fix: stop no-dash SSN branch matching digit runs inside hex IDs

A bare nine-digit run embedded in a longer alphanumeric token (random
hex IDs, UUID segments) matched the SSN pattern because its boundaries
only excluded adjacent digits. In practice this let randomly generated
server IDs trip the Claude Code PII firewall hook and block entire
sessions.

Tighten the no-dash branch only: the run must not be followed by a
letter, and must start at a non-alphanumeric boundary or right after a
two-letter token prefix (preserving v4.4.0 country-code parity, e.g.
DE123456789). The dashed branch keeps its existing boundaries.

Author: sidmohan0

datafog/processing/text_processing/regex_annotator/regex_annotator.py

@@ -104,15 +104,23 @@ def __init__(
             # inside a DE_VAT_ID) are resolved by the engine's span-overlap
             # suppression, not here, so default (EN) detection keeps v4.4.0
             # behavior even when German labels are active.
+            # The no-dash branch has stricter boundaries than the dashed one:
+            # a nine-digit run embedded in a longer alphanumeric token (random
+            # hex IDs, UUID segments) is not an SSN. The run must not be
+            # followed by a letter, and must start either at a non-alphanumeric
+            # boundary or right after a two-letter token prefix (country codes
+            # like "DE123456789" — v4.4.0 parity).
             "SSN": re.compile(
                 r"""
-                (?<!\d)
                 (?:
+                    (?<!\d)
                     (?!000|666)\d{3}-(?!00)\d{2}-(?!0000)\d{4}
+                    (?!\d)
                     |
+                    (?:(?<![0-9A-Za-z])|(?<=\b[A-Za-z]{2}))
                     (?!000|666)\d{3}(?!00)\d{2}(?!0000)\d{4}
+                    (?![0-9A-Za-z])
                 )
-                (?!\d)
                 """,
                 re.IGNORECASE | re.MULTILINE | re.VERBOSE,
             ),

tests/test_regex_annotator.py

@@ -373,6 +373,29 @@ def test_annotation_result_format():
     assert ssn_spans[0].text == "123-45-6789"
 
 
+def test_ssn_no_dash_not_flagged_inside_alphanumeric_tokens():
+    """Regression guard: bare nine-digit runs embedded in longer
+    alphanumeric tokens (random hex IDs, UUID segments, blob names) must
+    not match SSN. A digit run counts as embedded when the token
+    continues with letters after it, or when it is preceded by a token
+    prefix that is not a bare two-letter country code (see
+    test_ssn_detection_keeps_v44_behavior_for_country_prefixed_digits)."""
+    annotator = RegexAnnotator()
+    for text in (
+        "serverId 3f2a123456789bc is up.",  # letters on both sides
+        "session 9c-3f2a123456789-77 restarted.",  # run ends a hex segment
+        "blob deadbeef123456789cafe stored.",
+        "id a1b2-123456789abc-x9",  # run starts a segment, letters after
+    ):
+        assert annotator.annotate(text)["SSN"] == [], text
+
+
+def test_ssn_no_dash_still_flagged_standalone():
+    """A bare nine-digit number that is its own token must keep matching."""
+    annotator = RegexAnnotator()
+    assert annotator.annotate("Case 219099999 assigned.")["SSN"] == ["219099999"]
+
+
 def test_ssn_detection_keeps_v44_behavior_for_country_prefixed_digits():
     """Regression guard: bare nine-digit runs after a country prefix must
     still match SSN when no locale is configured (v4.4.0 parity). The