fix(dreamer): log project identity, never absolute paths (privacy)

Dreamer/timer/git-commit log lines interpolated the full project directory
(`reg.directory`, `dir=${projectDirectory}`, `cwd=${directory}`). Those
absolute paths carry the OS username AND the project/client name — and they
flow into `doctor --issue` GitHub reports. The issue bundler's
`sanitizePathString` strips the home prefix + username but leaves the project
subpath intact, so the project name still leaked into public reports.

Fix at the source: every dreamer, dream-timer, and git-commit log line now
emits the opaque project identity (`git:<sha>` / `dir:<hash>`) instead of the
path. The identity uniquely correlates a run for debugging without exposing
anything sensitive. 10 sites across 4 files:
  - dream-timer.ts: register/unregister/timer-tick/queue-fail + 3 git-commit
    sweep lines now use `projectIdentity` (already in scope on every one).
  - runner.ts: the dequeue line drops `dir=` entirely.
  - git-log-reader.ts: threaded an optional `projectIdentity` into
    ReadGitCommitsOptions purely for log correlation (falls back to a
    "<project>" placeholder); the two cwd= logs now print the label. The git
    `cwd` still uses the real directory — only the LOG text changed.
  - indexer.ts: passes projectPath as the identity to the reader.

Pi inherits this automatically — it imports the shared-core dream timer and
git-commit reader; no Pi-side path logging exists.

Co-authored-by: Alfonso [Magic Context] <288211368+alfonso-magic-context@users.noreply.github.com>

Author: ualtinok

packages/plugin/src/features/magic-context/dreamer/runner.ts

@@ -1371,9 +1371,10 @@ export async function processDreamQueue(args: {
     // sibling-worktree path the shared identity map might resolve to.
     const projectDirectory =
         args.sessionDirectoryOverride ?? resolveDreamSessionDirectory(entry.projectIdentity);
-    log(
-        `[dreamer] dequeued project ${entry.projectIdentity} (dir=${projectDirectory}), starting dream run`,
-    );
+    // Log the project identity only — never the resolved directory. The
+    // absolute path carries the username + project name (privacy), and the
+    // git:<sha>/dir:<hash> identity uniquely correlates the run for debugging.
+    log(`[dreamer] dequeued project ${entry.projectIdentity}, starting dream run`);
 
     let result: DreamRunResult;
     try {

packages/plugin/src/features/magic-context/git-commits/git-log-reader.ts

@@ -59,6 +59,14 @@ export interface ReadGitCommitsOptions {
     branch?: string;
     /** Hard cap on returned commits. Default 5000. */
     maxCommits?: number;
+    /**
+     * Project identity (`git:<sha>` / `dir:<hash>`) used ONLY for log
+     * correlation. We never log the absolute `directory` — it carries the
+     * username + project name (privacy, and these logs flow into
+     * `doctor --issue` reports). When omitted, logs fall back to a neutral
+     * "<project>" placeholder.
+     */
+    projectIdentity?: string;
 }
 
 /**
@@ -85,6 +93,10 @@ export async function readGitCommits(
             `readGitCommits: refusing revision that looks like an option: "${revision}"`,
         );
     }
+    // Privacy: logs identify the project by its opaque identity, never the
+    // absolute cwd (which carries the username + project name and lands in
+    // doctor --issue reports).
+    const projectLabel = options.projectIdentity ?? "<project>";
     const args = [
         "log",
         revision,
@@ -116,13 +128,13 @@ export async function readGitCommits(
         // retry. We DO log the reason though — a silent empty-result masked a
         // real cwd / PATH / timeout bug during the v0.14 git-commits rollout.
         const message = error instanceof Error ? error.message : String(error);
-        log(`[git-commits] readGitCommits failed at cwd=${directory}: ${message.slice(0, 500)}`);
+        log(`[git-commits] readGitCommits failed for ${projectLabel}: ${message.slice(0, 500)}`);
         return [];
     }
 
     if (stdout.trim().length === 0) {
         log(
-            `[git-commits] readGitCommits returned empty stdout at cwd=${directory} (sinceMs=${options.sinceMs ?? "none"} args=${args.slice(0, 4).join(" ")})`,
+            `[git-commits] readGitCommits returned empty stdout for ${projectLabel} (sinceMs=${options.sinceMs ?? "none"} args=${args.slice(0, 4).join(" ")})`,
         );
     }
 

packages/plugin/src/features/magic-context/git-commits/indexer.ts

@@ -91,6 +91,7 @@ export async function indexCommitsForProject(
         const commits = await readGitCommits(directory, {
             sinceMs,
             maxCommits: options.maxCommits,
+            projectIdentity: projectPath,
         });
         result.scanned = commits.length;
 

packages/plugin/src/plugin/dream-timer.ts

@@ -110,7 +110,7 @@ export async function startDreamScheduleTimer(
 
     if (isNewRegistration) {
         log(
-            `[dreamer] registered project ${args.directory} (dreaming=${dreamingEnabled} embeddings=${embeddingSweepEnabled} commits=${commitIndexingEnabled}; total=${registeredProjects.size})`,
+            `[dreamer] registered project ${args.projectIdentity} (dreaming=${dreamingEnabled} embeddings=${embeddingSweepEnabled} commits=${commitIndexingEnabled}; total=${registeredProjects.size})`,
         );
     }
 
@@ -139,7 +139,7 @@ export async function startDreamScheduleTimer(
     return () => {
         registeredProjects.delete(args.directory);
         log(
-            `[dreamer] unregistered project ${args.directory} (remaining=${registeredProjects.size})`,
+            `[dreamer] unregistered project ${args.projectIdentity} (remaining=${registeredProjects.size})`,
         );
         if (registeredProjects.size === 0 && activeTimer) {
             clearInterval(activeTimer);
@@ -226,7 +226,7 @@ async function sweepProject(
 
     try {
         log(
-            `[dreamer] timer tick (${origin}) ${reg.directory} — checking schedule window "${reg.dreamerConfig.schedule}"`,
+            `[dreamer] timer tick (${origin}) ${reg.projectIdentity} — checking schedule window "${reg.dreamerConfig.schedule}"`,
         );
         // Resolve THIS registration's project identity. The shared `dream_queue`
         // is process-global (any OpenCode/Pi instance can write to it), but
@@ -251,7 +251,7 @@ async function sweepProject(
             fallbackModels: resolveFallbackChain(DREAMER_AGENT, reg.dreamerConfig.fallback_models),
         });
     } catch (error) {
-        log(`[dreamer] timer-triggered queue processing failed for ${reg.directory}:`, error);
+        log(`[dreamer] timer-triggered queue processing failed for ${reg.projectIdentity}:`, error);
     }
 }
 
@@ -296,14 +296,14 @@ async function sweepGitCommits(args: {
             lease.reason === "cooldown_active"
                 ? `cooldown active until ${lease.nextAllowedAt}`
                 : `lease held by ${lease.leaseHolder ?? "another holder"} until ${lease.leaseExpiresAt ?? "unknown"}`;
-        log(`[git-commits] sweep skipped for ${projectIdentity} (${directory}): ${reason}`);
+        log(`[git-commits] sweep skipped for ${projectIdentity}: ${reason}`);
         return;
     }
 
     const startedAt = Date.now();
     const stopRenewal = startGitSweepLeaseRenewal(db, projectIdentity, holderId);
     log(
-        `[git-commits] sweep starting for ${directory} (project=${projectIdentity} sinceDays=${gitCommitIndexing.since_days} maxCommits=${gitCommitIndexing.max_commits})`,
+        `[git-commits] sweep starting for ${projectIdentity} (sinceDays=${gitCommitIndexing.since_days} maxCommits=${gitCommitIndexing.max_commits})`,
     );
     try {
         const result = await indexCommitsForProject(db, projectIdentity, directory, {
@@ -330,7 +330,7 @@ async function sweepGitCommits(args: {
         releaseGitSweepLease(db, projectIdentity, holderId);
         const elapsedMs = Date.now() - startedAt;
         log(
-            `[git-commits] sweep failed for ${directory} after ${elapsedMs}ms: ${error instanceof Error ? error.message : String(error)}`,
+            `[git-commits] sweep failed for ${projectIdentity} after ${elapsedMs}ms: ${error instanceof Error ? error.message : String(error)}`,
         );
     } finally {
         stopRenewal();