Clear localStorage on sign-out

[tembo]

Summary

Fixed security vulnerability where chat cache persisted in localStorage after sign-out on shared devices. Changes include:

• Removed localStorage.setItem() call for chat cache in app-sidebar.tsx - now only uses sessionStorage with minimal fields (_id, title, updatedAt)
• Updated auth-client.tsx to clear both sessionStorage and localStorage for all sensitive keys (openchat-chats-cache, openchat-prompt-drafts, openchat-stream) during sign-out
• Renamed SENSITIVE_SESSION_KEYS → SENSITIVE_STORAGE_KEYS to reflect dual-storage clearing
• Cleaned up merge conflict markers in app-sidebar.tsx

Files modified:

• apps/web/src/components/app-sidebar.tsx
• apps/web/src/lib/auth-client.tsx

Want tembo to make any changes? Add a review or comment with @tembo and i'll get back to work!

---

Summary by cubic

Stops chat data from persisting in localStorage after sign-out to prevent data leakage on shared devices. Sidebar now caches minimal chat fields in sessionStorage, and sign-out clears sensitive keys from both storages.

• Bug Fixes
  • Cache only _id, title, and updatedAt in sessionStorage for the sidebar.
  • On sign-out, remove openchat-chats-cache, openchat-prompt-drafts, and openchat-stream from sessionStorage and localStorage.
  • Rename SENSITIVE_SESSION_KEYS to SENSITIVE_STORAGE_KEYS.

^{Written for commit d312850. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
osschat-web	Error		Feb 14, 2026 3:08am

[railway-app]

This PR was not deployed automatically as @tembo[bot] does not have access to the Railway project.

In order to get automatic PR deploys, please add @tembo[bot] to your workspace on Railway.