[CurryYangxx]

---

What

Two user-facing additions around the Hide Confidential values in Preview/Console setting:

• Tools → Clear All Response History — a global clear, behind a confirmation dialog. Removes HTTP / WebSocket / Socket.IO / MCP responses and collection-runner results across every project and collection, including the body, timeline and event-log files they point at on disk.
• Toggle notices — switching the setting back ON suggests clearing Response History; switching it OFF warns that confidential values will persist in local logs/history. Both are modals, shown on every toggle.

Why

While the setting is off, confidential values are written to the local timeline and response files in cleartext. Turning it back on hides them in the UI but does not remove what was already persisted, so users need both a heads-up and a way to clean up.

Notes

• None of the removed document types sync (canSync = false), so this only affects the local machine — no server or git state is touched.
• The handler lives in root.tsx rather than renderer-listeners.ts so it can revalidate() afterwards; the response panes read from loaders, which a raw database write does not refresh. The runner history is component state, so it re-reads on db.changes instead.
• Runner results are already redacted at write time; they are included here because results recorded while the setting was off contain plaintext.

Testing

• Unit test for removeAllResponseHistory covering all five document types, file unlinking, missing files, and that requests/workspaces are left alone.
• Manually: clear with a request open (response pane empties), and with the Runner tab open on a past result (history list and result pane clear).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

✅ KSAI Review: Finished

1. 07:44 UTC Reading review guidelines and knowledge base before analyzing changes
2. 07:46 UTC Tracing service invocations and IPC channels across modules
3. 07:48 UTC Tracing settings and modal rendering paths across the codebase
4. 07:50 UTC Tracing modal rendering and confidential redaction across UI tests
5. 07:52 UTC Tracing modal behavior through component code and search results
6. 07:56 UTC Tracing modal flows and reviewing smoke test coverage

---

Run report (federated) · 1 paid run · $0.1973 total

#	Engine	Result	Model	Turns	Cost
1	opencode	success	glm-5.3-flash/max	88	$0.1966

Reviewing cost $0.1966; deciding how to run it cost $0.0007

[github-actions]

Check	Result
Scope	Global 'Clear All Response History' action across menu, renderer confirm, main-process delete; toggle heads-up alert; label renames; runner refresh on doc removal.
Mandate	typescript-code-reviewer (adversarial TypeScript)
Findings	2 High, 1 Medium, 2 Low
Findings audit	One kreview:findings-auditor pass; all 5 findings upheld; 2 Low reworded; none removed.

The clear-all path is wired correctly across renderer, IPC and main process, and the unit test covers the delete helper. The new toggle alert blocks both smoke specs that toggle the setting, so CI fails. The unlink handler hides real file failures behind a success toast.

Additional Risk pass: no leaked secrets, no new attack surface beyond the existing services.invoke bridge, no listener or handle leaks.

This review read 7032251. The pull request has moved to 633810e since, so a comment on a line changed after that commit shows as outdated.