@chatpanel/pii 0.2.10 → 0.2.14

package/index.js

@@ -7,9 +7,10 @@
 // Submodules are also importable directly:
 //   'chatpanel-pii/pii-redact.js'   deterministic redact/restore + vault
 //   'chatpanel-pii/pii-detect.js'   local NER / LLM entity detection
-//   'chatpanel-pii/pipeline.js'     pure turn orchestration + tier/scope gating
+//   'chatpanel-pii/pipeline.js'     pure turn orchestration + tier/scope selection
 //   'chatpanel-pii/tool-rank.js'    deterministic tool narrowing (auto mode)
 //   'chatpanel-pii/sanitize.js'     Unicode de-steganography (strip invisible/format chars)
+//   'chatpanel-pii/net.js'          SSRF host classifier + outbound-URL guard
 
 export * from './pii-redact.js';
 export * from './pii-detect.js';
@@ -17,3 +18,4 @@ export * from './pipeline.js';
 export * from './tool-rank.js';
 export * from './tool-harness.js';
 export * from './sanitize.js';
+export * from './net.js';

package/net.js

@@ -0,0 +1,103 @@
+// Shared host classifier + outbound-URL guard — the SSRF primitive.
+//
+// One implementation of "what is a loopback / cloud-metadata / private host",
+// delivered the way the rest of @chatpanel/pii is: npm dependency for the
+// gateway/bridge, vendorable into the browser extension (pure — only URL + string
+// ops, no node APIs, so it runs in a Worker/service-worker too). Replaces the
+// hand-maintained copies in the bridge (src/ssrf.js) and the extension
+// (js/context.js isBlockedHost) so a security guard can't silently drift between
+// the direct client path and the proxied path. See docs/secure-data-plane.md.
+//
+// The policy knobs cover the two legitimate trust contexts:
+//   • A MODEL / API / MCP endpoint (gateway upstream, bridge MCP proxy) may live on
+//     loopback (Ollama, LM Studio) or the LAN (a homelab GPU box) — so those are
+//     allowed by default — but must NEVER reach cloud instance metadata.
+//   • A WEB PAGE fetch (link title, page context) has no business touching loopback
+//     or any private host at all — call with { allowLoopback:false, allowPrivate:false }.
+// Cloud metadata (169.254.169.254 & friends) and non-http(s) schemes are blocked in
+// BOTH contexts, unconditionally. Re-run the assert on every redirect hop.
+
+function ipv4(h) {
+  const m = String(h).match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (!m) return null;
+  const o = m.slice(1).map(Number);
+  if (o.some((n) => n > 255)) return null;
+  return o;
+}
+
+const norm = (hostname) => String(hostname || '').toLowerCase().replace(/^\[|\]$/g, '');
+
+// Loopback = this host's own services (127.0.0.0/8, ::1, localhost, *.localhost).
+export function isLoopbackHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return false;
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  if (h === '::1') return true;
+  const o = ipv4(h);
+  return !!(o && o[0] === 127);
+}
+
+// Cloud instance metadata — the sharpest SSRF target (credential theft). Covers the
+// link-local IMDS address used by AWS/GCP/Azure/DO (169.254.169.254), Alibaba's
+// 100.100.100.200, and the GCP/name-based metadata hosts. ALWAYS blocked.
+export function isMetadataHost(hostname) {
+  const h = norm(hostname);
+  if (h === 'metadata.google.internal' || h === 'metadata') return true;
+  const o = ipv4(h);
+  if (!o) return false;
+  if (o[0] === 169 && o[1] === 254) return true;                 // 169.254.169.254 (+ link-local)
+  if (o[0] === 100 && o[1] === 100 && o[2] === 100 && o[3] === 200) return true; // Alibaba IMDS
+  return false;
+}
+
+// Private / internal address space, EXCLUDING loopback + metadata (checked
+// separately): RFC1918, CGNAT, IPv6 ULA/link-local, mDNS .local, this-host 0.x/::.
+export function isPrivateHost(hostname) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (h.endsWith('.local')) return true;
+  if (
+    h === '::' || h.startsWith('fc') || h.startsWith('fd')       // IPv6 ULA
+    || h.startsWith('fe8') || h.startsWith('fe9') || h.startsWith('fea') || h.startsWith('feb') // link-local
+  ) return true;
+  const o = ipv4(h);
+  if (o) {
+    const [a, b] = o;
+    if (a === 0 || a === 10) return true;                        // this-host / RFC1918
+    if (a === 169 && b === 254) return true;                     // link-local
+    if (a === 172 && b >= 16 && b <= 31) return true;            // RFC1918
+    if (a === 192 && b === 168) return true;                     // RFC1918
+    if (a === 100 && b >= 64 && b <= 127) return true;           // CGNAT
+  }
+  return false;
+}
+
+// Policy-driven classifier. Returns true if `hostname` must be blocked under `policy`.
+// Defaults model the ENDPOINT context (loopback + LAN allowed, metadata never).
+export function isBlockedHost(hostname, { allowLoopback = true, allowPrivate = true } = {}) {
+  const h = norm(hostname);
+  if (!h) return true;
+  if (isMetadataHost(h)) return true;                            // never, in any context
+  if (isLoopbackHost(h)) return !allowLoopback;
+  if (isPrivateHost(h)) return !allowPrivate;
+  return false;                                                  // public host
+}
+
+// Assert a URL is fetchable under `policy`; returns the parsed URL or throws.
+// Call on the initial URL AND after every redirect hop.
+export function assertFetchableUrl(u, policy = {}) {
+  let parsed;
+  try { parsed = new URL(u); } catch { throw new Error(`invalid URL: ${u}`); }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+    throw new Error(`only http(s) URLs allowed (got "${parsed.protocol}")`);
+  }
+  if (isBlockedHost(parsed.hostname, policy)) {
+    throw new Error(`refusing to reach a blocked address (${parsed.hostname})`);
+  }
+  return parsed;
+}
+
+// Endpoint context: model/API/MCP upstream — loopback + LAN OK, metadata never.
+export const assertEndpointUrl = (u, opts = {}) => assertFetchableUrl(u, { allowLoopback: true, allowPrivate: true, ...opts });
+// Web-page context: no loopback, no private, no metadata — genuinely public only.
+export const assertPublicWebUrl = (u) => assertFetchableUrl(u, { allowLoopback: false, allowPrivate: false });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/pii",
-  "version": "0.2.10",
+  "version": "0.2.14",
   "description": "The canonical ChatPanel privacy engine — reversible PII redaction + pseudonymization with local entity detection. Pure, dependency-free ESM shared by the ChatPanel extension, gateway, and bridge.",
   "type": "module",
   "main": "index.js",
@@ -11,7 +11,8 @@
     "./pipeline.js": "./pipeline.js",
     "./tool-rank.js": "./tool-rank.js",
     "./tool-harness.js": "./tool-harness.js",
-    "./sanitize.js": "./sanitize.js"
+    "./sanitize.js": "./sanitize.js",
+    "./net.js": "./net.js"
   },
   "files": [
     "index.js",
@@ -21,6 +22,7 @@
     "tool-rank.js",
     "tool-harness.js",
     "sanitize.js",
+    "net.js",
     "LICENSE",
     "README.md"
   ],

package/pii-detect.js

@@ -13,6 +13,8 @@
 //     chat — redaction silently falls back to the deterministic layer.
 //   - input is length-capped so a huge transcript can't stall detection.
 
+import { assertEndpointUrl } from './net.js';
+
 const cache = new Map(); // key -> [{value,type}]
 const CACHE_MAX = 300;
 
@@ -151,6 +153,11 @@ export async function detectEntities(text, cfg, { signal, fetchImpl = globalThis
   const run = det.backend === 'endpoint' ? detectViaEndpoint : detectViaOpenAI;
   let ents = [];
   try {
+    // SSRF guard before RAW (pre-redaction) text leaves for the detector: http(s)
+    // only, never cloud metadata. Loopback/LAN allowed — a local NER server / Ollama
+    // is the normal case. A blocked URL fails open (deterministic-only), or surfaces
+    // to the Test button in strict mode.
+    assertEndpointUrl(det.url);
     ents = await withTimeout(run(capped, det, signal, fetchImpl), det.timeoutMs || 1500, signal);
   } catch (e) {
     if (strict) throw e; // surface errors to the Test button

package/pii-redact.js

@@ -9,7 +9,7 @@
 // Pure + dependency-free so it is unit-testable and runs identically for API and
 // CLI/bridge agents (both assemble their outbound payload through providers.js).
 //
-// Tiers (the licensing seam):
+// Tiers:
 //   'basic' — deterministic regex: emails, phones, IPs, cards (Luhn), SSNs, keys.
 //   'full'  — basic + entity-aware: known people/orgs (meeting roster, contacts,
 //             the user's own identity) and a user-editable custom dictionary.
@@ -18,6 +18,8 @@
 // one reference won't restore (it shows the token) — but the privacy guarantee
 // (the real value never left the device) always holds.
 
+import { stripHidden, confusablesSkeleton } from './sanitize.js';
+
 const TOKEN_RE = /\[\[([A-Z][A-Z0-9]*)_(\d+)\]\]/g;
 
 // Bracket-TOLERANT match of the same token. Smaller models routinely drop or mangle
@@ -72,6 +74,55 @@ function escapeRegex(s) {
   return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+// Reject a user-supplied dictionary regex that is a likely ReDoS (catastrophic
+// backtracking) BEFORE compiling + running it on untrusted-length input. Heuristic,
+// not exhaustive: cap length, and reject the classic nested-quantifier families —
+// a quantified group whose body also has a quantifier ((a+)+ / (a*)* / (.*)+) and
+// back-to-back unbounded quantifiers (a**, .*+). A rejected pattern is skipped like a
+// syntactically-invalid one, so redaction never breaks or hangs.
+function isSafeUserPattern(p) {
+  if (typeof p !== 'string' || p.length === 0 || p.length > 200) return false;
+  if (/\([^)]*[+*}][^)]*\)\s*[+*{]/.test(p)) return false; // (…quantifier…)quantifier
+  if (/[+*]\s*[+*]/.test(p)) return false;                  // a**, a+*, .*+
+  return true;
+}
+
+// Apply many find/replace rules in a SINGLE left-to-right pass over the source.
+// Each rule is { re: <global RegExp>, repl: (match) => string }. Unlike running
+// rule[0].replace then rule[1].replace then …, text emitted by one rule is NEVER
+// re-scanned by a later rule — so substitutions can't cascade (e.g. a pseudonym
+// that happens to equal another entry's input). On a tie at the same position the
+// earlier rule wins (rules carry priority by their order in the array).
+function applyRulesOnce(text, rules) {
+  if (!rules || rules.length === 0) return text;
+  let out = '';
+  let pos = 0;
+  const n = text.length;
+  while (pos <= n) {
+    let best = null;
+    let bestRule = null;
+    for (const rule of rules) {
+      rule.re.lastIndex = pos;
+      const m = rule.re.exec(text);
+      if (m && (best === null || m.index < best.index)) {
+        best = m;
+        bestRule = rule;
+        if (m.index === pos) break; // nothing can start earlier than the cursor
+      }
+    }
+    if (!best) { out += text.slice(pos); break; }
+    out += text.slice(pos, best.index);
+    if (best[0].length === 0) { // pathological empty match — emit a char, advance
+      out += text[best.index] ?? '';
+      pos = best.index + 1;
+    } else {
+      out += bestRule.repl(best);
+      pos = best.index + best[0].length;
+    }
+  }
+  return out;
+}
+
 function luhnValid(digits) {
   let sum = 0;
   let alt = false;
@@ -84,19 +135,42 @@ function luhnValid(digits) {
   return sum % 10 === 0;
 }
 
+// Plausible IPv6? Controls false positives from the broad IPV6 regex: accept only a
+// `::`-compressed form (≥1 hextet) or a full 8-hextet address, hextets ≤4 hex digits.
+function isLikelyIpv6(s) {
+  if (!/^[0-9A-Fa-f:]+$/.test(s) || (s.match(/:/g) || []).length < 2) return false;
+  const parts = s.split(':');
+  if (parts.some((p) => p.length > 4)) return false;
+  if (s.includes('::')) return parts.filter(Boolean).length >= 1 && parts.filter(Boolean).length <= 7;
+  return parts.length === 8 && parts.every((p) => p.length >= 1);
+}
+
 // Deterministic detectors. Each: { type, re, valid? }. Order = priority; more
 // specific patterns run first so they win the bytes before greedier ones.
 const DETECTORS = [
+  // PEM private-key block (multi-line) — highest priority, most specific.
+  { type: 'SECRET', re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9]+ )*PRIVATE KEY-----/g },
   { type: 'EMAIL', re: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g },
-  { type: 'SSN', re: /\b\d{3}-\d{2}-\d{4}\b/g },
+  // SSN: dash- OR space-separated (bare 9-digit is left alone — too false-positive-prone).
+  { type: 'SSN', re: /\b\d{3}[-\s]\d{2}[-\s]\d{4}\b/g },
   {
+    // Vendor API keys / tokens. sk-… also covers OpenAI sk-proj-/sk-ant-. Adds Google
+    // (AIza…), Stripe (sk_live_/rk_test_…), GitHub fine-grained PATs, Slack xapp-.
     type: 'KEY',
-    re: /\b(?:sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g,
+    re: /\b(?:sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[0-9A-Za-z_]{22,}|xox[baprs]-[A-Za-z0-9-]{10,}|xapp-[0-9]-[A-Za-z0-9-]{10,}|AIza[0-9A-Za-z_-]{35}|[rs]k_(?:live|test)_[0-9A-Za-z]{16,})\b/g,
   },
+  // JWT — three base64url segments; `eyJ` is base64 of `{"…`, so this is specific.
+  { type: 'KEY', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g },
   {
     type: 'IP',
     re: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g,
   },
+  {
+    // IPv6 (incl. :: compression). Broad match narrowed by isLikelyIpv6 to curb FPs.
+    type: 'IP',
+    re: /(?<![:\w])(?:[0-9A-Fa-f]{0,4}:){2,7}[0-9A-Fa-f]{0,4}(?![:\w])/g,
+    valid: (m) => isLikelyIpv6(m),
+  },
   {
     // Phone: only count it if it has a separator or a leading + and 7–15 digits —
     // so long bare ids (a 11-digit page id, an order number) are NOT redacted.
@@ -124,9 +198,16 @@ export function redactText(text, vault, {
   tier = 'basic',
   entities = [],
   dictionary = [],
+  sanitize = true,
+  sanitizeOpts = undefined,
 } = {}) {
   if (text == null || text === '') return text;
-  let out = String(text);
+  // De-steganography BEFORE detection, in-band: an obfuscated value
+  // (j<ZWSP>o<ZWSP>hn@x.com, homoglyphs, ASCII-smuggled Tag chars) must become
+  // matchable so the regex/NER can't be trivially bypassed. Callers used to have to
+  // remember to stripHidden() first; folding it in here makes the engine safe on its
+  // own — the sanitize:false escape hatch is only for a caller that already did it.
+  let out = sanitize ? stripHidden(String(text), sanitizeOpts) : String(text);
   const v = vault || createVault();
 
   const entityTier = tier === 'full' || tier === 'entities';
@@ -135,25 +216,33 @@ export function redactText(text, vault, {
   //    An entry with `alias` PSEUDONYMIZES: permanent substitution (the model and
   //    the user's transcript both see the alias, never reversed). Otherwise it
   //    REDACTS to a reversible [[TYPE_n]] placeholder restored in the user's view.
+  //    All entries are applied in ONE pass (applyRulesOnce): an alias produced by
+  //    one entry must not be re-matched by a later entry, or substitutions cascade
+  //    (e.g. value 'Arnav'→alias 'John' then 'John' caught by a later 'John' rule).
+  const dictRules = [];
   for (const d of dictionary || []) {
     if (!d) continue;
+    let re;
     try {
-      const re = d.pattern
-        ? new RegExp(d.pattern, d.flags && /g/.test(d.flags) ? d.flags : `${d.flags || ''}g`)
+      re = d.pattern
+        ? (isSafeUserPattern(d.pattern) ? new RegExp(d.pattern, d.flags && /g/.test(d.flags) ? d.flags : `${d.flags || ''}g`) : null)
         : (d.value ? new RegExp(`(?<![\\w])${escapeRegex(d.value)}(?![\\w])`, 'gi') : null);
-      if (!re) continue;
-      if (d.alias != null && d.alias !== '') {
-        out = out.replace(re, () => d.alias); // pseudonymize: model + reply see the alias…
-        // …but record alias→original so LOCAL tool args (history/meeting search) map
-        // back to the real value. Local lookups must hit real data; only the model is blinded.
-        if (d.value) v.aliases.set(d.alias, d.value);
-      } else {
-        out = out.replace(re, (m) => tokenFor(v, d.type || (d.pattern ? 'PII' : 'TERM'), d.pattern ? m : d.value));
-      }
     } catch {
-      /* a bad user regex must never break redaction */
+      re = null; // a bad user regex must never break redaction
+    }
+    if (!re) continue;
+    if (d.alias != null && d.alias !== '') {
+      // pseudonymize: model + reply see the alias…
+      // …but record alias→original so LOCAL tool args (history/meeting search) map
+      // back to the real value. Local lookups must hit real data; only the model is blinded.
+      if (d.value) v.aliases.set(d.alias, d.value);
+      dictRules.push({ re, repl: () => d.alias });
+    } else {
+      const type = d.type || (d.pattern ? 'PII' : 'TERM');
+      dictRules.push({ re, repl: (m) => tokenFor(v, type, d.pattern ? m[0] : d.value) });
     }
   }
+  out = applyRulesOnce(out, dictRules);
 
   // 2) Known entities (full tier) — longest value first so "Alex Rivera" wins
   //    before a bare "Alex". Restores to the canonical entity value.
@@ -166,13 +255,61 @@ export function redactText(text, vault, {
     }
   }
 
-  // 3) Deterministic detectors (all tiers).
+  // 3) Deterministic detectors (all tiers). Detect against a CONFUSABLES SKELETON so
+  //    homoglyph-obfuscated values (Cyrillic/Greek/fullwidth Latin look-alikes) match
+  //    the ASCII regexes — but REDACT the ORIGINAL span. The fold is 1:1 per code point,
+  //    so a skeleton match's indices line up with `out`, and legitimate non-Latin text
+  //    (which won't match a detector) is never rewritten. Higher-priority detectors
+  //    (earlier in DETECTORS) claim overlapping spans first, matching the old order.
+  const skel = confusablesSkeleton(out);
+  const taken = []; // non-overlapping [start,end) spans, in priority order
+  const overlaps = (s, e) => taken.some((t) => s < t.end && e > t.start);
   for (const det of DETECTORS) {
-    out = out.replace(det.re, (m) => (!det.valid || det.valid(m) ? tokenFor(v, det.type, m) : m));
+    det.re.lastIndex = 0;
+    let m;
+    while ((m = det.re.exec(skel)) !== null) {
+      if (m[0].length === 0) { det.re.lastIndex++; continue; }
+      const start = m.index, end = start + m[0].length;
+      if ((det.valid && !det.valid(m[0])) || overlaps(start, end)) continue;
+      taken.push({ start, end, type: det.type });
+    }
+  }
+  if (taken.length) {
+    taken.sort((a, b) => a.start - b.start);
+    let rebuilt = '';
+    let pos = 0;
+    for (const t of taken) {
+      rebuilt += out.slice(pos, t.start) + tokenFor(v, t.type, out.slice(t.start, t.end));
+      pos = t.end;
+    }
+    out = rebuilt + out.slice(pos);
   }
   return out;
 }
 
+// Re-redact a tool RESULT before the model sees it, walking the shapes tools
+// actually return: a bare string, a { text } object, an array, and the
+// MCP-standard { content: [{ type:'text', text }] } (incl. an embedded
+// { resource: { text } }). Only text-bearing fields are redacted — arbitrary
+// fields (ids, urls, mime types) are left intact so tool results stay valid.
+// Restore is the inverse concern; this only runs on the model-facing direction.
+export function redactResultShape(raw, vault, opts) {
+  if (raw == null || typeof raw === 'string') {
+    return raw == null ? raw : redactText(raw, vault, opts);
+  }
+  if (Array.isArray(raw)) return raw.map((r) => redactResultShape(r, vault, opts));
+  if (typeof raw === 'object') {
+    let out = raw;
+    if (typeof raw.text === 'string') out = { ...out, text: redactText(raw.text, vault, opts) };
+    if (Array.isArray(raw.content)) out = { ...out, content: raw.content.map((c) => redactResultShape(c, vault, opts)) };
+    if (raw.resource && typeof raw.resource === 'object' && typeof raw.resource.text === 'string') {
+      out = { ...out, resource: { ...raw.resource, text: redactText(raw.resource.text, vault, opts) } };
+    }
+    return out;
+  }
+  return raw;
+}
+
 // Swap placeholders back to their originals. Unknown tokens are left untouched.
 export function restoreText(text, vault) {
   if (text == null || !vault) return text;
@@ -188,9 +325,15 @@ export function restoreText(text, vault) {
 export function restoreWithAliases(text, vault) {
   let out = restoreText(text, vault);
   if (vault?.aliases?.size) {
-    for (const [alias, real] of vault.aliases) {
-      if (!alias) continue;
-      out = out.replace(new RegExp(`(?<![\\w])${escapeRegex(alias)}(?![\\w])`, 'g'), () => real);
+    // ONE pass over every alias at once. Looping `replace` per alias re-scans the
+    // output and cascades when one alias's real value equals another alias (e.g.
+    // 'Twinkle'→'John' then 'John'→'Arnav'): the model's "Twinkle" would walk the
+    // chain to "Arnav". A single alternation replaces each span exactly once.
+    // Longest alias first so a multi-word pseudonym wins over its prefix.
+    const aliases = [...vault.aliases.keys()].filter(Boolean).sort((a, b) => b.length - a.length);
+    if (aliases.length) {
+      const re = new RegExp(`(?<![\\w])(?:${aliases.map(escapeRegex).join('|')})(?![\\w])`, 'g');
+      out = out.replace(re, (m) => (vault.aliases.has(m) ? vault.aliases.get(m) : m));
     }
   }
   return out;

package/pipeline.js

@@ -5,27 +5,24 @@
 // What lives HERE (portable): redactOutbound, redactToolResult/redactResult,
 // makeStreamRestorer, restore/restoreDeep, effectiveTier + gating.
 //
-// What stays in the EXTENSION (host glue, NOT here): reading
-// settings.ui.piiRedaction, the module-level Pro entitlement, and chrome storage.
-// Those wrap these pure functions with host-specific config.
+// Host glue kept in the EXTENSION (NOT here): reading settings.ui.piiRedaction,
+// the entitlement flag, and chrome storage — those wrap these pure functions with
+// host-specific config.
 
-import { redactText, restoreText, restoreWithAliases } from './pii-redact.js';
+import { redactText, restoreText, restoreWithAliases, redactResultShape } from './pii-redact.js';
 
 export function redactionEnabled(cfg) {
   return !!(cfg && cfg.mode && cfg.mode !== 'off');
 }
 
-// The entity (name/org) tier is Pro; Free silently falls back to deterministic
-// regex so the feature still does something useful without the upsell breaking.
+// The entity (name/org) tier is Pro; Free falls back to the deterministic regex tier.
 export function effectiveTier(cfg, isPro) {
   const t = cfg?.tier === 'full' ? 'full' : 'basic';
   return t === 'full' && !isPro ? 'basic' : t;
 }
 
-// Free ceiling: a small taste of the custom dictionary. The first FREE_DICT_LIMIT
-// entries apply; an unlimited dictionary (plus wider scope and the model layer) is
-// Pro. Enforced here as defense-in-depth — the UI also surfaces the cap, but never
-// trust the UI alone.
+// On Free the first FREE_DICT_LIMIT custom-dictionary entries apply; the full
+// dictionary is Pro. Enforced here as well as in the UI.
 export const FREE_DICT_LIMIT = 5;
 
 export function gatedDictionary(cfg, isPro) {
@@ -122,10 +119,11 @@ export function restoreDeep(value, vault) {
   return value;
 }
 
+// Re-redact a tool result of any shape (string / { text } / array / MCP
+// { content:[{text}] }), gated once by the toolResults scope. The old path only
+// covered string + { text }, so PII in a content[] item reached the model.
 export function redactResult(result, ctx) {
-  if (typeof result === 'string') return redactToolResult(result, ctx);
-  if (result && typeof result === 'object' && typeof result.text === 'string') {
-    return { ...result, text: redactToolResult(result.text, ctx) };
-  }
-  return result;
+  const { vault, cfg, isPro = false, entities = [] } = ctx || {};
+  if (!redactionEnabled(cfg) || !vault || !gatedScope(cfg, isPro).toolResults) return result;
+  return redactResultShape(result, vault, redactOpts(cfg, isPro, entities));
 }

package/sanitize.js

@@ -129,5 +129,43 @@ export function stripHidden(text, opts) {
   return sanitizeUnicode(text, opts).clean;
 }
 
+// ── Confusables skeleton ─────────────────────────────────────────────────────
+// Fold single-code-point Latin LOOK-ALIKES (Cyrillic / Greek / fullwidth) to their
+// ASCII skeleton so a homoglyph-obfuscated value (jоhn@x.com with a Cyrillic 'о')
+// becomes matchable by the ASCII regexes. STRICTLY 1:1 per code point — every mapping
+// is one char → one char — so a match's indices in the skeleton line up exactly with
+// the original text. Use it for DETECTION only and redact the ORIGINAL span, so
+// legitimate Cyrillic/Greek/CJK text is never rewritten (only deceptively-Latin
+// values that actually match a detector get touched). Built from numeric code points
+// (no literal confusables in source, like the rest of this module).
+const CONFUSABLE = new Map([
+  // Cyrillic lowercase → Latin
+  [0x0430, 'a'], [0x0435, 'e'], [0x043E, 'o'], [0x0440, 'p'], [0x0441, 'c'],
+  [0x0443, 'y'], [0x0445, 'x'], [0x0455, 's'], [0x0456, 'i'], [0x0458, 'j'],
+  [0x04BB, 'h'], [0x043C, 'm'], [0x043D, 'h'], [0x0442, 't'], [0x043A, 'k'],
+  // Cyrillic uppercase → Latin
+  [0x0410, 'A'], [0x0412, 'B'], [0x0415, 'E'], [0x041A, 'K'], [0x041C, 'M'],
+  [0x041D, 'H'], [0x041E, 'O'], [0x0420, 'P'], [0x0421, 'C'], [0x0422, 'T'],
+  [0x0425, 'X'], [0x0406, 'I'], [0x0408, 'J'], [0x0405, 'S'],
+  // Greek → Latin
+  [0x03BF, 'o'], [0x03C1, 'p'], [0x03B1, 'a'], [0x03BD, 'v'], [0x03B9, 'i'],
+  [0x0391, 'A'], [0x0392, 'B'], [0x0395, 'E'], [0x0396, 'Z'], [0x0397, 'H'],
+  [0x0399, 'I'], [0x039A, 'K'], [0x039C, 'M'], [0x039D, 'N'], [0x039F, 'O'],
+  [0x03A1, 'P'], [0x03A4, 'T'], [0x03A5, 'Y'], [0x03A7, 'X'],
+]);
+
+export function confusablesSkeleton(text) {
+  if (typeof text !== 'string' || text === '') return text ?? '';
+  let out = '';
+  for (const ch of text) {
+    const cp = ch.codePointAt(0);
+    if (cp >= 0xFF01 && cp <= 0xFF5E) { out += String.fromCharCode(cp - 0xFEE0); continue; } // fullwidth ASCII
+    const mapped = CONFUSABLE.get(cp);
+    out += mapped != null ? mapped : ch;
+  }
+  return out;
+}
+
 // Exposed for tests / external auditing.
 export const SANITIZE_RANGES = RANGES;
+export const CONFUSABLE_MAP = CONFUSABLE;

package/tool-harness.js

@@ -17,9 +17,9 @@
 // Self-contained on the SYNCED engine files (pii-redact.js, tool-rank.js), so the
 // extension (browser ESM) and the gateway (npm) run the exact same code. The caller
 // passes the already-gated `redactOpts` ({tier, entities, dictionary}) it computed
-// from cfg+isPro — keeping tier/dictionary Pro-gating out of the harness.
+// from cfg+isPro — tier/dictionary selection stays out of the harness.
 
-import { restoreText, restoreWithAliases, redactText } from './pii-redact.js';
+import { restoreText, restoreWithAliases, redactResultShape } from './pii-redact.js';
 import { narrowSpecs } from './tool-rank.js';
 
 // MCP / remote tools are server-prefixed (mcp_server__tool). Local tools
@@ -77,12 +77,19 @@ export function placeholderToolNote({ toolData = 'real' } = {}) {
   return intro + remote + rules;
 }
 
-export function makeToolHarness({ vault = null, toolData = 'real', redactOpts = null, redactResults = true } = {}) {
+export function makeToolHarness({ vault = null, toolData = 'real', redactOpts = null, redactResults = true, remoteTools = null } = {}) {
   const on = !!vault;                       // privacy enabled for this turn?
   const redactRemote = toolData === 'redactRemote';
+  // How we decide a tool is REMOTE (must not receive real PII under redactRemote).
+  // Prefer an EXPLICIT set/predicate the caller derived from the toolset (a remote
+  // tool not named mcp_* would otherwise be misclassified as local and get real
+  // values); fall back to the mcp_* name heuristic when the caller passes nothing.
+  const isRemoteTool = typeof remoteTools === 'function' ? remoteTools
+    : (remoteTools instanceof Set ? (name) => remoteTools.has(name)
+      : isRemoteToolName);
   return {
     enabled: on,
-    isRemoteTool: isRemoteToolName,
+    isRemoteTool,
 
     // ⓪ Always-on tool selection (privacy-independent). `available` is any spec
     // list; `opts` forwards { cap, keep, name, description } to the shared ranker.
@@ -93,18 +100,16 @@ export function makeToolHarness({ vault = null, toolData = 'real', redactOpts =
     // ② What the tool receives.
     toTool(name, args) {
       if (!on) return args;                                    // privacy off → already real
-      if (redactRemote && isRemoteToolName(name)) return args;  // keep PII off remote MCP
+      if (redactRemote && isRemoteTool(name)) return args;      // keep PII off remote MCP
       return restoreToolArgs(args, vault);                      // real values for the tool
     },
 
-    // ③ What the model sees back (re-redacted). Handles a string or a { text } shape.
+    // ③ What the model sees back (re-redacted). Walks string / { text } / array /
+    // MCP { content:[{text}] } shapes so a tool result can't leak PII to the model
+    // via a nested field the old string/{text}-only path skipped.
     toModelResult(name, raw) {
       if (!on || !redactResults || !redactOpts) return raw;
-      if (typeof raw === 'string') return redactText(raw, vault, redactOpts);
-      if (raw && typeof raw === 'object' && typeof raw.text === 'string') {
-        return { ...raw, text: redactText(raw.text, vault, redactOpts) };
-      }
-      return raw;
+      return redactResultShape(raw, vault, redactOpts);
     },
 
     // ④ The final reply the user sees.