@ -274,6 +274,13 @@
       "when": 1773931592563,
       "tag": "0038_careless_iron_monger",
       "breakpoints": true
+    },
+    {
+      "idx": 39,
+      "version": "7",
+      "when": 1774011294562,
+      "tag": "0039_curly_maria_hill",
+      "breakpoints": true
     }
   ]
 }

packages/db/src/schema/instance_settings.ts

@@ -5,6 +5,7 @@ export const instanceSettings = pgTable(
   {
     id: uuid("id").primaryKey().defaultRandom(),
     singletonKey: text("singleton_key").notNull().default("default"),
+    general: jsonb("general").$type<Record<string, unknown>>().notNull().default({}),
     experimental: jsonb("experimental").$type<Record<string, unknown>>().notNull().default({}),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),

packages/shared/src/index.ts

@@ -121,6 +121,7 @@ export {
 export type {
   Company,
   InstanceExperimentalSettings,
+  InstanceGeneralSettings,
   InstanceSettings,
   Agent,
   AgentAccessState,
@@ -248,6 +249,9 @@ export type {
 } from "./types/index.js";
 
 export {
+  instanceGeneralSettingsSchema,
+  patchInstanceGeneralSettingsSchema,
+  type PatchInstanceGeneralSettings,
   instanceExperimentalSettingsSchema,
   patchInstanceExperimentalSettingsSchema,
   type PatchInstanceExperimentalSettings,

packages/shared/src/types/index.ts

@@ -1,5 +1,5 @@
 export type { Company } from "./company.js";
-export type { InstanceExperimentalSettings, InstanceSettings } from "./instance.js";
+export type { InstanceExperimentalSettings, InstanceGeneralSettings, InstanceSettings } from "./instance.js";
 export type {
   Agent,
   AgentAccessState,

packages/shared/src/types/instance.ts

@@ -1,9 +1,14 @@
+export interface InstanceGeneralSettings {
+  censorUsernameInLogs: boolean;
+}
+
 export interface InstanceExperimentalSettings {
   enableIsolatedWorkspaces: boolean;
 }
 
 export interface InstanceSettings {
   id: string;
+  general: InstanceGeneralSettings;
   experimental: InstanceExperimentalSettings;
   createdAt: Date;
   updatedAt: Date;

packages/shared/src/validators/index.ts

@@ -1,4 +1,8 @@
 export {
+  instanceGeneralSettingsSchema,
+  patchInstanceGeneralSettingsSchema,
+  type InstanceGeneralSettings,
+  type PatchInstanceGeneralSettings,
   instanceExperimentalSettingsSchema,
   patchInstanceExperimentalSettingsSchema,
   type InstanceExperimentalSettings,

packages/shared/src/validators/instance.ts

@@ -1,10 +1,18 @@
 import { z } from "zod";
 
+export const instanceGeneralSettingsSchema = z.object({
+  censorUsernameInLogs: z.boolean().default(false),
+}).strict();
+
+export const patchInstanceGeneralSettingsSchema = instanceGeneralSettingsSchema.partial();
+
 export const instanceExperimentalSettingsSchema = z.object({
   enableIsolatedWorkspaces: z.boolean().default(false),
 }).strict();
 
 export const patchInstanceExperimentalSettingsSchema = instanceExperimentalSettingsSchema.partial();
 
+export type InstanceGeneralSettings = z.infer<typeof instanceGeneralSettingsSchema>;
+export type PatchInstanceGeneralSettings = z.infer<typeof patchInstanceGeneralSettingsSchema>;
 export type InstanceExperimentalSettings = z.infer<typeof instanceExperimentalSettingsSchema>;
 export type PatchInstanceExperimentalSettings = z.infer<typeof patchInstanceExperimentalSettingsSchema>;