fix(guardrails): mask PII inside a tool_result's nested content - #12930

applyToContentValue() descends into a content block's content only when it is a string:

if (typeof record.content === "string") { … }

A tool_result carries its payload as an array of parts — the shape every agentic client sends back after running a tool — so the string test walks past it, and the tool output reaches the provider unmasked.

Driving PIIMaskerGuardrail.preCall() with PII_REDACTION_ENABLED=true:

{"type":"text","text":"visible [SSN_REDACTED]"}
{"type":"tool_result","tool_use_id":"toolu_1",
 "content":[{"type":"text","text":"tool output 123-45-6789"}]}

Why this is worse than it looks

The sibling block is redacted. So the guardrail returns modified: true, reports {detections: 1, redacted: true}, and the payload visibly contains a [SSN_REDACTED]. Every signal downstream says the masker did its job, while a second copy of the same value went out untouched. A guardrail that fails loudly is a bug; one that fails while reporting success is the reason I wrote a test for the counted-detection case too.

CredentialMaskerGuardrail, in the same directory, walks the entire payload via walkValue. Only the PII masker stopped at depth one.

The change

sanitizeMessageLikeList() already calls applyToContentValue for a message's content. Making applyToContentValue do the same for a nested block is the same call, one level down, so the two agree on how deep masking goes:

if ("content" in record) {
  const result = applyToContentValue(record.content, detections);
  modified ||= result.modified;
  record.content = result.value;
}

This subsumes the string branch it replaces — applyToContentValue sanitizes a string and recurses into an array — so no case is lost. The payload is a JSON.parse(JSON.stringify(...)) round-trip before this runs, so it is acyclic and the recursion is bounded by its nesting; no seen set is needed.

maskResponsesOutput() on the response path has the same depth-one shape. I have left it alone rather than widen this PR, and I am happy to send it separately.

Verification

tests/unit/pii-nested-tool-result.test.ts, 6 tests. Checked by breaking it:

Under the first mutation the two guards — a string content on a block is still masked and a payload with nothing to mask is passed through unchanged — stay green, which is what should happen: that mutation restores the old behaviour for exactly the cases the old code handled.

eslint clean on both files; tsc -p tsconfig.typecheck-core.json reports 0 errors.