Description

resolveEmbeddedCompactionTarget() attempts to drop authProfileId only when a config override switches providers, but it compares the override provider against the raw caller-supplied params.provider.

This creates a credential-confusion edge case:

• If the caller omits provider (or passes whitespace) but does supply an authProfileId intended for the runtime’s default provider, and
• agents.defaults.compaction.model is configured as "<overrideProvider>/<model>" where overrideProvider equals the effective default provider,

then authProfileId is dropped even though the effective provider did not change. Downstream, getApiKeyForModel({ profileId: authProfileId }) is called with profileId: undefined, causing the auth resolver to fall back to other profiles / env keys / provider keys.

Impact depends on deployment, but can include:

• Using a more privileged/global API key instead of the intended per-session/per-tenant authProfileId
• Sending compaction requests under the wrong account (cross-tenant credential mix-up)

Vulnerable code:

const authProfileId =
  overrideProvider !== (params.provider ?? "")?.trim()
    ? undefined
    : (params.authProfileId ?? undefined);

This logic is also used via buildEmbeddedCompactionRuntimeContext(), which currently calls resolveEmbeddedCompactionTarget() without passing defaultProvider/defaultModel, increasing the odds that params.provider is unset while the runtime still has defaults elsewhere.

Recommendation

Compare against the effective provider (after applying defaults), not the raw caller input, and ensure defaults are consistently passed.

For example:

export function resolveEmbeddedCompactionTarget(params: {
  ​// ...
  defaultProvider?: string;
  defaultModel?: string;
}) {
  const effectiveProvider = params.provider?.trim() || params.defaultProvider;
  const effectiveModel = params.modelId?.trim() || params.defaultModel;

  const override = params.config?.agents?.defaults?.compaction?.model?.trim();
  if (!override) return { provider: effectiveProvider, model: effectiveModel, authProfileId: params.authProfileId ?? undefined };

  const slashIdx = override.indexOf("/");
  if (slashIdx > 0) {
    const overrideProvider = override.slice(0, slashIdx).trim();
    const overrideModel = override.slice(slashIdx + 1).trim() || params.defaultModel;

    const authProfileId =
      overrideProvider !== (effectiveProvider ?? "")
        ? undefined
        : (params.authProfileId ?? undefined);

    return { provider: overrideProvider, model: overrideModel, authProfileId };
  }

  return { provider: effectiveProvider, model: override, authProfileId: params.authProfileId ?? undefined };
}

Also update buildEmbeddedCompactionRuntimeContext() to pass defaultProvider/defaultModel when available (or ensure callers always pass provider when passing authProfileId).

Description

The embedded Pi compaction path allows config.agents.defaults.compaction.model to override both the model and the provider used for compaction. Because compaction processes/transmits conversation history for summarization, an attacker (or untrusted workspace/user config) that can influence this config value can redirect sensitive transcript content to a different third-party provider, bypassing enterprise/provider allowlists, data residency requirements, or other governance controls.

Key points:

• Input: config.agents.defaults.compaction.model (string) is taken from config and parsed as either provider/model or model.
• No validation/allowlist is applied to the provider name or model id.
• Sink: the resolved provider and modelId are used to resolveModelAsync(provider, modelId, ...) and then run compaction (which summarizes transcript/history).

Vulnerable code (provider/model override parsing):

const override = params.config?.agents?.defaults?.compaction?.model?.trim();
...
if (slashIdx > 0) {
  const overrideProvider = override.slice(0, slashIdx).trim();
  const overrideModel = override.slice(slashIdx + 1).trim() || params.defaultModel;
  ...
  return { provider: overrideProvider, model: overrideModel, authProfileId };
}

Vulnerable code (override used to select runtime provider/model for compaction):

const resolvedCompactionTarget = resolveEmbeddedCompactionTarget({ config: params.config, ... });
const provider = resolvedCompactionTarget.provider ?? DEFAULT_PROVIDER;
const modelId = resolvedCompactionTarget.model ?? DEFAULT_MODEL;
const { model } = await resolveModelAsync(provider, modelId, agentDir, params.config);

Recommendation

Treat agents.defaults.compaction.model as a restricted setting:

• Enforce an explicit allowlist of permitted compaction providers/models (ideally separate from the primary chat model allowlist), and reject/ignore overrides outside the allowlist.
• Consider splitting config into provider and model fields with schema-level validation rather than ad-hoc string parsing.
• If multi-tenant/untrusted workspace config is possible, prevent workspace/project-level settings from changing provider/model used for compaction.

Example (conceptual) validation/allowlist:

const allowed = new Set(["openai/gpt-4o", "anthropic/claude-sonnet-4-5"]);
const requested = `${provider}/${modelId}`;
if (!allowed.has(requested)) {
  throw new Error(`Compaction model not allowed: ${requested}`);
}

Description

compactEmbeddedPiSession() builds a runtimeContext object by spreading all caller-supplied params (including config, workspaceDir, skillsSnapshot, owner identifiers, prompts, etc.) and passes it to the pluggable contextEngine.compact() and runContextEngineMaintenance().

Because context engines can be registered via the public SDK (registerContextEngine() is explicitly for third-party registrations), any non-core or externally supplied ContextEngine implementation will receive this runtime context. This can lead to unintended disclosure of sensitive information such as:

• internal filesystem paths (workspaceDir, agentDir, sessionFile)
• identifiers / PII (senderId, ownerNumbers, channel/thread ids)
• full runtime configuration (config) which may contain secrets or security-relevant settings
• prompt content (extraSystemPrompt, customInstructions)

Vulnerable code (from changed lines):

const runtimeContext = {
  ...params,
  ...buildEmbeddedCompactionRuntimeContext({
    ​// ...
    config: params.config,
    skillsSnapshot: params.skillsSnapshot,
    extraSystemPrompt: params.extraSystemPrompt,
    ownerNumbers: params.ownerNumbers,
  }),
};

const result = await contextEngine.compact({
  ​// ...
  runtimeContext,
});

Even if most engines are trusted, this design makes it easy for a third-party engine (or a compromised plugin dependency) to exfiltrate sensitive configuration and user metadata.

Recommendation

Do not pass the full params object to third-party ContextEngines. Instead, whitelist and/or redact fields before handing off to plugin implementations.

Suggested fix (use a minimal allowlisted schema and avoid passing full config):

​// Only expose what engines actually need
const runtimeContext = buildEmbeddedCompactionRuntimeContext({
  sessionKey: params.sessionKey,
  messageChannel: params.messageChannel,
  messageProvider: params.messageProvider,
  agentAccountId: params.agentAccountId,
  currentChannelId: params.currentChannelId,
  currentThreadTs: params.currentThreadTs,
  currentMessageId: params.currentMessageId,
  ​// consider omitting authProfileId/config/ownerNumbers unless strictly needed
  workspaceDir: resolveUserPath(params.workspaceDir),
  agentDir,
  senderIsOwner: params.senderIsOwner,
  senderId: params.senderId,
  provider: params.provider,
  modelId: params.model,
});

await contextEngine.compact({ ... , runtimeContext });

If engines need configuration, pass a redacted snapshot (e.g., remove secrets/tokens/passwords and any auth-profile material), and document the contract so plugin authors cannot rely on hidden fields from params.