Priority 90 — runs before Compaction@100 and Memory@150.
Detects and replaces company names, money amounts, phone numbers,
emails, and ID card numbers with deterministic tokens (__ENTITY_N__).
External callers can restore originals via DataMasker::unmask().
Security Configuration:
- config/security.toml with shell_exec, file_read, file_write, web_fetch, browser, and mcp settings
- Command whitelist/blacklist for shell execution
- Path restrictions for file operations
- SSRF protection for web fetch
Tool Security Implementation:
- ShellSecurityConfig with whitelist/blacklist validation
- ShellExecTool with actual command execution
- Timeout and output size limits
- Security checks before command execution
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add StreamChunk and StreamEvent types for Tauri event emission
- Add stream() method to LlmDriver trait with async-stream
- Implement Anthropic streaming with SSE parsing
- Implement OpenAI streaming with SSE parsing
- Add placeholder stream() for Gemini and Local drivers
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
