fix(tess): redact chat persistence and egress

apps/gateway/src/chat/chat.gateway.ts

@@ -13,6 +13,7 @@ import { Server, Socket } from 'socket.io';
 import type { AgentSessionEvent } from '@mariozechner/pi-coding-agent';
 import type { Auth } from '@mosaicstack/auth';
 import type { Brain } from '@mosaicstack/brain';
+import { redactSensitiveContent } from '@mosaicstack/log';
 import type {
   SetThinkingPayload,
   SlashCommandPayload,
@@ -210,9 +211,10 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
           {
             conversationId,
             role: 'user',
-            content: data.content,
+            content: redactSensitiveContent(data.content).content,
             metadata: {
               timestamp: new Date().toISOString(),
+              classifications: redactSensitiveContent(data.content).classifications,
             },
           },
           userId,
@@ -611,8 +613,11 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
               {
                 conversationId,
                 role: 'assistant',
-                content: cs.assistantText,
+                content: redactSensitiveContent(cs.assistantText).content,
-                metadata,
+                metadata: {
+                  ...metadata,
+                  classifications: redactSensitiveContent(cs.assistantText).classifications,
+                },
               },
               userId,
             )
@@ -636,17 +641,18 @@ export class ChatGateway implements OnGatewayInit, OnGatewayConnection, OnGatewa
         if (assistantEvent.type === 'text_delta') {
           // Accumulate assistant text for persistence
           const cs = this.clientSessions.get(client.id);
+          const redactedDelta = redactSensitiveContent(assistantEvent.delta).content;
           if (cs) {
-            cs.assistantText += assistantEvent.delta;
+            cs.assistantText += redactedDelta;
           }
           client.emit('agent:text', {
             conversationId,
-            text: assistantEvent.delta,
+            text: redactedDelta,
           });
         } else if (assistantEvent.type === 'thinking_delta') {
           client.emit('agent:thinking', {
             conversationId,
-            text: assistantEvent.delta,
+            text: redactSensitiveContent(assistantEvent.delta).content,
           });
         }
         break;