Opus finding
deterministicSelect can include secret-bearing message content in a hash that is not security-sensitive but leaks length-based stability
lowmaintainabilitymedium
- src/providers/orchestrator.ts:109-118
Joining role:content with '|' is ambiguous if a message contains '|' or if a role string contains ':' — different message arrays could collide in payload. Not a security issue (sha256 still ok) but the determinism guarantee is weaker than it appears: e.g. messages [{role:'user', content:'a|user:b'}] vs [{role:'user', content:'a'},{role:'user', content:'b'}] hash to the same payload. For a 'deterministic' router this is a subtle correctness issue if callers depend on per-message identity.
Recommendation
Use JSON.stringify(messages) or a length-prefixed encoding so collisions are impossible.