[codex] Merge artifact telemetry into content consent (#4087)

* Merge artifact telemetry into content consent

* Localize privacy telemetry disclosure copy

Generated-By: looper 0.9.7 (runner=fixer, agent=codex)

Author: Siri-Ray

apps/daemon/src/app-config.ts

@@ -461,7 +461,7 @@ function applyTelemetryDefaults(prefs: AppConfigPrefs): AppConfigPrefs {
   if (prefs.telemetry === undefined) {
     return {
       ...prefs,
-      telemetry: { metrics: true, content: true, artifactManifest: false },
+      telemetry: { metrics: true, content: true },
     };
   }
   return prefs;

apps/daemon/src/langfuse-trace.ts

@@ -10,9 +10,9 @@
 // Privacy gates are layered: `prefs.metrics` is the master switch, and
 // `prefs.content` is required for Langfuse traces because this sink is used
 // for turn-quality evals. If either is off, no network call is made.
-// `prefs.artifactManifest` decides whether the produced-files manifest is
-// included. None of these defaults to true; the Web onboarding flow flips
-// metrics + content after explicit consent.
+// Complete-context manifests are part of content telemetry: when metrics and
+// content are both enabled, Langfuse receives the trace and associated object
+// references. If either is off, no network call is made.
 //
 // See: specs/change/20260507-langfuse-telemetry/spec.md
 
@@ -923,14 +923,15 @@ function buildTimingSpanBodies(
       end: runEnd,
       input: {
         phase: 'finalize',
-        artifact_manifest_enabled: ctx.prefs.artifactManifest === true,
+        artifact_manifest_enabled: ctx.prefs.metrics === true && ctx.prefs.content === true,
       },
       output: {
         status: ctx.run.status,
         artifact_count: ctx.artifacts.length,
         attachment_count: ctx.attachmentManifest?.length ?? 0,
         manifest_completeness:
-          ctx.manifestCompleteness ?? (ctx.prefs.artifactManifest ? 'unavailable' : 'off'),
+          ctx.manifestCompleteness ??
+          (ctx.prefs.metrics === true && ctx.prefs.content === true ? 'unavailable' : 'off'),
       },
       metadata: { boundary: 'finalizeStartAt -> run.endedAt' },
     },
@@ -1013,7 +1014,7 @@ function shouldCreateGenerationObservation(ctx: ReportContext): boolean {
 
 export function buildTracePayload(ctx: ReportContext): unknown[] {
   const wantsContent = ctx.prefs.metrics === true && ctx.prefs.content === true;
-  const wantsArtifacts = ctx.prefs.artifactManifest === true;
+  const wantsArtifacts = wantsContent;
 
   const sessionId =
     ctx.conversationId.length <= SESSION_ID_MAX ? ctx.conversationId : undefined;

apps/daemon/src/trace-object-manifest.ts

@@ -643,8 +643,7 @@ export async function buildTraceObjectManifests(
 ): Promise<TraceObjectUploadManifests | undefined> {
   if (
     opts.prefs.metrics !== true ||
-    opts.prefs.content !== true ||
-    opts.prefs.artifactManifest !== true
+    opts.prefs.content !== true
   ) {
     return undefined;
   }

apps/daemon/tests/app-config.test.ts

@@ -25,7 +25,6 @@ import { isLocalSameOrigin } from '../src/origin-validation.js';
 const DEFAULT_TELEMETRY = {
   metrics: true,
   content: true,
-  artifactManifest: false,
 } as const;
 
 describe('app-config', () => {

apps/daemon/tests/langfuse-bridge.test.ts

@@ -1451,14 +1451,10 @@ describe('langfuse-bridge.reportRunCompletedFromDaemon', () => {
     expect(generation.model).toBe('default');
   });
 
-  it('omits artifacts when that gate is off', async () => {
+  it('includes artifacts when content telemetry is on', async () => {
     await writeAppCfg({
       installationId: 'install-1',
-      telemetry: {
-        metrics: true,
-        content: true,
-        artifactManifest: false,
-      },
+      telemetry: { metrics: true, content: true },
     });
     const messages: FakeMessage[] = [
       {
@@ -1488,7 +1484,9 @@ describe('langfuse-bridge.reportRunCompletedFromDaemon', () => {
     const trace = JSON.parse(init.body as string).batch[0].body;
     expect(trace.input).toBe('design a coffee landing page');
     expect(trace.output).toBe('sensitive output');
-    expect(trace.metadata.artifacts).toBeUndefined();
+    expect(trace.metadata.artifacts).toEqual([
+      { slug: 'secret.html', type: 'html', sizeBytes: 1 },
+    ]);
     // tokens + eventsSummary are still in metadata since they're metrics
     expect(trace.metadata.tokens).toEqual({
       input: 100,

apps/daemon/tests/langfuse-trace.test.ts

@@ -494,10 +494,10 @@ describe('buildTracePayload', () => {
     expect(trace.metadata.manifest_completeness).toBeUndefined();
   });
 
-  it('includes trace-safe object manifests when the artifact manifest gate is on', () => {
+  it('includes trace-safe object manifests when content telemetry is on', () => {
     const batch = buildTracePayload(
       makeCtx({
-        prefs: { metrics: true, content: false, artifactManifest: true },
+        prefs: { metrics: true, content: true },
         attachmentManifest: [
           {
             attachment_id: 'att-1',
@@ -589,7 +589,7 @@ describe('buildTracePayload', () => {
     const batch = buildTracePayload(
       makeCtx({
         artifacts: many,
-        prefs: { metrics: true, content: false, artifactManifest: true },
+        prefs: { metrics: true, content: true },
       }),
     );
     const trace = (batch[0] as any).body;
@@ -622,7 +622,7 @@ describe('buildTracePayload', () => {
       makeCtx({
         artifactManifest: many,
         manifestCompleteness: 'complete',
-        prefs: { metrics: true, content: false, artifactManifest: true },
+        prefs: { metrics: true, content: true },
       }),
     );
     const trace = (batch[0] as any).body;
@@ -657,7 +657,7 @@ describe('buildTracePayload', () => {
       makeCtx({
         attachmentManifest: many,
         manifestCompleteness: 'complete',
-        prefs: { metrics: true, content: false, artifactManifest: true },
+        prefs: { metrics: true, content: true },
         run: {
           runId: 'run-1',
           status: 'succeeded',
@@ -1443,7 +1443,7 @@ describe('reportRunCompleted', () => {
     const fetchSpy = vi.fn();
     const result = await reportRunCompleted(
       makeCtx({
-        prefs: { metrics: true, content: false, artifactManifest: true },
+        prefs: { metrics: true, content: false },
       }),
       { config: TEST_CONFIG, fetchImpl: fetchSpy as any },
     );

apps/web/src/App.tsx

@@ -2202,7 +2202,7 @@ function AppInner() {
               ...latestPersistedConfigRef.current,
               installationId,
               privacyDecisionAt: Date.now(),
-              telemetry: { metrics: true, content: true, artifactManifest: false },
+              telemetry: { metrics: true, content: true },
             });
           }}
         />

apps/web/src/components/PrivacySection.tsx

@@ -49,7 +49,7 @@ export function PrivacySection({ cfg, setCfg }: Props): JSX.Element {
       ...c,
       installationId: generateInstallationId(),
       privacyDecisionAt: Date.now(),
-      telemetry: { metrics: true, content: true, artifactManifest: false },
+      telemetry: { metrics: true, content: true },
     }));
   }
 
@@ -58,7 +58,7 @@ export function PrivacySection({ cfg, setCfg }: Props): JSX.Element {
       ...c,
       installationId: null,
       privacyDecisionAt: Date.now(),
-      telemetry: { metrics: false, content: false, artifactManifest: false },
+      telemetry: { metrics: false, content: false },
     }));
   }
 
@@ -67,7 +67,7 @@ export function PrivacySection({ cfg, setCfg }: Props): JSX.Element {
       ...c,
       installationId: generateInstallationId(),
       privacyDecisionAt: c.privacyDecisionAt ?? Date.now(),
-      telemetry: { metrics: false, content: false, artifactManifest: false },
+      telemetry: { metrics: false, content: false },
     }));
   }
 
@@ -106,20 +106,6 @@ export function PrivacySection({ cfg, setCfg }: Props): JSX.Element {
                 patchTelemetry({ content: v });
               }}
             />
-            <ToggleRow
-              label={t('settings.privacyArtifacts')}
-              hint={t('settings.privacyArtifactsHint')}
-              checked={telemetry.artifactManifest === true}
-              onChange={(v) => {
-                trackSettingsPrivacyClick(analytics.track, {
-                  page_name: 'settings',
-                  area: 'privacy',
-                  element: 'project_artifacts_manifest',
-                  project_artifacts_manifest_status: v ? 'on' : 'off',
-                });
-                patchTelemetry({ artifactManifest: v });
-              }}
-            />
           </div>
 
           <div className="settings-subsection">

apps/web/src/i18n/locales/ar.ts

@@ -369,18 +369,16 @@ export const ar: Dict = {
   'settings.privacyHint': 'البيانات التي تتم مشاركتها مع فريق Open Design',
   'settings.privacyConsentKicker': 'ساعدنا في تحسين Open Design',
   'settings.privacyConsentLead': 'يمكن لـ Open Design مشاركة بيانات الاستخدام مع فريقنا لمساعدتنا على التحسين. يشمل ذلك:',
-  'settings.privacyConsentFooter': 'يمكنك تغيير أي من هذه في أي وقت من الإعدادات ← الخصوصية. نحن لا نرفع محتويات ملفات المخرجات التي تنشئها أبدًا.',
+  'settings.privacyConsentFooter': 'يمكنك تغيير هذه الخيارات في أي وقت من الإعدادات ← الخصوصية.',
   'settings.privacyConsentShare': 'مشاركة بيانات الاستخدام',
   'settings.privacyConsentDecline': 'عدم المشاركة',
   'settings.privacyConsentAccept': 'فهمت',
-  'settings.privacyConsentBannerFooter': 'مشاركة البيانات مفعّلة افتراضيًا. يمكنك إيقافها في أي وقت من الإعدادات ← الخصوصية. نحن لا نرفع محتويات ملفات المخرجات التي تنشئها أبدًا.',
+  'settings.privacyConsentBannerFooter': 'مشاركة البيانات مفعّلة افتراضيًا. يمكنك إيقافها في أي وقت من الإعدادات ← الخصوصية.',
   'settings.privacyConsentPolicyLink': 'اقرأ سياسة الخصوصية',
   'settings.privacyMetrics': 'مقاييس مجهولة المصدر',
   'settings.privacyMetricsHint': 'عدد مرات التشغيل، واستخدام Token، ومعدل الأخطاء، والمدة. بدون أي مطالبات، وبدون أي بيانات للمشروع.',
   'settings.privacyContent': 'محتوى المحادثة والأدوات',
-  'settings.privacyContentHint': 'مطالباتك، وردود المساعد، ومدخلات الأدوات، ومخرجات الأدوات (تُقتطع قبل الإرسال). تتم إزالة مفاتيح API والرموز (Token) وJWT والبريد الإلكتروني وعناوين IP وأرقام بطاقات الائتمان تلقائيًا قبل الإرسال.',
-  'settings.privacyArtifacts': 'بيان أصول المشروع',
-  'settings.privacyArtifactsHint': 'أسماء الملفات المُنشأة وأنواعها وأحجامها. لا يتم إرسال محتويات الملفات أبدًا.',
+  'settings.privacyContentHint': 'المطالبات، وردود المساعد، ومدخلات/مخرجات الأدوات، وملفات السياق الكامل اللازمة لمراجعة الجودة. تتم إزالة الأسرار قبل الإرسال.',
   'settings.privacyInstallationId': 'المُعرّف المجهول',
   'settings.privacyOptedOut': 'تم إلغاء الاشتراك',
   'settings.privacyDataDeletion': 'حذف بياناتي',

apps/web/src/i18n/locales/de.ts

@@ -369,18 +369,16 @@ export const de: Dict = {
   'settings.privacyHint': 'Welche Daten mit dem Open Design-Team geteilt werden',
   'settings.privacyConsentKicker': 'Hilf uns, Open Design zu verbessern',
   'settings.privacyConsentLead': 'Open Design kann Nutzungsdaten mit unserem Team teilen, um uns bei Verbesserungen zu helfen. Dazu gehören:',
-  'settings.privacyConsentFooter': 'Du kannst beides jederzeit unter Einstellungen → Datenschutz ändern. Wir laden niemals die Inhalte deiner generierten Artefaktdateien hoch.',
+  'settings.privacyConsentFooter': 'Du kannst diese Einstellungen jederzeit unter Einstellungen → Datenschutz ändern.',
   'settings.privacyConsentShare': 'Nutzungsdaten teilen',
   'settings.privacyConsentDecline': 'Nicht teilen',
   'settings.privacyConsentAccept': 'Verstanden',
-  'settings.privacyConsentBannerFooter': 'Datenfreigabe ist standardmäßig aktiviert. Du kannst sie jederzeit unter Einstellungen → Datenschutz deaktivieren. Wir laden niemals die Inhalte deiner generierten Artefaktdateien hoch.',
+  'settings.privacyConsentBannerFooter': 'Datenfreigabe ist standardmäßig aktiviert. Du kannst sie jederzeit unter Einstellungen → Datenschutz deaktivieren.',
   'settings.privacyConsentPolicyLink': 'Datenschutzrichtlinie lesen',
   'settings.privacyMetrics': 'Anonyme Metriken',
   'settings.privacyMetricsHint': 'Ausführungsanzahl, Token-Verbrauch, Fehlerrate, Dauer. Keine Prompts, keine Projektdaten.',
   'settings.privacyContent': 'Conversation content',
-  'settings.privacyContentHint': 'Your prompts and the assistant\'s responses (truncated 8 KB / 16 KB). API keys, tokens, JWTs, emails, IPs, and credit-card numbers are stripped automatically before send.',
-  'settings.privacyArtifacts': 'Manifest der Projekt-Artefakte',
-  'settings.privacyArtifactsHint': 'Dateinamen, -typen und -größen der generierten Dateien. Dateiinhalte werden niemals gesendet.',
+  'settings.privacyContentHint': 'Prompts, Antworten des Assistenten, Ein- und Ausgaben von Tools sowie vollständige Kontextdateien, die für die Qualitätsprüfung benötigt werden. Geheimnisse werden vor dem Senden entfernt.',
   'settings.privacyInstallationId': 'Anonyme ID',
   'settings.privacyOptedOut': 'abgemeldet',
   'settings.privacyDataDeletion': 'Meine Daten löschen',