fix: mask cost-history project identity in privacy mode

[steipete]

Summary

Honor the maintainer-approved scope of #3262: when “Hide personal information” is enabled, replace project and source names with numbered labels and omit their paths in the cost-history submenu. Usage & Spend also masks project names, including expanded rows.

Masking is an immutable presentation projection. Original project/source objects still own row IDs, source-collapse decisions, sorting, costs, tokens and stored history. The hosted-chart fingerprint includes the privacy setting so changing it invalidates cached content; the dashboard reads the observed setting without triggering another history scan. Turning privacy off restores the original labels.

The settings explanation, all translated catalogs, documentation and changelog describe the bounded display behavior. Session IDs, exports and unrelated diagnostics are unchanged; this is not a claim that arbitrary exports are sanitized.

Verification

• make check: passed, zero lint violations across 2,042 files; all 22 translated catalogs pass.
• Independent Codex review: no actionable P0–P2 findings.
• Focused architecture/privacy/chart tests: 83 passed; opt-in native-view screenshot test passed. Covers masking/restoration, source overflow, differing single-source visibility, pathless names, numeric preservation, all dashboard ranks and the architecture gate.
• Fixture follow-up: all 14 bounded-progress/fixture-seeding tests passed. Initial synthetic-corpus setup now reuses the existing exclusive-create seed helper, avoiding unnecessary atomic publication/fsync before readers start; file contents, counts, scanner assertions, runtime writes and all deadlines are unchanged.
• Full make test: passed all 960 selections across 80 groups in 2,483.3 seconds. One group reached the normal timeout; all 12 selections passed the runner's standard isolated retries. No deadlines or assertions were loosened.
• Final-head CI: passed lint, all three Linux builds, both macOS test shards and the aggregate gate at f21fa598cdb1cf514aa4509afb65a060f50b0de5.
• Earlier validation caught three stale architecture-gate line anchors after the view edits; corrected only their positions, preserving all fingerprints and enforcement. Initial lint and Linux x64 jobs also hit upstream HTTP 504 downloads. An earlier local full run stopped on existing Gemini subprocess fixture timing failures; the unchanged isolated Gemini suite passed all 20 tests, then passed again in the completed full run.
• A later local run hit the standard 180-second limit during synthetic cost-corpus creation, including an isolated retry; sampling identified atomic fixture writes as the bottleneck. The one-line seed-helper change above addresses that setup path. These earlier runs are not counted as completed full-suite proof.
• Synthetic before/after native-view renders inspected below. No real accounts, credentials or personal project paths are used; these are isolated rendered-view fixtures, not a live-account app test.

Before and after

Cost-history menu before (original renderer):

Cost-history menu after, privacy enabled:

Usage & Spend before:

Usage & Spend after, privacy enabled:

Fixes #3262.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 29, 2026, 2:09 PM ET / 18:09 UTC.

ClawSweeper review

What this changes

Extends “Hide personal information” to mask cost-history project/source labels and paths and Usage & Spend project names, with localized copy, cache invalidation, and regression coverage.

Merge readiness

⚠️ Ready for maintainer review - 1 item remains

Keep open for normal maintainer approval: this owner-authored PR introduces the requested bounded privacy masking, and the reviewed head has no actionable correctness or security finding.

Priority: P2
Reviewed head: f21fa598cdb1cf514aa4509afb65a060f50b0de5

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, well-covered display-layer change with no identified correctness or security defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary external-contributor proof gate does not apply because this is owner-authored; the supplied PR body also links synthetic before/after native-view renders for the changed display path.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary external-contributor proof gate does not apply because this is owner-authored; the supplied PR body also links synthetic before/after native-view renders for the changed display path.
Evidence reviewed	6 items	Display-only privacy projection: The introduced identity type replaces names with localized placeholders and removes paths only when privacy mode is enabled; it does not mutate the source records. Hosted menu receives and invalidates privacy state: The hosted submenu fingerprint includes the setting and the constructed chart receives the same value, preventing a cached unmasked menu from surviving a toggle. Dashboard receives privacy state: The preferences dashboard passes the observed setting into each currency section, whose project panel renders the projected identity rather than the raw name.
Findings	None	None.
Security	None	None.

How this fits together

CodexBar reads local provider cost history and renders it in a hosted menu chart and the Usage & Spend preferences dashboard. The privacy setting now changes only those display projections while the underlying usage records, totals, grouping, and stored history remain intact.

flowchart LR
A[Privacy setting] --> B[Menu refresh fingerprint]
B --> C[Cost-history menu]
A --> D[Usage and Spend dashboard]
C --> E[Numbered labels and hidden paths]
D --> F[Numbered project labels]
E --> G[Unchanged cost data]
F --> G

Loading

Before merge

• Complete next step (P2) - No repair dispatch is appropriate: the owner-authored PR has no concrete review defect and remains for normal maintainer approval.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production versus test delta	production/docs/localization +170/-29; tests +136/-4	The privacy presentation change is accompanied by focused behavioral coverage and an opt-in render fixture.
Localized surface	23 localization catalogs updated	All supported language catalogs receive the new setting explanation and numbered placeholder labels.

Root-cause cluster

Relationship: fixed_by_candidate
Canonical: #3262
Summary: This PR is the explicit candidate implementation for the related privacy request and changes the two display surfaces described there.

Members:

• canonical: Hide personal information #3262 - The PR body explicitly connects its bounded masking scope to that open request.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Technical review

Best possible solution:

Land the display-only projection after normal maintainer approval so privacy mode masks the documented project and source identity surfaces without migrating stored usage data.

Do we have a high-confidence way to reproduce the issue?

Yes—focused source tests construct cost-history snapshots with private names and paths, then verify that enabling the existing setting renders numbered labels while preserving totals and grouping. This review did not execute tests in the read-only checkout.

Is this the best way to solve the issue?

Yes. A display-only identity projection is the narrowest maintainable solution because it leaves row IDs, ordering, grouping, totals, and persisted history on the original values.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ae0ec9e24457.

Labels

Label justifications:

• P2: This is a bounded privacy-display improvement that prevents project and path disclosure in the reviewed cost surfaces.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary external-contributor proof gate does not apply because this is owner-authored; the supplied PR body also links synthetic before/after native-view renders for the changed display path.

Evidence

What I checked:

• Display-only privacy projection: The introduced identity type replaces names with localized placeholders and removes paths only when privacy mode is enabled; it does not mutate the source records. (Sources/CodexBar/CostHistoryIdentity.swift:1, f21fa598cdb1)
• Hosted menu receives and invalidates privacy state: The hosted submenu fingerprint includes the setting and the constructed chart receives the same value, preventing a cached unmasked menu from surviving a toggle. (Sources/CodexBar/StatusItemController+HostedSubmenus.swift:290, f21fa598cdb1)
• Dashboard receives privacy state: The preferences dashboard passes the observed setting into each currency section, whose project panel renders the projected identity rather than the raw name. (Sources/CodexBar/PreferencesSpendDashboardPane.swift:406, f21fa598cdb1)
• Focused regression coverage: Tests cover project and source masking, hidden paths, preservation of totals and raw objects, restoration when disabled, single-source handling, and every dashboard rank. (Tests/CodexBarTests/CostHistoryChartMenuViewTests.swift:10, f21fa598cdb1)
• Documented scope: The documentation explicitly defines this as display masking for the two reviewed surfaces and states that it is neither data deletion nor export sanitization. (docs/codex.md:209, f21fa598cdb1)
• Feature-history routing: Recent default-branch history shows Yuxin Qiao maintaining spend dashboard refresh and invalidation, while Peter Steinberger has prior cost-chart and spend-reporting work. (Sources/CodexBar/CostHistoryChartMenuView.swift, 75894c9fb983)

Likely related people:

• steipete: Previously authored the cost-chart interaction fix and the spend-reporting integration on the default-branch history. (role: feature-history contributor; confidence: high; commits: 71d823110568, bbb5cd73af04; files: Sources/CodexBar/CostHistoryChartMenuView.swift, Sources/CodexBar/SpendDashboardModel.swift)
• Yuxin-Qiao: Recent default-branch commits maintained spend catch-up, dashboard invalidation, and model construction adjacent to the changed presentation path. (role: recent area contributor; confidence: high; commits: 75894c9fb983, 6538ac34597e, 1cf98b330a79; files: Sources/CodexBar/PreferencesSpendDashboardPane.swift, Sources/CodexBar/SpendDashboardModel.swift, Sources/CodexBar/StatusItemController+HostedSubmenus.swift)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-08-29T17:13:05.530Z sha ead687b :: needs maintainer review before merge. :: none
• reviewed 2026-08-29T17:24:42.173Z sha ead687b :: needs maintainer review before merge. :: none
• reviewed 2026-08-29T17:58:38.084Z sha b0a0d54 :: needs maintainer review before merge. :: none