Viewer stores bearer token in sessionStorage — users must re-enter on every new tab

[Shana-AE]

Summary

The viewer stores the AGENTMEMORY_SECRET bearer token in sessionStorage instead of localStorage. Since sessionStorage is per-tab and cleared when the tab closes, users must re-enter the token every time they open a new tab or restart their browser.

Affected code

src/viewer/index.html (around line 1207–1212 on v0.9.27):

var VIEWER_TOKEN_STORAGE_KEY = '"agentmemory-viewer-token"';

// Read
try { return sessionStorage.getItem(VIEWER_TOKEN_STORAGE_KEY) || '""'; } catch (_) { return '""'; }

// Write
if (token) sessionStorage.setItem(VIEWER_TOKEN_STORAGE_KEY, token);
else sessionStorage.removeItem(VIEWER_TOKEN_STORAGE_KEY);

Notably, the theme preference already uses localStorage (line 1070):

localStorage.setItem('"agentmemory-theme"', dark ? '"dark"' : '"light"');

So the less-sensitive setting persists, but the auth token does not.

Impact

• Every new tab: user must manually re-enter the token
• Browser restart: token lost
• Tab crash (e.g., from the sync freeze in Viewer dashboard can freeze Chrome by processing large mem-live sync backlogs #609): token may be lost if the page reloads

Suggested fix

Use localStorage instead of sessionStorage for the token. If there are XSS concerns with localStorage, consider:

1. A "Remember token" checkbox (default off = sessionStorage, on = localStorage)
2. Token expiry (clear after N hours)
3. The existing nonce-based CSP (script-src '"nonce-XXX"') already provides strong XSS protection, making localStorage reasonably safe

Workaround

Local patch (entrypoint sed):

sed -i '"s