@chatpanel/pii 0.7.0 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/pii",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "The canonical ChatPanel privacy engine \u2014 reversible PII redaction + pseudonymization with local entity detection. Pure, dependency-free ESM shared by the ChatPanel extension, gateway, and bridge.",
   "type": "module",
   "main": "index.js",

package/pii-detect.js

@@ -244,6 +244,24 @@ const hostOf = (u) => { try { return new URL(String(u)).host; } catch { return '
 export async function detectEntities(text, cfg, { signal, fetchImpl = globalThis.fetch, strict = false, structured = NO_STRUCTURE, onEgress = null } = {}) {
   const det = cfg?.detection;
   if (!det || !det.backend || det.backend === 'off' || !det.url || typeof fetchImpl !== 'function') return [];
+  // AN IN-PROCESS DETECTOR SENDS NOTHING ANYWHERE, so the network guard below must not
+  // judge it by a URL it never dials.
+  //
+  // This is not a hypothetical. A host that runs the model in its own process passes a
+  // sentinel URL and a fetchImpl that ignores it entirely — and the sentinel failed the
+  // http(s) scheme check, threw, and was swallowed by the fail-open path. The result was a
+  // detector that reported itself ready, answered its own health route correctly, and
+  // contributed NOTHING to a single redaction: names, organisations and places went to the
+  // model in full while the UI said full tier.
+  //
+  // The opt-out is deliberately narrow. It requires the caller to have supplied its OWN
+  // fetch, so a `transport: 'in-process'` line in a config file cannot turn the SSRF guard
+  // off for a real network address — without an injected transport there is no in-process
+  // anything, and the flag is refused rather than honoured.
+  const inProcess = det.transport === 'in-process';
+  if (inProcess && fetchImpl === globalThis.fetch) {
+    throw new Error("detection.transport 'in-process' needs an injected fetch; refusing to treat a network call as in-process");
+  }
   const capped = String(text || '').slice(0, det.maxChars || 8000);
   if (capped.trim().length < 8) return [];
   const key = cacheKey(capped, det);
@@ -255,12 +273,12 @@ export async function detectEntities(text, cfg, { signal, fetchImpl = globalThis
     // only, never cloud metadata. Loopback/LAN allowed — a local NER server / Ollama
     // is the normal case. A blocked URL fails open (deterministic-only), or surfaces
     // to the Test button in strict mode.
-    assertEndpointUrl(det.url);
+    if (!inProcess) assertEndpointUrl(det.url);
     const t0 = Date.now();
     try {
       ents = await withTimeout(run(capped, det, signal, fetchImpl, structured), det.timeoutMs || 1500, signal);
-      report(onEgress, det, capped, t0, ents.length, null);
-    } catch (e) { report(onEgress, det, capped, t0, 0, e); throw e; }
+      if (!inProcess) report(onEgress, det, capped, t0, ents.length, null);
+    } catch (e) { if (!inProcess) report(onEgress, det, capped, t0, 0, e); throw e; }
   } catch (e) {
     if (strict) throw e; // surface errors to the Test button
     ents = []; // otherwise fail open — deterministic redaction still applies

package/tool-harness.js

@@ -46,7 +46,15 @@ export function restoreToolArgs(value, vault) {
 // [[LOCATION_1]] token as redacted and REFUSE to use it for a lookup ("I can't see
 // your real city") — the opposite of what we want. Weak models call the tool blindly
 // and it works (the harness restores the real value), so the note levels them up.
-export function placeholderToolNote({ toolData = 'real' } = {}) {
+//
+// `ownTools`: the model is a relayed CLI agent that brings tools of ITS OWN (Codex's web
+// search, a shell, files). Those run on the far side of the harness and receive the
+// placeholder LITERALLY — a search for "[[ORG_1]] stock price" finds nothing, and the agent
+// reports that "the lookup did not resolve the company". Seen exactly so, on the desktop:
+// Codex chose its own web search over ChatPanel's `find` on one turn and answered from
+// nothing. The extra sentence says which tools restore and which do not, so the choice is
+// no longer a coin toss.
+export function placeholderToolNote({ toolData = 'real', ownTools = false } = {}) {
   const intro =
     'PRIVACY PLACEHOLDERS: some values in this conversation are tokens like [[PERSON_1]], '
     + '[[LOCATION_1]], [[ORG_1]] that stand in for the user\'s real private data. ';
@@ -74,7 +82,14 @@ export function placeholderToolNote({ toolData = 'real' } = {}) {
     + 'Do NOT ask the user to re-type the value and do NOT refuse on privacy grounds — the lookup '
     + 'will work. The real values are restored in your final answer automatically, so write your '
     + 'answer using the placeholders too.';
-  return intro + remote + rules;
+  const own = ownTools
+    ? ' ONLY THE TOOLS LISTED IN THIS CONVERSATION restore placeholders. Any tool you bring '
+      + 'yourself — your own web search, shell, file or code tools — receives the placeholder '
+      + 'text literally and will find nothing. So for ANY lookup that involves a placeholder, '
+      + 'call the listed tool (for example `find` with action `web_search` or `history_search`) '
+      + 'rather than your own; use your own tools only for things that involve no placeholder.'
+    : '';
+  return intro + remote + rules + own;
 }
 
 // Tools whose results come from the PUBLIC web rather than from the user's own machine or