@medusasec/sensitive-spans 0.1.0

package/dist/merge-spans.js

@@ -0,0 +1,45 @@
+// Merge detected spans from multiple layers (the in-browser ONNX model and the
+// deterministic regex pack) into a single list.
+//
+// Rules:
+//   • Same-category spans that overlap collapse to the higher-confidence one,
+//     so a key both layers catch isn't flagged twice.
+//   • Spans of *different* categories are both kept, even when they overlap.
+//     The banner takes the strictest action across every detected category, and
+//     the user should see all of them. This is what lets the deterministic
+//     regex SECRET span survive when the model labels the same text CODE — e.g.
+//     an API key buried in a long paste that the model only sees as "code".
+//
+// Pure + dependency-free so it can be unit-tested off the service worker.
+// A "degenerate" span carries <3 alphanumeric chars — e.g. a broken model
+// WordPiece like "t" (from "st"). It's useless as evidence and must never win a
+// merge over a real, meaningful span (e.g. the full "9000 jane st" address).
+const spanChars = (s) => String((s && s.text) || "").replace(/[^\p{L}\p{N}]/gu, "").length;
+const isDegenerate = (s) => spanChars(s) < 3;
+
+export function mergeSpans(...lists) {
+  const out = [];
+  for (const list of lists) {
+    for (const s of list || []) {
+      const cat = String(s.category || "").toUpperCase();
+      const i = out.findIndex(
+        (o) =>
+          String(o.category || "").toUpperCase() === cat &&
+          s.start < o.end &&
+          s.end > o.start,
+      );
+      if (i === -1) {
+        out.push(s);
+      } else {
+        // Overlap, same category → keep the better representative. A meaningful
+        // span always beats a degenerate fragment; otherwise, higher confidence.
+        const inDeg = isDegenerate(out[i]);
+        const chDeg = isDegenerate(s);
+        if (inDeg && !chDeg) out[i] = s;
+        else if (!inDeg && chDeg) { /* keep the meaningful incumbent */ }
+        else if ((s.confidence ?? 0) > (out[i].confidence ?? 0)) out[i] = s;
+      }
+    }
+  }
+  return out;
+}

package/dist/policy-decision.js

@@ -0,0 +1,480 @@
+// The canonical "what do we do with these detected spans" decision, shared by
+// the service worker and unit-tested in isolation.
+//
+// Two independent controls decide whether a category is enforced:
+//   1. settings.enabledCategories[CAT]  — the per-category on/off toggle
+//      (user setting; the org can lock it). OFF here = never flagged.
+//   2. policy.category_actions[cat] === "off"  — the ORG turned this category
+//      off from the dashboard. OFF here = never flagged (silently allowed),
+//      even if the local toggle is on.
+// A span survives only if BOTH say the category is on AND it clears the
+// confidence floor. Surviving spans then get an action (block/warn/coach).
+//
+// Pure + dependency-free so it runs under node:test.
+
+// Standalone dates/timestamps and OCR garbage are frequently mislabeled PII by
+// the model (e.g. the clock baked into a screenshot). A PII span is "noise" if,
+// once date/time words are stripped, nothing that resembles a real entity is
+// left — no alphabetic token of 3+ letters and no run of 4+ digits. Structured
+// PII (email, SSN, phone, cards) always keeps a real token or a long digit run,
+// so this never drops legitimate detections — only bare dates and OCR garble.
+const DATE_WORDS =
+  /\b(?:jan|feb|mar|apr|may|jun|jul|aug|sep|oct|nov|dec)[a-z]*\b|\b(?:mon|tue|wed|thu|fri|sat|sun)[a-z]*\b|\b(?:at|am|pm|gmt|utc|on|the|today|yesterday|tomorrow)\b/gi;
+
+// INTENT categories (dual-head sequence head): whole-text properties, not
+// discrete values. They must never resolve to `mask` (nothing to redact — a
+// whole-text mask blanks the prompt), so actionForSpans downgrades mask→block
+// for them. Kept in lowercase to match category_actions keys.
+const INTENT_CATEGORIES = new Set(["injection", "code"]);
+
+export function isNoisyPii(text) {
+  const raw = String(text || "");
+  const stripped = raw
+    .replace(/\b(?:19|20)\d{2}\b/g, " ") // 4-digit years (would otherwise look like a number)
+    .replace(/\d{1,2}:\d{2}(?::\d{2})?/g, " ") // clock times
+    .replace(DATE_WORDS, " ");
+  const hasWord = /[a-z]{3,}/i.test(stripped);
+  const hasNumber = /\d{4,}/.test(stripped); // SSN/phone tail/card group survive; bare dates don't
+  if (!hasWord && !hasNumber) return true; // bare date/timestamp
+
+  // OCR garbage guard: a screenshot that includes browser chrome (tab titles,
+  // bookmarks bar) OCRs into a soup of 1-2 char fragments and symbol runs —
+  // "e C ) lz) cost » (24) fA Marr f*®" — which the model can mislabel as PII.
+  // A GENUINE identifier always survives (isNoisyOcrText escapes on one).
+  return isNoisyOcrText(raw);
+}
+
+// Is `text` OCR "chrome soup"? A full-screen screenshot uploaded to an AI OCRs
+// the tab titles + bookmarks bar + toolbar glyphs into a run of ≥4 tokens that is
+// dominated by lone characters, symbol-bearing fragments (» ® © * parens), or
+// short non-word/non-number junk. The model can mislabel that soup as PII / CODE /
+// INJECTION. A GENUINE identifier (email/SSN/phone/card/address) means it is NOT
+// soup, so real leaks buried in a screenshot are never suppressed by this.
+export function isNoisyOcrText(text) {
+  const raw = String(text || "");
+  if (hasGenuineIdentifier(raw)) return false;
+  const toks = raw.trim().split(/\s+/).filter(Boolean);
+  if (toks.length < 4) return false;
+  // "fragments": lone single characters and tokens carrying stray symbols —
+  // real names/addresses/words don't produce these.
+  const fragments = toks.filter(
+    (t) => t.length === 1 || /[^\p{L}\p{N}.,'\-@]/u.test(t),
+  ).length;
+  // "junk": neither a 3+ letter word nor a 3+ digit number.
+  const junk = toks.filter(
+    (t) => !/^\p{L}{3,}$/u.test(t) && !/^\p{N}{3,}$/u.test(t),
+  ).length;
+  return (fragments >= 3 && fragments / toks.length >= 0.25) || junk / toks.length >= 0.6;
+}
+
+// Trim leading/trailing non-alphanumeric junk and collapse whitespace, so the
+// evidence chip/preview shows clean text. Only ever used for display — never for
+// matching or the approval hash.
+export function cleanSpanText(text) {
+  return String(text || "")
+    .replace(/\s+/g, " ")
+    .split(" ")
+    .filter((t) => /[\p{L}\p{N}]/u.test(t)) // drop pure-symbol tokens (OCR noise: » ) *®)
+    .join(" ")
+    .replace(/^[^\p{L}\p{N}]+/u, "")
+    .replace(/[^\p{L}\p{N}]+$/u, "")
+    .trim();
+}
+
+// A GENUINE leak-risk identifier: email / SSN / card / IBAN / passport-or-license /
+// phone or long digit run / street address. Used to gate PII findings from IMAGE OCR,
+// where a screenshot of browser chrome / an app UI OCRs into a list of bare words that
+// the model mislabels PII. Bare names/labels are low-risk anyway; a real identifier is
+// the actual leak — and those survive OCR well (verified ~97% even on degraded scans).
+const GENUINE_ID_RE = new RegExp(
+  [
+    /[\w.+-]+@[\w-]+\.\w+/, // email
+    /\b\d{3}[- .]?\d{2}[- .]?\d{4}\b/, // SSN
+    /\b(?:\d[ -]?){13,19}\b/, // card
+    /\b[a-z]{2}\d{2}[a-z0-9]{10,}\b/, // IBAN
+    /\b[a-z]{1,2}\d{6,9}\b/, // passport / license
+    /(?:\d[\s().\-]{0,2}){6,}\d/, // phone (7+ digits, allows "(415) 555-0192")
+    /\b\d{7,}\b/, // long account / id
+    /\b\d{1,5}\b[^,\n]{0,32}\b(?:street|st|avenue|ave|court|ct|road|rd|lane|ln|drive|dr|way|place|pl|blvd|terrace|ridge|circle|square|highway|hwy)\b/, // street address
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "i", // one flag for the whole set (street words + IBAN/passport are letter-agnostic in OCR)
+);
+export function hasGenuineIdentifier(text) {
+  return GENUINE_ID_RE.test(String(text || ""));
+}
+
+// Positive evidence that text is actually source code — real keywords, loaded
+// operators, call/def syntax, markup tags, or control flow. Used to gate CODE
+// findings from IMAGE OCR: a screenshot of browser chrome / an app UI OCRs into a
+// soup of short words (tab titles, bookmark names, toolbar glyphs) the model can
+// mislabel CODE. A real code screenshot carries this structure; browser chrome
+// does not. Text/PDF/DOCX code is unaffected — this gate only applies to images.
+const CODE_SIGNAL_RE = new RegExp(
+  [
+    /\b(?:function|const|let|var|def|class|import|export|return|public|private|protected|static|void|async|await|lambda|struct|interface|namespace|require|typedef|extends|implements|println|printf)\b/,
+    /=>|===|!==|\+=|-=|\*=|::|\|\||&&|->|<<|>>/, // multi-char / loaded operators
+    /\b[A-Za-z_$][\w$]*\s*\([^)]*\)\s*[{;]/, // call/def followed by a body or terminator
+    /<\/[a-z][\w-]*>|<[a-z][\w-]*(?:\s[^<>]*)?\/>/i, // html/xml/jsx tag
+    /\b(?:if|for|while|switch|catch)\s*\(/, // control flow with a paren
+    /#include\b|#!\s*\/|<\?php|\bSELECT\b[\s\S]{1,200}\bFROM\b/i, // include / shebang / php / sql
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "i",
+);
+export function hasCodeSignal(text) {
+  return CODE_SIGNAL_RE.test(String(text || ""));
+}
+
+// Positive evidence that a SECRET span carries an actual credential — a known
+// key shape/prefix, a credential keyword next to a value, or a high-entropy
+// token. The model's token head sometimes labels ordinary prose SECRET on long
+// documents (e.g. "USD pp. Then beach hopping"); a real secret is never plain
+// English words. Deterministic regex secrets (sk-…, ghp_…) bypass this — they
+// carry deterministic=true and are already validated. Recall-safe: a genuine
+// key/token/password always matches one of these.
+const SECRET_PREFIX_RE = new RegExp(
+  [
+    /\b(?:sk|pk|rk)[-_](?:live|test|prod)[-_][A-Za-z0-9]{8,}/, // stripe-style
+    /\bsk-ant-[A-Za-z0-9_\-]{16,}/, // anthropic
+    /\bgh[posru]_[A-Za-z0-9]{20,}/, // github token
+    /\bgithub_pat_[A-Za-z0-9_]{20,}/,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,}/, // slack
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}/, // aws
+    /\bAIza[0-9A-Za-z_\-]{20,}/, // google api key
+    /\bya29\.[0-9A-Za-z_\-]{10,}/, // google oauth
+    /\bglpat-[0-9A-Za-z_\-]{16,}/, // gitlab
+    /\b(?:npm_|dop_v1_|shpat_|sq0csp-)[A-Za-z0-9_\-]{16,}/, // npm/digitalocean/shopify/square
+    /\beyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{4,}/, // JWT
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----/, // PEM private key
+    /\bwhsec_[A-Za-z0-9]{16,}/, // stripe webhook signing secret
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "i",
+);
+// A credential keyword immediately followed by a value ("password: hunter2",
+// "api_key = ...", "Wifi Password 87654321").
+const CRED_KEYWORD_RE =
+  /\b(?:pass(?:word|wd|phrase)?|secret|api[_\- ]?key|access[_\- ]?key|client[_\- ]?secret|private[_\- ]?key|auth[_\- ]?token|bearer)\b\s*[:=]?\s*\S{4,}/i;
+export function hasSecretSignal(text) {
+  const raw = String(text || "");
+  if (SECRET_PREFIX_RE.test(raw) || CRED_KEYWORD_RE.test(raw)) return true;
+  // High-entropy token: a long no-space run that isn't natural language. Real
+  // English words are short and single-class; a 24+ char run, or a 20+ char run
+  // mixing letters and digits, or a 32+ hex string, is key-shaped.
+  for (const tok of raw.split(/[\s"'`,;:()<>{}[\]]+/)) {
+    if (!/^[A-Za-z0-9_\-+/=.]+$/.test(tok)) continue;
+    if (tok.length >= 24) return true;
+    if (tok.length >= 20 && /[A-Za-z]/.test(tok) && /[0-9]/.test(tok)) return true;
+    if (/^[0-9a-f]{32,}$/i.test(tok)) return true;
+  }
+  return false;
+}
+
+// Positive evidence that an INSURANCE span is an actual data leak: a policy /
+// member / group / claim number (a digit-bearing identifier), a genuine PII
+// identifier, or any 4+ digit run. Abstract insurance talk ("third party
+// liability", "collision damage waiver coverage") is a topic, not sensitive
+// data, and the model mislabels it INSURANCE on long benign prose.
+const INSURANCE_ID_RE = new RegExp(
+  [
+    /\b(?:policy|member|subscriber|group|claim|certificate|plan|rx|bin|pcn)\b[^\n]{0,12}?[A-Z]{0,4}\d{3,}/i,
+    /\b[A-Z]{2,4}[- ]?\d{6,}\b/, // insurer id like BX-44718 / ABCD123456
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "i",
+);
+// Someone reading an ID out loud: three or more number-words in a row
+// ("begins eight-eight-two-two", "ends five-five-nine-oh"). Rare in ordinary
+// prose, and it is how people paraphrase an identifier they don't want to paste
+// verbatim — so it recovers the oblique member/claim IDs that carry no digits at
+// all, without admitting insurance TOPIC vocabulary.
+const SPELLED_NUMBER_RUN =
+  /\b(?:zero|oh|one|two|three|four|five|six|seven|eight|nine|ten)\b(?:[\s,-]+\b(?:zero|oh|one|two|three|four|five|six|seven|eight|nine|ten)\b){2,}/i;
+
+export function hasInsuranceSignal(text) {
+  const raw = String(text || "");
+  // A bare 4-digit run used to qualify, which meant any year or figure did —
+  // government reports and news are full of them, and 17% of the INSURANCE false
+  // positives measured on real prose rode in on that rule alone. Require a real
+  // identifier, an insurance-ID shape, a run long enough not to be a year, or a
+  // spelled-out identifier.
+  return (
+    hasGenuineIdentifier(raw) ||
+    INSURANCE_ID_RE.test(raw) ||
+    /\b\d{6,}\b/.test(raw) ||
+    SPELLED_NUMBER_RUN.test(raw)
+  );
+}
+
+// Positive evidence that a FINANCIAL span is actual financial data: a card / IBAN /
+// bank-account or routing number, or a money/account keyword next to a number. A
+// bare PRICE ("$12 USD per foreign adult", "90 usd pp") is NOT sensitive financial
+// data — it's a cost — yet the model mislabels prices, place names, and stray
+// words ("foreign", "Rebeca") FINANCIAL on long prose. Recall-safe: real financial
+// PII always carries an account/card number or a money keyword with a value.
+const FINANCIAL_SIGNAL_RE = new RegExp(
+  [
+    /\b(?:\d[ -]?){13,19}\b/, // card
+    /\b[a-z]{2}\d{2}[a-z0-9]{10,}\b/i, // IBAN
+    /\b\d{9,}\b/, // long account / routing number
+    /\b(?:account|acct|iban|swift|bic|routing|sort\s*code|ach|wire|balance|salary|wage|payroll|invoice|statement|ledger|deposit|withdrawal|transaction)\b[^\n]{0,20}\d/i,
+    /\b(?:visa|mastercard|amex|discover|cvv|cvc)\b/i,
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "i",
+);
+export function hasFinancialSignal(text) {
+  const raw = String(text || "");
+  return hasGenuineIdentifier(raw) || FINANCIAL_SIGNAL_RE.test(raw);
+}
+
+// A model span with almost no substance is noise, not a finding. The token head
+// emits ragged 1-3 character runs on long or non-English documents ("imp", "Ku",
+// "Has", "hoe") that surface as meaningless evidence chips. Measured over a
+// 12,000-row benign corpus, 21% of all false-positive chips were this shape.
+// A genuine value always carries more than a few characters — and anything that
+// looks like a real identifier escapes before the length test.
+const MIN_SPAN_ALNUM = 5;
+export function isDegenerateSpan(text) {
+  const raw = String(text || "");
+  if (hasGenuineIdentifier(raw)) return false;
+  return raw.replace(/[^\p{L}\p{N}]/gu, "").length < MIN_SPAN_ALNUM;
+}
+
+// Positive evidence that a HEALTH span is somebody's health DATA rather than a
+// health TOPIC. Discussing healthcare policy, psychology, or a medical concept
+// is not a leak; a patient record is. Every genuine health row in the corpus
+// carries at least one of: a person marker ("Patient X", "my wife", "dx:"), a
+// record identifier (MRN / DOB / chart), a drug with a dose, or a lab value with
+// units. Topic prose in news and government reports carries none of them — which
+// is why HEALTH was the single largest false-positive category (1,465 chips)
+// before this gate existed.
+const HEALTH_PERSON_RE =
+  /\b(?:patient|pt\b|my (?:wife|husband|mother|mom|father|dad|son|daughter|brother|sister|partner|kid)|his|her|their)\b|\bdx\s*[:=]|\bdiagnos(?:ed|is)\b|\bpresents with\b|\bchart\b|\breferral\b/i;
+const HEALTH_RECORD_RE =
+  /\bmrn\s*[:#]?\s*[\w-]+|\bdob\s*[:#]?\s*[\d/.-]+|\b\d{1,3}[\s-]*(?:y\/o|yo|yrs?[\s-]*old|year[\s-]*old)\b|\bsoap note\b|\bop note\b|\bcase report\b/i;
+const HEALTH_CLINICAL_RE = new RegExp(
+  [
+    /\b\d+(?:\.\d+)?\s*(?:mg|mcg|ml|iu|units?)\b/, // a drug with a dose
+    /\b(?:a1c|hba1c|egfr|bmi|ef|rf|psa|inr|cd4|ldl|hdl|tsh|crp|esr)\b\s*(?:of\s*)?[<>]?\s*\d/, // lab + value
+    /\bviral load\b|\bblood pressure\s*\d|\b\d{2,3}\/\d{2,3}\s*mmhg\b/, // vitals
+    /\bstage\s+(?:i{1,3}v?|\d)\b/, // cancer staging
+  ]
+    .map((r) => r.source)
+    .join("|"),
+  "i",
+);
+export function hasHealthSignal(text) {
+  const raw = String(text || "");
+  return (
+    hasGenuineIdentifier(raw) ||
+    HEALTH_RECORD_RE.test(raw) ||
+    HEALTH_CLINICAL_RE.test(raw) ||
+    HEALTH_PERSON_RE.test(raw)
+  );
+}
+
+// Context that legitimizes a SECRET / INSURANCE finding. The genuine-signal
+// guards below drop a model span whose own text carries no syntactic signal —
+// but a real secret can be OBLIQUE ("my aws key is A K I A 7…", a base64'd token,
+// "the passphrase is my dog's name") where the signal is in the surrounding words,
+// not the value. So a span is ALSO kept when its surrounding text contains
+// credential / insurance context. Benign prose (a travel itinerary) has neither
+// the signal nor the context, so it is still dropped; an adversarial obfuscated
+// secret is kept. Validated recall-first against 121k labeled rows: the only
+// SECRET rows this still drops are bare card numbers (caught by the deterministic
+// card detector + the FINANCIAL category instead). Multilingual on purpose
+// (contrase-, senha, passwort) so a foreign-language credential isn't missed.
+const SECRET_CONTEXT_RE =
+  /\b(?:api|key|keys|token|tokens|secret|secrets|password|passwords|passwd|passcode|passphrase|credential|credentials|creds|auth|bearer|oauth|ssh|webhook|env|login|vpn|pin|wifi|wi-fi|ssid|router|root|aws|github|gitlab|stripe|slack|sendgrid|twilio|mongo|postgres|database|connection\s*string|signing|access\s*key|private\s*key|client\s*secret|contrase|senha|passwort|mot\s*de\s*passe)\b/i;
+// NOTE: INSURANCE is gated on span-signal ONLY (a policy/member/claim number),
+// NOT on surrounding context. Unlike a secret, insurance data is only sensitive
+// when an actual identifier is present — "third party liability coverage" is a
+// topic, not a leak, yet sits amid insurance words. Context-gating would keep
+// that benign topic talk (common in rental/legal docs). The cost is reduced
+// recall on obliquely-stated member IDs, a low-value category for this product.
+
+// The span's own text plus a little of the text around it (model spans carry
+// char offsets into the full scanned text). Context lets the guard see credential
+// wording that sits next to an obfuscated value.
+const CONTEXT_PAD = 160;
+function spanContext(span, fullText) {
+  if (typeof fullText === "string" && fullText && Number.isFinite(span?.start)) {
+    const lo = Math.max(0, span.start - CONTEXT_PAD);
+    const hi = Math.min(fullText.length, (span.end ?? span.start) + CONTEXT_PAD);
+    return fullText.slice(lo, hi);
+  }
+  return String(span?.text || "");
+}
+
+// Is a MODEL PII span actually a fragment of ordinary prose, not an entity? On
+// long documents the token head mislabels runs of plain words PII ("…the
+// entrance. You must pre-purchase…", "30 minute", "90 usd pp Then beach
+// hopping"). This runs on the SPAN text (not the whole document): the model
+// labels function words / units as O when it is working correctly, so their
+// presence INSIDE a PII span is itself the tell that the span is a misfire. A
+// genuine PII value — name, email, phone, address, SSN — trips none of these,
+// and any real identifier escapes immediately. Three orthogonal signatures, all
+// of which a real entity lacks:
+//   A) crosses a sentence boundary (". " / "? " / "!" / "??")  — entities don't
+//   B) contains a prose function/modal word (you/must/then/…)  — names don't
+//      (the list excludes words that double as names: will, grace, may, june…)
+//   C) is only numbers + measurement/currency units (usd, pp, minute, km …)
+//   D) all-lowercase multi-word prose joined by a preposition, with NO capitalized
+//      name-token — "…stops for photos or wildlife sightings". A genuine PII entity
+//      the model spans is either capitalized (a name/place → not all-lowercase) or
+//      an identifier (escapes at the top). Prepositions only (NOT and/or, which
+//      join names: "john and mary"), so a lowercase multi-word name is untouched.
+const PII_PROSE_WORDS =
+  /\b(?:you|your|youre|youll|yours|must|then|because|would|should|could|please|weve|were|dont|doesnt|wont|cannot|well|theyre|weve|lets|dont|arent|isnt|whats|heres|theres)\b/i;
+const PII_UNIT_TOKEN =
+  /^(?:[$€£]?\d[\d.,:/%-]*|usd|eur|gbp|cad|pp|ea|min|mins|minute|minutes|hour|hours|hr|hrs|sec|secs|second|seconds|day|days|week|weeks|month|months|year|years|yr|yrs|am|pm|km|mi|mile|miles|kg|lb|lbs|ft|cm|mm|m|%|and|or|to|of|per|the|a|an)$/i;
+const PII_PREPOSITION = /\b(?:for|with|at|on|in|of|to|from|by|about|into|over|near|per|the)\b/i;
+export function isProsePii(text) {
+  const raw = String(text || "");
+  if (hasGenuineIdentifier(raw)) return false; // a real identifier is never prose
+  // A) an entity never spans a sentence break
+  if (/[.?!]["')\]]?\s+\S|[?!]{2,}/.test(raw.trim())) return true;
+  // B) a function/modal word never appears inside a name/email/address/id
+  if (PII_PROSE_WORDS.test(raw)) return true;
+  // C) numbers + units only, with at least one number and no name-like token
+  const toks = raw.trim().split(/\s+/).filter(Boolean);
+  if (toks.length && toks.every((t) => PII_UNIT_TOKEN.test(t)) && /\d/.test(raw)) return true;
+  // D) all-lowercase multi-word prose with a preposition and no capitalized name
+  if (toks.length >= 3 && !/\p{Lu}/u.test(raw) && PII_PREPOSITION.test(raw)) return true;
+  return false;
+}
+
+export function filterSpans(spans, settings, policy, fullText) {
+  const localFloor = settings?.confidenceThreshold || 0;
+  const globalThreshold = Math.max(localFloor, policy?.min_confidence || 0);
+  const catThresholds = policy?.dlp_category_thresholds || {};
+  const actions = policy?.category_actions || {};
+  const enabled = settings?.enabledCategories || {};
+  return (spans || []).filter((s) => {
+    const up = (s.category || "").toUpperCase();
+    const lo = (s.category || "").toLowerCase();
+    if (!enabled[up]) return false; // category toggled off locally
+    if (actions[lo] === "off") return false; // category turned off by org policy → allow
+    // Per-category confidence floor OVERRIDES the global one when set (mirrors
+    // the gateway dlp.py precedence); the local user floor still applies as a
+    // hard minimum so a lax org threshold can't drop below the user's setting.
+    const threshold =
+      lo in catThresholds ? Math.max(localFloor, catThresholds[lo]) : globalThreshold;
+    if ((s.confidence ?? 1) < threshold) return false;
+    // Genuine-signal guards for MODEL spans. On long benign documents the token
+    // head over-fires — labeling ordinary prose SECRET / CODE / INSURANCE
+    // (e.g. "USD pp. Then beach hopping" → SECRET, "third party liability" →
+    // INSURANCE, park hours → CODE). The image/OCR path already gates these
+    // (background.js classifyFileText); the typed-text path previously did not,
+    // so the same false positives reached the user on a paste.
+    //
+    // SECRET keeps a span when its own text has the signal OR its surrounding
+    // text has credential context — so an OBLIQUE secret ("my aws key is
+    // A K I A 7…", a base64'd token) survives while a benign itinerary (neither
+    // signal nor context) is dropped. CODE is a whole-text intent property, so its
+    // span text is the document — signal-only is enough. INSURANCE is signal-only
+    // (a policy/member/claim number): insurance topic words are common in benign
+    // rental/legal prose, so context-gating would keep that benign talk. PII is
+    // gated on the SPAN text (isProsePii): the model labels function words / units
+    // as O, so their presence INSIDE a PII span marks it a prose misfire — a
+    // genuine name/email/address/id trips none of the signatures, so recall on
+    // real PII is preserved. Deterministic regex hits (sk-…, ghp_…) carry
+    // deterministic=true and are already validated — never second-guess them.
+    if (!s.deterministic && s.text) {
+      // A near-empty span is noise in every category — check it once, first.
+      // Intent spans (injection/code) carry the whole text as their evidence, so
+      // they are exempt from the length test.
+      if (s.kind !== "intent" && isDegenerateSpan(s.text)) return false;
+      if (up === "SECRET" && !hasSecretSignal(s.text) && !SECRET_CONTEXT_RE.test(spanContext(s, fullText)))
+        return false;
+      if (up === "CODE" && !hasCodeSignal(s.text)) return false;
+      if (up === "INSURANCE" && !hasInsuranceSignal(s.text)) return false;
+      if (up === "FINANCIAL" && !hasFinancialSignal(s.text)) return false; // price/word ≠ financial data
+      if (up === "HEALTH" && !hasHealthSignal(s.text)) return false; // health TOPIC ≠ health DATA
+      if (lo === "pii" && isProsePii(s.text)) return false; // model tagged a prose fragment PII
+    }
+    if (lo === "pii" && isNoisyPii(s.text)) return false; // bare date/timestamp / OCR noise
+    return true;
+  });
+}
+
+// Decide the UI action across a set of (already-filtered) spans. The "worst"
+// action wins: block > mask > warn > coach. A disallow_override category forces
+// a hard block even if its action was only "warn". "mask" redacts the matched
+// value from the outgoing request (enforced in netguard) and lets the rest send.
+export function actionForSpans(spans, policy) {
+  const rank = { block: 4, mask: 3, warn: 2, coach: 1 };
+  let worst = "coach";
+  let requireJustification = false;
+  let disallowOverride = false;
+  let disallowApproval = false;
+  const reqJust = new Set((policy?.require_justification || []).map((s) => s.toLowerCase()));
+  const noOverride = new Set((policy?.disallow_override || []).map((s) => s.toLowerCase()));
+  const noApproval = new Set((policy?.disallow_approval || []).map((s) => s.toLowerCase()));
+  const actions = policy?.category_actions || {};
+  for (const s of spans || []) {
+    const cat = (s.category || "").toLowerCase();
+    let a = actions[cat] || "warn";
+    // mask-safety invariant: an intent category (injection/code) has no discrete
+    // value to redact — masking it would blank the whole prompt in netguard.
+    // Downgrade mask→block. Guarded by BOTH the category set and the kind tag
+    // the offscreen model attaches, so it holds even if one is missing.
+    if (a === "mask" && (INTENT_CATEGORIES.has(cat) || s.kind === "intent")) {
+      a = "block";
+    }
+    if ((rank[a] || 0) > (rank[worst] || 0)) worst = a;
+    if (reqJust.has(cat)) requireJustification = true;
+    if (noOverride.has(cat)) disallowOverride = true;
+    if (noApproval.has(cat)) disallowApproval = true;
+  }
+  // disallow_override forces a hard block (no "Send anyway") even if the action
+  // was only "warn"; disallow_approval additionally removes "Request approval".
+  if (disallowOverride) {
+    worst = "block";
+    requireJustification = false;
+  }
+  return { action: worst, requireJustification, disallowOverride, disallowApproval };
+}
+
+// Full decision: filter to the enforced spans, then pick the action. When no
+// span survives, `spans` is empty and the caller allows the submission.
+export function decide(spans, settings, policy, fullText) {
+  const filtered = filterSpans(spans, settings, policy, fullText)
+    .map((s) => ({ ...s, text: cleanSpanText(s.text) }))
+    // Strongest match first, so the banner + admin event lead with the most
+    // meaningful evidence rather than whatever the model happened to emit first.
+    .sort((a, b) => (b.confidence ?? 1) - (a.confidence ?? 1));
+  return { spans: filtered, ...actionForSpans(filtered, policy) };
+}
+
+// Observe (monitor) mode: the org scans + logs findings but never enforces. The
+// content script records the would-be action and lets the prompt through.
+export function isObserveMode(policy) {
+  return !!(policy && policy.observe);
+}
+
+// Fail-closed mode (org policy `fail_mode: "closed"`): when scanning is
+// UNAVAILABLE (worker dead, model hung, classify timeout), block the send
+// instead of failing open. The consumer default stays fail-open — a broken
+// extension must never lock an unmanaged user out of a site — but a compliance
+// org can choose "no unverified content leaves the browser" as posture.
+export function isFailClosed(policy) {
+  return !!(policy && policy.fail_mode === "closed");
+}
+
+// What to do with a file we can't read (image, encrypted, legacy .doc, oversize).
+// Admin-overridable via policy.upload_unscannable_action; otherwise the default
+// follows the org's failure posture: warn normally, block under fail-closed
+// (an unreadable file IS an unverified send).
+export function unscannableAction(policy) {
+  const a = policy && policy.upload_unscannable_action;
+  if (a === "off" || a === "warn" || a === "block") return a;
+  return isFailClosed(policy) ? "block" : "warn";
+}

package/dist/pseudonymize.js

@@ -0,0 +1,91 @@
+// Pseudonymization — consistent, reversible placeholders for detected spans.
+//
+// Used for agent-driven submissions when the org policy sets
+// `agents.pseudonymize`: instead of blocking or warning, every detected value
+// is replaced with a stable token ("[PII-1]", "[SECRET-2]") so the same value
+// maps to the same token for the life of the tab, and the mapping can be
+// rehydrated locally later. The map never leaves the browser.
+//
+// Pure module (unit-tested). Storage of the per-tab map is the caller's job.
+
+export const PLACEHOLDER_PREFIX = {
+  secret: "SECRET",
+  pii: "PII",
+  financial: "FIN",
+  health: "PHI",
+  insurance: "INS",
+  code: "CODE",
+  injection: "TEXT",
+};
+
+// A placeholder must stand in for a VALUE, never a sentence. Model spans can
+// be broad (a whole clause tagged financial); those are left for the caller
+// to mine for identifiers (see background.js) rather than replaced wholesale.
+export const MAX_PLACEHOLDER_CHARS = 48;
+export const MAX_PLACEHOLDER_WORDS = 6;
+export function isValueLike(text) {
+  const t = String(text || "").trim();
+  if (!t) return false;
+  if (t.length > MAX_PLACEHOLDER_CHARS) return false;
+  if (t.split(/\s+/).length > MAX_PLACEHOLDER_WORDS) return false;
+  return true;
+}
+
+export function placeholderFor(category, n) {
+  const key = String(category || "").toLowerCase();
+  return `[${PLACEHOLDER_PREFIX[key] || key.toUpperCase() || "DATA"}-${n}]`;
+}
+
+/**
+ * Assign a `replacement` to every span with text. `state` = {map, counters}
+ * where map: Record<text, token> and counters: Record<category, n>. Mutates
+ * and returns state so a caller can persist it per tab.
+ */
+export function assignPlaceholders(spans, state) {
+  const st = state && typeof state === "object" ? state : {};
+  st.map = st.map && typeof st.map === "object" ? st.map : {};
+  st.counters = st.counters && typeof st.counters === "object" ? st.counters : {};
+  const out = [];
+  for (const s of spans || []) {
+    const text = s && typeof s.text === "string" ? s.text : "";
+    if (!text.trim() || s.kind === "intent" || !isValueLike(text)) {
+      out.push(s);
+      continue;
+    }
+    let token = st.map[text];
+    if (!token) {
+      const cat = String(s.category || "data").toLowerCase();
+      st.counters[cat] = (st.counters[cat] || 0) + 1;
+      token = placeholderFor(cat, st.counters[cat]);
+      st.map[text] = token;
+    }
+    out.push({ ...s, replacement: token });
+  }
+  return { spans: out, state: st };
+}
+
+/** Replace every mapped value in `text` with its token (longest values first). */
+export function pseudonymizeText(text, state) {
+  let out = String(text ?? "");
+  const map = (state && state.map) || {};
+  const values = Object.keys(map).sort((a, b) => b.length - a.length);
+  for (const v of values) if (v && out.includes(v)) out = out.split(v).join(map[v]);
+  return out;
+}
+
+/** Inverse: put the original values back (e.g. into a model's reply). */
+export function rehydrateText(text, state) {
+  let out = String(text ?? "");
+  const map = (state && state.map) || {};
+  for (const [v, token] of Object.entries(map)) if (token && out.includes(token)) out = out.split(token).join(v);
+  return out;
+}
+
+/** Bound the per-tab map so a long session can't grow it without limit. */
+export function trimState(state, max = 500) {
+  if (!state || !state.map) return state;
+  const entries = Object.entries(state.map);
+  if (entries.length <= max) return state;
+  state.map = Object.fromEntries(entries.slice(entries.length - max));
+  return state;
+}