v0.6.4 — architecture review fixes

Install: curl -fsSL https://omna.dev/cli/install.sh | bash
Homebrew: brew tap gaurjin/omna https://github.com/gaurjin/omna-plugin && brew install --cask omna

Fixes from an independent architecture review.

Never sent unmasked

• If masking fails for any reason (an engine error, a full disk), the request is refused, never forwarded as it was.
• A file sent in pieces is refused when a piece cannot be checked on its own (a value can be cut across two pieces).
• Some secret keys were masked in the wrong place (a Sonar token, a Microsoft Teams webhook): now the key itself is masked.
• Text the AI APIs keep under data, url, name or user is masked too (text documents, links with keys, user ids).

Real values only for you

The local API door answers only requests addressed to this machine, and puts back only the real values that request itself carried. Another program that types [EMAIL_1] gets [EMAIL_1] back.

Better detection, faster

• Names and emails with accents (José Núñez, josé@…) are masked.
• Codex-style replies get real values back in their finished tool calls.
• Very large inputs are about ten times faster.

Under the hood

Engine omna-pii-mask 0.2.11. The Homebrew build is signed and notarized by Apple.