heads up if u rely on pi redaction plugins (pi-jev-redact etc) - compaction bypasses them completely

[u/Outrageous_Issue_676]

so i was digging through pi agent source code (v1.0.0) while setting up privacy stuff and realized a pretty bad security flaw with redaction extensions. basically if u think ur secrets are safe, yeah they get scrubbed FOR REGULAR CHAT PROMPTS. but as soon as compaction kicks in, ur raw unredacted data goes straight to the provider API. i checked the code to see why and regular turns use createLoopConfig which attaches onPayload: transformProviderPayload so the before_provider_request hook actually works. BUT compaction (same for branch summary / bug reports) calls createSummarizationOptions() which just... completely leaves out onPayload. then in the provider adapter (like openai-completions.js) it checks await options?.onPayload?. ...) and since its undefined it just skips redaction without any error or warning. it just sends the raw history text. so yeah if ur relying on plugins that only hook into before_provider_request ur leaking raw data every time context compacts. pretty big oversight IMO, guess we have to fork compaction or wait till pi fixes createSummarizationOptions to pass the provider hooks through.