workspace: memory content mirrored to cloud is unfiltered — no secret/PII redaction

[anandgupta42]

Found during v0.9.7 release review (Chaos Gremlin/Privacy Auditor persona).

memory-extract.ts's tool description explicitly invites the agent to capture 'warehouse configs found via /discover, query patterns from sql_optimize, naming conventions observed' into memory blocks. Nothing in the write path (memory-write.ts, memory-extract.ts) or the mirror path (memory-sync.ts's push() forwards block.content verbatim to MemoryApi.add/update) does secret-scanning, PII filtering, or redaction before content leaves the machine (when workspace mirroring is enabled).

Compounds the disclosure gap fixed in v0.9.7 (see bind-time consent line added in workspace.tsx/link.ts): once a user knows memory syncs and accepts that, there's still no guardrail preventing a warehouse connection string or customer-identifying value from being captured into a block and mirrored.

Deferred because this needs a content-scanning/redaction design (not a quick patch), and the feature remains gated behind the off-by-default ALTIMATE_WORKSPACE pilot flag.

[sahrizvi]

Agreeing with this, and adding two things that widen the exposure beyond what's described — both observed while running the bind/mirror flow end to end against a real tenant this week.

1. Binding uploads content the user never authored for that workspace.

The issue frames the risk as a block being captured into memory and then mirrored — i.e. everything downstream of the moment the user accepts that memory syncs. But backfill on first bind sweeps every local block, including global-scope ones written while working on entirely unrelated projects.

I watched this happen: binding a fresh project to a workspace swept 8 global blocks — written months earlier during unrelated local testing — into that workspace's pool. Nothing about that content was authored with that workspace in mind, and the bind-time consent line reasonably reads as "memory from this project will sync".

So the redaction gap isn't only "what gets captured after consent"; it's also whatever is already sitting on disk from other contexts. If someone has ever captured a connection string into a global block, binding any project ships it.

2. Content passes through a server-side LLM before storage.

Worth naming explicitly in the disclosure surface: the backend runs an extraction/rewrite step over the submitted content before it reaches the store — the stored memory text is not byte-identical to what the client sent, and the client subsequently repairs it back. Practically that means unredacted content reaches an LLM as well as the memory service. Doesn't change the fix, but it's an extra hop worth listing when the redaction design is written.

On the shape of a fix, one thought from having watched the write path closely. Redaction at the mirror boundary (in push(), before MemoryApi.add/update) is the smaller change, but it means the unredacted content still lands in the local block file. Redaction at capture keeps it off disk entirely, at the cost of the local block being lossy relative to what the agent saw. Those are meaningfully different products and it's probably worth deciding which one before the scanning approach is chosen — a scanner is reusable either way, the placement isn't.

No disagreement with the deferral; the pilot flag being off by default is doing real work here.