Summary
The opt-in next-action suggestion transcript redactor can leave the suffix of a labelled credential in model input when the credential is enclosed in quotes and contains spaces or punctuation.
The existing matcher recognizes optional quote delimiters, but still stops the value at whitespace, commas, semicolons, or }. Those characters are legal inside a quoted value. The complete quoted value should be redacted while adjacent ordinary text remains intact.
Reproduction
Base: OpenPI f6b49ae (0.8.1), Node 22.22.3 on Windows. All values below are synthetic.
- Pass a normal
read tool-result SessionEntry containing password="north south" next=visible to serializeRunTranscript from extensions/suggestions/src/transcript.ts.
- Observe the serialized tool-result text.
- Repeat with
{"secret":"north,south;east}west","ordinary":"visible"} or token='north south;east,west}' next=visible.
Expected for the first case: password=[REDACTED] next=visible.
Actual: password=[REDACTED] south" next=visible.
The same truncation occurs with escaped quote characters and backslashes. Five focused serializer regressions fail on the base revision.
Impact and scope
When suggestions are explicitly enabled, the serialized run is passed to the configured suggestion model. This can retain fragments that the existing labelled-credential redaction was intended to remove. No real credentials, provider calls, or actual disclosure were used or observed in this reproduction.
The proposed fix is limited to correctly consuming complete quoted values in the existing best-effort redactor. It does not add new secret-detection policy, guarantee removal of arbitrary unlabelled secrets, change suggestion configuration, or rewrite Session history.
Summary
The opt-in next-action suggestion transcript redactor can leave the suffix of a labelled credential in model input when the credential is enclosed in quotes and contains spaces or punctuation.
The existing matcher recognizes optional quote delimiters, but still stops the value at whitespace, commas, semicolons, or
}. Those characters are legal inside a quoted value. The complete quoted value should be redacted while adjacent ordinary text remains intact.Reproduction
Base: OpenPI f6b49ae (
0.8.1), Node 22.22.3 on Windows. All values below are synthetic.readtool-result SessionEntry containingpassword="north south" next=visibletoserializeRunTranscriptfromextensions/suggestions/src/transcript.ts.{"secret":"north,south;east}west","ordinary":"visible"}ortoken='north south;east,west}' next=visible.Expected for the first case:
password=[REDACTED] next=visible.Actual:
password=[REDACTED] south" next=visible.The same truncation occurs with escaped quote characters and backslashes. Five focused serializer regressions fail on the base revision.
Impact and scope
When suggestions are explicitly enabled, the serialized run is passed to the configured suggestion model. This can retain fragments that the existing labelled-credential redaction was intended to remove. No real credentials, provider calls, or actual disclosure were used or observed in this reproduction.
The proposed fix is limited to correctly consuming complete quoted values in the existing best-effort redactor. It does not add new secret-detection policy, guarantee removal of arbitrary unlabelled secrets, change suggestion configuration, or rewrite Session history.