fix(guardrails): rename PRESIDIO_URL env var to PII_URL

Match the infra taskdef, which sets PII_URL on the app container for the
combined Presidio sidecar.

Author: TheodoreSpeaks

apps/sim/lib/core/config/env.ts

@@ -311,7 +311,7 @@ export const env = createEnv({
     PORT:                                  z.number().optional(),                  // Main application port
     INTERNAL_API_BASE_URL:                 z.string().optional(),                  // Optional internal base URL for server-side self-calls; must include protocol if set (e.g., http://sim-app.namespace.svc.cluster.local:3000)
     ALLOWED_ORIGINS:                       z.string().optional(),                  // CORS allowed origins
-    PRESIDIO_URL:                          z.string().optional(),                  // Presidio sidecar base URL serving /analyze + /anonymize (default http://localhost:5001)
+    PII_URL:                               z.string().optional(),                  // Presidio PII sidecar base URL serving /analyze + /anonymize (default http://localhost:5001)
 
     // OAuth Integration Credentials - All optional, enables third-party integrations
     GOOGLE_CLIENT_ID:                      z.string().optional(),                  // Google OAuth client ID for Google services

apps/sim/lib/guardrails/README.md

@@ -35,7 +35,7 @@ docker run -d -p 5001:5001 sim-pii
 Point the app at it (default shown):
 
 ```bash
-PRESIDIO_URL=http://localhost:5001
+PII_URL=http://localhost:5001
 ```
 
 The image bakes in the recognizers itself — a check-digit-validated **VIN** recognizer and

apps/sim/lib/guardrails/validate_pii.ts

@@ -12,7 +12,7 @@ const REQUEST_TIMEOUT_MS = 45_000
 const MASK_CONCURRENCY = 8
 
 /** Single Presidio sidecar serving both /analyze and /anonymize (VIN is native there). */
-const PRESIDIO_URL = env.PRESIDIO_URL || 'http://localhost:5001'
+const PII_URL = env.PII_URL || 'http://localhost:5001'
 
 export interface PIIValidationInput {
   text: string
@@ -56,7 +56,7 @@ async function analyze(
   const entities = entityTypes.length > 0 ? entityTypes : undefined
 
   // boundary-raw-fetch: internal call to the Presidio analyzer sidecar over localhost
-  const response = await fetch(`${PRESIDIO_URL}/analyze`, {
+  const response = await fetch(`${PII_URL}/analyze`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ text, language, ...(entities ? { entities } : {}) }),
@@ -77,7 +77,7 @@ async function anonymize(text: string, spans: AnalyzerSpan[]): Promise<string> {
   if (spans.length === 0) return text
 
   // boundary-raw-fetch: internal call to the Presidio anonymizer sidecar over localhost
-  const response = await fetch(`${PRESIDIO_URL}/anonymize`, {
+  const response = await fetch(`${PII_URL}/anonymize`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
     body: JSON.stringify({ text, analyzer_results: spans }),