@connexum/ai-governance 1.0.0-beta.11

package/dist/hooks/hook-health-monitor.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+# hook-health-monitor.sh -- Standalone health check for governance hooks.
+#
+# Run periodically (e.g., cron or on session start) to verify:
+#   - All hook files exist and are executable
+#   - Hook files haven't been tampered with (SHA-256 verification)
+#   - Required tools (jq, openssl) are available
+#   - Log directories are writable
+#   - No hooks are missing from the configuration
+#
+# T-049: Hook health monitoring.
+#
+# Usage:
+#   bash hook-health-monitor.sh [--manifest path/to/manifest.json]
+#
+# @connexum/ai-governance
+
+set -euo pipefail
+
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LOG_DIR="${GOVERNANCE_LOG_DIR:-/tmp/governance/logs}"
+MANIFEST_FILE=""
+ERRORS=0
+WARNINGS=0
+
+# Parse args
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --manifest) MANIFEST_FILE="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+mkdir -p "$LOG_DIR"
+
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+REPORT_FILE="$LOG_DIR/hook-health-$(date -u +%Y%m%d).jsonl"
+
+log_check() {
+  local status="$1"
+  local check="$2"
+  local detail="$3"
+
+  echo "{\"timestamp\":\"$TIMESTAMP\",\"status\":\"$status\",\"check\":\"$check\",\"detail\":\"$detail\"}" >> "$REPORT_FILE"
+
+  if [[ "$status" == "FAIL" ]]; then
+    echo "✗ FAIL: $check -- $detail" >&2
+    ((ERRORS++)) || true
+  elif [[ "$status" == "WARN" ]]; then
+    echo "! WARN: $check -- $detail" >&2
+    ((WARNINGS++)) || true
+  else
+    echo "✓ PASS: $check" >&2
+  fi
+}
+
+# --- 1. Check required tools ---
+
+for tool in jq sha256sum; do
+  if command -v "$tool" &>/dev/null; then
+    log_check "PASS" "tool:$tool" "Available"
+  else
+    # sha256sum might be shasum on macOS
+    if [[ "$tool" == "sha256sum" ]] && command -v shasum &>/dev/null; then
+      log_check "PASS" "tool:$tool" "Available (via shasum)"
+    else
+      log_check "WARN" "tool:$tool" "Not found -- some features may not work"
+    fi
+  fi
+done
+
+# --- 2. Check hook files exist and are executable ---
+
+EXPECTED_HOOKS=(
+  # F-NEW-PROBE-2026-05-03: list rebuilt to cover all runtime hooks
+  # shipped with the package. Excludes: hook-utils.sh helper,
+  # hook-wrapper.sh wrapper utility, and install-hooks.sh install-time
+  # scaffold.
+  # 2026-05-12: audit-dir-picker.sh added under F-NEW-CRIT-39g
+  # vendor-neutral audit dir resolution. Total now 13 runtime hooks.
+  "audit-dir-picker.sh"
+  "audit-logger.sh"
+  "cost-budget-gate.sh"
+  "destructive-command-guard.sh"
+  "file-boundary-guard.sh"
+  "file-change-tracker.sh"
+  "governance-file-shield.sh"
+  "governance-integrity-check.sh"
+  "hook-health-monitor.sh"
+  "output-exfiltration-scanner.sh"
+  "secret-leak-scanner.sh"
+  "token-tracker.sh"
+  "web-access-gate.sh"
+)
+
+for hook in "${EXPECTED_HOOKS[@]}"; do
+  HOOK_PATH="$HOOK_DIR/$hook"
+
+  if [[ ! -f "$HOOK_PATH" ]]; then
+    log_check "FAIL" "hook:exists:$hook" "File not found"
+    continue
+  fi
+
+  if [[ ! -r "$HOOK_PATH" ]]; then
+    log_check "FAIL" "hook:readable:$hook" "File not readable"
+    continue
+  fi
+
+  # Check for valid shebang
+  FIRST_LINE=$(head -1 "$HOOK_PATH")
+  if [[ "$FIRST_LINE" != "#!/usr/bin/env bash" && "$FIRST_LINE" != "#!/bin/bash" ]]; then
+    log_check "WARN" "hook:shebang:$hook" "Non-standard shebang: $FIRST_LINE"
+  fi
+
+  log_check "PASS" "hook:exists:$hook" "Present and readable"
+done
+
+# --- 3. SHA-256 integrity verification ---
+
+if [[ -n "$MANIFEST_FILE" && -f "$MANIFEST_FILE" ]]; then
+  if command -v jq &>/dev/null; then
+    # Read expected hashes from manifest
+    while IFS= read -r line; do
+      FILE=$(echo "$line" | jq -r '.file')
+      EXPECTED_HASH=$(echo "$line" | jq -r '.sha256')
+      FULL_PATH="$HOOK_DIR/$FILE"
+
+      if [[ -f "$FULL_PATH" ]]; then
+        if command -v sha256sum &>/dev/null; then
+          ACTUAL_HASH=$(sha256sum "$FULL_PATH" | awk '{print $1}')
+        elif command -v shasum &>/dev/null; then
+          ACTUAL_HASH=$(shasum -a 256 "$FULL_PATH" | awk '{print $1}')
+        else
+          log_check "WARN" "integrity:$FILE" "No hash tool available"
+          continue
+        fi
+
+        if [[ "$ACTUAL_HASH" == "$EXPECTED_HASH" ]]; then
+          log_check "PASS" "integrity:$FILE" "Hash matches"
+        else
+          log_check "FAIL" "integrity:$FILE" "TAMPERED: expected=$EXPECTED_HASH actual=$ACTUAL_HASH"
+        fi
+      fi
+    done < <(jq -c '.hooks[]' "$MANIFEST_FILE" 2>/dev/null)
+  else
+    log_check "WARN" "integrity:manifest" "jq not available, cannot verify manifest"
+  fi
+else
+  log_check "WARN" "integrity:manifest" "No manifest file provided (use --manifest)"
+fi
+
+# --- 4. Check log directories ---
+
+for dir in "$LOG_DIR" "${GOVERNANCE_AUDIT_DIR:-/tmp/governance/audit}"; do
+  if [[ -d "$dir" ]]; then
+    if [[ -w "$dir" ]]; then
+      log_check "PASS" "dir:writable:$dir" "Writable"
+    else
+      log_check "FAIL" "dir:writable:$dir" "Not writable"
+    fi
+  else
+    log_check "WARN" "dir:exists:$dir" "Does not exist (will be created on first use)"
+  fi
+done
+
+# --- 5. Check disk space ---
+
+if command -v df &>/dev/null; then
+  AVAIL_KB=$(df -P "$LOG_DIR" 2>/dev/null | tail -1 | awk '{print $4}')
+  if [[ -n "$AVAIL_KB" ]] && [[ "$AVAIL_KB" -lt 102400 ]]; then
+    log_check "WARN" "disk:space" "Low disk space: ${AVAIL_KB}KB available in $LOG_DIR"
+  else
+    log_check "PASS" "disk:space" "${AVAIL_KB}KB available"
+  fi
+fi
+
+# --- Summary ---
+
+TOTAL=$((ERRORS + WARNINGS))
+echo "" >&2
+echo "Hook Health Summary: ${ERRORS} errors, ${WARNINGS} warnings" >&2
+
+if [[ $ERRORS -gt 0 ]]; then
+  echo "{\"timestamp\":\"$TIMESTAMP\",\"status\":\"UNHEALTHY\",\"errors\":$ERRORS,\"warnings\":$WARNINGS}" >> "$REPORT_FILE"
+  exit 1
+fi
+
+echo "{\"timestamp\":\"$TIMESTAMP\",\"status\":\"HEALTHY\",\"errors\":0,\"warnings\":$WARNINGS}" >> "$REPORT_FILE"
+exit 0

package/dist/hooks/hook-utils.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# hook-utils.sh -- Shared validation for all governance hooks.
+#
+# Source this file at the top of every hook script:
+#   SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+#   source "$SCRIPT_DIR/hook-utils.sh"
+#
+# Provides:
+#   validate_input()  - Read and validate stdin JSON
+#   $HOOK_INPUT       - Validated JSON string
+#   $HOOK_TOOL_NAME   - Extracted tool_name
+#   $HOOK_TOOL_INPUT  - Extracted tool_input
+#
+# @connexum/ai-governance
+
+# Maximum input size (1MB). Larger inputs are rejected to prevent
+# resource exhaustion and buffer overflow in jq processing.
+MAX_INPUT_BYTES=1048576
+
+validate_input() {
+  # Read all stdin
+  HOOK_INPUT=$(cat)
+
+  # Check input size
+  INPUT_SIZE=${#HOOK_INPUT}
+  if [ "$INPUT_SIZE" -gt "$MAX_INPUT_BYTES" ]; then
+    echo "BLOCKED: Hook input exceeds maximum size (${INPUT_SIZE} bytes > ${MAX_INPUT_BYTES} bytes). Possible injection attempt." >&2
+    exit 2
+  fi
+
+  # Check for empty input
+  if [ -z "$HOOK_INPUT" ]; then
+    # No input = nothing to gate
+    exit 0
+  fi
+
+  # Validate JSON structure (jq will fail on non-JSON)
+  if ! echo "$HOOK_INPUT" | jq empty 2>/dev/null; then
+    echo "BLOCKED: Hook input is not valid JSON. Possible injection attempt." >&2
+    exit 2
+  fi
+
+  # Validate expected top-level fields exist
+  HOOK_TOOL_NAME=$(echo "$HOOK_INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+  HOOK_TOOL_INPUT=$(echo "$HOOK_INPUT" | jq -r '.tool_input // empty' 2>/dev/null)
+
+  # Export for use in calling script
+  export HOOK_INPUT
+  export HOOK_TOOL_NAME
+  export HOOK_TOOL_INPUT
+}

package/dist/hooks/hook-wrapper.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# hook-wrapper.sh -- Universal wrapper that respects runtime controls
+# Wraps any governance hook with profile checking and disable controls.
+# Usage: hook-wrapper.sh <actual-hook.sh>
+#
+# Environment variables:
+#   CXNI_HOOK_PROFILE     - minimal|standard|strict (default: standard)
+#   CXNI_DISABLED_HOOKS   - comma-separated list of hook names to skip
+#
+# Part of @connexum/ai-governance
+
+set -uo pipefail
+
+# Get the actual hook to run
+HOOK_SCRIPT="$1"
+shift
+
+if [ ! -f "$HOOK_SCRIPT" ]; then
+  exit 0
+fi
+
+HOOK_NAME=$(basename "$HOOK_SCRIPT" .sh)
+
+# Check if hook is explicitly disabled
+if [ -n "${CXNI_DISABLED_HOOKS:-}" ]; then
+  IFS=',' read -ra DISABLED <<< "$CXNI_DISABLED_HOOKS"
+  for d in "${DISABLED[@]}"; do
+    d=$(echo "$d" | xargs)  # trim whitespace
+    if [ "$d" = "$HOOK_NAME" ]; then
+      exit 0
+    fi
+  done
+fi
+
+# REMOVED: CXNI_MAINTENANCE_MODE bypass (security review 2026-04-17). Maintenance mode must not bypass enforcement.
+
+# Check profile-based activation
+PROFILE="${CXNI_HOOK_PROFILE:-standard}"
+
+# Profile hierarchy: strict includes standard includes minimal
+# Map hooks to minimum profile level
+declare -A HOOK_PROFILES=(
+  ["governance-file-shield"]="minimal"
+  ["secret-leak-scanner"]="minimal"
+  ["destructive-command-guard"]="minimal"
+  ["web-access-gate"]="standard"
+  ["audit-logger"]="standard"
+  ["file-boundary-guard"]="strict"
+  ["cost-budget-gate"]="strict"
+  ["token-tracker"]="strict"
+  ["file-change-tracker"]="strict"
+  ["governance-integrity-check"]="minimal"
+)
+
+REQUIRED_PROFILE="${HOOK_PROFILES[$HOOK_NAME]:-standard}"
+
+# Check if current profile includes this hook's required level
+PROFILE_RANK=0
+case "$PROFILE" in
+  minimal) PROFILE_RANK=1 ;;
+  standard) PROFILE_RANK=2 ;;
+  strict) PROFILE_RANK=3 ;;
+esac
+
+REQUIRED_RANK=0
+case "$REQUIRED_PROFILE" in
+  minimal) REQUIRED_RANK=1 ;;
+  standard) REQUIRED_RANK=2 ;;
+  strict) REQUIRED_RANK=3 ;;
+esac
+
+if [ "$PROFILE_RANK" -lt "$REQUIRED_RANK" ]; then
+  exit 0
+fi
+
+# Run the actual hook
+exec "$HOOK_SCRIPT" "$@"

package/dist/hooks/install-hooks.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# install-hooks.sh -- Installs AI Governance hooks into a Claude Code project
+# Usage: ./install-hooks.sh [--profile minimal|standard|strict] [--project-dir /path]
+#
+# This is the entry point for hook installation. It:
+# 1. Copies hook scripts to .claude/hooks/ (or project-specific location)
+# 2. Registers hooks in settings.json
+# 3. Creates governance config files
+# 4. Makes all hooks executable
+#
+# Part of @connexum/ai-governance
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROFILE="${CXNI_HOOK_PROFILE:-standard}"
+PROJECT_DIR="${1:-.}"
+SETTINGS_FILE=""
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --profile) PROFILE="$2"; shift 2 ;;
+    --project-dir) PROJECT_DIR="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+# Validate profile
+case "$PROFILE" in
+  minimal|standard|strict) ;;
+  *)
+    echo "Error: Invalid profile '$PROFILE'. Use: minimal, standard, strict" >&2
+    exit 1
+    ;;
+esac
+
+echo "Installing AI Governance hooks..."
+echo "  Profile: $PROFILE"
+echo "  Project: $PROJECT_DIR"
+
+# Create directories
+HOOKS_DIR="$PROJECT_DIR/.claude/hooks"
+GOV_DIR="$PROJECT_DIR/.claude/governance"
+AUDIT_DIR="$GOV_DIR/audit"
+mkdir -p "$HOOKS_DIR" "$GOV_DIR" "$AUDIT_DIR" "$GOV_DIR/token-tracking" "$GOV_DIR/file-changes"
+
+# Define hooks by profile
+# Minimal: only critical security hooks
+# Standard: security + audit (recommended)
+# Strict: everything including budget gates and file boundaries
+
+PRETOOL_HOOKS_MINIMAL=(
+  "governance-file-shield.sh"
+  "secret-leak-scanner.sh"
+  "destructive-command-guard.sh"
+)
+
+PRETOOL_HOOKS_STANDARD=(
+  "${PRETOOL_HOOKS_MINIMAL[@]}"
+  "web-access-gate.sh"
+)
+
+PRETOOL_HOOKS_STRICT=(
+  "${PRETOOL_HOOKS_STANDARD[@]}"
+  "file-boundary-guard.sh"
+  "cost-budget-gate.sh"
+)
+
+POSTTOOL_HOOKS_MINIMAL=()
+
+POSTTOOL_HOOKS_STANDARD=(
+  "audit-logger.sh"
+)
+
+POSTTOOL_HOOKS_STRICT=(
+  "audit-logger.sh"
+  "token-tracker.sh"
+  "file-change-tracker.sh"
+)
+
+SESSION_HOOKS=(
+  "governance-integrity-check.sh"
+)
+
+# Select hooks based on profile
+case "$PROFILE" in
+  minimal)
+    PRETOOL_HOOKS=("${PRETOOL_HOOKS_MINIMAL[@]}")
+    POSTTOOL_HOOKS=("${POSTTOOL_HOOKS_MINIMAL[@]+"${POSTTOOL_HOOKS_MINIMAL[@]}"}")
+    ;;
+  standard)
+    PRETOOL_HOOKS=("${PRETOOL_HOOKS_STANDARD[@]}")
+    POSTTOOL_HOOKS=("${POSTTOOL_HOOKS_STANDARD[@]}")
+    ;;
+  strict)
+    PRETOOL_HOOKS=("${PRETOOL_HOOKS_STRICT[@]}")
+    POSTTOOL_HOOKS=("${POSTTOOL_HOOKS_STRICT[@]}")
+    ;;
+esac
+
+# Copy hooks
+INSTALLED=0
+
+for hook in "${PRETOOL_HOOKS[@]}"; do
+  if [ -f "$SCRIPT_DIR/$hook" ]; then
+    cp "$SCRIPT_DIR/$hook" "$HOOKS_DIR/$hook"
+    chmod +x "$HOOKS_DIR/$hook"
+    INSTALLED=$((INSTALLED + 1))
+    echo "  Installed PreToolUse: $hook"
+  fi
+done
+
+for hook in "${POSTTOOL_HOOKS[@]+"${POSTTOOL_HOOKS[@]}"}"; do
+  if [ -n "$hook" ] && [ -f "$SCRIPT_DIR/$hook" ]; then
+    cp "$SCRIPT_DIR/$hook" "$HOOKS_DIR/$hook"
+    chmod +x "$HOOKS_DIR/$hook"
+    INSTALLED=$((INSTALLED + 1))
+    echo "  Installed PostToolUse: $hook"
+  fi
+done
+
+for hook in "${SESSION_HOOKS[@]}"; do
+  if [ -f "$SCRIPT_DIR/$hook" ]; then
+    cp "$SCRIPT_DIR/$hook" "$HOOKS_DIR/$hook"
+    chmod +x "$HOOKS_DIR/$hook"
+    INSTALLED=$((INSTALLED + 1))
+    echo "  Installed SessionStart: $hook"
+  fi
+done
+
+# Create default governance config
+if [ ! -f "$GOV_DIR/protected-files.conf" ]; then
+  cat > "$GOV_DIR/protected-files.conf" << 'CONF'
+# Protected files -- these cannot be modified by AI agents
+# Add one pattern per line. Lines starting with # are comments.
+SOUL.md
+governance.md
+GOVERNANCE_RULES.md
+ROUTING_RULES.md
+agent-web-permissions.md
+web-interaction-security.md
+CONF
+  echo "  Created: protected-files.conf"
+fi
+
+# Create hook profile marker
+echo "$PROFILE" > "$GOV_DIR/.hook-profile"
+
+echo ""
+echo "Installed $INSTALLED hooks ($PROFILE profile)."
+echo ""
+echo "Next steps:"
+echo "  1. Register hooks in your Claude Code settings (see docs)"
+echo "  2. Configure project-boundaries.conf if using strict profile"
+echo "  3. Configure token-budget.json if using cost budget gate"
+echo "  4. Run a session to verify hooks are active"
+echo ""
+echo "Runtime controls:"
+echo "  CXNI_HOOK_PROFILE=minimal|standard|strict"
+echo "  CXNI_DISABLED_HOOKS=comma,separated,hook,names"
+echo "  # REMOVED: CXNI_MAINTENANCE_MODE bypass (security review 2026-04-17). Maintenance mode must not bypass enforcement."

package/dist/hooks/output-exfiltration-scanner.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+# output-exfiltration-scanner.sh -- PostToolUse hook
+#
+# Detects potential data exfiltration attempts in tool outputs:
+#   - Encoded data (base64 blobs, hex dumps)
+#   - Large data volumes in responses
+#   - Sensitive patterns in outputs (credentials, tokens)
+#   - Suspicious URL patterns in outputs
+#
+# T-048: Output exfiltration scanning.
+#
+# @connexum/ai-governance
+
+set -euo pipefail
+
+# Source shared utilities if available
+HOOK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [[ -f "$HOOK_DIR/hook-utils.sh" ]]; then
+  source "$HOOK_DIR/hook-utils.sh"
+fi
+
+# Read input from stdin
+INPUT="$(cat)"
+
+# Extract tool name and output
+TOOL_NAME=""
+TOOL_OUTPUT=""
+
+if command -v jq &>/dev/null; then
+  TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null || true)
+  # F-NEW-CRIT-37: Claude Code's PostToolUse payload uses .tool_response, NOT
+  # .tool_output. Read .tool_response first, falling back to common subfields
+  # (.content, .stdout) and to JSON-stringify when .tool_response is an object
+  # without those fields. Preserve legacy .tool_output / .output for any caller
+  # still using them.
+  TOOL_OUTPUT=$(echo "$INPUT" | jq -r '
+    (.tool_response // null) as $tr |
+    if $tr == null then (.tool_output // .output // empty)
+    elif ($tr | type) == "string" then $tr
+    elif ($tr | type) == "object" then ($tr.content // $tr.stdout // ($tr | tojson))
+    else (.tool_output // .output // empty)
+    end
+  ' 2>/dev/null || true)
+fi
+
+# Skip if no output to scan
+if [[ -z "$TOOL_OUTPUT" ]]; then
+  exit 0
+fi
+
+# --- Exfiltration Detection ---
+
+VIOLATIONS=()
+
+# 1. Large base64 blobs (>500 chars of continuous base64)
+if echo "$TOOL_OUTPUT" | grep -qE '[A-Za-z0-9+/]{500,}={0,2}'; then
+  VIOLATIONS+=("Large base64 blob detected in output (potential encoded data exfiltration)")
+fi
+
+# 2. Long hex dumps (>200 chars of continuous hex)
+if echo "$TOOL_OUTPUT" | grep -qE '([0-9a-fA-F]{2}\s?){100,}'; then
+  VIOLATIONS+=("Large hex dump in output (potential binary data exfiltration)")
+fi
+
+# 3. Credential patterns in output
+if echo "$TOOL_OUTPUT" | grep -qEi '(api[_-]?key|secret[_-]?key|access[_-]?token|bearer|authorization)[[:space:]]*[:=][[:space:]]*[A-Za-z0-9+/_.=-]{20,}'; then
+  VIOLATIONS+=("Credential/token pattern detected in output")
+fi
+
+# 4. AWS-style keys in output
+if echo "$TOOL_OUTPUT" | grep -qE 'AKIA[0-9A-Z]{16}'; then
+  VIOLATIONS+=("AWS access key detected in output")
+fi
+
+# 5. Private key material
+if echo "$TOOL_OUTPUT" | grep -qE -e '-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'; then
+  VIOLATIONS+=("Private key material detected in output")
+fi
+
+# 6. Connection strings with credentials
+if echo "$TOOL_OUTPUT" | grep -qEi '(postgres|mysql|mongodb|redis)://[^:]+:[^@]+@'; then
+  VIOLATIONS+=("Database connection string with credentials in output")
+fi
+
+# 7. JWT tokens (three base64 segments separated by dots)
+if echo "$TOOL_OUTPUT" | grep -qE 'eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}'; then
+  VIOLATIONS+=("JWT token detected in output")
+fi
+
+# --- Report Violations ---
+
+LOG_DIR="${GOVERNANCE_LOG_DIR:-/tmp/governance/logs}"
+mkdir -p "$LOG_DIR"
+LOG_FILE="$LOG_DIR/exfiltration-scan.jsonl"
+
+if [[ ${#VIOLATIONS[@]} -gt 0 ]]; then
+  TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+  for violation in "${VIOLATIONS[@]}"; do
+    # Log the violation
+    echo "{\"timestamp\":\"$TIMESTAMP\",\"tool\":\"$TOOL_NAME\",\"violation\":\"$violation\",\"action\":\"WARN\"}" >> "$LOG_FILE"
+
+    # Write warning to stderr (visible to operator)
+    echo "⚠ EXFILTRATION WARNING: $violation (tool: $TOOL_NAME)" >&2
+  done
+
+  # We WARN but don't block -- PostToolUse can't prevent output
+  # that's already been generated. The warning creates an audit trail.
+  exit 0
+fi
+
+exit 0

package/dist/hooks/powershell/audit-dir-picker.ps1

@@ -0,0 +1,72 @@
+# audit-dir-picker.ps1 -- Vendor-neutral audit directory selection.
+#
+# Dot-source this file then call Get-AuditDir; the picked path is
+# returned to the pipeline. Caller captures it:
+#   $auditDir = Get-AuditDir
+#
+# Selection order (highest to lowest priority):
+#   1. CXNI_AUDIT_DIR env var (operator override; always wins).
+#   2. Active-IDE detection: scan CWD for IDE marker dirs in
+#      preference order. First match wins. Each maps to its
+#      conventional dir under the IDE namespace.
+#        .claude/    -> .claude/governance/audit/    (Claude Code)
+#        .cursor/    -> .cursor/governance/audit/    (Cursor)
+#        .continue/  -> .continue/governance/audit/  (Continue)
+#        .cody/      -> .cody/governance/audit/      (Sourcegraph Cody)
+#        .aider/     -> .aider/governance/audit/     (Aider)
+#        .gemini/    -> .gemini/governance/audit/    (Gemini Code Assist)
+#   3. Vendor-neutral fallback: .governance/audit/
+#   4. Legacy alias: GOVERNANCE/audit/ (only if it already exists,
+#      so existing customers do not lose their history; new installs
+#      never get this).
+#
+# F-NEW-CRIT-39g foundation: closes the Claude-Code-specific lock-in
+# in the bash hooks so non-Claude IDEs on Windows can install
+# governance without a stray .claude/ dir polluting their project.
+#
+# Mirrors src/hooks/audit-dir-picker.sh exactly (same selection
+# order, same fallback chain). Tested by tests/powershell-hooks.test.ts
+# parity assertion.
+#
+# @connexum/ai-governance F-NEW-CRIT-39g
+
+# IDE marker dirs in preference order. First match in CWD wins.
+# Order rationale: Claude Code first because it is the most-deployed
+# adapter today; the rest in alphabetical order so the choice is
+# predictable when multiple IDE markers are present.
+$Script:CXNI_IDE_MARKERS = @(
+    ".claude",
+    ".cursor",
+    ".continue",
+    ".cody",
+    ".aider",
+    ".gemini"
+)
+
+function Get-AuditDir {
+    [CmdletBinding()]
+    param()
+
+    # 1. Operator override.
+    $override = $env:CXNI_AUDIT_DIR
+    if ($override) {
+        return $override
+    }
+
+    # 2. Active-IDE detection.
+    foreach ($marker in $Script:CXNI_IDE_MARKERS) {
+        if (Test-Path -Path $marker -PathType Container) {
+            return "$marker/governance/audit"
+        }
+    }
+
+    # 4. Legacy alias: only if it already has content. Prevents new
+    # installs from creating GOVERNANCE/ while letting existing customers
+    # keep writing to it.
+    if (Test-Path -Path "GOVERNANCE/audit" -PathType Container) {
+        return "GOVERNANCE/audit"
+    }
+
+    # 3. Vendor-neutral fallback.
+    return ".governance/audit"
+}