Follow app privacy setting on serve dashboard - #2967
Conversation
The serve dashboard ignored the app's "Hide personal information" toggle and always served full account emails unless --identity was passed. Resolve the identity mode per request when the flag is absent, so the toggle applies without a serve restart, and fold the resolved mode into the response cache key so a body cached before a toggle cannot be replayed after it. An explicit --identity still wins. codexbar dashboard keeps its full default.
# Conflicts: # CHANGELOG.md
|
🦞👀 Pull request received. I will update this pull request when review starts. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3805441200
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "com.steipete.codexbar", | ||
| "com.steipete.codexbar.debug", | ||
| ] | ||
| for domain in domains { | ||
| if let value = UserDefaults(suiteName: domain)?.object(forKey: "hidePersonalInfo") as? Bool { |
There was a problem hiding this comment.
When serve is launched from a debug app and the release defaults domain already contains hidePersonalInfo, this release-first loop always returns that value and never consults com.steipete.codexbar.debug. Consequently, toggling privacy in the running debug app has no effect on its dashboard. Resolve the domain from the containing app/bundle before reading the setting rather than returning the first value found across both domains.
Useful? React with 👍 / 👎.
| - Starts no HTTP server and requires no dashboard bearer token. See `docs/dashboard-api.md` for the shared payload contract. | ||
| - `codexbar serve` starts a foreground HTTP server for usage and cost JSON, a token-gated dashboard snapshot, and a built-in web UI at `/`. | ||
| - Dashboard snapshot identity defaults to full account emails; use `--identity redacted` to hide email local parts, especially when responses cross a network. | ||
| - Dashboard snapshot identity follows the app's "Hide personal information" setting when `--identity` is absent: the toggle on redacts email local parts, off keeps full emails. The setting is read per request, so a change applies without a serve restart. Pass `--identity redacted` or `--identity full` to pin the mode and ignore the app setting, especially when responses cross a network. |
There was a problem hiding this comment.
serve --help to describe the new default
This documents the new behavior, but CodexBarCLI.serveHelp still tells users that snapshot identity defaults to full emails. Since CLIIO prints that hard-coded text for codexbar serve --help, users and scripts consulting the command itself receive semantics that contradict this change and may unexpectedly get redacted identities. Update the built-in help alongside this documentation.
Useful? React with 👍 / 👎.
clawsweeper
Bot
added
merge-risk: 🚨 compatibility
|
Codex review: needs changes before merge. Reviewed August 16, 2026, 1:18 AM ET / 05:18 UTC. ClawSweeper reviewWhat this changesThe PR makes Merge readinessKeep this owner-authored PR open for two bounded corrections: it can read the wrong app privacy preference in debug builds, and its built-in help contradicts the new default. Priority: P2 Review scores
Verification
How this fits togetherThe bundled CLI serves a dashboard snapshot that the built-in web UI polls. Each request resolves an identity mode, uses it in the response-cache key, and returns account data to the dashboard. flowchart LR
A[App privacy preference] --> B[Serve request]
C[Optional identity flag] --> D[Identity mode resolver]
B --> D
D --> E[Dashboard cache key]
E --> F[Snapshot builder]
F --> G[Web dashboard]
D --> H[Full or redacted identity]
Before merge
Findings
Agent review detailsSecurityNeeds attention: The debug-domain fallback can defeat an explicit privacy preference and expose email local parts in dashboard output. Review metrics
Root-cause clusterRelationship: Members:
Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything. Merge-risk optionsMaintainer options:
Copy recommended automerge instructionTechnical reviewBest possible solution: Use the active app’s single bundle-aware defaults domain, update Do we have a high-confidence way to reproduce the issue? Yes. With conflicting release and debug Is this the best way to solve the issue? No. Per-request resolution and cache separation are sound, but selecting the active app domain and updating the built-in command contract are required for a correct implementation. Full review comments:
Overall correctness: patch is incorrect AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 2f951e278d27. LabelsLabel changes:
Label justifications:
EvidenceSecurity concerns:
Acceptance criteria:
What I checked:
Likely related people:
Rank-up movesOptional improvements that raise the rating; they are not merge blockers.
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
|
# Conflicts: # CHANGELOG.md
# Conflicts: # CHANGELOG.md
2 participants
Maintainer refresh of #2960 by @urda (fork branch went CONFLICTING after today's merge train and is not maintainer-editable). All code and tests are @urda's work, rebased onto current main with the CHANGELOG union-resolved and a credit line added.
Closes #2960.
codexbar servedashboard follows the app's "Hide personal information" setting when no--identityflag is given, resolved per request so toggling applies without a restart.--identity redacted|fullstill wins and ignores the app setting.