Viewer stores bearer token in sessionStorage — users must re-enter on every new tab

[Shana-AE]

Summary

The viewer stores the AGENTMEMORY_SECRET bearer token in sessionStorage instead of localStorage. Since sessionStorage is per-tab and cleared when the tab closes, users must re-enter the token every time they open a new tab or restart their browser.

Affected code

src/viewer/index.html (around line 1207–1212 on v0.9.27):

var VIEWER_TOKEN_STORAGE_KEY = 'agentmemory-viewer-token';

// Read
try { return sessionStorage.getItem(VIEWER_TOKEN_STORAGE_KEY) || ''; } catch (_) { return ''; }

// Write
if (token) sessionStorage.setItem(VIEWER_TOKEN_STORAGE_KEY, token);
else sessionStorage.removeItem(VIEWER_TOKEN_STORAGE_KEY);

Notably, the theme preference already uses localStorage (line 1070):

localStorage.setItem('agentmemory-theme', dark ? 'dark' : 'light');

So the less-sensitive setting persists, but the auth token does not.

Impact

• Every new tab: user must manually re-enter the token
• Browser restart: token lost
• Tab crash (e.g., from the sync freeze in Viewer dashboard can freeze Chrome by processing large mem-live sync backlogs #609): token may be lost if the page reloads

Suggested fix

Use localStorage instead of sessionStorage for the token. If there are XSS concerns with localStorage, consider:

1. A "Remember token" checkbox (default off = sessionStorage, on = localStorage)
2. Token expiry (clear after N hours)
3. The existing nonce-based CSP (script-src 'nonce-XXX') already provides strong XSS protection, making localStorage reasonably safe

Workaround

Local patch (entrypoint sed):

sed -i 's|sessionStorage.getItem(VIEWER_TOKEN|localStorage.getItem(VIEWER_TOKEN|g' viewer/index.html
sed -i 's|sessionStorage.setItem(VIEWER_TOKEN|localStorage.setItem(VIEWER_TOKEN|g' viewer/index.html
sed -i 's|sessionStorage.removeItem(VIEWER_TOKEN|localStorage.removeItem(VIEWER_TOKEN|g' viewer/index.html

Tested on v0.9.27.