fix(cu): redact an observation id on the same terms as the fields beside it - #2044

hqhq1025 · 2026-08-03T17:05:11Z

computerUseModelCallArgs put observation_id through stableIdentifier and
stopped there. Every identifier beside it goes on through redactSecrets, and
so does observation_id in the sibling projection computerUseApprovalSummary
— the two disagreed, and the model-facing one was the permissive side.

The consequence, measured through the real ToolRuntime seam before the fix:

argument	value sent	persisted
`element_id`	`sk-ant-api03-…`	`[redacted]`
`app`	`sk-ant-api03-…`	`[redacted]`
`observation_id`	`sk-ant-api03-…`	`sk-ant-api03-AbCdEfGh…`

That value lands in the persisted tool_call, on the tool_start event, and in
the model's own replayed history. Arguments are not validated before this
projection runs, so a model can put anything under that key.

Why this was left alone when it was found: the model quotes the observation id
back on its next call, so rewriting it could break the observe-then-act loop,
and redactSecrets matches runs of 40-plus hex among other shapes. That turns
out not to apply. The executor mints these with randomUUID, and a UUID has no
such run, so it passes through untouched:

原样  3f2b1c9e-4a5d-6e7f-8091-a2b3c4d5e6f7
脱敏  sk-ant-api03-AbCdEfGhIjKlMnOpQrStUvWxYz0123456
脱敏  ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789

Anything this rewrites was never an id the host handed out, so nothing the model
needs is lost.

The test pins both directions, and I checked it can fail: reverting the one-line
change reddens it alone.

✖ a secret-shaped observation id is redacted, and a real one is not

Restored: @maka/core 754 pass / 0 fail.

Closes #2042.

…ide it computerUseModelCallArgs put observation_id through stableIdentifier and stopped there, so a secret-shaped value under that key reached the persisted tool_call, the tool_start event and the model's replayed history verbatim, while the same string under app or element_id was redacted. The sibling projection computerUseApprovalSummary already redacted it; the two disagreed. Redacting it looked unsafe because the model quotes the id back on its next call, so rewriting it could break the observe-then-act loop. It cannot: the executor mints these with randomUUID, and a UUID carries no run of 40-plus hex characters, so redactSecrets leaves it alone. Measured: the minted shape passes through unchanged, an API-key shape does not. Anything rewritten here was never an id this host handed out. Closes apache#2042.

hqhq1025 merged commit 34f4d8a into apache:main Aug 3, 2026
10 checks passed

Navigation Menu

Uh oh!

fix(cu): redact an observation id on the same terms as the fields beside it - #2044