@sifxprime/krouter 0.5.144 → 0.5.146

package/README.md

@@ -69,6 +69,24 @@ docker run -d \
   sifxprime/krouter:latest
 ```
 
+#### With PII Redaction (Presidio)
+
+To enable automatic PII redaction before sending requests to AI providers.
+`INITIAL_PASSWORD` has no default — set one before starting, or compose will
+refuse to come up:
+
+```bash
+export KROUTER_INITIAL_PASSWORD="$(openssl rand -base64 24)"
+docker compose up -d
+```
+
+Not using Docker? kRouter has no Python dependency — run the sidecar separately
+and point `SIDECAR_URL` at it. See the setup guide below.
+
+Redaction is **off by default**; enable it from Dashboard -> Presidio.
+
+See [docs/REDACTION_SETUP.md](https://github.com/sifxprime/krouter/blob/main/docs/REDACTION_SETUP.md) for full configuration and customization options.
+
 Then open **[http://localhost:20128/dashboard](http://localhost:20128/dashboard)**.
 
 ---
@@ -123,6 +141,206 @@ If one provider fails, kRouter instantly falls back through your entire pre-rank
 
 ---
 
+## 🔒 PII Redaction with Presidio
+
+kRouter includes optional PII (Personally Identifiable Information) redaction using Microsoft Presidio, protecting your sensitive data before it reaches AI providers.
+
+### What Gets Redacted
+
+**Built-in ML Detection:**
+- Names (PERSON)
+- Email addresses (EMAIL_ADDRESS)
+- Phone numbers (PHONE_NUMBER)
+- Locations and addresses (LOCATION, GPE)
+- Organizations (ORG)
+- Credit card numbers (CREDIT_CARD)
+- IP addresses (IP_ADDRESS)
+- URLs (URL)
+- Social Security Numbers
+- Dates and more...
+
+**Custom Regex Patterns:**
+- OpenAI API keys (`sk-proj-*`)
+- GitHub personal access tokens
+- AWS access keys
+- Slack webhook URLs
+- Internal IDs and custom patterns
+
+### How It Works
+
+```
+┌─────────────┐
+│  Your CLI   │  Input: "My name is John Doe, email: john@company.com"
+│   Tool      │
+└──────┬──────┘
+       │
+       ↓
+┌─────────────────────────────────────────────┐
+│         kRouter Redaction Middleware       │
+│  1. Extract text from messages             │
+│  2. Send to Presidio sidecar               │
+│  3. Receive redacted text                  │
+│  4. Replace in request body                │
+└──────┬──────────────────────────────────────┘
+       │
+       ↓
+  Output: "My name is <PERSON>, email: <EMAIL>"
+       │
+       ↓
+┌─────────────────────────────────────────────┐
+│           AI Provider                       │
+│  (Never sees actual PII)                   │
+└─────────────────────────────────────────────┘
+```
+
+### Security: Fail-Closed by Default
+
+**When redaction fails, requests are REJECTED** — not sent unredacted:
+
+| Scenario | Behavior | Status Code |
+|----------|----------|-------------|
+| Sidecar timeout | Request rejected | 503 Service Unavailable |
+| Sidecar down | Request rejected | 503 Service Unavailable |
+| Sidecar error | Request rejected | 502 Bad Gateway |
+| Invalid response | Request rejected | 502 Bad Gateway |
+
+This ensures PII is never accidentally sent to AI providers when the redaction service is unavailable.
+
+> ⚠️ **Important:** For production use, monitor redaction failures and set up alerts. See [Troubleshooting](#troubleshooting-presidio).
+
+### Quick Start (Docker)
+
+```bash
+# Start kRouter with Presidio sidecar
+docker-compose up -d
+
+# Open dashboard
+open http://localhost:20128/dashboard
+```
+
+The Presidio sidecar runs in a separate container and communicates with kRouter over the Docker network.
+
+### Configuration
+
+Enable and configure PII redaction in the dashboard:
+
+1. Go to **Dashboard → Settings → Presidio**
+2. Toggle **Presidio Sidecar** to enable
+3. Toggle **PII Redaction** to activate
+4. (Optional) Toggle **Custom Regex Patterns** and edit YAML
+
+#### Example Custom Regex YAML
+
+```yaml
+rules:
+  - entity: "INTERNAL_ID"
+    pattern: "USER-[0-9]{6}"
+    description: "Internal user ID format"
+
+  - entity: "PROJECT_KEY"
+    pattern: "PROJ_[A-Z]{3}-[0-9]{4}"
+    description: "Project identifier"
+
+  - entity: "DEPLOY_TOKEN"
+    pattern: "glpat-[a-zA-Z0-9_-]{20}"
+    description: "GitLab deployment token"
+```
+
+### Environment Variables
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `REDACTION_ENABLED` | `true` | Enable/disable redaction middleware |
+| `REDACTION_FAIL_OPEN` | `false` | **⚠️ SECURITY:** If true, allow requests on redaction failure (not recommended) |
+| `SIDECAR_URL` | `http://presidio-sidecar:5001/redact` | Presidio sidecar endpoint |
+| `PRESIDIO_CONFIG_PATH` | `/app/redaction_config.yaml` | Path to custom regex YAML config |
+
+> 🔒 **Security Note:** Never set `REDACTION_FAIL_OPEN=true` in production unless you have a specific reason and understand the security implications.
+
+### Testing Redaction
+
+```bash
+# Test the sidecar directly
+curl -X POST http://localhost:5001/redact \
+  -H "Content-Type: application/json" \
+  -d '{
+    "texts": [
+      "Contact John Doe at john.doe@example.com or 555-123-4567",
+      "OpenAI key: sk-proj-abc123def456ghi789jkl"
+    ]
+  }'
+
+# Response:
+# {
+#   "redacted_texts": [
+#     "Contact <PERSON> at <EMAIL_ADDRESS> or <PHONE_NUMBER>",
+#     "OpenAI key: <OPENAI_KEY>"
+#   ]
+# }
+```
+
+### Performance
+
+- **Latency:** < 2ms per request (within Docker network)
+- **Overhead:** Minimal, typically < 10ms end-to-end
+- **Scalability:** Concurrent processing with Uvicorn workers
+
+### Troubleshooting Presidio
+
+**Redaction failures appear as 503 errors:**
+
+```bash
+# Check sidecar status
+docker-compose ps presidio-sidecar
+
+# Check sidecar logs
+docker-compose logs presidio-sidecar
+
+# Check kRouter redaction logs
+docker-compose logs krouter | grep redaction
+```
+
+**Sidecar won't start:**
+
+```bash
+# Check if port 5001 is in use
+lsof -i :5001
+
+# Rebuild the sidecar container
+docker-compose build presidio-sidecar
+docker-compose up -d presidio-sidecar
+```
+
+**Redaction not working:**
+
+1. Verify Presidio toggles are enabled in Dashboard → Settings → Presidio
+2. Check that `REDACTION_ENABLED=true` in docker-compose.yml
+3. Ensure sidecar is healthy: `curl http://localhost:5001/health`
+4. Check kRouter logs for errors
+
+**High false positive rate:**
+
+- Add custom patterns to YAML config in Dashboard → Settings → Presidio
+- Review and refine regex patterns
+- Test patterns using the sidecar API directly
+
+### Security Best Practices
+
+1. **Never disable fail-closed in production** — Keep `REDACTION_FAIL_OPEN=false`
+2. **Monitor redaction failures** — Set up alerts on 503/502 errors
+3. **Review custom regex patterns** — Ensure they're specific and don't match valid content
+4. **Keep sidecar updated** — Pull latest image for security patches
+5. **Use dedicated network** — Isolate redaction traffic when possible
+
+### Customization
+
+For advanced customization, see:
+- **Full configuration guide:** [docs/REDACTION_SETUP.md](https://github.com/sifxprime/krouter/blob/main/docs/REDACTION_SETUP.md)
+- **Pattern examples:** [docs/REDACTION_SETUP.md#custom-patterns](https://github.com/sifxprime/krouter/blob/main/docs/REDACTION_SETUP.md#custom-patterns)
+- **Fail-closed behaviour and limits:** [docs/REDACTION_SETUP.md#a-note-on-trust](https://github.com/sifxprime/krouter/blob/main/docs/REDACTION_SETUP.md#a-note-on-trust)
+
+---
+
 ## 💡 Features
 
 | Feature | What It Does | Why It Matters |
@@ -137,6 +355,7 @@ If one provider fails, kRouter instantly falls back through your entire pre-rank
 | 🎨 **Custom Combos** | Unlimited model combinations with per-combo strategies | Tailor fallback to your workflow |
 | 🖥️ **System Tray** | Runs quietly in background with tray icon | Set-and-forget deployment |
 | 🐳 **Deploy Anywhere** | Localhost · VPS · Docker · Cloudflare Workers | Wherever you need it |
+| 🔒 **PII Redaction** | Auto-redact sensitive data (emails, phones, API keys) using Microsoft Presidio | Protect privacy before sending to AI providers |
 
 📖 **Full feature guide with screenshots → [krouter.kodelyht.com](https://krouter.kodelyht.com)**
 

package/app/.next-cli-build/BUILD_ID

@@ -1 +1 @@
-p4jE6g-j-05K8E74ySO-I
+alT51K3CdFyFBv27IY7wb

package/app/.next-cli-build/app-path-routes-manifest.json

@@ -78,19 +78,14 @@
   "/api/usage/providers/route": "/api/usage/providers",
   "/api/usage/request-details/route": "/api/usage/request-details",
   "/api/usage/request-logs/route": "/api/usage/request-logs",
-  "/api/v1/api/chat/route": "/api/v1/api/chat",
   "/api/v1/audio/speech/route": "/api/v1/audio/speech",
   "/api/v1/audio/voices/route": "/api/v1/audio/voices",
-  "/api/v1/chat/completions/route": "/api/v1/chat/completions",
   "/api/v1/embeddings/route": "/api/v1/embeddings",
   "/api/v1/images/generations/route": "/api/v1/images/generations",
   "/api/v1/messages/count_tokens/route": "/api/v1/messages/count_tokens",
-  "/api/v1/messages/route": "/api/v1/messages",
   "/api/v1/models/[kind]/route": "/api/v1/models/[kind]",
   "/api/v1/models/info/route": "/api/v1/models/info",
   "/api/v1/models/route": "/api/v1/models",
-  "/api/v1/responses/compact/route": "/api/v1/responses/compact",
-  "/api/v1/responses/route": "/api/v1/responses",
   "/api/v1/route": "/api/v1",
   "/api/v1/search/route": "/api/v1/search",
   "/api/v1/videos/[id]/route": "/api/v1/videos/[id]",
@@ -98,7 +93,6 @@
   "/api/v1/videos/extensions/route": "/api/v1/videos/extensions",
   "/api/v1/videos/generations/route": "/api/v1/videos/generations",
   "/api/v1/web/fetch/route": "/api/v1/web/fetch",
-  "/api/v1beta/models/[...path]/route": "/api/v1beta/models/[...path]",
   "/api/v1beta/models/route": "/api/v1beta/models",
   "/api/version/shutdown/route": "/api/version/shutdown",
   "/api/version/update/route": "/api/version/update",
@@ -126,18 +120,18 @@
   "/api/oauth/[provider]/[action]/route": "/api/oauth/[provider]/[action]",
   "/api/provider-nodes/route": "/api/provider-nodes",
   "/api/providers/[id]/route": "/api/providers/[id]",
-  "/api/providers/client/route": "/api/providers/client",
   "/api/providers/health/route": "/api/providers/health",
-  "/api/providers/[id]/models/route": "/api/providers/[id]/models",
+  "/api/providers/client/route": "/api/providers/client",
   "/api/providers/suggested-models/route": "/api/providers/suggested-models",
   "/api/providers/route": "/api/providers",
+  "/api/providers/[id]/models/route": "/api/providers/[id]/models",
   "/api/providers/zenith/log/route": "/api/providers/zenith/log",
+  "/api/providers/zenith/route": "/api/providers/zenith",
   "/api/proxy-pools/[id]/route": "/api/proxy-pools/[id]",
   "/api/proxy-pools/[id]/test/route": "/api/proxy-pools/[id]/test",
   "/api/proxy-pools/cloudflare-deploy/route": "/api/proxy-pools/cloudflare-deploy",
-  "/api/providers/zenith/route": "/api/providers/zenith",
-  "/api/proxy-pools/deno-deploy/route": "/api/proxy-pools/deno-deploy",
   "/api/proxy-pools/route": "/api/proxy-pools",
+  "/api/proxy-pools/deno-deploy/route": "/api/proxy-pools/deno-deploy",
   "/api/proxy-pools/vercel-deploy/route": "/api/proxy-pools/vercel-deploy",
   "/api/pxpipe/health/route": "/api/pxpipe/health",
   "/api/pxpipe/install/route": "/api/pxpipe/install",
@@ -150,13 +144,20 @@
   "/api/settings/database/route": "/api/settings/database",
   "/api/settings/environment/route": "/api/settings/environment",
   "/api/settings/proxy-test/route": "/api/settings/proxy-test",
+  "/api/settings/presidio/route": "/api/settings/presidio",
   "/api/settings/route": "/api/settings",
   "/api/translator/console-logs/stream/route": "/api/translator/console-logs/stream",
   "/api/usage/[connectionId]/route": "/api/usage/[connectionId]",
   "/api/usage/stats/route": "/api/usage/stats",
   "/api/usage/stream/route": "/api/usage/stream",
+  "/api/v1/api/chat/route": "/api/v1/api/chat",
   "/api/v1/audio/transcriptions/route": "/api/v1/audio/transcriptions",
+  "/api/v1/chat/completions/route": "/api/v1/chat/completions",
+  "/api/v1/messages/route": "/api/v1/messages",
+  "/api/v1/responses/compact/route": "/api/v1/responses/compact",
+  "/api/v1/responses/route": "/api/v1/responses",
   "/api/version/route": "/api/version",
+  "/api/v1beta/models/[...path]/route": "/api/v1beta/models/[...path]",
   "/callback/page": "/callback",
   "/dashboard/settings/pricing/page": "/dashboard/settings/pricing",
   "/landing/page": "/landing",
@@ -182,8 +183,9 @@
   "/(dashboard)/dashboard/translator/page": "/dashboard/translator",
   "/(dashboard)/dashboard/usage/page": "/dashboard/usage",
   "/(dashboard)/dashboard/console-log/page": "/dashboard/console-log",
-  "/(dashboard)/dashboard/providers/page": "/dashboard/providers",
+  "/(dashboard)/dashboard/presidio/page": "/dashboard/presidio",
   "/(dashboard)/dashboard/profile/page": "/dashboard/profile",
   "/(dashboard)/dashboard/providers/[id]/page": "/dashboard/providers/[id]",
+  "/(dashboard)/dashboard/providers/page": "/dashboard/providers",
   "/(dashboard)/dashboard/proxy-pools/page": "/dashboard/proxy-pools"
 }

package/app/.next-cli-build/build-manifest.json

@@ -4,8 +4,8 @@
   ],
   "devFiles": [],
   "lowPriorityFiles": [
-    "static/p4jE6g-j-05K8E74ySO-I/_buildManifest.js",
-    "static/p4jE6g-j-05K8E74ySO-I/_ssgManifest.js"
+    "static/alT51K3CdFyFBv27IY7wb/_buildManifest.js",
+    "static/alT51K3CdFyFBv27IY7wb/_ssgManifest.js"
   ],
   "rootMainFiles": [
     "static/chunks/webpack-53609978799ebbca.js",

package/app/.next-cli-build/prerender-manifest.json

@@ -118,7 +118,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 26387,
+      "htmlSize": 27733,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -146,7 +146,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 28971,
+      "htmlSize": 30269,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -174,7 +174,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 28925,
+      "htmlSize": 30271,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -202,7 +202,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 27119,
+      "htmlSize": 28465,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -230,7 +230,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 26902,
+      "htmlSize": 28248,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -258,7 +258,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 26696,
+      "htmlSize": 27994,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -286,7 +286,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 44621,
+      "htmlSize": 45967,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -314,7 +314,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 34197,
+      "htmlSize": 35413,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -338,11 +338,39 @@
         "x-next-revalidate-tag-token"
       ]
     },
+    "/dashboard/presidio": {
+      "routeType": "page",
+      "response": "complete",
+      "compute": "static",
+      "htmlSize": 27793,
+      "experimentalBypassFor": [
+        {
+          "type": "header",
+          "key": "next-action"
+        },
+        {
+          "type": "header",
+          "key": "content-type",
+          "value": "multipart/form-data;.*"
+        }
+      ],
+      "initialRevalidateSeconds": false,
+      "srcRoute": "/dashboard/presidio",
+      "dataRoute": "/dashboard/presidio.rsc",
+      "allowHeader": [
+        "host",
+        "x-matched-path",
+        "x-prerender-revalidate",
+        "x-prerender-revalidate-if-generated",
+        "x-next-revalidated-tags",
+        "x-next-revalidate-tag-token"
+      ]
+    },
     "/dashboard/profile": {
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 42754,
+      "htmlSize": 44100,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -370,7 +398,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 27010,
+      "htmlSize": 28356,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -398,7 +426,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 36098,
+      "htmlSize": 37444,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -426,7 +454,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 27069,
+      "htmlSize": 28415,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -454,7 +482,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 30900,
+      "htmlSize": 32198,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -482,7 +510,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 33351,
+      "htmlSize": 34697,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -538,7 +566,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 39539,
+      "htmlSize": 40885,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -566,7 +594,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 30062,
+      "htmlSize": 31408,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -594,7 +622,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 35973,
+      "htmlSize": 37319,
       "experimentalBypassFor": [
         {
           "type": "header",
@@ -622,7 +650,7 @@
       "routeType": "page",
       "response": "complete",
       "compute": "static",
-      "htmlSize": 26619,
+      "htmlSize": 27965,
       "experimentalBypassFor": [
         {
           "type": "header",

package/app/.next-cli-build/routes-manifest.json

@@ -780,6 +780,12 @@
       "routeKeys": {},
       "namedRegex": "^/api/settings/environment(?:/)?$"
     },
+    {
+      "page": "/api/settings/presidio",
+      "regex": "^/api/settings/presidio(?:/)?$",
+      "routeKeys": {},
+      "namedRegex": "^/api/settings/presidio(?:/)?$"
+    },
     {
       "page": "/api/settings/proxy-test",
       "regex": "^/api/settings/proxy\\-test(?:/)?$",
@@ -1128,6 +1134,12 @@
       "routeKeys": {},
       "namedRegex": "^/dashboard/mitm(?:/)?$"
     },
+    {
+      "page": "/dashboard/presidio",
+      "regex": "^/dashboard/presidio(?:/)?$",
+      "routeKeys": {},
+      "namedRegex": "^/dashboard/presidio(?:/)?$"
+    },
     {
       "page": "/dashboard/profile",
       "regex": "^/dashboard/profile(?:/)?$",