[bhargavmehta01]

Problem and behavior

The existing regex path already uses fixed Czech patient aliases, but other identifying values receive fresh replacements per occurrence, and some report layouts retain names or consume neighboring fields. This change keeps replacements consistent throughout one report while preserving clinical text and avoiding a permanent cross-report pseudonym key.

• Recognized patient names use conventional fictional names: Jan Novák / Jana Nováková for Czech reports, Peter Horváth / Petra Horváthová for Slovak reports, and John Doe / Jane Doe for English reports. Specific Czech/Slovak report labels supply the language hint; shared, mixed or unknown clues use the English alias set without suppressing name removal. Reported sex, including multiline fields, takes precedence over profile sex. Aliases also avoid original labeled first/surname components so local-model final validation does not reject an intentional replacement. If every conventional and anonymous alias collides, a non-name mask is used.
• Repeated identifiers use HMAC-SHA256 with a fresh, lazy, in-memory report key. The SHA-256 implementation comes from the existing vendored library. The key is neither stored nor synced.
• Explicit name fields handle short and lowercase names, including Slovak Meno and Priezvisko without a profile-name hint. Slovak sex, DOB, clinician and address labels are supported; whitespace-separated physician/address labels remain supported. Standalone name matches preserve measured clinical rows such as White blood cell count and Free T4. Empty identifying fields cannot consume the next result line.
• Recognized DOBs retain their year and agree across repeated copies, including Birth Date labels and strict multiline date values. Empty DOB fields cannot consume clinical rows. Age stays unchanged, and labeled collection/report dates remain intact even when their value equals the DOB.
• Local-model preprocessing and finalization share the captured profile hints, alias and key. Streaming review displays and sends the finalized result with its actual character count.
• Review panes synchronize vertical and horizontal scrolling while the prepared text stays editable.

Merged current main and regenerated the module map and DOM-sink inventory. Public documentation is prepared separately in getbased-docs #26, to land with or after this change.

Validation

Using Node.js 24.22.0 and the project's TypeScript 7 toolchain:

• Four focused unit suites: 146 passed (pii-redaction, pii-scroll-sync, pii-review-presentation, pii-review-styles).
• Existing node tests/test-pii.js checks: 47 passed.
• Focused Chromium PII and PDF-import specs: 14 passed, including Slovak aliases across repeated pages, real pane scrolling, clinical-text preservation and edited Send payloads.
• Application/test migration typechecks, Svelte checks, architecture check, DOM-sink audit, and quality guardrails passed.
• The PR Actions run passed on 3b28960e: compiler/quality and production-artifact preparation, unit tests, native browser checks, all four selected Chromium shipping shards, resource limits and the required test gate.
• CodeQL passed. Greptile reviewed the same commit with 5/5 confidence, all three numbered findings addressed and no new actionable issues. No unresolved review threads remain.

Verification used synthetic reports and controlled provider responses. This PR run used affected selection with native Chromium and four Chromium shipping shards. Additional browser engines and combined coverage belong to nightly/full release-evidence runs and were not part of this scoped run. These checks do not establish recognition of every real report layout or live model behavior.

[greptile-apps]

Confidence Score: 5/5

[High impact] The reviewed changes appear safe to merge, with all three numbered findings addressed.

Summary

Keeps privacy replacements consistent within each report and synchronizes the review panes.

• Report redaction keeps repeated replacements matched and protects clinical details.
• Streamed review shows and sends the finalized text.
• The original and prepared report panes scroll together.

No new actionable issues were found in the changes since the previous review. All three numbered findings are addressed. Related repositories showed no incompatible code consumers. Checks here were based on source inspection; tests were not rerun.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Report and captured profile hints] --> B[Report-local redaction]
  B --> C[Local model]
  C --> D[Final privacy check]
  B -->|Keep supplied replacements| D
  D --> E[Editable review]
  E --> F[Send finalized or edited text]

Loading

_{Reviews (12) · Last reviewed commit: "Fix privacy alias collisions and preserv..." · Reviewed by Greptile}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.

[bhargavmehta01]

Addressed all the review feedback and merged the latest main (966727b), so the conflict is gone. CI is green except one unit test, coverage-producer.test.ts, which hit its 30s timeout (31.4s here; it passed at 27.3s on the previous run of this branch and doesn't touch the redaction code). @elkimek could you re-run that job and take another look when you get a chance? Thanks!