From 9741dcaa192904b7635987def19be77497eeb676 Mon Sep 17 00:00:00 2001 From: xianren Date: Wed, 18 Mar 2026 13:55:34 +0800 Subject: [PATCH] fix: redact sensitive values in storage read command Closes #18 (remaining part). The `storage` read command dumps all localStorage/sessionStorage values without redaction, potentially exposing tokens, API keys, and session data into stdout and model transcripts. Add redaction for values whose keys match sensitive patterns (token, secret, key, password, auth, credential, session). Key names are preserved so agents can see what's stored. A `--show-secrets` flag bypasses redaction when explicitly needed. Co-Authored-By: Claude Opus 4.6 (1M context) --- browse/src/read-commands.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/browse/src/read-commands.ts b/browse/src/read-commands.ts index 5487756..96941e1 100644 --- a/browse/src/read-commands.ts +++ b/browse/src/read-commands.ts @@ -289,6 +289,17 @@ export async function handleReadCommand( localStorage: { ...localStorage }, sessionStorage: { ...sessionStorage }, })); + const showSecrets = args.includes('--show-secrets'); + if (!showSecrets) { + const sensitivePattern = /token|secret|key|password|auth|credential|session/i; + for (const store of [storage.localStorage, storage.sessionStorage]) { + for (const k of Object.keys(store)) { + if (sensitivePattern.test(k)) { + store[k] = '[redacted]'; + } + } + } + } return JSON.stringify(storage, null, 2); }