All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
- armos-ner-en model — Armos now ships with a custom-trained NER model (armos-ai/en_armos_ner) built specifically for Indian and Western PII detection. Downloaded automatically on first use (~450 MB, cached at
~/.cache/armos/models/). - ADDRESS detection — Physical address detection (Indian and Western) now powered by armos-ner-en NER. Covers flat/house/plot formats with locality, city, and PIN; US/UK street addresses with postcode. 100% detection rate across 10,000 samples.
huggingface_hubadded as a core dependency for model download and caching.
- Indian name detection: 96.4% → 99.4% (+9.1% vs
en_core_web_lgbaseline) across 10,000 samples. - Western name detection: 99.7% across 10,000 samples.
- OpenAI
sk-proj-API keys now detected — regex updated to cover the newer key format alongside the classicsk-prefix. - First-run download experience improved: clear
[armos]messages explain what is downloading and why. Subsequent runs load from cache silently. - ADDRESS entity boundary resolution improved — partial overlaps (< 50% of shorter span) no longer cause adjacent entities (e.g. AADHAAR) to be dropped.
- GitHub personal access tokens (
ghp_) now detected for tokens longer than 36 characters.
- Streaming demasking — OpenAI (
chat.completions) and Anthropic (messages) wrappers now transparently demasked PII tokens in streaming responses. Tokens split across multiple chunks are buffered and reassembled before demasking. - Uncertain PII detection —
MaskResult.uncertainexposes entities that scored below the masking threshold (0.35) but above a near-miss floor (0.1). These are surfaced for inspection without being masked.
- Added
click>=8.0.0as an explicit dependency.typer>=0.12droppedclickas a hard requirement, causingModuleNotFoundErroron CI when spaCy's CLI tried to import it.
- Redis vault now supports TLS (
rediss://) connections viacertififor CA bundle verification. certifi>=2024.0.0added to theredisandallextras.
- Auto-download of
en_core_web_lgspaCy model on first use — no manualspacy downloadrequired. CONTRIBUTING.mdwith setup, testing, and PR guidelines.
- Dropped Python 3.9 support; minimum version is now Python 3.10.
- Added GitHub Actions CI running tests across Python 3.10, 3.11, and 3.12.
- Detection accuracy benchmarks across all supported entity types (NAME, EMAIL, PHONE, AADHAAR, PAN, CARD, IP, APIKEY, SSN, IBAN).
- SSN detection — US Social Security Numbers (e.g.
371-53-1234). - IBAN detection — International Bank Account Numbers (e.g.
GB29NWBK60161331926819). - OpenAI Responses API masking —
client.responses.create(...)is now protected. - Embeddings masking —
client.embeddings.create(...)masks PII before the vector is generated. QUICKSTART.mdandTROUBLESHOOTING.mdguides.
- Redis store API refactored to explicit
store="redis"+redis_url=parameters (breaking change from earlier implicit config). - System hint automatically injected into the LLM context when PII is detected, reminding the model to preserve tokens verbatim.
- Enriched PyPI package metadata (classifiers, keywords, URLs).
- Initial release.
- Core PII masking via Presidio + spaCy
en_core_web_lg. - Supported entities: NAME, EMAIL, PHONE, AADHAAR, PAN, CREDIT CARD, IP ADDRESS, API KEY.
MemoryVault(default, ephemeral) andRedisVault(optional, customer-owned).- Deterministic token format
[PII:TYPE:8hexhash]— same value always maps to the same token. - Case-normalised deduplication —
john smith/John Smith/JOHN SMITHall produce the same token. MaskResultwith.text,.entities,.has_pii, and.uncertain.- OpenAI
chat.completionswrapper (ArmosOpenAI). - Anthropic
messageswrapper (ArmosAnthropic).