fix(launchpad): elide a contributor's home directory from note 315 (#385)

[serina-mcfall]

Summary

launchpad/Research/315-desktop-stdout-destination.md line 154 pasted du -sh output containing an absolute /Users/<name>/… path, publishing a contributor's local username in a public repository. This elides the home-directory prefix to ~.

Related issue

Closes #385

Issue type

Bug

---

Agent provenance

Field	Value
Harness / provider	Claude Code
Model	claude-opus-5
Session reference	N/A - the harness exposes no shareable run id
Initiating human	@serina-mcfall

Observed behaviour

$ git show origin/launchpad:launchpad/Research/315-desktop-stdout-destination.md \
    | grep -nE "/(Users|home)/[a-zA-Z]+/" | sed -E 's#/(Users|home)/[a-zA-Z]+/#/\1/<REDACTED>/#g'
154: 96K	/Users/<REDACTED>/Library/Application Support/xyz.block.buzz.app/agents/logs

The note has been merged for some time, so the value is already public. This stops it persisting rather than containing it — there is nothing to contain.

Expected behaviour

No tracked file under launchpad/ carries a contributor's home-directory path.

The change

One line, plus a one-line disclosure:

• /Users/<name>/Library/… → ~/Library/…
• an inline note recording that the prefix was elided and that nothing else in the transcript was altered

~ is the convention this note already uses — in its own prose ("resolves on macOS to ~/Library/Application Support/xyz.block.buzz.app/agents/logs/") and in the very next command in the same block (ls ~/Library/Application\ Support/…). So the elision makes line 154 consistent with its neighbours rather than introducing a new style.

Nothing the note demonstrates changes: 96K in that location still reads the same, and the directory is still identified unambiguously.

Why the substitution is disclosed rather than silent

The block is presented as a pasted terminal transcript. du does not print ~. Editing a transcript to look like output that was never produced is the same defect class this cohort's reviews keep filing against research notes — so the note now says what was changed, in one line, at the point of the change.

Verification

Command run:

python3 -m unittest discover -s launchpad/scripts -t launchpad/scripts
git show HEAD:launchpad/Research/315-desktop-stdout-destination.md | grep -cE "/(Users|home)/[a-zA-Z]+/"

Raw output:

Ran 215 tests in 0.270s

OK

0

• Tests or checks were run and the raw output is pasted above
• The diff is confined to the scope of the linked issue
• No secrets, keys, tokens or hostnames were added to tracked files

Scope note — this is one of two

I scanned every research note merged on launchpad:

$ for f in $(git ls-tree -r --name-only origin/launchpad -- launchpad/Research/ | grep '\.md$'); do
    hits=$(git show "origin/launchpad:${f}" | grep -coE "/(Users|home)/[a-zA-Z]+/")
    [ "$hits" -gt 0 ] && echo "${f##*/}: $hits"
  done
315-desktop-stdout-destination.md: 1

315 is the only merged note affected, and this PR closes it.

A second instance exists in launchpad/Research/345-test-output-disclosure.md, which is not merged — it is in PR #439, currently blocked. It is raised in that PR's review and is not fixed here, because fixing it on this branch would touch a file another open PR owns. Worth noting that #345 is itself a note about output disclosure, which is where the pattern is easiest to miss.

Not verified

The scan pattern only catches /Users/<name>/ and /home/<name>/. It would not catch a Windows profile path (C:\Users\<name>), a bare username appearing outside a path, or a hostname. Those were not searched for here.

🤖 Drafted by Claude Code (claude-opus-5) for @serina-mcfall.