[BUG] Tool argument content is exported in tool_input/tool_parameters regardless of any OTEL_LOG_TOOL_* setting

What's Wrong?

Full bash command text reaches OTLP telemetry and no setting turns it off. The binary references five
content flags (OTEL_LOG_ASSISTANT_RESPONSES, OTEL_LOG_RAW_API_BODIES, OTEL_LOG_TOOL_CONTENT,
OTEL_LOG_TOOL_DETAILS, OTEL_LOG_USER_PROMPTS). None of them suppresses it.

Measured with a canary string in a bash command, captured at a local collector with no processors, so
the payload is exactly what Claude Code emits:

| Configuration | Canary in exported payload |
|-|-|
| all flags unset (default) | yes |
| OTEL_LOG_TOOL_CONTENT=0 | yes |
| OTEL_LOG_TOOL_CONTENT=false | yes |

It lands in three attributes, and only in tool attributes, never in the assistant response body. So
this is not Claude quoting the command back:

• tool_decision -> tool_parameters, which contains full_command
• tool_result -> tool_parameters
• tool_result -> tool_input, which contains command

user.email arrives as a record attribute on the same events.

What Should Happen?

One of the OTEL_LOG_TOOL_* flags should gate tool_input and tool_parameters. Failing that, the
monitoring docs should say plainly that tool arguments and user.email are always exported and cannot
be disabled.

The doc fix matters as much as the code fix. These flag names read like controls over whether tool
content is included. Anyone pointing Claude Code straight at a vendor OTLP endpoint, which the docs
present as supported, is exporting every developer's shell commands and email address without meaning
to. We found it by planting a canary rather than trusting the names, and we now run a local collector
that strips these fields before anything leaves the machine.

Steps to Reproduce

1. Point OTEL_EXPORTER_OTLP_ENDPOINT at a collector that writes received payloads to a file, with no

processors configured.

1. Leave every OTEL_LOG_TOOL_* variable unset. Repeat with OTEL_LOG_TOOL_CONTENT=0, then =false.
2. Run claude -p "Run exactly this bash command and nothing else: echo CANARY_12345" with the Bash

tool allowed.

1. Grep the captured payload for CANARY_12345. Present in all three runs.

Environment

Claude Code 2.1.259, also seen on 2.1.252 and 2.1.258. macOS darwin 25.6.0 arm64. OTLP gRPC to
otelcol-contrib 0.160.0 on loopback.