iamtoruk a4be04d926 fix(core,cli): fingerprint the source path out of dedup keys ... dedupKey is a CallObservation field: it ships on the envelope. Six decoders — codebuff, zerostack, pi, omp, grok and lingtai-tui — were folding the absolute source path (a chat directory, a session file) into it raw, so a host path rode every payload derived from those sessions. They now fold `sourceRefFingerprint`, a keyed HMAC-SHA256 under a new `source` domain. Like every other fingerprint in that module the key is required and an empty key throws, so a source ref can never degrade to an unkeyed, dictionary-attackable digest. That means the CLI bridge has to supply a real key. It passed `''`, which was correct when minimization happened only on the sync path; it now threads getHostPrivacyKey() — per-install stable, so dedup keys stay stable across runs. The keys change VALUE, so the six carry a `source-ref-fingerprint-v1` parse version that forces one re-parse and drops the cached raw-path keys instead of re-ingesting the same records under two shapes. A parse version cannot see the privacy key change, though, and a lost, rotated, or ephemeral (unwritable config dir) key would silently produce keys that never match the cached ones — so computeEnvFingerprint folds a digest of the key in for exactly those providers. The five bridge parity goldens used to compute their expected keys with the same function and key production uses, which pins nothing. They now re-derive the fingerprint longhand under a pinned test key, assert the key SHAPE, and assert the raw fixture path appears nowhere in it.		2026-08-21 10:18:58 -07:00
..
env-isolation.ts	test(cli): price off the bundled snapshot; fix platform-dependent proxy-path assertion	2026-08-21 08:11:34 -07:00
fixed-privacy-key.ts	fix(core,cli): fingerprint the source path out of dedup keys	2026-08-21 10:18:58 -07:00