feat(llm): reversible anonymizer at the LLM boundary

[maxie7]

What

Escalating an event sends the trigger line, the ring-buffer context, the template and the source name to the configured LLM endpoint — verbatim. Against a local Ollama nothing leaves the machine, which is why this was never a v1 blocker; the moment --llm-url points at a hosted provider, real production logs (IPs, emails, tokens, hostnames, home paths) go over the wire in the clear.

This adds an opt-in, reversible anonymizer at that boundary. Default off — with the flag absent the outgoing payload is byte-for-byte what it was before.

How

A decorator Backend (internal/llm/anonymizing.go) wraps the OpenAI-compatible backend and is constructed only when --llm-anonymize is on. It masks on the way out and restores on the way in, so the pipeline, the template state and the TUI keep the real values — you are triaging your own system in your own terminal.

The masker itself (internal/anonymize) is a pure package with no llm dependency, deliberately kept separate from the pipeline's template masker: the two mask for different reasons and change for different reasons.

• Type-tagged placeholders — <IP_1>, <EMAIL_1>, <TOKEN_1>, <HOST_1>, <UUID_1>, <USER_1>. The tag is load-bearing: the model needs to know "this is an IP" to suggest anything useful, so a generic <REDACTED> would gut the explanation. The same value maps to the same placeholder within a request.
• One mapper per request, in memory only — never persisted, never shared, discarded once the response is restored.
• Detectors run specific → general: JWT → AWS key → Bearer/sk- → URL and connection-string credentials → email → UUID → IPv6 → IPv4 → URL-authority host → bare infra host → home-directory username. An email contains a host, a URL contains a host and possibly credentials, an IP is digits and dots — the order decides who wins.
• Fail-closed: if masking errors, the escalation is skipped and the card is marked explanation-unavailable. It never falls through to sending the raw payload.
• Startup notice when --llm-url is non-local and masking is off: to stderr in --plain, and to the status bar in the TUI, where the alternate screen would otherwise wipe it.

Two deliberately narrow choices

Bare hostnames are masked only on private/infra suffixes (internal, local, lan, corp, svc, …), not on public TLDs. Go panics are full of github.com/..., golang.org/x/..., go.uber.org/zap, and since multiline grouping a whole goroutine dump is a single escalation — masking those would degrade the explanation for no privacy gain. The sensitivity lives in db-01.acme.internal, not in github.com. Hosts inside URLs, emails and connection strings are masked regardless of suffix.

Home paths mask only the username segment — /home/<USER_1>/go/pkg/mod/... — because blanking the whole path would gut every Go stack frame.

A leak found in manual wire testing

The first implementation masked the trigger line correctly but leaked secret fragments through the Template field. The template reaches the anonymizer after the pipeline masker has rewritten it, so a secret arrives shape-broken — sk-abcdefghij0123456789XYZ as sk-abcdefghij<NUM>XYZ — and detectors anchored on an unbroken run of [A-Za-z0-9] missed it. The same applies to AWS keys and JWTs: a class of bug, not one regex.

Fixed in 23fb180: the four prefix-anchored secret detectors now treat a pipeline placeholder as another character of the token run. The tests feed real pipeline.Templatize output rather than hand-written mangled strings, since the coupling between the two maskers is what caused the bug in the first place.

Not a guarantee

The README says so plainly. Free-text logs can contain anything, so this is best-effort risk reduction. Two known gaps are documented rather than hidden: a bare public hostname in prose is not masked, and one value can pick up two placeholders (one from the raw line, one from the pre-masked template) — cosmetic, not a leak.

Verification

• gofmt, go vet, golangci-lint (0 issues), go test ./..., go test -race ./..., go build ./... — all green.
• The headline test asserts on the bytes the fake provider actually received, not on the anonymizer's return value.
• Manual wire test: with the flag on, a line carrying an IP, email, sk- token, AWS key, JWT, infra hostname and home path produces a request body containing none of those literals; the same run without the flag shows all of them.