Best possible solution:

Land this PR or an equivalent maintainer-approved central append-layer redaction fix after resolving mergeability and accepting the additive SDK contract change, while preserving the source contributor credit from #73563.

Do we have a high-confidence way to reproduce the issue?

Yes, by source inspection: current main redacts the persisted JSONL entry but inline session, gateway, and Telegram transcript update paths still emit the original payload. I did not execute a live repro in this read-only review.

Is this the best way to solve the issue?

Yes, with maintainer acceptance: centralizing redaction at the append sink and returning the appended redacted message is the narrow maintainable fix. The remaining judgment is the public SDK return/config type change and branch mergeability, not a clear code defect in the latest head.

Acceptance criteria:

• pnpm check:changed
• pnpm test src/config/sessions/transcript-append-redact.test.ts src/agents/transcript-redact.test.ts src/config/sessions/transcript.test.ts extensions/telegram/src/bot-message-dispatch.test.ts src/gateway/server-methods/chat.inject.parentid.test.ts
• pnpm plugin-sdk:api:check

What I checked:

• Current main append sink persists a redacted message but returns no sanitized payload: On current main, appendSessionTranscriptMessage writes message: redactSecrets(params.message) to the JSONL entry and returns only { messageId }, so downstream inline emitters cannot reuse the sanitized value from this sink. (src/config/sessions/transcript-append.ts:294, aa9799320d65)
• Current main inline session update uses the original message: appendExactAssistantMessageToSessionTranscript appends through the redacting sink, then emits the original message object in inline transcript updates. (src/config/sessions/transcript.ts:316, aa9799320d65)
• Current main Telegram and gateway mirrors also emit original payloads: The Telegram mirror and gateway transcript injection helper call appendSessionTranscriptMessage, then emit or return the original message/messageBody instead of the persisted redacted value. (extensions/telegram/src/bot-message-dispatch.ts:340, aa9799320d65)
• PR head returns the redacted appended message and preserves broad fallback redaction: At PR head a6d8a21, appendSessionTranscriptMessage computes finalMessage with redactTranscriptMessage for AgentMessage-like payloads and redactSecrets for non-role payloads, writes finalMessage, and returns it with messageId. (src/config/sessions/transcript-append.ts:298, a6d8a214745e)
• PR head routes inline emitters through the appended redacted message: At PR head, session transcript, Telegram, and gateway injection paths destructure message: appendedMessage and emit or return that value instead of the original payload. (src/gateway/server-methods/chat-transcript-inject.ts:106, a6d8a214745e)
• Prior review finding is addressed in latest head: The latest head includes tests for raw string payloads, structured no-role payloads, custom patterns without dropping defaults, redacted inline events, and delivery-mirror dedupe against redacted/legacy transcript text. (src/config/sessions/transcript-append-redact.test.ts:101, a6d8a214745e)

Likely related people:

• steipete: Recent current-main commits changed transcript append, session write-lock, and gateway transcript IO behavior on the central files this PR modifies. (role: recent area contributor; confidence: high; commits: 3f6b481464bf, f7ed29e11812, 6147e1b91d3e; files: src/config/sessions/transcript-append.ts, src/config/sessions/transcript.ts, src/gateway/server-methods/chat-transcript-inject.ts)
• vincentkoc: Current-main history shows work on persisted transcript redaction and gateway transcript hot paths that overlap the redaction and transcript-event surfaces reviewed here. (role: redaction and gateway adjacent contributor; confidence: medium; commits: 406ae72fd278, ec59af33863a; files: src/agents/session-tool-result-guard-wrapper.ts, src/gateway/server-methods/chat-transcript-inject.ts)
• pgondhi987: Recent current-main commit changed persisted secret-shaped payload redaction in the transcript append/logging area, directly adjacent to this PR's sink-level redaction work. (role: recent transcript redaction contributor; confidence: medium; commits: 17ceca86d698; files: src/config/sessions/transcript-append.ts, src/logging/redact.ts)
• jalehman: Recent current-main Telegram dispatcher work touches the same Telegram file that this PR updates for transcript mirror emission. (role: recent Telegram adjacent contributor; confidence: medium; commits: 24ffd4d2f851; files: extensions/telegram/src/bot-message-dispatch.ts)
• hxy91819: The PR discussion shows this person closed the noisy replacement attempt, reopened this PR, assigned it, and documented the SDK compatibility judgment needed before landing. (role: current PR reviewer and assignee; confidence: high; commits: 09830824b742, e4dfa98c1f22, a6d8a214745e; files: src/config/sessions/transcript-append.ts, src/agents/transcript-redact.ts, docs/.generated/plugin-sdk-api-baseline.sha256)

Remaining risk / open question:

• The provided PR state reports mergeable=false, so landing may still require rebase or conflict resolution before checks can gate the exact head.
• The Plugin SDK API baseline change is intentional and likely additive, but it still needs maintainer acceptance because appendSessionTranscriptMessage is exported through the SDK runtime surface.
• This read-only review did not run the PR's validation commands; it is based on source, tests, PR context, and current-main inspection.

Codex review notes: model gpt-5.5, reasoning high; reviewed against aa9799320d65.