Replace RegexPiiGuard with RedactWire; clear PII messaging; 0.4.0#39
Merged
Conversation
Swap the built-in 4-pattern RegexPiiGuard for RedactWire (sister project): invariant rules (email, credit card, IP, IBAN) + secret/credential detection, running against the default culture (CultureInfo.CurrentCulture). - Add RedactWire 0.3.0 PackageReference to BotWire.Core. - PiiGuardOptions gains ConfigureDetector (Action<PiiDetectorBuilder>) for full RedactWire customization (cultures, custom IPiiRule, overlap strategy). - AdditionalPatterns retained (no breaking change), bridged to RedactWire custom rules via TimeoutRegexRule, which compiles each user regex with a 100ms match timeout to bound ReDoS; on timeout it logs and degrades to no-match. - Check() reports the earliest in-text match and short-circuits blank input. Note: PiiGuardOptions now exposes RedactWire's PiiDetectorBuilder, so RedactWire (and System.Text.Json transitively) is a public dependency of BotWire.Core. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
0.4.0 moves JSON/XML/object scanning into the RedactWire.Structured add-on, so the base package no longer pulls System.Text.Json. BotWire.Core uses only string detection, so no code change is needed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A blocked message used to surface the widget's generic "Something went wrong" instead of the configured PII rejection, so users had no idea why their message was refused. Make the PII rejection legible end to end: - Server: PII blocks return a distinct "PiiBlocked" status (carrying the configurable PiiGuardOptions.RejectionMessage), so clients can tell a PII refusal apart from a generic failure. - Prompt-injection blocks no longer reuse the PII copy; they get their own neutral PromptInjectionOptions.RejectionMessage. - Widget + RedisShop sample: surface the server's message for guard rejections (PiiBlocked / Blocked / RateLimited) instead of the generic error. The sample duck-types on status so it holds across botwire-js versions. - Widget.js endpoint: serve with no-cache + a content-hash ETag instead of a one-hour max-age, so a rebuilt widget reaches browsers immediately (304 when unchanged). This long cache was why the fix appeared not to take effect. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Release no longer fires on tag push; it runs solely via workflow_dispatch with a required `tag` input. Every job resolves REF_NAME from that input, checks out the tag, and the GitHub Release step is re-run-safe (upload --clobber if it exists). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
VersionPrefix (all .NET packages) and botwire-js package.json to 0.4.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces the built-in 4-pattern
RegexPiiGuardwith RedactWire (sister project), and makes a blocked message tell the user why it was refused instead of a generic error. Bumps BotWire to 0.4.0.PII detection (RedactWire)
BotWire.Corenow backs PII detection with RedactWire 0.4.0: invariant rules (email, credit card, IP, IBAN) + secret/credential detection, against the default culture.PiiGuardOptionskeepsEnabled+RejectionMessage, keepsAdditionalPatterns(no breaking change) — bridged to RedactWire custom rules via aTimeoutRegexRulethat compiles each user regex with a 100ms match timeout to bound ReDoS — and addsConfigureDetector(Action<PiiDetectorBuilder>) for full RedactWire customization (cultures, custom rules, overlap strategy).System.Text.Json(structured scanning moved to an add-on), so no net-new transitive dep onBotWire.Core.Clear PII messaging
A blocked message previously showed the widget's generic "Something went wrong" and dropped the configured PII rejection. Now legible end to end:
PiiBlockedstatus carrying the configurableRejectionMessage.PromptInjectionOptions.RejectionMessage.PiiBlocked/Blocked/RateLimited).widget.jsendpoint now usesno-cache+ content-hash ETag instead of a one-hourmax-age— a rebuilt widget reaches browsers immediately (was masking the fix).Release / versioning
workflow_dispatchwith ataginput); no longer fires on tag push.VersionPrefix(all .NET packages) andbotwire-js.Note (public API)
PiiGuardOptions.ConfigureDetectorexposes RedactWire'sPiiDetectorBuilder, so RedactWire is a deliberate public dependency ofBotWire.Core.Tests
All green: Core 255, AspNetCore 27, Integration 9, Redis 19, Email 22, npm 30. Added coverage for the RedactWire guard, ReDoS timeout,
PiiBlockedrendering, and widget.js ETag revalidation.🤖 Generated with Claude Code