P3.6: Detector — client_storage scaffold and registration

[bjcorder]

Parent tracker: #62
Spec: docs/superpowers/specs/2026-05-21-edge-case-hardening-design.md
Milestone: P3

Goal

Create the new client_storage detector and register it. The detector recognises browser-side token storage and URL embedding patterns so P3.7 classifier rules can flag them.

Acceptance criteria

• New module crates/sessionscope-detectors/src/client_storage/mod.rs.
• Detector registered in crates/sessionscope-detectors/src/registry.rs.
• Recognises:
  • localStorage.setItem(name, ...) and sessionStorage.setItem(name, ...)
  • document.cookie = ... (key portion)
  • URL builder patterns embedding token-shaped names in path segments or fragment identifiers
• Token-shaped name patterns: access_token, id_token, refresh_token, jwt, bearer, auth, session (case-insensitive substring match, with documented allowlist to avoid noise).
• Distinguishes path segments vs fragment identifiers (#token=...) since the existing query-param detector already covers ?token=.
• Evidence excerpts redacted before reporting.

Files touched

• crates/sessionscope-detectors/src/client_storage/mod.rs (new)
• crates/sessionscope-detectors/src/registry.rs (register)

Audit-then-decide

• No new finding category from this issue. Findings land in P3.7.

Doc-update checklist

• docs/USAGE.md notes the new detector under "Storage hygiene".
• Coverage-matrix entries deferred until P3.7 lands findings.

[bjcorder]

Implemented in 79eb8db.

Summary:

• Added and registered the client_storage detector.
• Detects token-shaped localStorage.setItem, sessionStorage.setItem, document.cookie writes, URL path/fragment token embedding, and browser-path client secret evidence.
• Uses an allowlist for benign storage keys such as theme and keeps evidence excerpts sanitized.
• Preserved existing bearer detector behavior; P3 classifier dedupe/ownership remains additive rather than removing old behavior.

Validation:

• cargo test -q -p sessionscope-detectors client_storage — passed

Notes / follow-ups:

• Findings for the emitted evidence land in P3.7: Classifier — client storage hygiene findings #83.

[bjcorder]

Implemented in follow-up commit 867fd6d.

Summary:

• Narrowed URL path/fragment token evidence to avoid treating ordinary /auth/callback OAuth callback paths as token-in-URL findings.
• Adjusted Authlib fixture imports to keep placeholder-token guardrails clean.

Validation:

• cargo test -q -p sessionscope-detectors client_storage — passed
• cargo test -q -p sessionscope-testing fixture_sources_use_only_obvious_placeholder_secrets — passed
• cargo test -q -p sessionscope-testing issue_27_provider_library_fixtures_emit_documented_coverage — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in review-fix commit 4814668.

Summary:

• Added redaction for literal second arguments in token-shaped localStorage.setItem / sessionStorage.setItem evidence so detector excerpts do not leak browser-stored token values.
• Added detector regression coverage for this redaction path.

Validation:

• cargo test -q -p sessionscope-detectors client_storage — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in review-fix commit a69a59f.

Summary:

• Extended browser storage redaction to template-literal token values in token-shaped setItem calls.

Validation:

• cargo test -q -p sessionscope-detectors client_storage — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in review-fix commit b1ddd2a.

Summary:

• Added shared/report-level browser storage setItem redaction for token-shaped keys, including short template-literal token values.

Validation:

• cargo test -q -p sessionscope-detectors client_storage — passed
• cargo test -q -p sessionscope-core redacts_browser_storage_token_values — passed
• cargo test -q -p sessionscope-reporters render_sanitizes_browser_storage_token_values — passed

Notes / follow-ups:

• None.

[bjcorder]

Implemented in PR #98: #98

Implementation commits:

• 79eb8db — P3.6 client_storage detector registration
• 867fd6d — Narrow client storage URL token evidence
• 4814668 — Review fix: storage redaction
• a69a59f — Review fix: template literal storage redaction
• b1ddd2a — Report-level browser storage redaction

Validation:

• cargo fmt --all -- --check — passed
• cargo check --workspace — passed
• cargo test -q — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None.