Anonymark User Guide & Visual Walkthrough

Anonymark (anonymark) is a native Go and macOS Vision/CoreText CLI utility for capturing and anonymizing technical screenshots with pixel-matched synthetic data replacement. Instead of obscuring UI layouts with black redaction bars or coarse pixelation, Anonymark measures the exact background color cluster, glyph ink height, font weight, and typographic baseline of detected identifiers and renders realistic synthetic replacements directly in place.

View on GitHub 🍳 Open Practical Cookbook →

Table of Contents

1. Core Architecture & Rendering Pipeline
2. Visual Walkthrough — Synthetic In-Place Replacement
3. Redaction Modes (synthetic, pill, blur)
4. Supported Identifier Detectors
5. CLI Reference & Flags
6. Empirical Layout Proofreader
7. Shell Completions

1. Core Architecture & Rendering Pipeline

Traditional redaction tools either blur rectangular bounding boxes or stamp flat solid-color rectangles over text, producing a jarring “cut-and-paste tagboard” appearance whenever a screenshot contains subtle card gradients, selection highlights, or mixed font weights.

Anonymark solves this with a five-stage native pipeline (pkg/ocr, pkg/detector, pkg/renderer, pkg/anonymizer):

1. Accurate Vision OCR Pass (VNRecognizeTextRequest): Extracts full line observations and normalized bounding boxes across the screenshot.
2. Longest-Span Token-Boundary Matching (Detector.DetectMatches): Scans recognized text for private IPv4 addresses, hardware MAC addresses, .lan/.local hostnames, device prefixes (nas-, pve-, dns-, iot-, esp-), /Users/<name> paths, emails, and secret tokens. Overlapping candidates are deduplicated longest-first while preserving non-sensitive surrounding text on the same line.
3. Clustered Perimeter Background Sampling (sampleBackgroundPixel): Samples pixels around the 2px exterior perimeter of each target region and selects the dominant color cluster (distance < 0.06), ignoring stray border lines or adjacent icons so the erased background matches the underlying card or row highlight seamlessly.
4. Ink-Metrics Typography & Column Snapping (measureInkMetrics): Measures actual foreground glyph ink height (inkMaxY - inkMinY), median core-ink RGB color, and horizontal ink coverage to select the matching SF Pro or SF Mono font weight (.regular, .medium, .semibold, .bold), snapping vertically aligned list rows to a shared left X coordinate and point size.
5. CoreText Baseline Rendering (CTLineDraw): Draws the anonymized line onto the exact typographic baseline (capHeight and descender-aware) with proportional width clamping so replacement strings never overflow onto adjacent UI badges.

2. Visual Walkthrough — Synthetic In-Place Replacement

Below is a screenshot of the Drifter network workbench processed through anonymark process -mode synthetic:

Hover or click for annotations Showing annotations · Click to pin Annotations pinned · Click to hide

Visual Callout Guide — Synthetic Replacement Engine

• ① In-Place Synthetic Host & IP Replacement: Multi-row sidebar lists (proxy-gw-43.lan, nas-host-40.lan, core-node-69.lan) and their subnet IPv4 subtitles (10.0.144.x) are replaced on the exact original typographic baseline while preserving leading status indicator dots and warning icons.
• ② Clustered Perimeter Background Sampling: In the detail header, nas-host-40.lan and 10.0.144.15 blend smoothly into the dark inspector header without overlapping the adjacent Drift status pill.
• ③ Session-Deterministic Token Mapping: Hardware MAC addresses (52:54:00:68:ED:82 using the standard QEMU/KVM locally administered OUI) and mDNS service instances (_smb._tcp.local (proxy-gw-41)) map deterministically across the entire image.

3. Redaction Modes (synthetic, pill, blur)

Anonymark supports three visual output modes via the -mode flag:

Hover or click for annotations Showing annotations · Click to pin Annotations pinned · Click to hide

Visual Callout Guide — Pill Redaction Mode (-mode pill)

• ① Pill Redaction Mode (-mode pill): Replaces every detected hostname and IP row in the host list with clean dark-gray redaction bars while keeping status dots and warning badges visible.
• ② Inspector Detail Redaction: Automatically redacts matching hostnames, IPs, and MAC addresses in the detail header and device profile table.

4. Supported Identifier Detectors

5. CLI Reference & Flags

Interactive Screen Capture (anonymark capture)

Launches the native macOS crosshair region selector (screencapture -i), runs OCR + synthetic replacement on the captured PNG, and writes the anonymized output:

anonymark capture -out clean_capture.png
anonymark capture -out redacted_capture.png -mode pill

Process Existing Image (anonymark process)

Processes any existing PNG or JPEG screenshot on disk:

anonymark process input.png -out anonymized.png
anonymark process input.png -out anonymized_pill.png -mode pill
anonymark process input.png -out anonymized_blur.png -mode blur

6. Empirical Layout Proofreader

Before and after rendering, pkg/anonymizer.Proofreader audits target regions (AuditLayout and AuditRenderedRegions) to verify:

• Width Coverage (0.95x – 1.05x): Ensures synthetic strings do not leave awkward gaps or overflow onto neighboring UI controls.
• Column Font Uniformity: Verifies that vertically aligned table/sidebar items maintain consistent point sizes (stdDev <= 1.0pt).

7. Shell Completions

Generate native shell completions for Zsh or Bash:

# Zsh
anonymark completion zsh > ~/.zsh/completions/_anonymark

# Bash
anonymark completion bash > /usr/local/etc/bash_completion.d/anonymark