Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

security(data): DELETE 会话反而把完整 transcript 持久化落盘——无 retention/purge/按人清除，明文宽权限无限留存

Open
  • Is something wrong?
#102 13 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
rust
Domain
api, backend, security

Research direction

Start in src/http/handlers.rs:650-683 to trace DELETE behavior, then inspect src/storage/local.rs:29-34 and the shadow-git, checkpoint, and memory storage paths. Review config_file.rs for the existing 0600 permission precedent and confirm the absence of retention handling with the repository's retention search. Done means DELETE purge leaves no session copy in sessions/, shadow-git, or memory, while stored session data has restricted permissions and retention behavior is defined.

Written by the indexing model from the issue text.

Description

场景 gap 单（okguitar 提报）· 优先级 P1 · 依赖：无

基线 HEAD = 9165b9a0。

Summary

  • DELETE /sessions/:id 在移除会话后调用 storage.save_transcript 把完整 transcript 持久化（src/http/handlers.rs:650-669，Goal 396 语义「会话结束即落盘」）；tombstone（:670-683）只挡冷加载复活，JSONL 本体留在 <workspace>/.recursive/sessions/<id>.jsonl（src/storage/local.rs:29-34）。「删除」操作反而多写一份全文。
  • 全仓 grep -ri retention src/ 零命中——无 retention/TTL 配置项；无「按用户删除」API（没有用户概念）。
  • 会话/记忆/scratchpad 文件按进程默认 umask（通常 0644）明文落盘；set_permissions(0600) 只用于 secrets.env（config_file.rs）。

影响

企业办公/个保法/GDPR 场景：员工离职或数据主体删除请求无执行路径；公司代码与业务对话在服务器磁盘无限期明文留存；共享主机上其他本地账户可读。

建议

  1. DELETE 提供 purge=true 真删语义（或独立 purge 端点），连带 shadow-git/checkpoint 副本；
  2. session 数据文件 0600；
  3. 引入 per-owner retention（天数）后台清理。

验收：DELETE purge 后磁盘上无该会话任何副本（sessions/、shadow-git、memory）。

Dominant language
Rust
Stars
4
Forks
0
Avg merge
5h 32m
Merged PRs (30d)
7

Getting set up

  • Ships a Dockerfile or Docker Compose file
  • No pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from jeffkit/recursive

All issues in jeffkit/recursive

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.