[stawan15]

The agent reads untrusted things — a web page, a dependency, a reply — and then acts with the user's account behind it. This closes the places where that turns into a credential leak, and tightens the phone page.

What leaves the process is masked

Conversations, prompt history, exports, the phone page and resume-search snippets pass through a redactor. It catches the key shapes worth knowing — sk-, sk-ant-, ghp_, glpat-, xoxb-, AKIA, AIza, JWT, PEM blocks, Bearer …, user:pass@, password=, quoted JSON values — and the exact keys in auth.json, the provider environment and the phone token. The last four characters survive so a person can tell which key leaked: sk-[redacted:…3456]. RedactJSON keeps a tool call's JSON valid, and a second pass doesn't touch a marker it already wrote. /scrub cleans the conversations saved before this existed.

Child processes no longer inherit the shell's keys

Bash, background jobs, hooks and MCP servers get an environment with *_API_KEY, *_TOKEN, *_SECRET, *_PASSWORD, AWS_* and similar dropped, so a model that runs env sees PATH, not credentials. An MCP server still gets exactly the variables its own configuration lists. A shell command that names a credential store (~/.ssh, ~/.aws, ~/.git-credentials, teveus's config dir, cloud metadata) asks first even in autopilot, because a command has no paths to inspect before it runs.

WebFetch can't reach this machine

Loopback, private, link-local, CGNAT and cloud metadata are refused on the first request and on every redirect, and the address actually connected to is checked, so a DNS answer can't change in between. WebFetchLocal turns that off for a local dev server.

The phone page

• Listens on 127.0.0.1 unless you name another address; binding wider still works and now warns that the page is plain HTTP.
• Trades the token in its link for an HttpOnly, SameSite=Strict cookie and redirects to /, so the address bar, the history and the page's own scripts stop carrying it.
• Sends a nonce-based CSP and the usual frame, sniffing and referrer headers; bounds timeouts, header size and body size.
• Can make permissions stricter but not looser: autopilot and "always allow" stay in the terminal. So do trusting a folder and agreeing to run Claude Code — the page says what's waiting and points at the terminal.
• Other windows' pages no longer carry their links; tapping one asks this server to open it.
• A masked field's value never reaches the page.

Undo

/undo and /rewind give a file back its original permissions instead of a fixed 0644, so a restored 0600 key file doesn't become world-readable.

Docs and tests

SECURITY.md, PRIVACY.md, README.md and CHANGELOG.md describe the new behaviour (the changelog is regenerated into docs/changelog.json). New tests cover every redaction shape and its idempotency, save and scrub, env filtering, the SSRF guard including 100.64/10 and redirects, the credential ask in autopilot, the cookie flow, the security headers, mode and permission escalation, local-only questions and masked input.