bug(runtime): Deep Research artifact pages are redacted separately, so a secret split across pages is shown #5432

What happened

deep_research_read_artifact returns an artifact in pages. Pages are counted in code points: offset_chars, and max_chars (default 32,000, at most 64,000 per read). An artifact holds up to 512,000 characters. The tool picks the window from the raw text first (packages/runtime/src/deep-research-tools.ts:229-234) and only then runs safeResearchArtifactContent on that window (:236).

A credential that crosses a page boundary is incomplete in each page, so no redaction pattern matches either part. Joining the two pages gives back the full value, even though a read that covers the whole value returns [redacted].

JSON artifacts larger than one read are affected even when nothing straddles a boundary. Key-based JSON redaction only applies when the text parses as a whole document, and a single page does not.

docs/deep-research-durable-workspace.md:250-252 says artifact text is secret-redacted before it is returned to the model.

How to reproduce

1. Save a source artifact with deep_research_save_artifact whose content is Evidence before sk-ant-FAKE-test-key-0000 evidence after. (a fake value).
2. Read it with default arguments. The body is Evidence before [redacted] evidence after.
3. Read it with { offset_chars: 0, max_chars: 17 }. The body is Evidence before s.
4. Read it with { offset_chars: 17 }. The body is k-ant-FAKE-test-key-0000 evidence after.

The same happens with fake ghp_, AIza, xoxb-, 40-hex, API_KEY= and Authorization: Bearer values. It also happens with a value across the default 32,000 boundary during default paging, and with max_chars: 1 reads.

Environment

• Maka commit: 672d827 (main)
• Surface: Runtime Host (Deep Research tools)
• Node.js: 22.23.1, running from source

Logs, screenshots, or additional context

SECURITY.md §2.4 treats redactSecrets() as a best-effort heuristic, not a boundary, so this is filed as a regular bug. Artifact content is text the model saved itself. Paging therefore re-shows text the model already had. The problem is that paged reads do not hide what a whole read hides.