@akasecurity/ai-tc-claude-code 0.9.4 → 0.9.6

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aka",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code. Detection runs locally; events are recorded to a local SQLite store on your machine.",
   "homepage": "https://github.com/akasecurity/ai-tc",
   "author": { "name": "AKA Security" }

package/README.md

@@ -11,6 +11,8 @@ Detection runs entirely on your machine. There's no account and no backend — n
 
 [^egress]: Live detection and enforcement run locally. The one exception is the **opt-in** `/aka:setup` calibration below: to rate what an initial history scan finds, its judge step sends those findings to the model API through the `claude` CLI — the same provider your Claude session already uses, reached with your own credentials. For each finding that means the raw (unmasked) value including any secret, roughly 120 characters of the surrounding transcript text on either side (re-scanned before it goes, so every secret the rules detect in that window is masked, including the finding's own value where it appears there), the finding's rule, category, severity, masked value and confidence, and a sequential counter the model echoes back so its verdict can be matched to the finding. The source file's path is not sent. It takes **two** separate opt-ins — one to read your history at all, and a second, distinct grant to send what was found — and without the second the judge does not run. It keeps those values out of your local Claude transcript, but a copy of them does leave the machine. Withdrawing either grant stops future scans; it cannot recall what was already sent.
 
+The local store keeps your prompts and tool calls verbatim apart from the spans a rule masks, and file permissions — not encryption — are all that protect it. See [Data at rest](https://github.com/akasecurity/ai-tc/blob/main/SECURITY.md#data-at-rest) for which files it spans and what holds on Windows.
+
 ## Install
 
 This package is distributed through the **Claude Code plugin marketplace**, not `npm install`. Add the marketplace and install the plugin from inside Claude Code:
@@ -50,6 +52,8 @@ The plugin installs Claude Code hooks that run locally with no `node_modules`, a
 
 It also adds slash commands for reports and setup (`/aka:health`, `/aka:findings`, `/aka:dashboard`, and more).
 
+The plugin works standalone, and governs what a session carries: rule packs, findings, policy, and an audit trail. To harden the harness itself — safe-default permissions, structural command guards, and credential deny rules — pair it with [claude-tools](https://github.com/akasecurity/claude-tools). They compose: claude-tools hardens the harness, `ai-tc` governs the traffic.
+
 ## Docs
 
 Full documentation and the built-in detection catalog live at **[akasecurity.github.io/ai-tc-docs](https://akasecurity.github.io/ai-tc-docs/)**.

package/commands/setup.md

@@ -892,3 +892,26 @@ declined, or a failed install you already reported — end with one warm close:
 
 Before you finish, confirm every AKA_SHOW region on the path you took was
 relayed to the user. If you summarized one instead of pasting it, paste it now.
+
+## Known limitations
+
+Be honest about every one of these if the user asks why something wasn't caught
+— never imply coverage this plugin does not have.
+
+**The model-judge step in step 3 cannot run on native Windows.** The judge
+spawns the `claude` CLI through a shell-free `execFileSync`, and an
+npm-installed CLI is a `.cmd` shim on Windows, which Node has refused to spawn
+without a shell since the CVE-2024-27980 fix. So a user who grants model-judge
+consent gets a spawn failure at that step rather than a rated set of findings,
+and the step exits non-zero instead of completing. Everything before it is
+unaffected — the posture check, the consent-gated historical read, and the local
+ruleset scan all run, and every finding is still detected and redacted locally.
+What is unavailable is only the model pass that rates false positives and
+severity.
+
+Say this plainly if a Windows user asks why setup stopped there, and do not
+offer to retry it: the fix is a code change, tracked separately. Two things
+worth getting right if it comes up — running under WSL2 is Linux rather than
+Windows and is not affected, and declining model-judge consent in step 1 is not
+a workaround so much as the other supported path, since the local scan is what
+produces the findings in the first place.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/ai-tc-claude-code",
-  "version": "0.9.4",
+  "version": "0.9.6",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code",
   "license": "Apache-2.0",
   "type": "module",
@@ -29,10 +29,11 @@
     "zod": "^4.0.0",
     "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/persistence": "0.8.0",
+    "@akasecurity/plugin-sdk": "0.8.0",
     "@akasecurity/scanner": "0.8.0",
+    "@akasecurity/schema": "0.8.0",
     "@akasecurity/plugin-runtime": "0.8.0",
-    "@akasecurity/plugin-sdk": "0.8.0",
-    "@akasecurity/schema": "0.8.0"
+    "@akasecurity/setup-wizard": "0.8.0"
   },
   "scripts": {
     "build": "tsup",