Skip to content

fix(ai): redact local file paths from AI payloads#785

Merged
chubes4 merged 1 commit intomainfrom
fix/redact-ai-file-paths
Mar 11, 2026
Merged

fix(ai): redact local file paths from AI payloads#785
chubes4 merged 1 commit intomainfrom
fix/redact-ai-file-paths

Conversation

@chubes4
Copy link
Member

@chubes4 chubes4 commented Mar 11, 2026

Summary

  • redact file_info.file_path from AI-visible data_packets JSON in AIStep
  • keep runtime/original packets unchanged so fetch, vision, and publish flows still use internal file paths normally
  • add focused tests proving local file paths are removed from model payloads

Why

Fetch handlers can attach file_info with local/internal file paths so downstream runtime steps can access files. That is valid internal pipeline state.

The problem is that AIStep was serializing the full data_packets array directly into the model prompt. That exposed local paths like dm-files, temp paths, or legacy server paths to the model, which can then be copied into generated post content.

This is not Reddit-specific. Reddit made the bug obvious on wire posts, but the exposure path is generic:

FetchHandler -> DataPacket(file_info) -> AIStep JSON serialization

So the safest fix is at the AI serialization boundary in core.

Testing

  • homeboy test data-machine

@github-actions
Copy link

github-actions bot commented Mar 11, 2026

Homeboy Results — data-machine

Lint

Failure Digest

Lint Failure Digest

Autofixability classification

  • Overall: human_needed
  • Autofix enabled: no
  • Autofix attempted this run: no
  • Human-needed failed commands:
    • lint
  • Failed commands with available automated fixes:
    • lint
  • Automated fixes are disabled for this step. Commands with available fix support in this run: lint

Machine-readable artifacts

  • homeboy-lint-summary.json
  • homeboy-test-failures.json
  • homeboy-audit-summary.json
  • homeboy-autofixability.json

⚡ Scope: changed files only

lint (changed files only)

Test

⚡ Scope: changed files only

test (changed files only)

Audit

⚡ Scope: changed files only

audit (changed files only)

Tooling versions
  • Homeboy CLI: homeboy 0.74.1
  • Extension: wordpress from https://github.com/Extra-Chill/homeboy-extensions
  • Extension revision: unknown
  • Action: Extra-Chill/homeboy-action@v1

Homeboy Action v1

@chubes4 chubes4 merged commit 8bd4967 into main Mar 11, 2026
0 of 3 checks passed
@chubes4 chubes4 deleted the fix/redact-ai-file-paths branch March 11, 2026 05:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant