{"record":{"id":"1a873621f81edc09","repo":"paperclipai/paperclip","slug":"public-replay-contains-private-provider-metadata","errorCode":null,"errorMessage":"Public replay contains private provider metadata","messagePattern":"Public replay contains private provider metadata","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/paperclip-runner/scripts/public-eval-viewer.mjs","lineNumber":106,"sourceCode":"      Array.isArray(value) ||\n      Object.keys(value).some((key) => !names.split(\" \").includes(key))\n    )\n      throw new Error(\"Unknown public chat projection field\");\n  };\n  fields(payload.publication, \"schema notice\");\n  fields(payload.navigation, \"suiteHref previous next\");\n  for (const link of [payload.navigation.previous, payload.navigation.next])\n    if (link !== null) fields(link, \"label href\");\n  fields(\n    payload.run,\n    \"model provider driver providerVersion runnerProvider acpxAgent acpxProfile requestedModel effectiveModelHistory configuration sessionId providerSessionId agentVersion managedProfile retainedSession retainedSessionStatus fixtureDigest runnerPackageDigest runnerdDigest startedAt finishedAt durationMs runnerBuild initialRevision finalRevision usage\",\n  );\n  if (\n    payload.run.effectiveModelHistory?.length ||\n    payload.run.managedProfile != null ||\n    payload.run.acpxProfile != null\n  )\n    throw new Error(\"Public replay contains private provider metadata\");\n  if (payload.run.usage !== null)\n    fields(\n      payload.run.usage,\n      \"agentTurns providerRequests inputTokens outputTokens cachedInputTokens reasoningTokens providerReportedCostNanodollars estimatedCostNanodollars pricingVersion\",\n    );\n  fields(\n    payload.view,\n    \"schema sessionId mode identity issue turns composer evidence connection replay renderedAt\",\n  );\n  fields(\n    payload.view.identity,\n    \"agentLabel runnerLabel runnerAttached controlPlaneLabel controlPlaneTooltip replaySource\",\n  );\n  fields(\n    payload.view.issue,\n    \"identifier title status priority assignee runState scenarioId fixtureProfile\",\n  );\n  fields(payload.view.composer, \"state helper reason pendingInteractionId\");","sourceCodeStart":88,"sourceCodeEnd":124,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/packages/paperclip-runner/scripts/public-eval-viewer.mjs#L88-L124","documentation":"validatePublicChatPayload() rejects payloads whose run block still carries private provider routing data: a non-empty effectiveModelHistory, or non-null managedProfile / acpxProfile. These fields reveal internal model-selection and profile configuration that must not appear in public reports, so \"Public replay contains private provider metadata\" is thrown.","triggerScenarios":"Calling validatePublicChatPayload when the projection step failed to strip run.effectiveModelHistory (non-empty array), run.managedProfile, or run.acpxProfile — e.g. projecting a replay where model fallback occurred or managed/acpx profiles were active.","commonSituations":"A new generator version stopped zeroing these fields; replays from runs using managed profiles were projected with fields retained; model-fallback runs populated effectiveModelHistory and the projection only nulls it for single-model runs.","solutions":["Strip the fields in the projection step: set effectiveModelHistory to [] (or omit content), managedProfile and acpxProfile to null before validation.","Regenerate the public payload with the fixed projector and revalidate.","Check the projector handles model-fallback runs — effectiveModelHistory must be emptied for those specifically.","If a field was renamed in the run projection, ensure the nulling logic uses the new name so the old key isn't left populated."],"exampleFix":"// before\nrun: { ...run, effectiveModelHistory: run.effectiveModelHistory },\n// after\nrun: { ...run, effectiveModelHistory: [], managedProfile: null, acpxProfile: null },","handlingStrategy":"validation","validationCode":"const hasPrivateProviderMeta = (run) =>\n  Boolean(run?.effectiveModelHistory?.length) || run?.managedProfile != null || run?.acpxProfile != null;\nif (hasPrivateProviderMeta(payload.run)) throw new Error(\"strip provider metadata before publishing\");","typeGuard":"const providerMetaCleared = (run) => Array.isArray(run?.effectiveModelHistory) && run.effectiveModelHistory.length === 0 && run.managedProfile == null && run.acpxProfile == null;","tryCatchPattern":"try {\n  validatePublicChatPayload(payload);\n} catch (err) {\n  if (err.message === \"Public replay contains private provider metadata\") {\n    payload.run.effectiveModelHistory = [];\n    payload.run.managedProfile = null;\n    payload.run.acpxProfile = null;\n    validatePublicChatPayload(payload);\n  } else throw err;\n}","preventionTips":["Null out provider-routing fields in the projector for every run, not just single-model runs","Add a test using a model-fallback replay to prove effectiveModelHistory is emptied","Review any new run field for public-safety before adding it to the run projection","Treat managedProfile/acpxProfile/effectiveModelHistory as private-by-default in code review"],"tags":["security","privacy","validation","data-leak"],"backgroundTag":"schema-validation-failed","analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-09-10T03:14:50.855Z","contentChangedAt":"2026-09-10T03:14:50.855Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}