Problem

hackagent/router/tracking/utils.py:24 marks any dict key containing token as sensitive:

_SENSITIVE_SUBSTRINGS = ("key", "token", "secret", "password")

sanitize_for_json() in hackagent/router/tracking/utils.py:85-86 then replaces
matching values with ***REDACTED***. This redacts operational metrics stored in the hackagent-db
via Tracker/StepTracker such as prompt_tokens, completion_tokens,
total_tokens, input_tokens, output_tokens, cached_tokens, and
token_count (e.g. response.usage in hackagent/router/router.py:895-897,
hackagent/server/api/models.py:435-443, hackagent/cli/tui/views/results/formatters/http.py:290-309).
Counts are not secrets and must remain visible in traces/results.

Sensitive keys like api_key, api_token, access_token, secret, password
must still be redacted.

Minimal Fix

In hackagent/router/tracking/utils.py add an exact-match allowlist checked
before the sensitive-substring test and keep the substring check for everything
else:

_TOKEN_COUNT_ALLOWLIST = frozenset({
    "prompt_tokens", "completion_tokens", "total_tokens",
    "input_tokens", "output_tokens", "cached_tokens",
    "token_count", "prompt_tokens_details", "completion_tokens_details",
})
# in sanitize_for_json, if k.lower() in allowlist → recurse, don't redact

Files To Change

• hackagent/router/tracking/utils.py -> add allowlist and guard in sanitize_for_json.
• tests/unit/router/tracking/test_tracker.py -> add regression: usage token counts preserved while api_token/api_key remain redacted (also cover nested prompt_tokens_details.cached_tokens).

Verification

uv run ruff format .
uv run ruff check .
env -u OLLAMA_HOST -u OLLAMA_BASE_URL -u OLLAMA_API_BASE -u OLLAMA_MODELS \
  uv run pytest tests/unit/router/tracking/ tests/unit/router/test_envelope.py tests/unit/cli/tui/test_tui_results_and_logs.py

Expected result: token-count fields persist through sanitize_for_json; secret/token keys still redacted; existing tracking tests remain green.