feat(redaction): add event-level redactEvent hook

[naji247]

Summary

Redaction decisions often need more context than a single string. The existing redactSensitiveInformation hook is applied blindly to every string field in an event, so consumers can't tell which tool produced a value, what type of event is being published, or which field a string belongs to.

This PR adds a new event-level redaction hook, redactEvent, alongside the existing string-level hook. It receives the full Event object — resourceName, eventType, parameters, response, userIntent, and the rest — and returns a modified event, or null to drop the event entirely.

agentcat.track(mcpServer, "proj_0000000", {
  redactEvent: (event) => {
    // Drop events from tools that handle secrets entirely
    if (event.resourceName === "get_credentials") {
      return null;
    }
    // Strip response payloads from a specific tool
    if (event.resourceName === "export_report") {
      return { ...event, response: undefined };
    }
    return event;
  },
});

Behavior

• Signature: (event: Event) => Event | null | Promise<Event | null> — sync or async, exported as RedactEventFunction.
• Ordering: redactEvent runs first and sees raw, unredacted values with full event context. redactSensitiveInformation (if configured), sanitization, and truncation all run on its output, so the string-level scrubber remains the last line of defense.
• Drop semantics: returning null/undefined drops the event. If the hook throws, the event is dropped and the error is logged to ~/agentcat.log — the same fail-closed semantics as the existing string-level hook.
• System-managed fields: id, sessionId, projectId, eventType, and timestamp are restored if the hook changes or removes them, protecting session and project attribution. Everything else is fully consumer-controlled.
• Field deletions are honored: fields removed by the hook stay removed rather than being merged back in.

Behavior change worth noting

The hook is attached centrally in the publish pipeline, which means custom events published via publishCustomEvent on a tracked server now also pass through redactEvent. Custom events previously bypassed redaction entirely; the string-level hook's behavior for them is unchanged. Custom events published with a bare session ID string (no tracked server) still bypass redaction, since no tracked configuration exists there.

Test plan

• Unit tests for the new applyEventRedaction helper: sync/async hooks, null/undefined drops, deletion honoring, system-managed field restoration, internal function fields never exposed to or persisted from the hook, error propagation (src/tests/redaction.test.ts)
• Queue-level tests: hook attachment from track() options, drop-on-null, drop-on-throw, ordering relative to string redaction (src/tests/eventQueue.test.ts)
• End-to-end integration tests over a real MCP client/server pair: metadata visibility, field replacement, selective drop by event type, hook composition with string redaction, publishCustomEvent coverage (src/tests/redaction.test.ts)
• Full suite green: 499 passed, plus lint and typecheck via pnpm run prepublishOnly
• Manual end-to-end verification against the built package (dist): drove a real MCP client/server with both hooks configured and a local HTTP capture server in place of the AgentCat API; confirmed rewritten parameters, dropped events, string redaction composing after the event hook, and that a throwing hook drops only the affected event without disrupting the server