fix(web): redact cockpit evidence refs #141

Closed

codex wants to merge 1 commit from codex/cockpit-redact-evidence-refs into main

codex commented

2026-06-03 09:05:42 +02:00

Collaborator

Canary status: missing — fire 3+3 review before merge

Summary

Fixes #133 by adding a defensive frontend redaction helper for Operational Cockpit evidence refs and using it before rendering item.evidence.ref in the default UI.

The helper redacts:

Signal source refs such as signal:+48...:<message_id> while preserving the message suffix,
phone-like identifiers,
private local paths such as /Users/..., /home/..., /private/var/..., /var/folders/..., /tmp/...,
credential-like query params such as token, authorization, api_key, idempotencyKey, password, and secret.

Scope

Adds apps/web/src/utils/operational-redaction.ts.
Adds focused Vitest coverage for Signal refs, private paths, credential params, and ordinary Forgejo refs.
Updates OperationalCockpitSettings to render redacted evidence refs by default.

Non-goals

No backend snapshot contract change.
No raw maintainer/debug reveal UI.
No deploy, restart, secret change, or migration.
No changes to MCP write authority or public exposure.

Spec sources read

#133
docs/operational-cockpit-contract.md
docs/contracts/operational-snapshot.v0.schema.json
Current OperationalCockpitSettings rendering path

Tests / smoke

pnpm --filter @kan/web exec vitest src/utils/operational-redaction.test.ts --run — passed, 4 tests.
pnpm --filter @kan/web exec eslint src/utils/operational-redaction.ts src/utils/operational-redaction.test.ts — passed.
pnpm exec prettier --check apps/web/src/utils/operational-redaction.ts apps/web/src/utils/operational-redaction.test.ts apps/web/src/views/settings/OperationalCockpitSettings.tsx — passed.

Known existing main debt:

pnpm --filter @kan/web typecheck remains red on pre-existing issues in bootstrap.cjs, cardPrefix workspace typing, and missing generated/available getWorkspaceOperationalSnapshot web API inference.
pnpm --filter @kan/web exec eslint src/views/settings/OperationalCockpitSettings.tsx remains red on pre-existing typed-router/project-service issues in that file plus older style rules. This PR does not broaden that debt.

Rollback

Revert 00e12484. No data or schema changes.

Owner gates

No production-impacting action taken. Merge decision remains with Piotr.

Canary status: missing — fire 3+3 review before merge ## Summary Fixes #133 by adding a defensive frontend redaction helper for Operational Cockpit evidence refs and using it before rendering `item.evidence.ref` in the default UI. The helper redacts: - Signal source refs such as `signal:+48...:<message_id>` while preserving the message suffix, - phone-like identifiers, - private local paths such as `/Users/...`, `/home/...`, `/private/var/...`, `/var/folders/...`, `/tmp/...`, - credential-like query params such as `token`, `authorization`, `api_key`, `idempotencyKey`, `password`, and `secret`. ## Scope - Adds `apps/web/src/utils/operational-redaction.ts`. - Adds focused Vitest coverage for Signal refs, private paths, credential params, and ordinary Forgejo refs. - Updates `OperationalCockpitSettings` to render redacted evidence refs by default. ## Non-goals - No backend snapshot contract change. - No raw maintainer/debug reveal UI. - No deploy, restart, secret change, or migration. - No changes to MCP write authority or public exposure. ## Spec sources read - #133 - `docs/operational-cockpit-contract.md` - `docs/contracts/operational-snapshot.v0.schema.json` - Current `OperationalCockpitSettings` rendering path ## Tests / smoke - `pnpm --filter @kan/web exec vitest src/utils/operational-redaction.test.ts --run` — passed, 4 tests. - `pnpm --filter @kan/web exec eslint src/utils/operational-redaction.ts src/utils/operational-redaction.test.ts` — passed. - `pnpm exec prettier --check apps/web/src/utils/operational-redaction.ts apps/web/src/utils/operational-redaction.test.ts apps/web/src/views/settings/OperationalCockpitSettings.tsx` — passed. Known existing main debt: - `pnpm --filter @kan/web typecheck` remains red on pre-existing issues in `bootstrap.cjs`, `cardPrefix` workspace typing, and missing generated/available `getWorkspaceOperationalSnapshot` web API inference. - `pnpm --filter @kan/web exec eslint src/views/settings/OperationalCockpitSettings.tsx` remains red on pre-existing typed-router/project-service issues in that file plus older style rules. This PR does not broaden that debt. ## Rollback Revert `00e12484`. No data or schema changes. ## Owner gates No production-impacting action taken. Merge decision remains with Piotr.

codex added 1 commit

2026-06-03 09:05:42 +02:00

fix(web): redact cockpit evidence refs (#133 )

Forgejo CI / verify (pull_request) Successful in 42s

Details

00e12484e8

codex referenced this pull request

2026-06-03 10:35:57 +02:00

ux(Iskra): cockpit needs one “what is true now?” operational surface #80

codex referenced this pull request

2026-06-03 10:37:18 +02:00

ux(Iskra): memory receipts and evidence links need a human-readable Kan surface #84

codex referenced this pull request

2026-06-03 19:46:05 +02:00

fix(web): redact cockpit evidence refs after trust metadata #157

codex commented

2026-06-03 19:46:28 +02:00

Author

Collaborator

Superseded by #157 after #156 landed first.

#141 is now mergeable: false because it was based on the pre-trust-metadata Cockpit file. I reapplied the same redaction intent on current main in #157:

same helper/test coverage for Signal refs, private paths, credential query params,
updated against the current Cockpit UI with trust metadata,
mergeable on current main.

Recommendation: do not merge #141. Merge #157 instead, then close #141 as superseded.

Superseded by #157 after #156 landed first. #141 is now `mergeable: false` because it was based on the pre-trust-metadata Cockpit file. I reapplied the same redaction intent on current `main` in #157: - same helper/test coverage for Signal refs, private paths, credential query params, - updated against the current Cockpit UI with `trust` metadata, - mergeable on current main. Recommendation: do not merge #141. Merge #157 instead, then close #141 as superseded.

codex closed this pull request

2026-06-03 19:47:10 +02:00