Redact sensitive tool argument values in audit payloads

- Add SENSITIVE_ARGUMENT_KEYS frozenset with command, content, new, old
- Route arguments dict through redact_tool_arguments to redact both
  sensitive key patterns and tool argument content values, preserving
  non-sensitive keys like path
- Keep payload-level content and other keys unaffected

Author: johnteee

teaagent/audit.py

@@ -20,6 +20,7 @@
     'secret',
     'token',
 )
+SENSITIVE_ARGUMENT_KEYS = frozenset({'command', 'content', 'new', 'old'})
 
 
 def utc_now() -> str:
@@ -77,7 +78,35 @@ def record(self, event_type: str, run_id: str, **payload: Any) -> AuditEvent:
 
 
 def redact_audit_payload(payload: dict[str, Any]) -> dict[str, Any]:
-    return {key: redact_audit_value(key, value) for key, value in payload.items()}
+    redacted: dict[str, Any] = {}
+    for key, value in payload.items():
+        if key == 'arguments' and isinstance(value, dict):
+            redacted[key] = redact_tool_arguments(value)
+        else:
+            redacted[key] = redact_audit_value(key, value)
+    return redacted
+
+
+def redact_tool_arguments(arguments: dict[str, Any]) -> dict[str, Any]:
+    return {
+        str(key): redact_tool_argument_value(str(key), value)
+        for key, value in arguments.items()
+    }
+
+
+def redact_tool_argument_value(key: str, value: Any) -> Any:
+    if is_sensitive_key(key) or key in SENSITIVE_ARGUMENT_KEYS:
+        return AUDIT_REDACTED
+    if isinstance(value, dict):
+        return {
+            str(child_key): redact_tool_argument_value(str(child_key), child_value)
+            for child_key, child_value in value.items()
+        }
+    if isinstance(value, list):
+        return [redact_tool_argument_value('', item) for item in value]
+    if isinstance(value, tuple):
+        return [redact_tool_argument_value('', item) for item in value]
+    return redact_audit_value(key, value)
 
 
 def redact_audit_value(key: str, value: Any) -> Any:

tests/test_audit.py

@@ -131,6 +131,34 @@ def test_record_redacts_sensitive_payload_keys(self) -> None:
         )
         self.assertEqual(event.payload['arguments']['path'], 'file.txt')
 
+    def test_record_redacts_sensitive_tool_argument_values(self) -> None:
+        logger = AuditLogger()
+
+        event = logger.record(
+            'tool_call_started',
+            'run-1',
+            arguments={
+                'path': 'file.txt',
+                'content': 'secret file body',
+                'old': 'previous secret',
+                'new': 'new secret',
+                'command': 'export TOKEN=secret',
+            },
+        )
+
+        self.assertEqual(event.payload['arguments']['path'], 'file.txt')
+        self.assertEqual(event.payload['arguments']['content'], AUDIT_REDACTED)
+        self.assertEqual(event.payload['arguments']['old'], AUDIT_REDACTED)
+        self.assertEqual(event.payload['arguments']['new'], AUDIT_REDACTED)
+        self.assertEqual(event.payload['arguments']['command'], AUDIT_REDACTED)
+
+    def test_record_preserves_non_argument_content(self) -> None:
+        logger = AuditLogger()
+
+        event = logger.record('tool_call_completed', 'run-1', content='read result')
+
+        self.assertEqual(event.payload['content'], 'read result')
+
     def test_record_truncates_large_strings(self) -> None:
         logger = AuditLogger()