Compaction secret redaction matches argument names, not values
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
- Domain
- security
Research direction
Read .github/meta/harness-review-followups.md and packages/opencode/src/session/compaction.ts:62-75, starting with isSensitiveArgName and the compaction ledger flow. Trace how arguments enter synthetic prompts after tool output pruning. Done means sensitive values in URLs or free text are protected through allowlisted metadata and value-level detection, rather than argument-name matching alone.
Written by the indexing model from the issue text.
Description
Deferred from the v0.10.0 release review. Self-disclosed in .github/meta/harness-review-followups.md.
Compaction redacts sensitive tool arguments by argument name (isSensitiveArgName, packages/opencode/src/session/compaction.ts:62-75). A secret that appears in a value rather than a recognisably-named argument — inside a URL, or in free text — is not matched.
Because the compaction ledger is replayed into later synthetic prompts, an unmatched secret can be re-sent after the tool output it came from has been pruned.
Name-based matching cannot close this. It needs allowlisted metadata plus value-level secret detection.
- Dominant language
- TypeScript
- Stars
- 813
- Forks
- 134
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 62
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from AltimateAI/altimate-code
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
AltimateAI/altimate-code#1323 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
AltimateAI/altimate-code#1288 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
AltimateAI/altimate-code#1285 ·
-
privacy: Altimate Base consent dialog no longer discloses persistent per-installation identifier Open
Difficulty 1/5 Under an hour Newbie friendliness 88/100
AltimateAI/altimate-code#1284 ·
-
Difficulty 2/5 Under an hour Newbie friendliness 72/100
AltimateAI/altimate-code#1283 ·
All issues in AltimateAI/altimate-code
Similar issues
-
Browser Waiting for: Product Owner
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
getsentry/sentry-javascript#24577 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
agilepathway/label-checker#640 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
copse-dev/agent-pane#2953 ·
-
agentic-workflows
Difficulty 1/5 Under an hour Newbie friendliness 85/100
githubnext/rig#534 ·
-
automation missing-model model-sync provider:pioneer
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
anomalyco/models.dev#7701 ·