[saucam]

Codeoid stores everything a session does: its transcript, the history other backends are seeded from, the scrollback clients replay, memory, share bundles. Until now a token printed by gh auth token, a cat .env, or a key pasted into a prompt ended up in all of them in plain text. After this change, none of those hold a secret's value.

Design for this and the next three phases: docs/secrets-and-memory-design.md. The user guide is in docs/CONFIGURATION.md, under "Secrets in what codeoid stores".

What changes for a user

• A value codeoid knows is replaced by its name. That covers a declared credential, a backend account's key, an MCP sign-in, and the daemon's own keys. They appear as ‹credential:gh-highflame›, and the value stays where it already lives.
• Anything else that looks like a credential is replaced by a fingerprint. That covers a vendor token, a JWT, a private key, a URL password, and a value under a name like DB_PASSWORD. It appears as ‹secret:github-token:3f9a2c1b›, and the same secret gets the same reference everywhere. A distinct token format is also remembered for the rest of the daemon's run, per tenant, so a bare repeat is caught.
• Some calls are stored without their secret part.
  • A command that exists to print a credential (gh auth token, printenv, op read, cat .env, kubectl get secret, …) is stored without its output.
  • A write to a credential file is stored without its content, on every backend.
• Detected values are dropped by default. A workstream can keep them instead with captureSecrets: "vault": encrypted, kept to that workstream and tenant, and revealed only to the owner's own token, with an audit entry.
• New commands: codeoid secret ls | reveal | forget | promote | scrub. scrub rewrites data stored before this change, and refuses to run while the daemon is up.
• MCP results are scrubbed before the model sees them, through the hub and the relay (secrets.beforeModel, on by default).

Limits (documented)

• The backend has already seen a value by the time codeoid stores the result, and a CLI backend keeps its own copy (for example Claude Code's ~/.claude/projects).
• Claude's Bash output isn't scrubbed before the model sees it.
• Stateless backends (OpenAI-compatible, Gemini, llama.cpp) see earlier secrets as references from the next turn on. The current prompt goes as written.
• A password found only by its name isn't remembered, so a bare repeat isn't caught.
• A secret with no known shape that codeoid doesn't know still gets through.

Verification

• Reviews: two audit rounds (four auditor passes in total), plus a verification pass on round two's fixes. Everything they found is fixed, with a regression test for each.
• Checks: typecheck and lint are clean.
• Tests:
  • Secrets tests: 133 pass under both Bun 1.4.4 and 1.3.13 (the version CI pins).
  • Full unit suite: 6279 pass and 1 fails, the bubblewrap test that also fails on main on this machine.
  • The new e2e journey (e2e/specs/secrets.spec.ts) passes on a real daemon. It covers the web UI, transcripts on disk, a reload, and codeoid secret reveal and forget.
• Performance: detection is linear on hostile input. 2 MB of ordinary source code takes about 140 ms on Bun 1.3.13 against a 250 ms budget. Text that can't be checked in time isn't stored.
• No UI changes, so there are no screenshots.

For agents: where things are

• src/daemon/secrets/:
  • detect.ts: patterns after atuin and gitleaks (MIT). Boundaries are checked in code; private keys and JWTs are found in linear passes; the env value is a sticky second match.
  • known.ts: Aho-Corasick KnownSecrets, and LearnedSecrets indexed by prefix. Both match whole tokens and never inside a reference.
  • scrub.ts: Scrubber and StreamScrubber.
  • verdict.ts and files.ts: what of a tool call is stored.
  • vault.ts: AES-256-GCM, bound to tenant, workstream and fingerprint.
  • service.ts: SecretService and addDaemonKnownSources.
  • scrub-stored.ts: the offline scrub.
• session.ts:
  • #scrubMessage in #persistAndBuffer and #commitStreamed.
  • #recordedToolInput by verdict, at tool_start, approvals and hook-rewritten inputs.
  • tool_complete is scrubbed before hooks run.
  • #historyForTurn sends the raw current prompt.
  • The canonical history uses scrubTurn (partial) and scrubSeed (whole).
• providers/canonical.ts, memory/engine.ts (scrubText), share/pack.ts, mcp/hub.ts (setResultScrub, scrubRelayed), mcp/proxy.ts.
• store.ts: captured_secrets, knownSecretValues, scrubText for settled dispatch tasks, events and audit.
• routines/store.ts, server.ts and cli.ts. Only codeoid start creates the service (secretsConfigDir).
• Protocol: secret.list, secret.reveal, secret.forget. Config: secrets.* and workstreams.items[].captureSecrets.

🤖 Generated with Claude Code

[saucam]

pr-shepherd: CI is green on a1a810e (daemon-check, e2e, web-check, Socket x2). I made no changes: no failures, the branch is level with main (0 behind), and every commit subject passes the prefix check. Oracle hasn't reviewed yet. Asked for review in #javelin-pr.