@akasecurity/ai-tc-claude-code 0.9.6 → 0.9.8

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aka",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code. Detection runs locally; events are recorded to a local SQLite store on your machine.",
   "homepage": "https://github.com/akasecurity/ai-tc",
   "author": { "name": "AKA Security" }

package/README.md

@@ -7,9 +7,9 @@
 
 The Claude Code plugin for **[AI Traffic Control](https://github.com/akasecurity/ai-tc)** (`ai-tc`). It hooks into a Claude Code session and inspects its traffic — prompts, tool calls, tool results, file reads — scanning each event against your rule packs and applying inline **warn / redact / block** policies. Every event is recorded to a local SQLite store at `~/.aka/data/aka.db`.
 
-Detection runs entirely on your machine. There's no account and no backend — nothing is sent anywhere to be scanned.[^egress]
+Detection runs entirely on your machine. Standalone by default — no account and no backend, and nothing is sent anywhere to be scanned.[^egress]
 
-[^egress]: Live detection and enforcement run locally. The one exception is the **opt-in** `/aka:setup` calibration below: to rate what an initial history scan finds, its judge step sends those findings to the model API through the `claude` CLI — the same provider your Claude session already uses, reached with your own credentials. For each finding that means the raw (unmasked) value including any secret, roughly 120 characters of the surrounding transcript text on either side (re-scanned before it goes, so every secret the rules detect in that window is masked, including the finding's own value where it appears there), the finding's rule, category, severity, masked value and confidence, and a sequential counter the model echoes back so its verdict can be matched to the finding. The source file's path is not sent. It takes **two** separate opt-ins — one to read your history at all, and a second, distinct grant to send what was found — and without the second the judge does not run. It keeps those values out of your local Claude transcript, but a copy of them does leave the machine. Withdrawing either grant stops future scans; it cannot recall what was already sent.
+[^egress]: Live detection and enforcement run locally, on every install and whatever else is configured. Two things can send anything off the machine, and both are opt-in. The first is the **opt-in** `/aka:setup` calibration below: to rate what an initial history scan finds, its judge step sends those findings to the model API through the `claude` CLI — the same provider your Claude session already uses, reached with your own credentials. For each finding that means the raw (unmasked) value including any secret, roughly 120 characters of the surrounding transcript text on either side (re-scanned before it goes, so every secret the rules detect in that window is masked, including the finding's own value where it appears there), the finding's rule, category, severity, masked value and confidence, and a sequential counter the model echoes back so its verdict can be matched to the finding. The source file's path is not sent. It takes **two** separate opt-ins — one to read your history at all, and a second, distinct grant to send what was found — and without the second the judge does not run. It keeps those values out of your local Claude transcript, but a copy of them does leave the machine. Withdrawing either grant stops future scans; it cannot recall what was already sent. The second is attaching this machine to an AKA deployment your organization runs (`aka attach`), after which the plugin forwards the activity that deployment is entitled to see and enforces the policy it sets — which can raise enforcement beyond your own settings but never lower it. Nothing is forwarded until both an endpoint and an access key are on disk; `aka status` says what a machine is attached to and `aka detach` ends it.
 
 The local store keeps your prompts and tool calls verbatim apart from the spans a rule masks, and file permissions — not encryption — are all that protect it. See [Data at rest](https://github.com/akasecurity/ai-tc/blob/main/SECURITY.md#data-at-rest) for which files it spans and what holds on Windows.
 

package/commands/setup.md

@@ -892,26 +892,3 @@ declined, or a failed install you already reported — end with one warm close:
 
 Before you finish, confirm every AKA_SHOW region on the path you took was
 relayed to the user. If you summarized one instead of pasting it, paste it now.
-
-## Known limitations
-
-Be honest about every one of these if the user asks why something wasn't caught
-— never imply coverage this plugin does not have.
-
-**The model-judge step in step 3 cannot run on native Windows.** The judge
-spawns the `claude` CLI through a shell-free `execFileSync`, and an
-npm-installed CLI is a `.cmd` shim on Windows, which Node has refused to spawn
-without a shell since the CVE-2024-27980 fix. So a user who grants model-judge
-consent gets a spawn failure at that step rather than a rated set of findings,
-and the step exits non-zero instead of completing. Everything before it is
-unaffected — the posture check, the consent-gated historical read, and the local
-ruleset scan all run, and every finding is still detected and redacted locally.
-What is unavailable is only the model pass that rates false positives and
-severity.
-
-Say this plainly if a Windows user asks why setup stopped there, and do not
-offer to retry it: the fix is a code change, tracked separately. Two things
-worth getting right if it comes up — running under WSL2 is Linux rather than
-Windows and is not affected, and declining model-judge consent in step 1 is not
-a workaround so much as the other supported path, since the local scan is what
-produces the findings in the first place.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/ai-tc-claude-code",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code",
   "license": "Apache-2.0",
   "type": "module",
@@ -22,17 +22,18 @@
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "eslint": "^9.0.0",
+    "@vitest/coverage-v8": "^4.1.10",
+    "eslint": "^9.39.5",
     "tsup": "^8.0.0",
     "typescript": "^5.8.0",
     "vitest": "^4.1.10",
     "zod": "^4.0.0",
-    "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/persistence": "0.8.0",
-    "@akasecurity/plugin-sdk": "0.8.0",
+    "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/scanner": "0.8.0",
-    "@akasecurity/schema": "0.8.0",
     "@akasecurity/plugin-runtime": "0.8.0",
+    "@akasecurity/plugin-sdk": "0.8.0",
+    "@akasecurity/schema": "0.8.0",
     "@akasecurity/setup-wizard": "0.8.0"
   },
   "scripts": {