Porting a PII tracer byte-exact from Python to TypeScript, so a coding agent cannot leak your secrets

My coding agent is good at its job. It is also one cat .env away from sending my keys to a vendor. I did not want to trust a prompt for that. I wanted the request itself to be clean, provably, before it leaves.

This is the story of porting a PII tracer from Python to TypeScript - byte-exact - so it could run inside the agent's pipeline instead of next to it.