环境变量STORE_SESSION_MESSAGES是否已经失效了？

[faqformy]

我设置环境变量STORE_SESSION_MESSAGES=false，但是Session 详情的请求体和请求Message还是会记录详细请求数据。

[ding113]

这个变量目前的行为改为控制 message 消息体里的 redact 了。
选择不存储 message 后，消息体里用户输入会被隐藏。

[github-actions]

Thank you for your question.

Based on my analysis of the codebase, STORE_SESSION_MESSAGES has not become invalid — its behavior was intentionally changed in v0.5.1 (PR #655). The changelog entry states:

会话消息存储策略调整：STORE_SESSION_MESSAGES 环境变量改为控制消息脱敏而非存储开关

Before v0.5.1: STORE_SESSION_MESSAGES=false meant request/response bodies were not stored at all.

After v0.5.1 (current behavior): STORE_SESSION_MESSAGES=false means request/response bodies are still stored, but sensitive message content is redacted to [REDACTED]. This is now a privacy/redaction control, not a storage toggle.

Current behavior with STORE_SESSION_MESSAGES=false:

Data	Stored?	Content
Request body	Yes	Message content replaced with [REDACTED]
Messages	Yes	Content fields replaced with [REDACTED]
Response body	Yes	Message content replaced with [REDACTED]
System prompts	Yes	Replaced with [REDACTED]
JSON structure	Yes	Preserved (role, type, etc. remain visible)

This behavior is implemented in src/lib/session-manager.ts:

• Line 953: storeSessionMessages() — when STORE_MESSAGES is false, calls redactMessages() before storing
• Lines 1414-1416: storeSessionRequestBody() — when false, calls redactRequestBody() which redacts messages[], system, input[], and Gemini contents[]
• Lines 1342-1389: storeSessionResponse() — when false, calls redactResponseBody() which redacts response message content

The redaction logic is in src/lib/utils/message-redaction.ts, which supports Claude, OpenAI, Gemini, and Codex formats.

The environment variable definition in src/lib/config/env.schema.ts (lines 97-100) confirms the current design:

// - false (default): store request/response bodies but redact message content [REDACTED]
// - true: store message content as-is (note privacy and storage implications)

What you should see with STORE_SESSION_MESSAGES=false:

When viewing Session details, you should see the structure of requests/responses, but all sensitive content (message text, system prompts, tool inputs/outputs, image data) should show as [REDACTED]. If you are seeing the full unredacted content, please verify:

1. That the environment variable is correctly set and the application was restarted after the change
2. That you're looking at sessions created after the restart (existing Redis-cached sessions from before the restart will still have the old data for up to SESSION_TTL seconds, default 300s)

Summary

This is working as designed in the current version. The variable controls redaction rather than storage. If your expectation is that no data should be stored at all, that is the old behavior and is no longer supported — the current approach ensures session debugging is always available while protecting sensitive content by default.

---

Automated response from Claude AI

[faqformy]

这个变量目前的行为改为控制 message 消息体里的 redact 了。 选择不存储 message 后，消息体里用户输入会被隐藏。

收到，谢谢。