ashlr-plugin 1.36.4

package/docs/policy-packs.md

@@ -0,0 +1,188 @@
+# Policy Packs
+
+Policy packs let a team admin define allow, deny, and require-confirmation rules for tool calls. The server distributes the current pack to every org member; the `policy-enforce` hook applies the rules client-side before any tool runs.
+
+---
+
+## Rule syntax
+
+Each rule has three fields:
+
+| Field   | Type                          | Description                                      |
+|---------|-------------------------------|--------------------------------------------------|
+| `match` | glob string                   | Pattern matched against the tool call (see below)|
+| `kind`  | `"tool"` / `"path"` / `"shell"` | What the pattern is matched against            |
+| `reason`| string (optional)             | Human-readable explanation shown when blocked    |
+
+### Kinds
+
+**`tool`** — matches against the tool name.
+
+```yaml
+match: "mcp__ashlr-*"
+kind: tool
+```
+
+Matches any ashlr MCP tool. Since the v1.13 router consolidation the canonical prefix is `mcp__plugin_ashlr_ashlr__ashlr__*` (e.g. `mcp__plugin_ashlr_ashlr__ashlr__edit`). Patterns like `mcp__ashlr-*` still match the legacy form seen in older transcripts; prefer `mcp__plugin_ashlr_*` for new policies.
+
+**`path`** — matches against file path arguments (`file_path`, `path`, `file`).
+
+```yaml
+match: "/etc/*"
+kind: path
+reason: "System files require manual review"
+```
+
+Blocks or confirms any tool call whose path argument matches `/etc/*`.
+
+**`shell`** — matches against the `command` argument of Bash calls.
+
+```yaml
+match: "Bash(rm *)"
+kind: shell
+reason: "Deletions not permitted in CI"
+```
+
+The `Bash(...)` wrapper is optional syntax sugar; the inner pattern is matched against the raw command string.
+
+---
+
+## Precedence
+
+Rules are evaluated in this order — **first match wins per tier**:
+
+```
+deny  >  requireConfirm  >  allow
+```
+
+If a call matches a `deny` rule it is blocked regardless of any `allow` rule. If it matches `requireConfirm` (and no `deny` rule), Claude prompts the user before proceeding. `allow` rules have no enforcement effect on their own — they exist as documentation and for future audit filtering.
+
+### Example
+
+```yaml
+rules:
+  deny:
+    - match: "Bash(rm *)"
+      kind: shell
+      reason: "No deletions — use the trash instead"
+    - match: "/etc/*"
+      kind: path
+      reason: "System files are read-only"
+  requireConfirm:
+    - match: "Write"
+      kind: tool
+    - match: "/home/*/prod-*"
+      kind: path
+  allow:
+    - match: "mcp__ashlr-*"
+      kind: tool
+    - match: "Read"
+      kind: tool
+```
+
+With this policy:
+
+- `Bash(rm -rf /tmp)` → **blocked** (deny shell rule)
+- `Edit(/etc/hosts)` → **blocked** (deny path rule)
+- `Write(/home/alice/prod-config.yaml)` → **confirm** (requireConfirm path rule takes effect after deny check passes)
+- `Write(/home/alice/dev-notes.md)` → **confirm** (requireConfirm tool rule)
+- `Read(anything)` → **allowed** (no deny or requireConfirm match)
+- `mcp__plugin_ashlr_ashlr__ashlr__read` → **allowed**
+
+---
+
+## YAML upload format
+
+POST to `/policy/upload` with `Content-Type: application/json`:
+
+```json
+{
+  "orgId": "your-org-id",
+  "name": "default",
+  "rules": {
+    "allow": [
+      { "match": "Read", "kind": "tool" },
+      { "match": "mcp__ashlr-*", "kind": "tool" }
+    ],
+    "deny": [
+      { "match": "Bash(rm *)", "kind": "shell", "reason": "No deletions" },
+      { "match": "/etc/*", "kind": "path", "reason": "System files locked" }
+    ],
+    "requireConfirm": [
+      { "match": "Write", "kind": "tool" },
+      { "match": "/home/*/prod-*", "kind": "path" }
+    ]
+  }
+}
+```
+
+The server creates a new version number on each upload. The current pointer is updated automatically.
+
+---
+
+## Versioning and rollback
+
+Every upload creates an immutable versioned snapshot. To see recent versions:
+
+```
+GET /policy/history
+```
+
+Response:
+```json
+[
+  { "packId": "...", "name": "default", "version": 3, "author": "alice@co.com", "createdAt": "..." },
+  { "packId": "...", "name": "default", "version": 2, "author": "bob@co.com",   "createdAt": "..." },
+  { "packId": "...", "name": "default", "version": 1, "author": "alice@co.com", "createdAt": "..." }
+]
+```
+
+To roll back:
+
+```json
+POST /policy/rollback
+{
+  "packId": "<id of the v1 pack>",
+  "toVersion": 1
+}
+```
+
+This sets the current pointer to the v1 pack. No data is deleted — all versions remain in history.
+
+---
+
+## Client-side enforcement
+
+The `hooks/policy-enforce.ts` hook fires on every `Edit`, `Write`, `Bash`, `MultiEdit`, and ashlr-edit call (PreToolUse). It:
+
+1. Fetches `/policy/current` (cached for 5 minutes in `/tmp`).
+2. Evaluates rules in precedence order.
+3. On a `deny` match: writes `{"type":"block","reason":"..."}` to stdout and exits 2 — the tool is cancelled.
+4. On a `requireConfirm` match: writes `{"permissionDecision":"ask","reason":"..."}` to stdout — Claude prompts the user.
+5. On allow / no match: exits 0 silently.
+
+### Kill switch
+
+Set `ASHLR_POLICY_ENFORCE=0` to disable enforcement entirely (useful for break-glass situations or local dev).
+
+### Requirements
+
+- `ASHLR_PRO_TOKEN` must be set.
+- User's org must be on the `team` tier or higher.
+- No policy configured → all tools allowed (fail-open).
+- Network errors → fail-open (tool proceeds, error is not surfaced).
+
+---
+
+## Glob syntax
+
+Patterns use [minimatch](https://github.com/isaacs/minimatch) glob syntax:
+
+| Pattern           | Matches                                         |
+|-------------------|-------------------------------------------------|
+| `mcp__ashlr-*`    | Any tool starting with `mcp__ashlr-`            |
+| `Edit`            | Exactly the Edit tool                           |
+| `/etc/*`          | Any path directly under `/etc/`                 |
+| `/etc/**`         | Any path anywhere under `/etc/`                 |
+| `Bash(rm *)`      | Any Bash command starting with `rm `            |
+| `**/prod-*`       | Any path segment containing `prod-` prefix      |

package/docs/press-kit/fact-sheet.md

@@ -0,0 +1,78 @@
+# Fact sheet — ashlr-plugin
+
+Quick-reference for journalists and analysts.
+
+---
+
+| Field | Value |
+|---|---|
+| **Product name** | ashlr-plugin |
+| **Current version** | 1.36.0 |
+| **Release date** | June 2026 |
+| **Repository** | github.com/ashlrai/ashlr-plugin |
+| **License** | MIT |
+| **Website** | plugin.ashlr.ai |
+| **Category** | Codex plugin / Claude Code plugin / AI coding tool / MCP server |
+| **Primary use case** | Token-efficiency layer for Codex and Claude Code |
+
+---
+
+## Technical
+
+| Field | Value |
+|---|---|
+| **MCP tools** | 40 |
+| **Skills / slash commands** | 34 Claude Code slash commands + Codex workflow skills |
+| **Test count** | 860 pass, 2 skip, 0 fail |
+| **Test files** | 55 |
+| **Codebase (plugin repo)** | 750 files, 149,462 LOC in the latest self-repo benchmark artifact |
+| **Runtime** | Bun >= 1.3 |
+| **Benchmark: overall savings** | −57% cross-language mean token reduction |
+| **Benchmark: read savings** | −82.2% mean |
+| **Benchmark: grep savings** | −81.7% mean |
+| **Benchmark methodology** | scripts/run-benchmark.ts; weekly CI refresh; docs/benchmarks-v2.json |
+| **Compatible hosts** | Codex, Claude Code, Cursor (via MCP), Goose (via recipe), generic MCP hosts |
+
+---
+
+## Team
+
+| Field | Value |
+|---|---|
+| **Team size** | 1 (solo founder) |
+| **Founder** | Mason Wyatt |
+| **Contact** | support@ashlr.ai |
+| **Press contact** | support@ashlr.ai |
+
+---
+
+## Pricing
+
+| Tier | Price | Notes |
+|---|---|---|
+| Free | $0 forever | Full plugin, MIT, no feature gates |
+| Pro | $12/month or $120/year | Cloud genome sync, hosted LLM summarizer, cross-machine stats |
+| Team | $24/user/month or $20/user/month annual (min 3 users) | E2E-encrypted shared team genome (vclock LWW + manual conflict resolution), org dashboard, policy packs, SSO, audit log |
+| Enterprise | Contact sales | On-prem, private inference, dedicated SLA |
+
+---
+
+## Key claims (all traceable)
+
+| Claim | Source |
+|---|---|
+| −57% cross-language token savings | docs/benchmarks.md, multi-repo reference set |
+| −82.2% read savings | docs/benchmarks-v2.json, aggregate.ashlr__read.mean = 0.178 → 1 − 0.178 = 82.2% |
+| −81.7% grep savings | docs/benchmarks-v2.json, aggregate.ashlr__grep.mean = 0.183 → 1 − 0.183 = 81.7% |
+| 860 passing tests | CHANGELOG.md [1.4.0] Tests section |
+| 40 MCP tools | README.md tool table |
+| 34 slash commands + Codex skills | docs/pricing.md + `.codex-plugin/plugin.json` |
+| MIT license | LICENSE file |
+
+---
+
+## Known limitations
+
+- 2 tests skipped: `no-genome grep` environment-leak flake and a benchmark ratio assertion (same root cause). Both pass in isolation; documented in-line.
+- `rg` binary sensitivity: benchmark rg-resolution walks multiple candidate paths but may require `rg` to be a plain system binary in some environments.
+- Small edits (< ~30 chars): `ashlr__edit` diff-summary overhead exceeds naive payload; ratio is 2.5x in the small-edit benchmark bucket.

package/docs/press-kit/founder-bio.md

@@ -0,0 +1,3 @@
+# Founder bio — Mason Wyatt
+
+Mason Wyatt is the founder of ashlr and a principal at Evero Consulting. He built ashlr after noticing that Claude Code's native file-reading and search tools were shipping full payloads — entire source files, complete grep output — into model context on every call, driving token bills up on real codebases without a corresponding benefit to output quality. He shipped the plugin from v0.1 to production in a single week, building a reproducible benchmark harness alongside the tools so every claimed savings number is auditable and refreshed weekly by CI. He can be reached at support@ashlr.ai.

package/docs/press-kit/logo.svg

@@ -0,0 +1,33 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 48" fill="none">
+  <defs>
+    <linearGradient id="logo-grad" x1="0" y1="0" x2="32" y2="32" gradientUnits="userSpaceOnUse">
+      <stop offset="0%" stop-color="#c2410c"/>
+      <stop offset="100%" stop-color="#8B2E1A"/>
+    </linearGradient>
+  </defs>
+
+  <!-- Icon mark: ledger square -->
+  <rect x="0" y="8" width="32" height="32" rx="6" fill="#1a0f0c"/>
+  <rect x="0.75" y="8.75" width="30.5" height="30.5" rx="5.5" fill="none" stroke="url(#logo-grad)" stroke-opacity="0.3" stroke-width="1.5"/>
+  <!-- Ledger lines -->
+  <line x1="6" y1="18" x2="26" y2="18" stroke="url(#logo-grad)" stroke-opacity="0.4" stroke-width="1"/>
+  <line x1="6" y1="24" x2="26" y2="24" stroke="url(#logo-grad)" stroke-opacity="0.55" stroke-width="1"/>
+  <line x1="6" y1="30" x2="26" y2="30" stroke="url(#logo-grad)" stroke-opacity="0.7" stroke-width="1"/>
+  <!-- Brand square -->
+  <rect x="6" y="10" width="7" height="7" fill="url(#logo-grad)"/>
+  <!-- Row dots -->
+  <circle cx="23" cy="24" r="2" fill="url(#logo-grad)"/>
+  <circle cx="23" cy="30" r="2" fill="url(#logo-grad)" opacity="0.65"/>
+
+  <!-- Wordmark -->
+  <!-- Uses a system-font fallback; replace with Fraunces webfont embedding for print use -->
+  <text
+    x="44"
+    y="33"
+    font-family="Georgia, 'Times New Roman', serif"
+    font-weight="300"
+    font-size="28"
+    letter-spacing="-0.5"
+    fill="#F3EADB"
+  >ashlr</text>
+</svg>

package/docs/press-kit/screenshots.md

@@ -0,0 +1,146 @@
+# Screenshots — ashlr v1.4.0 launch
+
+Ordered by priority. Capture in order; use the listed commands to reproduce exactly.
+
+---
+
+## 1. Status line — active session
+
+**What to show:** The Claude Code terminal footer with the ashlr status line, showing a real session counter, sparkline, and the `↑` activity indicator.
+
+**Environment:** Terminal (iTerm2 or similar), dark or light, full-width.
+
+**Command to reproduce:**
+```bash
+# Fire a few tool calls first to get a non-zero session counter
+# Then the status line updates automatically within ~550ms
+# Widen terminal to at least 120 columns for full display
+```
+
+**Expected visual:**
+```
+ashlr · 7d ▁▂▃▅▇█ · session ↑+48.2K · lifetime +2.1M
+```
+The gradient shimmer should be mid-sweep. The `↑` activity indicator should be lit (orange, fading to the brand dark). Sparkline should show meaningful variation across the 7 bars.
+
+**Capture notes:** 1280px wide minimum. Retina / 2x preferred.
+
+---
+
+## 2. /ashlr-savings dashboard
+
+**What to show:** The full `/ashlr-savings` ASCII output — per-tool rows, dollar amounts, sparkline, session and lifetime totals.
+
+**Environment:** Terminal.
+
+**Command to reproduce:**
+```bash
+# Inside Claude Code after a real session with tool calls:
+/ashlr-savings
+```
+
+**Expected visual:**
+```
+Session savings  ·  ashlr-plugin v1.4.0
+────────────────────────────────────────
+  ashlr__read      6 calls    −42,180 tok   $0.13
+  ashlr__grep      3 calls    −11,040 tok   $0.03
+  ashlr__edit      2 calls     −3,200 tok   $0.01
+  ─────────────────────────────────────────────
+  Session total               −56,420 tok   $0.17
+  Lifetime total             −284,900 tok   $0.86
+  7-day sparkline   ▁▂▃▃▅▆█
+```
+Numbers should be real (not zero). At least 3 tools with non-zero rows.
+
+---
+
+## 3. /ashlr-dashboard — watch mode
+
+**What to show:** The full ASCII dashboard with bar chart, sparklines, and projected annual line.
+
+**Environment:** Terminal, dark preferred for contrast.
+
+**Command to reproduce:**
+```bash
+bun run ~/.claude/plugins/cache/ashlr-marketplace/ashlr/1.4.0/scripts/savings-dashboard.ts --watch
+```
+
+**Expected visual:** Three tiles across the top (session / lifetime / best day), bar chart with at least 3 rows, 7-day and 30-day sparklines, the Fraunces-style projected annual line at the bottom. Colors intact — `--watch` mode live-redraws every 1.5s; capture a mid-redraw frame if possible.
+
+---
+
+## 4. Before/after comparison — single file
+
+**What to show:** Side-by-side of raw vs ashlr output for `server/tests/auth.test.ts`. Demonstrates the 85% token reduction on a real file.
+
+**Environment:** Terminal or static image composition.
+
+**Numbers (from docs/benchmarks-v2.json):**
+- Raw: 10,846 bytes / 2,709 tokens
+- ashlr: 1,623 bytes / 406 tokens
+- Ratio: 0.150 (85% reduction)
+
+**Command to reproduce:**
+```bash
+# Raw (native Read):
+# Read server/tests/auth.test.ts
+# ↑ shows full file, ~10,846 bytes in context
+
+# ashlr:
+# ashlr__read { "path": "server/tests/auth.test.ts" }
+# ↑ shows head + elision marker + tail, ~1,623 bytes
+```
+
+**Expected visual:** Two terminal panels. Left: raw output scrolling to show full length. Right: ashlr output — compact, with the `[... N lines elided ...]` marker visible. Token counts shown as labels below each panel.
+
+---
+
+## 5. Benchmarks page — browser
+
+**What to show:** `plugin.ashlr.ai/benchmarks` with the −57% cross-language number prominent, per-tool breakdown bars, and the methodology section.
+
+**Environment:** Browser, parchment background, 1280x800 viewport.
+
+**Command to reproduce:**
+```bash
+# Navigate to: https://plugin.ashlr.ai/benchmarks
+# Or locally: cd site && bun run dev, then open /benchmarks
+```
+
+**Expected visual:** The large −57% number above the fold. Per-tool bars showing read/grep/edit breakdown. The CI badge showing the last benchmark run. Methodology panel visible on scroll. Parchment grain texture intact.
+
+**Capture notes:** Full-page screenshot preferred. Above-the-fold crop also useful as a thumbnail.
+
+---
+
+## 6. Compare page — browser
+
+**What to show:** `plugin.ashlr.ai/compare` with the four-column comparison table. The ashlr column highlighted in the debit red.
+
+**Environment:** Browser, 1440px wide preferred to show all four columns without horizontal scroll.
+
+**Command to reproduce:**
+```bash
+# Navigate to: https://plugin.ashlr.ai/compare
+# Or locally: cd site && bun run dev, then open /compare
+```
+
+**Expected visual:** Table with group headers (Compression / Architecture / Observability / etc.), the ashlr column with a subtle red tint, `+` marks in green for ashlr, `unknown` in muted ink for WOZCODE where data is not published.
+
+---
+
+## 7. Landing page hero
+
+**What to show:** The `plugin.ashlr.ai` landing page hero — the large display number, the animated SVG terminal mock, and the install command.
+
+**Environment:** Browser, 1440px wide.
+
+**Command to reproduce:**
+```bash
+# Navigate to: https://plugin.ashlr.ai
+```
+
+**Expected visual:** The −57% number in Fraunces display weight, the stamp animation in mid-rotate, the terminal mock SVG showing the sparkline and counter. The parchment background with grain. The install command block visible below the fold.
+
+**Capture notes:** Catch the hero at the moment the stamp-rotate animation is at ~45 degrees for the most dynamic still.