[J-StrawHat]

Description

Session messages may contain important credentials (e.g., ak/sk, API key, password) in user text, tool arguments, tool results, and context abstracts. Persisting those values also makes them available to later memory extraction.

This PR add opt-in, offline credential masking at the shared Session append boundary, before message construction, tool-output externalization, or persistence.

Enable it with memory.session_secret_masking_enabled: true in ov.conf (The default is false, preserving existing behavior). The scanner masks private copies of message content without changing caller-owned tool arguments. For example, API_KEY=abcdefghijklmnopqrstuvwxyz is stored as API_KEY=ab****yz, while ordinary fields such as region, max_tokens, token_count, and cache_key remain unchanged. No new HTTP API, third-party dependency, model call, or online credential verification is introduced.

Human Involvement

• A human participated in the implementation or review loop
• This PR was generated entirely by AI agents without human participation in the loop

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test update

Changes Made

• Mask text, context abstracts, nested tool inputs, tool outputs, and tool-output externalization error text before any batch content is written. Reject invalid or over-limit batches without falling back to unmasked persistence.
• Share field-name normalization across structured inputs, textual assignments, and CLI options. Recognize case-insensitive aliases, common camel-case names, and underscore/hyphen separators. Unambiguous credential suffixes support arbitrary namespaces, including EVAL_ARK_API_KEY, MY_COMPANY_API_KEY, and MY-API-KEY.
• Preserve recognized prefixes and the first/last two characters of long, plain credential bodies; replace short or complex values with [REDACTED]. Sensitive non-string field values, including containers, are replaced as a whole. Preserve Bearer/Basic authentication schemes and already-masked values.
• Run scanning on one dedicated worker thread per process with bounded text, batch, nesting, node, and match budgets. Keep the existing grouping, externalization, and append flow.

Supported credential types

• Known token prefixes: sk-, sk-proj-, sk-svcacct-, sk-ant- and its apiN- variants; ak- and Ark ark-; Volcengine AKLT/AKTP; AWS AKIA/ASIA Access Key IDs.
• GitHub tokens: ghp_, gho_, ghu_, ghs_, ghr_, and github_pat_.
• Credential fields: ak, sk, api_key, x_api_key, access_key, access_key_id, secret_key, secret_access_key, and access_key_secret, including supported aliases and namespace suffixes. Unprefixed secret values are detected through field context.
• Tokens, passwords, and secrets in named fields: token, access_token, refresh_token, session_token, auth_token, security_token, bot_token; password, passwd, pwd; secret, client_secret, app_secret, private_key, signing_key, signing_secret, webhook_secret, credential, and credentials.
• Authentication text and headers: Bearer/Basic values, Authorization, and Proxy-Authorization.
• CLI credentials: sensitive long options with space or = separators and quoted/escaped values, plus curl --oauth2-bearer, --user/-u, and --proxy-user/-U. Combined user:password values are fully replaced.

Testing

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have tested this on the following platforms:
  • Linux
  • macOS
  • Windows

Validation was performed locally on macOS:

• Focused regression suite: 204 passed for the final committed implementation.
• Isolated HTTP end-to-end validation: 469/469 checks passed, including persistence, externalized tool outputs, archives, memory extraction, ordinary-field preservation, and concurrent requests.
• Live Web Studio → VikingBot → OpenViking validation with real tool calls and automatic commit: checked 40 synthetic credential values, three externalized outputs, and ordinary fields across 32 varied log records. Original credentials were absent from the checked persisted content. The personal OpenViking service was unaffected.
• Performance study: 10 fresh processes, 384 synthetic input variants, and 518,400 timed calls, covering baseline/disabled/enabled modes, 4,096–4,194,304 characters, six corpus categories, and concurrency 1/8/32. At concurrency 1, enabled P95 ranged from 0.39–0.55 ms for 4,096 characters and 3.39–5.92 ms for 65,536 characters. These are averages of per-process P95 values; file writes were stubbed, and HTTP/model latency was excluded. Larger inputs and queueing add measurable cost.

Checklist

• My code follows the project's coding style
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• Any dependent changes have been merged and published

Screenshots (if applicable)

When chatting with the agent:

Memory stored in OpenViking: (important credentials have been masked)

Additional Notes

Detection is best-effort and based on known formats and sensitive field context. This does not identify every arbitrary random string, decode encoded credentials, inspect images or referenced resources, or rewrite historical content. No original-value mapping is retained. The feature is independent of whether memory extraction is enabled.

[J-StrawHat]

New implementation: PR #6278