@privacyscrubber/mcp-server 2.3.9 → 2.4.1

package/index.js

@@ -26,6 +26,7 @@ import { fileURLToPath } from 'url';
 import crypto from 'crypto';
 import os from 'os';
 import { execSync } from 'child_process';
+import { Transform } from 'stream';
 
 const require = createRequire(import.meta.url);
 const __filename = fileURLToPath(import.meta.url);
@@ -63,6 +64,54 @@ if (!LicenseManager || typeof LicenseManager.validate !== 'function') {
 // Initialize core engine
 PrivacyScrubberCore.init();
 
+let piiEngine;
+try {
+  piiEngine = require('./ps-pii-engine.cjs');
+} catch (e) {
+  try {
+    piiEngine = require('./ps-pii-engine.js');
+  } catch (err) {}
+}
+
+export const CANONICAL_INDUSTRY_PROFILES = [
+  'General', 'Dev', 'Medical', 'Pharma', 'Biotech', 'Telecom', 'Legal', 'Compliance', 'CCPA',
+  'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'Underwriting',
+  'Automotive', 'Energy', 'Hospitality', 'HR', 'Security', 'Marketing', 'Support',
+  'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal', 'Engineering'
+];
+
+export function resolveRequestedProfile(args, defaultProfile = 'General') {
+  if (!args || typeof args !== 'object') return defaultProfile;
+  const sec = typeof args.sector === 'string' ? args.sector.trim() : '';
+  const prof = typeof args.profile === 'string' ? args.profile.trim() : '';
+
+  let candidate = defaultProfile;
+  if (sec && (!prof || prof.toLowerCase() === 'general')) {
+    candidate = sec;
+  } else if (prof) {
+    candidate = prof;
+  } else if (sec) {
+    candidate = sec;
+  }
+
+  // Canonical normalization via PROFILE_ALIAS_MAP if available
+  if (candidate && candidate.toLowerCase() !== 'general' && piiEngine && piiEngine.PROFILE_ALIAS_MAP) {
+    const mapped = piiEngine.PROFILE_ALIAS_MAP[candidate.toLowerCase()];
+    if (mapped) {
+      if (candidate.toLowerCase() === mapped.toLowerCase()) {
+        return candidate;
+      }
+      return mapped.charAt(0).toUpperCase() + mapped.slice(1);
+    }
+  }
+
+  return candidate;
+}
+
+const PROFILE_PARAM_DESCRIPTION = "The detection profile to use. Available: 'General' (Free, 15,000 chars), or 30 specialized industry profiles (5,000 chars Free trial quota; unlimited on PRO/TEAMS/SDK): 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Biotech', 'Telecom', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'Underwriting', 'Automotive', 'Energy', 'Hospitality', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal', 'Engineering'. Defaults to 'General'.";
+
+const SECTOR_PARAM_DESCRIPTION = "Optional alias for 'profile'. The industry sector or compliance vertical to apply (e.g. 'medical', 'finance', 'legal', 'dev', 'hr', 'accounting', 'security', 'compliance', 'underwriting', 'telecom').";
+
 // Volatile in-memory token map per session (multi-task agent isolation)
 const agentSessions = new Map();
 const MAX_CONCURRENT_SESSIONS = 200;
@@ -75,9 +124,13 @@ function getSession(sessionId = 'default') {
   if (!session) {
     if (agentSessions.size >= MAX_CONCURRENT_SESSIONS) {
       const oldestKey = agentSessions.keys().next().value;
+      const oldestSession = agentSessions.get(oldestKey);
+      if (oldestSession && oldestSession.streamDetokenizer) {
+        oldestSession.streamDetokenizer.reset();
+      }
       agentSessions.delete(oldestKey);
     }
-    session = { map: {}, ignoreList: new Set(), createdAt: now, lastActive: now };
+    session = { map: {}, ignoreList: new Set(), streamDetokenizer: null, createdAt: now, lastActive: now };
     agentSessions.set(sid, session);
   }
   session.lastActive = now;
@@ -96,6 +149,282 @@ function getSessionIgnoreList(sessionId = 'default') {
 const sessionMap = getSessionMap('default');
 const sessionIgnoreList = getSessionIgnoreList('default');
 
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Builds a fast streaming token replacement function for MCP.
+ * Preserves all whitespace, indentation, newlines, and code blocks.
+ * Handles descending key ordering, case-insensitivity, alternative delimiters (<...>, {{...}}, __...__),
+ * and possessive suffixes ('s).
+ */
+export function buildStreamReplacer(tokenMap = {}, options = {}) {
+  if (!tokenMap || typeof tokenMap !== 'object' || Object.keys(tokenMap).length === 0) {
+    return (text) => text || '';
+  }
+
+  const onTokenRestored = typeof options?.onTokenRestored === 'function' ? options.onTokenRestored : null;
+  const lookup = new Map();
+  const patterns = [];
+  const sortedKeys = Object.keys(tokenMap).sort((a, b) => b.length - a.length);
+
+  for (const k of sortedKeys) {
+    const val = tokenMap[k];
+    const inner = k.replace(/^(?:\[|<|\{\{?|__|【|［|〔|「|『)|(?:\]|>|\}\}?|__|】|］|〕|」|』)$/g, '');
+    const match = inner.match(/^([A-Za-z_0-9]+?)[-_ ]?(\d+)$/);
+
+    if (match) {
+      const label = escapeRegex(match[1]);
+      const idx = match[2];
+      const corePat = '[*`_~\\s]*' + label + '[*`_~]*[-_\\s]*0*' + idx + '[*`_~.,;:!?\\s]*';
+      const patternStr = '(?:\\[' + corePat + '\\]|<' + corePat + '>|\\{\\{' + corePat + '\\}\\}|\\{' + corePat + '\\}|__' + corePat + '__|[【［〔「『]' + corePat + '[】］〕」』]|%5B' + corePat + '%5D|&#(?:91|091|x5[bB]);' + corePat + '&#(?:93|093|x5[dD]);|&(?:lbrack|lsqb);' + corePat + '&(?:rbrack|rsqb);|\\\\u005[bB]' + corePat + '\\\\u005[dD]|\\b' + label + '[-_\\s]+0*' + idx + '\\b)';
+      patterns.push(patternStr);
+      const normKey = (match[1] + '_' + parseInt(idx, 10)).toUpperCase();
+      lookup.set(normKey, val);
+      lookup.set(k, val);
+      lookup.set(k.toUpperCase(), val);
+    } else {
+      const safe = escapeRegex(k);
+      patterns.push(safe);
+      lookup.set(k, val);
+      lookup.set(k.toUpperCase(), val);
+    }
+  }
+
+  const unifiedRegex = new RegExp('(?:' + patterns.join('|') + ')(\'s|’s|s)?', 'gi');
+
+  return function replaceTokens(text) {
+    if (!text) return '';
+    unifiedRegex.lastIndex = 0;
+    return text.replace(unifiedRegex, (match, suffix) => {
+      const isPossessive = suffix && /('s|’s)$/i.test(suffix);
+      const coreMatch = suffix ? match.slice(0, match.length - suffix.length) : match;
+      let restored = null;
+
+      if (lookup.has(coreMatch)) {
+        restored = lookup.get(coreMatch);
+      } else if (lookup.has(coreMatch.toUpperCase())) {
+        restored = lookup.get(coreMatch.toUpperCase());
+      } else {
+        const inner = coreMatch
+          .replace(/^(?:%5B|&#(?:91|091|x5[bB]);|&(?:lbrack|lsqb);|\\u005[bB]|\[|<|\{\{?|__|【|［|〔|「|『)/i, '')
+          .replace(/(?:%5D|&#(?:93|093|x5[dD]);|&(?:rbrack|rsqb);|\\u005[dD]|\]|>|\}\}?|__|】|］|〕|」|』)$/i, '')
+          .replace(/[*`_~.,;:!?\s]+/g, ' ')
+          .trim();
+        const m = inner.match(/^([A-Za-z_0-9]+?)[-_ ]?(\d+)$/);
+        if (m) {
+          const normKey = (m[1] + '_' + parseInt(m[2], 10)).toUpperCase();
+          if (lookup.has(normKey)) {
+            restored = lookup.get(normKey);
+          }
+        }
+      }
+
+      if (restored !== null) {
+        if (onTokenRestored) {
+          try { onTokenRestored({ token: match, originalValue: restored }); } catch (_) {}
+        }
+        return restored + (isPossessive ? "'s" : '');
+      }
+
+      if (lookup.has(match)) {
+        restored = lookup.get(match);
+        if (onTokenRestored) {
+          try { onTokenRestored({ token: match, originalValue: restored }); } catch (_) {}
+        }
+        return restored;
+      }
+
+      return match;
+    });
+  };
+}
+
+/**
+ * Streaming Token Detokenizer with sliding window buffer for LLM chunk boundary splits.
+ * Buffers partial token candidates at chunk boundaries across stdio and Server-Sent Events,
+ * preventing character loss and token corruption.
+ */
+export class StreamingDetokenizer {
+  constructor(tokenMap = {}, options = {}) {
+    this.tokenMap = tokenMap && typeof tokenMap === 'object' ? tokenMap : {};
+    this.options = options || {};
+    this.replacer = buildStreamReplacer(this.tokenMap, this.options);
+    this.pendingBuffer = '';
+    this.hasTokens = Object.keys(this.tokenMap).length > 0;
+    this._lastTokenCount = Object.keys(this.tokenMap).length;
+    this.decoder = new TextDecoder('utf-8', { fatal: false });
+  }
+
+  get buffer() {
+    return this.pendingBuffer;
+  }
+
+  set buffer(val) {
+    this.pendingBuffer = typeof val === 'string' ? val : '';
+  }
+
+  updateTokenMap(newMap) {
+    if (newMap && typeof newMap === 'object') {
+      this.tokenMap = newMap;
+      this.replacer = buildStreamReplacer(this.tokenMap, this.options);
+      this.hasTokens = Object.keys(this.tokenMap).length > 0;
+      this._lastTokenCount = Object.keys(this.tokenMap).length;
+    }
+  }
+
+  reset() {
+    this.pendingBuffer = '';
+  }
+
+  feed(chunk) {
+    if (chunk === undefined || chunk === null) return '';
+    let text = '';
+    if (typeof chunk === 'string') {
+      text = chunk;
+    } else if (chunk instanceof Uint8Array || (typeof Buffer !== 'undefined' && Buffer.isBuffer(chunk))) {
+      text = this.decoder.decode(chunk, { stream: true });
+    } else {
+      text = String(chunk);
+    }
+
+    if (!text) return '';
+
+    const currentTokenCount = Object.keys(this.tokenMap).length;
+    if (currentTokenCount !== this._lastTokenCount) {
+      this.replacer = buildStreamReplacer(this.tokenMap, this.options);
+      this.hasTokens = currentTokenCount > 0;
+      this._lastTokenCount = currentTokenCount;
+    }
+
+    if (!this.hasTokens) return text;
+
+    this.pendingBuffer += text;
+
+    const tailLen = 160;
+    const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
+    const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
+    const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+
+    if (m) {
+      const candidate = m[0];
+      const isClosedUnderscoreOrUnicode = (candidate.length >= 4 && candidate.startsWith('__') && candidate.endsWith('__')) || /\\u005[Dd]/.test(candidate);
+      if (isClosedUnderscoreOrUnicode && this.replacer(candidate) !== candidate) {
+        const toEmit = this.pendingBuffer;
+        this.pendingBuffer = '';
+        return this.replacer(toEmit);
+      }
+      const splitIdx = offset + m.index;
+      const safeToEmit = this.pendingBuffer.slice(0, splitIdx);
+      this.pendingBuffer = this.pendingBuffer.slice(splitIdx);
+      return safeToEmit ? this.replacer(safeToEmit) : '';
+    }
+
+    const toEmit = this.pendingBuffer;
+    this.pendingBuffer = '';
+    return this.replacer(toEmit);
+  }
+
+  process(chunk) {
+    return this.feed(chunk);
+  }
+
+  flush() {
+    let text = '';
+    try {
+      text = this.decoder.decode(new Uint8Array(), { stream: false });
+    } catch (_) {}
+
+    if (text) {
+      this.pendingBuffer += text;
+    }
+
+    if (!this.pendingBuffer) return '';
+    const remaining = this.pendingBuffer;
+    this.pendingBuffer = '';
+    return this.replacer(remaining);
+  }
+
+  toNodeTransform() {
+    const self = this;
+    const transformStream = new Transform({
+      transform(chunk, encoding, callback) {
+        try {
+          const out = self.feed(chunk);
+          if (out) this.push(out);
+          callback();
+        } catch (err) {
+          callback(err);
+        }
+      },
+      flush(callback) {
+        try {
+          const out = self.flush();
+          if (out) this.push(out);
+          callback();
+        } catch (err) {
+          callback(err);
+        }
+      },
+      destroy(err, callback) {
+        self.reset();
+        callback(err);
+      }
+    });
+    transformStream.detokenizer = self;
+    return transformStream;
+  }
+
+  async* wrapStream(asyncIterable) {
+    for await (const chunk of asyncIterable) {
+      if (chunk === null || chunk === undefined) continue;
+      if (chunk.choices && Array.isArray(chunk.choices) && chunk.choices[0]?.delta?.content !== undefined) {
+        const delta = chunk.choices[0].delta.content;
+        if (typeof delta === 'string') {
+          const restored = this.feed(delta);
+          if (restored) {
+            chunk.choices[0].delta.content = restored;
+            yield chunk;
+          }
+        } else {
+          yield chunk;
+        }
+        continue;
+      }
+
+      let text = '';
+      if (typeof chunk === 'string') {
+        text = chunk;
+      } else if (typeof chunk?.text === 'string') {
+        text = chunk.text;
+      } else if (typeof chunk?.content === 'string') {
+        text = chunk.content;
+      } else if (chunk instanceof Uint8Array || (typeof Buffer !== 'undefined' && Buffer.isBuffer(chunk))) {
+        text = chunk;
+      } else {
+        text = String(chunk);
+      }
+
+      const emitted = this.feed(text);
+      if (emitted) yield emitted;
+    }
+
+    const finalChunk = this.flush();
+    if (finalChunk) yield finalChunk;
+  }
+}
+
+export function getStreamDetokenizer(sessionId = 'default') {
+  const session = getSession(sessionId);
+  if (!session.streamDetokenizer) {
+    session.streamDetokenizer = new StreamingDetokenizer(session.map);
+  } else {
+    session.streamDetokenizer.updateTokenMap(session.map);
+  }
+  return session.streamDetokenizer;
+}
+
 function reverseTokens(text, map) {
   if (!text || typeof text !== 'string' || !map || Object.keys(map).length === 0) return text;
   if (PrivacyScrubberCore && typeof PrivacyScrubberCore.unscrubText === 'function') {
@@ -130,18 +459,35 @@ function mcpLog(msg) {
 
 // Secrets detection patterns — defined once here, shared by detectSecrets() and performSanitization()
 const DEVOPS_SECRETS_DETECTOR = [
-  { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{16}\b/g },
-  { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
-  { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_]{10,}\b/g },
-  { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{24,}\b/g },
-  { name: 'OpenAI Project API Key', regex: /\b(?:sk|pk)-(?:proj-)?[a-zA-Z0-9_-]{16,}\b/gi },
-  { name: 'Database Connection URI', regex: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s"']+/gi },
-  { name: 'Embedded Credentials URI', regex: /\b(?:https?|s?ftp):\/\/[a-zA-Z0-9_.%+-]+:[^\s/@:"']+@[a-zA-Z0-9_.-]+(?::\d+)?(?:\/[^\s"']*)?/gi },
-  { name: 'URL Query Parameter Secret', regex: /(?<=[?&](?:api_key|apikey|access_token|client_secret|auth_token|token|secret|password|private_key)=)[^\s"'\x26#)>]{8,}/gi },
-  { name: 'Bearer / Auth Header Token', regex: /(?<=\b(?:Bearer|Token)\s+)[a-zA-Z0-9_\-\.~+/=]{16,}\b/gi },
-  { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}\b/gi },
-  { name: 'Private Cryptographic Key (PEM Block)', regex: /-----BEGIN (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----[\s\S]{10,8192}?-----END (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g },
-  { name: 'Private Cryptographic Key (Header)', regex: /-----BEGIN (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g }
+    { name: 'AWS Credentials', regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|AIPA)[A-Z0-9]{12,28}\b/g, label: 'AWS_KEY' },
+    { name: 'Google Cloud / Gemini API Key', regex: /\bAIza[0-9A-Za-z_-]{35}\b/g, label: 'API_TOKEN' },
+    { name: 'Anthropic API Key', regex: /\bsk-ant-(?:api\d{2}|admin\d{2}|sid\d{2})-[a-zA-Z0-9_-]{16,128}\b/g, label: 'API_TOKEN' },
+    { name: 'HuggingFace / Perplexity API Key', regex: /\b(?:hf_[a-zA-Z0-9]{20,64}|pplx-[a-zA-Z0-9]{24,64})\b/g, label: 'API_TOKEN' },
+    { name: 'SendGrid API Key', regex: /\bSG\.[a-zA-Z0-9_-]{16,32}\.[a-zA-Z0-9_-]{32,64}\b/g, label: 'API_TOKEN' },
+    { name: 'Postman API Key', regex: /\bPMAK-[a-fA-F0-9]{24}-[a-fA-F0-9]{34}\b/g, label: 'API_TOKEN' },
+    { name: 'GitHub Fine-Grained PAT', regex: /\bgithub_pat_[a-zA-Z0-9]{20,30}_[a-zA-Z0-9]{40,80}\b/g, label: 'API_TOKEN' },
+    { name: 'Slack Enterprise / Refresh Token', regex: /\bxoxe\.xox[baprs]-\d-[a-zA-Z0-9-]{10,}\b|\bxox[eapbrs]-[a-zA-Z0-9-]{10,}\b/g, label: 'API_TOKEN' },
+    { name: 'Telegram Bot API Token', regex: /\b\d{8,10}:AA[A-Za-z0-9_-]{33}\b/g, label: 'API_TOKEN' },
+    { name: 'Age Encryption Secret Key', regex: /\bAGE-SECRET-KEY-1[A-Z0-9]{58}\b/g, label: 'SECRET' },
+    { name: 'Modern Cloud & AI Platform Key', regex: /\b(?:sbp_[a-fA-F0-9]{40}|dop_v1_[a-fA-F0-9]{64}|doo_v1_[a-fA-F0-9]{64}|dp\.(?:st|pt|ct|sa)\.[a-zA-Z0-9_-]{20,}|lin_api_[a-zA-Z0-9]{32,64}|ntn_[a-zA-Z0-9]{32,64}|secret_[a-zA-Z0-9]{32,64}|gsk_[a-zA-Z0-9]{32,64}|r8_[a-zA-Z0-9]{24,64}|tvly-[a-zA-Z0-9_-]{20,64}|fc-[a-fA-F0-9]{32}|dapi[a-fA-F0-9]{32}(?:-\d)?|re_[a-zA-Z0-9_]{20,64}|napi_[a-zA-Z0-9]{32,64}|[a-zA-Z0-9]{14}\.atlasv1\.[a-zA-Z0-9]{50,80}|pypi-[A-Za-z0-9_-]{16,128}|whsec_[A-Za-z0-9+/=_-]{24,128}|shpat_[a-fA-F0-9]{32}|shpss_[a-fA-F0-9]{32}|shpca_[a-fA-F0-9]{32}|shppa_[a-fA-F0-9]{32}|hvs\.[A-Za-z0-9_-]{24,128}|hvb\.[A-Za-z0-9_-]{24,128}|glsa_[A-Za-z0-9]{32}_[A-Fa-f0-9]{8}|glc_[A-Za-z0-9+/=_-]{20,128}|pscale_tkn_[A-Za-z0-9_.-]{20,64}|pscale_pw_[A-Za-z0-9_.-]{20,64}|pat[A-Za-z0-9]{14}\.[a-fA-F0-9]{64}|pat-(?:na1|eu1)-[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}|sq0atp-[A-Za-z0-9_-]{22,64}|sq0csp-[A-Za-z0-9_-]{32,64}|NRAK-[A-Z0-9]{27}|v1\.0-[a-fA-F0-9]{24}-[a-fA-F0-9]{16,160}|ATATT3xFfGF0[A-Za-z0-9+/=_-]{24,128}|tskey-(?:auth|api|client)-[A-Za-z0-9_-]{20,96}|sntry[su]_[A-Za-z0-9+/=_-]{32,160}|(?:pk|sk)\.eyJ1[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{16,}|key-[a-f0-9]{32}|[a-f0-9]{32}-us\d{1,2})\b/g, label: 'API_TOKEN' },
+    { name: 'Twilio Account SID / API Key', regex: /\b(?:AC|SK)[a-fA-F0-9]{32}\b/g, label: 'API_TOKEN' },
+    { name: 'Bcrypt / Argon2 Password Hash', regex: /(?<![A-Za-z0-9])(?:\$2[aby]\$\d{2}\$[./A-Za-z0-9=]{20,60}|\$argon2(?:id|i|d)\$[^\s"']{15,120})/g, label: 'SECRET' },
+    { name: 'JSON Web Token (JWT)', regex: /\beyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g, label: 'JWT_TOKEN' },
+    { name: 'API Token/Key (GitHub/Slack/NPM)', regex: /\b(?:ghp|gho|ghu|ghs|ghr|glpat|npm|xox[baprs])[-_][A-Za-z0-9_-]{10,}\b/g, label: 'API_TOKEN' },
+    { name: 'Stripe API Key', regex: /\b(?:[rs]k)_(?:test|live)_[a-zA-Z0-9]{10,}\b/g, label: 'STRIPE_KEY' },
+    { name: 'OpenAI Project API Key', regex: /\b(?:sk|pk)-(?:proj-)?[a-zA-Z0-9_-]{16,}\b/gi, label: 'OPENAI_KEY' },
+    { name: 'Slack / Discord Incoming Webhook URL', regex: /\bhttps:\/\/(?:hooks\.slack\.com\/services\/T[A-Z0-9_]+\/B[A-Z0-9_]+\/[A-Za-z0-9_-]+|(?:ptb\.|canary\.)?discord(?:app)?\.com\/api\/webhooks\/\d{17,20}\/[A-Za-z0-9_-]{60,70})\b/gi, label: 'SECRET' },
+    { name: 'Azure Connection String / SAS Token', regex: /(?:DefaultEndpointsProtocol=https?;AccountName=[^;\s"']+;AccountKey=[A-Za-z0-9+/=]{20,}(?:;EndpointSuffix=[^;\s"']+)?|Endpoint=sb:\/\/[^;\s"']+;SharedAccessKeyName=[^;\s"']+;SharedAccessKey=[A-Za-z0-9+/=]{16,}|\bSharedAccessSignature=sr=[^\s"']+&sig=[A-Za-z0-9%/+=]{16,}|\bAccountKey=[A-Za-z0-9+/=]{40,88}==)/gi, label: 'SECRET' },
+    { name: 'Database Connection URI', regex: /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqp|mssql):\/\/[^\s"']+/gi, label: 'DB_URI' },
+    { name: 'Embedded Credentials URI', regex: /\b(?:https?|hxxps?|s?ftp|fxp|wss?):\/\/[a-zA-Z0-9_.%+-]+:[^\s/@:"']+@[a-zA-Z0-9_.-]+(?:\[\.\][a-zA-Z0-9_.-]+|\(\.\)[a-zA-Z0-9_.-]+)*(?::\d+)?(?:\/[^\s"']*)?/gi, label: 'SECRET' },
+    { name: 'URL Query Parameter Secret', regex: /(?<=[?&](?:api_key|apikey|access_token|client_secret|auth_token|token|secret|password|private_key)=)[^\s"'\x26#)>]{8,}/gi, label: 'SECRET' },
+    { name: 'CLI Credential Flag / Curl User Auth', regex: /(?:\bcurl\b[^\r\n]*?\s(?:-u|--user)\s+["']?[A-Za-z0-9_.+-]+:[^\s"']+|\b(?:--password|--api-key|--apikey|--access-token|--auth-token|--client-secret|--secret-key|--private-key)(?:=|\s+)["']?[^\s"']{6,}["']?)/gi, label: 'SECRET' },
+    { name: 'HTTP API Key Header', regex: /\b(?:X-API-Key|X-Amz-Security-Token|X-Functions-Key|X-Shopify-Access-Token|X-Auth-Token|Api-Key)\s*:\s*["']?[A-Za-z0-9_.\-~+/=]{12,}["']?/gi, label: 'SECRET' },
+    { name: 'Docker Registry Auth / K8s Secret Base64', regex: /(?<=["']?(?:auth|identitytoken|registrytoken|\.dockerconfigjson)["']?\s*:\s*["'])[A-Za-z0-9+/=]{16,}(?=["'])/gi, label: 'SECRET' },
+    { name: 'Bearer / Auth Header Token', regex: /(?<=\b(?:Bearer|Token)\s+)[a-zA-Z0-9_\-\.~+/=]{16,}\b/gi, label: 'SECRET' },
+    { name: 'Database/API Secret', regex: /\b(DB|POSTGRES|REDIS|MYSQL|AWS|SECRET|PASSWORD|TOKEN|API|KEY)[A-Z0-9_]*\s*[:=]\s*[^ \t\r\n"']{8,}/gi, label: 'SECRET' },
+    { name: 'Private Cryptographic Key (PEM Block)', regex: /-----BEGIN (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----[\s\S]{10,8192}?-----END (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g, label: 'SECRET' },
+    { name: 'Private Cryptographic Key (Header)', regex: /-----BEGIN (?:RSA |EC |PGP |DSA |OPENSSH |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----/g, label: 'SECRET' }
 ];
 
 function checkLicenseStatus() {
@@ -151,7 +497,9 @@ function checkLicenseStatus() {
   const result = LicenseManager.validate(key);
   
   if (!result.valid) {
-    mcpLog(`DEBUG: License invalid because: ${result.reason || "Unknown"}`);
+    if (process.env.DEBUG_PRIVACYSCRUBBER) {
+      mcpLog(`[License] Key validation notice: ${result.reason || "Unknown"}`);
+    }
     return { isPro: false, type: null, error: result.reason || "Invalid license format or signature." };
   }
 
@@ -264,8 +612,8 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
         frameworksSet.add('CCPA/CPRA');
     }
     if (types.includes('ID') || types.includes('SSN') || types.includes('PASSPORT') || types.includes('NATIONAL_ID')) {
-        frameworksSet.add('SOC 2 Type II');
-        frameworksSet.add('ISO 27001 (A.8.11)');
+        frameworksSet.add('SOC 2 controls');
+        frameworksSet.add('ISO 27001 A.8.11 controls');
     }
     if (types.some(t => ['CREDIT_CARD', 'BANK', 'IBAN', 'FINANCIAL', 'CARD', 'STRIPE_KEY', 'TAX_ID', 'EIN', 'W2', '1099', 'SALARY', 'WAGE'].includes(t))) {
         frameworksSet.add('PCI DSS v4.0');
@@ -285,7 +633,7 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
     }
 
     const ipHoldings = {
-        standard: 'IETF draft-sibiryakov-ztds-protocol-00',
+        standard: 'IETF draft-sibiryakov-ztds-protocol-01',
         standardUrl: 'https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/',
         patent: "U.S. & Int'l Patents Pending (Paris Convention Priority)",
         trademark: 'ZTDS™ Reg. #182655957 (ILPO Cl 9 & 42)'
@@ -295,27 +643,27 @@ function buildCisoAuditTelemetry(currentTokenMap = {}) {
         {
             statute: 'EU AI Act (Art. 50)',
             scope: 'AI Transparency & Data Minimization',
-            rule: '0-byte external network transmission; prevents unauthorized ingestion into frontier models.'
+            rule: 'Sanitization runs locally by design; reduces the content sent to external AI models. Informational mapping, not a compliance determination.'
         },
         {
             statute: 'GDPR (Art. 4, 25, 28, 32)',
             scope: 'Pseudonymization & Processor Liability',
-            rule: 'Volatile client-side tokenization eliminates GDPR Article 28 data processor liability.'
+            rule: 'Client-side pseudonymization is a technical measure supporting Art. 25 and 32. It does not by itself remove controller or processor obligations.'
         },
         {
             statute: 'HIPAA 45 CFR § 164.514(b)',
             scope: 'Safe Harbor De-Identification',
-            rule: 'Deterministic removal of all 18 PHI identifiers prior to AI analysis.'
+            rule: 'Pattern-based masking of direct identifiers supports Safe Harbor de-identification workflows. Review output for residual identifiers before sharing.'
         },
         {
             statute: 'IRC § 7216 & IRS Pub. 1075',
             scope: 'Tax Return Information Confidentiality',
-            rule: 'Strict criminal penalty safeguard against unauthorized disclosure of tax records to cloud LLMs.'
+            rule: 'Masking identifiers before AI use can reduce exposure of tax return information. Informational mapping, not legal advice.'
         },
         {
             statute: 'FRE 502',
             scope: 'Attorney-Client Privilege Preservation',
-            rule: 'Automated in-memory redaction prevents inadvertent waiver of legal privilege in AI workflows.'
+            rule: 'In-memory redaction can reduce disclosure of privileged details in AI workflows. Privilege determinations remain a legal judgment.'
         }
     ];
 
@@ -934,7 +1282,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use (e.g. 'General', 'Dev', 'Medical', 'Finance', 'Legal'). Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             format: {
               type: "string",
@@ -947,7 +1299,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "sanitize_text",
-        description: "STEP 1: Call this first. You MUST NOT process raw user data before calling this. Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM. (For in-code backend services or RAG vector pipelines outside of MCP, use '@privacyscrubber/sdk': npm i @privacyscrubber/sdk)",
+        description: "STEP 1: Call this first. You MUST NOT process raw user data before calling this. Locally scrubs PII, secrets, and credentials (like API keys, passwords, emails, phones, names) from code, logs, or text. Replaces them with safe placeholders (e.g., [EMAIL_1], [API_KEY_1]). Keep your data secure before passing it to any LLM. Supports General and all 30 specialized industry profiles in RAM session map. (For in-code backend services or RAG vector pipelines outside of MCP, use '@privacyscrubber/sdk': npm i @privacyscrubber/sdk)",
         inputSchema: {
           type: "object",
           properties: {
@@ -957,7 +1309,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Available: 'General' (Free), or PRO profiles: 'Dev' (Engineering/Code), 'Medical', 'Pharma', 'Biotech', 'Telecom', 'Legal', 'Compliance', 'CCPA', 'Finance', 'Bizops', 'Sales', 'WealthMgmt', 'Insurance', 'Accounting', 'Underwriting', 'Automotive', 'Energy', 'Hospitality', 'HR', 'Security', 'Marketing', 'Support', 'RealEstate', 'Agents', 'Academic', 'Creative', 'Tech', 'Personal'. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             compact: {
               type: "boolean",
@@ -978,7 +1334,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "scrub_text",
-        description: "Alias for 'sanitize_text'. Locally scrubs PII and secrets before LLM ingestion.",
+        description: "Alias for 'sanitize_text'. Locally scrubs PII, secrets, and credentials from prompts or text before LLM ingestion. Supports General and all 30 specialized industry profiles in RAM session map.",
         inputSchema: {
           type: "object",
           properties: {
@@ -988,7 +1344,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             compact: {
               type: "boolean",
@@ -1009,13 +1369,21 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
       },
       {
         name: "reveal_text",
-        description: "STEP 3: Call this last. You MUST pass your final generated response through this tool to restore tokens (e.g., [EMAIL_1]) back with the original private data from the local volatile RAM-only session map before showing it to the user.",
+        description: "STEP 3: Call this last. You MUST pass your final generated response through this tool to restore tokens (e.g., [EMAIL_1]) back with the original private data from the local volatile RAM-only session map before showing it to the user. Supports both standard batch mode and real-time streaming mode (stream: true).",
         inputSchema: {
           type: "object",
           properties: {
             text: {
               type: "string",
-              description: "The AI generated response containing placeholders to restore."
+              description: "The AI generated response (or streaming chunk) containing placeholders to restore."
+            },
+            stream: {
+              type: "boolean",
+              description: "Optional. When true, uses the sliding-window StreamingDetokenizer to prevent token splitting across chunk boundaries."
+            },
+            flush: {
+              type: "boolean",
+              description: "Optional. When true in streaming mode, flushes any remaining buffered text at EOF."
             },
             session_id: {
               type: "string",
@@ -1025,6 +1393,32 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["text"]
         }
       },
+      {
+        name: "stream_reveal_text",
+        description: "STEP 3 (Streaming): Real-time streaming token detokenizer for LLM Server-Sent Events (SSE) and stdio chunk pipelines. Buffers split token candidates across chunk boundaries (e.g. '[EM' + 'AIL_1]') so no characters or tokens are corrupted. Pass 'flush: true' on the final chunk.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            chunk: {
+              type: "string",
+              description: "The incoming text chunk from the LLM stream or stdout."
+            },
+            flush: {
+              type: "boolean",
+              description: "Optional. Set to true on the final chunk or at EOF to flush remaining buffer. Defaults to false."
+            },
+            reset: {
+              type: "boolean",
+              description: "Optional. Set to true to reset internal streaming buffer for this session. Defaults to false."
+            },
+            session_id: {
+              type: "string",
+              description: "Optional session ID matching the sanitize_text call for multi-agent isolation. Defaults to 'default'."
+            }
+          },
+          required: ["chunk"]
+        }
+      },
       {
         name: "sanitize_file",
         description: "Reads a local file, sanitizes its contents using the selected profile, and outputs the safe version for AI analysis. Securely keeps original identifiers in memory.",
@@ -1037,7 +1431,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             compact: {
               type: "boolean",
@@ -1063,7 +1461,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             compact: {
               type: "boolean",
@@ -1089,7 +1491,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             extensions: {
               type: "array",
@@ -1116,7 +1522,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             dry_run: {
               type: "boolean",
@@ -1157,6 +1567,10 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             department: {
               type: "string",
               description: "Optional department or auditor ID (e.g. 'SecOps / Engineering')."
+            },
+            session_id: {
+              type: "string",
+              description: "Optional session ID for multi-agent isolation. Defaults to 'default'."
             }
           },
           required: []
@@ -1205,7 +1619,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "Detection profile. Available: 'General', 'Dev' (recommended for code/secrets), 'Security', 'Finance', etc. Defaults to 'Dev'."
+              description: "Detection profile. Available: 'Dev' (default for code/secrets), 'General', or any of the 30 specialized industry profiles (e.g. 'Security', 'Finance', 'Medical'). Defaults to 'Dev'."
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             timeout_ms: {
               type: "number",
@@ -1227,7 +1645,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "Detection profile. Defaults to 'Dev'."
+              description: "Detection profile. Available: 'Dev' (default), 'General', or any of the 30 specialized industry profiles. Defaults to 'Dev'."
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             max_lines: {
               type: "number",
@@ -1253,7 +1675,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "Detection profile. Defaults to 'Dev'."
+              description: "Detection profile. Available: 'Dev' (default), 'General', or any of the 30 specialized industry profiles. Defaults to 'Dev'."
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             session_id: {
               type: "string",
@@ -1382,7 +1808,11 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
             },
             profile: {
               type: "string",
-              description: "The detection profile to use. Defaults to 'General'."
+              description: PROFILE_PARAM_DESCRIPTION
+            },
+            sector: {
+              type: "string",
+              description: SECTOR_PARAM_DESCRIPTION
             },
             session_id: {
               type: "string",
@@ -1619,14 +2049,14 @@ server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
       "biotech": "Biotech & Genomics profile. Scrubs accessions, patient phenotypes, HGVS variants, DNA/RNA samples, and flowcell IDs.",
       "telecom": "Call Centers & Telephony profile. Scrubs CTI interaction IDs, Amazon Connect/Genesys sessions, agent extensions, ANI/DNIS, IVR DTMF, and audio transcript diarization headers."
     };
-    const desc = descriptions[profileName.toLowerCase()] || `The '${profileName}' profile is a PRO-tier detection ruleset tuned for specific industry compliance. It detects and sanitizes domain-specific identifiers.`;
+    const desc = descriptions[profileName.toLowerCase()] || `The '${profileName}' profile is a specialized detection ruleset tuned for specific industry compliance. It detects and sanitizes domain-specific identifiers.`;
     
     return {
       contents: [
         {
           uri,
           mimeType: "text/markdown",
-          text: `# Profile: ${profileName}\n\n**Description:** ${desc}\n\n*Note: To use this profile, pass \`"profile": "${profileName}"\` to the \`sanitize_text\` or \`sanitize_file\` tools. Advanced profiles require a PRO license.*`
+          text: `# Profile: ${profileName}\n\n**Description:** ${desc}\n\n*Note: To use this profile, pass \`"profile": "${profileName}"\` or \`"sector": "${profileName}"\` to tools like \`scrub_text\`, \`sanitize_text\`, or \`sanitize_file\`. Advanced profiles include a 5,000 character Free trial quota; PRO/TEAMS tiers grant unlimited characters.*`
         }
       ]
     };
@@ -1641,7 +2071,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
   try {
     if (name === "audit_context") {
-      const { text, profile = "General", format = "detailed" } = args || {};
+      const { text, format = "detailed" } = args || {};
 
       if (text === undefined || text === null) {
         return {
@@ -1656,7 +2086,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
-      const targetProfile = (profile || "General").trim();
+      const targetProfile = resolveRequestedProfile(args, "General");
       const customRules = loadCustomRules();
       const normalizedProfile = targetProfile.toLowerCase();
       const license = checkLicenseStatus();
@@ -1707,7 +2137,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "sanitize_text" || name === "scrub_text") {
-      const { text, profile = "General", ignore_list, compact = false, session_id = "default" } = args || {};
+      const { text, ignore_list, compact = false, session_id = "default" } = args || {};
       const currentSession = getSessionMap(session_id);
       const currentIgnoreList = getSessionIgnoreList(session_id);
 
@@ -1727,7 +2157,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           content: [{ type: "text", text: `Error: Parameter 'text' must be a string, got '${typeof text}'. Stringify objects before passing.` }]
         };
       }
-      const targetProfile = (profile || "General").trim();
+      const targetProfile = resolveRequestedProfile(args, "General");
 
       // Check tier gating for advanced profiles
       const isAdvanced = targetProfile.toLowerCase() !== "general";
@@ -1772,7 +2202,38 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "reveal_text") {
-      const { text, session_id = "default" } = args || {};
+      const { text, stream = false, flush = false, session_id = "default" } = args || {};
+
+      if (stream) {
+        if (text === undefined || text === null) {
+          if (flush) {
+            const detok = getStreamDetokenizer(session_id);
+            const flushedText = detok.flush();
+            return {
+              content: [{ type: "text", text: flushedText }]
+            };
+          }
+          return {
+            isError: true,
+            content: [{ type: "text", text: "Error: Missing required parameter 'text'. Provide the stream chunk to restore." }]
+          };
+        }
+        if (typeof text !== "string") {
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: Parameter 'text' must be a string, got '${typeof text}'.` }]
+          };
+        }
+        const detok = getStreamDetokenizer(session_id);
+        let emitted = detok.feed(text);
+        if (flush) {
+          emitted += detok.flush();
+        }
+        return {
+          content: [{ type: "text", text: emitted }]
+        };
+      }
+
       if (text === undefined || text === null) {
         return {
           isError: true,
@@ -1812,6 +2273,43 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       };
     }
 
+    if (name === "stream_reveal_text") {
+      const { chunk, flush = false, reset = false, session_id = "default" } = args || {};
+      if (chunk === undefined || chunk === null) {
+        if (flush) {
+          const detok = getStreamDetokenizer(session_id);
+          const flushedText = detok.flush();
+          return {
+            content: [{ type: "text", text: flushedText }]
+          };
+        }
+        return {
+          isError: true,
+          content: [{ type: "text", text: "Error: Missing required parameter 'chunk'. Provide the text chunk to process." }]
+        };
+      }
+      if (typeof chunk !== "string") {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: Parameter 'chunk' must be a string, got '${typeof chunk}'.` }]
+        };
+      }
+
+      const detok = getStreamDetokenizer(session_id);
+      if (reset) {
+        detok.reset();
+      }
+
+      let emitted = detok.feed(chunk);
+      if (flush) {
+        emitted += detok.flush();
+      }
+
+      return {
+        content: [{ type: "text", text: emitted }]
+      };
+    }
+
     if (name === "mark_false_positive") {
       const { token, session_id = "default" } = args || {};
       if (!token || typeof token !== 'string') {
@@ -1860,7 +2358,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           ]
         };
       }
-      const { profile = "General", compact = false, session_id = "default" } = args || {};
+      const targetProfile = resolveRequestedProfile(args, "General");
+      const { compact = false, session_id = "default" } = args || {};
       const targetSession = getSessionMap(session_id);
       const targetIgnoreList = getSessionIgnoreList(session_id);
       const filePath = rawPath;
@@ -1908,9 +2407,111 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       if (resolvedPath.toLowerCase().endsWith(".docx")) {
         try {
           const mammoth = require('mammoth');
-          const result = await mammoth.extractRawText({ path: resolvedPath });
-          const content = result.value;
-          const targetProfile = profile.trim();
+          const zlib = require('zlib');
+          const docxBuf = fs.readFileSync(resolvedPath);
+          const result = await mammoth.extractRawText({ buffer: docxBuf });
+          let extraXmlText = "";
+          try {
+            const zipEntries = {};
+            let eocdOffset = -1;
+            for (let i = docxBuf.length - 22; i >= Math.max(0, docxBuf.length - 65557); i--) {
+              if (docxBuf.readUInt32LE(i) === 0x06054b50) {
+                eocdOffset = i;
+                break;
+              }
+            }
+            if (eocdOffset !== -1) {
+              const cdEntries = docxBuf.readUInt16LE(eocdOffset + 10);
+              let pos = docxBuf.readUInt32LE(eocdOffset + 16);
+              for (let e = 0; e < cdEntries && pos + 46 <= docxBuf.length; e++) {
+                if (docxBuf.readUInt32LE(pos) !== 0x02014b50) break;
+                const method = docxBuf.readUInt16LE(pos + 10);
+                const compSize = docxBuf.readUInt32LE(pos + 20);
+                const nameLen = docxBuf.readUInt16LE(pos + 28);
+                const extraLen = docxBuf.readUInt16LE(pos + 30);
+                const commentLen = docxBuf.readUInt16LE(pos + 32);
+                const localOffset = docxBuf.readUInt32LE(pos + 42);
+                const entryName = docxBuf.toString('utf8', pos + 46, pos + 46 + nameLen);
+                if (localOffset + 30 <= docxBuf.length && docxBuf.readUInt32LE(localOffset) === 0x04034b50) {
+                  const lNameLen = docxBuf.readUInt16LE(localOffset + 26);
+                  const lExtraLen = docxBuf.readUInt16LE(localOffset + 28);
+                  const dataStart = localOffset + 30 + lNameLen + lExtraLen;
+                  const compData = docxBuf.subarray(dataStart, dataStart + compSize);
+                  if (method === 0) {
+                    zipEntries[entryName] = compData.toString('utf8');
+                  } else if (method === 8) {
+                    zipEntries[entryName] = zlib.inflateRawSync(compData).toString('utf8');
+                  }
+                }
+                pos += 46 + nameLen + extraLen + commentLen;
+              }
+            }
+            const xmlTargets = Object.keys(zipEntries).filter((n) =>
+              /^(?:word\/(?:header\d*|footer\d*|footnotes|endnotes|comments|commentsExtended|people)\.xml|docProps\/(?:core|app|custom)\.xml)$/i.test(n)
+            );
+            const docAuthors = new Set();
+            for (const xmlPath of xmlTargets) {
+              const rawXml = zipEntries[xmlPath];
+              const authorRx = /\b(?:w:author|w15:author|w15:userId)="([^"]+)"/gi;
+              let am;
+              while ((am = authorRx.exec(rawXml)) !== null) {
+                if (am[1] && am[1].trim()) docAuthors.add(am[1].trim());
+              }
+              const stripped = rawXml
+                .replace(/<\/w:p>/gi, "\n")
+                .replace(/<w:tab\b[^>]*\/?>/gi, "\t")
+                .replace(/<[^>]+>/g, " ")
+                .replace(/&amp;/g, "&")
+                .replace(/&lt;/g, "<")
+                .replace(/&gt;/g, ">")
+                .replace(/&quot;/g, '"')
+                .replace(/&apos;/g, "'")
+                .replace(/[ \t]+/g, " ")
+                .trim();
+              if (stripped) extraXmlText += `\n${stripped}\n`;
+            }
+            if (zipEntries["word/document.xml"]) {
+              const docXml = zipEntries["word/document.xml"];
+              const authorRx = /\bw:author="([^"]+)"/gi;
+              let am;
+              while ((am = authorRx.exec(docXml)) !== null) {
+                if (am[1] && am[1].trim()) docAuthors.add(am[1].trim());
+              }
+              const delAndInstrRx = /<w:(?:delText|instrText)\b[^>]*>([\s\S]*?)<\/w:(?:delText|instrText)>/gi;
+              let dm;
+              const hiddenChunks = [];
+              while ((dm = delAndInstrRx.exec(docXml)) !== null) {
+                const val = dm[1]
+                  .replace(/<[^>]+>/g, " ")
+                  .replace(/&amp;/g, "&")
+                  .replace(/&lt;/g, "<")
+                  .replace(/&gt;/g, ">")
+                  .replace(/&quot;/g, '"')
+                  .replace(/&apos;/g, "'")
+                  .trim();
+                if (val) hiddenChunks.push(val);
+              }
+              if (hiddenChunks.length > 0) {
+                extraXmlText += `\n[Tracked Changes / Field Text]: ${hiddenChunks.join(" | ")}\n`;
+              }
+            }
+            if (docAuthors.size > 0) {
+              extraXmlText += `\n[Document Reviewers]: ${Array.from(docAuthors).join(", ")}\n`;
+            }
+            const relsTargets = Object.keys(zipEntries).filter((n) => /^word\/_rels\/.*\.rels$/i.test(n));
+            for (const relPath of relsTargets) {
+              const relXml = zipEntries[relPath];
+              const targetRegex = /Target="([^"]+)"/gi;
+              let tm;
+              while ((tm = targetRegex.exec(relXml)) !== null) {
+                const val = tm[1];
+                if (/^(?:mailto:|tel:|https?:\/\/)/i.test(val) && !/schemas\.openxmlformats\.org|schemas\.microsoft\.com|w3\.org/i.test(val)) {
+                  extraXmlText += `\n[Document Link]: ${val}\n`;
+                }
+              }
+            }
+          } catch (_) {}
+          const content = (result.value || '') + (extraXmlText ? '\n' + extraXmlText : '');
           const isAdvanced = targetProfile.toLowerCase() !== "general";
           const license = checkLicenseStatus();
           let finalProfile = targetProfile;
@@ -1973,7 +2574,6 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const pdf = require('pdf-parse');
             const data = await pdf(buffer);
             const content = data.text;
-            const targetProfile = profile.trim();
             let finalProfile = targetProfile;
 
             const sanitized = performSanitization(content, finalProfile, targetIgnoreList, targetSession);
@@ -2000,13 +2600,46 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             const XLSX = require('xlsx');
             const workbook = XLSX.read(buffer, { type: 'buffer' });
             let content = '';
+            if (workbook.Props && typeof workbook.Props === 'object') {
+              const propFields = ['Author', 'LastAuthor', 'Company', 'Manager', 'Title', 'Subject', 'Comments'];
+              for (const pf of propFields) {
+                if (workbook.Props[pf] && String(workbook.Props[pf]).trim()) {
+                  content += `[Workbook ${pf}]: ${String(workbook.Props[pf]).trim()}\n`;
+                }
+              }
+            }
+            if (workbook.CustProps && typeof workbook.CustProps === 'object') {
+              for (const [ck, cv] of Object.entries(workbook.CustProps)) {
+                if (cv !== undefined && cv !== null && String(cv).trim()) {
+                  content += `[Custom Property ${ck}]: ${String(cv).trim()}\n`;
+                }
+              }
+            }
             workbook.SheetNames.forEach(sheetName => {
               const worksheet = workbook.Sheets[sheetName];
               content += `--- Sheet: ${sheetName} ---\n`;
               content += XLSX.utils.sheet_to_csv(worksheet) + '\n';
+              if (worksheet && typeof worksheet === 'object') {
+                for (const cellKey of Object.keys(worksheet)) {
+                  if (cellKey.startsWith('!')) continue;
+                  const cell = worksheet[cellKey];
+                  if (!cell || typeof cell !== 'object') continue;
+                  if (cell.l && cell.l.Target) {
+                    content += `[Hyperlink ${cellKey}]: ${cell.l.Target}\n`;
+                  }
+                  if (Array.isArray(cell.c)) {
+                    for (const comm of cell.c) {
+                      const author = comm.a ? `${comm.a}: ` : '';
+                      const cText = (comm.t || '').trim();
+                      if (cText) {
+                        content += `[Comment ${cellKey}] ${author}${cText}\n`;
+                      }
+                    }
+                  }
+                }
+              }
             });
 
-            const targetProfile = profile.trim();
             let finalProfile = targetProfile;
 
             const sanitized = performSanitization(content, finalProfile, targetIgnoreList, targetSession);
@@ -2051,14 +2684,63 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
-      const content = buffer.toString("utf8");
-      const targetProfile = profile.trim();
+      let content = buffer.toString("utf8");
+      const ext = path.extname(resolvedPath).toLowerCase();
+      if (ext === ".eml") {
+        const decodeQpUtf8 = (str) =>
+          str
+            .replace(/=\r?\n/g, "")
+            .replace(/(?:=[0-9A-Fa-f]{2})+/g, (seq) => {
+              try {
+                const bytes = Buffer.alloc(seq.length / 3);
+                for (let i = 0; i < bytes.length; i++) {
+                  bytes[i] = parseInt(seq.slice(i * 3 + 1, i * 3 + 3), 16);
+                }
+                return bytes.toString("utf8");
+              } catch (_) {
+                return seq;
+              }
+            });
+        content = content.replace(/=\?([^?]+)\?([BQbq])\?([^?]+)\?=/g, (full, charset, enc, payload) => {
+          try {
+            if (enc.toUpperCase() === "B") {
+              return Buffer.from(payload.replace(/\s+/g, ""), "base64").toString("utf8");
+            }
+            return decodeQpUtf8(payload.replace(/_/g, " "));
+          } catch (_) {
+            return full;
+          }
+        });
+        content = content.replace(
+          /(Content-Transfer-Encoding\s*:\s*base64\b[\s\S]*?\r?\n\r?\n)([A-Za-z0-9+/=\r\n]+)(?=\r?\n--|\s*$)/gi,
+          (full, hdr, b64Block) => {
+            try {
+              const cleanB64 = b64Block.replace(/[\r\n\s]+/g, "");
+              if (cleanB64.length < 8) return full;
+              return hdr + Buffer.from(cleanB64, "base64").toString("utf8");
+            } catch (_) {
+              return full;
+            }
+          }
+        );
+        content = decodeQpUtf8(content);
+      } else if (ext === ".rtf") {
+        content = content
+          .replace(/\\par\b|\\line\b/gi, "\n")
+          .replace(/\\'([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+          .replace(/\\u(-?\d+)\??/g, (_, code) => {
+            const n = parseInt(code, 10);
+            return String.fromCharCode(n < 0 ? n + 65536 : n);
+          })
+          .replace(/\\[a-zA-Z]+(?:-?\d+)?[ ]?/g, " ")
+          .replace(/[{}]/g, " ")
+          .replace(/[ \t]+/g, " ");
+      }
       const isAdvanced = targetProfile.toLowerCase() !== "general";
       const license = checkLicenseStatus();
       let finalProfile = targetProfile;
       let isAutoElevated = false;
 
-      const ext = path.extname(resolvedPath).toLowerCase();
       const CODE_EXTENSIONS = new Set(['.js', '.ts', '.jsx', '.tsx', '.py', '.go', '.rs', '.java', '.rb', '.php', '.cs', '.sh', '.bash', '.zsh', '.env', '.yaml', '.yml', '.toml', '.sql']);
       const DEV_HEURISTIC_REGEX = /(?:AKIA[0-9A-Z]{16}|ghp_[a-zA-Z0-9]{36}|sk-[a-zA-Z0-9]{20,}|-----BEGIN (?:RSA )?PRIVATE KEY-----|Bearer\s+eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+|(?:postgres|postgresql|mysql|mongodb|redis):\/\/[^\s"'>]+|export\s+(?:AWS_|DATABASE_|API_KEY|SECRET)|const\s+\w+\s*=\s*require\(|import\s+.*\s+from\s+['"])/i;
 
@@ -2095,7 +2777,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "redact_file") {
-      const { file_path, profile, dry_run, no_backup } = args;
+      const { file_path, dry_run, no_backup } = args;
       if (!file_path || !fs.existsSync(file_path)) {
         return { isError: true, content: [{ type: "text", text: `Error: File not found at path: ${file_path}` }] };
       }
@@ -2110,10 +2792,55 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         if (buffer.indexOf(0) !== -1) {
           return { isError: true, content: [{ type: "text", text: `Error: Cannot redact binary file.` }] };
         }
-        const content = buffer.toString('utf8');
+        let content = buffer.toString('utf8');
+        const ext = path.extname(file_path).toLowerCase();
+        if (ext === ".eml") {
+          const decodeQpUtf8 = (str) =>
+            str.replace(/=\r?\n/g, "").replace(/(?:=[0-9A-Fa-f]{2})+/g, (seq) => {
+              try {
+                const bytes = Buffer.alloc(seq.length / 3);
+                for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(seq.slice(i * 3 + 1, i * 3 + 3), 16);
+                return bytes.toString("utf8");
+              } catch (_) { return seq; }
+            });
+          content = content.replace(/=\?([^?]+)\?([BQbq])\?([^?]+)\?=/g, (full, charset, enc, payload) => {
+            try {
+              if (enc.toUpperCase() === "B") return Buffer.from(payload.replace(/\s+/g, ""), "base64").toString("utf8");
+              return decodeQpUtf8(payload.replace(/_/g, " "));
+            } catch (_) { return full; }
+          });
+          content = content.replace(/(Content-Transfer-Encoding\s*:\s*base64\b[\s\S]*?\r?\n\r?\n)([A-Za-z0-9+/=\r\n]+)(?=\r?\n--|\s*$)/gi, (full, hdr, b64Block) => {
+            try {
+              const cleanB64 = b64Block.replace(/[\r\n\s]+/g, "");
+              if (cleanB64.length < 8) return full;
+              return hdr + Buffer.from(cleanB64, "base64").toString("utf8");
+            } catch (_) { return full; }
+          });
+          content = decodeQpUtf8(content);
+        } else if (ext === ".rtf") {
+          content = content
+            .replace(/\\par\b|\\line\b/gi, "\n")
+            .replace(/\\'([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+            .replace(/\\u(-?\d+)\??/g, (_, code) => {
+              const n = parseInt(code, 10);
+              return String.fromCharCode(n < 0 ? n + 65536 : n);
+            })
+            .replace(/\\[a-zA-Z]+(?:-?\d+)?[ ]?/g, " ")
+            .replace(/[{}]/g, " ")
+            .replace(/[ \t]+/g, " ");
+        }
 
         const customRules = loadCustomRules();
-        const normalizedProfile = (profile || "general").trim().toLowerCase();
+        const activeRules = [...customRules];
+        DEVOPS_SECRETS_DETECTOR.forEach(rule => {
+          activeRules.push({
+            name: rule.name,
+            pattern: rule.regex.source,
+            regex: new RegExp(rule.regex.source, rule.regex.flags),
+            label: rule.label || 'SECRET'
+          });
+        });
+        const normalizedProfile = resolveRequestedProfile(args, "general").toLowerCase();
         const license = checkLicenseStatus();
         
         const limitStatus = checkFreeTierLimit(license.isPro);
@@ -2125,7 +2852,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
         const localSessionMap = {};
         
-        const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+        const result = PrivacyScrubberCore.scrubText(content, activeRules, {}, normalizedProfile, localSessionMap, license.isPro);
         
         let isSecretLeak = false;
         if (!license.isPro && result.tokenMap) {
@@ -2240,8 +2967,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       const tierIcon = license.isPro ? '✅' : '🔓';
       const profileList = license.isPro
         ? 'All 30 specialized profiles active (General, Dev, Medical, Legal, Finance, HR…)'
-        : 'General only — PRO unlocks all 30 specialized industry profiles';
-      const sizeLimit = license.isPro ? 'Unlimited' : '15,000 characters per request';
+        : 'All 30 profiles active (5k quota) · PRO unlocks unlimited';
+      const sizeLimit = license.isPro ? 'Unlimited' : '15,000 char (General) / 5,000 char (Industry)';
 
       const configPath = resolveConfigPath();
       let rulesStatus = '';
@@ -2323,7 +3050,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "audit_directory_for_pii") {
-      const { directory_path, profile, extensions, ignore_node_modules } = args;
+      const { directory_path, extensions, ignore_node_modules } = args;
       if (!directory_path || !fs.existsSync(directory_path)) {
         return { isError: true, content: [{ type: "text", text: `Error: Directory not found at path: ${directory_path}` }] };
       }
@@ -2352,7 +3079,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       let reportLines = [`## Security Audit Report: ${directory_path}`];
       let filesWithIssues = 0;
       const customRules = loadCustomRules();
-      const normalizedProfile = (profile || "general").trim().toLowerCase();
+      const activeRules = [...customRules];
+      DEVOPS_SECRETS_DETECTOR.forEach(rule => {
+        activeRules.push({
+          name: rule.name,
+          pattern: rule.regex.source,
+          regex: new RegExp(rule.regex.source, rule.regex.flags),
+          label: rule.label || 'SECRET'
+        });
+      });
+      const normalizedProfile = resolveRequestedProfile(args, "general").toLowerCase();
       const license = checkLicenseStatus();
       
       const limitStatus = checkFreeTierLimit(license.isPro);
@@ -2374,7 +3110,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           const content = buffer.toString('utf8');
 
           const localSessionMap = {};
-          const result = PrivacyScrubberCore.scrubText(content, customRules, {}, normalizedProfile, localSessionMap, license.isPro);
+          const result = PrivacyScrubberCore.scrubText(content, activeRules, {}, normalizedProfile, localSessionMap, license.isPro);
           
           Object.assign(totalTokensForDirectory, localSessionMap);
           
@@ -2422,17 +3158,18 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "generate_compliance_report") {
-      const { format = "markdown", company_name = "PrivacyScrubber Client", department = "SecOps / Compliance" } = args || {};
-      const telemetry = buildCisoAuditTelemetry(sessionMap);
+      const { format = "markdown", company_name = "PrivacyScrubber Client", department = "SecOps / Compliance", session_id = "default" } = args || {};
+      const targetSession = getSessionMap(session_id);
+      const telemetry = buildCisoAuditTelemetry(targetSession);
       
-      const receipt = buildPsr2Receipt(sessionMap);
+      const receipt = buildPsr2Receipt(targetSession);
       return {
         content: [{ type: "text", text: formatPsr2Report({ format, receipt, telemetry, company_name, department, utmSource: 'mcp_compliance_report', utmMedium: format === 'json' ? 'json' : 'markdown' }) }]
       };
     }
 
     if (name === "guard_exec") {
-      const { command, cwd, profile = "Dev", timeout_ms = 15000, session_id = "default" } = args || {};
+      const { command, cwd, timeout_ms = 15000, session_id = "default" } = args || {};
       if (!command || typeof command !== "string") {
         return {
           isError: true,
@@ -2472,7 +3209,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         exitCode = typeof err.status === 'number' ? err.status : 1;
       }
 
-      const targetProfile = (profile || "Dev").trim();
+      const targetProfile = resolveRequestedProfile(args, "Dev");
       const isAdvanced = targetProfile.toLowerCase() !== "general";
       const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
 
@@ -2502,7 +3239,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "guard_read_file") {
-      const { file_path, profile = "Dev", max_lines = 500, session_id = "default" } = args || {};
+      const { file_path, max_lines = 500, session_id = "default" } = args || {};
       if (!file_path || typeof file_path !== "string") {
         return {
           isError: true,
@@ -2523,6 +3260,22 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           content: [{ type: "text", text: `Error: Path is a directory. Use audit_directory_for_pii to scan directories.` }]
         };
       }
+      if (stat.size > 10 * 1024 * 1024) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: `Error: File is too large (${(stat.size / 1024 / 1024).toFixed(2)}MB). Maximum allowed size is 10MB.` }]
+        };
+      }
+      const rawBuffer = fs.readFileSync(resolvedPath);
+      const checkLen = Math.min(rawBuffer.length, 8000);
+      for (let i = 0; i < checkLen; i++) {
+        if (rawBuffer[i] === 0) {
+          return {
+            isError: true,
+            content: [{ type: "text", text: `Error: Binary file format detected. Use sanitize_file for DOCX/PDF/XLSX documents.` }]
+          };
+        }
+      }
       const license = checkLicenseStatus();
       const limitStatus = checkFreeTierLimit(license.isPro);
       if (limitStatus.blocked) {
@@ -2532,12 +3285,48 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
-      let rawContent = fs.readFileSync(resolvedPath, 'utf8');
+      let rawContent = rawBuffer.toString('utf8');
+      const ext = path.extname(resolvedPath).toLowerCase();
+      if (ext === '.eml') {
+        const decodeQpUtf8 = (str) =>
+          str.replace(/=\r?\n/g, '').replace(/(?:=[0-9A-Fa-f]{2})+/g, (seq) => {
+            try {
+              const bytes = Buffer.alloc(seq.length / 3);
+              for (let i = 0; i < bytes.length; i++) bytes[i] = parseInt(seq.slice(i * 3 + 1, i * 3 + 3), 16);
+              return bytes.toString('utf8');
+            } catch (_) { return seq; }
+          });
+        rawContent = rawContent.replace(/=\?([^?]+)\?([BQbq])\?([^?]+)\?=/g, (full, charset, enc, payload) => {
+          try {
+            if (enc.toUpperCase() === 'B') return Buffer.from(payload.replace(/\s+/g, ''), 'base64').toString('utf8');
+            return decodeQpUtf8(payload.replace(/_/g, ' '));
+          } catch (_) { return full; }
+        });
+        rawContent = rawContent.replace(/(Content-Transfer-Encoding\s*:\s*base64\b[\s\S]*?\r?\n\r?\n)([A-Za-z0-9+/=\r\n]+)(?=\r?\n--|\s*$)/gi, (full, hdr, b64Block) => {
+          try {
+            const cleanB64 = b64Block.replace(/[\r\n\s]+/g, '');
+            if (cleanB64.length < 8) return full;
+            return hdr + Buffer.from(cleanB64, 'base64').toString('utf8');
+          } catch (_) { return full; }
+        });
+        rawContent = decodeQpUtf8(rawContent);
+      } else if (ext === '.rtf') {
+        rawContent = rawContent
+          .replace(/\\par\b|\\line\b/gi, '\n')
+          .replace(/\\'([0-9a-fA-F]{2})/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+          .replace(/\\u(-?\d+)\??/g, (_, code) => {
+            const n = parseInt(code, 10);
+            return String.fromCharCode(n < 0 ? n + 65536 : n);
+          })
+          .replace(/\\[a-zA-Z]+(?:-?\d+)?[ ]?/g, ' ')
+          .replace(/[{}]/g, ' ')
+          .replace(/[ \t]+/g, ' ');
+      }
       const lines = rawContent.split(/\r?\n/);
       const capped = lines.slice(0, max_lines).join('\n');
       const wasLineTruncated = lines.length > max_lines;
 
-      const targetProfile = (profile || "Dev").trim();
+      const targetProfile = resolveRequestedProfile(args, "Dev");
       const isAdvanced = targetProfile.toLowerCase() !== "general";
       const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
 
@@ -2563,7 +3352,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     }
 
     if (name === "guard_git_diff") {
-      const { staged = false, cwd, profile = "Dev", session_id = "default" } = args || {};
+      const { staged = false, cwd, session_id = "default" } = args || {};
       const targetSession = getSessionMap(session_id);
       const targetIgnoreList = getSessionIgnoreList(session_id);
       const repoCwd = cwd ? path.resolve(cwd) : process.cwd();
@@ -2597,7 +3386,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         };
       }
 
-      const targetProfile = (profile || "Dev").trim();
+      const targetProfile = resolveRequestedProfile(args, "Dev");
       const isAdvanced = targetProfile.toLowerCase() !== "general";
       const charLimit = (isAdvanced && !license.isPro) ? 5000 : 15000;
 
@@ -2806,6 +3595,7 @@ Before reading sensitive files, running terminal commands that may print credent
         }
         const tokenEntries = Object.entries(session.map);
         const telemetry = buildCisoAuditTelemetry(session.map);
+        const streamBufferLen = session.streamDetokenizer ? session.streamDetokenizer.buffer.length : 0;
         return {
           content: [{
             type: "text",
@@ -2813,6 +3603,7 @@ Before reading sensitive files, running terminal commands that may print credent
               `Created: ${new Date(session.createdAt).toISOString()}\n` +
               `Last Active: ${new Date(session.lastActive).toISOString()}\n` +
               `Total Tokens Stored in RAM: ${tokenEntries.length}\n` +
+              `Stream Buffer: ${streamBufferLen} bytes pending\n` +
               `Entity Types: ${Object.keys(telemetry.entities).join(', ') || 'None'}\n` +
               `Risk Level: ${telemetry.riskLevel}\n` +
               `Status: Volatile in-memory mapping active (0 bytes disk/network).`
@@ -2825,7 +3616,8 @@ Before reading sensitive files, running terminal commands that may print credent
       for (const [sid, sess] of agentSessions.entries()) {
         const count = Object.keys(sess.map).length;
         totalTokens += count;
-        sessionList.push({ id: sid, tokens: count, lastActive: new Date(sess.lastActive).toISOString() });
+        const streamBufferLen = sess.streamDetokenizer ? sess.streamDetokenizer.buffer.length : 0;
+        sessionList.push({ id: sid, tokens: count, streamBufferBytes: streamBufferLen, lastActive: new Date(sess.lastActive).toISOString() });
       }
 
       return {
@@ -2836,7 +3628,7 @@ Before reading sensitive files, running terminal commands that may print credent
             `Total Tokens in Memory: ${totalTokens}\n` +
             `Process Heap Used: ${(memUsage.heapUsed / (1024 * 1024)).toFixed(2)} MB\n` +
             `Uptime: ${Math.floor(process.uptime())} seconds\n` +
-            `Active Sessions: ${sessionList.map(s => `${s.id} (${s.tokens} tokens)`).join(', ') || 'None'}`
+            `Active Sessions: ${sessionList.map(s => `${s.id} (${s.tokens} tokens, ${s.streamBufferBytes} buf)`).join(', ') || 'None'}`
         }]
       };
     }
@@ -2845,6 +3637,11 @@ Before reading sensitive files, running terminal commands that may print credent
       const { session_id, all = false, reset_all = false } = args || {};
       if (all || reset_all) {
         const count = agentSessions.size;
+        for (const sess of agentSessions.values()) {
+          if (sess.streamDetokenizer) {
+            sess.streamDetokenizer.reset();
+          }
+        }
         agentSessions.clear();
         getSessionMap('default');
         sessionIgnoreList.clear();
@@ -2857,6 +3654,10 @@ Before reading sensitive files, running terminal commands that may print credent
       }
 
       const sid = (session_id || 'default').toString().trim();
+      const sess = agentSessions.get(sid);
+      if (sess && sess.streamDetokenizer) {
+        sess.streamDetokenizer.reset();
+      }
       const existed = agentSessions.delete(sid);
       if (sid === 'default') {
         getSessionMap('default');
@@ -2872,7 +3673,7 @@ Before reading sensitive files, running terminal commands that may print credent
     }
 
     if (name === "guard_rag_chunk") {
-      const { chunks, profile = "General", session_id = "default" } = args || {};
+      const { chunks, session_id = "default" } = args || {};
       if (!Array.isArray(chunks)) {
         return {
           isError: true,
@@ -2880,6 +3681,7 @@ Before reading sensitive files, running terminal commands that may print credent
         };
       }
 
+      const targetProfile = resolveRequestedProfile(args, "General");
       const targetSession = getSessionMap(session_id);
       const targetIgnoreList = getSessionIgnoreList(session_id);
       let totalTokensRedacted = 0;
@@ -2888,13 +3690,13 @@ Before reading sensitive files, running terminal commands that may print credent
       for (let i = 0; i < chunks.length; i++) {
         const item = chunks[i];
         if (typeof item === 'string') {
-          const res = performSanitization(item, profile, targetIgnoreList, targetSession);
+          const res = performSanitization(item, targetProfile, targetIgnoreList, targetSession);
           totalTokensRedacted += Object.keys(res.newTokens || {}).length;
           sanitizedChunks.push(res.scrubbedText);
         } else if (item && typeof item === 'object') {
           const copy = { ...item };
           const rawText = copy.text || copy.pageContent || copy.document || '';
-          const res = performSanitization(rawText, profile, targetIgnoreList, targetSession);
+          const res = performSanitization(rawText, targetProfile, targetIgnoreList, targetSession);
           totalTokensRedacted += Object.keys(res.newTokens || {}).length;
 
           if (copy.text !== undefined) copy.text = res.scrubbedText;
@@ -3183,7 +3985,7 @@ function detectSecrets(text) {
   return detected;
 }
 
-function performSanitization(text, profile, ignoreList = null, customSessionMap = null) {
+export function performSanitization(text, profile, ignoreList = null, customSessionMap = null) {
   const customRules = loadCustomRules();
   const normalizedProfile = (profile || "general").trim().toLowerCase();
   const license = checkLicenseStatus();
@@ -3211,7 +4013,7 @@ function performSanitization(text, profile, ignoreList = null, customSessionMap
   return { scrubbedText: result.scrubbedText, newTokens };
 }
 
-function truncateIfFree(text, isPro, charLimit = 15000) {
+export function truncateIfFree(text, isPro, charLimit = 15000) {
   if (!isPro && text.length > charLimit) {
     mcpLog(`${colors.yellowBold}[PrivacyScrubber] Input truncated to ${charLimit.toLocaleString()} characters (Free Tier Limit).${colors.reset}\n${colors.cyan}[Upgrade] Set PRIVACYSCRUBBER_KEY to your PRO/TEAMS/SDK license key for unlimited throughput: https://privacyscrubber.com/pricing?tier=teams&utm_source=mcp&utm_medium=truncation&utm_campaign=teams_upgrade${colors.reset}\n`);
     const upsellNotice = `\n\n[PrivacyScrubber Free Tier: Payload truncated to ${charLimit.toLocaleString()} chars. Upgrade to PRO ($15/mo or $110 Lifetime) or Developer SDK ($299/mo) for unlimited payload processing: https://privacyscrubber.com/pricing?tier=teams&utm_source=mcp&utm_medium=truncation&utm_campaign=teams_upgrade]`;