v0.2.0

Breaking: placeholder format changed. Placeholders are now keyed hashes, [[TYPE_<8 hex>]] (for example [[EMAIL_3f9a2c1d]]), not per-session ordinals ([[EMAIL_1]]). Placeholders from 0.1.0 do not carry over.

Changed

• Placeholders stay the same across sessions and restarts: HMAC-SHA256 over type + normalized value, keyed with a per-install secret at $DSH_HOME/pii-anonymizer.key (mode 0600, created on first use). No value table is kept, and the plugin writes nothing raw to disk.

Added

• Every message entering a step is anonymized (agent/pre-step): runtime-context snapshots (for example a memory index), workspace instructions, recall and relay messages.
• Tool results are anonymized (tools/post-execute). Turn this off with toolResults: false.
• System-prompt sections, contexts and string variables are anonymized (system-prompt/assemble). Turn this off with systemPrompt: false.

Fixed

• README claims are corrected: only what is sent to the provider is rewritten, and local storage keeps raw values. A new "What is and is not covered" section lists the limits.

Known gaps

Not rewritten: a complete: true system-prompt section, tool schemas, tool outcomes finalized without post-execute (cancellations, pipeline failures, finalizeContent), PII the detectors cannot recognize, model output, and requests other plugins make outside the agent loop.

Full details: CHANGELOG.md