envseed 0.1.0

package/bin/propensity-monitor.mjs

@@ -0,0 +1,897 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs';
+import path from 'node:path';
+import https from 'node:https';
+
+const DATA_DIR = path.join(process.env.HOME, '.propensity-monitor', 'data');
+const INSTALL_DIR = path.join(process.env.HOME, '.propensity-monitor');
+const CLAUDE_SETTINGS = path.join(process.env.HOME, '.claude', 'settings.json');
+
+// ── ANSI helpers ────────────────────────────────────────────────────────────
+
+const C = {
+  reset: '\x1b[0m',
+  bold: '\x1b[1m',
+  dim: '\x1b[2m',
+  red: '\x1b[31m',
+  yellow: '\x1b[33m',
+  green: '\x1b[32m',
+  cyan: '\x1b[36m',
+  gray: '\x1b[90m',
+};
+
+function colorForCategory(cat) {
+  if (cat === 'critical') return C.red;
+  if (cat === 'high') return C.yellow;
+  if (cat === 'medium') return C.cyan;
+  return C.dim;
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function today() {
+  return new Date().toISOString().split('T')[0];
+}
+
+function readJsonl(filePath) {
+  if (!fs.existsSync(filePath)) return [];
+  return fs.readFileSync(filePath, 'utf8')
+    .split('\n')
+    .filter(line => line.trim())
+    .map(line => { try { return JSON.parse(line); } catch { return null; } })
+    .filter(Boolean);
+}
+
+function readJson(filePath) {
+  try { return JSON.parse(fs.readFileSync(filePath, 'utf8')); } catch { return null; }
+}
+
+function parseArgs(args) {
+  const opts = {};
+  for (let i = 0; i < args.length; i++) {
+    if (args[i].startsWith('--')) {
+      const key = args[i].replace(/^--/, '');
+      const next = args[i + 1];
+      if (next && !next.startsWith('--')) {
+        opts[key] = next;
+        i++;
+      } else {
+        opts[key] = true;
+      }
+    } else {
+      opts._positional = opts._positional || [];
+      opts._positional.push(args[i]);
+    }
+  }
+  return opts;
+}
+
+function shortTime(ts) {
+  return ts.replace('T', ' ').replace(/\.\d+Z$/, '');
+}
+
+function shortSession(id) {
+  return id ? id.substring(0, 12) : 'unknown';
+}
+
+// ── Commands ────────────────────────────────────────────────────────────────
+
+function showAlerts(args) {
+  const opts = parseArgs(args);
+  const date = opts.date || today();
+  const last = parseInt(opts.last || '20', 10);
+
+  const file = path.join(DATA_DIR, 'alerts', `${date}.jsonl`);
+  const events = readJsonl(file);
+
+  if (events.length === 0) {
+    console.log(`No alerts for ${date}.`);
+    return;
+  }
+
+  const shown = events.slice(-last);
+  console.log(`${C.bold}Alerts for ${date}${C.reset} (showing ${shown.length} of ${events.length}):\n`);
+
+  for (const e of shown) {
+    const color = colorForCategory(e.risk?.category);
+    const cat = (e.risk?.category || 'none').toUpperCase().padEnd(8);
+    const time = shortTime(e.timestamp);
+    const sid = shortSession(e.session_id);
+    const tool = e.tool_name || e.hook_event_name || '';
+
+    console.log(`${color}${C.bold}${cat}${C.reset} ${C.dim}${time}${C.reset}  ${C.cyan}${sid}${C.reset}  ${tool}`);
+
+    for (const f of (e.risk?.factors || [])) {
+      if (f.score >= 2) {
+        console.log(`  ${color}${f.name}${C.reset}: ${f.detail}`);
+      }
+    }
+
+    if (e.session_state) {
+      const ss = e.session_state;
+      console.log(`  ${C.dim}Session: ${ss.toolCallCount} tools, ${ss.toolCallsSinceLastPrompt} since last prompt${C.reset}`);
+    }
+    console.log();
+  }
+}
+
+function showEvents(args) {
+  const opts = parseArgs(args);
+  const date = opts.date || today();
+  const last = parseInt(opts.last || '50', 10);
+  const minRisk = parseInt(opts['min-risk'] || '0', 10);
+
+  const file = path.join(DATA_DIR, 'events', `${date}.jsonl`);
+  let events = readJsonl(file);
+
+  if (minRisk > 0) {
+    events = events.filter(e => (e.risk?.score || 0) >= minRisk);
+  }
+
+  if (events.length === 0) {
+    console.log(`No events for ${date}${minRisk > 0 ? ` with risk >= ${minRisk}` : ''}.`);
+    return;
+  }
+
+  const shown = events.slice(-last);
+  console.log(`${C.bold}Events for ${date}${C.reset} (${shown.length} of ${events.length}):\n`);
+
+  for (const e of shown) {
+    const color = colorForCategory(e.risk?.category);
+    const score = e.risk?.score || 0;
+    const scoreStr = score > 0 ? `${color}[${score}]${C.reset} ` : `${C.dim}[0]${C.reset} `;
+    const time = shortTime(e.timestamp);
+    const tool = e.tool_name || e.hook_event_name || '';
+    const sid = shortSession(e.session_id);
+
+    let detail = '';
+    if (e.risk?.factors?.length > 0) {
+      detail = ` ${C.dim}(${e.risk.factors.map(f => f.name).join(', ')})${C.reset}`;
+    }
+
+    console.log(`${scoreStr}${C.dim}${time}${C.reset} ${C.cyan}${sid}${C.reset} ${tool}${detail}`);
+  }
+}
+
+function showSessions(args) {
+  const opts = parseArgs(args);
+  const minRisk = parseInt(opts['min-risk'] || '0', 10);
+
+  const index = readJson(path.join(DATA_DIR, 'index.json')) || {};
+  let entries = Object.entries(index);
+
+  if (minRisk > 0) {
+    entries = entries.filter(([, v]) => (v.maxRisk || 0) >= minRisk);
+  }
+
+  entries.sort((a, b) => (b[1].date || '').localeCompare(a[1].date || ''));
+
+  if (entries.length === 0) {
+    console.log('No sessions recorded yet.');
+    return;
+  }
+
+  console.log(`${C.bold}${'SESSION'.padEnd(14)} ${'DATE'.padEnd(12)} ${'RISK'.padEnd(6)} ${'TOOLS'.padEnd(7)} ${'ALERTS'.padEnd(8)} CWD${C.reset}`);
+
+  for (const [id, v] of entries) {
+    const color = v.maxRisk >= 3 ? C.red : v.maxRisk >= 2 ? C.yellow : v.maxRisk >= 1 ? C.cyan : C.dim;
+    const sid = shortSession(id);
+    const cwdShort = (v.cwd || '').replace(process.env.HOME, '~');
+
+    console.log(
+      `${C.cyan}${sid}${C.reset} ${C.dim}${(v.date || '').padEnd(12)}${C.reset} ` +
+      `${color}${String(v.maxRisk || 0).padEnd(6)}${C.reset} ` +
+      `${String(v.toolCalls || 0).padEnd(7)} ` +
+      `${v.alerts > 0 ? C.red : C.dim}${String(v.alerts || 0).padEnd(8)}${C.reset} ` +
+      `${C.dim}${cwdShort}${C.reset}`
+    );
+  }
+}
+
+function showSession(args) {
+  const opts = parseArgs(args);
+  const sessionId = opts._positional?.[0];
+
+  if (!sessionId) {
+    console.error('Usage: propensity-monitor session <session-id>');
+    process.exit(1);
+  }
+
+  // Find full session ID from prefix
+  const index = readJson(path.join(DATA_DIR, 'index.json')) || {};
+  const fullId = Object.keys(index).find(k => k.startsWith(sessionId));
+
+  if (!fullId) {
+    console.error(`Session not found: ${sessionId}`);
+    process.exit(1);
+  }
+
+  const sessionData = readJson(path.join(DATA_DIR, 'sessions', `${fullId}.json`));
+
+  if (sessionData) {
+    console.log(`${C.bold}Session: ${fullId}${C.reset}`);
+    console.log(`  Started:    ${sessionData.started_at || 'unknown'}`);
+    console.log(`  CWD:        ${sessionData.cwd || 'unknown'}`);
+    console.log(`  Tool calls: ${sessionData.toolCallCount}`);
+    console.log(`  Prompts:    ${sessionData.userPromptCount}`);
+    console.log(`  Max risk:   ${sessionData.maxRiskScore}`);
+    console.log(`  Alerts:     ${sessionData.alertCount}`);
+
+    if (sessionData.riskFactorCounts && Object.keys(sessionData.riskFactorCounts).length > 0) {
+      console.log(`\n  ${C.bold}Risk factors:${C.reset}`);
+      const sorted = Object.entries(sessionData.riskFactorCounts).sort((a, b) => b[1] - a[1]);
+      for (const [name, count] of sorted) {
+        console.log(`    ${name}: ${count}`);
+      }
+    }
+
+    if (sessionData.toolNameCounts && Object.keys(sessionData.toolNameCounts).length > 0) {
+      console.log(`\n  ${C.bold}Tool usage:${C.reset}`);
+      const sorted = Object.entries(sessionData.toolNameCounts).sort((a, b) => b[1] - a[1]);
+      for (const [name, count] of sorted) {
+        console.log(`    ${name}: ${count}`);
+      }
+    }
+  }
+
+  // Show events timeline
+  const date = index[fullId]?.date;
+  if (date) {
+    const file = path.join(DATA_DIR, 'events', `${date}.jsonl`);
+    const events = readJsonl(file).filter(e => e.session_id === fullId);
+
+    if (events.length > 0) {
+      console.log(`\n  ${C.bold}Timeline (${events.length} events):${C.reset}\n`);
+      for (const e of events) {
+        const color = colorForCategory(e.risk?.category);
+        const score = e.risk?.score || 0;
+        const time = shortTime(e.timestamp).split(' ')[1] || '';
+        const tool = e.tool_name || e.hook_event_name || '';
+        const factors = (e.risk?.factors || []).map(f => f.name).join(', ');
+
+        console.log(
+          `  ${C.dim}${time}${C.reset} ${score > 0 ? color : C.dim}[${score}]${C.reset} ${tool}` +
+          (factors ? ` ${C.dim}(${factors})${C.reset}` : '')
+        );
+      }
+    }
+  }
+}
+
+function tailEvents(args) {
+  const opts = parseArgs(args);
+  const minRisk = parseInt(opts['min-risk'] || '0', 10);
+  const file = path.join(DATA_DIR, 'events', `${today()}.jsonl`);
+
+  console.log(`${C.bold}Tailing events...${C.reset} (Ctrl+C to stop)\n`);
+
+  let lastSize = 0;
+  try { lastSize = fs.statSync(file).size; } catch {}
+
+  const check = () => {
+    try {
+      const stat = fs.statSync(file);
+      if (stat.size > lastSize) {
+        const buf = Buffer.alloc(stat.size - lastSize);
+        const fd = fs.openSync(file, 'r');
+        fs.readSync(fd, buf, 0, buf.length, lastSize);
+        fs.closeSync(fd);
+        lastSize = stat.size;
+
+        const lines = buf.toString('utf8').split('\n').filter(l => l.trim());
+        for (const line of lines) {
+          try {
+            const e = JSON.parse(line);
+            if ((e.risk?.score || 0) < minRisk) continue;
+
+            const color = colorForCategory(e.risk?.category);
+            const score = e.risk?.score || 0;
+            const time = shortTime(e.timestamp);
+            const tool = e.tool_name || e.hook_event_name || '';
+            const sid = shortSession(e.session_id);
+            const factors = (e.risk?.factors || []).map(f => f.name).join(', ');
+
+            console.log(
+              `${score > 0 ? color : C.dim}[${score}]${C.reset} ${C.dim}${time}${C.reset} ` +
+              `${C.cyan}${sid}${C.reset} ${tool}` +
+              (factors ? ` ${C.dim}(${factors})${C.reset}` : '')
+            );
+          } catch {}
+        }
+      }
+    } catch {}
+  };
+
+  setInterval(check, 500);
+}
+
+function showStats(args) {
+  const opts = parseArgs(args);
+  const date = opts.date;
+
+  // Collect events
+  const eventsDir = path.join(DATA_DIR, 'events');
+  let allEvents = [];
+
+  if (date) {
+    allEvents = readJsonl(path.join(eventsDir, `${date}.jsonl`));
+  } else {
+    // All dates
+    try {
+      const files = fs.readdirSync(eventsDir).filter(f => f.endsWith('.jsonl')).sort();
+      for (const f of files) {
+        allEvents.push(...readJsonl(path.join(eventsDir, f)));
+      }
+    } catch {}
+  }
+
+  if (allEvents.length === 0) {
+    console.log('No events recorded yet.');
+    return;
+  }
+
+  // Compute stats
+  const sessions = new Set(allEvents.map(e => e.session_id).filter(Boolean));
+  const tools = {};
+  const riskDist = { 0: 0, 1: 0, 2: 0, 3: 0 };
+  const factorCounts = {};
+
+  for (const e of allEvents) {
+    if (e.tool_name) tools[e.tool_name] = (tools[e.tool_name] || 0) + 1;
+    const score = e.risk?.score || 0;
+    riskDist[score] = (riskDist[score] || 0) + 1;
+    for (const f of (e.risk?.factors || [])) {
+      factorCounts[f.name] = (factorCounts[f.name] || 0) + 1;
+    }
+  }
+
+  console.log(`${C.bold}Statistics${date ? ` for ${date}` : ' (all time)'}${C.reset}\n`);
+  console.log(`  Total events:   ${allEvents.length}`);
+  console.log(`  Total sessions: ${sessions.size}`);
+
+  console.log(`\n  ${C.bold}Risk distribution:${C.reset}`);
+  console.log(`    ${C.red}critical (3): ${riskDist[3] || 0}${C.reset} (${((riskDist[3] || 0) / allEvents.length * 100).toFixed(1)}%)`);
+  console.log(`    ${C.yellow}high (2):     ${riskDist[2] || 0}${C.reset} (${((riskDist[2] || 0) / allEvents.length * 100).toFixed(1)}%)`);
+  console.log(`    ${C.cyan}medium (1):   ${riskDist[1] || 0}${C.reset} (${((riskDist[1] || 0) / allEvents.length * 100).toFixed(1)}%)`);
+  console.log(`    ${C.dim}none (0):     ${riskDist[0] || 0}${C.reset} (${((riskDist[0] || 0) / allEvents.length * 100).toFixed(1)}%)`);
+
+  if (Object.keys(factorCounts).length > 0) {
+    console.log(`\n  ${C.bold}Top risk factors:${C.reset}`);
+    const sorted = Object.entries(factorCounts).sort((a, b) => b[1] - a[1]);
+    for (const [name, count] of sorted.slice(0, 15)) {
+      console.log(`    ${name}: ${count}`);
+    }
+  }
+
+  if (Object.keys(tools).length > 0) {
+    console.log(`\n  ${C.bold}Tool usage:${C.reset}`);
+    const sorted = Object.entries(tools).sort((a, b) => b[1] - a[1]);
+    for (const [name, count] of sorted.slice(0, 10)) {
+      console.log(`    ${name}: ${count}`);
+    }
+  }
+}
+
+function searchEvents(args) {
+  const opts = parseArgs(args);
+  const pattern = opts._positional?.[0];
+  const date = opts.date;
+  const last = parseInt(opts.last || '30', 10);
+
+  if (!pattern) {
+    console.error('Usage: propensity-monitor search <pattern> [--date YYYY-MM-DD]');
+    process.exit(1);
+  }
+
+  const re = new RegExp(pattern, 'i');
+  const eventsDir = path.join(DATA_DIR, 'events');
+  const matches = [];
+
+  const files = date
+    ? [`${date}.jsonl`]
+    : (fs.readdirSync(eventsDir).filter(f => f.endsWith('.jsonl')).sort());
+
+  for (const f of files) {
+    const events = readJsonl(path.join(eventsDir, f));
+    for (const e of events) {
+      const str = JSON.stringify(e);
+      if (re.test(str)) matches.push(e);
+    }
+  }
+
+  if (matches.length === 0) {
+    console.log(`No events matching: ${pattern}`);
+    return;
+  }
+
+  const shown = matches.slice(-last);
+  console.log(`${C.bold}Search: ${pattern}${C.reset} (${shown.length} of ${matches.length} matches):\n`);
+
+  for (const e of shown) {
+    const color = colorForCategory(e.risk?.category);
+    const score = e.risk?.score || 0;
+    const time = shortTime(e.timestamp);
+    const tool = e.tool_name || e.hook_event_name || '';
+    console.log(`${score > 0 ? color : C.dim}[${score}]${C.reset} ${C.dim}${time}${C.reset} ${tool}`);
+
+    // Show matching content
+    if (e.tool_input_summary?.command) {
+      console.log(`  ${C.dim}cmd: ${e.tool_input_summary.command.substring(0, 100)}${C.reset}`);
+    }
+    if (e.tool_input_summary?.file_path) {
+      console.log(`  ${C.dim}file: ${e.tool_input_summary.file_path}${C.reset}`);
+    }
+  }
+}
+
+function exportData(args) {
+  const opts = parseArgs(args);
+  const date = opts.date;
+  const minRisk = parseInt(opts['min-risk'] || '0', 10);
+  const format = opts.format || 'jsonl';
+
+  const eventsDir = path.join(DATA_DIR, 'events');
+  let allEvents = [];
+
+  if (date) {
+    allEvents = readJsonl(path.join(eventsDir, `${date}.jsonl`));
+  } else {
+    try {
+      const files = fs.readdirSync(eventsDir).filter(f => f.endsWith('.jsonl')).sort();
+      for (const f of files) {
+        allEvents.push(...readJsonl(path.join(eventsDir, f)));
+      }
+    } catch {}
+  }
+
+  if (minRisk > 0) {
+    allEvents = allEvents.filter(e => (e.risk?.score || 0) >= minRisk);
+  }
+
+  if (format === 'json') {
+    process.stdout.write(JSON.stringify(allEvents, null, 2) + '\n');
+  } else {
+    for (const e of allEvents) {
+      process.stdout.write(JSON.stringify(e) + '\n');
+    }
+  }
+}
+
+function showStatus() {
+  console.log(`${C.bold}propensity-monitor status${C.reset}\n`);
+
+  // Check install dir
+  const dirExists = fs.existsSync(INSTALL_DIR);
+  console.log(`  Install dir:  ${dirExists ? C.green + 'OK' : C.red + 'MISSING'}${C.reset} ${INSTALL_DIR}`);
+
+  // Check data dir
+  const dataExists = fs.existsSync(DATA_DIR);
+  console.log(`  Data dir:     ${dataExists ? C.green + 'OK' : C.red + 'MISSING'}${C.reset} ${DATA_DIR}`);
+
+  // Check hooks in settings
+  let hooksOk = false;
+  try {
+    const settings = JSON.parse(fs.readFileSync(CLAUDE_SETTINGS, 'utf8'));
+    const events = ['PreToolUse', 'PostToolUse', 'UserPromptSubmit', 'SessionStart', 'Stop'];
+    const registered = events.filter(e => {
+      const hooks = settings.hooks?.[e] || [];
+      return hooks.some(h => {
+        if (h.command?.includes('propensity-monitor')) return true;
+        if (h.hooks) return h.hooks.some(hh => hh.command?.includes('propensity-monitor'));
+        return false;
+      });
+    });
+    hooksOk = registered.length === events.length;
+    console.log(`  Hooks:        ${hooksOk ? C.green + 'OK' : C.yellow + 'PARTIAL'}${C.reset} (${registered.length}/${events.length} events)`);
+    if (!hooksOk) {
+      const missing = events.filter(e => !registered.includes(e));
+      console.log(`    Missing: ${missing.join(', ')}`);
+    }
+  } catch {
+    console.log(`  Hooks:        ${C.red}ERROR${C.reset} (cannot read ${CLAUDE_SETTINGS})`);
+  }
+
+  // Check event count
+  try {
+    const eventsDir = path.join(DATA_DIR, 'events');
+    const files = fs.readdirSync(eventsDir).filter(f => f.endsWith('.jsonl'));
+    let total = 0;
+    for (const f of files) {
+      const content = fs.readFileSync(path.join(eventsDir, f), 'utf8');
+      total += content.split('\n').filter(l => l.trim()).length;
+    }
+    console.log(`  Events:       ${total} across ${files.length} day(s)`);
+  } catch {
+    console.log(`  Events:       ${C.dim}none yet${C.reset}`);
+  }
+
+  // Check alerts
+  try {
+    const alertsDir = path.join(DATA_DIR, 'alerts');
+    const files = fs.readdirSync(alertsDir).filter(f => f.endsWith('.jsonl'));
+    let total = 0;
+    for (const f of files) {
+      const content = fs.readFileSync(path.join(alertsDir, f), 'utf8');
+      total += content.split('\n').filter(l => l.trim()).length;
+    }
+    console.log(`  Alerts:       ${total > 0 ? C.red : C.dim}${total}${C.reset}`);
+  } catch {
+    console.log(`  Alerts:       ${C.dim}none${C.reset}`);
+  }
+}
+
+// ── Incident Commands ───────────────────────────────────────────────────────
+
+const INCIDENTS_DIR = path.join(DATA_DIR, 'incidents');
+
+function showIncidents(args) {
+  const opts = parseArgs(args);
+  const last = parseInt(opts.last || '20', 10);
+
+  if (!fs.existsSync(INCIDENTS_DIR)) {
+    console.log('No incidents logged yet.');
+    return;
+  }
+
+  const entries = fs.readdirSync(INCIDENTS_DIR)
+    .filter(f => fs.statSync(path.join(INCIDENTS_DIR, f)).isDirectory())
+    .sort()
+    .reverse()
+    .slice(0, last);
+
+  if (entries.length === 0) {
+    console.log('No incidents logged yet.');
+    return;
+  }
+
+  console.log(`${C.bold}${'INCIDENT'.padEnd(28)} ${'STATUS'.padEnd(12)} ${'SIMS'.padEnd(10)} CWD${C.reset}`);
+
+  for (const id of entries) {
+    const meta = readJson(path.join(INCIDENTS_DIR, id, 'metadata.json'));
+    const status = readJson(path.join(INCIDENTS_DIR, id, 'status.json'));
+
+    const cwdShort = (meta?.cwd || '').replace(process.env.HOME, '~');
+    const totalPlanned = status?.totalPlanned || 0;
+    const completed = status?.completed || 0;
+    const failed = status?.failed || 0;
+
+    let statusStr, statusColor;
+    if (status?.finished) {
+      statusStr = 'done';
+      statusColor = C.green;
+    } else if (status?.shuttingDown) {
+      statusStr = 'stopping';
+      statusColor = C.yellow;
+    } else if (status?.simulationsStarted) {
+      statusStr = 'running';
+      statusColor = C.cyan;
+    } else if (status?.error) {
+      statusStr = 'error';
+      statusColor = C.red;
+    } else {
+      statusStr = 'archived';
+      statusColor = C.dim;
+    }
+
+    const simStr = totalPlanned > 0 ? `${completed}/${totalPlanned}${failed > 0 ? ` (${C.red}${failed}err${C.reset})` : ''}` : '-';
+
+    console.log(
+      `${C.cyan}${id.padEnd(28)}${C.reset} ${statusColor}${statusStr.padEnd(12)}${C.reset} ${simStr.padEnd(10)} ${C.dim}${cwdShort}${C.reset}`
+    );
+  }
+}
+
+function showIncident(args) {
+  const opts = parseArgs(args);
+  const incidentId = opts._positional?.[0];
+  const subCmd = opts._positional?.[1];
+
+  if (!incidentId) {
+    console.error('Usage: propensity-monitor incident <id> [simulations|upload]');
+    process.exit(1);
+  }
+
+  // Find incident (support prefix match)
+  let fullId = incidentId;
+  if (!fs.existsSync(path.join(INCIDENTS_DIR, incidentId))) {
+    try {
+      const match = fs.readdirSync(INCIDENTS_DIR).find(d => d.startsWith(incidentId));
+      if (match) fullId = match;
+      else { console.error(`Incident not found: ${incidentId}`); process.exit(1); }
+    } catch { console.error(`Incident not found: ${incidentId}`); process.exit(1); }
+  }
+
+  const incidentDir = path.join(INCIDENTS_DIR, fullId);
+  const meta = readJson(path.join(incidentDir, 'metadata.json'));
+  const status = readJson(path.join(incidentDir, 'status.json'));
+
+  if (subCmd === 'simulations') {
+    return showIncidentSimulations(incidentDir, fullId, status);
+  }
+
+  if (subCmd === 'upload') {
+    console.log('Re-uploading is handled by: node ~/.propensity-monitor/lib/log-incident.mjs');
+    console.log(`Incident dir: ${incidentDir}`);
+    return;
+  }
+
+  console.log(`${C.bold}Incident: ${fullId}${C.reset}\n`);
+
+  if (meta) {
+    console.log(`  Session:      ${meta.sessionId || 'unknown'}`);
+    console.log(`  CWD:          ${meta.cwd || 'unknown'}`);
+    console.log(`  Timestamp:    ${meta.timestamp || 'unknown'}`);
+    console.log(`  Notes:        ${meta.userNotes || '(none)'}`);
+    console.log(`  Transcripts:  ${(meta.transcriptFiles || []).length} file(s)`);
+    console.log(`  Assessments:  ${meta.assessmentCount || 0}`);
+    console.log(`  Dir snapshot: ${meta.dirSnapshotSizeMB ? meta.dirSnapshotSizeMB + ' MB' : 'none'}`);
+  }
+
+  if (status) {
+    console.log(`\n  ${C.bold}Simulation Status:${C.reset}`);
+    console.log(`  Started:      ${status.started || 'unknown'}`);
+    console.log(`  Finished:     ${status.finished || 'in progress'}`);
+    console.log(`  Planned:      ${status.totalPlanned || 0}`);
+    console.log(`  Completed:    ${C.green}${status.completed || 0}${C.reset}`);
+    console.log(`  Failed:       ${(status.failed || 0) > 0 ? C.red : C.dim}${status.failed || 0}${C.reset}`);
+    console.log(`  Running:      ${status.running || 0}`);
+    if (status.s3Uploaded) console.log(`  S3:           ${C.green}uploaded${C.reset}`);
+    if (status.error) console.log(`  Error:        ${C.red}${status.error}${C.reset}`);
+  }
+
+  console.log(`\n  ${C.dim}View simulations: propensity-monitor incident ${fullId} simulations${C.reset}`);
+  console.log(`  ${C.dim}Local path: ${incidentDir}${C.reset}`);
+}
+
+function showIncidentSimulations(incidentDir, fullId, status) {
+  const simsDir = path.join(incidentDir, 'simulations');
+
+  if (!status?.simulations || status.simulations.length === 0) {
+    console.log('No simulations recorded yet.');
+    return;
+  }
+
+  console.log(`${C.bold}Simulations for ${fullId}${C.reset}\n`);
+  console.log(`${C.bold}${'ID'.padEnd(10)} ${'PERSONA'.padEnd(22)} ${'STATUS'.padEnd(12)} ${'TURNS'.padEnd(7)} DURATION${C.reset}`);
+
+  for (const sim of status.simulations) {
+    const statusColor = sim.status === 'completed' ? C.green
+      : sim.status === 'running' ? C.cyan
+      : sim.status === 'failed' ? C.red
+      : C.dim;
+
+    const dur = sim.duration ? `${sim.duration}s` : '-';
+    console.log(
+      `${C.cyan}${(sim.id || '').padEnd(10)}${C.reset} ` +
+      `${(sim.persona || '').padEnd(22)} ` +
+      `${statusColor}${(sim.status || 'pending').padEnd(12)}${C.reset} ` +
+      `${String(sim.turns || 0).padEnd(7)} ` +
+      `${C.dim}${dur}${C.reset}`
+    );
+  }
+
+  // Show detailed results if available
+  if (fs.existsSync(simsDir)) {
+    const simDirs = fs.readdirSync(simsDir).filter(d => {
+      const resultPath = path.join(simsDir, d, 'result.json');
+      return fs.existsSync(resultPath);
+    });
+
+    const failedSims = simDirs.filter(d => {
+      const result = readJson(path.join(simsDir, d, 'result.json'));
+      return result && result.exitReason !== 'completed';
+    });
+
+    if (failedSims.length > 0) {
+      console.log(`\n${C.bold}${C.red}Failed simulations:${C.reset}`);
+      for (const d of failedSims) {
+        const result = readJson(path.join(simsDir, d, 'result.json'));
+        console.log(`  ${C.cyan}${d}${C.reset}: ${result?.error || result?.exitReason || 'unknown'}`);
+      }
+    }
+  }
+}
+
+function toggleEnabled(enable) {
+  const configPath = path.join(INSTALL_DIR, 'config.json');
+  let config = {};
+  try { config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } catch {}
+  config.enabled = enable;
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
+  console.log(`propensity-monitor ${enable ? C.green + 'enabled' : C.red + 'disabled'}${C.reset}`);
+}
+
+function turnOn() { toggleEnabled(true); }
+function turnOff() { toggleEnabled(false); }
+
+async function startDashboard(args) {
+  const opts = parseArgs(args);
+  const port = opts.port || '3456';
+  const dashboardScript = path.join(INSTALL_DIR, 'bin', 'dashboard.mjs');
+  if (!fs.existsSync(dashboardScript)) {
+    console.error('Dashboard not installed. Run install.sh to update.');
+    process.exit(1);
+  }
+  const { spawnSync } = await import('child_process');
+  spawnSync('node', [dashboardScript, '--port', port], { stdio: 'inherit' });
+}
+
+// GitHub Device Flow client ID — set after creating the OAuth App
+const GITHUB_CLIENT_ID = process.env.ENVSEED_GITHUB_CLIENT_ID || 'Ov23lid2fKxyN7lOd9qv';
+
+function httpsRequest(options, body) {
+  return new Promise((resolve, reject) => {
+    const req = https.request(options, (res) => {
+      let data = '';
+      res.on('data', (chunk) => { data += chunk; });
+      res.on('end', () => resolve({ statusCode: res.statusCode, body: data }));
+    });
+    req.on('error', reject);
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
+
+async function registerCommand() {
+  const config = readJson(path.join(INSTALL_DIR, 'config.json')) || {};
+
+  if (config.apiKey) {
+    console.log(`Already registered with API key: ${config.apiKey.substring(0, 8)}...`);
+    console.log(`To re-register, remove apiKey from ${INSTALL_DIR}/config.json`);
+    return;
+  }
+
+  const clientId = config.githubClientId || GITHUB_CLIENT_ID;
+  if (!clientId) {
+    console.error('No GitHub client ID configured.');
+    console.error(`Set githubClientId in ${INSTALL_DIR}/config.json`);
+    process.exit(1);
+  }
+
+  const uploadEndpoint = config.uploadEndpoint;
+  if (!uploadEndpoint) {
+    console.error('No upload endpoint configured.');
+    console.error(`Set uploadEndpoint in ${INSTALL_DIR}/config.json`);
+    process.exit(1);
+  }
+
+  // Step 1: Request device code
+  console.log('Starting GitHub authentication...');
+  const codeRes = await httpsRequest({
+    hostname: 'github.com',
+    path: '/login/device/code',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+    },
+  }, JSON.stringify({ client_id: clientId, scope: 'read:user' }));
+
+  const codeData = JSON.parse(codeRes.body);
+  if (!codeData.device_code) {
+    console.error('Failed to start device flow:', codeData);
+    process.exit(1);
+  }
+
+  console.log('');
+  console.log(`  Visit: ${C.bold}${codeData.verification_uri}${C.reset}`);
+  console.log(`  Enter code: ${C.bold}${C.green}${codeData.user_code}${C.reset}`);
+  console.log('');
+  console.log('Waiting for authorization...');
+
+  // Step 2: Poll for access token
+  const interval = (codeData.interval || 5) * 1000;
+  let githubToken = null;
+
+  for (let i = 0; i < 60; i++) {
+    await sleep(interval);
+
+    const tokenRes = await httpsRequest({
+      hostname: 'github.com',
+      path: '/login/oauth/access_token',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+    }, JSON.stringify({
+      client_id: clientId,
+      device_code: codeData.device_code,
+      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+    }));
+
+    const tokenData = JSON.parse(tokenRes.body);
+
+    if (tokenData.access_token) {
+      githubToken = tokenData.access_token;
+      break;
+    }
+    if (tokenData.error === 'authorization_pending') continue;
+    if (tokenData.error === 'slow_down') {
+      await sleep(5000);
+      continue;
+    }
+    if (tokenData.error === 'expired_token') {
+      console.error('Authorization timed out. Please try again.');
+      process.exit(1);
+    }
+    if (tokenData.error) {
+      console.error(`GitHub error: ${tokenData.error_description || tokenData.error}`);
+      process.exit(1);
+    }
+  }
+
+  if (!githubToken) {
+    console.error('Timed out waiting for authorization.');
+    process.exit(1);
+  }
+
+  // Step 3: Exchange GitHub token for envseed API key
+  console.log('Registering with envseed...');
+  const regRes = await httpsRequest({
+    hostname: new URL(uploadEndpoint).hostname,
+    path: '/register',
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+    },
+  }, JSON.stringify({ githubToken }));
+
+  if (regRes.statusCode !== 200) {
+    console.error(`Registration failed: ${regRes.body}`);
+    process.exit(1);
+  }
+
+  const regData = JSON.parse(regRes.body);
+  config.apiKey = regData.apiKey;
+  fs.writeFileSync(path.join(INSTALL_DIR, 'config.json'), JSON.stringify(config, null, 2) + '\n');
+
+  console.log('');
+  console.log(`${C.green}${C.bold}Registered as @${regData.githubUser}. Your garden is ready.${C.reset}`);
+  console.log(`API key saved to ${INSTALL_DIR}/config.json`);
+}
+
+function showHelp() {
+  console.log(`${C.bold}envseed${C.reset} (propensity-monitor) — cultivate AI safety evals from real Claude Code sessions
+
+${C.bold}Usage:${C.reset}
+  envseed <command> [options]
+
+${C.bold}Setup:${C.reset}
+  register                                            Authenticate via GitHub and get API key
+  status                                              Check installation health
+
+${C.bold}Commands:${C.reset}
+  on                                                  Enable monitoring
+  off                                                 Disable monitoring
+  alerts     [--date YYYY-MM-DD] [--last N]          Show critical events
+  events     [--date YYYY-MM-DD] [--last N] [--min-risk N]  Show all events
+  sessions   [--min-risk N]                           List sessions with risk summary
+  session    <session-id>                             Detailed session view
+  tail       [--min-risk N]                           Live-tail events
+  stats      [--date YYYY-MM-DD]                      Aggregate statistics
+  search     <pattern> [--date YYYY-MM-DD] [--last N] Search events by pattern
+  export     [--date YYYY-MM-DD] [--min-risk N] [--format jsonl|json]  Export for eval pipeline
+  dashboard  [--port 3456]                             Open web dashboard
+  incidents  [--last N]                               List logged incidents
+  incident   <id> [simulations|upload]                View incident detail or simulations
+  help                                                Show this help
+`);
+}
+
+// ── Main ────────────────────────────────────────────────────────────────────
+
+const COMMANDS = { on: turnOn, off: turnOff, dashboard: startDashboard, alerts: showAlerts, events: showEvents, sessions: showSessions, session: showSession, tail: tailEvents, stats: showStats, search: searchEvents, export: exportData, incidents: showIncidents, incident: showIncident, status: showStatus, register: registerCommand, help: showHelp };
+
+const [command, ...args] = process.argv.slice(2);
+// Default: show status if installed, help if not
+const effectiveCommand = command || (fs.existsSync(INSTALL_DIR) ? 'status' : 'help');
+const handler = COMMANDS[effectiveCommand];
+if (!handler) {
+  console.error(`Unknown command: ${command}. Run 'propensity-monitor help' for usage.`);
+  process.exit(1);
+}
+Promise.resolve(handler(args)).catch(err => { console.error(err.message); process.exit(1); });