@privacyscrubber/sdk 2.4.1 → 2.4.3

package/README.md

@@ -139,6 +139,29 @@ console.log(restoredText);
 // "I have queued an SMS notification for John Doe at 555-0199."
 ```
 
+#### Custom Rules (`customRules`), Domain Exclusions (`ignoreList`) & Profile Selection
+You can pass `customRules` (for internal ERP/project formats) and `ignoreList` (to preserve domain-specific nouns or allowlisted identifiers in cleartext) into `sanitize()` across any profile (`'General'`, `'Manufacturing'`, `'Sales'`, `'Support'`, etc.):
+
+```javascript
+import { sanitize } from '@privacyscrubber/sdk';
+
+const { scrubbedText, tokenMap } = sanitize(rawCrmPayload, {
+    // Profile guidance:
+    // - 'Manufacturing' (or 'Engineering'): masks shopfloor/plant IDs (e.g., "Linie 3", "Station 4", SAP order numbers) alongside general PII.
+    // - 'Sales' / 'Support' / 'General': preserves production line numbers in cleartext while masking personal names, emails, phones, meeting links, and CRM identifiers.
+    profile: 'Manufacturing',
+
+    // Add custom regex or exact literal rules (works on all profiles):
+    customRules: [
+        { name: 'Internal Project Code', pattern: 'PRJ-\\d{4,6}', label: 'PROJECT' },
+        { name: 'Custom Drawing ID', regex: /\bDRW-[A-Z0-9-]{5,12}\b/g, label: 'DRAWING' }
+    ],
+
+    // Exclude specific domain terms or false-positive nouns (case-insensitive; also prevents multi-word NAME matches containing these terms):
+    ignoreList: ['Materialmangel', 'Störgrund', 'Prüfstand', 'Linie 3']
+});
+```
+
 ---
 
 ### 3. Vercel AI SDK Integration (`@privacyscrubber/sdk/vercel-ai`)

package/browser.js

@@ -114,7 +114,7 @@ export function buildAuditTelemetry(currentTokenMap = {}) {
             if (!t) continue;
             const tokenStr = typeof t === 'string' ? t : ((t && (t.token || t.mask)) ? String(t.token || t.mask) : '');
             if (!tokenStr) continue;
-            const match = tokenStr.match(/\[([A-Z_]+)_\d+\]/);
+            const match = tokenStr.match(/\[([A-Z0-9_]+)_\d+\]/);
             const baseType = match ? match[1] : (tokenStr.replace(/\[|\]/g, '').replace(/_[0-9]+$/, '') || 'CUSTOM');
             entities[baseType] = (entities[baseType] || 0) + 1;
             totalCount++;
@@ -237,7 +237,11 @@ export function sanitize(text, options = {}) {
     if (!text || typeof text !== 'string') {
         return {
             scrubbedText: '',
+            scrubbed: '',
             tokenMap: {},
+            sessionMap: {},
+            matches: [],
+            spans: [],
             count: 0,
             executionMs: 0,
             license: { isPro: false, tier: 'FREE', limit: 15000, wasTruncated: false },
@@ -344,9 +348,16 @@ export function sanitize(text, options = {}) {
         finalScrubbedText += `\n\n<!-- [PrivacyScrubber] Input truncated at free tier limit (${limit.toLocaleString()} chars). For unlimited throughput: https://privacyscrubber.com/pricing?tier=sdk&src=truncation -->`;
     }
 
+    const returnFullSessionMap = options.returnFullSessionMap === true;
+    const sessionMap = { ...(existingSessionMap || {}), ...(rawResult.tokenMap || {}) };
+
     return {
         scrubbedText: finalScrubbedText,
-        tokenMap: rawResult.tokenMap || {},
+        scrubbed: finalScrubbedText,
+        tokenMap: returnFullSessionMap ? sessionMap : (rawResult.tokenMap || {}),
+        sessionMap: sessionMap,
+        matches: rawResult.matches || [],
+        spans: rawResult.matches || [],
         count: rawResult.count || 0,
         executionMs: executionMs,
         license: {
@@ -391,6 +402,7 @@ export function restore(aiResponse, tokenMap = {}) {
 }
 
 export const unscrub = restore;
+export const desanitize = restore;
 
 /**
  * Recursively sanitizes all string values within an object or array.
@@ -517,6 +529,7 @@ export class PrivacyScrubberEngine {
         this.generateReceipt = config.generateReceipt !== false;
         this.sessionMap = { ...(config.initialSessionMap || {}) };
         this.ignoreList = new Set(config.ignoreList || []);
+        this.maxSessionTokens = config.maxSessionTokens || 10000;
         this.license = validateLicense(this.licenseKey);
     }
 
@@ -548,6 +561,14 @@ export class PrivacyScrubberEngine {
         const result = sanitize(text, mergedOptions);
         if (options.persistSession !== false) {
             Object.assign(this.sessionMap, result.tokenMap);
+            const maxTokens = options.maxSessionTokens || this.maxSessionTokens || 10000;
+            const keys = Object.keys(this.sessionMap);
+            if (keys.length > maxTokens) {
+                const pruneCount = keys.length - maxTokens;
+                for (let i = 0; i < pruneCount; i++) {
+                    delete this.sessionMap[keys[i]];
+                }
+            }
         }
         return result;
     }
@@ -563,8 +584,31 @@ export class PrivacyScrubberEngine {
         }
     }
 
-    createStreamRestorer(options = {}) {
-        return createStreamTokenRestorer(this.sessionMap, options);
+    markFalsePositive(token) {
+        const original = this.sessionMap[token];
+        if (!original) {
+            return { success: false, reason: `Token '${token}' not found in session map` };
+        }
+        this.ignoreList.add(original);
+        delete this.sessionMap[token];
+        return { success: true, token, original, ignoreListSize: this.ignoreList.size };
+    }
+
+    clearIgnoreList() {
+        this.ignoreList.clear();
+    }
+
+    createStreamRestorer(tokenMap = null, options = {}) {
+        if (tokenMap && typeof tokenMap === 'object' && typeof tokenMap.onTokenRestored === 'function' && Object.keys(options).length === 0) {
+            return createStreamTokenRestorer(this.sessionMap, tokenMap);
+        }
+        const activeMap = tokenMap || this.sessionMap;
+        return createStreamTokenRestorer(activeMap, options);
+    }
+
+    async* wrapStream(stream, tokenMap = null, options = {}) {
+        const activeMap = tokenMap || this.sessionMap;
+        yield* wrapAiStream(stream, activeMap, options);
     }
 }
 
@@ -749,7 +793,7 @@ export class StreamingDetokenizer {
         const tailLen = 160;
         const tail = this.pendingBuffer.length > tailLen ? this.pendingBuffer.slice(-tailLen) : this.pendingBuffer;
         const offset = this.pendingBuffer.length > tailLen ? this.pendingBuffer.length - tailLen : 0;
-        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-А-Яа-яЁё *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
+        const m = tail.match(/(?:(?:\[|【|［|〔|「|『|<|\{\{?|__?|%5[Bb]|\\u005[Bb]|&(?:amp;)?(?:#0*91;|#[xX]0*5[Bb];|lbrack;))[A-Za-z0-9_\-\u0410-\u044F\u0401\u0451 *`~.\\]{0,128}(?:%5?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?3?|[xX]0*5?[Dd]?)?|r(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)?|%[0-9A-Fa-f]?|\\(?:u(?:0(?:0(?:5)?)?)?)?|&(?:a(?:m(?:p(?:;)?)?)?)?(?:#(?:0*9?1?|[xX]0*5?)?|l(?:b(?:r(?:a(?:c(?:k)?)?)?)?)?)?)$/);
 
         if (m) {
             const candidate = m[0];
@@ -804,15 +848,19 @@ export class StreamingDetokenizer {
      * @returns {AsyncGenerator<any>}
      */
     async* wrapStream(asyncIterable) {
+        let lastOpenAIChunk = null;
         for await (const chunk of asyncIterable) {
             if (chunk === null || chunk === undefined) continue;
             if (chunk.choices && Array.isArray(chunk.choices) && chunk.choices[0]?.delta?.content !== undefined) {
+                lastOpenAIChunk = chunk;
                 const delta = chunk.choices[0].delta.content;
                 if (typeof delta === 'string') {
                     const restored = this.feed(delta);
                     if (restored) {
-                        chunk.choices[0].delta.content = restored;
-                        yield chunk;
+                        const clonedChoices = chunk.choices.map((c, idx) =>
+                            idx === 0 ? { ...c, delta: { ...c.delta, content: restored } } : c
+                        );
+                        yield { ...chunk, choices: clonedChoices };
                     }
                 } else {
                     yield chunk;
@@ -838,7 +886,16 @@ export class StreamingDetokenizer {
         }
 
         const finalChunk = this.flush();
-        if (finalChunk) yield finalChunk;
+        if (finalChunk) {
+            if (lastOpenAIChunk) {
+                const clonedChoices = lastOpenAIChunk.choices.map((c, idx) =>
+                    idx === 0 ? { ...c, delta: { ...c.delta, content: finalChunk } } : c
+                );
+                yield { ...lastOpenAIChunk, choices: clonedChoices };
+            } else {
+                yield finalChunk;
+            }
+        }
     }
 }
 
@@ -847,25 +904,7 @@ export class StreamingDetokenizer {
  */
 export async function* wrapAiStream(stream, tokenMap = {}, options = {}) {
     const detokenizer = new StreamingDetokenizer(tokenMap, options);
-    for await (const chunk of stream) {
-        const text = typeof chunk === 'string' ? chunk : (chunk?.content || chunk?.text || chunk?.delta || '');
-        if (text) {
-            const detokenized = detokenizer.process(text);
-            if (detokenized) {
-                if (typeof chunk === 'string') {
-                    yield detokenized;
-                } else if (typeof chunk === 'object' && chunk !== null) {
-                    yield { ...chunk, content: detokenized, text: detokenized };
-                }
-            }
-        } else {
-            yield chunk;
-        }
-    }
-    const remaining = detokenizer.flush();
-    if (remaining) {
-        yield remaining;
-    }
+    yield* detokenizer.wrapStream(stream);
 }
 
 export function createStreamTokenRestorer(tokenMap = {}, options = {}) {
@@ -893,7 +932,22 @@ export function createStreamTokenRestorer(tokenMap = {}, options = {}) {
     return stream;
 }
 
-export const scrubText = scrubberPkg ? scrubberPkg.scrubText : null;
+export function scrubText(text, customRulesOrOptions = [], ...args) {
+    if (
+        customRulesOrOptions &&
+        typeof customRulesOrOptions === 'object' &&
+        !Array.isArray(customRulesOrOptions) &&
+        args.length === 0
+    ) {
+        return sanitize(text, customRulesOrOptions);
+    }
+    if (!scrubberPkg || typeof scrubberPkg.scrubText !== 'function') return null;
+    const res = scrubberPkg.scrubText(text, customRulesOrOptions, ...args);
+    if (res && typeof res === 'object' && typeof res.scrubbed === 'undefined') {
+        res.scrubbed = res.scrubbedText;
+    }
+    return res;
+}
 export const unscrubText = scrubberPkg ? scrubberPkg.unscrubText : null;
 
 // ── PSR-2 Receipt Integrity (real SHA-256; parity with src/modules/receipt-integrity.js) ──
@@ -965,7 +1019,7 @@ export function buildPsr2Receipt(tokenMap, timestamp = new Date().toISOString())
   const labels = (tokenMap && typeof tokenMap === 'object' ? Object.keys(tokenMap) : []).slice().sort();
   const counts = {};
   for (const t of labels) {
-    const m = t.match(/\[([A-Z_]+)_\d+\]/);
+    const m = String(t).trim().match(/^(?:\[|<|\{\{|__)([A-Z0-9_]+)_\d+(?:\]|>|\}\}|__)$/);
     const type = m ? m[1] : 'CUSTOM';
     counts[type] = (counts[type] || 0) + 1;
   }
@@ -1082,6 +1136,7 @@ export default {
     restore,
     restoreObject,
     unscrub,
+    desanitize,
     validateLicense,
     validateLicenseKey,
     buildAuditTelemetry,

package/cli.js

@@ -21,9 +21,18 @@ import { sanitize, restore, validateLicense, generateProcurementMemo, StreamingD
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-const args = process.argv.slice(2);
+const rawArgs = process.argv.slice(2);
+const args = [];
+for (const a of rawArgs) {
+  const eqIdx = a.indexOf('=');
+  if (a.startsWith('-') && eqIdx > 1) {
+    args.push(a.slice(0, eqIdx), a.slice(eqIdx + 1));
+  } else {
+    args.push(a);
+  }
+}
 
-let sdkVersion = '2.4.1';
+let sdkVersion = '2.4.3';
 try {
   const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, 'package.json'), 'utf8'));
   sdkVersion = pkg.version || sdkVersion;
@@ -104,7 +113,10 @@ if (args.includes('sidecar') || args.includes('--sidecar') || args.includes('ser
   let port = 3100;
   const portIdx = args.indexOf('--port') !== -1 ? args.indexOf('--port') : args.indexOf('-p');
   if (portIdx !== -1 && args[portIdx + 1]) {
-    port = parseInt(args[portIdx + 1], 10);
+    const parsedPort = parseInt(args[portIdx + 1], 10);
+    if (Number.isInteger(parsedPort) && parsedPort >= 1 && parsedPort <= 65535) {
+      port = parsedPort;
+    }
   }
   let host = process.env.HOST || '127.0.0.1';
   const hostIdx = args.indexOf('--host');
@@ -176,9 +188,12 @@ if (args.includes('sidecar') || args.includes('--sidecar') || args.includes('ser
 
     if (req.method === 'POST') {
       let bodyStr = '';
+      let aborted = false;
       req.on('data', chunk => {
+        if (aborted || res.writableEnded) return;
         bodyStr += chunk;
         if (bodyStr.length > 50 * 1024 * 1024) {
+          aborted = true;
           res.writeHead(413, { 'Content-Type': 'application/json' });
           res.end(JSON.stringify({ error: 'Payload Too Large' }));
           req.destroy();
@@ -186,6 +201,7 @@ if (args.includes('sidecar') || args.includes('--sidecar') || args.includes('ser
       });
 
       req.on('end', () => {
+        if (aborted || res.writableEnded) return;
         try {
           const payload = bodyStr ? JSON.parse(bodyStr) : {};
           const isScrub = reqUrl === '/scrub' || reqUrl === '/sanitize' || reqUrl === '/v1/scrub' || reqUrl === '/v1/sanitize';
@@ -389,6 +405,7 @@ fi
     try { fs.chmodSync(preCommitPath, 0o755); } catch (_) {}
     console.log('[PrivacyScrubber Hook] Successfully installed Zero-Trust pre-commit hook in .git/hooks/pre-commit.');
     console.log('[PrivacyScrubber Hook] Staged changes will now be audited for unmasked secrets before commit.');
+    console.log('[GitHub] Star the open-source repository: https://github.com/moxno/privacyscrubber-mcp (CLI: gh repo star moxno/privacyscrubber-mcp)');
     process.exit(0);
   }
 
@@ -404,10 +421,15 @@ fi
           fs.unlinkSync(preCommitPath);
         }
         console.log('[PrivacyScrubber Hook] Pre-commit hook removed successfully.');
+        console.log('[Feedback] Why did you remove the hook? (1-click instant log):');
+        console.log('  - False positive / Accuracy: https://privacyscrubber.com/uninstall/?src=sdk&reason=accuracy');
+        console.log('  - Workflow / Setup issue:    https://privacyscrubber.com/uninstall/?src=sdk&reason=setup');
+        console.log('  - General feedback:          https://privacyscrubber.com/uninstall/?mode=feedback&src=sdk');
         process.exit(0);
       }
     }
     console.log('[PrivacyScrubber Hook] Pre-commit hook was not found in active repository.');
+    console.log('[Feedback] Share feedback or report an issue: https://privacyscrubber.com/uninstall/?mode=feedback&src=sdk');
     process.exit(0);
   }
 }
@@ -431,10 +453,16 @@ if (args.includes('scan-git-staged') || args.includes('--scan-git-staged')) {
     }
 
     const res = sanitize(addedLines, { profile: 'Dev', detectSecrets: true });
-    const maskedCount = Object.keys(res.tokenMap || {}).length;
+    const includeNames = args.includes('--include-names') || args.includes('--strict');
+    const relevantTokens = Object.keys(res.tokenMap || {}).filter(
+      tok => includeNames || !/^\[NAME_\d+\]$/i.test(tok)
+    );
+    const maskedCount = relevantTokens.length;
 
     if (maskedCount > 0) {
-      const entityTypes = Object.keys(res.telemetry?.entities || {}).join(', ');
+      const entityTypes = Array.from(new Set(
+        relevantTokens.map(t => t.replace(/^\[|_\d+\]$/g, ''))
+      )).join(', ');
       console.error(`
 ╔══════════════════════════════════════════════════════════════════════════════╗
 ║  🚨 [PrivacyScrubber Git Shield] UNMASKED SECRETS / PII INTERCEPTED!        ║
@@ -580,31 +608,47 @@ if (mapIdx !== -1 && args[mapIdx + 1]) {
 }
 
 // Locate input argument (first positional parameter that is not a flag or flag value)
+const inputFlagIdx = args.indexOf('--input') !== -1 ? args.indexOf('--input') : args.indexOf('-i');
+const outIdx = args.indexOf('--out') !== -1 ? args.indexOf('--out') : (args.indexOf('--output') !== -1 ? args.indexOf('--output') : args.indexOf('-o'));
+const outputFile = (outIdx !== -1 && args[outIdx + 1]) ? args[outIdx + 1] : null;
+
 const skipIndices = new Set();
 if (configIdx !== -1) { skipIndices.add(configIdx); skipIndices.add(configIdx + 1); }
 if (profIdx !== -1) { skipIndices.add(profIdx); skipIndices.add(profIdx + 1); }
 if (keyIdx !== -1) { skipIndices.add(keyIdx); skipIndices.add(keyIdx + 1); }
 if (mapIdx !== -1) { skipIndices.add(mapIdx); skipIndices.add(mapIdx + 1); }
 if (formatIdx !== -1) { skipIndices.add(formatIdx); skipIndices.add(formatIdx + 1); }
-const outIdx = args.indexOf('--out');
+if (inputFlagIdx !== -1) { skipIndices.add(inputFlagIdx); skipIndices.add(inputFlagIdx + 1); }
 if (outIdx !== -1) { skipIndices.add(outIdx); skipIndices.add(outIdx + 1); }
 
-let inputArg = null;
-for (let i = 0; i < args.length; i++) {
-  if (skipIndices.has(i)) continue;
-  if (args[i] === '--verify-ci' || args[i] === '--ztds-proof' || args[i] === '--json' || args[i] === '--sarif' || args[i] === '--restore' || args[i] === '--unscrub') continue;
-  if (args[i].startsWith('-')) continue;
-  inputArg = args[i];
-  break;
+let inputArg = (inputFlagIdx !== -1 && args[inputFlagIdx + 1]) ? args[inputFlagIdx + 1] : null;
+if (!inputArg) {
+  for (let i = 0; i < args.length; i++) {
+    if (skipIndices.has(i)) continue;
+    if (args[i] === 'sanitize' || args[i] === 'scrub') continue;
+    if (args[i] === '--verify-ci' || args[i] === '--ztds-proof' || args[i] === '--json' || args[i] === '--sarif' || args[i] === '--restore' || args[i] === '--unscrub') continue;
+    if (args[i].startsWith('-')) continue;
+    inputArg = args[i];
+    break;
+  }
+}
+
+function writeCliOutput(str) {
+  const payload = str.endsWith('\n') ? str : str + '\n';
+  if (outputFile) {
+    fs.writeFileSync(path.resolve(process.cwd(), outputFile), payload, 'utf8');
+  } else {
+    process.stdout.write(payload);
+  }
 }
 
 function handleExecution(text) {
   if (isRestore) {
     const { restoredText, restoredCount } = restore(text, tokenMap);
     if (isJson) {
-      console.log(JSON.stringify({ restoredText, restoredCount }, null, 2));
+      writeCliOutput(JSON.stringify({ restoredText, restoredCount }, null, 2));
     } else {
-      process.stdout.write(restoredText.endsWith('\n') ? restoredText : restoredText + '\n');
+      writeCliOutput(restoredText);
     }
     process.exit(0);
   }
@@ -648,9 +692,9 @@ function handleExecution(text) {
     };
 
     const proofJson = JSON.stringify(proof, null, 2);
-    if (outIdx !== -1 && args[outIdx + 1]) {
-      fs.writeFileSync(path.resolve(process.cwd(), args[outIdx + 1]), proofJson, 'utf8');
-      console.log(`[ZTDS Proof] Conformance proof saved to ${args[outIdx + 1]}`);
+    if (outputFile) {
+      fs.writeFileSync(path.resolve(process.cwd(), outputFile), proofJson, 'utf8');
+      console.log(`[ZTDS Proof] Conformance proof saved to ${outputFile}`);
     } else {
       console.log(proofJson);
     }
@@ -659,7 +703,7 @@ function handleExecution(text) {
 
   if (isVerifyCi) {
     if (!text || !text.trim()) {
-      console.log(`> **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)`);
+      writeCliOutput(`> **Verified by PrivacyScrubber (ZTDS Standard)**\n> * **Status:** PASSED · 0 PII / 0 Secrets detected in prompt pipeline (Empty payload)\n> * **Execution:** Local RAM (<1ms) · 0 Network Egress Bytes\n> * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)`);
       process.exit(0);
     }
 
@@ -678,16 +722,16 @@ function handleExecution(text) {
 > * **Audit Hash:** \`${hash}\` (Zero-Trust Verified)
 > * **Compliance Spec:** [Zero-Trust Data Sanitization (ZTDS)](https://privacyscrubber.com/solutions/engineering/zero-trust-ai-data-sanitization?src=ci_stamp) | ⭐ [Star on GitHub](https://github.com/moxno/privacyscrubber-mcp) | [Developer SDK ($299/mo)](https://privacyscrubber.com/sdk/?src=ci_stamp)
 `;
-    console.log(stamp.trim());
+    writeCliOutput(stamp.trim());
     process.exit(0);
   }
 
   if (!text) {
     if (isSarif) {
-      const { emitSarif } = require('./sarif.js');
-      console.log(emitSarif([], { pretty: true }));
+      const { emitSarif } = require('./sarif.cjs');
+      writeCliOutput(emitSarif([], { pretty: true }));
     } else if (isJson) {
-      console.log(JSON.stringify({ scrubbedText: '', tokenMap: {}, count: 0 }, null, 2));
+      writeCliOutput(JSON.stringify({ scrubbedText: '', tokenMap: {}, count: 0 }, null, 2));
     }
     process.exit(0);
   }
@@ -698,19 +742,19 @@ function handleExecution(text) {
     customRules: loadedConfig.customRules || []
   });
   if (isSarif) {
-    const { emitSarif, sanitizeResultToFindings } = require('./sarif.js');
+    const { emitSarif, sanitizeResultToFindings } = require('./sarif.cjs');
     const findings = sanitizeResultToFindings(res, text, inputArg || 'stdin');
     const sarifOutput = emitSarif(findings, { pretty: true });
-    process.stdout.write(sarifOutput + '\n');
+    writeCliOutput(sarifOutput);
   } else if (isJson) {
-    console.log(JSON.stringify({
+    writeCliOutput(JSON.stringify({
       scrubbedText: res.scrubbedText,
       tokenMap: res.tokenMap,
       count: res.count,
       telemetry: res.telemetry
     }, null, 2));
   } else {
-    process.stdout.write(res.scrubbedText.endsWith('\n') ? res.scrubbedText : res.scrubbedText + '\n');
+    writeCliOutput(res.scrubbedText);
   }
   process.exit(0);
 }

package/examples/python-bridge/bridge_daemon.cjs

@@ -92,7 +92,6 @@ function sendResponse(id, result, error = null) {
 // Setup readline interface on stdin
 const rl = readline.createInterface({
     input: process.stdin,
-    output: process.stdout,
     terminal: false
 });
 
@@ -116,7 +115,7 @@ rl.on('line', (line) => {
                 sendResponse(id, {
                     pong: true,
                     engine: 'PrivacyScrubber ZTDS',
-                    version: '2.4.1',
+                    version: '2.4.3',
                     uptime: process.uptime()
                 });
                 break;
@@ -163,17 +162,36 @@ rl.on('line', (line) => {
 
             case 'sanitize_object': {
                 const data = req.data ?? {};
+                const persistSession = req.persist_session ?? req.persistSession ?? true;
+                let mergedIgnore = null;
+                const reqIgnore = req.ignore_list || req.ignoreList || null;
+                if (reqIgnore || engine.ignoreList.size > 0) {
+                    mergedIgnore = new Set(engine.ignoreList);
+                    if (reqIgnore) {
+                        for (const item of reqIgnore) mergedIgnore.add(item);
+                    }
+                }
                 const options = {
                     profile: req.profile || engine.defaultProfile,
                     detectSecrets: req.detect_secrets ?? req.detectSecrets ?? false,
                     licenseKey: req.license_key || req.licenseKey || engine.licenseKey,
+                    generateReceipt: req.generate_receipt ?? req.generateReceipt ?? true,
                     customRules: req.custom_rules || req.customRules || [],
+                    ignoreList: mergedIgnore,
+                    existingSessionMap: persistSession ? engine.sessionMap : (req.existing_session_map || req.existingSessionMap || {}),
                     throwOnLimit: req.throw_on_limit ?? req.throwOnLimit ?? true
                 };
 
                 const res = sdk.sanitizeObject(data, options);
-                if (req.persist_session !== false && res.tokenMap) {
+                if (persistSession && res.tokenMap) {
                     Object.assign(engine.sessionMap, res.tokenMap);
+                    const keys = Object.keys(engine.sessionMap);
+                    if (keys.length > engine.maxSessionTokens) {
+                        const excess = keys.length - engine.maxSessionTokens;
+                        for (let i = 0; i < excess; i++) {
+                            delete engine.sessionMap[keys[i]];
+                        }
+                    }
                 }
                 sendResponse(id, {
                     sanitized: res.sanitized,
@@ -213,10 +231,11 @@ rl.on('line', (line) => {
             }
 
             case 'status': {
+                const tier = engine.license?.tier || 'FREE';
                 sendResponse(id, {
                     profile: engine.defaultProfile,
-                    license_tier: engine.license?.tier || 'FREE',
-                    is_pro: engine.license?.isPro || false,
+                    license_tier: tier,
+                    is_pro: Boolean(engine.license?.valid && ['SDK', 'OEM', 'ENTERPRISE', 'PRO', 'TEAMS'].includes(tier)),
                     session_tokens_count: Object.keys(engine.sessionMap).length,
                     ignore_list_size: engine.ignoreList.size,
                     memory_usage: process.memoryUsage()

package/examples/python-bridge/fastapi_example.py

@@ -59,7 +59,7 @@ if FASTAPI_AVAILABLE:
     app = FastAPI(
         title="PrivacyScrubber ZTDS Sidecar Proxy",
         description="Zero-Trust Data Sanitization & In-Memory PII Shield for LLM Pipelines",
-        version="2.4.1"
+        version="2.4.3"
     )
 
     @app.on_event("startup")

package/examples/python-bridge/privacyscrubber/__init__.py

@@ -24,7 +24,7 @@ from privacyscrubber.exceptions import (
     PrivacyScrubberLicenseError,
 )
 
-__version__ = "2.4.1"
+__version__ = "2.4.3"
 __author__ = "Ilya Sibiryakov (BrandMeWeb)"
 __license__ = "Proprietary"
 

package/examples/python-bridge/privacyscrubber/bridge_daemon.cjs

@@ -92,7 +92,6 @@ function sendResponse(id, result, error = null) {
 // Setup readline interface on stdin
 const rl = readline.createInterface({
     input: process.stdin,
-    output: process.stdout,
     terminal: false
 });
 
@@ -116,7 +115,7 @@ rl.on('line', (line) => {
                 sendResponse(id, {
                     pong: true,
                     engine: 'PrivacyScrubber ZTDS',
-                    version: '2.4.1',
+                    version: '2.4.3',
                     uptime: process.uptime()
                 });
                 break;
@@ -163,17 +162,36 @@ rl.on('line', (line) => {
 
             case 'sanitize_object': {
                 const data = req.data ?? {};
+                const persistSession = req.persist_session ?? req.persistSession ?? true;
+                let mergedIgnore = null;
+                const reqIgnore = req.ignore_list || req.ignoreList || null;
+                if (reqIgnore || engine.ignoreList.size > 0) {
+                    mergedIgnore = new Set(engine.ignoreList);
+                    if (reqIgnore) {
+                        for (const item of reqIgnore) mergedIgnore.add(item);
+                    }
+                }
                 const options = {
                     profile: req.profile || engine.defaultProfile,
                     detectSecrets: req.detect_secrets ?? req.detectSecrets ?? false,
                     licenseKey: req.license_key || req.licenseKey || engine.licenseKey,
+                    generateReceipt: req.generate_receipt ?? req.generateReceipt ?? true,
                     customRules: req.custom_rules || req.customRules || [],
+                    ignoreList: mergedIgnore,
+                    existingSessionMap: persistSession ? engine.sessionMap : (req.existing_session_map || req.existingSessionMap || {}),
                     throwOnLimit: req.throw_on_limit ?? req.throwOnLimit ?? true
                 };
 
                 const res = sdk.sanitizeObject(data, options);
-                if (req.persist_session !== false && res.tokenMap) {
+                if (persistSession && res.tokenMap) {
                     Object.assign(engine.sessionMap, res.tokenMap);
+                    const keys = Object.keys(engine.sessionMap);
+                    if (keys.length > engine.maxSessionTokens) {
+                        const excess = keys.length - engine.maxSessionTokens;
+                        for (let i = 0; i < excess; i++) {
+                            delete engine.sessionMap[keys[i]];
+                        }
+                    }
                 }
                 sendResponse(id, {
                     sanitized: res.sanitized,
@@ -213,10 +231,11 @@ rl.on('line', (line) => {
             }
 
             case 'status': {
+                const tier = engine.license?.tier || 'FREE';
                 sendResponse(id, {
                     profile: engine.defaultProfile,
-                    license_tier: engine.license?.tier || 'FREE',
-                    is_pro: engine.license?.isPro || false,
+                    license_tier: tier,
+                    is_pro: Boolean(engine.license?.valid && ['SDK', 'OEM', 'ENTERPRISE', 'PRO', 'TEAMS'].includes(tier)),
                     session_tokens_count: Object.keys(engine.sessionMap).length,
                     ignore_list_size: engine.ignoreList.size,
                     memory_usage: process.memoryUsage()

package/examples/python-bridge/privacyscrubber/cli.py

@@ -50,7 +50,7 @@ def main() -> None:
     args = parser.parse_args()
 
     if args.version:
-        print("PrivacyScrubber ZTDS Python SDK v2.4.1")
+        print("PrivacyScrubber ZTDS Python SDK v2.4.3")
         sys.exit(0)
 
     if not args.command: