fix(runtime): redact a Deep Research artifact before paging it

[Totoro-qaq]

Summary

deep_research_read_artifact picked the offset_chars window from the raw artifact and only then redacted that window. A credential split by a page boundary matched no pattern in either page, so two consecutive reads joined back into the value a whole read hides. A JSON artifact larger than one read never parsed as a document, so key-based JSON redaction did not apply to its pages either.

• The read redacts the whole artifact once, after the ledger hash check, and pages over the redacted text. offset, end and total count that text. The offset_chars description now says so and tells the model to continue from the previous end.
• offset_chars is no longer capped at the stored length (512,000). Redaction can make the text longer, and the tail of such an artifact could otherwise not be reached.
• JSON redaction now also covers object keys. Before, pages of a large JSON artifact went through text redaction, which hid token-shaped keys. A whole-document read would leave them visible.
• Artifacts without secrets page exactly as before. Status and other model-facing Deep Research text already redact whole fields.

Depends on #5434. Redacting a whole 512,000-character artifact needs the linear assignment scan from that PR. On main, a 512,000-character hyphenated run takes minutes; with both changes it takes a few milliseconds. Please merge #5434 first.

Fixes #5432

Verification

• New runtime tests:
  • a fake secret across the default 32,000 boundary;
  • every split point for seven fake secret shapes;
  • max_chars: 1 reads;
  • a pretty-printed JSON artifact read whole and split at every point;
  • forged envelope tags split across pages;
  • an artifact whose redacted text is longer than the stored text, read to its end;
  • artifacts without secrets keep their offsets.
• New core test: object-key redaction.
• The secret tests failed before the fix. Each of these mutations fails a test:
  • slicing before redacting;
  • redacting per line;
  • stripping tags per page;
  • dropping key redaction;
  • restoring the offset_chars cap.
• On this branch: Deep Research tools 11/11, core redaction 29/29. @maka/runtime test:dist passed (3,527 passed, 14 skipped) before the assignment-regex part moved to fix(core): redact a secret assignment nested in a harmless assignment's value #5434. The runtime-host tests that load redaction pass 314/314.
• Checked with fix(core): redact a secret assignment nested in a harmless assignment's value #5434 cherry-picked onto this branch:
  • core 852/852 and Deep Research tools 11/11;
  • whole-artifact redaction of 512,000-character pathological inputs in 2–6 ms.
• Runtime and core typecheck, biome lint and format, git diff --check and the Windows test inventory pass.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code helped investigate, implement and test this change. The commit carries a Generated-by: Claude Code trailer.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

Summary

The ordering fix is right, and the invariants it claims hold up under inspection: the read now redacts the whole stored body once (packages/runtime/src/deep-research-tools.ts:233) before selecting the window (:236-241), the SHA-256 ledger check still runs on the raw bytes ahead of it (:225-227), and offset/end/total are all derived from the exact string that gets emitted — so consecutive pages cannot reassemble a token that a whole read hides. Dropping .max(DEEP_RESEARCH_ARTIFACT_CONTENT_MAX_CHARS) from offset_chars (:192-197) is required, because redaction can lengthen the text; the "reaches the end of a redacted artifact…" test demonstrates a total beyond the stored length.

What I verified:

• No other model-facing path emits an artifact body: validateArtifactIntegrity only hashes (:874-887), and status/name/locator/summary go through normalizeInlineText (:925-930); save, checkpoint and complete echo no bodies.
• Tag stripping now runs on the whole body instead of per window, so a forged envelope split by a page boundary can no longer leave a <deep-research-artifact fragment in one page and …> in the next (deep-research-tools.test.ts:619-668).
• Coverage for the reported bug is thorough: every split point for seven secret shapes, max_chars: 1, forged tags across pages, redacted-longer-than-stored, secret-free artifacts keeping their offsets, and a core test for key redaction.
• I did not execute the suites (they need #5434, which is not on main). The checks below are from the diff plus a standalone run of redactSecrets / the current safeResearchArtifactContent body against synthetic inputs.

Findings

1. Redaction still runs before forged-tag stripping, so a secret split by a forged tag is rejoined after redaction

safeResearchArtifactContent (packages/runtime/src/deep-research-tools.ts:932-936) redacts first and strips </?deep-research-(?:workspace|artifact)…> second. A token that straddles such a tag matches no pattern while redaction runs, and the strip step then glues the halves back together:

input : ghp_FAKE<deep-research-artifact id="dr-x" role="source">tokFAKEtokFAKEtokFAKE evidence
output: ghp_FAKEtokFAKEtokFAKEtokFAKE evidence      ← matches /ghp_[0-9A-Za-z_]{20,}/

(Reproduced with packages/core/src/redaction.ts plus the helper as written on this branch.)

This is pre-existing rather than a regression, but it is the same "reassemble after redaction" invariant this PR establishes — with tag stripping as the join instead of a page boundary — and this read is the one place artifact bodies reach the model. Stripping the tags first and redacting afterwards (or redacting again after stripping) closes it; the order is otherwise unobservable, since redactSecrets never emits these tags.

No test pins it: 'strips forged workspace and artifact envelopes from persisted artifact content' (deep-research-tools.test.ts:619-668) asserts only that the tags themselves do not survive a split, not that a secret straddling one stays hidden. A fixture such as ghp_FAKE<deep-research-artifact id="dr-x">tokFAKEtokFAKEtokFAKE read whole and split at every point would cover both orderings.

nits

1. <deep-research-artifact id="a>b" role="source"> leaves b" role="source"> in the body, because [^>]{0,4096} stops at the first > (:934). Pre-existing and cosmetic, but it is the same line finding 1 touches.
2. Whole-document JSON redaction re-serializes through JSON.stringify (packages/core/src/redaction.ts:127), so any secret now collapses a pretty-printed artifact to one line; before this change, pages (invalid JSON slices) took the text path and kept their indentation. Line numbers a resumed model may cite therefore shift for multi-page JSON reads, and the JSON test only asserts JSON.parse(...) deep-equality (deep-research-tools.test.ts:734-766), so nothing pins the emitted shape.
3. Object-key redaction collapses distinct keys that redact to the same text (packages/core/src/redaction.ts:154-167): for {"ghp_AAA…": "public", "ghp_BBB…": "private"} the later entry overwrites the earlier, so a value can be presented under a key it never had. The comment covers the collapse but not the value mis-association; fine to keep if that is the intent.
4. offset_chars is now unbounded (:192-197) while end stays Math.min(total, offset + maxChars) (:240), so offset > total yields an inverted envelope (offset="1000000000" end="97" total="97"), an empty body and Truncated: false. Pre-existing logic, but clamping offset to total — or rejecting it — is a one-liner now that the cap is gone.

Merge-order note

Every read redacts up to 512,000 characters and paging re-redacts per call, so this branch is only fast with #5434's linear assignment scan. Worth keeping that as an enforced dependency (as the PR body states) rather than relying on PR text alone, since nothing in the code guards the slow path.

[Totoro-qaq]

Thanks. Changes in 8f56c15:

• Finding 1: safeResearchArtifactContent and normalizeInlineText, which had the same order, now share redactUntilNormalized.
  • It redacts, then strips tags (and collapses whitespace for inline text), and repeats until stripping changes nothing. Redaction therefore always runs after the last strip.
  • Your fixture now reads [redacted] whole and at every split.
  • Redacting a JSON document can turn a \u003c escape into a literal <, and the loop covers that too.
  • Text still unsettled after four passes (three or more levels of nested tag fragments) is withheld as [withheld: nested forged envelope tags] rather than trimmed. Dropping characters there can glue a word onto a rejoined token and hide it from the \b patterns.
• Nit 4: an offset past the end now reports offset = end = total, an empty body and Truncated: false.
• Nit 3: the comment now says colliding keys keep only the last value. Behavior is unchanged.
• Nit 1: the text left after stripping <deep-research-artifact id="a> contains no <, so it is plain text, not a tag.
• Nit 2: this is inherent to whole-document JSON redaction. Once redaction changes the parsed document, it re-serializes it, and offset/end/total count that text, so pages stay consistent. Core tests already pin the compact form, for example /"authorization":"\[redacted\]"/.