shroud-privacy 2.2.1 → 2.2.3

package/README.md

@@ -183,7 +183,6 @@ To enable proof hashes and fake samples for deeper audit:
 | `auditHashSalt` | string | `""` | Salt for proof hashes |
 | `auditHashTruncate` | number | `12` | Truncate proof hashes to N hex chars |
 | `auditMaxFakesSample` | number | `0` | Include up to N fake values in audit (0 = off) |
-| `logMappings` | boolean | `false` | Log mapping table (debug only) |
 | `customPatterns` | array | `[]` | User-defined regex detection patterns |
 | `detectorOverrides` | object | `{}` | Override built-in rules: disable or change confidence per rule name |
 | `maxToolDepth` | number | `10` | Max nested tool call depth before warning |
@@ -299,6 +298,7 @@ Shroud includes a `ContextDetector` that wraps the regex engine with post-detect
 - **Hostname propagation**: `hostname FCNETR1` in one place → bare `FCNETR1` detected everywhere in the text.
 - **Learned entities**: Hostnames and infra identifiers seen in previous messages are remembered and detected in future messages without requiring config-line context.
 - **Documentation filtering**: RFC 5737 TEST-NET IPs (192.0.2.x, 198.51.100.x, 203.0.113.x), RFC 3849 IPv6 doc prefix (`2001:db8::/32`), IPv6 loopback (`::1`), `example.com` emails, and well-known placeholders are automatically skipped.
+- **Public URL filtering**: URLs pointing to well-known public platforms (YouTube, GitHub, Wikipedia, Google, Reddit, Stack Overflow, npm, PyPI, Docker Hub, etc.) are never obfuscated — they aren't PII. Emails at these domains are still detected.
 - **Common word decay**: Words like `permit`, `deny`, `default` that happen to match patterns get 50% confidence reduction.
 - **Recursive deobfuscation**: Up to 3 passes for nested structures (fakes inside JSON-encoded strings).
 - **Subnet-aware deobfuscation**: When an LLM derives network/broadcast addresses from fake host IPs (e.g., computing `.0` or `.255`), Shroud reverse-maps them via the SubnetMapper. Works for both CGNAT (IPv4) and ULA (IPv6) fake ranges, including LLM-compressed IPv6 forms.
@@ -452,7 +452,7 @@ Supports context manager, auto-restart on crash, residual fake detection, and ho
 
 ```bash
 npm install
-npm test          # run vitest (718 tests)
+npm test          # run vitest (777 tests)
 npm run build     # compile TypeScript
 npm run lint      # type-check without emitting
 ```

package/dist/detectors/regex.js

@@ -24,6 +24,24 @@ const DOC_DOMAINS = new Set([
     "example.com", "example.net", "example.org", // RFC 2606
     "localhost", "invalid",
 ]);
+/** Well-known public domains whose URLs are never PII. */
+const PUBLIC_DOMAINS = new Set([
+    "youtube.com", "youtu.be", "m.youtube.com",
+    "google.com", "google.co.uk", "google.de", "google.fr",
+    "github.com", "gitlab.com", "bitbucket.org",
+    "stackoverflow.com", "stackexchange.com",
+    "wikipedia.org", "wikimedia.org",
+    "twitter.com", "x.com",
+    "reddit.com",
+    "linkedin.com",
+    "medium.com",
+    "npmjs.com", "pypi.org", "crates.io",
+    "docker.com", "hub.docker.com",
+    "microsoft.com", "apple.com",
+    "mozilla.org",
+    "w3.org",
+    "archive.org",
+]);
 const DOC_HOSTNAMES = new Set([
     "localhost", "HOSTNAME", "EXAMPLE", "CHANGEME",
     "YOUR_HOST", "YOURHOST", "hostname", "example",
@@ -73,6 +91,14 @@ export function isDocExample(value, category) {
                     return true;
                 }
             }
+            // Public domains — skip for URLs only (emails @youtube.com are still PII)
+            if (category === Category.URL) {
+                for (const d of PUBLIC_DOMAINS) {
+                    if (lower.includes(`//${d}`) || lower.includes(`//${d}/`) || lower.includes(`.${d}`)) {
+                        return true;
+                    }
+                }
+            }
             return false;
         }
         case Category.BGP_ASN:

package/dist/hooks.js

@@ -182,6 +182,7 @@ export function registerHooks(api, obfuscator) {
         text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
         return text;
     }
+    const isFirstLoad = !globalThis.__shroudObfuscator;
     if (!IS_TEST) {
         const g = globalThis;
         if (g.__shroudObfuscator) {
@@ -618,7 +619,6 @@ export function registerHooks(api, obfuscator) {
         }
         return event;
     };
-    api.logger?.info("[shroud] Installed global streaming deobfuscation hook");
     // -----------------------------------------------------------------------
     // 7. Global deobfuscation hook for channel delivery (defense-in-depth).
     //    Primary deobfuscation happens in the fetch response interceptor (8).
@@ -630,7 +630,6 @@ export function registerHooks(api, obfuscator) {
             return text;
         return ob().deobfuscate(text);
     };
-    api.logger?.info("[shroud] Registered globalThis.__shroudDeobfuscate for channel delivery");
     // -----------------------------------------------------------------------
     // 8. Fetch intercept — the universal privacy boundary.
     //
@@ -658,7 +657,6 @@ export function registerHooks(api, obfuscator) {
         "/v1/models/", // Google Vertex AI
     ];
     const originalFetch = globalThis.fetch;
-    api.logger?.info(`[shroud][fetch-guard] hasFetch=${!!originalFetch} patched=${!!globalThis.__shroudFetchPatched}`);
     if (originalFetch && !(globalThis.__shroudFetchPatched)) {
         globalThis.__shroudFetchPatched = true;
         globalThis.fetch = async function shroudFetchInterceptor(input, init) {
@@ -1124,6 +1122,5 @@ export function registerHooks(api, obfuscator) {
             }
             return response;
         }
-        api.logger?.info("[shroud] Installed outbound fetch intercept — PII obfuscated before ALL LLM API calls");
     }
 }

package/dist/index.js

@@ -87,18 +87,14 @@ function patchEventStreamPrototype(logger) {
                 // Try requiring from the file's own directory (no exports restriction from parent)
                 const mod = localRequire("./event-stream.js");
                 EventStream = mod?.EventStream ?? mod?.default?.EventStream;
-                if (EventStream) {
-                    logger?.info(`[shroud] Found EventStream via direct file path: ${candidate}`);
+                if (EventStream)
                     break;
-                }
             }
             catch { /* try next */ }
         }
     }
-    if (!EventStream?.prototype?.push) {
-        logger?.info("[shroud] Could not locate EventStream class — streaming deobfuscation unavailable");
+    if (!EventStream?.prototype?.push)
         return;
-    }
     // Wrap prototype.push with the deobfuscation hook
     const originalPush = EventStream.prototype.push;
     EventStream.prototype.push = function shroudPatchedPush(event) {
@@ -110,7 +106,6 @@ function patchEventStreamPrototype(logger) {
     };
     // Mark as patched to prevent double-wrapping
     globalThis[PATCH_MARKER] = true;
-    logger?.info("[shroud] Patched EventStream.prototype.push — zero-file streaming deobfuscation active");
 }
 export default {
     id: "shroud-privacy",
@@ -160,6 +155,11 @@ export default {
                 };
             },
         });
-        api.logger?.info("[shroud] Plugin loaded — native TypeScript, no proxy required.");
+        // Single load confirmation — used by test harness to verify plugin loaded.
+        // Only logs once per process (suppressed on subsequent agent loads).
+        if (!globalThis.__shroudLoadLogged) {
+            globalThis.__shroudLoadLogged = true;
+            api.logger?.info("[shroud] Plugin loaded.");
+        }
     },
 };

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",
@@ -21,7 +21,6 @@
       "auditHashSalt": { "type": "string", "default": "", "description": "Salt for proof hashes" },
       "auditHashTruncate": { "type": "integer", "default": 12, "minimum": 4, "maximum": 64, "description": "Truncate proof hashes to N hex chars" },
       "auditMaxFakesSample": { "type": "integer", "default": 0, "minimum": 0, "maximum": 20, "description": "Include up to N fake replacement values in audit log (0 = disabled)" },
-      "logMappings": { "type": "boolean", "default": false, "description": "Log mapping table (debug only)" },
       "detectorOverrides": {
         "type": "object",
         "additionalProperties": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Privacy obfuscation for AI agents — detects PII and replaces with deterministic fake values before anything reaches the LLM. Works with OpenClaw (plugin) or any agent (APP protocol).",
   "type": "module",
   "main": "dist/index.js",