@chatpanel/pii 0.2.1 → 0.2.3

package/index.js

@@ -14,3 +14,4 @@ export * from './pii-redact.js';
 export * from './pii-detect.js';
 export * from './pipeline.js';
 export * from './tool-rank.js';
+export * from './tool-harness.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/pii",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "The canonical ChatPanel privacy engine — reversible PII redaction + pseudonymization with local entity detection. Pure, dependency-free ESM shared by the ChatPanel extension, gateway, and bridge.",
   "type": "module",
   "main": "index.js",
@@ -9,7 +9,8 @@
     "./pii-redact.js": "./pii-redact.js",
     "./pii-detect.js": "./pii-detect.js",
     "./pipeline.js": "./pipeline.js",
-    "./tool-rank.js": "./tool-rank.js"
+    "./tool-rank.js": "./tool-rank.js",
+    "./tool-harness.js": "./tool-harness.js"
   },
   "files": [
     "index.js",
@@ -17,6 +18,7 @@
     "pii-detect.js",
     "pipeline.js",
     "tool-rank.js",
+    "tool-harness.js",
     "LICENSE",
     "README.md"
   ],

package/pii-redact.js

@@ -20,6 +20,14 @@
 
 const TOKEN_RE = /\[\[([A-Z][A-Z0-9]*)_(\d+)\]\]/g;
 
+// Bracket-TOLERANT match of the same token. Smaller models routinely drop or mangle
+// the [[ ]] when echoing a placeholder into tool-call JSON — e.g. they emit "ORG_1"
+// or "[ORG_1]" instead of "[[ORG_1]]" — which the strict TOKEN_RE misses, leaving
+// the tool to search the literal "ORG_1" (and get nothing). We match 0–2 brackets
+// on each side and reconstruct the canonical token to look up; only ACTUAL vault
+// tokens are swapped, so a coincidental "ABC_1" that isn't ours is left untouched.
+const TOLERANT_TOKEN_RE = /\[{0,2}([A-Z][A-Z0-9]*_\d+)\]{0,2}/g;
+
 // A vault is the per-conversation mapping between placeholders and originals. Keep
 // one per conversation so PERSON_1 means the same entity across turns.
 export function createVault() {
@@ -168,7 +176,10 @@ export function redactText(text, vault, {
 // Swap placeholders back to their originals. Unknown tokens are left untouched.
 export function restoreText(text, vault) {
   if (text == null || !vault) return text;
-  return String(text).replace(TOKEN_RE, (m) => (vault.byToken.has(m) ? vault.byToken.get(m) : m));
+  return String(text).replace(TOLERANT_TOKEN_RE, (m, inner) => {
+    const canonical = `[[${inner}]]`;
+    return vault.byToken.has(canonical) ? vault.byToken.get(canonical) : m;
+  });
 }
 
 // Restore for LOCAL use only — e.g. tool-call args that hit on-device history /

package/tool-harness.js

@@ -0,0 +1,79 @@
+// THE tool harness — one interception layer shared by every orchestrator
+// (ChatPanel API + agent, gateway API + relay) so tool handling can't drift. It
+// owns the boundaries around a model turn:
+//
+//   ⓪ selectTools  — inject + narrow the tools the model is offered (MCP-auto).
+//   ② toTool       — what a tool RECEIVES: real values (so on-device / remote
+//                    lookups work), or the redacted token for remote MCP tools
+//                    when the user chose "redact remote".
+//   ③ toModelResult— what the MODEL sees back: the tool result re-redacted so it
+//                    stays blinded.
+//   ④ toUser       — the final reply: reversible tokens restored (pseudonyms stay).
+//
+// PRIVACY IS OPTIONAL. With no `vault` (redaction off), ②③④ are pass-throughs —
+// no latency, no placeholder confusion — but ⓪ selectTools STILL narrows, because
+// not every turn is privacy-sensitive yet every turn benefits from fewer tools.
+//
+// Self-contained on the SYNCED engine files (pii-redact.js, tool-rank.js), so the
+// extension (browser ESM) and the gateway (npm) run the exact same code. The caller
+// passes the already-gated `redactOpts` ({tier, entities, dictionary}) it computed
+// from cfg+isPro — keeping tier/dictionary Pro-gating out of the harness.
+
+import { restoreText, restoreWithAliases, redactText } from './pii-redact.js';
+import { narrowSpecs } from './tool-rank.js';
+
+// MCP / remote tools are server-prefixed (mcp_server__tool). Local tools
+// (history/meeting/page, or a client's core bash/read) are not — they always get
+// real values and are never narrowed away.
+export const isRemoteToolName = (name) => /^mcp[_-]/i.test(String(name || ''));
+
+// Deep restore of a tool-call argument value, undoing reversible tokens AND
+// pseudonyms (tools run locally / on real data; only the model stays blinded).
+export function restoreToolArgs(value, vault) {
+  if (!vault) return value;
+  if (typeof value === 'string') return restoreWithAliases(value, vault);
+  if (Array.isArray(value)) return value.map((v) => restoreToolArgs(v, vault));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const k of Object.keys(value)) out[k] = restoreToolArgs(value[k], vault);
+    return out;
+  }
+  return value;
+}
+
+export function makeToolHarness({ vault = null, toolData = 'real', redactOpts = null, redactResults = true } = {}) {
+  const on = !!vault;                       // privacy enabled for this turn?
+  const redactRemote = toolData === 'redactRemote';
+  return {
+    enabled: on,
+    isRemoteTool: isRemoteToolName,
+
+    // ⓪ Always-on tool selection (privacy-independent). `available` is any spec
+    // list; `opts` forwards { cap, keep, name, description } to the shared ranker.
+    selectTools(available, query, opts = {}) {
+      return narrowSpecs(available, query, opts);
+    },
+
+    // ② What the tool receives.
+    toTool(name, args) {
+      if (!on) return args;                                    // privacy off → already real
+      if (redactRemote && isRemoteToolName(name)) return args;  // keep PII off remote MCP
+      return restoreToolArgs(args, vault);                      // real values for the tool
+    },
+
+    // ③ What the model sees back (re-redacted). Handles a string or a { text } shape.
+    toModelResult(name, raw) {
+      if (!on || !redactResults || !redactOpts) return raw;
+      if (typeof raw === 'string') return redactText(raw, vault, redactOpts);
+      if (raw && typeof raw === 'object' && typeof raw.text === 'string') {
+        return { ...raw, text: redactText(raw.text, vault, redactOpts) };
+      }
+      return raw;
+    },
+
+    // ④ The final reply the user sees.
+    toUser(text) {
+      return on ? restoreText(text, vault) : text;
+    },
+  };
+}