Porting a PII tracer byte-exact from Python to TypeScript, so a coding agent cannot leak your secrets

A developer ported a PII tracer byte-exact from Python to TypeScript so it can run inside a coding agent's request pipeline rather than alongside it, aiming to strip secrets such as API keys before requests leave the machine. The approach relies on provable request sanitization instead of trusting a prompt to prevent leaks.

My coding agent is good at its job. It is also one cat .env away from sending my keys to a vendor. I did not want to trust a prompt for that. I wanted the request itself to be clean, provably, before it leaves. This is the story of porting a PII tracer from Python to TypeScript - byte-exact - so it could run inside the agent's pipeline instead of next to it.