@privacyscrubber/mcp-server 2.1.0 → 2.2.0

package/README.md

@@ -96,6 +96,28 @@ Add this to your Claude Desktop config file:
     *   **Command:** `npx -y @privacyscrubber/mcp-server`
 3. Optional: Set `PRIVACYSCRUBBER_KEY` as an environment variable in your system shell.
 
+### Cline / Roo Code
+Add to `cline_mcp_settings.json`:
+```json
+{
+  "mcpServers": {
+    "privacyscrubber": {
+      "command": "npx",
+      "args": ["-y", "@privacyscrubber/mcp-server"],
+      "env": {
+        "PRIVACYSCRUBBER_KEY": "YOUR_OPTIONAL_PRO_LICENSE_KEY"
+      }
+    }
+  }
+}
+```
+
+### Claude Code CLI
+Add directly from your terminal:
+```bash
+claude mcp add privacyscrubber -- npx -y @privacyscrubber/mcp-server
+```
+
 ---
 
 ## 🛠️ Provided Tools & JSON-RPC Specifications
@@ -167,35 +189,47 @@ Reads a local file, extracts text, sanitizes it, and returns the redacted templa
     *   `filePath` (string, required): Absolute file path to read and sanitize.
     *   `profile` (string, optional): The industry detection profile.
 
----
+### 4. `guard_exec` (Command Execution Firewall)
+Safely executes terminal commands in an isolated child process, masking stdout/stderr PII, database credentials, and API keys in local RAM before passing them to the AI agent. Includes a CISO audit receipt in stderr.
 
-## 🌐 Browser Extension & Web Client
+*   **Arguments:**
+    *   `command` (string, required): The shell command to execute (e.g. `cat .env`, `docker logs web`, `git diff`).
+    *   `cwd` (string, optional): Working directory.
+    *   `profile` (string, optional): Detection profile (defaults to `Dev`).
+    *   `timeout_ms` (number, optional): Timeout in ms (defaults to `15000`).
 
-Looking for real-time protection directly inside your web browser?
-*   **Chrome Extension:** Get the [PrivacyScrubber Chrome Extension](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol) to sanitize prompts directly inside ChatGPT, Claude, and Gemini in real-time.
-*   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server).
+### 5. `guard_read_file` (Credential-Masking File Reader)
+Reads files (.env, configs, source code, database dumps) and tokenizes all passwords, JWTs, and PII in volatile memory, returning safe redacted content for AI reasoning.
 
-## 📄 License & Commercial Upgrade
+*   **Arguments:**
+    *   `file_path` (string, required): Path to file.
+    *   `profile` (string, optional): Detection profile (defaults to `Dev`).
+    *   `max_lines` (number, optional): Line cap for large files (defaults to `500`).
 
-By default, the server runs under the **Free Tier** (restricted to 15,000 characters per request and the basic `General` PII profile). To unlock 25 specialized engineering, medical, legal, and financial PII profiles, as well as team-wide custom rules, you can purchase a commercial license.
+### 6. `guard_git_diff` (Pre-Commit & Diff Sanitizer)
+Inspects staged (`--cached`) or unstaged repository diffs, redacting any newly introduced secrets or PII in local RAM before AI code review or commit message generation.
 
-### Feature Comparison
+*   **Arguments:**
+    *   `staged` (boolean, optional): If `true`, inspects staged changes (`git diff --cached`). Defaults to `false`.
+    *   `cwd` (string, optional): Working directory.
+    *   `profile` (string, optional): Detection profile (defaults to `Dev`).
 
-| Feature | Free Tier | PRO Tier | TEAMS Tier |
-| :--- | :--- | :--- | :--- |
-| **Volatile Tokenization** | ✅ Yes | ✅ Yes | ✅ Yes |
-| **Standard PII Masking** | ✅ Yes | ✅ Yes | ✅ Yes |
-| **Max Character Length** | 15,000 chars | ♾️ Unlimited | ♾️ Unlimited |
-| **Industry Profiles** | General Only | 25 Profiles | 25 Profiles |
-| **Custom Regex Rules** | ❌ Locked | ♾️ Unlimited | ♾️ Unlimited |
-| **Team Rules Sync (GPO)** | ❌ No | ❌ No | ✅ Yes (Shared Link) |
-| **Licensing Cost** | $0 | **$110 Lifetime** | **$99/mo Flat Rate** |
+### 7. `guard_apply_patch` (Safe Patch Applicator)
+Reverses token placeholders (`[API_KEY_1]`, `[SECRET_1]`) in AI-generated code or text by looking up the local RAM session map, creating a `.bak` backup, and writing authentic cleartext directly to disk. The remote LLM never sees real secrets.
 
-👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server)**
+*   **Arguments:**
+    *   `file_path` (string, required): Path to target file.
+    *   `content` (string, required): Content containing tokens to restore on disk.
+    *   `create_backup` (boolean, optional): Backup existing file before write (defaults to `true`).
 
----
+### 8. `create_agent_rules` (1-Click Agent Rule Injection)
+Automatically scaffolds CISO-grade Zero-Trust directives into `.cursorrules`, `.windsurfrules`, `CLAUDE.md`, `.github/copilot-instructions.md`, or `.clinerules`.
+
+*   **Arguments:**
+    *   `agent_types` (array, optional): `["all"]`, `["cursor"]`, `["windsurf"]`, `["claude_code"]`, `["copilot"]`, `["cline"]`. Defaults to `["all"]`.
+    *   `workspace_dir` (string, optional): Workspace directory.
 
-### 4. `check_status`
+### 9. `check_status`
 
 Returns a visual dashboard showing your current tier, session request count, active profiles, and upgrade instructions. Use it at any time to check your license status or get setup help.
 
@@ -210,7 +244,7 @@ Returns a visual dashboard showing your current tier, session request count, act
 *   **Response Example (Free Tier):**
     ```
     ╔══════════════════════════════════════════════════╗
-    ║       PrivacyScrubber MCP Server v1.7.1          ║
+    ║       PrivacyScrubber MCP Server v2.2.0          ║
     ╠══════════════════════════════════════════════════╣
     ║  🔓 Tier: FREE                                   ║
     ║  📊 Session requests: 5                          ║
@@ -231,6 +265,52 @@ Returns a visual dashboard showing your current tier, session request count, act
 
 ---
 
+## 🛡️ Standalone CLI: `ps-guard`
+
+PrivacyScrubber bundles `ps-guard` for Unix pipe, pre-commit, and agentic workflows:
+
+```bash
+# Pipe any output through RAM redaction
+cat .env | npx ps-guard --profile dev
+
+# Execute commands through the ZTDS safety wrapper
+npx ps-guard -- npm test
+
+# Review git diff with secrets redacted
+npx ps-guard --diff --staged
+
+# Generate rules for all AI IDEs (.cursorrules, .windsurfrules, CLAUDE.md, copilot, cline)
+npx ps-guard --rules
+```
+
+---
+
+## 🌐 Browser Extension & Web Client
+
+Looking for real-time protection directly inside your web browser?
+*   **Chrome Extension:** Get the [PrivacyScrubber Chrome Extension](https://chromewebstore.google.com/detail/privacyscrubber-%E2%80%94-pii-red/pimoejgefeilajmmbpghifdmhdlkgjol) to sanitize prompts directly inside ChatGPT, Claude, and Gemini in real-time.
+*   **Web Sandbox:** Use the zero-server browser sanitization tools at [PrivacyScrubber Homepage](https://privacyscrubber.com/?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server).
+
+## 📄 License & Commercial Upgrade
+
+By default, the server runs under the **Free Tier** (restricted to 15,000 characters per request and the basic `General` PII profile). To unlock 25 specialized engineering, medical, legal, and financial PII profiles, as well as team-wide custom rules, you can purchase a commercial license.
+
+### Feature Comparison
+
+| Feature | Free Tier | PRO Tier | TEAMS Tier |
+| :--- | :--- | :--- | :--- |
+| **Volatile Tokenization** | ✅ Yes | ✅ Yes | ✅ Yes |
+| **Standard PII Masking** | ✅ Yes | ✅ Yes | ✅ Yes |
+| **Max Character Length** | 15,000 chars | ♾️ Unlimited | ♾️ Unlimited |
+| **Industry Profiles** | General Only | 25 Profiles | 25 Profiles |
+| **Custom Regex Rules** | ❌ Locked | ♾️ Unlimited | ♾️ Unlimited |
+| **Team Rules Sync (GPO)** | ❌ No | ❌ No | ✅ Yes (Shared Link) |
+| **Licensing Cost** | $0 | **$110 Lifetime** | **$99/mo Flat Rate** |
+
+👉 **[Acquire a PRO / TEAMS License Key at privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server)**
+
+---
+
 ## 🔐 After Purchase: Activate PRO in Your MCP Client
 
 After purchasing a PRO license at [privacyscrubber.com/pricing](https://privacyscrubber.com/pricing?utm_source=npm&utm_medium=readme&utm_campaign=mcp_server), you will receive a license key. Add it to your MCP client config as an environment variable: `PRIVACYSCRUBBER_KEY`.

package/index.js

@@ -24,6 +24,7 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 
 import crypto from 'crypto';
+import { execSync } from 'child_process';
 
 const require = createRequire(import.meta.url);
 const __filename = fileURLToPath(import.meta.url);
@@ -417,6 +418,120 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           properties: {},
           required: []
         }
+      },
+      {
+        name: "guard_exec",
+        description: "Zero-Trust Agentic Guard: Safely executes a shell/terminal command locally in isolated process, sanitizes stdout and stderr in volatile RAM, tokenizes any API keys, credentials, database URIs, or PII before sending output to LLM. Maps original values in memory for safe local restoration.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            command: {
+              type: "string",
+              description: "The shell command to execute (e.g. 'cat .env', 'git diff', 'docker logs web', 'env')."
+            },
+            cwd: {
+              type: "string",
+              description: "Optional working directory. Defaults to current workspace root."
+            },
+            profile: {
+              type: "string",
+              description: "Detection profile. Available: 'General', 'Dev' (recommended for code/secrets), 'Security', 'Finance', etc. Defaults to 'Dev'."
+            },
+            timeout_ms: {
+              type: "number",
+              description: "Execution timeout in milliseconds. Defaults to 15000 (15s)."
+            }
+          },
+          required: ["command"]
+        }
+      },
+      {
+        name: "guard_read_file",
+        description: "Zero-Trust Agentic Guard: Reads a sensitive local file (.env, config, credentials, source code, database dumps), sanitizes all credentials and PII in volatile RAM, and returns safe tokenized content for AI agent context.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            file_path: {
+              type: "string",
+              description: "Absolute or relative path to the file to inspect."
+            },
+            profile: {
+              type: "string",
+              description: "Detection profile. Defaults to 'Dev'."
+            },
+            max_lines: {
+              type: "number",
+              description: "Optional line cap for large files. Defaults to 500."
+            }
+          },
+          required: ["file_path"]
+        }
+      },
+      {
+        name: "guard_git_diff",
+        description: "Zero-Trust Agentic Guard: Inspects unstaged or staged git diffs locally, sanitizes any newly added or modified credentials, tokens, or PII in RAM, and returns safe diff for AI commit generation or code review.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            staged: {
+              type: "boolean",
+              description: "If true, runs 'git diff --cached'. If false, runs 'git diff'. Defaults to false."
+            },
+            cwd: {
+              type: "string",
+              description: "Optional repository directory. Defaults to current workspace root."
+            },
+            profile: {
+              type: "string",
+              description: "Detection profile. Defaults to 'Dev'."
+            }
+          },
+          required: []
+        }
+      },
+      {
+        name: "guard_apply_patch",
+        description: "Zero-Trust Agentic Guard: Reverses token placeholders ([API_KEY_1], [SECRET_1]) in AI-generated code or text, restores authentic values from local volatile RAM, and writes real content directly to target file on disk. Remote LLM never learns actual secrets.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            file_path: {
+              type: "string",
+              description: "Absolute path to the destination file to create or update."
+            },
+            content: {
+              type: "string",
+              description: "Code or text content containing token placeholders to de-anonymize locally before write."
+            },
+            create_backup: {
+              type: "boolean",
+              description: "Whether to create a .bak backup if target file already exists. Defaults to true."
+            }
+          },
+          required: ["file_path", "content"]
+        }
+      },
+      {
+        name: "create_agent_rules",
+        description: "Zero-Trust Agentic Guard: Scaffolds CISO-grade AI Agent Rules in workspace (.cursorrules, .windsurfrules, CLAUDE.md, .github/copilot-instructions.md, .clinerules). Guides autonomous agents to route all file reads, git diffs, and shell commands through PrivacyScrubber Guard tools.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            agent_types: {
+              type: "array",
+              items: {
+                type: "string",
+                enum: ["all", "cursor", "windsurf", "claude_code", "copilot", "cline"]
+              },
+              description: "List of agent targets to generate rules for. Use ['all'] to generate rules for all supported AI agents."
+            },
+            workspace_dir: {
+              type: "string",
+              description: "Target workspace root directory. Defaults to current directory."
+            }
+          },
+          required: []
+        }
       }
     ]
   };
@@ -433,6 +548,10 @@ server.setRequestHandler(ListPromptsRequestSchema, async () => {
       {
         name: "safe_redaction_workflow",
         description: "Instructions for using the redact_file tool safely with QA checks.",
+      },
+      {
+        name: "agentic_guard_instructions",
+        description: "Zero-Trust Agentic Guard instructions for autonomous AI agents (Cursor, Windsurf, Claude Code).",
       }
     ]
   };
@@ -455,6 +574,21 @@ server.setRequestHandler(GetPromptRequestSchema, async (request) => {
     };
   }
 
+  if (request.params.name === "agentic_guard_instructions") {
+    return {
+      description: "Instructions for autonomous AI agents operating under Zero-Trust Agentic Guard.",
+      messages: [
+        {
+          role: "user",
+          content: {
+            type: "text",
+            text: "You are an autonomous AI software engineer operating under strict Zero-Trust Data Sanitization (ZTDS) policies. Sensitive files, logs, and shell output must never leak API keys, credentials, or PII to external model APIs.\n\nFollow these mandatory agent protocols:\n1. Terminal Commands: When running commands whose output might contain credentials or PII (cat .env, docker logs, env, git diff, psql), use `guard_exec` to sanitize output in local RAM before it enters your context.\n2. Reading Secrets/Config: When reading configuration files, API keys, or database schemas, call `guard_read_file` instead of raw file readers.\n3. Code Review & Commits: Use `guard_git_diff` to review changes safely with credentials masked as tokens.\n4. Writing Code: When writing code containing token placeholders (e.g. [API_KEY_1]), use `guard_apply_patch` to restore authentic values locally on disk without exposing them to the cloud.\n5. AI Answers: Pass final text containing tokens through `reveal_text` before returning it to the user."
+          }
+        }
+      ]
+    };
+  }
+
   if (request.params.name !== "secure_ai_workflow") {
     throw new Error(`Unknown prompt: ${request.params.name}`);
   }
@@ -1288,6 +1422,296 @@ ${telemetry.frameworksList.map(f => `- **${f}**`).join('\n')}
       };
     }
 
+    if (name === "guard_exec") {
+      const { command, cwd, profile = "Dev", timeout_ms = 15000 } = args || {};
+      if (!command || typeof command !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'command'." }]
+        };
+      }
+      const license = checkLicenseStatus();
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Free tier daily limit exhausted (${FREE_TIER_DAILY_LIMIT} requests). Get a PRO key at https://privacyscrubber.com/pricing` }]
+        };
+      }
+
+      const execCwd = cwd ? path.resolve(cwd) : process.cwd();
+      let stdout = '';
+      let stderr = '';
+      let exitCode = 0;
+
+      try {
+        stdout = execSync(command, {
+          cwd: execCwd,
+          timeout: Math.min(Math.max(timeout_ms, 1000), 60000),
+          maxBuffer: 10 * 1024 * 1024,
+          encoding: 'utf8',
+          stdio: ['pipe', 'pipe', 'pipe']
+        });
+      } catch (err) {
+        stdout = err.stdout ? err.stdout.toString() : '';
+        stderr = err.stderr ? err.stderr.toString() : (err.message || '');
+        exitCode = typeof err.status === 'number' ? err.status : 1;
+      }
+
+      const targetProfile = (profile || "Dev").trim();
+      const isAdvanced = targetProfile.toLowerCase() !== "general";
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
+
+      const { processedText: cleanStdout } = truncateIfFree(stdout, license.isPro, charLimit);
+      const { processedText: cleanStderr } = truncateIfFree(stderr, license.isPro, charLimit);
+
+      const resCommand = performSanitization(command, targetProfile, sessionIgnoreList);
+      const resStdout = performSanitization(cleanStdout, targetProfile, sessionIgnoreList);
+      const resStderr = performSanitization(cleanStderr, targetProfile, sessionIgnoreList);
+
+      const allNewTokens = { ...resCommand.newTokens, ...resStdout.newTokens, ...resStderr.newTokens };
+      const tokenCount = Object.keys(allNewTokens).length;
+      const telemetry = buildCisoAuditTelemetry(allNewTokens);
+      const receiptMd = formatAuditReceipt(telemetry);
+
+      const responseText = `[Zero-Trust Agentic Guard: Exec: ${command.split(' ')[0]}]\n` +
+        `Command: ${resCommand.scrubbedText}\n` +
+        `Exit Code: ${exitCode}\n` +
+        `Tokens Redacted: ${tokenCount}\n\n` +
+        (resStdout.scrubbedText ? `--- STDOUT ---\n${resStdout.scrubbedText}\n\n` : '') +
+        (resStderr.scrubbedText ? `--- STDERR ---\n${resStderr.scrubbedText}\n\n` : '') +
+        receiptMd;
+
+      return {
+        content: [{ type: "text", text: responseText }]
+      };
+    }
+
+    if (name === "guard_read_file") {
+      const { file_path, profile = "Dev", max_lines = 500 } = args || {};
+      if (!file_path || typeof file_path !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'file_path'." }]
+        };
+      }
+      const resolvedPath = path.resolve(process.cwd(), file_path);
+      if (!fs.existsSync(resolvedPath)) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: File not found at path: ${resolvedPath}` }]
+        };
+      }
+      const stat = fs.statSync(resolvedPath);
+      if (stat.isDirectory()) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Path is a directory. Use audit_directory_for_pii to scan directories.` }]
+        };
+      }
+      const license = checkLicenseStatus();
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Free tier daily limit exhausted. Get a PRO key at https://privacyscrubber.com/pricing` }]
+        };
+      }
+
+      let rawContent = fs.readFileSync(resolvedPath, 'utf8');
+      const lines = rawContent.split(/\r?\n/);
+      const capped = lines.slice(0, max_lines).join('\n');
+      const wasTruncated = lines.length > max_lines;
+
+      const targetProfile = (profile || "Dev").trim();
+      const isAdvanced = targetProfile.toLowerCase() !== "general";
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
+
+      const { processedText } = truncateIfFree(capped, license.isPro, charLimit);
+      const { scrubbedText, newTokens } = performSanitization(processedText, targetProfile, sessionIgnoreList);
+
+      const telemetry = buildCisoAuditTelemetry(newTokens);
+      const receiptMd = formatAuditReceipt(telemetry);
+
+      const responseText = `[Zero-Trust Agentic Guard: File Read: ${path.basename(resolvedPath)}]\n` +
+        `Path: ${resolvedPath}\n` +
+        `Total Lines: ${lines.length}${wasTruncated ? ` (Displaying first ${max_lines} lines)` : ''}\n` +
+        `Tokens Redacted: ${Object.keys(newTokens).length}\n\n` +
+        `--- SANITIZED CONTENT ---\n` +
+        scrubbedText + '\n\n' +
+        receiptMd;
+
+      return {
+        content: [{ type: "text", text: responseText }]
+      };
+    }
+
+    if (name === "guard_git_diff") {
+      const { staged = false, cwd, profile = "Dev" } = args || {};
+      const repoCwd = cwd ? path.resolve(cwd) : process.cwd();
+      const license = checkLicenseStatus();
+      const limitStatus = checkFreeTierLimit(license.isPro);
+      if (limitStatus.blocked) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Free tier daily limit exhausted. Get a PRO key at https://privacyscrubber.com/pricing` }]
+        };
+      }
+
+      const gitCmd = staged ? "git diff --cached" : "git diff";
+      let diffOutput = '';
+      try {
+        diffOutput = execSync(gitCmd, { cwd: repoCwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+      } catch (err) {
+        if (err.code === 'ENOBUFS' && err.stdout) {
+          diffOutput = err.stdout.toString('utf8');
+        } else {
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error executing '${gitCmd}': ${err.message}` }]
+          };
+        }
+      }
+
+      if (!diffOutput.trim()) {
+        return {
+          content: [{ type: "text", text: `[Zero-Trust Agentic Guard: Git Diff]\nNo git diff changes detected (${staged ? 'staged' : 'unstaged'}).` }]
+        };
+      }
+
+      const targetProfile = (profile || "Dev").trim();
+      const isAdvanced = targetProfile.toLowerCase() !== "general";
+      const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
+
+      const { processedText } = truncateIfFree(diffOutput, license.isPro, charLimit);
+      const { scrubbedText, newTokens } = performSanitization(processedText, targetProfile, sessionIgnoreList);
+
+      const telemetry = buildCisoAuditTelemetry(newTokens);
+      const receiptMd = formatAuditReceipt(telemetry);
+
+      const responseText = `[Zero-Trust Agentic Guard: Git Diff (${staged ? 'Staged' : 'Unstaged'})]\n` +
+        `Tokens Redacted: ${Object.keys(newTokens).length}\n\n` +
+        `--- SANITIZED DIFF ---\n` +
+        scrubbedText + '\n\n' +
+        receiptMd;
+
+      return {
+        content: [{ type: "text", text: responseText }]
+      };
+    }
+
+    if (name === "guard_apply_patch") {
+      const { file_path, content, create_backup = true } = args || {};
+      if (!file_path || typeof file_path !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'file_path'." }]
+        };
+      }
+      if (content === undefined || content === null || typeof content !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'content' (must be string)." }]
+        };
+      }
+
+      const resolvedPath = path.resolve(process.cwd(), file_path);
+      const restored = PrivacyScrubberCore.unscrubText(content, sessionMap);
+      const authenticContent = restored.restoredText;
+
+      let backupCreated = false;
+      if (create_backup && fs.existsSync(resolvedPath)) {
+        const backupPath = `${resolvedPath}.bak`;
+        fs.copyFileSync(resolvedPath, backupPath);
+        backupCreated = true;
+      }
+
+      const parentDir = path.dirname(resolvedPath);
+      if (!fs.existsSync(parentDir)) {
+        fs.mkdirSync(parentDir, { recursive: true });
+      }
+
+      fs.writeFileSync(resolvedPath, authenticContent, 'utf8');
+
+      return {
+        content: [{
+          type: "text",
+          text: `[Zero-Trust Agentic Guard: Patch Applied Successfully]\n` +
+            `Destination: ${resolvedPath}\n` +
+            `Tokens Restored Locally: ${restored.restoredCount || 0}\n` +
+            `Backup Created: ${backupCreated ? `${resolvedPath}.bak` : 'No'}\n` +
+            `Status: File written with 100% authentic local values. Remote LLM received zero secrets.`
+        }]
+      };
+    }
+
+    if (name === "create_agent_rules") {
+      const { agent_types = ["all"], workspace_dir } = args || {};
+      const targetDir = workspace_dir ? path.resolve(workspace_dir) : process.cwd();
+      const targets = agent_types.includes("all") ? ["cursor", "windsurf", "claude_code", "copilot", "cline"] : agent_types;
+
+      const ruleText = `# PrivacyScrubber Zero-Trust Agentic Guard (CISO Security Rules)
+# 100% Local In-Memory Data Sanitization. Zero Network Egress.
+
+## Agent Mandate
+You are an autonomous AI assistant operating under strict Zero-Trust Data Sanitization (ZTDS) policies.
+Before reading sensitive files, running terminal commands that may print credentials, or committing code:
+
+1. **Terminal Commands:** When running shell commands whose output may contain API keys, database connection strings, or customer PII (e.g. \`cat .env\`, \`docker logs\`, \`env\`, \`git diff\`), invoke the \`guard_exec\` tool instead of raw terminal execution.
+2. **Reading Credentials/Config:** When reading \`.env*\`, config files, database credentials, or secret keys, always call \`guard_read_file\` so sensitive entities are tokenized locally in RAM before entering your context window.
+3. **Git Code Review:** Use \`guard_git_diff\` to inspect changes without exposing plaintext secrets to the cloud.
+4. **Applying Patches:** When writing files containing token placeholders (e.g. \`[API_KEY_1]\`, \`[DB_PASSWORD_1]\`), use \`guard_apply_patch\` to automatically restore authentic secrets locally to disk without sending them back to the LLM.
+5. **Final Output:** Pass any final synthesized text containing token placeholders through \`reveal_text\` before presenting it to the user.
+`;
+
+      const generatedFiles = [];
+      if (targets.includes("cursor")) {
+        const p = path.join(targetDir, '.cursorrules');
+        fs.writeFileSync(p, ruleText, 'utf8');
+        generatedFiles.push('.cursorrules');
+      }
+      if (targets.includes("windsurf")) {
+        const p = path.join(targetDir, '.windsurfrules');
+        fs.writeFileSync(p, ruleText, 'utf8');
+        generatedFiles.push('.windsurfrules');
+      }
+      if (targets.includes("claude_code")) {
+        const p = path.join(targetDir, 'CLAUDE.md');
+        if (fs.existsSync(p)) {
+          const existing = fs.readFileSync(p, 'utf8');
+          if (!existing.includes("Zero-Trust Agentic Guard")) {
+            fs.writeFileSync(p, existing + "\n\n" + ruleText, 'utf8');
+            generatedFiles.push('CLAUDE.md (appended)');
+          }
+        } else {
+          fs.writeFileSync(p, ruleText, 'utf8');
+          generatedFiles.push('CLAUDE.md');
+        }
+      }
+      if (targets.includes("copilot")) {
+        const copilotDir = path.join(targetDir, '.github');
+        if (!fs.existsSync(copilotDir)) fs.mkdirSync(copilotDir, { recursive: true });
+        const p = path.join(copilotDir, 'copilot-instructions.md');
+        fs.writeFileSync(p, ruleText, 'utf8');
+        generatedFiles.push('.github/copilot-instructions.md');
+      }
+      if (targets.includes("cline")) {
+        const p = path.join(targetDir, '.clinerules');
+        fs.writeFileSync(p, ruleText, 'utf8');
+        generatedFiles.push('.clinerules');
+      }
+
+      return {
+        content: [{
+          type: "text",
+          text: `[Zero-Trust Agentic Guard: Agent Rules Generated]\n` +
+            `Workspace: ${targetDir}\n` +
+            `Files Created/Updated:\n${generatedFiles.map(f => `- ${f}`).join('\n')}\n\n` +
+            `Autonomous AI agents in this repository will now automatically use PrivacyScrubber Guard tools.`
+        }]
+      };
+    }
+
     return {
       isError: true,
       content: [{ type: "text", text: `Unknown tool: ${name}` }]

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "manifest_version": "0.3",
   "name": "privacyscrubber/pii-masking-mcp",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "author": {
     "name": "PrivacyScrubber",
@@ -12,7 +12,9 @@
     "entry_point": "index.js",
     "mcp_config": {
       "command": "node",
-      "args": ["${__dirname}/index.js"],
+      "args": [
+        "${__dirname}/index.js"
+      ],
       "env": {
         "PRIVACYSCRUBBER_KEY": "${user_config.PRIVACYSCRUBBER_KEY}"
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@privacyscrubber/mcp-server",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "mcpName": "io.github.moxno/privacyscrubber-mcp",
   "description": "CISO-Approved Zero-Trust PII & Secrets Redaction MCP Server for Cursor, Windsurf, and Claude Desktop. Prevent API leaks and comply with HIPAA/SOC 2 locally.",
   "main": "index.js",
@@ -27,6 +27,8 @@
     "mcp-server": "index.js",
     "privacyscrubber-mcp": "index.js",
     "pii-masking-run": "pii-masking-run.js",
+    "ps-guard": "pii-masking-run.js",
+    "agentic-guard": "pii-masking-run.js",
     "privacyscrubber-mcp-install": "install.js"
   },
   "scripts": {

package/pii-masking-run.js

@@ -9,7 +9,7 @@
  * Usage: pii-masking-run [options] -- <command> [args...]
  */
 
-import { spawn } from 'child_process';
+import { spawn, execSync } from 'child_process';
 import { createRequire } from 'module';
 import fs from 'fs';
 import path from 'path';
@@ -27,24 +27,39 @@ const cmdIndex = args.indexOf("--");
 
 if (args.includes("--version") || args.includes("-v")) {
   const pkgPath = path.resolve(__dirname, './package.json');
-  let version = '1.7.0';
+  let version = '2.2.0';
   try { version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version; } catch (_) {}
-  console.log(`pii-masking-run v${version} (PrivacyScrubber MCP)`);
+  console.log(`ps-guard / pii-masking-run v${version} (PrivacyScrubber MCP)`);
   process.exit(0);
 }
 
-if (cmdIndex === -1 || args.includes("-h") || args.includes("--help")) {
-  console.log("PrivacyScrubber CLI Command Runner: pii-masking-run");
+const isDiffMode = args.includes("--diff");
+const isRulesMode = args.includes("--rules");
+const hasCommand = cmdIndex !== -1 && args.slice(cmdIndex + 1).length > 0;
+const hasStdin = !process.stdin.isTTY;
+
+if (args.includes("-h") || args.includes("--help") || (!hasCommand && !isDiffMode && !isRulesMode && !hasStdin)) {
+  console.log("PrivacyScrubber CLI & Agentic Guard: ps-guard / pii-masking-run");
   console.log("\nUsage:");
-  console.log("  npx pii-masking-run [options] -- <command> [args...]");
+  console.log("  npx ps-guard [options] -- <command> [args...]");
+  console.log("  cat <file> | npx ps-guard [options]");
+  console.log("  npx ps-guard --diff [--staged] [options]");
+  console.log("  npx ps-guard --rules [targets]");
   console.log("\nOptions:");
-  console.log("  --profile <name>  Specify detection profile (e.g. General, Medical, Legal, Dev, HR)");
+  console.log("  --profile <name>  Specify detection profile (e.g. General, Dev, Medical, Legal, HR)");
   console.log("  --key <licKey>    PrivacyScrubber PRO License Key");
+  console.log("  --diff            Sanitize git diff output before committing or sending to AI");
+  console.log("  --staged          Use staged git changes with --diff");
+  console.log("  --rules [targets] Generate AI agent rules (.cursorrules, .windsurfrules, CLAUDE.md, copilot, cline)");
+  console.log("  -q, --quiet       Suppress stderr proof telemetry");
   console.log("  -v, --version     Print version");
   console.log("  -h, --help        Show this help screen");
   console.log("\nExamples:");
-  console.log("  npx pii-masking-run -- cat database-dump.sql");
-  console.log("  npx pii-masking-run --profile dev -- npm test");
+  console.log("  npx ps-guard -- cat database-dump.sql");
+  console.log("  npx ps-guard --profile dev -- npm test");
+  console.log("  cat .env | npx ps-guard --profile dev");
+  console.log("  npx ps-guard --diff --staged");
+  console.log("  npx ps-guard --rules cursor,windsurf");
   process.exit(0);
 }
 
@@ -126,14 +141,9 @@ function loadCustomRules() {
 // Local runtime variables
 let profile = "General";
 let key = process.env.PRIVACYSCRUBBER_KEY || "";
+let rulesTargets = ["all"];
 
-const optionsArgs = args.slice(0, cmdIndex);
-const commandArgs = args.slice(cmdIndex + 1);
-
-if (commandArgs.length === 0) {
-  console.error("Error: No command specified after '--'.");
-  process.exit(1);
-}
+const optionsArgs = cmdIndex !== -1 ? args.slice(0, cmdIndex) : args;
 
 // Parse custom command-line options
 for (let i = 0; i < optionsArgs.length; i++) {
@@ -143,6 +153,11 @@ for (let i = 0; i < optionsArgs.length; i++) {
   } else if (optionsArgs[i] === "--key" && optionsArgs[i + 1]) {
     key = optionsArgs[i + 1];
     i++;
+  } else if (optionsArgs[i] === "--rules") {
+    if (optionsArgs[i + 1] && !optionsArgs[i + 1].startsWith("-")) {
+      rulesTargets = optionsArgs[i + 1].split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
+      i++;
+    }
   }
 }
 
@@ -154,9 +169,26 @@ const customRules = loadCustomRules();
 const localSessionMap = {};
 
 function performSanitization(text) {
-  const normalizedProfile = (profile || "general").trim().toLowerCase();
-  const result = PrivacyScrubberCore.scrubText(text, customRules, {}, normalizedProfile, localSessionMap);
   const license = checkLicenseStatus();
+  const normalizedProfile = (profile || "general").trim().toLowerCase();
+  const limit = (normalizedProfile !== "general" && !license.isPro) ? 5000 : 15000;
+  let textToScrub = text;
+  let wasTruncated = false;
+  if (!license.isPro && textToScrub.length > limit) {
+    textToScrub = textToScrub.slice(0, limit);
+    wasTruncated = true;
+  }
+
+  let result;
+  try {
+    result = PrivacyScrubberCore.scrubText(textToScrub, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+  } catch (err) {
+    return text;
+  }
+
+  if (result && result.tokenMap) {
+    Object.assign(localSessionMap, result.tokenMap);
+  }
   
   if (!license.isPro && result.tokenMap) {
     // Free tier: check for secrets and warn
@@ -181,40 +213,160 @@ function performSanitization(text) {
     }
   }
 
-  return result.scrubbedText;
+  return result.scrubbedText + (wasTruncated ? '\n[Output truncated to Free Tier character limit. Upgrade to PRO for unlimited.]' : '');
+}
+
+function emitProofFeedback() {
+  const isQuiet = args.includes("--quiet") || args.includes("-q");
+  if (isQuiet) return;
+
+  const totalMasked = Object.keys(localSessionMap).length;
+  if (totalMasked > 0) {
+    process.stderr.write(`\x1b[36m[ps-guard] ${totalMasked} item(s) masked · 0 bytes egress · Zero-Trust RAM verified\x1b[0m\n`);
+  } else if (args.includes("--verbose")) {
+    process.stderr.write(`\x1b[36m[ps-guard] 0 item(s) masked · 0 bytes egress · Zero-Trust RAM verified\x1b[0m\n`);
+  }
+}
+
+// Mode 1: Agent Rules Generation (--rules)
+if (isRulesMode) {
+  const targetDir = process.cwd();
+  const targets = rulesTargets.includes("all") ? ["cursor", "windsurf", "claude_code", "copilot", "cline"] : rulesTargets;
+  const RULE_TEXT = `# PrivacyScrubber Zero-Trust Agentic Guard (CISO Security Rules)
+# 100% Local In-Memory Data Sanitization. Zero Network Egress.
+
+## Agent Mandate
+You are an autonomous AI assistant operating under strict Zero-Trust Data Sanitization (ZTDS) policies.
+Before reading sensitive files, running terminal commands that may print credentials, or committing code:
+
+1. **Terminal Commands:** When running shell commands whose output may contain API keys, database connection strings, or customer PII (e.g. \`cat .env\`, \`docker logs\`, \`env\`, \`git diff\`), invoke the \`guard_exec\` tool instead of raw terminal execution.
+2. **Reading Credentials/Config:** When reading \`.env*\`, config files, database credentials, or secret keys, always call \`guard_read_file\` so sensitive entities are tokenized locally in RAM before entering your context window.
+3. **Git Code Review:** Use \`guard_git_diff\` to inspect changes without exposing plaintext secrets to the cloud.
+4. **Applying Patches:** When writing files containing token placeholders (e.g. \`[API_KEY_1]\`, \`[DB_PASSWORD_1]\`), use \`guard_apply_patch\` to automatically restore authentic secrets locally to disk without sending them back to the LLM.
+5. **Final Output:** Pass any final synthesized text containing token placeholders through \`reveal_text\` before presenting it to the user.
+`;
+
+  const generatedFiles = [];
+  if (targets.includes("cursor")) {
+    fs.writeFileSync(path.join(targetDir, '.cursorrules'), RULE_TEXT, 'utf8');
+    generatedFiles.push('.cursorrules');
+  }
+  if (targets.includes("windsurf")) {
+    fs.writeFileSync(path.join(targetDir, '.windsurfrules'), RULE_TEXT, 'utf8');
+    generatedFiles.push('.windsurfrules');
+  }
+  if (targets.includes("claude_code") || targets.includes("claude")) {
+    const p = path.join(targetDir, 'CLAUDE.md');
+    if (fs.existsSync(p)) {
+      const existing = fs.readFileSync(p, 'utf8');
+      if (!existing.includes("Zero-Trust Agentic Guard")) {
+        fs.writeFileSync(p, existing + "\n\n" + RULE_TEXT, 'utf8');
+        generatedFiles.push('CLAUDE.md (appended)');
+      } else {
+        generatedFiles.push('CLAUDE.md (already present)');
+      }
+    } else {
+      fs.writeFileSync(p, RULE_TEXT, 'utf8');
+      generatedFiles.push('CLAUDE.md');
+    }
+  }
+  if (targets.includes("copilot")) {
+    const copilotDir = path.join(targetDir, '.github');
+    if (!fs.existsSync(copilotDir)) fs.mkdirSync(copilotDir, { recursive: true });
+    fs.writeFileSync(path.join(copilotDir, 'copilot-instructions.md'), RULE_TEXT, 'utf8');
+    generatedFiles.push('.github/copilot-instructions.md');
+  }
+  if (targets.includes("cline")) {
+    fs.writeFileSync(path.join(targetDir, '.clinerules'), RULE_TEXT, 'utf8');
+    generatedFiles.push('.clinerules');
+  }
+
+  console.log(`[Zero-Trust Agentic Guard: Agent Rules Generated]`);
+  console.log(`Workspace: ${targetDir}`);
+  console.log(`Files Created/Updated:`);
+  generatedFiles.forEach(f => console.log(`  - ${f}`));
+  process.exit(0);
 }
 
-// Spawn child process capturing output
-const child = spawn(commandArgs[0], commandArgs.slice(1), {
-  stdio: ['inherit', 'pipe', 'pipe'],
-  shell: true
-});
-
-const rlStdout = readline.createInterface({
-  input: child.stdout,
-  terminal: false
-});
-
-rlStdout.on('line', (line) => {
-  const sanitized = performSanitization(line);
-  process.stdout.write(sanitized + '\n');
-});
-
-const rlStderr = readline.createInterface({
-  input: child.stderr,
-  terminal: false
-});
-
-rlStderr.on('line', (line) => {
-  const sanitized = performSanitization(line);
-  process.stderr.write(sanitized + '\n');
-});
-
-child.on('close', (code) => {
-  process.exit(code || 0);
-});
-
-child.on('error', (err) => {
-  console.error(`Error spawning command: ${err.message}`);
-  process.exit(1);
-});
+// Mode 2: Git Diff Mode (--diff)
+if (isDiffMode) {
+  const isStaged = args.includes("--staged") || args.includes("--cached");
+  const gitCmd = isStaged ? "git diff --cached" : "git diff";
+  try {
+    let diffOutput = '';
+    try {
+      diffOutput = execSync(gitCmd, { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+    } catch (err) {
+      if (err.code === 'ENOBUFS' && err.stdout) {
+        diffOutput = err.stdout.toString('utf8');
+      } else {
+        throw err;
+      }
+    }
+    if (!diffOutput.trim()) {
+      console.log(`[Zero-Trust Agentic Guard: Git Diff]\nNo git diff changes detected (${isStaged ? 'staged' : 'unstaged'}).`);
+      process.exit(0);
+    }
+    const sanitizedDiff = performSanitization(diffOutput);
+    process.stdout.write(sanitizedDiff.endsWith('\n') ? sanitizedDiff : sanitizedDiff + '\n');
+    emitProofFeedback();
+    process.exit(0);
+  } catch (err) {
+    console.error(`Error running git diff: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+// Mode 3: Stdin Stream Mode (pipe)
+if (hasStdin && !hasCommand) {
+  const rlStdin = readline.createInterface({
+    input: process.stdin,
+    terminal: false
+  });
+  rlStdin.on('line', (line) => {
+    const sanitized = performSanitization(line);
+    process.stdout.write(sanitized + '\n');
+  });
+  rlStdin.on('close', () => {
+    emitProofFeedback();
+    process.exit(0);
+  });
+} else if (hasCommand) {
+  // Mode 4: Spawn Child Process (-- <command>)
+  const commandArgs = args.slice(cmdIndex + 1);
+  const fullCommand = commandArgs.join(' ');
+  const child = spawn(fullCommand, {
+    stdio: ['inherit', 'pipe', 'pipe'],
+    shell: true
+  });
+
+  const rlStdout = readline.createInterface({
+    input: child.stdout,
+    terminal: false
+  });
+
+  rlStdout.on('line', (line) => {
+    const sanitized = performSanitization(line);
+    process.stdout.write(sanitized + '\n');
+  });
+
+  const rlStderr = readline.createInterface({
+    input: child.stderr,
+    terminal: false
+  });
+
+  rlStderr.on('line', (line) => {
+    const sanitized = performSanitization(line);
+    process.stderr.write(sanitized + '\n');
+  });
+
+  child.on('close', (code) => {
+    emitProofFeedback();
+    process.exit(code || 0);
+  });
+
+  child.on('error', (err) => {
+    console.error(`Error spawning command: ${err.message}`);
+    process.exit(1);
+  });
+}

package/ps-pii-engine.cjs

@@ -92,7 +92,7 @@ let REGEX_RULES = [
     { type: 'ID', regex: /\b\d{2}\/\d{2}\/\d{4}\b/g },
 
     // Phone Numbers
-    { type: 'PHONE', regex: /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g },
+    { type: 'PHONE', regex: /(?<!\w)(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g },
     { type: 'PHONE', regex: /\+\d{1,3}[ \t.-]+(?:\(?\d{1,4}\)?[ \t.-]+)?\d{2,8}(?:[ \t.-]+\d{2,8}){0,4}\b/g },
     { type: 'PHONE', regex: /\+?[1-9]\d{1,3}[\s.-]\(?\d{1,4}\)?[\s.-]\d{2,4}[\s.-]\d{4}/g },
     { type: 'PHONE', regex: /(?:\+44\s?7\d{3}|\(?07\d{3}\)?)\s?\d{3}\s?\d{3}\b/g },
@@ -119,6 +119,8 @@ let REGEX_RULES = [
     { type: 'NAME', regex: /(?<=^|[^\p{L}\p{N}_])\p{Lu}{2,}(?:[\p{Lu}'-]*\p{Lu})?(?:(?:[ \t\xA0]*\p{Lu}\.)+[ \t\xA0]*|[ \t\xA0]+)(?:\p{Lu}\p{Ll}[\p{Ll}'-]*|\p{Lu}[\p{Ll}'-]*[\p{Lu}'-][\p{Ll}'-]*)(?:'s)?(?=[^\p{L}\p{N}_]|$)(?![ \t\xA0]*:)/gu },
     // Names with Honorifics (with or without period, supporting single or multi-word full names) (Unicode-safe)
     { type: 'NAME', regex: /(?<=^|[^\p{L}\p{N}_])(?:Mr|Mrs|Ms|Dr|Prof|Hon|Mr\.|Mrs\.|Ms\.|Dr\.|Prof\.|Hon\.)[ \t\xA0]+(?:\p{Lu}[\p{Ll}'-]*\p{Ll}|\p{Lu}[\p{Ll}'-]*[\p{Lu}'-][\p{Ll}'-]*)(?:[ \t\xA0]+(?:\p{Lu}[\p{Ll}'-]*\p{Ll}|\p{Lu}[\p{Ll}'-]*[\p{Lu}'-][\p{Ll}'-]*))?(?=[^\p{L}\p{N}_]|$)(?![ \t\xA0]*:)/gu },
+    // Names with Quoted or Parenthetical Nicknames (e.g. Judith "Judy" Diaz, Robert (Bob) Smith)
+    { type: 'NAME', regex: /(?<=^|[^\p{L}\p{N}_])(?:\p{Lu}[\p{Ll}'-]+)[ \t\xA0]+(?:"[\p{Lu}\p{Ll}'-]+"|'[\p{Lu}\p{Ll}'-]+'|[“‘][\p{Lu}\p{Ll}'-]+[”’]|\([\p{Lu}\p{Ll}'-]+\))[ \t\xA0]+(?:\p{Lu}[\p{Ll}'-]+)(?:'s)?(?=[^\p{L}\p{N}_]|$)(?![ \t\xA0]*:)/gu },
     
     // W-2 Box c Employer Block (Name, Address, and Zip Code)
     { type: 'NAME', isContextName: true, regex: /(?:(?:\bBox\s+c\b|\bc\.\s*|\bc\s+(?=Employer))\s*(?:Employer(?:'s)?\s*)?(?:name[,\s]+address[,\s]+and\s+ZIP\s+code|name)?|(?:Employer(?:'s)?\s+name[,\s]+address[,\s]+and\s+ZIP\s+code))[\s:#]*([A-Za-z0-9&., \t\xA0'-]{2,45}?)(?=\r?\n|$|\s{3,}|\t|EIN|FEIN|Box|\d+\b|Wages|Federal|Social|Medicare)/gi },
@@ -129,7 +131,11 @@ let REGEX_RULES = [
     // Contextual Last Names (Last name, Surname, Family name)
     { type: 'NAME', isContextName: true, regex: /(?:(?:Employee(?:'s)?|Borrower(?:'s)?|Co-Borrower(?:'s)?|Applicant(?:'s)?|Candidate(?:'s)?|Worker(?:'s)?|Taxpayer(?:'s)?|Spouse(?:'s)?|Person(?:'s)?)\s+)?(?:Last\s+name|Surname|Family\s+name)[\s:#]+(?:\b|\b\s*)([A-Za-z'-]{2,30})/gi },
     // Contextual General Names (Employee, Principal Investigator, Physician, Doctor, etc.)
-    { type: 'NAME', isContextName: true, regex: /(?:(?:Employee|Employer|Borrower|Co-Borrower|Applicant|Candidate|Worker|Taxpayer|Spouse|Client|Customer|Patient|Claimant|Insured|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Testator|Author)\s+(?:Name|Full\s+Name)|(?:Principal\s+Investigator|Investigator|Physician|Doctor|Supervisor|Reporting\s+To|Prepared\s+By|Attention|Attn|Contact(?:\s+Person)?|Author)(?:\s+Name)?|(?:Employee|Employer|Borrower|Client|Customer|Patient|Claimant|Insured|Doctor|Attn|Signatory|Witness|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Author)\s*[:=#])[:\s#]*(?:\b|\b\s*)([A-Z\p{Lu}][A-Za-z0-9&.,\s'-]{1,35}?)(?=\r?\n|$|\s{3,}|\t|Employee|Employer|Address|Phone|SSN|EIN|FEIN|Date|Pay|Rate|Tax|W-2|OMB|Copy|Box|Status)/giu },
+    { type: 'NAME', isContextName: true, regex: /(?:(?:Employee|Employer|Borrower|Co-Borrower|Applicant|Candidate|Worker|Taxpayer|Spouse|Client|Customer|Patient|Claimant|Insured|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Testator|Author)\s+(?:Name|Full\s+Name)|(?:Principal\s+Investigator|Investigator|Physician|Doctor|Supervisor|Reporting\s+To|Prepared\s+By|Attention|Attn|(?<!Emergency\s+|ICE\s+)Contact(?:\s+Person)?|Author)(?:\s+Name)?|(?:Employee|Employer|Borrower|Client|Customer|Patient|Claimant|Insured|Doctor|Attn|Signatory|Witness|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Author)\s*[:=#])[:\s#|]*(?:\b|\b\s*)([A-Z\p{Lu}][A-Za-z0-9&.,\s'"“”()-]{1,35}?)(?=\r?\n|$|\s{3,}|\t|Employee|Employer|Address|Phone|SSN|EIN|FEIN|Date|Pay|Rate|Tax|W-2|OMB|Copy|Box|Status|\|)/giu },
+    // Contextual Nicknames & Preferred Names (e.g. "Nickname: Judy", "Preferred Name: Alex", "AKA: Bob", "Goes by: Sam")
+    { type: 'NAME', isContextName: true, regex: /(?:(?:Patient(?:'s)?|Client(?:'s)?|Child(?:'s)?|Employee(?:'s)?|Person(?:'s)?)\s+)?(?:Nickname|Nick\s+Name|Preferred\s+(?:First\s+)?Name|Also\s+Known\s+As|AKA|Alias|Goes\s+by)[\s:#]+(?:\b|\b\s*)([A-Z\p{Lu}][A-Za-z0-9&.,\s'-]{1,30}?)(?=\r?\n|$|\s{3,}|\t|DOB|Date|Phone|Address|Emergency|Relationship|Notes|MRN|\()/giu },
+    // Emergency Contacts (Standard, Inverted Last First, Single Name, Table Cells, Extended Relationships, Brackets & Phone Lookahead)
+    { type: 'NAME', isContextName: true, regex: /(?:(?:^|[^\p{L}\p{N}_]|\|)\s*(?:In\s+Case\s+of\s+Emergency(?:\s*\(ICE\))?|ICE(?:[ \t\xA0]*(?:Contact|Notification|Person|Name))?|Emergency(?:[ \t\xA0]*(?:Contact|Notification|Person|Info|Details))?|Primary\s+Emergency\s+Contact|Secondary\s+Emergency\s+Contact|Alternate\s+Emergency\s+Contact|Person\s+to\s+notify\s+(?:in\s+case\s+of\s+emergency|in\s+emergency))(?:[ \t\xA0]*(?:[12#]|#\s*\d|\(\d\)))?(?:[ \t\xA0]*(?:Person|Name|Full\s+Name))?(?:[ \t\xA0]*(?:[\/&+-]|and)[ \t\xA0]*(?:Relationship|Relation|Proxy|Guarantor|Guardian))?(?:[ \t\xA0]*\((?:Primary|Secondary|Name|Relationship|Relation|Proxy|Guarantor|Legal\s+Guardian|Full\s+Name)\))?)[:=#|\/\t\s-]*[:=#|\/\t-][ \t\xA0]*([A-Z\p{Lu}][A-Za-z0-9&.'’]*(?:[ \t\xA0]+[A-Za-z0-9&.'’]+)*(?:,[ \t\xA0]*(?!(?:Relationship|Relation|Rel|Mother|Father|Spouse|Wife|Husband|Partner|Son|Daughter|Child|Parent|Brother|Sister|Sibling|Friend|Aunt|Uncle|Cousin|Guardian|Caregiver|Carer|Neighbor|Relative|Family|Grandmother|Grandfather|Grandparent|Grandson|Granddaughter|Stepmother|Stepfather|Stepson|Stepdaughter|Step-mother|Step-father|In-law|Mother-in-law|Father-in-law|Sister-in-law|Brother-in-law|Son-in-law|Daughter-in-law|Fiancé|Fiance|Fiancee|Significant\s+Other|Domestic\s+Partner|Life\s+Partner|Roommate|Colleague|Coworker|Co-worker|Legal\s+Guardian|Case\s+Worker|Caseworker|Social\s+Worker|Foster\s+Parent|POA|Power\s+of\s+Attorney|Healthcare\s+Proxy|Medical\s+Proxy|Proxy|Next\s+of\s+Kin|Aide)\b)[A-Z\p{Lu}][A-Za-z0-9&.'’]*(?:[ \t\xA0]+[A-Za-z0-9&.'’]+)*)?)(?=[ \t\xA0]*(?:\([A-Za-z0-9\s\/&':.+–-]+\)|\[[A-Za-z0-9\s\/&':.+–-]+\]|\{[A-Za-z0-9\s\/&':.+–-]+\}|[,\/|\-–—]{1,3}\s*(?:Relationship|Relation|Rel|Mother|Father|Spouse|Wife|Husband|Partner|Son|Daughter|Child|Parent|Brother|Sister|Sibling|Friend|Aunt|Uncle|Cousin|Guardian|Caregiver|Carer|Neighbor|Relative|Family|Grandmother|Grandfather|Grandparent|Grandson|Granddaughter|Stepmother|Stepfather|Stepson|Stepdaughter|Step-mother|Step-father|In-law|Mother-in-law|Father-in-law|Sister-in-law|Brother-in-law|Son-in-law|Daughter-in-law|Fiancé|Fiance|Fiancee|Significant\s+Other|Domestic\s+Partner|Life\s+Partner|Roommate|Colleague|Coworker|Co-worker|Legal\s+Guardian|Case\s+Worker|Caseworker|Social\s+Worker|Foster\s+Parent|POA|Power\s+of\s+Attorney|Healthcare\s+Proxy|Medical\s+Proxy|Proxy|Next\s+of\s+Kin|Aide)\b|[,\/|\-–—]?[ \t\xA0]*(?:Phone|Tel|Cell|Mobile|Work|Home|Office|Direct|Telephone)[:\s#-]*|[,\/|\-–—]?[ \t\xA0]*(?:Relationship|Relation|Rel)[:\s#-]*|[,\/|\-–—]?[ \t\xA0]*(?:\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b|[,\/|\-–—]?[ \t\xA0]*\d{3}[-.\s]?\d{4}\b|[ \t\xA0]*(?:\||\r?\n|$|\s{2,}|\t)))/gui },
     // Box e shorthand
     { type: 'NAME', isContextName: true, regex: /\b(?:Box\s+e)\s*[:#-]\s*([A-Za-z0-9&.,\s'-]{2,40})/gi }
 ];
@@ -181,7 +187,9 @@ let PROFILE_RULES = {
         { type: 'ID', regex: /\b(?:FEIN|EIN|TIN|Tax\s*ID)[:\s#]*(\d{2}-\d{7})\b/gi },
         { type: 'ID', regex: /\b(?:CRD|CIK|Advisor\s*ID|Broker\s*ID)[:\s#]*(\d{5,10})\b/gi },
         { type: 'ID', regex: /\b(?:LEI|LEGAL[\s-]ENTITY[\s-]IDENTIFIER)[:\s#-]*[0-9A-Z]{20}\b/gi },
-        { type: 'ID', regex: /\bBBG[0-9A-Z]{9}\b/g }
+        { type: 'ID', regex: /\bBBG[0-9A-Z]{9}\b/g },
+        { type: 'FINANCIAL', regex: /(?<=\b(?:Wire(?:\s+(?:Transfer|Amount))?|Transfer|Balance|Deposit|Withdrawal|Settlement|Principal|Interest|Remittance|Payout|Transaction(?:\s+Amount)?|Payment(?:\s+Amount)?|Total|Amount)[:\s]+)(?:(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\s*|[$€£¥₪₽₹]\s*)[0-9,.'’]*\d[KMB]?\b|\b\d[0-9,.'’]*\d?[KMB]?\s*(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\b|[$€£¥₪₽₹])|[0-9,.'’]{3,}\b)/gi },
+        { type: 'FINANCIAL', regex: /(?:(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\s*|[$€£¥₪₽₹]\s*)[0-9,.'’]*\d[KMB]?\b|\b\d[0-9,.'’]*\d?[KMB]?\s*(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\b|[$€£¥₪₽₹]))/gi }
     ],
     medical: [
         { type: 'PHI', regex: /\b(?:MRN|Patient ID|Medical Record (?:No\.?|Num(?:ber)?|#)|Patient (?:No\.?|Num(?:ber)?|#))[\s:#]+([A-Za-z0-9-]+)/gi },
@@ -409,7 +417,7 @@ let PROFILE_RULES = {
         { type: 'FINANCIAL', regex: /\b(?:Loss|Claim\s+Amount|Claim\s+Settlement|Settlement|Reserve|Indemnity)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’]+\b/gi },
         { type: 'ID', regex: /\b(?:(?:Assigned\s+)?Adjuster\s+(?:ID|No)|Claim\s+Rep(?:\.|resentative)?)[:\s#]*[-A-Z0-9]{4,15}\b/gi },
         { type: 'ID', regex: /\bNAIC(?:\s+(?:Company\s+)?(?:Code|CoCode|No\.?|Number|#))?[:\s#]*(\d{5})\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Deductible|Premium|Coverage\s+Amount)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'']+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Deductible|Premium|Coverage\s+Amount)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b[A-HJ-NPR-Z0-9]{17}\b/g },
         { type: 'ID', regex: /\b(?:Insured|Named\s+Insured)[:\s]+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)+/g },
         { type: 'ID', regex: /\b(?:Agent|Producer)\s*(?:Code|No|ID)[:\s#]*[-A-Z0-9]{4,15}\b/gi },
@@ -421,11 +429,11 @@ let PROFILE_RULES = {
     accounting: [
         { type: 'ID', regex: /\b(?:EIN|FEIN|Tax\s+ID)[:\s#]*\d{2}-\d{7}\b/gi },
         { type: 'FINANCIAL', regex: /\b(?:AGI|Adjusted\s+Gross\s+Income|Taxable\s+Income|Total\s+Income)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’]+\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Form\s+|Withheld\s+)?Box\s+\d{1,2}[a-z]?(?:\s*:\s*[A-Z])?\s*[:\s]+(?:[$\u20ac\u00a3\u00a5\u20aa\u20bd\u20b9]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.\u2018\u2019]+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Form\s+|Withheld\s+)?Box\s+\d{1,2}[a-z]?(?:\s*:\s*[A-Z])?\s*[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b(?:Form|Schedule)\s+(?:1040|1040-SR|W-2|W-4|1099-[A-Z]{1,4}|K-1|941|990|4562)\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Federal|State|Assessed)?\s*(?:Tax\s+Due|Balance\s+Due|Overpayment|Refund)[:\s]+(?:[$\u20ac\u00a3\u00a5\u20aa\u20bd\u20b9]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.\u2018\u2019]+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Federal|State|Assessed)?\s*(?:Tax\s+Due|Balance\s+Due|Overpayment|Refund)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b(?:State\s+Tax\s+ID|SUI|UI\s+Account\s+No)[:\s#]*[A-Z]{0,3}[-]?\d{4,15}\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Gross|Net|Medicare|Social\s+Security)\s+(?:Pay|Wages|Tips|Withholding)[:\s]+(?:[$\u20ac\u00a3\u00a5\u20aa\u20bd\u20b9]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.\u2018\u2019]+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Gross|Net|Medicare|Social\s+Security)\s+(?:Pay|Wages|Tips|Withholding)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b(?:CAF(?:\s+ID)?|(?:Practitioner|Tax\s+Preparer)\s+(?:PIN|ID)|PTIN)[:\s#]*[A-Z0-9-]{6,12}\b/gi },
         { type: 'ID', regex: /\bEFIN[:\s#]*\d{6}\b/gi },
         { type: 'ID', regex: /\bGL[-_\s]*(?:Account|Acct|Code)?[:\s#]*\d{4,10}\b/gi },
@@ -829,7 +837,7 @@ const PROFILE_JARGON = {
         'underwriting': 'underwriting', 'lending': 'underwriting', 'mortgage': 'underwriting', 'loan': 'underwriting', 'income': 'underwriting', 'income_verification': 'underwriting', 'payroll': 'underwriting', 'w2': 'underwriting', 'paystub': 'underwriting',
         'medical': 'medical', 'healthcare': 'medical', 'health': 'medical', 'pharma': 'pharma', 'hipaa': 'medical',
         'engineering': 'engineering', 'dev': 'dev', 'api': 'dev', 'devops': 'engineering', 'tech': 'tech',
-        'finance': 'finance', 'bizops': 'bizops', 'sales': 'sales', 'wealthmgmt': 'wealthmgmt', 'wealth': 'wealthmgmt', 'insurance': 'insurance', 'accounting': 'accounting', 'pci': 'finance',
+        'finance': 'finance', 'financial': 'finance', 'bizops': 'bizops', 'sales': 'sales', 'wealthmgmt': 'wealthmgmt', 'wealth': 'wealthmgmt', 'insurance': 'insurance', 'accounting': 'accounting', 'pci': 'finance',
         'legal': 'legal', 'compliance': 'compliance', 'ccpa': 'ccpa', 'gdpr': 'compliance', 'soc2': 'compliance', 'iso27001': 'compliance', 'nist': 'compliance', 'dpo': 'compliance', 'grc': 'compliance',
         'hr': 'hr', 'security': 'security', 'marketing': 'marketing', 'support': 'support',
         'realestate': 'realestate', 'academic': 'academic', 'agents': 'agents', 'ai_agents': 'agents', 'creative': 'creative', 'personal': 'personal'
@@ -847,16 +855,18 @@ const PROFILE_JARGON = {
     }
 
     function stitchOrphanedNameLines(text, profile) {
-        if (profile === 'medical') {
-            text = text.replace(/Patient Name:\s*\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Patient Name: $1');
-        } else if (profile === 'legal') {
-            text = text.replace(/Defendant:\s*\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Defendant: $1');
+        if (!text || !text.includes('\n')) return text;
+        const prof = (profile || 'general').toLowerCase();
+        if (prof === 'medical' || prof === 'general') {
+            text = text.replace(/(Patient\s+Name|Emergency\s+Contact|In\s+Case\s+of\s+Emergency|ICE(?:\s+Contact)?):\s*\r?\n+([A-Z\p{Lu}][A-Za-z0-9&.,'’ \t-]*?[A-Za-z0-9\p{Lu}\p{Ll}])(?=\r?\n|$)/gui, '$1: $2');
+        } else if (prof === 'legal') {
+            text = text.replace(/Defendant:\s*\r?\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Defendant: $1');
         }
         return text;
     }
 
     function detectMatches(text, activeProfile = 'general', customRules = [], nlpNames = [], enabledEntities = null, mlEntities = []) {
-        let textToProcess = text.replace(/[\u200b\u200c\u200d\ufeff]/g, '');
+        let textToProcess = stitchOrphanedNameLines(text, activeProfile).replace(/[\u200b\u200c\u200d\ufeff]/g, '');
         textToProcess = textToProcess.replace(/([a-z])(Email|Phone|Mobile|Tel|Address|IP|ID|URL|SSN|Date):/g, '$1 $2:');
 
         let matches = [];

package/ps-pii-engine.js

@@ -92,7 +92,7 @@ let REGEX_RULES = [
     { type: 'ID', regex: /\b\d{2}\/\d{2}\/\d{4}\b/g },
 
     // Phone Numbers
-    { type: 'PHONE', regex: /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g },
+    { type: 'PHONE', regex: /(?<!\w)(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b/g },
     { type: 'PHONE', regex: /\+\d{1,3}[ \t.-]+(?:\(?\d{1,4}\)?[ \t.-]+)?\d{2,8}(?:[ \t.-]+\d{2,8}){0,4}\b/g },
     { type: 'PHONE', regex: /\+?[1-9]\d{1,3}[\s.-]\(?\d{1,4}\)?[\s.-]\d{2,4}[\s.-]\d{4}/g },
     { type: 'PHONE', regex: /(?:\+44\s?7\d{3}|\(?07\d{3}\)?)\s?\d{3}\s?\d{3}\b/g },
@@ -119,6 +119,8 @@ let REGEX_RULES = [
     { type: 'NAME', regex: /(?<=^|[^\p{L}\p{N}_])\p{Lu}{2,}(?:[\p{Lu}'-]*\p{Lu})?(?:(?:[ \t\xA0]*\p{Lu}\.)+[ \t\xA0]*|[ \t\xA0]+)(?:\p{Lu}\p{Ll}[\p{Ll}'-]*|\p{Lu}[\p{Ll}'-]*[\p{Lu}'-][\p{Ll}'-]*)(?:'s)?(?=[^\p{L}\p{N}_]|$)(?![ \t\xA0]*:)/gu },
     // Names with Honorifics (with or without period, supporting single or multi-word full names) (Unicode-safe)
     { type: 'NAME', regex: /(?<=^|[^\p{L}\p{N}_])(?:Mr|Mrs|Ms|Dr|Prof|Hon|Mr\.|Mrs\.|Ms\.|Dr\.|Prof\.|Hon\.)[ \t\xA0]+(?:\p{Lu}[\p{Ll}'-]*\p{Ll}|\p{Lu}[\p{Ll}'-]*[\p{Lu}'-][\p{Ll}'-]*)(?:[ \t\xA0]+(?:\p{Lu}[\p{Ll}'-]*\p{Ll}|\p{Lu}[\p{Ll}'-]*[\p{Lu}'-][\p{Ll}'-]*))?(?=[^\p{L}\p{N}_]|$)(?![ \t\xA0]*:)/gu },
+    // Names with Quoted or Parenthetical Nicknames (e.g. Judith "Judy" Diaz, Robert (Bob) Smith)
+    { type: 'NAME', regex: /(?<=^|[^\p{L}\p{N}_])(?:\p{Lu}[\p{Ll}'-]+)[ \t\xA0]+(?:"[\p{Lu}\p{Ll}'-]+"|'[\p{Lu}\p{Ll}'-]+'|[“‘][\p{Lu}\p{Ll}'-]+[”’]|\([\p{Lu}\p{Ll}'-]+\))[ \t\xA0]+(?:\p{Lu}[\p{Ll}'-]+)(?:'s)?(?=[^\p{L}\p{N}_]|$)(?![ \t\xA0]*:)/gu },
     
     // W-2 Box c Employer Block (Name, Address, and Zip Code)
     { type: 'NAME', isContextName: true, regex: /(?:(?:\bBox\s+c\b|\bc\.\s*|\bc\s+(?=Employer))\s*(?:Employer(?:'s)?\s*)?(?:name[,\s]+address[,\s]+and\s+ZIP\s+code|name)?|(?:Employer(?:'s)?\s+name[,\s]+address[,\s]+and\s+ZIP\s+code))[\s:#]*([A-Za-z0-9&., \t\xA0'-]{2,45}?)(?=\r?\n|$|\s{3,}|\t|EIN|FEIN|Box|\d+\b|Wages|Federal|Social|Medicare)/gi },
@@ -129,7 +131,11 @@ let REGEX_RULES = [
     // Contextual Last Names (Last name, Surname, Family name)
     { type: 'NAME', isContextName: true, regex: /(?:(?:Employee(?:'s)?|Borrower(?:'s)?|Co-Borrower(?:'s)?|Applicant(?:'s)?|Candidate(?:'s)?|Worker(?:'s)?|Taxpayer(?:'s)?|Spouse(?:'s)?|Person(?:'s)?)\s+)?(?:Last\s+name|Surname|Family\s+name)[\s:#]+(?:\b|\b\s*)([A-Za-z'-]{2,30})/gi },
     // Contextual General Names (Employee, Principal Investigator, Physician, Doctor, etc.)
-    { type: 'NAME', isContextName: true, regex: /(?:(?:Employee|Employer|Borrower|Co-Borrower|Applicant|Candidate|Worker|Taxpayer|Spouse|Client|Customer|Patient|Claimant|Insured|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Testator|Author)\s+(?:Name|Full\s+Name)|(?:Principal\s+Investigator|Investigator|Physician|Doctor|Supervisor|Reporting\s+To|Prepared\s+By|Attention|Attn|Contact(?:\s+Person)?|Author)(?:\s+Name)?|(?:Employee|Employer|Borrower|Client|Customer|Patient|Claimant|Insured|Doctor|Attn|Signatory|Witness|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Author)\s*[:=#])[:\s#]*(?:\b|\b\s*)([A-Z\p{Lu}][A-Za-z0-9&.,\s'-]{1,35}?)(?=\r?\n|$|\s{3,}|\t|Employee|Employer|Address|Phone|SSN|EIN|FEIN|Date|Pay|Rate|Tax|W-2|OMB|Copy|Box|Status)/giu },
+    { type: 'NAME', isContextName: true, regex: /(?:(?:Employee|Employer|Borrower|Co-Borrower|Applicant|Candidate|Worker|Taxpayer|Spouse|Client|Customer|Patient|Claimant|Insured|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Testator|Author)\s+(?:Name|Full\s+Name)|(?:Principal\s+Investigator|Investigator|Physician|Doctor|Supervisor|Reporting\s+To|Prepared\s+By|Attention|Attn|(?<!Emergency\s+|ICE\s+)Contact(?:\s+Person)?|Author)(?:\s+Name)?|(?:Employee|Employer|Borrower|Client|Customer|Patient|Claimant|Insured|Doctor|Attn|Signatory|Witness|Tenant|Landlord|Buyer|Seller|Plaintiff|Defendant|Author)\s*[:=#])[:\s#|]*(?:\b|\b\s*)([A-Z\p{Lu}][A-Za-z0-9&.,\s'"“”()-]{1,35}?)(?=\r?\n|$|\s{3,}|\t|Employee|Employer|Address|Phone|SSN|EIN|FEIN|Date|Pay|Rate|Tax|W-2|OMB|Copy|Box|Status|\|)/giu },
+    // Contextual Nicknames & Preferred Names (e.g. "Nickname: Judy", "Preferred Name: Alex", "AKA: Bob", "Goes by: Sam")
+    { type: 'NAME', isContextName: true, regex: /(?:(?:Patient(?:'s)?|Client(?:'s)?|Child(?:'s)?|Employee(?:'s)?|Person(?:'s)?)\s+)?(?:Nickname|Nick\s+Name|Preferred\s+(?:First\s+)?Name|Also\s+Known\s+As|AKA|Alias|Goes\s+by)[\s:#]+(?:\b|\b\s*)([A-Z\p{Lu}][A-Za-z0-9&.,\s'-]{1,30}?)(?=\r?\n|$|\s{3,}|\t|DOB|Date|Phone|Address|Emergency|Relationship|Notes|MRN|\()/giu },
+    // Emergency Contacts (Standard, Inverted Last First, Single Name, Table Cells, Extended Relationships, Brackets & Phone Lookahead)
+    { type: 'NAME', isContextName: true, regex: /(?:(?:^|[^\p{L}\p{N}_]|\|)\s*(?:In\s+Case\s+of\s+Emergency(?:\s*\(ICE\))?|ICE(?:[ \t\xA0]*(?:Contact|Notification|Person|Name))?|Emergency(?:[ \t\xA0]*(?:Contact|Notification|Person|Info|Details))?|Primary\s+Emergency\s+Contact|Secondary\s+Emergency\s+Contact|Alternate\s+Emergency\s+Contact|Person\s+to\s+notify\s+(?:in\s+case\s+of\s+emergency|in\s+emergency))(?:[ \t\xA0]*(?:[12#]|#\s*\d|\(\d\)))?(?:[ \t\xA0]*(?:Person|Name|Full\s+Name))?(?:[ \t\xA0]*(?:[\/&+-]|and)[ \t\xA0]*(?:Relationship|Relation|Proxy|Guarantor|Guardian))?(?:[ \t\xA0]*\((?:Primary|Secondary|Name|Relationship|Relation|Proxy|Guarantor|Legal\s+Guardian|Full\s+Name)\))?)[:=#|\/\t\s-]*[:=#|\/\t-][ \t\xA0]*([A-Z\p{Lu}][A-Za-z0-9&.'’]*(?:[ \t\xA0]+[A-Za-z0-9&.'’]+)*(?:,[ \t\xA0]*(?!(?:Relationship|Relation|Rel|Mother|Father|Spouse|Wife|Husband|Partner|Son|Daughter|Child|Parent|Brother|Sister|Sibling|Friend|Aunt|Uncle|Cousin|Guardian|Caregiver|Carer|Neighbor|Relative|Family|Grandmother|Grandfather|Grandparent|Grandson|Granddaughter|Stepmother|Stepfather|Stepson|Stepdaughter|Step-mother|Step-father|In-law|Mother-in-law|Father-in-law|Sister-in-law|Brother-in-law|Son-in-law|Daughter-in-law|Fiancé|Fiance|Fiancee|Significant\s+Other|Domestic\s+Partner|Life\s+Partner|Roommate|Colleague|Coworker|Co-worker|Legal\s+Guardian|Case\s+Worker|Caseworker|Social\s+Worker|Foster\s+Parent|POA|Power\s+of\s+Attorney|Healthcare\s+Proxy|Medical\s+Proxy|Proxy|Next\s+of\s+Kin|Aide)\b)[A-Z\p{Lu}][A-Za-z0-9&.'’]*(?:[ \t\xA0]+[A-Za-z0-9&.'’]+)*)?)(?=[ \t\xA0]*(?:\([A-Za-z0-9\s\/&':.+–-]+\)|\[[A-Za-z0-9\s\/&':.+–-]+\]|\{[A-Za-z0-9\s\/&':.+–-]+\}|[,\/|\-–—]{1,3}\s*(?:Relationship|Relation|Rel|Mother|Father|Spouse|Wife|Husband|Partner|Son|Daughter|Child|Parent|Brother|Sister|Sibling|Friend|Aunt|Uncle|Cousin|Guardian|Caregiver|Carer|Neighbor|Relative|Family|Grandmother|Grandfather|Grandparent|Grandson|Granddaughter|Stepmother|Stepfather|Stepson|Stepdaughter|Step-mother|Step-father|In-law|Mother-in-law|Father-in-law|Sister-in-law|Brother-in-law|Son-in-law|Daughter-in-law|Fiancé|Fiance|Fiancee|Significant\s+Other|Domestic\s+Partner|Life\s+Partner|Roommate|Colleague|Coworker|Co-worker|Legal\s+Guardian|Case\s+Worker|Caseworker|Social\s+Worker|Foster\s+Parent|POA|Power\s+of\s+Attorney|Healthcare\s+Proxy|Medical\s+Proxy|Proxy|Next\s+of\s+Kin|Aide)\b|[,\/|\-–—]?[ \t\xA0]*(?:Phone|Tel|Cell|Mobile|Work|Home|Office|Direct|Telephone)[:\s#-]*|[,\/|\-–—]?[ \t\xA0]*(?:Relationship|Relation|Rel)[:\s#-]*|[,\/|\-–—]?[ \t\xA0]*(?:\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b|[,\/|\-–—]?[ \t\xA0]*\d{3}[-.\s]?\d{4}\b|[ \t\xA0]*(?:\||\r?\n|$|\s{2,}|\t)))/gui },
     // Box e shorthand
     { type: 'NAME', isContextName: true, regex: /\b(?:Box\s+e)\s*[:#-]\s*([A-Za-z0-9&.,\s'-]{2,40})/gi }
 ];
@@ -181,7 +187,9 @@ let PROFILE_RULES = {
         { type: 'ID', regex: /\b(?:FEIN|EIN|TIN|Tax\s*ID)[:\s#]*(\d{2}-\d{7})\b/gi },
         { type: 'ID', regex: /\b(?:CRD|CIK|Advisor\s*ID|Broker\s*ID)[:\s#]*(\d{5,10})\b/gi },
         { type: 'ID', regex: /\b(?:LEI|LEGAL[\s-]ENTITY[\s-]IDENTIFIER)[:\s#-]*[0-9A-Z]{20}\b/gi },
-        { type: 'ID', regex: /\bBBG[0-9A-Z]{9}\b/g }
+        { type: 'ID', regex: /\bBBG[0-9A-Z]{9}\b/g },
+        { type: 'FINANCIAL', regex: /(?<=\b(?:Wire(?:\s+(?:Transfer|Amount))?|Transfer|Balance|Deposit|Withdrawal|Settlement|Principal|Interest|Remittance|Payout|Transaction(?:\s+Amount)?|Payment(?:\s+Amount)?|Total|Amount)[:\s]+)(?:(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\s*|[$€£¥₪₽₹]\s*)[0-9,.'’]*\d[KMB]?\b|\b\d[0-9,.'’]*\d?[KMB]?\s*(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\b|[$€£¥₪₽₹])|[0-9,.'’]{3,}\b)/gi },
+        { type: 'FINANCIAL', regex: /(?:(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\s*|[$€£¥₪₽₹]\s*)[0-9,.'’]*\d[KMB]?\b|\b\d[0-9,.'’]*\d?[KMB]?\s*(?:\b(?:USD|EUR|GBP|CHF|ILS|RUB)\b|[$€£¥₪₽₹]))/gi }
     ],
     medical: [
         { type: 'PHI', regex: /\b(?:MRN|Patient ID|Medical Record (?:No\.?|Num(?:ber)?|#)|Patient (?:No\.?|Num(?:ber)?|#))[\s:#]+([A-Za-z0-9-]+)/gi },
@@ -409,7 +417,7 @@ let PROFILE_RULES = {
         { type: 'FINANCIAL', regex: /\b(?:Loss|Claim\s+Amount|Claim\s+Settlement|Settlement|Reserve|Indemnity)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’]+\b/gi },
         { type: 'ID', regex: /\b(?:(?:Assigned\s+)?Adjuster\s+(?:ID|No)|Claim\s+Rep(?:\.|resentative)?)[:\s#]*[-A-Z0-9]{4,15}\b/gi },
         { type: 'ID', regex: /\bNAIC(?:\s+(?:Company\s+)?(?:Code|CoCode|No\.?|Number|#))?[:\s#]*(\d{5})\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Deductible|Premium|Coverage\s+Amount)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'']+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Deductible|Premium|Coverage\s+Amount)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b[A-HJ-NPR-Z0-9]{17}\b/g },
         { type: 'ID', regex: /\b(?:Insured|Named\s+Insured)[:\s]+[A-Z][a-z]+(?:\s+[A-Z][a-z]+)+/g },
         { type: 'ID', regex: /\b(?:Agent|Producer)\s*(?:Code|No|ID)[:\s#]*[-A-Z0-9]{4,15}\b/gi },
@@ -421,11 +429,11 @@ let PROFILE_RULES = {
     accounting: [
         { type: 'ID', regex: /\b(?:EIN|FEIN|Tax\s+ID)[:\s#]*\d{2}-\d{7}\b/gi },
         { type: 'FINANCIAL', regex: /\b(?:AGI|Adjusted\s+Gross\s+Income|Taxable\s+Income|Total\s+Income)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’]+\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Form\s+|Withheld\s+)?Box\s+\d{1,2}[a-z]?(?:\s*:\s*[A-Z])?\s*[:\s]+(?:[$\u20ac\u00a3\u00a5\u20aa\u20bd\u20b9]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.\u2018\u2019]+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Form\s+|Withheld\s+)?Box\s+\d{1,2}[a-z]?(?:\s*:\s*[A-Z])?\s*[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b(?:Form|Schedule)\s+(?:1040|1040-SR|W-2|W-4|1099-[A-Z]{1,4}|K-1|941|990|4562)\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Federal|State|Assessed)?\s*(?:Tax\s+Due|Balance\s+Due|Overpayment|Refund)[:\s]+(?:[$\u20ac\u00a3\u00a5\u20aa\u20bd\u20b9]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.\u2018\u2019]+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Federal|State|Assessed)?\s*(?:Tax\s+Due|Balance\s+Due|Overpayment|Refund)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b(?:State\s+Tax\s+ID|SUI|UI\s+Account\s+No)[:\s#]*[A-Z]{0,3}[-]?\d{4,15}\b/gi },
-        { type: 'FINANCIAL', regex: /\b(?:Gross|Net|Medicare|Social\s+Security)\s+(?:Pay|Wages|Tips|Withholding)[:\s]+(?:[$\u20ac\u00a3\u00a5\u20aa\u20bd\u20b9]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.\u2018\u2019]+\b/gi },
+        { type: 'FINANCIAL', regex: /\b(?:Gross|Net|Medicare|Social\s+Security)\s+(?:Pay|Wages|Tips|Withholding)[:\s]+(?:[$€£¥₪₽₹]|(?:USD|EUR|GBP|CHF|ILS|RUB)\s?)[\d,.'’\u2018\u2019]+\b/gi },
         { type: 'ID', regex: /\b(?:CAF(?:\s+ID)?|(?:Practitioner|Tax\s+Preparer)\s+(?:PIN|ID)|PTIN)[:\s#]*[A-Z0-9-]{6,12}\b/gi },
         { type: 'ID', regex: /\bEFIN[:\s#]*\d{6}\b/gi },
         { type: 'ID', regex: /\bGL[-_\s]*(?:Account|Acct|Code)?[:\s#]*\d{4,10}\b/gi },
@@ -829,7 +837,7 @@ const PROFILE_JARGON = {
         'underwriting': 'underwriting', 'lending': 'underwriting', 'mortgage': 'underwriting', 'loan': 'underwriting', 'income': 'underwriting', 'income_verification': 'underwriting', 'payroll': 'underwriting', 'w2': 'underwriting', 'paystub': 'underwriting',
         'medical': 'medical', 'healthcare': 'medical', 'health': 'medical', 'pharma': 'pharma', 'hipaa': 'medical',
         'engineering': 'engineering', 'dev': 'dev', 'api': 'dev', 'devops': 'engineering', 'tech': 'tech',
-        'finance': 'finance', 'bizops': 'bizops', 'sales': 'sales', 'wealthmgmt': 'wealthmgmt', 'wealth': 'wealthmgmt', 'insurance': 'insurance', 'accounting': 'accounting', 'pci': 'finance',
+        'finance': 'finance', 'financial': 'finance', 'bizops': 'bizops', 'sales': 'sales', 'wealthmgmt': 'wealthmgmt', 'wealth': 'wealthmgmt', 'insurance': 'insurance', 'accounting': 'accounting', 'pci': 'finance',
         'legal': 'legal', 'compliance': 'compliance', 'ccpa': 'ccpa', 'gdpr': 'compliance', 'soc2': 'compliance', 'iso27001': 'compliance', 'nist': 'compliance', 'dpo': 'compliance', 'grc': 'compliance',
         'hr': 'hr', 'security': 'security', 'marketing': 'marketing', 'support': 'support',
         'realestate': 'realestate', 'academic': 'academic', 'agents': 'agents', 'ai_agents': 'agents', 'creative': 'creative', 'personal': 'personal'
@@ -847,16 +855,18 @@ const PROFILE_JARGON = {
     }
 
     function stitchOrphanedNameLines(text, profile) {
-        if (profile === 'medical') {
-            text = text.replace(/Patient Name:\s*\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Patient Name: $1');
-        } else if (profile === 'legal') {
-            text = text.replace(/Defendant:\s*\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Defendant: $1');
+        if (!text || !text.includes('\n')) return text;
+        const prof = (profile || 'general').toLowerCase();
+        if (prof === 'medical' || prof === 'general') {
+            text = text.replace(/(Patient\s+Name|Emergency\s+Contact|In\s+Case\s+of\s+Emergency|ICE(?:\s+Contact)?):\s*\r?\n+([A-Z\p{Lu}][A-Za-z0-9&.,'’ \t-]*?[A-Za-z0-9\p{Lu}\p{Ll}])(?=\r?\n|$)/gui, '$1: $2');
+        } else if (prof === 'legal') {
+            text = text.replace(/Defendant:\s*\r?\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Defendant: $1');
         }
         return text;
     }
 
     function detectMatches(text, activeProfile = 'general', customRules = [], nlpNames = [], enabledEntities = null, mlEntities = []) {
-        let textToProcess = text.replace(/[\u200b\u200c\u200d\ufeff]/g, '');
+        let textToProcess = stitchOrphanedNameLines(text, activeProfile).replace(/[\u200b\u200c\u200d\ufeff]/g, '');
         textToProcess = textToProcess.replace(/([a-z])(Email|Phone|Mobile|Tel|Address|IP|ID|URL|SSN|Date):/g, '$1 $2:');
 
         let matches = [];

package/scrubber-core.cjs

@@ -38,10 +38,10 @@
 function stitchOrphanedNameLines(text, profile) {
     if (!text || !text.includes('\n')) return text;
     const prof = (profile || 'general').toLowerCase();
-    if (prof === 'medical') {
-        text = text.replace(/Patient Name:\s*\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Patient Name: $1');
+    if (prof === 'medical' || prof === 'general') {
+        text = text.replace(/(Patient\s+Name|Emergency\s+Contact|In\s+Case\s+of\s+Emergency|ICE(?:\s+Contact)?):\s*\r?\n+([A-Z\p{Lu}][A-Za-z0-9&.,'’ \t-]*?[A-Za-z0-9\p{Lu}\p{Ll}])(?=\r?\n|$)/gui, '$1: $2');
     } else if (prof === 'legal') {
-        text = text.replace(/Defendant:\s*\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Defendant: $1');
+        text = text.replace(/Defendant:\s*\r?\n+([A-Z][a-zA-Z]+\s[A-Z][a-zA-Z]+)/g, 'Defendant: $1');
     }
     return text;
 }
@@ -1116,7 +1116,7 @@ function hydrateRegex(rule) {
                 }
             });
             if (remaskedCount > 0) {
-                if (typeof showInPageToast === 'function') showInPageToast(`🔒 Re-masked in DOM. Original tokens restored.`, "info");
+                if (typeof showInPageToast === 'function') showInPageToast('Re-masked in DOM. Original tokens restored.', "info");
                 document.querySelectorAll('.ps-toolbar-reveal, [id$="-reveal"]').forEach(b => {
                     b.setAttribute('title', 'Reveal Original Data (Decrypted Locally)');
                     b.classList.remove('ps-revealed-active');
@@ -1184,7 +1184,7 @@ function hydrateRegex(rule) {
         });
 
         if (restoredCount > 0) {
-            if (typeof showInPageToast === 'function') showInPageToast(`✅ Decrypted Locally! Your data is now safe to copy.`, "success");
+            if (typeof showInPageToast === 'function') showInPageToast('✓ Decrypted Locally in RAM. Safe to copy.', "success");
             document.querySelectorAll('.ps-toolbar-reveal, [id$="-reveal"]').forEach(b => {
                 b.setAttribute('title', 'Hide / Re-mask Protected Data in DOM');
                 b.classList.add('ps-revealed-active');

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/moxno/privacyscrubber-mcp",
     "source": "github"
   },
-  "version": "2.1.0",
+  "version": "2.2.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@privacyscrubber/mcp-server",
-      "version": "2.1.0",
+      "version": "2.2.0",
       "transport": {
         "type": "stdio"
       },
@@ -26,4 +26,4 @@
       ]
     }
   ]
-}
+}