session-export

Dumping a chat into a file looks harmless, but in compliance and audit workflows that step is exactly where leakage happens—API keys, JWTs, pasted .env values, user:pass URLs, and absolute file paths all land on disk untouched. session-export splits the job into two phases: sanitize first, then archive, so the final document is verifiable yet irreversible.

Redaction is fully rule-based, covering eight default categories (api-key, JWT, high-entropy tokens, KEY=value lines, Bearer strings, URL credentials, absolute paths, and user-defined regexes). The same input always yields the same output; every masked value carries a 12-character salted SHA-256 fingerprint, keeping records correlatable across files and machines without exposing the original. Exports ship in Markdown narrative, JSONL full-record, and PDF (self-contained print-ready HTML, optionally rendered via headless Chromium). Archives are organized by session and date, with list, search, and delete operations that reject path traversal outright. Each export embeds a compliance metadata header, and the /export-audit view aggregates activity by day, format, and sensitivity level.

If you work with DeepSeek Harness and regularly need to hand session records to legal, audit, or project-documentation teams, this plugin is the redact-before-export, trace-after-export layer you are missing. No model dependency, no extra runtime—install and go.