fix(agent): redact tool-call args in compaction transcript#4350
Conversation
Fixes esengine#4317 renderTranscript dumps full tool-call arguments (including sub-agent task prompts) into the text sent to the summarizer. The summarizer may reproduce these arguments verbatim in its output, which then gets inserted as a role:user message in the session. This leaked text looks like user input and can corrupt the message structure sent to the API. Fix: replace raw arguments with a short summary (key names + count) so the summarizer knows what tools were called but can't reproduce the full argument text.
|
What this fix does When the session grows too large, the app compacts old messages into a summary. During compaction, renderTranscript converts old messages to text and sends them to a summarizer AI. The problem: it was dumping the full JSON arguments of every tool call into that text. For sub-agent calls (task, research, explore), this includes the entire task prompt — sometimes thousands of characters. The summarizer AI would then reproduce that prompt text in its summary. The summary gets saved as a role:user message. So now there's a message in your conversation that looks like you typed a long English paragraph about searching for GitHub projects — but you didn't. What's redacted: The prompt the AI sent to the sub-agent (tool-call arguments) The summarizer still sees what the sub-agent found. It just can't reproduce the original task prompt. |
Closes #4317
Problem
Sub-agent task arguments leak into the user-visible conversation after compaction. The summarizer reproduces raw tool-call arguments (like task prompts) in its output, which gets inserted as a role:user message. This corrupts the session and causes HTTP 400 errors on subsequent API calls.
Root Cause
renderTranscript (compact.go:577) dumps full tool-call JSON arguments into the text sent to the summarizer. The summarizer may reproduce these arguments verbatim in its summary.
Fix
Replace raw arguments with a short summary (key names + count) via summarizeToolArgs. The summarizer knows what tools were called but can't reproduce the full argument text.
Files Changed
Verification