Harden the core privacy guarantee:
- Add `strict` mode (default true): after detection, verify no mapped value
survives as a whole token in the output (ignoring placeholders, whose context
may legitimately echo a value like `B+`). Catches a model that redacts one
mention of a value but leaves another in clear — which the placeholder/mapping
bijection check missed. Fail-closed: throws AnonymizationError naming only the
non-secret placeholder key, and runs on the final result so it is not swallowed
into the regex fallback (which can't fix a name leak). Set strict:false to opt out.
- Add `prefilter` option (default true): decouple the PII pre-filter from the
presence of a regex fallback. Set false to always consult the LLM while keeping
the fallback for LLM failures (max recall + graceful degradation).
- Boundary-aware value substitution: applyKnown and the leak check now match
values only as whole tokens (Unicode letter/digit boundaries, regex-escaped),
so "Ann" no longer replaces inside "Anna" and "jean@x.ch" no longer matches
inside "jean@x.church"; accented/non-Latin names preserved.
- deanonymize restores longest placeholder keys first (prefix-overlap defense).
Restructures anonymize/anonymizeChunks/anonymizeTurn to a single exit so the
leak check runs once on the final result. Behavior is unchanged for callers that
were already leak-free.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
7fb76e89f6