Summary

Add a Privacy Shield layer that scans and redacts PII (Personally Identifiable Information) from the agent's outbound responses before they are sent to chat channels.

Motivation

This is specifically designed to combat Prompt Injection attacks. While the model needs access to sensitive info in its context to be helpful, we want to prevent that info from being "leaked" to external chat channels if the model is tricked or "hallucinates" private data into its output.

Features

• Output Interception: Intercepts messages at the final delivery stage (e.g., Telegram, Discord).
• Preserves Model Intelligence: Input context remains unscrubbed so the model stays smart.
• Default PII Redaction: Automatically masks Emails, Phone numbers, Credit Card numbers, and IPv4 addresses.
• Configurable: Users can enable/disable this feature via security.privacy.piiScrubbing.
• Custom Patterns: Users can provide their own regex patterns for additional redaction.

Configuration Example

{
  "security": {
    "privacy": {
      "piiScrubbing": "on",
      "piiPatterns": ["\\bsecret-project-code\\b"]
    }
  }
}

Behavior Changes

Files Changed

• src/infra/privacy.ts: Core PII scrubbing logic.
• src/infra/outbound/deliver.ts: Integration into the outbound delivery pipeline.
• src/config/types.security.ts: New security configuration types.
• src/config/zod-schema.ts: Configuration schema validation.

AI-Assisted Contribution 🤖

• AI-assisted (Claude)
• Focused on Prompt Injection defense
• Tested output scrubbing locally

lobster-biscuit

Greptile Overview

Greptile Summary

This PR introduces a “Privacy Shield” that redacts PII from agent context before sending it to LLMs. It adds a new security.privacy config section (types + Zod schema), implements PII scrubbing utilities in src/infra/privacy.ts, and integrates scrubbing into the embedded runner by applying it to the generated system prompt and to the limited message history before calling replaceMessages().

Key integration points are in src/agents/pi-embedded-runner/run/attempt.ts, where the system prompt override is scrubbed and the session history is scrubbed after validation/limiting.

Confidence Score: 3/5

• This PR is close, but there is a type-safety regression at a core integration point that should be fixed before merging.
• The config/type additions and integration look straightforward, but scrubPIIInMessages() returns unknown[] and is fed into replaceMessages(), which is intended to operate on AgentMessage[]. That’s either a TS compile break or a loss of guarantees in the message pipeline. Once the scrubber is typed to preserve AgentMessage shapes, the remaining changes appear low-risk.
• src/agents/pi-embedded-runner/run/attempt.ts, src/infra/privacy.ts