fix(checkpoint): redact task.json's task_description at the writer - #2129
Open
peyton-alt wants to merge 1 commit into
Open
fix(checkpoint): redact task.json's task_description at the writer#2129peyton-alt wants to merge 1 commit into
peyton-alt wants to merge 1 commit into
Conversation
The subagent transcript written beside it goes through sanitize → externalize → redact in condensation, but the task record's free-text description — the agent's own wording for the Task call, which can carry whatever the prompt carried — was copied into task.json verbatim and pushed with the checkpoint. Run it through the same redactor as the summary fields in writeTaskRecordEntry, which covers both persistent backends. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Entire-Checkpoint: 01M0Y3J4ZGY5N4ZWWVKV1M76XB
Contributor
There was a problem hiding this comment.
Pull request overview
This PR closes a privacy gap in checkpoint persistence by ensuring subagent task metadata (tasks/<tool-use-id>/task.json) does not store raw free-text task descriptions, aligning it with the existing redaction behavior applied to other persisted summary text.
Changes:
- Redact
TaskPayload.TaskDescriptionat the persistent checkpoint writer usingredact.Stringbefore writingtask.json. - Add a unit test asserting an AWS-key-shaped secret in
task_descriptionis not persisted verbatim. - Update docs/comments to clarify that
task_descriptionis redacted at write time.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| docs/architecture/sessions-and-checkpoints.md | Documents that tasks/<tool-use-id>/task.json has its description redacted at write time. |
| cmd/entire/cli/checkpoint/persistent.go | Applies redact.String to TaskDescription when materializing task.json. |
| cmd/entire/cli/checkpoint/checkpoint_test.go | Adds coverage verifying task_description is redacted in persisted task.json. |
| CLAUDE.md | Updates architecture notes to reflect writer-owned redaction of task_description. |
| api/checkpoint/metadata.go | Clarifies in the TaskPayload comment that redaction is performed by the writer. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+4616
to
+4621
| func TestWriteCommitted_TaskDescriptionRedacted(t *testing.T) { | ||
| t.Parallel() | ||
| repo, _ := setupBranchTestRepo(t) | ||
| store := NewGitStore(repo, DefaultV1Refs()) | ||
| checkpointID := id.MustCheckpointID("aabbccddeefc") | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://entire.io/gh/entireio/cli/trails/1145
Summary
Subagent task records are materialized into the parent session's checkpoint as
tasks/<tool_use_id>/{task.json, agent-<agent_id>.jsonl}. The transcript goes through sanitize → externalize → redact in condensation, buttask.json'stask_description— the agent's free text for the Task call — was copied verbatim and pushed with the checkpoint.writeTaskRecordEntrynow runs the description throughredact.String, the same redactor the checkpoint summary fields use, covering both persistent backends.TestWriteCommitted_TaskDescriptionRedactedwrites a description carrying a low-entropy AWS-key-shaped secret and readstask.jsonback.TaskPayloadcomment,sessions-and-checkpoints.md,CLAUDE.md.Found while wiring the subagent read path in entirehq/entire-api#859, which redacts descriptions at read time as a stopgap for already-committed checkpoints.
Verification
mise run lint,go test ./cmd/entire/cli/checkpoint/ ./cmd/entire/cli/strategy/ ./api/...,mise run test:integration(530 passed, 3 skipped)🤖 Generated with Claude Code
Note
Low Risk
Narrow write-path privacy fix using the existing redaction pipeline; no auth or checkpoint format changes beyond safer persisted metadata.
Overview
Subagent checkpoints now redact free-text
task_descriptionintasks/<tool_use_id>/task.jsonwhen materializing task records, matching how checkpoint summary fields are handled. Subagent transcripts were already sanitized and redacted in condensation; the Task prompt text was previously copied verbatim into the pushed checkpoint.writeTaskRecordEntryin the persistent checkpoint writer runsredact.StringonTaskDescriptionbefore marshalingtask.json. Callers still pass the description as recorded onTaskPayload; redaction is owned by the writer.TestWriteCommitted_TaskDescriptionRedactedasserts an AWS-key-shaped secret in the description is replaced in place while other metadata stays intact. Comments inapi/checkpoint/metadata.go,docs/architecture/sessions-and-checkpoints.md, andCLAUDE.mddocument the behavior.Reviewed by Cursor Bugbot for commit d072aea. Configure here.