fix(browser): redact observed event URLs

Squash merge PR #1296 into dev.
This commit is contained in:
Kai (Tam Nhu) Tran authored and GitHub committed 2026-05-19 08:54:57 -04:00
1 parent a2a51c6128
commit 9a2a1dde31
4 files changed
+194 -12

No files matched your search

+2
View File
@@ -269,3 +269,5 @@ If CCS reports `unsupported_build`, upgrade Codex and rerun `ccs browser status`
- Prefer a dedicated automation user-data dir instead of your everyday browser profile
- Do not commit browser paths, secrets, or generated session state to version control
- Treat `~/.ccs/config.yaml`, `~/.claude.json`, and the browser user-data directory as local machine state
- `browser_wait_for_event` requires explicit scoping for network request events (`urlIncludes`) and download events (`urlIncludes` or `suggestedFilenameIncludes`)
- Event details redact observed navigation, request, and download URLs before returning them to the MCP caller so observed browser metadata does not expose query strings, fragments, or path-scoped bearer values