fix(tess): redact chat persistence and egress

apps/gateway/src/chat/chat.gateway.ts

@@ -18,6 +18,7 @@ import {
 } from '@mosaicstack/discord-plugin';
 import type { Auth } from '@mosaicstack/auth';
 import type { Brain } from '@mosaicstack/brain';
+import { redactSensitiveContent } from '@mosaicstack/log';
 import type {
   SetThinkingPayload,
   SlashCommandApprovalResultPayload,
@@ -317,7 +318,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           {
             conversationId,
             role: 'user',
-            content: data.content,
+            content: redactSensitiveContent(data.content).content,
             metadata: {
               timestamp: new Date().toISOString(),
               ...(correlationId
@@ -327,6 +328,7 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
                     discordUserId: discordIngress?.userId,
                   }
                 : {}),
+              classifications: redactSensitiveContent(data.content).classifications,
             },
           },
           userId,
@@ -831,8 +833,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
               {
                 conversationId,
                 role: 'assistant',
-                content: cs.assistantText,
-                metadata,
+                content: redactSensitiveContent(cs.assistantText).content,
+                metadata: {
+                  ...metadata,
+                  classifications: redactSensitiveContent(cs.assistantText).classifications,
+                },
               },
               userId,
             )
@@ -856,17 +861,18 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         if (assistantEvent.type === 'text_delta') {
           // Accumulate assistant text for persistence
           const cs = this.clientSessions.get(client.id);
+          const redactedDelta = redactSensitiveContent(assistantEvent.delta).content;
           if (cs) {
-            cs.assistantText += assistantEvent.delta;
+            cs.assistantText += redactedDelta;
           }
           client.emit('agent:text', {
             conversationId,
-            text: assistantEvent.delta,
+            text: redactedDelta,
           });
         } else if (assistantEvent.type === 'thinking_delta') {
           client.emit('agent:thinking', {
             conversationId,
-            text: assistantEvent.delta,
+            text: redactSensitiveContent(assistantEvent.delta).content,
           });
         }
         break;