@akasecurity/ai-tc-claude-code 0.9.0 → 0.9.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aka",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code. Detection runs locally; events are recorded to a local SQLite store on your machine.",
   "homepage": "https://github.com/akasecurity/ai-tc",
   "author": { "name": "AKA Security" }

package/README.md

@@ -7,7 +7,9 @@
 
 The Claude Code plugin for **[AI Traffic Control](https://github.com/akasecurity/ai-tc)** (`ai-tc`). It hooks into a Claude Code session and inspects its traffic — prompts, tool calls, tool results, file reads — scanning each event against your rule packs and applying inline **warn / redact / block** policies. Every event is recorded to a local SQLite store at `~/.aka/data/aka.db`.
 
-Detection runs entirely on your machine. There's no account and no backend — nothing leaves your computer to be scanned.
+Detection runs entirely on your machine. There's no account and no backend — nothing is sent anywhere to be scanned.[^egress]
+
+[^egress]: Live detection and enforcement run locally. The one exception is the **opt-in** `/aka:setup` calibration below: to rate what an initial history scan finds, its judge step sends those findings to the model API through the `claude` CLI — the same provider your Claude session already uses. For each finding that means the raw (unmasked) value including any secret, plus roughly 120 characters of the surrounding transcript text on either side (any other secrets detected in that window are masked). It runs only after you explicitly opt in, and it keeps those values out of your local Claude transcript — but a copy of them does leave the machine. Withdrawing the grant later stops future scans; it cannot recall what was already sent.
 
 ## Install
 

package/commands/setup.md

@@ -15,10 +15,18 @@ dashboard. Everything the user sees is derived from their _actual_ history — n
 a fabricated or demo number. When there isn't enough history to judge, the wizard
 falls back to a conservative severity-derived floor instead of guessing.
 
-The false-positive/severity judgment itself runs in a **separate, transient
-subprocess that writes no transcript** — the raw (unmasked) finding values are
-never read into this conversation or your scannable history. You act only on the
-raw-free plan that subprocess prints back.
+The false-positive/severity judgment needs the raw (unmasked) findings to rate
+them accurately, so it **sends them to the model API** through separate `claude`
+CLI subprocesses (a large history is judged in several batches). Two things
+cross for each finding: its **raw value**, and about **120 characters of the
+surrounding transcript text** on either side of it (any other secrets detected in
+that window are masked). Those subprocesses ask the `claude` CLI to write
+no transcript, so the raw values do not enter this conversation or your scannable
+history — but a copy of them **does leave the machine**, sent to the model
+provider like any other Claude prompt. You act only on the raw-free plan the
+subprocesses print back. The scan that produces those values is offered for
+explicit consent in step 1, and that consent must state the model-API egress
+plainly before it is given.
 
 Follow the steps below **in order**. Nothing is written to the policy store
 until step 5 (or a floor fallback in step 3 if the calibration can't complete).
@@ -63,8 +71,8 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/intro.js" "${CLAUDE_PLUGIN_ROOT}/.claude-plu
 Before showing any recommended posture — the start-light default table in
 step 2 or the calibrated posture in step 4 — look at the **current project's**
 working tree yourself, with your own Read/Glob tools. There is no script for
-this: it is your own reasoning over facts you read directly, not the isolated
-triage subprocess's raw-free plan, and it needs no user interaction.
+this: it is your own reasoning over facts you read directly, not the triage
+subprocess's raw-free plan, and it needs no user interaction.
 
 **In scope:** the manifest's declared frameworks/dependencies
 (`package.json` or equivalent), payment or other third-party API SDKs among
@@ -101,7 +109,7 @@ posture the user reads, not a separate write. Persisting a tightened level happe
 only where the wizard already writes a per-category override — the adjust fork's
 `onboard.js --posture` write (step 4b), where the user picks each category's level
 explicitly. The keep-defaults path writes the severity floor (`--floor`, step 2)
-and the calibrated accept path applies the isolated subprocess's saved plan
+and the calibrated accept path applies the triage subprocess's saved plan
 verbatim (`--confirmed --plan`, step 5); neither carries the tightening on its
 own, so a tightened level the user wants persisted is chosen through the adjust
 fork. Do **not** bolt on an extra `onboard.js --posture` overlay to auto-re-persist
@@ -124,18 +132,36 @@ interactive picker. The plugin can't draw its own selectable UI (it can't
 capture keystrokes), so do **not** print a fake option list or ask the user to
 "reply with a number"; let the picker collect the answer.
 
-**Want me to look over what Claude's been up to?** — "I'll review Claude's recent work — transcripts, temp files, agent memory — to tune what I bring to you next."
+**Disclose the model-API egress plainly before you show the picker — this is what
+the user is consenting to, so it must be visible before they choose.** State it in
+your own words, without softening it: if they say yes, AKA scans the last 30 days
+of Claude history, and to rate what it finds it **sends the raw, unmasked values —
+including any secrets — to the model API through the `claude` CLI**. Name what
+travels with each one: **its raw value, and about 120 characters of the
+surrounding transcript text on either side** (any other secrets detected in that
+window are masked). That is real network egress to the model provider (the same one your
+Claude session already uses), not a purely local review. **A copy of each value
+leaves the machine.** The transcripts those values came from stay on disk
+untouched — nothing here removes them; that is the separate redaction step in
+step 6. The values are kept out of your local Claude transcript, and the findings
+are also recorded, masked, to the local store. The grant is revocable from the
+dashboard's **Settings → Historical access**, which stops future scans — it
+cannot recall anything already sent. Do not present the picker until you have
+said this.
+
+**Want me to look over what Claude's been up to?** — "I'll scan Claude's recent work — transcripts, temp files, agent memory — and send what I find to the model to rate it, so I can tune what I bring you next."
 
 Offer exactly two options:
 
-- **Yes, take a look** — "tune what I bring you, based on Claude's real work here"
+- **Yes, take a look** — "scan my real work here; raw findings go to the model to be rated, then tune what you bring me"
 - **Not now** — "start light and I'll learn as we go"
 
 Choosing **Yes, take a look** records the same historical-review consent the wizard has
-always recorded — the identical scope, the one-time grant, and the
-revocable-under-Policies semantics — so the simpler question broadens nothing
-about what AKA may access. Those granular scope and revocation details stay
-inspectable on request and in the dashboard.
+always recorded — the identical scope (which includes the model-API judgment disclosed
+above), the one-time grant, and the same revocation semantics — so the simpler question
+broadens nothing about what AKA may access. Those granular scope and revocation details
+stay inspectable on request and in the dashboard, under **Settings → Historical access**,
+whose own copy repeats the model-API disclosure.
 
 ## 2. Save the answer, then branch
 
@@ -221,10 +247,62 @@ it.
      step 6 already follows when no calibration frame was emitted). Step 7
      then runs as written.
 
-## 3. Run the evidence triage — isolated judgment, nothing written yet
+## 3. Run the evidence triage — off-transcript judgment, nothing written yet
 
-Pipe the backfill's triage stream straight into the `apply-suppressions`
-adapter in **PREVIEW** mode (no `--confirmed`):
+**Model-judge consent — a distinct opt-in, asked here before the pipe.** The
+false-positive/severity judgment runs by sending each finding to the Anthropic
+model API through `claude`. That is a separate egress from the historical-read
+consent collected in step 1 (which only let AKA _read_ the local transcripts), so
+it needs its own explicit grant. Before running the pipe, state plainly what
+leaves the machine, then use **AskUserQuestion** — the built-in picker (never a
+printed numbered list) — to collect the answer.
+
+Say plainly, before the picker: to sort real leaks from routine noise, AKA sends
+each finding's `rawMatch` (the raw detected value) plus the surrounding context
+window to the model API via `claude`. The **`filePath` is not sent**, and any
+secrets detected in that context window are **masked** before it goes — so the
+finding's own value is the only raw value that leaves. Nothing else about the
+finding or the file crosses. Note that masking covers the secrets AKA's rules
+detect; ordinary text in that window travels as-is.
+
+**Send findings to the model to sort real leaks from noise?** — "I'll send each
+detected value, plus a bit of surrounding context with any secrets in it masked,
+to the model to tell real leaks from routine noise. The file path stays local."
+
+- **Yes, send them** — "let the model triage what I found"
+- **No, keep it local** — "skip the model triage and start from the safe defaults"
+
+Present both options flat — this grant sends the user's data off the machine, so
+do **not** mark either one recommended.
+
+**Branch on the choice:**
+
+- **If the user chose "Yes, send them"** — record the model-judge consent, then
+  run the pipe below:
+
+  ```bash
+  node "${CLAUDE_PLUGIN_ROOT}/scripts/onboard.js" --model-judge-consent
+  ```
+
+- **If the user chose "No, keep it local"** — do **not** run the pipe. The judge
+  refuses to run without consent (it would only print a clean skip line), so there
+  is no calibrated plan to confirm. Fall back to the conservative severity floor,
+  tell the user the model triage was skipped, and continue to step 6:
+
+  ```bash
+  node "${CLAUDE_PLUGIN_ROOT}/scripts/onboard.js" --floor
+  ```
+
+  Say plainly: the model triage was declined, so AKA is starting from the
+  conservative severity floor instead of a calibrated posture, and it can be
+  re-run any time with `/aka:setup`. Declining here only skips this run — it does
+  **not** withdraw a grant made earlier; a stored grant is revoked under
+  **Settings → Model-judge consent** in the dashboard. **Skip steps 4 and 5** —
+  there is no plan to confirm — and rejoin the spine at step 6 with **no
+  `--surfaced`** (the same floor-fallback rule step 6 already follows).
+
+On the **Yes, send them** path, pipe the backfill's triage stream straight into
+the `apply-suppressions` adapter in **PREVIEW** mode (no `--confirmed`):
 
 ```bash
 node "${CLAUDE_PLUGIN_ROOT}/scripts/backfill.js" --triage | node "${CLAUDE_PLUGIN_ROOT}/scripts/apply-suppressions.js"
@@ -233,8 +311,11 @@ node "${CLAUDE_PLUGIN_ROOT}/scripts/backfill.js" --triage | node "${CLAUDE_PLUGI
 The backfill sweeps prior Claude Code transcripts (last 30 days, all projects)
 and streams one masked-plus-raw triage hit per line; masked findings are
 recorded to the local store as a side effect. The adapter runs the
-false-positive/severity **judgment in a separate transient subprocess** (no
-transcript), then prints back a **raw-free plan** you can safely show the user:
+false-positive/severity **judgment in separate `claude` subprocesses that send the
+raw hits — each one's value and its surrounding transcript text (other secrets in
+that window masked) — to the model API** (a large history is split into several batches; each asks
+the CLI to write no local transcript), then prints back a **raw-free plan** you
+can safely show the user:
 the calibrated-result card (the real-count headline and the recommended posture),
 the per-category reasoning, the masked false positives it would suppress, any
 categories it skipped, and its notes.
@@ -269,7 +350,8 @@ names its pattern and count from — never invent either off-signal.
 
 Everything you show the user in step 4 comes from **this command's output**. You
 never read the raw finding values yourself — do not echo, quote, or reconstruct
-them; by design they stay inside the isolated subprocess.
+them; the judge subprocesses send them to the model API and return only the
+raw-free plan, so they never enter this conversation.
 
 **Failed or truncated triage — never proceed silently (fallback).** If this
 command exits non-zero, or the adapter reports a truncated / sentinel-less
@@ -685,23 +767,24 @@ interface + terminal dashboard and on-demand scans."
 - **Not now** — "skip — you can add it anytime with the one-liner below"
 
 **Yes, add it** is the install authorization — run the bootstrap installer
-directly, with no second picker (it ensures Node is available and installs the
-global CLI from the public npm registry). Run the line for their OS:
+directly, with no second picker (it downloads the self-contained `aka` binary for
+their platform — no Node.js or npm required — and links it onto PATH). Run the
+line for their OS:
 
 ```bash
 # macOS / Linux
-curl -fsSL https://raw.githubusercontent.com/akasecurity/ai-tc/cli-latest/tools/installer/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.sh | sh
 
 # Windows (PowerShell)
-irm https://raw.githubusercontent.com/akasecurity/ai-tc/cli-latest/tools/installer/install.ps1 | iex
+irm https://raw.githubusercontent.com/akasecurity/ai-tc/bin-latest/tools/installer/install.ps1 | iex
 ```
 
-The one-liner pins to the stable release **tag** (`cli-latest`), never `main` —
-each release points that tag at its published `cli-v*` version, and the bootstrap
-scripts it fetches hold the installer's pinned ref + checksum, so fetching them
-from a mutable branch would defeat the integrity gate. To pin an exact version
-instead, set `AKA_INSTALL_REF=cli-v<version>` before running the line. Until the
-first release is published the one-liner 404s (fail-closed).
+The one-liner pins to the latest published binary release **tag** (`bin-latest`),
+never `main` — each binary release (`bin-v*`) moves that tag to its commit, and
+the installer verifies the downloaded binary against the release's `SHA256SUMS`
+(fail-closed), so a corrupted or tampered download is refused. To pin an exact
+version instead, set `AKA_INSTALL_REF=bin-v<version>` before running the line. If
+no `bin-v*` release exists yet the one-liner fails closed rather than guessing.
 
 After it completes, point them at `aka init` then `aka dashboard`. If they chose
 **Not now**, show the one-liner once so they can add it later, and move on —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/ai-tc-claude-code",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,11 +28,11 @@
     "vitest": "^4.1.10",
     "zod": "^4.0.0",
     "@akasecurity/eslint-config": "0.8.0",
-    "@akasecurity/plugin-sdk": "0.8.0",
     "@akasecurity/persistence": "0.8.0",
-    "@akasecurity/scanner": "0.8.0",
+    "@akasecurity/plugin-runtime": "0.8.0",
+    "@akasecurity/plugin-sdk": "0.8.0",
     "@akasecurity/schema": "0.8.0",
-    "@akasecurity/plugin-runtime": "0.8.0"
+    "@akasecurity/scanner": "0.8.0"
   },
   "scripts": {
     "build": "tsup",