@compr/opscontext-mcp 2.0.2 → 2.1.1

package/CHANGELOG.md

@@ -2,6 +2,83 @@
 
 All notable changes to OpsContext for AI Agents (previously ContextEngine — MCP server + CLI) are documented here.
 
+## [2.1.1] — 2026-06-23 — Phase 1c: one-command install + Claude Code terminal capture
+
+Closes the last surface gap from 2.1.0. Before this patch, "use OpsContext" meant running `nohup npx ...` every time the Mac restarted and hand-editing `~/.claude/settings.json` to wire Claude Code hooks. Now both are single commands. This is the release that lets non-technical users actually adopt OpsContext.
+
+### Added
+- **`src/install-autostart.ts`** (LOCK `[AUTOSTART-INSTALL]`) — installs a macOS LaunchAgent at `~/Library/LaunchAgents/com.opscontext.mcp.plist`. Set-and-forget — server starts at every login, KeepAlive restarts on crash, logs to `~/.contextengine/logs/mcp-{stdout,stderr}.log`. Companion `uninstall-autostart` + `autostart-status` commands. Auto-detects either a global npm install or a dev tree; pins node path absolutely (launchd has no PATH).
+- **`src/install-claude-hook.ts`** (LOCK `[CLAUDE-HOOK-INSTALL]`) — copies `defaults/claude-code-hook.sh` to `~/.claude/hooks/opscontext-emit.sh` and splices three entries into `~/.claude/settings.json` under `hooks`: `UserPromptSubmit` → `vscode.prompt_submit`, `PostToolUse` (`.*` matcher) → `vscode.tool_call`, `SessionStart` → `vscode.session_start`. **Idempotent + preserves every existing hook entry** (backs up settings.json before any change). Closes the terminal-side capture gap — every Claude Code session in any project now feeds the audit log.
+- **`defaults/claude-code-hook.sh`** — the actual shell hook: ~3 KB, pure bash + jq + curl, ~28 ms latency per invocation, **silent on every failure** (never blocks Claude Code), 1-second hard timeout on the HTTP call. Posts to `127.0.0.1:7842/events` with shared secret in `X-OpsContext-Secret` header. LOCK `[OPSCONTEXT-CC-HOOK]`.
+- **New CLI subcommands:**
+  - `opscontext install-autostart [--force]`
+  - `opscontext uninstall-autostart`
+  - `opscontext autostart-status`
+  - `opscontext install-claude-hook`
+  - `opscontext uninstall-claude-hook`
+
+### Fixed
+- **`chrome-extension/src/options/options.html`** — Secret field placeholder said `32 hex chars` but the actual secret is 64 hex (256-bit). Updated to `64 hex chars` to match what `init-extension-secret` writes. No backwards-compat issue — placeholder text only, not validation.
+- **`chrome-extension` content scripts now bundled as IIFE** (companion `@compr/opscontext-chrome@0.1.1`). The MV3 manifest can't put `"type": "module"` on `content_scripts` entries — only on `background`. The previous build shipped `dist/content/claude.js` with top-level `import` statements which Chrome silently rejected, dark-launching the entire capture surface (Options page still saved the secret fine because popup/options DO support modules via inline `<script type="module">`). New `scripts/bundle-content.mjs` runs esbuild after `tsc` to inline all `./shared/*` and `../lib/*` imports into a single IIFE per content entry. LOCK `[CONTENT-SCRIPT-BUNDLE]`. Reload the unpacked extension after rebuild for the fix to take effect.
+
+### Why this matters
+- Before: `nohup npx -y --package=@compr/opscontext-mcp@2.1.0 -- opscontext > /tmp/opscontext-mcp.log 2>&1 < /dev/null &` every reboot, plus hand-editing JSON for Claude Code hooks. Friction kills adoption.
+- After: `opscontext install-autostart && opscontext install-claude-hook`. Two commands, ever. Server auto-starts at login forever; terminal Claude Code sessions feed audit log automatically.
+
+### Architecture notes
+- Hook namespace stays `vscode.*` (not `claude_code.*`) so the published 2.1.0 detector heuristics fire today without a parallel namespace migration. `payload.surface = "claude-code"` disambiguates source for any caller that cares.
+- LaunchAgent uses `gui/$UID` domain (per-user, no root) — same pattern as the user's existing `com.invocme.backup-*` plists.
+- Hook deliberately emits on PostToolUse ONLY (not PreToolUse) — emitting both would double-count for the `stuck` heuristic and skew `silent_failure` counts.
+- All transport via HTTP `POST /events` not direct file writes — keeps event writes serialized through the running MCP server's single in-process chain cache, sidestepping the historic concurrent-write race (8 chain breaks on 2026-06-10/11, all `system` actor, all pre-flag-day; zero breaks since).
+
+### Known surface gaps still open
+- `Stop` hook event not emitted (would enable "assistant gave up mid-task" detection — Phase 3.1).
+- No Linux support yet for `install-autostart` (systemd --user unit equivalent is ~30 min of work).
+- No tool-result exit codes from VS Code extension yet (candidate for vscode-ext 0.10).
+
+## [2.1.0] — 2026-06-23 — Phase 1: cross-surface capture + drift detector + local event ingest
+
+The first feature release after the OpsContext rebrand. Closes the wedge the audit identified: **no other tool captures AI interactions across browser + IDE + terminal and feeds them into a tamper-evident audit log with policy enforcement**. Now we do.
+
+### Added
+- **`src/http-server.ts`** (LOCK `[HTTP-EVENT-INGEST]`) — local event-ingest HTTP endpoint at `http://127.0.0.1:7842`. The browser extension and the VS Code extension POST batched events here; the MCP server validates and appends them to the existing hash-chained audit log via `safeAppend()`.
+  - `POST /events` — schema-validated batched events (max 50 events, 64 KB body). Event-kind allowlist: `^(browser|vscode|cli)\.` — system kinds like `learning.save` can only come from the local writer, never the network. Auth via shared 32-byte hex secret at `~/.contextengine/extension-secret` (mode 0600), compared in constant time.
+  - `GET /health` — unauthenticated liveness probe.
+  - Bound to `127.0.0.1` ONLY — never `0.0.0.0`. LAN devices cannot inject audit events.
+  - Hot-reload of the secret on every request — `init-extension-secret --force` rotates without restarting MCP.
+  - Started automatically at MCP boot. Gracefully degrades on port conflict (`OPSCONTEXT_EVENT_PORT=<n>` to override).
+- **`src/detector.ts`** (LOCK `[DRIFT-HEURISTICS]`) — 8-heuristic drift / loop / fabrication detector.
+  - **loop** (warn): same prompt sent 3+ times in 5 min (Jaccard > 0.6 token overlap)
+  - **stuck** (warn): identical tool call 3+ times in 5 min
+  - **context_bloat** (warn): session > 80K tokens with no `session.save` event
+  - **fabrication_suspect** (critical): assistant response cites `file.ext:NN` that doesn't exist on disk
+  - **drift** (info): per-session, last 3 prompts have joint Jaccard < 0.10 against the session's first prompt
+  - **no_insight** (info): 30+ tool calls since the last `learning.save`
+  - **silent_failure** (critical): same tool returns error 3+ times in 5 min
+  - **stale_doc_signal**: stubbed (Phase 3.1; reads `policy.json` `doc_coverage`)
+  - `watchAuditLog()` uses `fs.watch` + 250 ms debounce + in-memory LRU dedupe (100 entries) so the same signal doesn't fire every poll cycle.
+  - Auto-emits `drift.detected` audit records for each fired signal — alerting itself is auditable.
+- **`contextengine watch`** CLI — streams alerts as they fire. Supports `--json` (NDJSON for log aggregators), `--severity info|warn|critical` (floor filter), `--once` (single-scan exit, code 2 if any critical signal — usable in CI), `--window SECONDS`.
+- **`contextengine init-extension-secret`** CLI — generates a 32-byte hex secret at `~/.contextengine/extension-secret` (mode 0600). Refuses by default if one already exists (`--force` to rotate).
+- **`contextengine emit-event <kind> <payload-json> [--actor NAME]`** CLI — appends a single event to the audit log. Used by the VS Code extension `0.9.0` for `vscode.prompt_submit` and `vscode.tool_call` events. Also useful for custom integrations and scripted tests.
+- **`drift_status` MCP tool** — agents can call this between major task phases to self-check active signals. Returns "pause and surface to the human" guidance if any critical signal is active.
+
+### Audit-log event types added (additive — no breaking changes)
+- `browser.prompt`, `browser.response`, `browser.tool_call`, `browser.session_start`, `browser.session_end`, `browser.capture_miss`
+- `vscode.prompt_submit`, `vscode.tool_call`, `vscode.session_start`
+- `drift.detected`, `notification.fired`
+
+### Tests
+- **14 new tests** in `tests/detector.test.ts` with 11 hand-written NDJSON fixtures in `tests/__fixtures__/audit-logs/`. One catalog test per heuristic + its negative ("similar prompts" fires loop; "different prompts" doesn't). Plus 2 integration tests on `detect()` and evidence cap.
+- **196 / 196 tests passing total** (was 182).
+
+### Companion release
+- **`@compr/opscontext-chrome@0.1.0`** — new Chrome extension scaffold under `chrome-extension/`. Captures Claude.ai + ChatGPT prompts/responses/tool-calls, streams them via the new `POST /events` endpoint. Not yet on the Chrome Web Store; loadable unpacked via `chrome://extensions` → Developer mode → "Load unpacked" → pick `chrome-extension/dist/`. BSL-1.1 license; selector seeds attributed to MIT prior art in `chrome-extension/LICENSE_THIRD_PARTY.md`.
+- **`css-llc.contextengine@0.9.0`** — VS Code extension companion release that emits `vscode.prompt_submit` and `vscode.tool_call` events into the audit log via the new `emit-event` CLI.
+
+### Day-1 test plan
+[`docs/test-plans/PHASE1_DAY1.md`](docs/test-plans/PHASE1_DAY1.md) — 10-step, ~15-minute end-to-end verification. Starts with `init-extension-secret`, ends with deliberate `fabrication_suspect` + `silent_failure` triggers verifying `watch` exits code 2.
+
 ## [2.0.2] — 2026-06-11 — HTML score report browser tab title → OpsContext
 
 Tiny patch release. One change:

package/defaults/claude-code-hook.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# OpsContext — Claude Code hook emitter
+#
+# 🔒 LOCKED [OPSCONTEXT-CC-HOOK] — 2026-06-23
+# ⛔ NEVER block on success or fail loudly. Claude Code waits for hooks to
+#    complete before continuing — any error must exit 0 + silent.
+# ⛔ NEVER emit on PreToolUse. PostToolUse alone — PreToolUse would double-
+#    count vs PostToolUse for the `stuck` heuristic and skew `silent_failure`.
+# ⛔ NEVER print to stdout (would be interpreted as a hook decision message).
+# WHY: This hook is the ONLY way Claude Code terminal sessions get into the
+#    OpsContext audit log. If it's slow or breaks, the user disables it and
+#    loses cross-surface drift visibility — the entire wedge collapses.
+# FIX: To support a new Claude Code hook event, add a case branch. Keep the
+#    exit-0-on-any-error discipline. Events go via HTTP (NOT direct file
+#    write) so the running MCP server's in-process chain cache prevents the
+#    concurrent-write race.
+
+set +e
+
+EVENT_KIND="${1:-}"
+SECRET_FILE="$HOME/.contextengine/extension-secret"
+ENDPOINT="${OPSCONTEXT_EVENT_URL:-http://127.0.0.1:7842/events}"
+
+# Bail fast if not initialized — never block Claude Code
+[ -r "$SECRET_FILE" ] || exit 0
+SECRET=$(cat "$SECRET_FILE" 2>/dev/null)
+[ -n "$SECRET" ] || exit 0
+
+INPUT=$(cat)
+[ -n "$INPUT" ] || exit 0
+
+NOW=$(date -u +%Y-%m-%dT%H:%M:%S.000Z)
+
+case "$EVENT_KIND" in
+  UserPromptSubmit)
+    PAYLOAD=$(printf '%s' "$INPUT" | jq -c --arg ts "$NOW" '{
+      v: 1, ts: $ts, event: "vscode.prompt_submit", actor: "claude-code",
+      payload: {
+        surface: "claude-code",
+        text: ((.prompt // "")[:4000]),
+        session: (.session_id // ""),
+        cwd: (.cwd // ""),
+        char_count: ((.prompt // "") | length)
+      }
+    }' 2>/dev/null)
+    ;;
+  PostToolUse)
+    PAYLOAD=$(printf '%s' "$INPUT" | jq -c --arg ts "$NOW" '{
+      v: 1, ts: $ts, event: "vscode.tool_call", actor: "claude-code",
+      payload: ({
+        surface: "claude-code",
+        tool: (.tool_name // ""),
+        args_preview: (
+          (.tool_input.command
+            // .tool_input.file_path
+            // .tool_input.pattern
+            // (.tool_input | tostring)
+            // ""
+          )[:200]
+        ),
+        session: (.session_id // ""),
+        cwd: (.cwd // "")
+      } + (
+        if (.tool_response.is_error == true)
+            or ((.tool_response.error // "") != "")
+            or ((.tool_response.interrupt // false) == true)
+        then { error: ((.tool_response.error
+                        // (.tool_response.content | tostring)
+                        // "tool reported error")[:500]) }
+        else {}
+        end
+      ))
+    }' 2>/dev/null)
+    ;;
+  SessionStart)
+    PAYLOAD=$(printf '%s' "$INPUT" | jq -c --arg ts "$NOW" '{
+      v: 1, ts: $ts, event: "vscode.session_start", actor: "claude-code",
+      payload: {
+        surface: "claude-code",
+        session: (.session_id // ""),
+        cwd: (.cwd // ""),
+        source: (.source // "")
+      }
+    }' 2>/dev/null)
+    ;;
+  *)
+    exit 0
+    ;;
+esac
+
+[ -n "$PAYLOAD" ] || exit 0
+
+# POST with 1s hard timeout. Any error → silent (curl >/dev/null 2>&1, exit 0).
+curl -sS --max-time 1.0 \
+  -H "Content-Type: application/json" \
+  -H "X-OpsContext-Secret: $SECRET" \
+  --data "{\"events\":[$PAYLOAD]}" \
+  "$ENDPOINT" >/dev/null 2>&1
+
+exit 0

package/dist/audit.d.ts

@@ -1,4 +1,4 @@
-export type AuditEvent = "learning.save" | "learning.delete" | "learning.import" | "session.save" | "session.delete" | "activation.activate" | "activation.deactivate" | "activation.heartbeat" | "activation.signature_reject" | "activation.legacy_signature" | "firewall.escalate" | "hook.block" | "hook.bypass";
+export type AuditEvent = "learning.save" | "learning.delete" | "learning.import" | "session.save" | "session.delete" | "activation.activate" | "activation.deactivate" | "activation.heartbeat" | "activation.signature_reject" | "activation.legacy_signature" | "firewall.escalate" | "hook.block" | "hook.bypass" | "browser.prompt" | "browser.response" | "browser.tool_call" | "browser.session_start" | "browser.session_end" | "browser.capture_miss" | "vscode.prompt_submit" | "vscode.tool_call" | "vscode.session_start" | "drift.detected" | "notification.fired";
 export interface AuditRecord {
     ts: string;
     event: AuditEvent;

package/dist/cli.js

@@ -1212,6 +1212,193 @@ tamper-evident audit log at ~/.contextengine/audit.log.`);
     console.error(`Unknown hook subcommand: ${sub}. Try 'contextengine hook --help'.`);
     process.exit(1);
 }
+async function cliEmitEvent(args) {
+    const { safeAppend } = await import("./audit.js");
+    const help = args.includes("-h") || args.includes("--help");
+    if (help || args.length < 2) {
+        console.log(`Usage: contextengine emit-event <event-kind> <payload-json> [--actor NAME]
+
+Appends a single event to the hash-chained audit log. Useful for VS Code
+extensions, custom integrations, or scripted test scenarios.
+
+  event-kind    One of: browser.* / vscode.* / cli.* / learning.* / etc.
+  payload-json  A JSON object describing the event. Will be validated as
+                a Record<string, unknown>.
+  --actor NAME  Override the actor field. Defaults to 'cli'.
+
+Examples:
+  contextengine emit-event vscode.tool_call '{"tool":"Edit","args_preview":"file=src/x.ts"}'
+  contextengine emit-event browser.prompt   '{"surface":"claude.ai","text":"hello","char_count":5}' --actor browser-ext
+
+The event becomes a regular audit-chain record (prev_hash + hash added by
+safeAppend), visible via 'contextengine audit-verify' and consumed by the
+'contextengine watch' detector + 'drift_status' MCP tool.`);
+        process.exit(help ? 0 : 1);
+    }
+    const eventKind = args[0];
+    const payloadJson = args[1];
+    let actor = "cli";
+    for (let i = 2; i < args.length; i++) {
+        if (args[i] === "--actor" && args[i + 1])
+            actor = args[++i];
+    }
+    let payload;
+    try {
+        const parsed = JSON.parse(payloadJson);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("payload must be a JSON object (not array, not primitive)");
+        }
+        payload = parsed;
+    }
+    catch (e) {
+        console.error(`Bad payload JSON: ${e instanceof Error ? e.message : String(e)}`);
+        process.exit(1);
+    }
+    // Cast — the audit module accepts any string for the event field; the
+    // AuditEvent union is documentation, not enforcement. Validation of
+    // "what's a valid event kind" is the caller's responsibility (the HTTP
+    // server enforces a prefix allow-list; this CLI is trusted).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    safeAppend(eventKind, payload, actor);
+    console.log(`✅ Appended ${eventKind} to audit log.`);
+}
+async function cliWatch(args) {
+    const { watchAuditLog, detect } = await import("./detector.js");
+    let jsonMode = false;
+    let once = false;
+    let minSeverity = "info";
+    let windowSeconds = 300;
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--json")
+            jsonMode = true;
+        else if (a === "--once")
+            once = true;
+        else if (a === "--severity" && args[i + 1]) {
+            const sev = args[++i];
+            if (sev !== "info" && sev !== "warn" && sev !== "critical") {
+                console.error(`Unknown severity: ${sev}. Try info|warn|critical.`);
+                process.exit(1);
+            }
+            minSeverity = sev;
+        }
+        else if (a === "--window" && args[i + 1]) {
+            windowSeconds = parseInt(args[++i], 10) || 300;
+        }
+        else if (a === "-h" || a === "--help") {
+            console.log(`Usage: contextengine watch [--json] [--severity info|warn|critical] [--once] [--window SECONDS]
+
+Streams drift / hallucination / loop / stuck-tool / context-bloat alerts as
+they're detected in ~/.contextengine/audit.log.
+
+  --json              One line of NDJSON per alert (for log aggregators / jq).
+  --severity X        Floor filter. Default: info (everything).
+  --once              Run a single scan over the recent window and exit.
+                      Good for cron / health checks.
+  --window SECONDS    How far back to scan in --once mode. Default: 300.
+
+Exit codes:
+  0   clean (or --once found no critical signals)
+  2   --once found at least one critical signal — useful in CI pipelines
+
+Signals also append a 'drift.detected' record to the audit log (hash-chained)
+so the alerting itself is auditable.
+
+Status-bar / OS-notification integration is via the VS Code extension —
+this CLI is for terminal users, CI, and cron.`);
+            return;
+        }
+    }
+    const sevOrder = { info: 0, warn: 1, critical: 2 };
+    const passesFilter = (s) => sevOrder[s.severity] >= sevOrder[minSeverity];
+    const fmt = (s) => {
+        if (jsonMode) {
+            return JSON.stringify({
+                ts: new Date(s.detectedAt).toISOString(),
+                kind: s.kind,
+                severity: s.severity,
+                reason: s.reason,
+                payload: s.payload,
+            });
+        }
+        const sev = s.severity === "critical" ? "CRIT " : s.severity === "warn" ? "WARN " : "INFO ";
+        const t = new Date(s.detectedAt).toISOString().slice(11, 19);
+        return `[${t}] ${sev} ${s.kind.padEnd(20)} ${s.reason}`;
+    };
+    if (once) {
+        const signals = detect({ windowSeconds }).filter(passesFilter);
+        for (const s of signals) {
+            console.log(fmt(s));
+        }
+        const hasCritical = signals.some((s) => s.severity === "critical");
+        process.exit(hasCritical ? 2 : 0);
+    }
+    if (!jsonMode) {
+        console.error("[opscontext watch] streaming drift signals (Ctrl-C to exit)…");
+    }
+    const dispose = watchAuditLog((s) => {
+        if (passesFilter(s))
+            console.log(fmt(s));
+    }, { windowSeconds });
+    process.on("SIGINT", () => {
+        dispose();
+        if (!jsonMode)
+            console.error("\n[opscontext watch] stopped.");
+        process.exit(0);
+    });
+    // Keep alive — the watcher uses internal timers, but a stdin listener also
+    // helps catch terminal closes.
+    process.stdin.resume();
+}
+async function cliInitExtensionSecret(args) {
+    const force = args.includes("--force") || args.includes("-f");
+    const help = args.includes("-h") || args.includes("--help");
+    if (help) {
+        console.log(`Usage: contextengine init-extension-secret [--force]
+
+Generates a 32-byte hex token at ~/.contextengine/extension-secret (mode 0600)
+and prints it to stdout. The OpsContext browser extension reads the same
+token from its options page; both sides must match for events to flow.
+
+  --force, -f   Overwrite an existing secret. Default is to refuse if one
+                already exists (prevents accidental rotation that would
+                disconnect the extension until it's re-pasted).
+
+After running, paste the printed value into the extension's Options page
+(Cmd+Shift+P → "Open extension options" in Chrome, or click the extension
+icon → Options).`);
+        return;
+    }
+    const { randomBytes } = await import("crypto");
+    const { writeFileSync, existsSync, chmodSync, mkdirSync } = await import("fs");
+    const { join } = await import("path");
+    const { homedir } = await import("os");
+    const dir = join(homedir(), ".contextengine");
+    const path = join(dir, "extension-secret");
+    if (existsSync(path) && !force) {
+        console.error(`❌ ${path} already exists. Re-running would invalidate any extension that already has the old value pasted in.\n` +
+            `\n` +
+            `   Pass --force to rotate (you'll need to re-paste the new value in the extension's Options page).\n` +
+            `   Or read the current secret with: cat ${path}`);
+        process.exit(1);
+    }
+    mkdirSync(dir, { recursive: true });
+    const secret = randomBytes(32).toString("hex");
+    writeFileSync(path, secret + "\n", { mode: 0o600 });
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* best-effort */ }
+    console.log(`✅ Wrote ${path} (mode 600)\n`);
+    console.log(`Secret (paste this into the browser extension's Options page):\n`);
+    console.log(`  ${secret}\n`);
+    console.log(`Next steps:`);
+    console.log(`  1. Open Chrome → chrome://extensions → Find "OpsContext Browser Capture"`);
+    console.log(`  2. Click "Options" → paste the secret → Save`);
+    console.log(`  3. Visit https://claude.ai or https://chatgpt.com — events will flow.`);
+    console.log(`\nThe MCP server's event-ingest endpoint is at http://127.0.0.1:7842/events`);
+    console.log(`(GET /health to verify it's running).`);
+}
 async function cliPolicy(args) {
     const sub = args[0];
     if (!sub || sub === "-h" || sub === "--help") {
@@ -1595,6 +1782,17 @@ Usage:
   contextengine audit-verify           Verify audit log chain integrity (tamper detection)
   contextengine policy <validate|show> [args]
                                        Author + validate the declarative .contextengine/policy.json
+  contextengine init-extension-secret [--force]
+                                       Generate ~/.contextengine/extension-secret for the browser ext
+  contextengine install-autostart [--force]
+                                       Install macOS LaunchAgent so MCP server auto-starts at login
+                                       (uninstall-autostart / autostart-status — companion commands)
+  contextengine install-claude-hook    Wire Claude Code terminal sessions into the OpsContext audit log
+                                       (UserPromptSubmit + PostToolUse + SessionStart hook entries)
+  contextengine watch [--json] [--severity info|warn|critical] [--once] [--window SECONDS]
+                                       Stream drift / loop / stuck-tool / fabrication alerts from the audit log
+  contextengine emit-event <kind> <payload-json> [--actor NAME]
+                                       Append a single event to the audit log (for integrations / scripted tests)
   contextengine hook <secret-scan|doc-coverage>
                                        Run policy-driven pre-commit checks against staged diff
                                        (exit 1 on blocking violation; CE_JSON=1 for CI output)
@@ -1793,6 +1991,54 @@ else if (command === "activate") {
         process.exit(1);
     });
 }
+else if (command === "emit-event") {
+    cliEmitEvent(process.argv.slice(3)).catch((err) => {
+        console.error("Error:", err);
+        process.exit(1);
+    });
+}
+else if (command === "watch") {
+    cliWatch(process.argv.slice(3)).catch((err) => {
+        console.error("Error:", err);
+        process.exit(1);
+    });
+}
+else if (command === "init-extension-secret") {
+    cliInitExtensionSecret(process.argv.slice(3)).catch((err) => {
+        console.error("Error:", err);
+        process.exit(1);
+    });
+}
+else if (command === "install-autostart") {
+    import("./install-autostart.js").then((m) => m.cliInstallAutostart(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "uninstall-autostart") {
+    import("./install-autostart.js").then((m) => m.cliUninstallAutostart(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "autostart-status") {
+    import("./install-autostart.js").then((m) => m.cliAutostartStatus(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "install-claude-hook") {
+    import("./install-claude-hook.js").then((m) => m.cliInstallClaudeHook(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
+else if (command === "uninstall-claude-hook") {
+    import("./install-claude-hook.js").then((m) => m.cliUninstallClaudeHook(process.argv.slice(3))).catch((err) => {
+        console.error("Error:", err instanceof Error ? err.message : err);
+        process.exit(1);
+    });
+}
 else if (command === "stats") {
     cliStats();
 }

package/dist/detector.d.ts

@@ -0,0 +1,64 @@
+import { type AuditRecord, type AuditEvent } from "./audit.js";
+export type DriftKind = "loop" | "stuck" | "context_bloat" | "fabrication_suspect" | "drift" | "no_insight" | "stale_doc_signal" | "silent_failure";
+export type Severity = "info" | "warn" | "critical";
+export interface DriftSignal {
+    kind: DriftKind;
+    severity: Severity;
+    reason: string;
+    evidence: AuditRecord[];
+    payload: Record<string, unknown>;
+    detectedAt: number;
+}
+export interface DetectorOptions {
+    /** Window in seconds for event scan. Default 300 (5 min). */
+    windowSeconds?: number;
+    /** Inject a "now" for deterministic tests. */
+    now?: number;
+    /** Inject the events instead of reading from disk (for tests). */
+    events?: AuditRecord[];
+    /** Project root for fabrication_suspect file-existence checks. */
+    cwd?: string;
+}
+export declare function scanRecentEvents(windowSeconds?: number, now?: number): AuditRecord[];
+/** Tokenize text for cheap similarity comparisons (Jaccard / BM25-lite). */
+export declare function tokens(s: string): Set<string>;
+export declare function jaccard(a: Set<string>, b: Set<string>): number;
+declare function detectLoop(events: AuditRecord[]): DriftSignal | null;
+declare function detectStuck(events: AuditRecord[], now: number): DriftSignal | null;
+declare function detectContextBloat(events: AuditRecord[]): DriftSignal | null;
+declare function detectFabrication(events: AuditRecord[], cwd: string): DriftSignal | null;
+declare function detectDrift(events: AuditRecord[]): DriftSignal | null;
+declare function detectNoInsight(events: AuditRecord[]): DriftSignal | null;
+declare function detectSilentFailure(events: AuditRecord[], now: number): DriftSignal | null;
+declare function detectStaleDocSignal(_events: AuditRecord[]): DriftSignal | null;
+export declare function runHeuristics(events: AuditRecord[], opts?: {
+    now?: number;
+    cwd?: string;
+}): DriftSignal[];
+/** Convenience for callers: scan recent events and run heuristics in one call. */
+export declare function detect(opts?: DetectorOptions): DriftSignal[];
+/**
+ * Watch the audit log and fire `onAlert` for each new signal. Dedupe key is
+ * `kind:reason` kept in an in-memory LRU bounded at 100 entries — prevents
+ * the same drift from firing every poll cycle.
+ *
+ * Returns a dispose function. Caller is responsible for handling SIGINT
+ * cleanly.
+ */
+export declare function watchAuditLog(onAlert: (s: DriftSignal) => void, opts?: {
+    windowSeconds?: number;
+    debounceMs?: number;
+    emitAuditEvent?: boolean;
+}): () => void;
+export declare const _internal: {
+    detectLoop: typeof detectLoop;
+    detectStuck: typeof detectStuck;
+    detectContextBloat: typeof detectContextBloat;
+    detectFabrication: typeof detectFabrication;
+    detectDrift: typeof detectDrift;
+    detectNoInsight: typeof detectNoInsight;
+    detectSilentFailure: typeof detectSilentFailure;
+    detectStaleDocSignal: typeof detectStaleDocSignal;
+};
+export type { AuditRecord, AuditEvent };
+//# sourceMappingURL=detector.d.ts.map