Description
Privacy scrubbing runs on the system prompt and on user/assistant messages, but tool result messages are explicitly passed through unscrubbed. The exemption is one line: if (m.role === 'tool') return m; in source/ai-sdk-client/chat/chat-handler.ts (line 177).
Use Case
Tool results are the largest volume of text leaving the machine and the least user-reviewed a cat .env, a git diff carrying a key, a config dump, or a stack trace with a token all go to the provider verbatim. Nanocoder's headline principle is zero telemetry, and /privacy tells users what gets removed, while the single largest channel is exempt from it.
Proposed Solution
Run the same detector set against tool result content, and rehydrate on the way back through the existing rehydrate path (already wired for tool args around chat-handler.ts:435). Make the detector set for tool results configurable PathDetector and UrlDetector are already disabled on the existing scrub paths because scrubbing paths/URLs out of tool output breaks the agent's ability to act on it, and the same tradeoff applies here.
Alternatives Considered
Leave it as user-education only (/privacy documents the gap) rejected, since it contradicts the project's own zero-telemetry framing.
Additional Context
Description
Privacy scrubbing runs on the system prompt and on user/assistant messages, but tool result messages are explicitly passed through unscrubbed. The exemption is one line:
if (m.role === 'tool') return m;insource/ai-sdk-client/chat/chat-handler.ts(line 177).Use Case
Tool results are the largest volume of text leaving the machine and the least user-reviewed a
cat .env, agit diffcarrying a key, a config dump, or a stack trace with a token all go to the provider verbatim. Nanocoder's headline principle is zero telemetry, and/privacytells users what gets removed, while the single largest channel is exempt from it.Proposed Solution
Run the same detector set against tool result content, and rehydrate on the way back through the existing
rehydratepath (already wired for tool args around chat-handler.ts:435). Make the detector set for tool results configurablePathDetectorandUrlDetectorare already disabled on the existing scrub paths because scrubbing paths/URLs out of tool output breaks the agent's ability to act on it, and the same tradeoff applies here.Alternatives Considered
Leave it as user-education only (
/privacydocuments the gap) rejected, since it contradicts the project's own zero-telemetry framing.Additional Context
prompt-scrubIntegration) #635, which shipped the original scrubber but explicitly skipsrole === 'tool')