Robustness: home-prefix path collapse over-matches sibling directories — make redactHomePath boundary-safe across all seven sites

[qwen-code-dev-bot]

sourceType

source:self-discovery — undirected maintainer review pass over the repository itself (no diff trigger).

sourceLinkOrEvidence

Concrete evidence in the current tree (main @ 587fb20):

The home-directory collapse used across every redacted display surface tests p.startsWith(home) with no path-boundary check, so a sibling directory whose name merely begins with the home string is misread as being under the home directory:

• src/permission-impact.ts:248-253 — the shared redactHomePath:

  export function redactHomePath(p: string): string {
    const home = process.env.HOME ?? process.env.USERPROFILE;
    if (home && p.startsWith(home)) {
      return "~" + p.slice(home.length);
    }
    return p;
  }

• Six local copies repeat the identical boundary-less pattern:
  • src/session-summary.ts:482 (redactPath, then redactSecrets)
  • src/session-search.ts:218 (redactWorkspacePath, then redactSecrets)
  • src/sandbox-diag.ts:75 (redactPath)
  • src/health-inventory.ts:424 (redactPath)
  • src/doctor.ts:266 (redactPath)
  • src/readline-store-warnings.ts:15 (redactStorePath, injectable home)

Minimal reproduction: with HOME=/home/alice, the path /home/alice2/proj satisfies "/home/alice2/proj".startsWith("/home/alice"), so it renders as ~2/proj — i.e. the listing claims the session lives under the user's home when it actually lives in a sibling directory. HOME=/root + /rootfs/x → ~fs/x is the same defect.

redactHomePath is imported by 35+ modules (attention-summary, sessions-overview, evidence-archive, provider-invocation, session-inspect, session-picker, tui-shell, …), so every surface that prints a workspace/config path inherits the over-match.

problemStatement

The ~ collapse is meant to hide the current user's home prefix. Because the match is a bare startsWith(home) with no separator/end boundary, a path that is a sibling of the home directory (shares the home string as a strict prefix but is not inside it) is also collapsed, producing a misleading ~… path that misrepresents where the session/workspace/config actually lives. This affects the session list, attention summary, doctor, health inventory, session search, sandbox diagnostics, and readline store warnings — every redacted path display.

userValue

--list-sessions, --attention, --doctor, --health-inventory, --search-sessions, and the store/sandbox diagnostics show a truthful location: paths under the home collapse to ~, sibling directories are shown as the (secret-redacted) paths they really are, so a user can correctly tell which repository/workspace a session belongs to.

scope

• Make redactHomePath (src/permission-impact.ts) boundary-safe: collapse only when p === home or p starts with home followed by a path separator (use the platform separator, e.g. node:path sep).
• Make the six local copies boundary-safe as well (session-summary.ts, session-search.ts, sandbox-diag.ts, health-inventory.ts, doctor.ts, readline-store-warnings.ts). Prefer routing them through the shared redactHomePath where the surrounding redactSecrets wrap allows; otherwise apply the same boundary check in place.
• Add regression tests for the boundary behavior (see testPlan).

nonGoals

• Not changing redactSecrets (secret-pattern redaction) or the order in which sites apply it.
• Not changing the ~ display format, the set of surfaces that collapse, or any trust/workspace-identity logic (folder-trust keys are unaffected — this is display-only).
• Not addressing Windows case-insensitive home matching or a HOME value with a trailing separator beyond keeping the boundary check correct for the common forms — separate, speculative concerns.
• Not touching the surrogate-safe truncation series (Robustness: make ellipsis truncation surrogate-safe — never split an emoji/astral character at the cut boundary #812→Robustness: surrogate-safe truncation for tui-shell tool-text rendering (transcript, output, hints) #842) — a different defect class (UTF-16 code-unit cuts), not path-prefix matching.

acceptanceCriteria

1. A sibling path (strict-prefix match without a following separator) is not collapsed: redactHomePath("/home/alice2/proj") with HOME=/home/alice returns /home/alice2/proj (and sites that wrap redactSecrets still secret-redact it).
2. A path under the home is collapsed: redactHomePath("/home/alice/proj") → ~/proj; redactHomePath("/home/alice") → ~.
3. All seven sites (shared helper + six local copies) are boundary-safe; no sibling over-match remains.
4. Inputs unaffected by the boundary (under-home, outside-home non-sibling) behave as before.
5. Focused regression tests cover sibling / under-home / home-alone; all existing tests pass.

testPlan

• Unit tests against the exported redactHomePath in tests/unit/permission-impact.test.ts (currently zero tests reference it): sibling not collapsed, under-home collapsed, home-alone → ~, and a HOME with a trailing separator if the implementation normalizes one.
• Cover at least one local copy through its exported surface (e.g. readline-store-warnings.ts's redactStorePath, which already accepts an injectable home) to prove the boundary holds there too.
• Gate: npm run typecheck, npm run build, npm test.

dogfoodPlan

Post-merge, run the permission-impact unit suite plus npm run smoke, and run --list-sessions / --attention against a real store to confirm under-home workspace paths still render with ~ and no surface regresses.

riskAndSecurityNotes

• Display-only; the collapse becomes strictly more conservative. A sibling path that was wrongly collapsed to a misleading ~… now renders its secret-redacted real path — this is more correct and does not leak the current user's home (the sibling is, by definition, outside it).
• redactSecrets still runs wherever a site wraps it, so no secret surface is widened.
• Behavior for paths genuinely under the home is unchanged (~ collapse preserved), so the privacy intent of the helper is intact.
• Low risk: pure string-boundary change in display helpers; no I/O, trust, or mutation path touched.

duplicateSearchEvidence

Searched open + closed Issues and PRs for home-path / redactHomePath / tilde / sibling / boundary:

• No Issue or PR addresses the home-prefix collapse over-matching sibling directories. Body search for redactHomePath matches only TUI: present sequential Workflow runs as an execution console #262 and Trust posture: compose workspace trust, sandbox isolation, approval mode, and extension readiness into one redacted, read-only view without core changes #124, which discuss redaction generally (TUI workflow console / trust posture), not the path-boundary defect.
• The surrogate-safe truncation series (Robustness: make ellipsis truncation surrogate-safe — never split an emoji/astral character at the cut boundary #812→Robustness: surrogate-safe truncation for tui-shell tool-text rendering (transcript, output, hints) #842) is a distinct defect class (UTF-16 code-unit cuts in text truncation), not path-prefix matching.
• Security: extend shared secret redactor to cover PEM private keys, JWTs, and Stripe/Google/Anthropic key formats #805 (extend the secret redactor) covers secret patterns (PEM/JWT/vendor keys), not the home-path boundary.
• grep -rn redactHomePath tests/ returns nothing: the helper has zero test coverage; tests/unit/permission-impact.test.ts covers redactSecrets, neutralizeSpoofing, and analyzeImpact but not redactHomePath.
  Conclusion: distinct, unfixed, untested boundary defect in a shared display helper plus six local copies — not a duplicate.

parentChildRelationship

Standalone leaf Issue. Independent of any parent; not part of the surrogate/truncation series or the secret-redaction line (#805).

dependencyOrder

No blocking dependencies; executable immediately (redactHomePath already exists and is exported). Single vertical slice: one boundary fix applied across the shared helper and six copies, plus focused regression tests.

[github-actions]

Automated intake triage

• Type: enhancement
• Priority: priority:p3
• Confidence: 0.96

Home-prefix path redaction over-matches sibling directories and should only collapse paths that are actually inside the user's home directory.

Reported evidence (unverified)

• redactHomePath uses startsWith(home) without a path-boundary check
• with HOME=/home/alice, /home/alice2/proj is rendered as ~2/proj
• the same boundary-less pattern appears in six additional local redaction helpers

Repository verification

Pending. Repository verification is still required before this Issue can become agent-ready.

This bounded pass classifies intake only. It cannot execute code, close the Issue, or grant governance authority.

[qwen-code-dev-bot]

🤖 Leased by qwen-code-dev-bot (autonomous loop, priority 4 — highest-priority dependency-ready agent-ready; the Desktop/Dynamic-Workflow subtasks above it in priority are blocked by open governance blockers #74/#106/#133/#142). Branch: issue/844-home-path-boundary. Starting the train: make the home-prefix ~ collapse boundary-safe across the shared redactHomePath and its six local copies, red→green regression tests, gates, PR, merge, dogfood.

[qwen-code-dev-bot]

Evidence (append-only) — implementation complete, PR #845 open

• Shared redactHomePath (src/permission-impact.ts) is now boundary-safe: the home prefix counts only when it is the whole path or followed by a path separator; a trailing-separator home is normalized. home/separator are injectable (default env home + platform sep) for deterministic tests; single-arg callers unaffected.
• The six duplicated local collapses (session-summary, session-search, sandbox-diag, health-inventory, doctor, readline-store-warnings) now delegate to redactHomePath; grep confirms no boundary-less startsWith(home) home-collapse remains in src/.
• Red→green: with the buggy body restored, the three sibling assertions failed on the over-match (~2/proj, ~2\proj); with the fix all 7 new redactHomePath (Issue #844) tests pass.
• Gate: typecheck ✓, build ✓ (desktop bundle), unit 271 files/4105 passed, integration 158 files/956 passed, smoke 54 passed, npm audit --omit=dev 0 vulns. Desktop E2E leg runs only in CI (no xvfb locally); change is CLI-display-only.
• Terminal E2E: --list-sessions → repo ~/qys/oh-my-cli-loop; --doctor → CLI entry ~/qys/oh-my-cli-loop/dist/index.js, State directory ~/.oh-my-cli (under-home collapse correct end-to-end).

PR: #845

[qwen-code-dev-bot]

Evidence (append-only) — merged & dogfooded; releasing lease

Merged to main via PR #845 (commit 8b533c4), CI verify + protected-paths both green (desktop E2E leg ran in CI).

Post-merge dogfood against the built artifact (dist/permission-impact.js), home=/home/alice:

• under-home /home/alice/proj → ~/proj
• home alone /home/alice → ~
• sibling /home/alice2/proj → /home/alice2/proj (unchanged — the over-match is gone)
• outside /etc/passwd → /etc/passwd
  Real-run check: node dist/index.js --list-sessions renders repo ~/qys/oh-my-cli-loop (home /root collapsed).

Issue closed by the merge (Closes #844). Releasing the agent-active lease; cleaning up the feature branch.