Describe the bug
Telemetry error-text masking (maskString in packages/opencode/src/altimate/telemetry/index.ts) deliberately redacts API keys, bearer tokens, emails, internal hosts, and quoted strings — but has no rule for filesystem paths or cloud-storage URIs. As a result:
- Unquoted absolute paths in error messages reach App Insights raw. Home-directory paths carry the OS username, and project-rooted paths leak repo/client structure. A live 7-day
core_failure/file_not_found cluster (32 machines) carries full /Users/<username>/… paths in the clear.
- Cloud-storage URIs (
gs://, s3://, abfss://, …) also pass through — bucket names identify the customer. Found via a sweep of all 800 distinct 30-day telemetry messages through maskString.
The gap is asymmetric, which is why it went unnoticed: paths that happen to be quoted are destroyed by the existing quote rule ('…' → ?), while unquoted ones survive.
Expected behavior
Paths and storage URIs in error text are masked (e.g. to a fixed <path> token), consistent with the chain's "over-masking is the correct failure mode" doctrine and with the masking already applied to keys/hosts/emails.
To Reproduce
Make any tool fail on an absolute path under the home directory (e.g. read on /Users/<you>/nope.sql) and inspect the emitted core_failure event — the path appears unmasked in error_message.
Describe the bug
Telemetry error-text masking (
maskStringinpackages/opencode/src/altimate/telemetry/index.ts) deliberately redacts API keys, bearer tokens, emails, internal hosts, and quoted strings — but has no rule for filesystem paths or cloud-storage URIs. As a result:core_failure/file_not_foundcluster (32 machines) carries full/Users/<username>/…paths in the clear.gs://,s3://,abfss://, …) also pass through — bucket names identify the customer. Found via a sweep of all 800 distinct 30-day telemetry messages throughmaskString.The gap is asymmetric, which is why it went unnoticed: paths that happen to be quoted are destroyed by the existing quote rule (
'…'→?), while unquoted ones survive.Expected behavior
Paths and storage URIs in error text are masked (e.g. to a fixed
<path>token), consistent with the chain's "over-masking is the correct failure mode" doctrine and with the masking already applied to keys/hosts/emails.To Reproduce
Make any tool fail on an absolute path under the home directory (e.g.
readon/Users/<you>/nope.sql) and inspect the emittedcore_failureevent — the path appears unmasked inerror_message.