mcp(fix[middleware]): redact respawn shell payloads

Add `shell` to `_SENSITIVE_ARG_NAMES` so respawn_pane's shell argument
is replaced by `{len, sha256_prefix}` in the audit log, matching the
existing treatment of `keys`, `text`, `value`, and `content`. An agent
that passes `shell="psql -U user -W secret"` would otherwise leak the
credential to long-lived audit archives.

Extend test_summarize_args_redacts_sensitive_keys to cover both `shell`
and `content` (the latter was already in the redaction set in code but
the test didn't exercise it). Update the safety doc's redaction list to
match the code (was: `keys`, `text`, `value`; now: `keys`, `text`,
`value`, `content`, `shell`).

Note for the threat model: redaction protects the MCP audit log, not
the OS process table or tmux's `pane_current_command` metadata. The
new safety subsection (1.C) documents the brief leakage window between
respawn-pane invocation and the spawned shell taking over.

Author: tony

CHANGES

@@ -28,6 +28,15 @@ _Notes on upcoming releases will be added here_
 
 ### Fixes
 
+- Audit log now redacts the ``shell`` argument on
+  {tooliconl}`respawn-pane` (and ``content`` on {tooliconl}`load-buffer`,
+  which the code already redacted but the docs did not list). The
+  ``shell`` payload may carry credentials passed to a relaunched
+  process; redacting the MCP audit log keeps them out of long-lived
+  log archives. Note: ``shell`` may still appear briefly in the OS
+  process table and tmux's ``pane_current_command`` metadata until the
+  spawned shell takes over — do not pass credentials directly even
+  with redaction.
 - {tooliconl}`respawn-pane` now requires an explicit ``pane_id``. Its
   signature still accepts ``session_name`` / ``session_id`` /
   ``window_id`` for backwards-compatibility with the shared pane-target

docs/topics/safety.md

@@ -114,7 +114,7 @@ Every tool call emits one `INFO` record on the `libtmux_mcp.audit` logger carryi
 - `outcome` — `ok` or `error`, with `error_type` on failure
 - `duration_ms`
 - `client_id` / `request_id` — from the fastmcp context when available
-- `args` — a summary of arguments. Sensitive keys (`keys`, `text`, `value`) are replaced by `{len, sha256_prefix}`; non-sensitive strings over 200 characters are truncated.
+- `args` — a summary of arguments. Sensitive keys (`keys`, `text`, `value`, `content`, `shell`) are replaced by `{len, sha256_prefix}`; non-sensitive strings over 200 characters are truncated.
 
 Route this logger to a dedicated sink if you want a durable audit trail; it is deliberately namespaced separately from the main `libtmux_mcp` logger.
 

src/libtmux_mcp/middleware.py

@@ -100,10 +100,17 @@ async def on_call_tool(
 
 #: Argument names that carry user-supplied payloads we never want in logs.
 #: ``keys`` (send_keys), ``text`` (paste_text), ``value`` (set_environment),
-#: and ``content`` (load_buffer) can contain commands, secrets, or
-#: arbitrary large strings. Matched by exact name, case-sensitive, to
-#: mirror the tool signatures.
-_SENSITIVE_ARG_NAMES: frozenset[str] = frozenset({"keys", "text", "value", "content"})
+#: ``content`` (load_buffer), and ``shell`` (respawn_pane) can contain
+#: commands, secrets, or arbitrary large strings. Matched by exact name,
+#: case-sensitive, to mirror the tool signatures.
+#:
+#: Note on ``shell`` redaction: this redacts the MCP audit log only.
+#: ``respawn_pane(shell="env SECRET=... bash")`` may briefly expose the
+#: argument via the OS process table and tmux's ``pane_current_command``
+#: metadata until the spawned shell takes over — see ``docs/topics/safety.md``.
+_SENSITIVE_ARG_NAMES: frozenset[str] = frozenset(
+    {"keys", "text", "value", "content", "shell"}
+)
 
 #: String arguments longer than this get truncated in the log summary to
 #: keep records bounded. Non-sensitive strings only — sensitive ones are

tests/test_middleware.py

@@ -149,11 +149,13 @@ def test_summarize_args_redacts_sensitive_keys() -> None:
         "keys": "rm -rf /",
         "text": "hello world",
         "value": "supersecret",
+        "content": "buffer payload",
+        "shell": "psql -U user -W secret123 mydb",
         "pane_id": "%1",
         "bracket": True,
     }
     summary = _summarize_args(args)
-    for sensitive in ("keys", "text", "value"):
+    for sensitive in ("keys", "text", "value", "content", "shell"):
         assert isinstance(summary[sensitive], dict)
         assert "len" in summary[sensitive]
         assert "sha256_prefix" in summary[sensitive]