@akasecurity/ai-tc-claude-code 0.9.7 → 0.9.9

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "aka",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code. Detection runs locally; events are recorded to a local SQLite store on your machine.",
   "homepage": "https://github.com/akasecurity/ai-tc",
   "author": { "name": "AKA Security" }

package/README.md

@@ -7,9 +7,9 @@
 
 The Claude Code plugin for **[AI Traffic Control](https://github.com/akasecurity/ai-tc)** (`ai-tc`). It hooks into a Claude Code session and inspects its traffic — prompts, tool calls, tool results, file reads — scanning each event against your rule packs and applying inline **warn / redact / block** policies. Every event is recorded to a local SQLite store at `~/.aka/data/aka.db`.
 
-Detection runs entirely on your machine. There's no account and no backend — nothing is sent anywhere to be scanned.[^egress]
+Detection runs entirely on your machine. Standalone by default — no account and no backend, and nothing is sent anywhere to be scanned.[^egress]
 
-[^egress]: Live detection and enforcement run locally. The one exception is the **opt-in** `/aka:setup` calibration below: to rate what an initial history scan finds, its judge step sends those findings to the model API through the `claude` CLI — the same provider your Claude session already uses, reached with your own credentials. For each finding that means the raw (unmasked) value including any secret, roughly 120 characters of the surrounding transcript text on either side (re-scanned before it goes, so every secret the rules detect in that window is masked, including the finding's own value where it appears there), the finding's rule, category, severity, masked value and confidence, and a sequential counter the model echoes back so its verdict can be matched to the finding. The source file's path is not sent. It takes **two** separate opt-ins — one to read your history at all, and a second, distinct grant to send what was found — and without the second the judge does not run. It keeps those values out of your local Claude transcript, but a copy of them does leave the machine. Withdrawing either grant stops future scans; it cannot recall what was already sent.
+[^egress]: Live detection and enforcement run locally, on every install and whatever else is configured. Two things can send anything off the machine, and both are opt-in. The first is the **opt-in** `/aka:setup` calibration below: to rate what an initial history scan finds, its judge step sends those findings to the model API through the `claude` CLI — the same provider your Claude session already uses, reached with your own credentials. For each finding that means the raw (unmasked) value including any secret, roughly 120 characters of the surrounding transcript text on either side (re-scanned before it goes, so every secret the rules detect in that window is masked, including the finding's own value where it appears there), the finding's rule, category, severity, masked value and confidence, and a sequential counter the model echoes back so its verdict can be matched to the finding. The source file's path is not sent. It takes **two** separate opt-ins — one to read your history at all, and a second, distinct grant to send what was found — and without the second the judge does not run. It keeps those values out of your local Claude transcript, but a copy of them does leave the machine. Withdrawing either grant stops future scans; it cannot recall what was already sent. The second is attaching this machine to an AKA deployment your organization runs (`aka attach`), after which the plugin forwards the activity that deployment is entitled to see and enforces the policy it sets — which can raise enforcement beyond your own settings but never lower it. Nothing is forwarded until both an endpoint and an access key are on disk; `aka status` says what a machine is attached to and `aka detach` ends it.
 
 The local store keeps your prompts and tool calls verbatim apart from the spans a rule masks, and file permissions — not encryption — are all that protect it. See [Data at rest](https://github.com/akasecurity/ai-tc/blob/main/SECURITY.md#data-at-rest) for which files it spans and what holds on Windows.
 

package/hooks/hooks.json

@@ -67,6 +67,28 @@
           }
         ]
       }
+    ],
+    "PreModelSwitch": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/pre-model-switch.js\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "PostModelSwitch": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"${CLAUDE_PLUGIN_ROOT}/scripts/post-model-switch.js\"",
+            "timeout": 10
+          }
+        ]
+      }
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@akasecurity/ai-tc-claude-code",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "AI Traffic Control — inspect and govern AI prompts in Claude Code",
   "license": "Apache-2.0",
   "type": "module",
@@ -22,19 +22,19 @@
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "@vitest/coverage-v8": "^4.1.10",
+    "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^9.39.5",
     "tsup": "^8.0.0",
     "typescript": "^5.8.0",
-    "vitest": "^4.1.10",
-    "zod": "^4.0.0",
+    "vitest": "^4.1.11",
+    "zod": "^4.5.4",
     "@akasecurity/eslint-config": "0.8.0",
     "@akasecurity/plugin-runtime": "0.8.0",
     "@akasecurity/persistence": "0.8.0",
     "@akasecurity/plugin-sdk": "0.8.0",
     "@akasecurity/schema": "0.8.0",
-    "@akasecurity/setup-wizard": "0.8.0",
-    "@akasecurity/scanner": "0.8.0"
+    "@akasecurity/scanner": "0.8.0",
+    "@akasecurity/setup-wizard": "0.8.0"
   },
   "scripts": {
     "build": "tsup",