chatsee-redact 0.2.0

Local JSON/JSONL/CSV log redaction using ChatSee's redaction rules.

chatsee-redact

Redact PII in your own JSON / JSONL / CSV log files locally, using ChatSee's redaction rules.

Your log content never leaves your machine. The only network call this tool makes is a read-only fetch of the regex classifier rules from ChatSee. The raw and redacted content is read from, and written to, local files only — there is no telemetry and nothing is uploaded.

Because it reuses the exact redaction engine shipped in the ChatSee SDK, the masking you get here is identical to what the ChatSee pipeline would apply.

Install

pip install chatsee-redact

This pulls in chatsee-ai (the SDK), whose base install depends only on requests.

Usage

# Redact one file; writes ./redacted/app.json
chatsee-redact app.json --out ./redacted/

# Default output is alongside the input: app.redacted.json
chatsee-redact app.json

# Multiple files into one folder
chatsee-redact logs/*.jsonl --out ./redacted/

# Pick the environment whose rules to use (default: qa)
chatsee-redact app.json --env demo --out ./redacted/

Input → output:

app.json          -->  ./redacted/app.json      (all string values masked)

What gets redacted

By default every string value in the document is scanned and masked (recursively, through nested objects and arrays). Non-string values (numbers, booleans, null) are left untouched.

To restrict redaction to specific top-level keys:

chatsee-redact app.json --fields user_message,bot_message,email

Formats

Input	Handling
.json	Whole-document: JSON array, object, or scalar.
.jsonl / .ndjson	JSON Lines — streamed one record per line (safe for large logs).
.csv	Per-row, streamed; header preserved. --fields selects columns.
other extension	Treated as JSONL. Override with --format.

Force a format with --format {auto,json,jsonl,csv}.

Inspecting the rules (dump-rules)

Fetch the raw classifier documents (the exact regexes that will run) so they can be audited before you trust the tool:

chatsee-redact dump-rules --env qa            # prints the rules JSON to stdout
chatsee-redact dump-rules --env qa -o rules.json

Options

Flag	Default	Description
-o, --out DIR	alongside input	Output directory (created if missing).
--out-file PATH	—	Explicit output path (single input only).
--env	qa	Rule source environment: dev/qa/demo/poc.
--classifiers-url	—	Full classifiers URL (overrides --env).
--fields A,B,C	all strings	Restrict redaction to these top-level keys / CSV columns.
--format	auto	auto | json | jsonl | csv.
--indent N	2	JSON output indent (-1 = compact).
--timeout	5	Rule-fetch HTTP timeout (seconds).
--cache-ttl	300	In-process rule cache TTL (seconds).
--no-verify-ssl	off	Disable TLS verification for the rule fetch.
--strict	off	Abort (write nothing) if no rules could be fetched, instead of copying unredacted.
-q, --quiet	off	Only log warnings/errors.

Behaviour when rules can't be fetched

By default the tool fails open (matching the SDK): it warns loudly and writes an unredacted copy so a transient outage doesn't break your job. Pass --strict to instead abort and write nothing — recommended when the output must be guaranteed redacted.

Exit codes

Code	Meaning
0	Success.
1	One or more files failed to redact (I/O or parse error).
2	Bad invocation (missing input, refused source overwrite, --out-file with multiple inputs).
3	--strict and no rules available.