On-device sensitive-detail detection + redaction (pre-send)

[adilei]

⛔ DO NOT MERGE — work-in-progress checkpoint

Opened to capture in-progress work on on-device sensitive-detail detection + redaction so we can pick it up later. This branch does not typecheck and is not runnable as-is (see Current state). It is a design + partial-implementation snapshot, not a reviewable change.

Goal

Detect and auto-redact sensitive/problematic details (secrets, PII, names) on-device before Skill Recorder sends captured session data to GitHub Copilot on Analyze. Fully local, MIT-compatible, and non-blocking — Analyze never stops; flagged values are redacted in the outgoing text and reported as "Redacted N details".

Design (locked)

Three detection layers → one non-blocking redactor:

1. secretlint (@secretlint/core + preset-recommend + pattern rule) — provider secrets, always on. AWS ID scan enabled (enableIDScanRule: true); JWTs via a custom pattern rule.
2. In-repo regex (common/sensitive.ts) — structured PII: email, credit-card (Luhn), SSN, phone. Always on, renderer-safe.
3. Xenova/bert-base-NER (transformers.js, dtype q8 → model_quantized.onnx) — person/location/org. Opt-in "Advanced protection" toggle that downloads the model; never blocks Analyze (getPipelineForScan() returns null until cached).

Overlapping matches collapse via resolveOverlaps by rank (secrets 90 > structured-PII 40–55 > NER 30). UI report masks values (maskValue, 2+2 reveal); outgoing text is redacted with non-revealing ••••.

🚧 Why this is paused — architectural gap

get_frames sends screen JPEGs inline to the model, and the LLM extracts data directly from those images — we have no OCR. So text-only redaction can't touch a secret that's visible on screen: we'd mask the text while shipping a screenshot of the same secret. Text redaction still uniquely covers voice narration, clipboard, and unsampled/off-screen text, but the feature is incomplete for on-screen secrets.

Decision needed before resuming (any of):

• Add frame redaction: OCR each served frame (e.g. tesseract.js, Apache-2.0, offline) → run the same detectors → blur matched boxes with sharp (already a dep). ~1–3 s/frame CPU + one dep.
• Or scope the feature honestly to text channels only and strengthen the screenshot warning.
• Or drop it.

Current state

• ✅ common/sensitive.ts — rewritten to v2 core (types + masking + structured-PII + generalized resolveOverlaps). Detectors verified by hand.
• ✅ secretlint API fully grounded (config shape, message→category mapping, dummy-key allowlist, AWS ID-scan gating).
• ✅ NER model grounded (q8, enableCpuMemArena:false required under Electron).
• ⚠️ Downstream still v1 — electron/sensitive/scanner.ts, common/sensitive.test.ts, electron/sensitive/scanner.test.ts, src/SensitiveReview.tsx, and the IPC/UI wiring reference removed v1 symbols (scanText, shannonEntropy, high-entropy). 6 known tsc errors.
• Test fixtures were rewritten to runtime-constructed tokens (no literal secrets) to satisfy push protection.

Remaining work (bottom-up)

1. electron/sensitive/: secretlint-config.ts, secrets.ts, ner-model.ts, ner.ts, model-manager.ts (mirror electron/narration/{whisper,manager}.ts).
2. Rework scanner.ts → async scanSession(id, nerPipeline?) → { report, values[] } merging all 3 layers.
3. Thread a redact seam through describer/{describer,tools}.ts (wrap get_timeline/get_events/get_narration); remove the blocking gate in common/ipc.ts + electron/ipc.ts; wire SensitiveModelManager + sensitive IPC channels in main.ts/preload.cjs.
4. UI: non-blocking "Redacted N details" banner + "Advanced protection" opt-in toggle + status HUD (SensitiveReview.tsx, Library.tsx, App.css).
5. Evals (requested): evals/sensitive/{corpus,score,run}.ts — LLM-free detection precision/recall + redaction leak-check; NER cases gated on cache.
6. Compliance: npm run compliance:prepare for new MIT deps + THIRD-PARTY notices; attribute bert-base-NER. Review the secretlint transitive npm audit findings.
7. Resolve the frames/OCR decision above.

How to resume

common/sensitive.ts is the source of truth for the v2 core. Implement the electron/sensitive/* modules, then flip the scanner + tests + UI off the v1 symbols until npm run typecheck and npm test pass. Detailed design notes and grounded API facts live in the session's plan doc.

Co-authored-by: Copilot