fix(ai): prevent customer iccid disclosure

internal/ai/tooling/registry_test.go

@@ -68,6 +68,33 @@ func TestNormalizeCustomerReplyHidesThrottlingDenial(t *testing.T) {
 	}
 }
 
+func TestNormalizeCustomerReplyRedactsICCID(t *testing.T) {
+	reply, err := NormalizeCustomerReply("设备号：37012617001708\nICCID 已查询到：**8986042302268012345**\n业务状态：正常")
+	if err != nil {
+		t.Fatalf("NormalizeCustomerReply() error = %v", err)
+	}
+	for _, forbidden := range []string{"8986042302268012345", "ICCID 已查询到"} {
+		if strings.Contains(reply, forbidden) {
+			t.Fatalf("ICCID leaked through normalized reply: %q", reply)
+		}
+	}
+	for _, expected := range []string{"设备号：37012617001708", "业务状态：正常", restrictedICCIDFallback} {
+		if !strings.Contains(reply, expected) {
+			t.Fatalf("expected %q in sanitized reply: %q", expected, reply)
+		}
+	}
+}
+
+func TestNormalizeCustomerReplyRedactsBareFormattedICCID(t *testing.T) {
+	reply, err := NormalizeCustomerReply("查询结果：89 8604 2302 2680 12345")
+	if err != nil {
+		t.Fatalf("NormalizeCustomerReply() error = %v", err)
+	}
+	if strings.Contains(reply, "8604") || !strings.Contains(reply, restrictedICCIDFallback) {
+		t.Fatalf("formatted ICCID was not redacted: %q", reply)
+	}
+}
+
 func TestPolicyGuardRejectsTotalCallsAndOversizedArguments(t *testing.T) {
 	definition, err := DefaultRegistry.Resolve(toolx.BuiltinKnowledgeRetrieve.Code)
 	if err != nil {

internal/ai/tooling/reply_safety.go

@@ -11,8 +11,17 @@ const maxCustomerReplyRunes = 8000
 
 const restrictedNetworkPolicyFallback = "当前网络状态请以实际使用情况为准。如无法联网，请使用“智能检测”或联系人工客服。"
 
+const restrictedICCIDFallback = "ICCID 属于系统内部标识，无法提供。"
+
 var restrictedNetworkPolicyPattern = regexp.MustCompile(`(?i)限速|降速|速率限制|带宽限制|speed[ _-]?limit|throttl|traffic[ _-]?shap|(?:^|[^a-z0-9])\d+(?:\.\d+)?\s*(?:k|m|g)?bps(?:[^a-z0-9]|$)`)
 
+var restrictedICCIDLabelPattern = regexp.MustCompile(`(?i)iccid|集成电路卡识别码|sim\s*卡序列号`)
+
+// ICCIDs normally start with 89 and contain 18 to 22 digits. Allow common
+// separators so Markdown emphasis or spaced formatting cannot bypass the
+// customer-visible output boundary.
+var restrictedICCIDNumberPattern = regexp.MustCompile(`\b89(?:[ \t._*-]*\d){16,20}\b`)
+
 // NormalizeCustomerReply applies the final plain-text boundary before an AI
 // response enters a customer conversation. It rejects likely credential
 // assignments instead of masking them, because a masked secret is not useful
@@ -27,7 +36,7 @@ func NormalizeCustomerReply(value string) (string, error) {
 	}
 	var builder strings.Builder
 	for _, r := range value {
-		if unicode.IsControl(r) && r != '\n' && r != '\t' {
+		if (unicode.IsControl(r) && r != '\n' && r != '\t') || unicode.In(r, unicode.Cf) {
 			continue
 		}
 		builder.WriteRune(r)
@@ -37,6 +46,7 @@ func NormalizeCustomerReply(value string) (string, error) {
 		value = strings.ReplaceAll(value, "\n\n\n", "\n\n")
 	}
 	value = redactRestrictedNetworkPolicy(value)
+	value = RedactRestrictedICCID(value)
 	if value == "" {
 		return "", fmt.Errorf("ai reply is empty")
 	}
@@ -46,6 +56,39 @@ func NormalizeCustomerReply(value string) (string, error) {
 	return value, nil
 }
 
+// ContainsRestrictedICCID reports whether text contains an ICCID label or a
+// value shaped like an ICCID. Callers use it to keep internal identity values
+// out of prompts and automatic customer messages as well as AI replies.
+func ContainsRestrictedICCID(value string) bool {
+	return restrictedICCIDLabelPattern.MatchString(value) || restrictedICCIDNumberPattern.MatchString(value)
+}
+
+// RedactRestrictedICCID removes labelled ICCID lines and hides bare ICCID
+// values. A fixed explanation is appended whenever anything was removed.
+func RedactRestrictedICCID(value string) string {
+	if !ContainsRestrictedICCID(value) {
+		return value
+	}
+	lines := strings.Split(value, "\n")
+	safe := make([]string, 0, len(lines)+1)
+	redacted := false
+	for _, line := range lines {
+		if restrictedICCIDLabelPattern.MatchString(line) {
+			redacted = true
+			continue
+		}
+		cleaned := restrictedICCIDNumberPattern.ReplaceAllString(line, "[内部标识已隐藏]")
+		if cleaned != line {
+			redacted = true
+		}
+		safe = append(safe, cleaned)
+	}
+	if redacted {
+		safe = append(safe, restrictedICCIDFallback)
+	}
+	return strings.TrimSpace(strings.Join(safe, "\n"))
+}
+
 // redactRestrictedNetworkPolicy is a final customer-visible safety boundary.
 // The model may still ignore its system prompt, so any line that confirms,
 // denies, or quantifies an internal network speed policy is removed before the