@akasecurity/ai-tc-claude-code 0.9.11 → 0.9.13

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aka",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code. Detection runs locally; events are recorded to a local SQLite store on your machine.",
   "homepage": "https://github.com/akasecurity/ai-tc",
   "author": { "name": "AKA Security" }

package/commands/scan.md

@@ -23,7 +23,7 @@ cryptography, hardcoded credentials, dev-mode configuration leaks, and other
 OWASP Top 10 issues.
 
 Results are recorded to the local store (`~/.aka/data/aka.db`) and are visible
-via `/findings`. Re-running `/aka:scan` is safe — files whose content has already
+via `/aka:findings`. Re-running `/aka:scan` is safe — files whose content has already
 been recorded are skipped.
 
 Files excluded by the repo's `.gitignore` are **still scanned** — local scratch

package/commands/setup.md

@@ -885,10 +885,38 @@ what happened, show the one-liner so they can retry later, and continue the
 wizard normally. The plugin is already fully set up and works on its own; a
 failed CLI install changes nothing about that.
 
-**Close the wizard.** The first-run summary already confirmed the saved posture
-and pointed at `/health`. Whichever way the CLI offer went — installed,
-declined, or a failed install you already reported — end with one warm close:
+**Close the wizard.** The first-run summary already confirmed the saved posture,
+reported the health score, and pointed at `/aka:dashboard` · `/aka:scan`.
+Whichever way the CLI offer went — installed, declined, or a failed install you
+already reported — end with one warm close:
 "That's it — I'm watching out for Claude going forward."
 
 Before you finish, confirm every AKA_SHOW region on the path you took was
 relayed to the user. If you summarized one instead of pasting it, paste it now.
+
+## Known limitations
+
+Reference, not a step. Be honest about these if the user asks why something was
+not caught; never imply coverage this plugin does not have.
+
+**A redact policy cannot mask text that EXECUTES, and what happens instead is a
+setting.** Rewriting a shell command would silently change what runs, and a
+masked URL requests a different resource — so on `Bash` and on `WebFetch`'s
+`url` there is no safe way to carry out a redact. **An MCP payload leaf is in
+the same class, for a different reason:** the schema belongs to the server, so a
+string there could be a body, a query or a command and this plugin cannot tell
+which — it is treated as executable rather than guessed at. What applies in
+place of the redact is the workspace's **redact fallback** (`redactFallback` in
+`~/.aka/settings/settings.json`, or pinned for a machine by an administrator).
+
+It ships as **warn**: the command runs, or the request goes out, with the value
+unmasked, and AKA says so in the session. Set it to **block** for the stricter
+behaviour, where the call is denied and the message explains what to remove.
+This matters most on `WebFetch`, because a request that has left cannot be
+recalled and no later hook can help.
+
+Data fields are unaffected either way — `Write`, `Edit`, `WebFetch`'s analysis
+prompt — and keep true redaction, including the reversible vault rewrite where
+vault consent is on file. Whichever path applies, the
+recorded finding carries the action that actually happened, never a "redact"
+that did not.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/ai-tc-claude-code",
-  "version": "0.9.11",
+  "version": "0.9.13",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code",
   "license": "Apache-2.0",
   "type": "module",
@@ -28,8 +28,8 @@
     "typescript": "^5.8.0",
     "vitest": "^4.1.11",
     "zod": "^4.5.4",
-    "@akasecurity/persistence": "0.8.0",
     "@akasecurity/plugin-runtime": "0.8.0",
+    "@akasecurity/persistence": "0.8.0",
     "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/plugin-sdk": "0.8.0",
     "@akasecurity/scanner": "0.8.0",