fix: honor default mask strategy in rust pii filter (#23)

* fix: honor default mask strategy in rust pii filter

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: format rust pii filter sources

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: inherit default mask strategy for custom patterns

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: normalize generated pii filter stubs

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: stabilize generated stub newlines

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: handle none mask strategy in model configs

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: validate pii filter mask strategy configs

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix: bump pii_filter to 0.2.1

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* test: update pii filter release-info kind check

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix(pii_filter): add payload clone regression coverage

Signed-off-by: lucarlig <luca.carlig@ibm.com>

* fix(pii_filter): isolate prompt post-fetch payloads

Signed-off-by: lucarlig <luca.carlig@ibm.com>

---------

Signed-off-by: lucarlig <luca.carlig@ibm.com>

Author: lucarlig

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "pii_filter"
-version = "0.2.0"
+version = "0.2.1"
 edition.workspace = true
 authors.workspace = true
 license.workspace = true

plugins/rust/python-package/pii_filter/Cargo.toml

@@ -5,7 +5,7 @@ High-performance PII detection and masking library for ContextForge.
 ## Features
 
 - Detects 12+ PII types (SSN, email, credit cards, phone numbers, and more)
-- Built-in detectors default to `redact` masking
+- Built-in detectors follow `default_mask_strategy` and default to `redact`
 - Multiple masking strategies (redact, partial, hash, tokenize, remove)
 - Parallel regex matching with RegexSet (5-10x faster than Python)
 - Zero-copy operations for nested JSON/dict traversal
@@ -28,8 +28,12 @@ The Python plugin requires the compiled Rust extension and uses it for all detec
 
 Version `0.2.0` intentionally changes the built-in default masking policy from partial masking to `redact`. Set `default_mask_strategy: "partial"` explicitly if you need the previous behavior.
 
+Version `0.2.1` changes custom-pattern inheritance: when `custom_patterns[].mask_strategy` is omitted or set to `null`/`None`, the pattern inherits `default_mask_strategy` instead of forcing `redact`.
+
 Version `0.2.0` also tightens the default privacy posture for observability: detection logging and detection-detail metadata are now disabled unless you opt in with `log_detections: true` or `include_detection_details: true`.
 
+Version `0.2.1` validates `default_mask_strategy` and `custom_patterns[].mask_strategy` strictly. Invalid values that older builds silently treated as `redact` now fail fast during plugin initialization.
+
 ## Detection Coverage
 
 This section describes the current Rust detector behavior so users know what is intentionally matched and what is intentionally left alone. The detector is optimized to reduce noisy false positives, which means some generic identifiers are only matched when they appear with clear context labels.

plugins/rust/python-package/pii_filter/README.md

@@ -12,29 +12,29 @@ __all__ = [
 class PIIDetectorRust:
     r"""
     Main PII detector exposed to Python
-    
+
     # Example (Python)
     ```python
     from cpex_pii_filter import PIIDetectorRust
-    
+
     config = {"detect_ssn": True, "detect_email": True}
     detector = PIIDetectorRust(config)
-    
+
     text = "My SSN is 123-45-6789 and email is john@example.com"
     detections = detector.detect(text)
     print(detections)  # {"ssn": [...], "email": [...]}
-    
+
     masked = detector.mask(text, detections)
     print(masked)  # "My SSN is [REDACTED] and email is [REDACTED]"
     ```
     """
     def __new__(cls, config: typing.Any) -> PIIDetectorRust:
         r"""
         Create a new PII detector
-        
+
         # Arguments
         * `config` - Python dictionary or Pydantic model with configuration
-        
+
         # Configuration Keys
         * `detect_ssn` (bool): Detect Social Security Numbers
         * `detect_bsn` (bool): Detect Dutch citizen service numbers
@@ -55,16 +55,17 @@ class PIIDetectorRust:
         * `max_text_bytes` (int): Maximum text payload size to inspect
         * `max_nested_depth` (int): Maximum nested container depth to inspect
         * `max_collection_items` (int): Maximum items to inspect per collection
-        * `custom_patterns` (list[dict]): Additional regex-based PII patterns
+        * `custom_patterns` (list[dict]): Additional regex-based PII patterns.
+          `mask_strategy` is optional and inherits `default_mask_strategy` when omitted or `None`.
         * `whitelist_patterns` (list[str]): Regex patterns to exclude from detection
         """
     def detect(self, text: builtins.str) -> typing.Any:
         r"""
         Detect PII in text
-        
+
         # Arguments
         * `text` - Text to scan for PII
-        
+
         # Returns
         Dictionary mapping PII type to list of detections:
         ```python
@@ -81,22 +82,22 @@ class PIIDetectorRust:
     def mask(self, text: builtins.str, detections: typing.Any) -> builtins.str:
         r"""
         Mask detected PII in text
-        
+
         # Arguments
         * `text` - Original text
         * `detections` - Detection results from detect()
-        
+
         # Returns
         Masked text with PII replaced
         """
     def process_nested(self, data: typing.Any, path: builtins.str) -> tuple[builtins.bool, typing.Any, typing.Any]:
         r"""
         Process nested data structures (dicts, lists, strings)
-        
+
         # Arguments
         * `data` - Python object (dict, list, str, or other)
         * `path` - Current path in the structure (for logging)
-        
+
         # Returns
         Tuple of (modified: bool, new_data: Any, detections: dict)
         """
@@ -108,4 +109,3 @@ class PIIFilterPluginCore:
     def prompt_post_fetch(self, payload: typing.Any, context: typing.Any) -> typing.Any: ...
     def tool_pre_invoke(self, payload: typing.Any, context: typing.Any) -> typing.Any: ...
     def tool_post_invoke(self, payload: typing.Any, context: typing.Any) -> typing.Any: ...
-

plugins/rust/python-package/pii_filter/cpex_pii_filter/pii_filter_rust/__init__.pyi

@@ -1,6 +1,6 @@
 description: "Rust-backed PII detection and masking for prompt arguments, tool inputs, and tool outputs"
 author: "ContextForge Contributors"
-version: "0.2.0"
+version: "0.2.1"
 kind: "cpex_pii_filter.pii_filter.PIIFilterPlugin"
 available_hooks:
   - "prompt_pre_fetch"

plugins/rust/python-package/pii_filter/cpex_pii_filter/plugin-manifest.yaml

@@ -33,7 +33,17 @@ fn curate_extension_stub_content(content: &str) -> String {
         "curated extension stub is missing PIIFilterPluginCore class definition",
     );
 
-    curated
+    normalize_trailing_whitespace(&curated)
+}
+
+fn normalize_trailing_whitespace(content: &str) -> String {
+    let normalized = content
+        .lines()
+        .map(str::trim_end)
+        .collect::<Vec<_>>()
+        .join("\n");
+    let normalized = normalized.trim_end_matches('\n');
+    format!("{normalized}\n")
 }
 
 fn curate_extension_stub() {
@@ -91,4 +101,17 @@ mod tests {
 
         let _ = curate_extension_stub_content(original);
     }
+
+    #[test]
+    fn test_curate_extension_stub_normalizes_whitespace_and_is_idempotent() {
+        let generated = "# This file is automatically generated by pyo3_stub_gen\n# ruff: noqa: E501, F401, F403, F405\n\nimport typing   \n\n__all__ = [\n    \"PIIDetectorRust\",\n]\n\n";
+
+        let curated = curate_extension_stub_content(generated);
+        let curated_again = curate_extension_stub_content(&curated);
+
+        assert_eq!(curated, curated_again);
+        assert!(curated.ends_with('\n'));
+        assert!(!curated.ends_with("\n\n"));
+        assert!(!curated.contains("typing   "));
+    }
 }