maskflow-cli 0.3.0__tar.gz → 0.6.0__tar.gz

maskflow_cli-0.6.0/.dockerignore

@@ -0,0 +1,3 @@
+# The Dockerfile installs maskflow-cli from PyPI -- it needs no repo files
+# in the build context. Keep the context tiny.
+*

{maskflow_cli-0.3.0 → maskflow_cli-0.6.0}/.gitignore

@@ -13,3 +13,4 @@ build/
 .coverage
 .mypy_cache/
 .ruff_cache/
+bench/indiapii/quality/.cache/

maskflow_cli-0.6.0/Dockerfile

@@ -0,0 +1,36 @@
+# `maskflow` CLI -- full image, including the spaCy NER pass so
+# `maskflow scan --deep` (bare names & addresses) works out of the box.
+#
+# Build (nothing is COPY'd, so the context is just this directory):
+#   docker build -f packages/maskflow-cli/Dockerfile \
+#     --build-arg MASKFLOW_CLI_VERSION=0.6.0 \
+#     -t maskflow/cli packages/maskflow-cli
+#
+# Run -- mount the directory holding your data as /work:
+#   docker run --rm -v "$PWD:/work" ghcr.io/maskflow/cli \
+#     scan jsonl /work/requests.jsonl --field 'messages[].content' \
+#     --deep -o /work/exposure-report.html
+#
+# Published as ghcr.io/maskflow/cli:<version> and :latest by
+# .github/workflows/release-cli.yml on a `cli-py-v*` tag.
+
+FROM python:3.12-slim
+
+# Empty => install the latest published maskflow-cli. A release build pins
+# the exact version so the image matches the tag.
+ARG MASKFLOW_CLI_VERSION=""
+
+RUN set -eux; \
+    pip install --no-cache-dir \
+      "maskflow-cli[s3,postgres]${MASKFLOW_CLI_VERSION:+==${MASKFLOW_CLI_VERSION}}"; \
+    python -m spacy download en_core_web_sm; \
+    python -c "import maskflow_cli.app, maskflow_pack_india, maskflow_pack_intl"; \
+    maskflow --help >/dev/null
+
+# Unprivileged; /work is the mount point for the caller's data.
+RUN useradd --create-home --uid 10001 scanner
+USER scanner
+WORKDIR /work
+
+ENTRYPOINT ["maskflow"]
+CMD ["--help"]

maskflow_cli-0.6.0/PKG-INFO

@@ -0,0 +1,107 @@
+Metadata-Version: 2.5
+Name: maskflow-cli
+Version: 0.6.0
+Summary: Command-line interface for MaskFlow: .maskflowrc config validation and inspection
+License: MIT
+Requires-Python: >=3.10
+Requires-Dist: httpx>=0.27
+Requires-Dist: maskflow-core[yaml]<0.7,>=0.6.0
+Requires-Dist: maskflow-pack-india<0.6,>=0.1.0
+Requires-Dist: maskflow-pack-intl<0.4,>=0.3.0
+Requires-Dist: rich>=13.0
+Requires-Dist: tomli-w>=1.0
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
+Provides-Extra: s3
+Requires-Dist: boto3>=1.34; extra == 's3'
+Description-Content-Type: text/markdown
+
+# maskflow-cli
+
+Command-line interface for [MaskFlow](https://github.com/):
+
+```
+maskflow config validate
+maskflow config show --resolved
+maskflow doctor
+maskflow explain "<text>"
+maskflow scan jsonl requests.jsonl --field 'messages[].content'
+```
+
+`maskflow doctor` checks installed versions, spaCy model presence (and
+which entities that consequently disables), and `.maskflowrc` validity,
+then reports enabled/disabled status for every registered entity. It
+exits 0 only when every check passes.
+
+`maskflow explain "<text>"` shows, span by span, why each piece of text
+was (or wasn't) detected as PII -- the pattern/NER hit, checksum result,
+context boost, and the threshold decision behind it. Spans that scored
+below their entity's threshold are listed separately as NEAREST MISSES,
+with the `.maskflowrc` change that would catch them. Matched text is
+truncated to 8 characters unless `--full` is passed. Accepts the same
+`--config`/`--set` overrides as `maskflow config`, so explanations reflect
+the same resolved config a real `mask()` call would use.
+
+## `maskflow scan` -- what PII already reached your LLM providers
+
+`maskflow scan SOURCE ...` answers the question a DPDP-deadline audit asks
+first: **what PII has this system already sent to third-party LLM
+providers, and how bad is it?** It reads your historical LLM traffic, runs
+MaskFlow's own detection over it, and writes **one self-contained HTML
+report** -- inline CSS/JS, zero external requests, so it prints cleanly and
+can be emailed to an auditor as-is.
+
+**Features**
+
+- **Eight source adapters**, one interface: `jsonl` / `ndjson` (with
+  `--field` selectors), `csv` (`--columns`), `dir` (recursive), `s3`
+  (streamed), `postgres` (server-side cursor), and the `langfuse` /
+  `helicone` / `langsmith` REST APIs. `s3` and `postgres` need the
+  `maskflow-cli[s3]` / `[postgres]` extras; the rest need nothing extra.
+- **Streaming, bounded memory** -- inputs can be gigabytes. `--workers N`
+  parallelises detection; `--checkpoint FILE` makes a run resumable;
+  `--sample N` is a fast first pass.
+- **Hybrid detection.** The pattern/checksum pass (Aadhaar, PAN, GSTIN,
+  UPI, IFSC, cards, email, ...) covers the whole corpus. The NER pass
+  (bare names & addresses) runs on a sample and is reported as a clearly
+  labelled estimate -- pass `--deep` to run it over everything.
+- **The report**: one headline number, breakdowns by entity type /
+  provider / model / time, a severity ranking with a plain-English "why
+  this matters" per row, **masked excerpts only** (values shown as
+  `<AADHAAR_1>`, never raw), and a DPDP Rule 6 mapping appendix. Also
+  `--format json|csv`.
+- **Runs entirely locally. Nothing is transmitted.** The API sources only
+  *read* from your own observability account.
+
+**Try it** -- a synthetic 60-record sample ships in
+[`examples/`](examples/):
+
+```bash
+uv run maskflow scan jsonl packages/maskflow-cli/examples/sample-llm-traffic.jsonl \
+  --field 'messages[].content' \
+  --provider-field provider --service-field model --timestamp-field created_at \
+  --deep --out exposure-report.html
+```
+
+Notes: `uv run` runs the CLI from the workspace venv -- drop it if
+`maskflow-cli` is on your `PATH` (`pipx install maskflow-cli`). Quote the
+`--field` value: `messages[].content` contains `[]`, which the shell would
+otherwise try to expand.
+
+**Install it** -- four ways, see
+[`packaging/`](packaging/) and [`docs/scan.md`](../../docs/scan.md#install):
+
+| | NER (names/addresses/DOB) |
+|---|---|
+| `pipx install maskflow-cli` + `python -m spacy download en_core_web_sm` | yes |
+| `docker run --rm -v "$PWD:/work" ghcr.io/maskflow/cli scan ...` | yes, baked in |
+| standalone binary (GitHub Releases, no Python) | no -- pattern pass only |
+| [`maskflow/scan-action`](../../packaging/scan-action/) for CI | yes |
+
+Then open `exposure-report.html`. See [`examples/README.md`](examples/README.md)
+for a walk-through of the output, and `docs/scan.md` for the full reference.
+
+See `docs/configuration.md` in the repo root for the full config reference.

maskflow_cli-0.6.0/README.md

@@ -0,0 +1,86 @@
+# maskflow-cli
+
+Command-line interface for [MaskFlow](https://github.com/):
+
+```
+maskflow config validate
+maskflow config show --resolved
+maskflow doctor
+maskflow explain "<text>"
+maskflow scan jsonl requests.jsonl --field 'messages[].content'
+```
+
+`maskflow doctor` checks installed versions, spaCy model presence (and
+which entities that consequently disables), and `.maskflowrc` validity,
+then reports enabled/disabled status for every registered entity. It
+exits 0 only when every check passes.
+
+`maskflow explain "<text>"` shows, span by span, why each piece of text
+was (or wasn't) detected as PII -- the pattern/NER hit, checksum result,
+context boost, and the threshold decision behind it. Spans that scored
+below their entity's threshold are listed separately as NEAREST MISSES,
+with the `.maskflowrc` change that would catch them. Matched text is
+truncated to 8 characters unless `--full` is passed. Accepts the same
+`--config`/`--set` overrides as `maskflow config`, so explanations reflect
+the same resolved config a real `mask()` call would use.
+
+## `maskflow scan` -- what PII already reached your LLM providers
+
+`maskflow scan SOURCE ...` answers the question a DPDP-deadline audit asks
+first: **what PII has this system already sent to third-party LLM
+providers, and how bad is it?** It reads your historical LLM traffic, runs
+MaskFlow's own detection over it, and writes **one self-contained HTML
+report** -- inline CSS/JS, zero external requests, so it prints cleanly and
+can be emailed to an auditor as-is.
+
+**Features**
+
+- **Eight source adapters**, one interface: `jsonl` / `ndjson` (with
+  `--field` selectors), `csv` (`--columns`), `dir` (recursive), `s3`
+  (streamed), `postgres` (server-side cursor), and the `langfuse` /
+  `helicone` / `langsmith` REST APIs. `s3` and `postgres` need the
+  `maskflow-cli[s3]` / `[postgres]` extras; the rest need nothing extra.
+- **Streaming, bounded memory** -- inputs can be gigabytes. `--workers N`
+  parallelises detection; `--checkpoint FILE` makes a run resumable;
+  `--sample N` is a fast first pass.
+- **Hybrid detection.** The pattern/checksum pass (Aadhaar, PAN, GSTIN,
+  UPI, IFSC, cards, email, ...) covers the whole corpus. The NER pass
+  (bare names & addresses) runs on a sample and is reported as a clearly
+  labelled estimate -- pass `--deep` to run it over everything.
+- **The report**: one headline number, breakdowns by entity type /
+  provider / model / time, a severity ranking with a plain-English "why
+  this matters" per row, **masked excerpts only** (values shown as
+  `<AADHAAR_1>`, never raw), and a DPDP Rule 6 mapping appendix. Also
+  `--format json|csv`.
+- **Runs entirely locally. Nothing is transmitted.** The API sources only
+  *read* from your own observability account.
+
+**Try it** -- a synthetic 60-record sample ships in
+[`examples/`](examples/):
+
+```bash
+uv run maskflow scan jsonl packages/maskflow-cli/examples/sample-llm-traffic.jsonl \
+  --field 'messages[].content' \
+  --provider-field provider --service-field model --timestamp-field created_at \
+  --deep --out exposure-report.html
+```
+
+Notes: `uv run` runs the CLI from the workspace venv -- drop it if
+`maskflow-cli` is on your `PATH` (`pipx install maskflow-cli`). Quote the
+`--field` value: `messages[].content` contains `[]`, which the shell would
+otherwise try to expand.
+
+**Install it** -- four ways, see
+[`packaging/`](packaging/) and [`docs/scan.md`](../../docs/scan.md#install):
+
+| | NER (names/addresses/DOB) |
+|---|---|
+| `pipx install maskflow-cli` + `python -m spacy download en_core_web_sm` | yes |
+| `docker run --rm -v "$PWD:/work" ghcr.io/maskflow/cli scan ...` | yes, baked in |
+| standalone binary (GitHub Releases, no Python) | no -- pattern pass only |
+| [`maskflow/scan-action`](../../packaging/scan-action/) for CI | yes |
+
+Then open `exposure-report.html`. See [`examples/README.md`](examples/README.md)
+for a walk-through of the output, and `docs/scan.md` for the full reference.
+
+See `docs/configuration.md` in the repo root for the full config reference.

maskflow_cli-0.6.0/examples/README.md

@@ -0,0 +1,83 @@
+# `maskflow scan` example
+
+`sample-llm-traffic.jsonl` is **60 fully synthetic** LLM API request records
+— the kind of log a team might export from an OpenAI/Anthropic gateway or an
+observability tool. About three quarters of them contain planted PII
+(Aadhaar, PAN, GSTIN, UPI VPA, IFSC, Indian mobile, passport, driving
+licence, credit card, date of birth, names, postal addresses); the rest are
+clean support queries.
+
+> **Nothing here is real.** Every identifier is generated to be
+> checksum-/format-valid but drawn at random within that shape — never from
+> or against a real registry. Names, emails (`@*.example`), and addresses are
+> assembled from synthetic pools. See `generate_sample.py`.
+
+Each record looks like:
+
+```json
+{"request_id": "req_0007", "provider": "anthropic", "model": "claude-sonnet-4",
+ "created_at": "2026-03-20T14:05:00Z",
+ "messages": [{"role": "user", "content": "Run a KYC check for ... Aadhaar ... PAN ..."}]}
+```
+
+## Run it
+
+From the repo root. `uv run` invokes the CLI from the workspace venv without
+a separate install; if you have `maskflow-cli` installed (`pipx install
+maskflow-cli`, or an activated venv), drop the `uv run` prefix.
+
+```bash
+uv run maskflow scan jsonl packages/maskflow-cli/examples/sample-llm-traffic.jsonl \
+  --field 'messages[].content' \
+  --provider-field provider \
+  --service-field model \
+  --timestamp-field created_at \
+  --deep \
+  --out exposure-report.html
+```
+
+One line, if your shell mangles the backslash continuations:
+
+```bash
+uv run maskflow scan jsonl packages/maskflow-cli/examples/sample-llm-traffic.jsonl --field 'messages[].content' --provider-field provider --service-field model --timestamp-field created_at --deep --out exposure-report.html
+```
+
+- `--field 'messages[].content'` — pull the text out of each record (the `[]`
+  means "every message"). **Quote it** — `[]` is a glob character in most
+  shells, so an unquoted `messages[].content` fails with "no matches found".
+- `--provider-field` / `--service-field` / `--timestamp-field` — map the
+  record's metadata columns so the report can break exposure down by
+  provider, model, and time.
+- `--deep` — run the full pipeline (names and addresses included) over every
+  record. Fine here because the file is tiny; on a real multi-GB corpus you
+  would drop `--deep` and let the NER pass run on a sample.
+- `--out` — where to write the report. `--format json` or `--format csv`
+  give you the same data as structured output instead.
+
+Open `exposure-report.html` in a browser. It is a single self-contained file
+— no network, no external assets — so it prints cleanly and can be emailed
+as-is.
+
+## What the report shows
+
+For this sample you should see roughly:
+
+- **~165 PII instances** reached three providers (openai, anthropic,
+  google), across **~49 of 60** records.
+- A breakdown by entity type — Aadhaar, PAN, passport, and credit card land
+  in the **Critical** severity band; addresses, driving licences, DOB, UPI
+  in **High**; names, mobiles, email, GSTIN in **Medium**; IFSC in **Low**.
+- A per-day time series and a per-provider / per-model split.
+- Expandable **masked** example contexts under each severity row — the
+  values are shown only as typed placeholders like `<AADHAAR_1>`, never
+  raw.
+- An **Appendix A** slot for the DPDP Rule 6 mapping.
+
+## Regenerate
+
+```bash
+uv run python packages/maskflow-cli/examples/generate_sample.py
+```
+
+Deterministic (fixed seed), so the committed file only changes when the
+generator does.

maskflow_cli-0.6.0/examples/generate_sample.py

@@ -0,0 +1,119 @@
+"""Regenerates examples/sample-llm-traffic.jsonl.
+
+EVERYTHING THIS PRODUCES IS SYNTHETIC. Identifiers are generated to be
+checksum-/format-valid but are drawn uniformly at random within that shape
+and are never looked up against, or taken from, any real registry -- see
+`bench/indiapii/generator/identifiers.py`. Names, emails, and addresses are
+assembled from the same synthetic pools. Do not treat any value here as
+belonging to a real person or organisation.
+
+Run from the repo root:  uv run python packages/maskflow-cli/examples/generate_sample.py
+"""
+
+from __future__ import annotations
+
+import json
+import random
+import sys
+from pathlib import Path
+
+# The synthetic-identifier generators live in the repo's bench/ tree.
+sys.path.insert(0, str(Path(__file__).resolve().parents[3]))
+
+from bench.indiapii.generator import identifiers as gen  # noqa: E402
+
+OUT = Path(__file__).parent / "sample-llm-traffic.jsonl"
+SEED = 20260513  # DPDP enforcement date -- deterministic output
+N = 60
+
+_PROVIDERS = [
+    ("openai", "gpt-4o"),
+    ("openai", "gpt-4o-mini"),
+    ("anthropic", "claude-sonnet-4"),
+    ("anthropic", "claude-3-5-haiku"),
+    ("google", "gemini-1.5-pro"),
+]
+
+# ~1 in 4 records is a clean support query with no PII, so the sample report
+# shows a realistic "N of M records contained PII" ratio.
+_CLEAN = [
+    "How do I reset my password?",
+    "What are your business hours on public holidays?",
+    "Summarise the attached refund policy in three bullet points.",
+    "Draft a polite reminder email about an overdue invoice (no names).",
+    "What's the difference between IMPS and NEFT?",
+]
+
+
+def _pii_prompt(rng: random.Random) -> str:
+    name = gen.generate_person_name(rng)
+    kind = rng.randrange(6)
+    if kind == 0:
+        dob = f"19{rng.randint(60, 99)}-{rng.randint(1, 12):02d}-{rng.randint(1, 28):02d}"
+        return (
+            f"Run a KYC check for {name}. Aadhaar {gen.generate_aadhaar(rng)}, "
+            f"PAN {gen.generate_pan(rng)}, DOB {dob}."
+        )
+    if kind == 1:
+        return (
+            f"Customer {name} ({gen.generate_indian_mobile(rng)}) wants a refund to "
+            f"UPI {gen.generate_upi_vpa(rng)} -- draft the confirmation message."
+        )
+    if kind == 2:
+        return (
+            f"Vendor onboarding: GSTIN {gen.generate_gstin(rng)}, settlement account "
+            f"IFSC {gen.generate_ifsc(rng)}, contact {name.split()[0].lower()}@vendor.example."
+        )
+    if kind == 3:
+        return (
+            f"Ship the replacement unit to {name}, {gen.generate_indian_address(rng)}. "
+            f"Reachable on {gen.generate_indian_mobile(rng)}."
+        )
+    if kind == 4:
+        return (
+            f"Cardholder {name} disputes a charge on card "
+            f"{_fake_card(rng)}; summarise the case for the ops team."
+        )
+    return (
+        f"Passport {gen.generate_indian_passport(rng)} and driving licence "
+        f"{gen.generate_driving_licence(rng)} submitted by {name} for verification."
+    )
+
+
+def _fake_card(rng: random.Random) -> str:
+    # A Luhn-valid 16-digit number in a test BIN range (4242...) -- same
+    # "valid shape, not a real card" discipline as the other identifiers.
+    digits = [4, 2, 4, 2] + [rng.randrange(10) for _ in range(11)]
+    checksum = 0
+    for idx, d in enumerate(reversed(digits)):
+        d = d * 2 if idx % 2 == 0 else d
+        checksum += d - 9 if d > 9 else d
+    digits.append((10 - checksum % 10) % 10)
+    s = "".join(map(str, digits))
+    return f"{s[0:4]} {s[4:8]} {s[8:12]} {s[12:16]}"
+
+
+def main() -> None:
+    rng = random.Random(SEED)
+    rows: list[dict] = []
+    for i in range(N):
+        provider, model = _PROVIDERS[i % len(_PROVIDERS)]
+        month = 1 + (i * 7) % 8  # spread Jan..Aug 2026
+        day = 1 + (i * 13) % 27
+        ts = f"2026-{month:02d}-{day:02d}T{9 + i % 9:02d}:{(i * 17) % 60:02d}:00Z"
+        content = rng.choice(_CLEAN) if i % 4 == 0 else _pii_prompt(rng)
+        rows.append(
+            {
+                "request_id": f"req_{i:04d}",
+                "provider": provider,
+                "model": model,
+                "created_at": ts,
+                "messages": [{"role": "user", "content": content}],
+            }
+        )
+    OUT.write_text("\n".join(json.dumps(r) for r in rows) + "\n", encoding="utf-8")
+    print(f"wrote {len(rows)} records -> {OUT}")
+
+
+if __name__ == "__main__":
+    main()

maskflow_cli-0.6.0/examples/sample-llm-traffic.jsonl

@@ -0,0 +1,60 @@
+{"request_id": "req_0000", "provider": "openai", "model": "gpt-4o", "created_at": "2026-01-01T09:00:00Z", "messages": [{"role": "user", "content": "What are your business hours on public holidays?"}]}
+{"request_id": "req_0001", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-08-14T10:17:00Z", "messages": [{"role": "user", "content": "Vendor onboarding: GSTIN 13BVNCH2630I6ZD, settlement account IFSC KBHB0GLR7ED, contact rameeni@vendor.example."}]}
+{"request_id": "req_0002", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-07-27T11:34:00Z", "messages": [{"role": "user", "content": "Cardholder Manosha disputes a charge on card 4242 5486 7637 3085; summarise the case for the ops team."}]}
+{"request_id": "req_0003", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-06-13T12:51:00Z", "messages": [{"role": "user", "content": "Customer Chaitr Sarvadharmamaya (+91-8958297726) wants a refund to UPI e1ypcn9@okicici -- draft the confirmation message."}]}
+{"request_id": "req_0004", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-05-26T13:08:00Z", "messages": [{"role": "user", "content": "What's the difference between IMPS and NEFT?"}]}
+{"request_id": "req_0005", "provider": "openai", "model": "gpt-4o", "created_at": "2026-04-12T14:25:00Z", "messages": [{"role": "user", "content": "Run a KYC check for Rajasi Bhishada. Aadhaar 9294 4857 5420, PAN ZHSBN5203Q, DOB 1985-03-20."}]}
+{"request_id": "req_0006", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-03-25T15:42:00Z", "messages": [{"role": "user", "content": "Customer Arunodhayen (+916643314760) wants a refund to UPI g5srz89yle2wb@waicici -- draft the confirmation message."}]}
+{"request_id": "req_0007", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-02-11T16:59:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Lingam Arieon, Door No. 623, Kural Layout, Thiruvananthapuram, Chhattisgarh. Reachable on +91-8763582776."}]}
+{"request_id": "req_0008", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-01-24T17:16:00Z", "messages": [{"role": "user", "content": "Draft a polite reminder email about an overdue invoice (no names)."}]}
+{"request_id": "req_0009", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-08-10T09:33:00Z", "messages": [{"role": "user", "content": "Customer Shrikalasundar Roderic (+91-8101485724) wants a refund to UPI jqp72@yesbank -- draft the confirmation message."}]}
+{"request_id": "req_0010", "provider": "openai", "model": "gpt-4o", "created_at": "2026-07-23T10:50:00Z", "messages": [{"role": "user", "content": "Passport W96 27182 and driving licence HP64-2016-6746731 submitted by Ratirat for verification."}]}
+{"request_id": "req_0011", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-06-09T11:07:00Z", "messages": [{"role": "user", "content": "Passport V20 72133 and driving licence TS64 2022 8000356 submitted by Wilde Tarika for verification."}]}
+{"request_id": "req_0012", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-05-22T12:24:00Z", "messages": [{"role": "user", "content": "Draft a polite reminder email about an overdue invoice (no names)."}]}
+{"request_id": "req_0013", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-04-08T13:41:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Aroop, Phase 984A, Chanchalarcha Vihar, Madavaram, West Bengal. Reachable on +916652213920."}]}
+{"request_id": "req_0014", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-03-21T14:58:00Z", "messages": [{"role": "user", "content": "Cardholder Kunjal disputes a charge on card 4242 1010 0295 3582; summarise the case for the ops team."}]}
+{"request_id": "req_0015", "provider": "openai", "model": "gpt-4o", "created_at": "2026-02-07T15:15:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Vrithika, Sector 794B, Joshnika Nagar, Veraval, Daman And Diu. Reachable on +91 6734853374."}]}
+{"request_id": "req_0016", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-01-20T16:32:00Z", "messages": [{"role": "user", "content": "Draft a polite reminder email about an overdue invoice (no names)."}]}
+{"request_id": "req_0017", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-08-06T17:49:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Zhaamileey, Plot 454B, Soruban Nagar, Buxar, Andhra Pradesh. Reachable on 08089671059."}]}
+{"request_id": "req_0018", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-07-19T09:06:00Z", "messages": [{"role": "user", "content": "Run a KYC check for Sammbhu. Aadhaar 527254856909, PAN BQHJS2680F, DOB 1966-04-11."}]}
+{"request_id": "req_0019", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-06-05T10:23:00Z", "messages": [{"role": "user", "content": "Run a KYC check for Averie Arhatasamhita. Aadhaar 6658 5114 2622, PAN RLLBT8160F, DOB 1962-12-12."}]}
+{"request_id": "req_0020", "provider": "openai", "model": "gpt-4o", "created_at": "2026-05-18T11:40:00Z", "messages": [{"role": "user", "content": "Summarise the attached refund policy in three bullet points."}]}
+{"request_id": "req_0021", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-04-04T12:57:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Mahasarasvat, Block 359, Sudurlabha Colony, Vasai-Virar, Himachal Pradesh. Reachable on +916457617906."}]}
+{"request_id": "req_0022", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-03-17T13:14:00Z", "messages": [{"role": "user", "content": "Cardholder Mahendrakumar Rajamuthu disputes a charge on card 4242 7405 5329 7491; summarise the case for the ops team."}]}
+{"request_id": "req_0023", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-02-03T14:31:00Z", "messages": [{"role": "user", "content": "Customer Chabla (06592230346) wants a refund to UPI tmo14upg88p@ybl -- draft the confirmation message."}]}
+{"request_id": "req_0024", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-01-16T15:48:00Z", "messages": [{"role": "user", "content": "What are your business hours on public holidays?"}]}
+{"request_id": "req_0025", "provider": "openai", "model": "gpt-4o", "created_at": "2026-08-02T16:05:00Z", "messages": [{"role": "user", "content": "Vendor onboarding: GSTIN 22FEAFD2442R8ZY, settlement account IFSC BCEY00QLUND, contact kushanthi@vendor.example."}]}
+{"request_id": "req_0026", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-07-15T17:22:00Z", "messages": [{"role": "user", "content": "Passport V80 84042 and driving licence TR37 1991 9387627 submitted by Winry Iyanharan for verification."}]}
+{"request_id": "req_0027", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-06-01T09:39:00Z", "messages": [{"role": "user", "content": "Passport V43 67482 and driving licence KL78-2008-4950584 submitted by Lilliann Zoella for verification."}]}
+{"request_id": "req_0028", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-05-14T10:56:00Z", "messages": [{"role": "user", "content": "Draft a polite reminder email about an overdue invoice (no names)."}]}
+{"request_id": "req_0029", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-04-27T11:13:00Z", "messages": [{"role": "user", "content": "Cardholder Trulie disputes a charge on card 4242 5456 8060 8480; summarise the case for the ops team."}]}
+{"request_id": "req_0030", "provider": "openai", "model": "gpt-4o", "created_at": "2026-03-13T12:30:00Z", "messages": [{"role": "user", "content": "Run a KYC check for Bhajuna Ruchel. Aadhaar 4154 6145 8082, PAN QEPPV8191N, DOB 1984-11-12."}]}
+{"request_id": "req_0031", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-02-26T13:47:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Lisaa Dio, Phase 412B, Hulk Colony, Rourkela, Goa. Reachable on +918083496965."}]}
+{"request_id": "req_0032", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-01-12T14:04:00Z", "messages": [{"role": "user", "content": "How do I reset my password?"}]}
+{"request_id": "req_0033", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-08-25T15:21:00Z", "messages": [{"role": "user", "content": "Vendor onboarding: GSTIN 22PBYFG4129B7ZX, settlement account IFSC ABBL0UOJH9H, contact yoganandh@vendor.example."}]}
+{"request_id": "req_0034", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-07-11T16:38:00Z", "messages": [{"role": "user", "content": "Customer Indujan Brihadgataye (+919177090793) wants a refund to UPI 0bkfzpxdgas@ybl -- draft the confirmation message."}]}
+{"request_id": "req_0035", "provider": "openai", "model": "gpt-4o", "created_at": "2026-06-24T17:55:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Ekaikanishthita, Flat 641, Devion Puram, Rajkot, Ladakh. Reachable on +91 9825034337."}]}
+{"request_id": "req_0036", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-05-10T09:12:00Z", "messages": [{"role": "user", "content": "What's the difference between IMPS and NEFT?"}]}
+{"request_id": "req_0037", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-04-23T10:29:00Z", "messages": [{"role": "user", "content": "Vendor onboarding: GSTIN 07OHBFX7274J6ZS, settlement account IFSC IOBA0V3NCRO, contact nikatha@vendor.example."}]}
+{"request_id": "req_0038", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-03-09T11:46:00Z", "messages": [{"role": "user", "content": "Customer Daryan (+91 7616038330) wants a refund to UPI ebkz1tor9@unionbank -- draft the confirmation message."}]}
+{"request_id": "req_0039", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-02-22T12:03:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Vrishabhapriya Asikundagata, Block 63B, Yamit Vihar, Haldwani-cum-Kathgodam, Gujarat. Reachable on +917150873370."}]}
+{"request_id": "req_0040", "provider": "openai", "model": "gpt-4o", "created_at": "2026-01-08T13:20:00Z", "messages": [{"role": "user", "content": "What are your business hours on public holidays?"}]}
+{"request_id": "req_0041", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-08-21T14:37:00Z", "messages": [{"role": "user", "content": "Cardholder Svahsthita Ameliah disputes a charge on card 4242 4252 1430 9790; summarise the case for the ops team."}]}
+{"request_id": "req_0042", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-07-07T15:54:00Z", "messages": [{"role": "user", "content": "Run a KYC check for Gunash Bhanusri. Aadhaar 4556-7185-1809, PAN PPVJZ8421L, DOB 1973-02-02."}]}
+{"request_id": "req_0043", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-06-20T16:11:00Z", "messages": [{"role": "user", "content": "Cardholder Sangiliyen Ubaithulla disputes a charge on card 4242 2049 8682 8117; summarise the case for the ops team."}]}
+{"request_id": "req_0044", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-05-06T17:28:00Z", "messages": [{"role": "user", "content": "How do I reset my password?"}]}
+{"request_id": "req_0045", "provider": "openai", "model": "gpt-4o", "created_at": "2026-04-19T09:45:00Z", "messages": [{"role": "user", "content": "Vendor onboarding: GSTIN 27ZCAFM7450J8Z5, settlement account IFSC BKDN07S3Y96, contact rahamathulla@vendor.example."}]}
+{"request_id": "req_0046", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-03-05T10:02:00Z", "messages": [{"role": "user", "content": "Vendor onboarding: GSTIN 24HFEJU6417Q5ZU, settlement account IFSC NKGS0U42NW6, contact gunagarbha@vendor.example."}]}
+{"request_id": "req_0047", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-02-18T11:19:00Z", "messages": [{"role": "user", "content": "Cardholder Anku Vikrit disputes a charge on card 4242 1722 4695 2466; summarise the case for the ops team."}]}
+{"request_id": "req_0048", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-01-04T12:36:00Z", "messages": [{"role": "user", "content": "What's the difference between IMPS and NEFT?"}]}
+{"request_id": "req_0049", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-08-17T13:53:00Z", "messages": [{"role": "user", "content": "Run a KYC check for Shrutapapaghn Isewar. Aadhaar 8769-8005-8680, PAN MJZBF9014V, DOB 1962-06-06."}]}
+{"request_id": "req_0050", "provider": "openai", "model": "gpt-4o", "created_at": "2026-07-03T14:10:00Z", "messages": [{"role": "user", "content": "Customer Harout Amaru (+91 7156684675) wants a refund to UPI jtik@baroda -- draft the confirmation message."}]}
+{"request_id": "req_0051", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-06-16T15:27:00Z", "messages": [{"role": "user", "content": "Passport H9867332 and driving licence SK21 1997 1695474 submitted by Msk for verification."}]}
+{"request_id": "req_0052", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-05-02T16:44:00Z", "messages": [{"role": "user", "content": "What's the difference between IMPS and NEFT?"}]}
+{"request_id": "req_0053", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-04-15T17:01:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Bhutikrite, H.No. 863A, Adris Vihar, Buxar, Jharkhand. Reachable on +91-9157079078."}]}
+{"request_id": "req_0054", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-03-01T09:18:00Z", "messages": [{"role": "user", "content": "Cardholder Akish disputes a charge on card 4242 5207 2782 7518; summarise the case for the ops team."}]}
+{"request_id": "req_0055", "provider": "openai", "model": "gpt-4o", "created_at": "2026-02-14T10:35:00Z", "messages": [{"role": "user", "content": "Ship the replacement unit to Jeyalatha, Block 175, Kiro Puram, Raurkela Industrial Township, Nagaland. Reachable on +919624990544."}]}
+{"request_id": "req_0056", "provider": "openai", "model": "gpt-4o-mini", "created_at": "2026-01-27T11:52:00Z", "messages": [{"role": "user", "content": "What are your business hours on public holidays?"}]}
+{"request_id": "req_0057", "provider": "anthropic", "model": "claude-sonnet-4", "created_at": "2026-08-13T12:09:00Z", "messages": [{"role": "user", "content": "Cardholder Kumarasan disputes a charge on card 4242 7360 9493 5821; summarise the case for the ops team."}]}
+{"request_id": "req_0058", "provider": "anthropic", "model": "claude-3-5-haiku", "created_at": "2026-07-26T13:26:00Z", "messages": [{"role": "user", "content": "Cardholder Maryclaire disputes a charge on card 4242 7437 1044 5565; summarise the case for the ops team."}]}
+{"request_id": "req_0059", "provider": "google", "model": "gemini-1.5-pro", "created_at": "2026-06-12T14:43:00Z", "messages": [{"role": "user", "content": "Cardholder Printhaapan disputes a charge on card 4242 2891 4265 2444; summarise the case for the ops team."}]}

maskflow_cli-0.6.0/packaging/README.md

@@ -0,0 +1,56 @@
+# Packaging `maskflow`
+
+How the CLI is distributed, and how each artifact is built.
+
+| channel | what you get | NER pass (names/addresses/DOB)? |
+|---|---|---|
+| **pipx / pip** | `pip install maskflow-cli` (`[s3]` / `[postgres]` extras) | Yes, with `python -m spacy download en_core_web_sm` |
+| **Docker** — `ghcr.io/maskflow/cli` | full CLI, spaCy + model baked in | Yes, out of the box |
+| **Standalone binary** — GitHub Releases | single ~15 MB file, no Python needed | **No** — pattern/checksum pass only |
+| **GitHub Action** — [`packaging/scan-action`](../../../packaging/scan-action/) | `maskflow scan` in CI, report as an artifact | Yes (downloads the model) |
+
+## pipx
+
+```bash
+pipx install maskflow-cli
+# or one-off:
+pipx run maskflow-cli scan jsonl requests.jsonl --field 'messages[].content'
+```
+
+`maskflow-cli` publishes to PyPI from `.github/workflows/release-cli.yml`
+on a `cli-py-v*` tag (trusted publishing, no stored token).
+
+## Docker
+
+`Dockerfile` in the package root. Built and pushed to
+`ghcr.io/maskflow/cli:<version>` and `:latest` by the same release
+workflow, `linux/amd64` + `linux/arm64`.
+
+```bash
+docker run --rm -v "$PWD:/work" ghcr.io/maskflow/cli \
+  scan jsonl /work/requests.jsonl --field 'messages[].content' \
+  --deep -o /work/exposure-report.html
+```
+
+## Standalone binary
+
+`maskflow.spec` + `_entry.py` here, built with PyInstaller by the release
+workflow's `binaries` matrix (linux/macos/windows) and attached to the
+GitHub Release.
+
+**The binary deliberately excludes spaCy** — bundling it and the model
+turns ~15 MB into ~1 GB and is fragile across the three OSes. So the binary
+runs the **pattern/checksum pass only**: Aadhaar, PAN, GSTIN, UPI, IFSC,
+credit cards, email, phones, the Indian gazetteer-based name/address
+layers, etc. It does *not* run the generic spaCy NER pass; `--deep` exits
+with a message pointing at the pip / Docker install. Reports it generates
+still contain no raw PII (excerpt dates are scrubbed regardless of NER).
+
+```bash
+pyinstaller --clean --noconfirm packages/maskflow-cli/packaging/maskflow.spec
+./dist/maskflow scan jsonl requests.jsonl --field 'messages[].content'
+```
+
+`_entry.py` calls `multiprocessing.freeze_support()` first — without it a
+`scan --workers >1` pool re-launches the frozen binary with
+multiprocessing's own argv and Typer aborts on the unknown `-B`.

maskflow_cli-0.6.0/packaging/_entry.py

@@ -0,0 +1,23 @@
+"""PyInstaller entry point for the standalone `maskflow` binary.
+
+A thin module (not a console-script shim) so the spec has a concrete file
+to analyse. Imports the packs explicitly -- in a frozen build the
+`"maskflow.recognizers"` entry points are not always discoverable, but the
+direct import side effect always registers the recognizers.
+"""
+
+from __future__ import annotations
+
+import multiprocessing
+
+import maskflow_pack_india  # noqa: F401
+import maskflow_pack_intl  # noqa: F401
+from maskflow_cli.app import main
+
+if __name__ == "__main__":
+    # MUST be first: when `scan --workers >1` spawns a pool, PyInstaller
+    # re-launches this same binary as the worker with multiprocessing's own
+    # argv (`-B -S -c ...`). freeze_support() intercepts that, runs the
+    # worker, and exits -- without it Typer sees `-B` and aborts.
+    multiprocessing.freeze_support()
+    main()