feat(hooks)!: engine-agnostic plugin contract + semantic-PII/secrets redaction (#275) - #295

Merged

illeatmyhat merged 20 commits into

mainfrom

feat/275-readi-semantic-pii

Jul 24, 2026

Commits on Jul 20, 2026

build(pii): add [readi] and [bench] extras

illeatmyhat
and
claude
committed
1f7b4ed
feat(pii): READI semantic redaction as a hook-seam plugin (#275)

illeatmyhat
and
claude
committed
81ecd48
feat(pii): effectiveness benchmark for regex vs semantic redaction

illeatmyhat
and
claude
committed
347cb2e
test(pii): cover the READI core, shim and payload contract

illeatmyhat
and
claude
committed
b8c2bcb
docs(pii): regex vs semantic guide and YAML switch example

illeatmyhat
and
claude
committed
faa5c2f

Commits on Jul 21, 2026

fix(pii): drop out-of-range spans after clamping in redact_spans

illeatmyhat
and
claude
committed
8166c6e
fix(pii): redact PII in tool_calls and other non-content message fields

illeatmyhat
and
claude
committed
f73ba01
refactor(pii)!: rename extras by method (pii-regex/pii-semantic); align metadata default

illeatmyhat
and
claude
committed
23301c2
docs(pii): note the benchmark value-leak metric is a lower bound

illeatmyhat
and
claude
committed
30267db
feat(hooks)!: always-on seam with fail-closed engine/detector errors

illeatmyhat
and
claude
committed
24cdb93
feat(cli): add `evolve hooks init` + config auto-discovery

illeatmyhat
and
claude
committed
1baa641
docs(hooks): document always-on seam, discovery, and `hooks init`

illeatmyhat
and
claude
committed
09e44c0

Commits on Jul 22, 2026

fix(hooks): code-first plugins suppress config discovery

illeatmyhat
and
claude
committed
274627b

Commits on Jul 23, 2026

merge: bring main (retention #294) into feat/275-readi-semantic-pii; keep always-on hooks
illeatmyhat
committed
7786c3f
refactor(hooks)!: remove deprecated enabled field

illeatmyhat
and
claude
committed
8607c98
fix(cli): stop rich from mangling extras in hooks init output

illeatmyhat
and
claude
committed
e0f50a7
refactor(hooks)!: decouple hook plugins from cpex via native contract + adapter

illeatmyhat
and
claude
committed
5af6581
fix(hooks): default YAML-omitted plugin mode to sequential (fail-closed)

illeatmyhat
and
claude
committed
5f75a7b
feat(hooks): add SecretsFilterMemoryPlugin — structured-secrets redaction

illeatmyhat
and
claude
committed
73910dc
refactor(hooks): make SecretsFilterMemoryPlugin native, not raw-cpex

illeatmyhat
and
claude
committed
7833816