fix(config): show resolved paths and redact secrets in config show

config show was displaying raw config defaults (~/...) instead of
actual resolved paths, hiding the effect of LOCALGPT_PROFILE. Now
all path fields (workspace, embedding_cache_dir, logging) are
overridden with resolved values before display, and a resolved paths
header is printed. API keys and secrets are redacted to "***".

Also renames logging.file to logging.path (with serde alias for
backwards compat) since it points to a directory, not a file — actual
logs are date-rotated as localgpt-YYYY-MM-DD.log. Fixes incorrect
LOCALGPT_PROFILE path format in docs (was workspace-{profile}, actual
is localgpt-{profile}/workspace). Enables blog indexing for search.

Author: yiwang

config.example.toml

@@ -324,5 +324,5 @@ policy = "deny"
 # Log level: trace, debug, info, warn, error
 level = "info"
 
-# Log file path
-file = "~/.local/state/localgpt/logs/agent.log"
+# Log directory (logs are written as localgpt-YYYY-MM-DD.log)
+path = "~/.local/state/localgpt/logs"

crates/cli/src/cli/config.rs

@@ -55,16 +55,39 @@ pub async fn run(args: ConfigArgs) -> Result<()> {
 }
 
 fn show_config(format: &str) -> Result<()> {
-    let config = Config::load()?;
+    let mut config = Config::load()?;
+
+    // Show resolved paths first (these account for LOCALGPT_PROFILE and env overrides)
+    println!("# Resolved paths");
+    println!("#   config:    {}", config.paths.config_dir.display());
+    println!("#   data:      {}", config.paths.data_dir.display());
+    println!("#   workspace: {}", config.paths.workspace.display());
+    println!("#   state:     {}", config.paths.state_dir.display());
+    println!("#   cache:     {}", config.paths.cache_dir.display());
+    println!("#   logs:      {}", config.paths.logs_dir().display());
+    if let Some(ref rt) = config.paths.runtime_dir {
+        println!("#   runtime:   {}", rt.display());
+    }
+    println!();
+
+    // Replace raw config values with resolved paths so output is accurate
+    config.memory.workspace = config.paths.workspace.display().to_string();
+    config.memory.embedding_cache_dir = config
+        .paths
+        .cache_dir
+        .join("embeddings")
+        .display()
+        .to_string();
+    config.logging.path = config.paths.logs_dir().display().to_string();
 
     match format {
         "json" => {
             let json = serde_json::to_string_pretty(&config)?;
-            println!("{}", json);
+            println!("{}", redact_secrets(&json));
         }
         _ => {
             let toml = toml::to_string_pretty(&config)?;
-            println!("{}", toml);
+            println!("{}", redact_secrets(&toml));
         }
     }
 
@@ -114,6 +137,44 @@ fn init_config(force: bool) -> Result<()> {
     Ok(())
 }
 
+/// Redact secret values in serialized config output.
+/// Matches lines where the key contains "api_key", "api_token", "secret", or
+/// "service_account_key" and replaces the value with "***".
+fn redact_secrets(output: &str) -> String {
+    const SECRET_KEYS: &[&str] = &[
+        "api_key",
+        "api_token",
+        "secret",
+        "service_account_key",
+        "auth_token",
+    ];
+
+    output
+        .lines()
+        .map(|line| {
+            let trimmed = line.trim_start();
+            // TOML: key = "value" or JSON: "key": "value"
+            for key in SECRET_KEYS {
+                // TOML format: api_key = "..."
+                if trimmed.starts_with(key) && trimmed.contains("= \"") {
+                    if let Some(eq_pos) = line.find("= \"") {
+                        return format!("{}= \"***\"", &line[..eq_pos]);
+                    }
+                }
+                // JSON format: "api_key": "..."
+                let json_key = format!("\"{}\":", key);
+                if trimmed.starts_with(&json_key) && trimmed.contains('"') {
+                    if let Some(colon_pos) = line.find(':') {
+                        return format!("{}: \"***\"", &line[..colon_pos]);
+                    }
+                }
+            }
+            line.to_string()
+        })
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
 const DEFAULT_CONFIG_TEMPLATE: &str = r#"# LocalGPT Configuration
 
 [agent]

crates/core/src/config/mod.rs

@@ -813,8 +813,8 @@ pub struct LoggingConfig {
     #[serde(default = "default_log_level")]
     pub level: String,
 
-    #[serde(default = "default_log_file")]
-    pub file: String,
+    #[serde(default = "default_log_path", alias = "file")]
+    pub path: String,
 
     /// Days to keep log files (0 = keep forever, no auto-deletion)
     #[serde(default)]
@@ -1091,8 +1091,8 @@ fn default_bind() -> String {
 fn default_log_level() -> String {
     "info".to_string()
 }
-fn default_log_file() -> String {
-    format!("{}/logs/agent.log", DEFAULT_STATE_DIR_STR)
+fn default_log_path() -> String {
+    format!("{}/logs", DEFAULT_STATE_DIR_STR)
 }
 fn default_sandbox_level() -> String {
     "auto".to_string()
@@ -1237,7 +1237,7 @@ impl Default for LoggingConfig {
     fn default() -> Self {
         Self {
             level: default_log_level(),
-            file: default_log_file(),
+            path: default_log_path(),
             retention_days: 0, // 0 = keep forever
         }
     }

website/docs/configuration.md

@@ -268,8 +268,8 @@ disable_suffix = false
 # Log level: trace, debug, info, warn, error
 level = "info"
 
-# Log file path
-file = "~/.local/state/localgpt/logs/agent.log"
+# Log directory (logs are written as localgpt-YYYY-MM-DD.log)
+path = "~/.local/state/localgpt/logs"
 
 #──────────────────────────────────────────────────────────────────────────────
 # Telegram Bot
@@ -535,14 +535,14 @@ LocalGPT supports multiple workspaces via environment variables (OpenClaw-compat
 export LOCALGPT_WORKSPACE=~/my-project/ai-workspace
 localgpt chat
 
-# Use profile-based workspaces
-export LOCALGPT_PROFILE=work    # uses ~/.local/share/localgpt/workspace-work
-export LOCALGPT_PROFILE=home    # uses ~/.local/share/localgpt/workspace-home
+# Use profile-based isolation (all directories get -profile suffix)
+export LOCALGPT_PROFILE=work    # uses ~/.local/share/localgpt-work/workspace
+export LOCALGPT_PROFILE=home    # uses ~/.local/share/localgpt-home/workspace
 ```
 
 Resolution order:
 1. `LOCALGPT_WORKSPACE` env var (absolute path override)
-2. `LOCALGPT_PROFILE` env var (creates `~/.local/share/localgpt/workspace-{profile}`)
+2. `LOCALGPT_PROFILE` env var (creates `~/.local/share/localgpt-{profile}/workspace`)
 3. `memory.workspace` from config file
 4. Default: `~/.local/share/localgpt/workspace`
 

website/docs/heartbeat.md

@@ -221,7 +221,7 @@ Each heartbeat cycle follows this flow:
 ## Logging
 
 Heartbeat actions are logged to:
-- Application log (`~/.local/state/localgpt/logs/agent.log`)
+- Application log (`~/.local/state/localgpt/logs/localgpt-YYYY-MM-DD.log`)
 - Daily memory log (if memory_append is used)
 
 ## Best Practices

website/docs/intro.md

@@ -41,7 +41,7 @@ LocalGPT follows the [XDG Base Directory Specification](https://specifications.f
 
 ~/.local/state/localgpt/
 ├── logs/
-│   └── agent.log                # Application logs
+│   └── localgpt-YYYY-MM-DD.log   # Daily application logs
 └── localgpt.audit.jsonl         # Append-only audit log
 
 ~/.cache/localgpt/

website/docusaurus.config.ts

@@ -45,7 +45,7 @@ const config: Config = {
       '@easyops-cn/docusaurus-search-local',
       {
         hashed: true,
-        indexBlog: false,
+        indexBlog: true,
       },
     ],
   ],