feat(logging): capture full run payload in session_logs on every run

Every run (App tab + Chat tab) now logs its complete payload to Supabase
session_logs in meta.payload of the 'run started' events:
- raw GO form inputs (controller._run_payload set in defined_go)
- resolved company/use case/vertical/line/function/context
- secret-redacted settings snapshot

Attached in _create_run_loggers() (guaranteed even when a run dies before
research) and again in run_research_streaming() once fully resolved.
New sanitize_payload() in session_logger.py redacts key/secret/password/
token/credential/auth values and truncates >2000-char strings; 5 tests in
tests/test_run_payload_logging.py. Chat-tab runs reset stale App-tab
_run_source/_run_payload at initialization. Query guide in
dev_notes/logging_channels.md (local docs, not tracked).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

chat_interface.py

@@ -556,14 +556,46 @@ I'll research a company, build a Snowflake schema, generate realistic data, and
             test_tag=tag,
             model=resolved_model,
             model_setting=model_setting,
+            payload=self._snapshot_run_payload(),
         )
         return self._session_logger
+
+    def _snapshot_run_payload(self):
+        """
+        One JSON-safe record of everything that defines this run.
+
+        Logged into session_logs meta on every run so Run History and ad-hoc
+        queries can always answer "what was run": the raw GO form inputs
+        (App tab), the resolved use case, and a secret-redacted snapshot of
+        the controller settings. Secrets never leave the process — see
+        sanitize_payload() in session_logger.py.
+        """
+        from session_logger import sanitize_payload
+        return sanitize_payload({
+            'interface': getattr(self, '_run_source', 'chat'),
+            'company': getattr(self, 'pending_generic_company', '') or self.settings.get('company', ''),
+            'use_case': getattr(self, 'pending_generic_use_case', '') or self.settings.get('use_case', ''),
+            'vertical': getattr(self, 'vertical', None),
+            'line': getattr(self, 'line', None),
+            'function': getattr(self, 'function', None),
+            'is_custom': getattr(self, 'is_generic_use_case', False),
+            'additional_context': getattr(self, 'generic_use_case_context', '') or '',
+            'form': getattr(self, '_run_payload', None),
+            'settings': dict(self.settings),
+        })
     
     def process_chat_message(self, message, chat_history, current_stage, current_model, company, use_case):
         """
         Process user message and return updated chat history and state (with streaming)
         Returns: (chat_history, current_stage, current_model, company, use_case, next_textbox_value)
         """
+        # Chat-tab runs enter at 'initialization' (App tab jumps straight to
+        # 'awaiting_context' after stashing its form payload) — reset any
+        # leftover App-tab run metadata so the logged payload matches this run.
+        if current_stage == 'initialization':
+            self._run_source = 'chat'
+            self._run_payload = None
+
         # Pipeline starts from awaiting_context; always give it a fresh run log.
         self._create_run_loggers(force=(current_stage == 'awaiting_context'))
         _slog = self._session_logger
@@ -2095,6 +2127,7 @@ To change settings, use:
                 additional_context=(getattr(self, 'generic_use_case_context', '') or '')[:500],
                 model=resolved_model,
                 model_setting=model_setting,
+                payload=self._snapshot_run_payload(),
             )
         password_block = self._temporary_password_block_message()
         if password_block:
@@ -6302,6 +6335,26 @@ def create_chat_tab(chat_controller_state, settings, current_stage, current_mode
             if share_with is not None:
                 controller.settings['share_with'] = share_with
 
+            # Capture the raw GO form payload so the run logger records exactly
+            # what was submitted (logged secret-redacted via _snapshot_run_payload)
+            controller._run_payload = {
+                'vertical': vertical,
+                'line': line,
+                'function': function_clean,
+                'url': url,
+                'use_url': use_url,
+                'additional_info': additional_info,
+                'model': model,
+                'ts_environment': env_label,
+                'liveboard_name': lb_name,
+                'data_size': data_size,
+                'geo_scope': geo_scope,
+                'tag_name': tag_name,
+                'column_naming': col_naming,
+                'object_prefix': obj_prefix,
+                'share_with': share_with,
+            }
+
             # Derive company name from URL or line+function label
             if use_url and url.strip():
                 raw_company = url.strip()

session_logger.py

@@ -47,6 +47,44 @@ from pathlib import Path
 from typing import Any, Optional
 
 
+# ---------------------------------------------------------------------------
+# Payload sanitization
+# ---------------------------------------------------------------------------
+
+_SECRET_KEY_RE = re.compile(r"key|secret|password|token|credential|auth", re.IGNORECASE)
+_MAX_PAYLOAD_STR = 2000
+
+
+def sanitize_payload(value: Any, _depth: int = 0) -> Any:
+    """
+    Return a JSON-safe copy of `value` suitable for the session_logs meta column.
+
+    - Dict values whose key looks secret (key/secret/password/token/credential/auth)
+      are replaced with a length marker, never logged.
+    - Strings longer than 2000 chars are truncated.
+    - Anything non-JSON-serializable is coerced to str.
+    """
+    if _depth > 6:
+        return str(value)
+    if isinstance(value, dict):
+        out = {}
+        for k, v in value.items():
+            if _SECRET_KEY_RE.search(str(k)) and isinstance(v, str) and v:
+                out[str(k)] = f"<redacted {len(v)} chars>"
+            else:
+                out[str(k)] = sanitize_payload(v, _depth + 1)
+        return out
+    if isinstance(value, (list, tuple)):
+        return [sanitize_payload(v, _depth + 1) for v in value]
+    if isinstance(value, str):
+        if len(value) > _MAX_PAYLOAD_STR:
+            return value[:_MAX_PAYLOAD_STR] + f"… <truncated, {len(value)} chars total>"
+        return value
+    if isinstance(value, (int, float, bool)) or value is None:
+        return value
+    return str(value)
+
+
 # ---------------------------------------------------------------------------
 # SessionLogger class
 # ---------------------------------------------------------------------------

tests/test_run_payload_logging.py

@@ -0,0 +1,96 @@
+"""
+Tests for run-payload logging.
+
+Covers sanitize_payload() in session_logger.py — the guard that lets the full
+run payload go into the Supabase session_logs meta column on every run without
+ever leaking secrets (trusted-auth keys, API keys, passwords).
+"""
+
+import json
+
+from session_logger import sanitize_payload
+
+
+def test_secret_keys_are_redacted():
+    payload = {
+        'thoughtspot_trusted_auth_key': 'super-secret-value-123',
+        'openai_api_key': 'sk-abc',
+        'password': 'hunter2',
+        'some_token': 'tok_xyz',
+        'thoughtspot_url': 'https://demo.thoughtspot.cloud',
+        'company': 'Acme',
+    }
+    out = sanitize_payload(payload)
+    dumped = json.dumps(out)
+    assert 'super-secret-value-123' not in dumped
+    assert 'sk-abc' not in dumped
+    assert 'hunter2' not in dumped
+    assert 'tok_xyz' not in dumped
+    # Non-secret values pass through untouched
+    assert out['thoughtspot_url'] == 'https://demo.thoughtspot.cloud'
+    assert out['company'] == 'Acme'
+    # Redacted values carry a length marker, not the secret
+    assert out['thoughtspot_trusted_auth_key'].startswith('<redacted')
+
+
+def test_nested_secrets_are_redacted():
+    payload = {'settings': {'inner': {'auth_key': 'deep-secret'}}}
+    out = sanitize_payload(payload)
+    assert 'deep-secret' not in json.dumps(out)
+
+
+def test_long_strings_are_truncated():
+    out = sanitize_payload({'ddl': 'x' * 5000})
+    assert len(out['ddl']) < 2100
+    assert 'truncated' in out['ddl']
+
+
+def test_json_safe_output():
+    class Weird:
+        def __repr__(self):
+            return 'WeirdObject'
+
+    payload = {
+        'obj': Weird(),
+        'tuple': (1, 2),
+        'none': None,
+        'flag': True,
+        'num': 3.5,
+        'list': [{'k': 'v'}, 'plain'],
+    }
+    out = sanitize_payload(payload)
+    # Must round-trip through JSON without default= hacks (Supabase insert path)
+    json.dumps(out)
+    assert out['obj'] == 'WeirdObject'
+    assert out['tuple'] == [1, 2]
+    assert out['none'] is None
+
+
+def test_typical_run_payload_shape():
+    """A realistic snapshot like _snapshot_run_payload() produces."""
+    snapshot = {
+        'interface': 'app_defined',
+        'company': 'https://nike.com',
+        'use_case': 'Retail Sales Performance',
+        'vertical': 'Retail',
+        'line': 'Retail',
+        'function': 'Sales',
+        'is_custom': False,
+        'additional_context': '',
+        'form': {
+            'vertical': 'Retail', 'line': 'Retail', 'function': 'Sales',
+            'url': 'https://nike.com', 'use_url': True, 'additional_info': '',
+            'model': 'GPT-5', 'ts_environment': 'SE Demo', 'liveboard_name': None,
+            'data_size': 'Medium', 'geo_scope': 'USA Only', 'tag_name': '',
+            'column_naming': 'snake_case', 'object_prefix': '', 'share_with': '',
+        },
+        'settings': {
+            'model': 'GPT-5',
+            'thoughtspot_trusted_auth_key': 'SECRET',
+            'fact_table_size': '10000',
+        },
+    }
+    out = sanitize_payload(snapshot)
+    assert 'SECRET' not in json.dumps(out)
+    assert out['form']['data_size'] == 'Medium'
+    assert out['settings']['fact_table_size'] == '10000'