[Dhravya]

Addresses #122 with a deterministic, offline filter immediately before automatic capture writes. Common provider-token prefixes, credential assignments, private-key blocks, Bearer tokens, JWTs, and URL credentials become explicit replacement markers, while surrounding facts and ordinary placeholders remain. This covers formatted user/assistant content, configured tool fields/results, signal captures, and pending Stop replies.

Capture-only protection: original prompt text still reaches recall/search requests unchanged. Explicit MCP writes and previously stored memories are not sanitized. This does not guarantee that secrets never leave the machine or that all credentials are detected.

Capture errors retain the existing friendly status messages without echoing HTTP response bodies; other capture error text is filtered. Cursor advancement, original pending-reply hashes, retries, document/session identity, namespace routing, and automatic remembering are unchanged. No settings, stored history, recall/query/ranking/UI behavior, or explicit MCP schemas/tools change. The Privacy section describes these limits; the filter cannot detect every secret.

Verified from a cold source archive with official Claude Code 2.1.296 and local synthetic model/memory APIs: six persistent sessions, 13 document requests (one intentionally unfiltered baseline and 12 filtered captures), actual Read input/results, signal/pending captures, same-session source replacement/resume, failure/retry, and an uninstrumented session. A scratch merge with #138's actual SDK adapter, retaining main's #141 transcript fix, exercises both legacy and v5 writes. It needs two mechanical capture.js conflict resolutions: retain the supporting-context import plus the redactor, and pass redacted content with the migration namespace. #138 itself was not edited or rebased.

Existing tests pass unchanged (32/32 for this source and the merged integration), Biome CI passes its configured scope, official strict plugin validation passes, and 47 positive/20 negative scratch cases pass. The standalone reproduction passes again in a second cold root; probes/evidence stay outside the repository. There are no test/workflow changes.

Version metadata remains 0.1.11. Release delivery is separate because #142 and #138 already reserve 0.1.12; this PR is a source fix, not evidence that installed caches have received it. Production services, real secrets/authentication, macOS, release/cache rollout, concurrent capture/exactly-once delivery, and one-shot shutdown durability were not validated here.

[capy-ai]

Capy found no issues.

View 2 other findings in Capy.