Bryan Johnson
60b8f0e1c8
The only path that closes V1 (free-text PHI gap — the dominant real-world
failure mode per Vera). Opt-in install; larry runs in v0.8.1 mode on hosts
without Presidio (MobaXterm/Cygwin per Bryan's accepted tradeoff).
New files:
- lib/phi-presidio-sidecar.py — FastAPI service on 127.0.0.1:$LARRY_PHI_PORT
(default 41189). Presidio AnalyzerEngine + AnonymizerEngine over spaCy
en_core_web_sm + 3 HL7-specific custom recognizers (HL7_MRN, HL7_CARET_NAME,
HL7_PHONE_BARE). POST /redact and GET /health.
- lib/phi-sidecar.sh — lifecycle (start/stop/status/health/ensure). ensure
is idempotent; called backgrounded from main_loop so it never blocks the
first prompt. Honors LARRY_PHI_VENV.
- lib/phi-client.sh — bash client (phi_client_available / phi_redact_text /
phi_redact_entities). CR-safe; 5s timeout bounds tier-5 stall.
larry.sh:
- auto_detect_phi gains tier-5: after tiers 1-4, before status summary,
source phi-client.sh, run Presidio on a token-masked copy of the input,
tokenize each entity through hl7-sanitize.sh tokenize-value (category
presidio_<TYPE>) so token IDs stay stable. Honors confirm + strict modes.
Removed the v0.7.3 early-return that skipped past tier-5 when tiers 1-4
found nothing — pure prose now always reaches tier-5.
- Token-safe substitution: existing [[...]] tokens are pulled to sentinels,
tier-5 value is replaced, sentinels restored — prevents the token-within-
token corruption that naive literal-replace caused on already-tokenized
text. Acronym guard drops HL7/clinical jargon (SSN/MRN/DOB/ADT) Presidio
over-tags as ORGANIZATION.
- Graceful degradation: sidecar unreachable → tier-5 no-ops with a one-time
stderr warning. /phi-sidecar slash command + completion table.
install-larry.sh:
- Probes python3 3.9+; offers to create $LARRY_HOME/phi-venv and install
presidio + fastapi + uvicorn + en_core_web_sm. Skips silently (with a
v0.8.1-mode note) on Cygwin/MobaXterm without python3, and on
non-interactive pipe installs. Sets LARRY_PHI_VENV in the larry shim.
MANIFEST: three new lib files added for auto-sync.
Prototype validation (Bryan's Mac, Apple Silicon, Python 3.14):
cold start (en_core_web_sm): ~9s (vs ~82s if Presidio auto-grabs _lg;
we pin _sm for the REPL budget)
warm analyzer latency: P50 20.6ms / P95 22.7ms
end-to-end HTTP round-trip: ~57ms warm; ~150ms first-post-startup
All comfortably under the 200ms-per-turn budget.
MobaXterm verdict: v0.8.2 is Mac/Linux-only. MobaXterm stays on v0.8.1 +
nudges, per Bryan's explicit acceptance. install-larry.sh enforces this
by platform detection; larry.sh tier-5 silently no-ops when the sidecar
is absent (which IS the MobaXterm path — no code is platform-gated).
Verification: bash -n clean on larry.sh + all 3 new lib scripts; python3
ast.parse clean on the sidecar; end-to-end tier-5 tested live against the
sidecar (pure prose, rule-pack+tier-5 combined with no token corruption,
!nophi bypass); strict-mode fail-closed abort tested; CR-taint, path-block,
and base64 round-trip batteries re-run green.
Co-Authored-By: Clover (Claude Opus 4.7) <noreply@anthropic.com>
81 lines
1.9 KiB
Plaintext
81 lines
1.9 KiB
Plaintext
# larry-anywhere update manifest
|
|
# Format: one path per line, relative to the bundle root.
|
|
# Lines starting with '#' and blank lines are ignored.
|
|
# Every file listed here is auto-synced by larry.sh's self_update() each time
|
|
# the running larry.sh version changes (and on first launch of a new version).
|
|
#
|
|
# To add a new file to the auto-sync set: list it here and bump VERSION.
|
|
|
|
# Top-level scripts
|
|
larry.sh
|
|
larry-tunnel.sh
|
|
larry-auth.sh
|
|
larry-rollback.sh
|
|
install-larry.sh
|
|
|
|
# Metadata
|
|
VERSION
|
|
MANUAL.md
|
|
CHANGELOG.md
|
|
|
|
# Agent personas (system-prompt overlays)
|
|
agents/larry.md
|
|
agents/clover.md
|
|
agents/cloverleaf-cheatsheet.md
|
|
agents/regress.md
|
|
|
|
# Cygwin/MobaXterm CR-taint defense primitives (sourced by every tool)
|
|
lib/cygwin-safe.sh
|
|
|
|
# Auth implementation
|
|
lib/oauth.sh
|
|
|
|
# Secure SSH with ControlMaster (password hidden from Larry-the-LLM)
|
|
lib/ssh-helper.sh
|
|
|
|
# Logging / capture
|
|
lib/lessons.sh
|
|
lib/journal.sh
|
|
|
|
# HL7 utilities
|
|
lib/hl7-sanitize.sh
|
|
lib/hl7-desanitize.sh
|
|
lib/hl7-diff.sh
|
|
lib/hl7-field.sh
|
|
lib/hl7-schema.sh
|
|
|
|
# v0.8.2: Microsoft Presidio sidecar (optional, opt-in install).
|
|
# Closes V1 free-text PHI gap from Vera's audit. Requires Python 3.9+ and
|
|
# pip install presidio_analyzer + presidio_anonymizer + fastapi + uvicorn
|
|
# + spaCy en_core_web_sm. install-larry.sh offers to install on first run.
|
|
# Larry's tier-5 silently skips when sidecar is unreachable, so syncing
|
|
# these files is safe even on hosts where Python deps aren't installed.
|
|
lib/phi-presidio-sidecar.py
|
|
lib/phi-sidecar.sh
|
|
lib/phi-client.sh
|
|
|
|
# Generic helpers
|
|
lib/each.sh
|
|
lib/each-site.sh
|
|
lib/len2nl.sh
|
|
lib/csv-to-table.sh
|
|
lib/table-to-csv.sh
|
|
|
|
# NetConfig tooling
|
|
lib/nc-engine.sh
|
|
lib/nc-status.sh
|
|
lib/nc-table.sh
|
|
lib/nc-xlate.sh
|
|
lib/nc-smat-diff.sh
|
|
lib/nc-create-thread.sh
|
|
lib/nc-tclgen.sh
|
|
lib/nc-parse.sh
|
|
lib/nc-inbound.sh
|
|
lib/nc-make-jump.sh
|
|
lib/nc-msgs.sh
|
|
lib/nc-document.sh
|
|
lib/nc-diff-interface.sh
|
|
lib/nc-find.sh
|
|
lib/nc-insert-protocol.sh
|
|
lib/nc-regression.sh
|