fix(contextual_access): redact post-hook content alongside output [PLT-3790]

[wdawson]

Linear: PLT-3790. Related engine change: PLT-3746 (ArcadeAI/monorepo#4556). Schema: ArcadeAI/schemas#31. Docs: ArcadeAI/docs#1217, which merges after this.

Why

Post-hook requests from remote MCP servers now include content, the blocks the server returned alongside output, and clients receive them. These examples now apply the same redaction and filtering to content as to output.

Changes

• Docker builds (first commit): the Dockerfiles now COPY and build examples/contextual_access/<name>/, the builder image is golang:1.26-alpine to match go.mod, and the .dockerignore entry for the committed advanced_server binary uses its new path. The earlier move (10b2909) had changed all three, and every build-and-push job had been failing since.
• pkg/server/schema.gen.go: regenerated from schemas main (ContentBlock, content, override.content).
• pii_redactor: scans and redacts content text blocks as well, in both redact and block modes.
• content_filter: keyword and pattern rules cover content text blocks, and replace rules rewrite them. Rules match each field on its own, so anchored patterns work.
• advanced_server: the PII path scans and redacts every string field of every content block. Fixed-output rules clear content.
• basic_rules: fixed-output rules clear content.
• READMEs: one line each noting that content gets the same treatment.
• Cleanups (follow-up commits):
  • The READMEs, usage comments, example configs, and the basic_rules cert script use go run ./examples/contextual_access/<name>. They had used the paths from before the move, and ./tools/webhook-test-server for basic_rules. Their -config flags point at each example's committed example-config.yaml, so the documented commands find their config when run from the repository root.
  • content_filter's pre-hook checks each input value on its own, as the post-hook does, so anchored input patterns work when a tool has several inputs. The README notes that a rule doesn't match across two separate fields.
  • The phone pattern in pii_redactor and advanced_server redacts a leading ( or +: (555) 123-4567 now becomes [PHONE REDACTED], not ([PHONE REDACTED]. It matches the same strings as before.
  • advanced_server/ab_testing.go is gofmt-clean.
  • The Dockerfiles EXPOSE 8888, the servers' default port.

Judgment calls

1. pii_redactor and content_filter handle content text blocks, the blocks MCP gateways render, going as deep as they already go into output. Other block types pass through unchanged. advanced_server, the comprehensive example, walks every block but leaves base64 payloads (image/audio data, resource blob) untouched, since a pattern match inside them would alter the encoded bytes.
2. A rule that replaces output with a fixed value returns override.content: []. Clients then receive the new output as a single text block.
3. override.content is sent only when the request carried content, so responses for non-MCP tools are unchanged.

Testing

No test suite exists. go build ./... and go vet ./... pass at every commit, and gofmt -l . is clean on the final commit. docker build succeeds for all six examples from the repo root, the same context the workflow uses. I ran each changed example locally and checked with curl that post-hook requests carrying content come back with override.content redacted or filtered. For the cleanups, I compared each change before and after with curl: pre-hook inputs with several fields, and phone numbers against ordinary numbers and other PII. I also ran one image with docker run -p 8888:8888 and checked /health.

🤖 Generated with Claude Code