Description
While implementing #6306 (redact MessagePart::Image base64 bytes from debug dumps), the reviewer flagged a related but out-of-scope residual leak vector: dump_tool_output in crates/zeph-core/src/debug_dump/mod.rs writes raw tool output text to the debug dump file unredacted. A vision tool (e.g. a screenshot tool) returning base64-encoded image bytes as its text output would still leak the full bytes to disk, since the redaction added in #6306 only covers MessagePart::Image in outbound LLM requests, not arbitrary tool-result text content.
This is the same category as the already-noted dump_response out-of-scope call from #6306's review — text-based dump paths that aren't covered by the request-focused image redaction.
Reproduction Steps
- Enable debug dumps (
[debug] enabled = true).
- Invoke a tool that returns base64-encoded image bytes as plain text output (e.g. a screenshot/vision tool without a typed
MessagePart::Image wrapper).
- Inspect the debug dump file — expect the raw base64 tool-output text present unredacted.
Expected Behavior
Tool output text that looks like base64-encoded binary data (heuristically, e.g. long high-entropy strings, or explicitly-known binary-returning tools) should be redacted or truncated in debug dumps, consistent with the image redaction added in #6306 — or, at minimum, the scope limitation should be explicitly documented so operators don't assume full redaction coverage.
Actual Behavior
dump_tool_output serializes raw tool output text verbatim with no redaction.
Environment
Related
Suggested next step
Triage: assess whether a heuristic (entropy/length-based) or an explicit per-tool allowlist of binary-returning tools is the right redaction trigger for dump_tool_output, given false-positive/false-negative tradeoffs already discussed in #6306's review.
Description
While implementing #6306 (redact
MessagePart::Imagebase64 bytes from debug dumps), the reviewer flagged a related but out-of-scope residual leak vector:dump_tool_outputincrates/zeph-core/src/debug_dump/mod.rswrites raw tool output text to the debug dump file unredacted. A vision tool (e.g. a screenshot tool) returning base64-encoded image bytes as its text output would still leak the full bytes to disk, since the redaction added in #6306 only coversMessagePart::Imagein outbound LLM requests, not arbitrary tool-result text content.This is the same category as the already-noted
dump_responseout-of-scope call from #6306's review — text-based dump paths that aren't covered by the request-focused image redaction.Reproduction Steps
[debug] enabled = true).MessagePart::Imagewrapper).Expected Behavior
Tool output text that looks like base64-encoded binary data (heuristically, e.g. long high-entropy strings, or explicitly-known binary-returning tools) should be redacted or truncated in debug dumps, consistent with the image redaction added in #6306 — or, at minimum, the scope limitation should be explicitly documented so operators don't assume full redaction coverage.
Actual Behavior
dump_tool_outputserializes raw tool output text verbatim with no redaction.Environment
zeph-coreRelated
Suggested next step
Triage: assess whether a heuristic (entropy/length-based) or an explicit per-tool allowlist of binary-returning tools is the right redaction trigger for
dump_tool_output, given false-positive/false-negative tradeoffs already discussed in #6306's review.