[RaviTharuma]

Summary

Fixes the sanitizer/guardrail config footgun where request PII redaction required INPUT_SANITIZER_MODE=redact, which made the documented enterprise recipe (MODE=block + PII_REDACTION_ENABLED=true) detect PII but still forward it upstream.

Also closes related docs/coverage gaps from the sanitizer audit.

Closes #8092
Closes #8094
Related: #8093, #8095, #8096, #8097

Changes

Code

• pii-masker preCall: PII_REDACTION_ENABLED=true now redacts request PII independently of injection mode
• Request shape coverage: redacts Responses API plain-string input[] items, top-level string input, and prompt
• sanitizeRequest / redactBody: same independent PII rewrite + broader body walk (string messages/system/input/prompt)

Docs

• Stop claiming INPUT_SANITIZER_MODE=redact strips injection patterns
• Document that request PII rewrite is controlled only by PII_REDACTION_ENABLED
• Clarify enterprise recipe so block + PII redaction are independent

Tests

• Registry test: redaction works with MODE=block
• Registry test: Responses string input / top-level string input
• New input-sanitizer-pii-redaction.test.ts matrix

Test plan

• node --import tsx/esm ... --test tests/unit/input-sanitizer-pii-redaction.test.ts (3/3 pass)
• node --import tsx/esm ... --test tests/unit/guardrails-registry.test.ts (7/7 pass)
• CI unit suite on this PR

Notes / intentional non-goals in this PR

• Does not change default INPUT_SANITIZER_ENABLED (still opt-out / default on in code; docs already say default true in current tree) — docs: remove stale packaged ENVIRONMENT.md showing INPUT_SANITIZER_ENABLED=false (live docs/code agree: true) #8093 may already be largely doc-aligned
• Does not rework medium-severity injection blocking policy — tracked in fix(backend): prompt-injection guard wiring inconsistent across endpoints; medium patterns never block #8095
• Response PII path already runs via pii-masker postCall + streaming transform in current main; this PR only clarifies request-side independence

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[RaviTharuma]

Superseded by #8124 which includes the PII decoupling work plus residual threshold/default alignment, docs/env contract sync, and the critical tar audit unblock.

Recommend closing this PR in favor of #8124.

[diegosouzapw]

Obrigado, @RaviTharuma — mergeado na release/v3.8.49. Validado no tip combinado (merge-train: typecheck + file-size + 106 testes das áreas tocadas + vitest 271/271 verdes). O único red de CI era o base-red compartilhado de complexity (pré-existente na tip da release, não deste PR).