From 34fafaefda9c8040379090e4629c7b29f7c7f06e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 15 Sep 2026 23:15:42 +0000
Subject: [PATCH] Fix auto-detect false positives for configured values inside
 compound matches

Home path, shell prompt, git remote, and env var assignment patterns match
a compound string (e.g. "/home/johnsmith") that only *contains* a configured
identity/mapping value ("johnsmith"), not equals it. The exact-match
configured.has() check never recognized these as already handled, so the
"potential PII" warning fired on every message containing one of these
shapes regardless of configuration, and the fallback auto-redact step
overwrote already-substituted text with a generic placeholder.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3nGKyoLaRghi1okiNyRKD
---
 src/content/content.js | 18 +++++++++++++++++-
 src/lib/auto-detect.js | 18 +++++++++++++++++-
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/src/content/content.js b/src/content/content.js
index 2626424..d6ca4e6 100644
--- a/src/content/content.js
+++ b/src/content/content.js
@@ -349,6 +349,22 @@
 
   const CONTEXT_WORDS_RE = /\b(?:born|birthday|dob|birth|passport|license|driver|ssn|social\s*security|address|zip|postal|date\s+of\s+birth)\b/i;
 
+  // Some patterns (home paths, shell prompts, git remotes, env var assignments)
+  // match a compound string that only *contains* a configured value rather
+  // than equaling it exactly (e.g. "/home/johnsmith" contains the configured
+  // username "johnsmith"). A plain Set.has() exact-match check never fires
+  // for these, so the same configured value gets flagged as "unconfigured"
+  // every time. Length-gated to avoid short tokens suppressing unrelated
+  // findings via accidental substring collision.
+  function matchesConfiguredValue(value, configured) {
+    const lower = value.toLowerCase();
+    if (configured.has(lower)) return true;
+    for (const c of configured) {
+      if (c.length >= 3 && lower.includes(c)) return true;
+    }
+    return false;
+  }
+
   // Common English words that are capitalized but aren't proper nouns.
   // Used by the proper noun heuristic to reduce false positives.
   const COMMON_CAPITALIZED = new Set([
@@ -487,7 +503,7 @@
       let m;
       while ((m = pat.re.exec(text)) !== null) {
         const val = m[0];
-        if (configured.has(val.toLowerCase())) continue;
+        if (matchesConfiguredValue(val, configured)) continue;
         if (pat.skip && pat.skip.test(val)) continue;
         findings.push({ name: pat.name, value: val, hint: pat.hint, category: pat.cat });
       }
diff --git a/src/lib/auto-detect.js b/src/lib/auto-detect.js
index d87f5af..85df83d 100644
--- a/src/lib/auto-detect.js
+++ b/src/lib/auto-detect.js
@@ -129,6 +129,22 @@ const PII_PATTERNS = [
 // Context words that make ambiguous patterns more likely to be PII
 const CONTEXT_WORDS = /\b(?:born|birthday|dob|birth|passport|license|driver|ssn|social\s*security|address|home|live|lives|reside|zip|postal)\b/i;
 
+// Some patterns (home paths, shell prompts, git remotes, env var assignments)
+// match a compound string that only *contains* a configured value rather than
+// equaling it exactly (e.g. "/home/johnsmith" contains the configured
+// username "johnsmith"). A plain Set.has() exact-match check never fires for
+// these, so the same configured value gets flagged as "unconfigured" every
+// time. Length-gated to avoid short tokens (e.g. a 2-char substitute)
+// suppressing unrelated findings via accidental substring collision.
+function matchesConfiguredValue(value, configured) {
+  const lower = value.toLowerCase();
+  if (configured.has(lower)) return true;
+  for (const c of configured) {
+    if (c.length >= 3 && lower.includes(c)) return true;
+  }
+  return false;
+}
+
 const AutoDetect = {
   /**
    * Scan text for potential unconfigured PII.
@@ -178,7 +194,7 @@ const AutoDetect = {
         const value = match[0];
 
         // Skip if already configured
-        if (configured.has(value.toLowerCase())) continue;
+        if (matchesConfiguredValue(value, configured)) continue;
 
         // Skip excluded values (like 127.0.0.1)
         if (pattern.exclude && pattern.exclude.test(value)) continue;