Bug: PII Masking Inconsistent — Multiple PII Items in Single Prompt Only Partially Masked

[dev-bitrupt]

What happened?

Only credit card number was masked. Email and CVC were not masked. When email was sent alone in a separate prompt, it was masked correctly. Multi-item PII detection is unreliable. No per-issue error toast shown.

Steps to reproduce

1. Enable PII masking in Settings > Guardrails
2. Send a message with 3 PII items: credit card number, email, and CVC in one prompt

Expected behavior

All PII items masked — credit card, email, and CVC replaced with tokens.

Affected service

Platform

Version or commit

0.2.58

Browser and OS

Chrome

Relevant log output

Screenshots or recordings

No response

Before submitting

• I searched existing issues and this hasn't been reported yet.