VS Code remembers the commands you hid with a space
VS Code's Run Recent Command list, in a new window on my laptop. Note the space before export . The token's a fake. The top four were typed on a different machine. I'd opened a Debian server with Remote-SSH and put a space in front of the export, so the server's bash would skip it, and it did. The server's ~/.bash_history has cd /var/log , ls -lh and uptime , and no token. My laptop has it, and…
When you paste a command with a space in front in VS Code's terminal, the space trick prevents it from being saved in the shell's history. However, VS Code keeps its own list of recent commands. This list is injected into bash and zsh by a shell integration script, which runs with each command and adds it to the list of the last 100 commands.
This list is stored in a SQLite file located in the user folder of VS Code, and it is also saved for each local terminal session for later restoration. The command list does not include information about the machine where the command was executed, so with Remote-SSH, the command is saved on your laptop along with the hidden one.
The VS Code extension for Cursor and Windsurf, which are built on VS Code, have a similar list in their own user folders. To remove an entry from the command list, there is a clear command, but it does not delete the entry from the disk. The scrollback history is also saved separately, and it is not affected by the clear command.
To prevent the list from accumulating tokens and other sensitive information, it is recommended to disable terminal history and avoid entering sensitive data in the terminal.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
