Interactive Shell Privacy - OpenSRE Documentation

Overview

The interactive shell saves every line you type to a history file so up-arrow recall and /history work across sessions. Each new prompt reloads the file when another running shell has changed it, so concurrent sessions share recent commands without a restart. Separately, it records each LLM prompt/response turn for local debugging and /resume. Incident prompts can include sensitive identifiers and tokens, so the shell:

Redacts known token shapes before each entry is written to disk
Supports disabling persistence entirely (memory-only mode)
Caps how many entries are kept (oldest pruned)
Offers /history clear to wipe the file on demand

The history file is ~/.opensre/interactive_history. See Prompt and response logging for the separate LLM turn log and remote product-analytics forwarding.

Defaults

Setting	Default	Effect
Persistence	on	Lines you type are appended to the history file.
Redaction	on	Known token shapes are replaced with `[REDACTED:<kind>]` before writing.
Retention cap	5000 entries	Older entries are pruned when the cap is exceeded.

Redaction patterns

The built-in patterns target token shapes that are distinctive enough to keep false positives on natural-language incident text low. Each match becomes a labeled placeholder.

Kind	Examples
`aws_key`	`AKIA…`, `ASIA…`
`aws_secret`	`aws_secret_access_key=…`
`github_pat`	`ghp_…`, `github_pat_…`
`anthropic_key`	`sk-ant-…`
`openai_key`	`sk-…`
`slack_token`	`xoxb-…`, `xoxp-…`, `xoxa-…`
`stripe_key`	`sk_live_…`, `sk_test_…`
`bearer`	`Bearer <opaque>` headers
`jwt`	`eyJ…` three-segment tokens
`password`	`--password=…`, `password=…`
`private_key`	PEM-encoded private keys

Redaction applies only to persistent history. The line you typed is still passed to OpenSRE’s normal pipeline as you typed it.

Slash commands

Command	Effect
`/history`	Show all persisted entries.
`/history clear`	Wipe the history file. Up-arrow recall resets on next launch.
`/history off`	Pause persistence for this session. New entries are not written.
`/history on`	Resume persistence for this session.
`/history retention <N>`	Keep at most N entries on disk. Prunes immediately.
`/privacy`	Show current persistence and redaction state, retention cap, and threat model.

Configuration

Settings resolve from (highest wins):

Environment variables
The interactive.history block in ~/.opensre/config.yml
Built-in defaults

Environment variables

Variable	Default	Effect
`OPENSRE_HISTORY_ENABLED`	`1`	Set to `0` / `false` / `off` to skip persistence entirely (in-memory only).
`OPENSRE_HISTORY_REDACT`	`1`	Set to `0` / `false` / `off` to disable redaction (raw `FileHistory`).
`OPENSRE_HISTORY_MAX_ENTRIES`	`5000`	Non-negative integer. `0` disables the cap (unlimited).

Config file

interactive:
  history:
    enabled: true
    redact: true
    max_entries: 5000

Prompt and response logging

Separately from typed-command history, OpenSRE records each agent turn — the submitted prompt and final response — in the interactive shell, opensre ask, gateway chat, and scheduled or embedded agent runs. Failures and cancellations retain the prompt and available error details. Each continuation is recorded separately. This log is richer than command history (it includes model output, not just what you typed) and is used for two purposes:

Local debugging / /resume: appended as JSON Lines to ~/.opensre/prompt_log.jsonl, and folded into the session file so /resume can restore conversation context. Gateway logs use the organization and user conversation directory rather than the host-wide default. An explicit OPENSRE_PROMPT_LOG_PATH overrides that location.
Product analytics: forwarded through the first-party OpenSRE app endpoint as an $ai_generation event (model, provider, latency, token counts, and the prompt/response text) so usage and quality can be tracked. Failed turns carry structured error properties ($ai_is_error, $ai_error, error_kind). Turns handled entirely by terminal tools or slash commands report $ai_model / $ai_provider as no_conversational_agent; when a conversational reply was intended but the LLM provider failed (missing API key, model access, quota, auth), the event reports the attempted model (or unknown) plus an ai_error_kind bucket (not_configured, quota, auth, or provider_error).

Defaults

Setting	Default	Effect
Logging	on	Each LLM turn is recorded.
Local JSONL file	on	Turns are appended to `~/.opensre/prompt_log.jsonl`.
Remote forwarding	on	Turns are also sent as a product-analytics `$ai_generation` event.
Redaction	on	Known token shapes (same patterns as command history) are stripped from the prompt and response before either sink.

Environment variables

Variable	Default	Effect
`OPENSRE_PROMPT_LOG_DISABLED`	`0`	Set to `1` to disable prompt/response logging entirely (both local file and remote analytics).
`OPENSRE_PROMPT_LOG_LOCAL_DISABLED`	`0`	Set to `1` to skip the local JSONL file while leaving remote forwarding (if enabled) unaffected.
`OPENSRE_PROMPT_LOG_REDACT`	`1`	Set to `0` to log/send raw prompt and response text without redaction.
`OPENSRE_PROMPT_LOG_PATH`	`~/.opensre/prompt_log.jsonl`	Override the local JSONL file path.

The separate operations log at ~/.opensre/operations_log.jsonl records agent and scheduler lifecycle breadcrumbs such as loop start, iteration outcome, loop creation, and delivery status. It does not store prompt or response bodies. Remote forwarding for this event also honors the global telemetry opt-outs: set OPENSRE_NO_TELEMETRY=1, OPENSRE_ANALYTICS_DISABLED=1, or DO_NOT_TRACK=1 to stop all product analytics (including $ai_generation) without touching the local JSONL file. See Environment variables.

Config file

interactive:
  prompt_log:
    posthog_enabled: true
    redact: true
    max_chars: 32000
    path: ~/.opensre/prompt_log.jsonl

Redaction here uses the same built-in pattern set as command history (see Redaction patterns above). It catches known secret shapes, not arbitrary sensitive content. Raw incident details, hostnames, or business context in a prompt are not redacted — only credential-shaped substrings.

Threat model

The history file is plain text on local disk at ~/.opensre/interactive_history, with the user’s default file permissions. Built-in redaction targets common token shapes only — it is not a substitute for proper secret handling. Treat the file as confidential and be aware:

A determined attacker with read access to your home directory can still read entries written before redaction was enabled.
Redaction cannot detect tokens that look like normal text (for example a natural-language password). Do not paste secrets you would not put in a system log.
Custom redaction patterns are not supported in v1. To redact internal token shapes, use /history off for that session and run /history clear afterwards.

The prompt/response log has the same caveats, plus one more: with remote forwarding on (the default), redacted prompt/response text leaves your machine. If you discuss confidential systems or data in the interactive shell, set OPENSRE_NO_TELEMETRY=1 (or OPENSRE_PROMPT_LOG_DISABLED=1 to also stop the local file) rather than relying on redaction alone. For a strong local posture: set OPENSRE_HISTORY_ENABLED=0 and OPENSRE_NO_TELEMETRY=1. That stops command-history persistence and remote analytics. Up-arrow recall across sessions is lost. /resume conversation context also depends on session files and the prompt log — set OPENSRE_PROMPT_LOG_DISABLED=1 (or clear session/prompt-log data) if you need that path off too. Otherwise rely on the in-memory ring for the current process.

​Overview

​Defaults

​Redaction patterns

​Slash commands

​Configuration

​Environment variables

​Config file

​Prompt and response logging

​Defaults

​Environment variables

​Config file

​Threat model

Overview

Defaults

Redaction patterns

Slash commands

Configuration

Environment variables

Config file

Prompt and response logging

Defaults

Environment variables

Config file

Threat model