getprismo 0.1.44 → 0.1.46

package/lib/prismo-dev/agent.js

@@ -215,6 +215,38 @@ module.exports = function createAgent(deps) {
     return sent;
   }
 
+  async function publishClaudeContextBlocks(config, rootDir, repo, options = {}) {
+    const state = safeReadJson(enforceStatePath(rootDir));
+    const blocks = Array.isArray(state?.contextBlocks) ? state.contextBlocks : [];
+    if (!blocks.length) return 0;
+    let sent = 0;
+    for (const block of blocks.slice(0, 10)) {
+      const ok = await sendLiveEvent(config, {
+        eventId: block.eventId || `claude-context-block-${block.at || Date.now()}`,
+        phase: "fixed",
+        eventType: "context_blocked",
+        severity: "success",
+        headline: "Blocked a wasteful context read",
+        detail: `${block.target} (rule: ${block.rule}) was denied before any tokens were spent.`,
+        repo,
+        targetCause: "generated-artifacts",
+        tokensPrevented: Number(block.estimatedTokensSaved || 0),
+        occurredAt: block.at || new Date().toISOString(),
+        payload: {
+          tool: "claude-code",
+          rule: block.rule,
+          sessionId: block.sessionId || null,
+          rawPrompts: false,
+          rawCode: false,
+          rawStdout: false,
+          rawStderr: false,
+        },
+      }, options);
+      if (ok) sent += 1;
+    }
+    return sent;
+  }
+
   async function publishAgentLoopSignals(config, rootDir, repo, options = {}) {
     if (!getUsageSummary) return 0;
     let summary = null;
@@ -552,6 +584,7 @@ module.exports = function createAgent(deps) {
       repo,
     }, options);
     await publishClaudeLoopStops(config, rootDir, repo, options);
+    await publishClaudeContextBlocks(config, rootDir, repo, options);
     await publishAgentLoopSignals(config, rootDir, repo, options);
 
     let autoDetectResult = null;

package/lib/prismo-dev/cli.js

@@ -6,7 +6,7 @@ const VALID_COMMANDS = new Set([
   "connect", "sync", "status", "disconnect", "agent", "connector", "setup", "scan", "digest",
   "optimize", "context", "cc", "cursor", "receipt", "instructions",
   "timeline", "replay", "boundaries", "usage", "guard", "watch", "demo", "repair",
-  "enforce", "bridge", "hook",
+  "enforce", "bridge", "hook", "protect",
 ]);
 
 function parseTokenBudget(value) {
@@ -151,7 +151,7 @@ function createCli(deps) {
       return;
     }
     if (!VALID_COMMANDS.has(command)) {
-      throw new Error(`Unknown command: ${command}. Try: prismo connect, prismo connector, prismo bridge, prismo agent, prismo guard, prismo sync, prismo doctor, prismo watch, prismo receipt, prismo benchmark, prismo shield, prismo mcp, prismo firewall, prismo init, prismo scan, prismo optimize, prismo context, prismo cc, prismo cursor, or prismo usage`);
+      throw new Error(`Unknown command: ${command}. Try: prismo protect, prismo connect, prismo connector, prismo bridge, prismo agent, prismo guard, prismo sync, prismo doctor, prismo watch, prismo receipt, prismo benchmark, prismo shield, prismo mcp, prismo firewall, prismo init, prismo scan, prismo optimize, prismo context, prismo cc, prismo cursor, or prismo usage`);
     }
 
     if (command === "demo") {
@@ -837,6 +837,56 @@ function createCli(deps) {
       return;
     }
 
+    if (command === "protect") {
+      const json = rest.includes("--json");
+      const target = getPositionals(rest, new Set())[0] || process.cwd();
+      const steps = [];
+
+      const doctor = runDoctor(target, { applySuggestions: true, json: true });
+      steps.push({
+        step: "doctor",
+        ok: true,
+        detail: `Score ${doctor.after?.score ?? doctor.before?.score ?? "?"}/100; ${(doctor.fixActions || []).length} fix action(s), ${(doctor.generatedFiles || []).length} context file(s).`,
+      });
+
+      const enforce = runEnforceInstall(target);
+      steps.push({
+        step: "enforce",
+        ok: true,
+        detail: `Runtime enforcement on: ${enforce.blockedRules} blocked-context rule(s), loop breaking armed.`,
+      });
+
+      const config = loadConfig();
+      if (config?.token) {
+        const connector = runConnectorStatus();
+        if (connector.running) {
+          steps.push({ step: "connector", ok: true, detail: "Background connector already running." });
+        } else {
+          runConnectorInstall(target, { mode: "autopilot" });
+          steps.push({ step: "connector", ok: true, detail: "Background connector installed and started in autopilot." });
+        }
+      } else {
+        steps.push({
+          step: "connector",
+          ok: false,
+          detail: `Not connected to Prismo Cloud. Local protection is on; for autonomous repairs and verified savings run: ${NPX_COMMAND} connect --token <your Prismo API key>`,
+        });
+      }
+
+      const result = { schemaVersion: 1, command: "protect", steps, generatedAt: new Date().toISOString() };
+      if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+      }
+      console.log("");
+      console.log("PrismoDev Protect");
+      console.log("");
+      steps.forEach((item) => console.log(`${item.ok ? "[on]" : "[--]"} ${item.step}: ${item.detail}`));
+      console.log("");
+      console.log("Your AI coding sessions in this repo are now scoped, guarded, and repaired automatically.");
+      return;
+    }
+
     if (command === "enforce") {
       const json = rest.includes("--json");
       const subcommand = (getPositionals(rest, new Set())[0] || "status").toLowerCase();

package/lib/prismo-dev/enforce.js

@@ -112,6 +112,26 @@ module.exports = function createEnforce(deps) {
     writeState(root, state);
   }
 
+  // Like loopStops: a publishable record of blocked context reads so the
+  // connector can surface "prevented before spend" on the dashboard.
+  function recordContextBlock(root, state, payload) {
+    const contextBlocks = Array.isArray(state.contextBlocks) ? state.contextBlocks : [];
+    const at = new Date().toISOString();
+    const target = String(payload.target || "").slice(0, 240);
+    const sessionId = payload.sessionId || "unknown";
+    const eventId = `claude-context-block-${sessionId}-${Buffer.from(`${payload.rule}:${target}`).toString("base64").replace(/[^a-z0-9]/gi, "").slice(0, 24)}-${at.slice(0, 16)}`;
+    state.contextBlocks = [{
+      eventId,
+      at,
+      tool: "claude-code",
+      target,
+      rule: String(payload.rule || "").slice(0, 120),
+      estimatedTokensSaved: Math.max(0, Math.round(payload.estimatedTokens || 0)),
+      sessionId,
+    }, ...contextBlocks].slice(0, DENIAL_LOG_LIMIT);
+    writeState(root, state);
+  }
+
   function estimateBlockedFileTokens(root, target) {
     try {
       const fullPath = path.isAbsolute(target) ? target : path.join(root, target);
@@ -179,7 +199,15 @@ module.exports = function createEnforce(deps) {
         const patterns = readBlockedPatterns(root);
         const hit = patterns.find((pattern) => matchesBlocked(relPath, pattern));
         if (hit) {
-          recordDenial(root, readState(root), "blocked-context", relPath, estimateBlockedFileTokens(root, target));
+          const state = readState(root);
+          const estimatedTokens = estimateBlockedFileTokens(root, target);
+          recordDenial(root, state, "blocked-context", relPath, estimatedTokens);
+          recordContextBlock(root, state, {
+            target: relPath,
+            rule: hit,
+            estimatedTokens,
+            sessionId: String(event.session_id || "unknown"),
+          });
           return deny(
             `Prismo context firewall: "${relPath}" is blocked context (rule: ${hit}). `
             + "It is generated output that wastes agent tokens. Use the .prismo/ context packs instead, "

package/lib/prismo-dev/help.js

@@ -36,6 +36,7 @@ Usage:
   prismo usage [codex|claude|cursor|all] [--json] [--limit N] [path]
   prismo guard [codex|claude|cursor|all] [--json] [--watch] [--once] [--no-sync] [--dry-run] [--limit N] [--budget N] [--interval N] [path]
   prismo repair <cause|auto> [--json] [--dry-run] [--tier mild|aggressive] [--limit N] [--budget N] [--scope SCOPE] [path] [-- <command ...>]
+  prismo protect [--json] [path]
   prismo enforce [status|install|uninstall] [--json] [path]
   prismo watch [codex|claude|cursor|all] [--json] [--once] [--agents] [--report] [--rescue] [--guardrails] [--throttle] [--events] [--no-events] [--auto] [--budget N] [--redact-paths] [--interval N] [path]
   prismo demo
@@ -69,6 +70,7 @@ Commands:
   usage       Read local Codex/Claude Code/Cursor session logs and summarize token usage.
   guard       Run proactive local guardrails and sync prevention events to Prismo.
   repair      Run the cause-specific repair for a detected waste cause; "auto" lets the planner pick.
+  protect     One command for full protection: safe fixes + context packs + runtime enforcement + background connector.
   enforce     Enforce the context firewall at runtime via Claude Code hooks (block blocked-context reads and command loops).
   watch       Refresh local session usage in the terminal.
   demo        Show sample output without needing a messy repo.
@@ -327,6 +329,17 @@ Output:
   --dry-run with auto prints the planner decision without executing.
   --tier aggressive forces the stronger repair; cloud-queued actions carry it automatically after a no-change/regressed verdict.
   Repairs only write .prismo/ files and append ignore rules with backups; they never overwrite CLAUDE.md, AGENTS.md, .gitignore, or source code.`,
+  protect: `PrismoDev Protect
+
+Usage:
+  prismo protect [--json] [path]
+
+One command that turns on the full stack for this repo:
+  1. doctor --apply-suggestions  safe ignore rules + compact context packs
+  2. enforce install             runtime enforcement via Claude Code hooks
+  3. connector                   background autonomous repairs (when connected to Prismo Cloud)
+
+If this machine is not connected yet, protect still enables all local protection and prints the connect command for the autonomous half.`,
   enforce: `PrismoDev Enforce
 
 Usage:

package/lib/prismo-dev-scan.js

@@ -178,6 +178,13 @@ const { appendIgnoreSuggestions, applyFixes } = require("./prismo-dev/fixes")({
 function writeGeneratedFile(root, relPath, contents) {
   const fullPath = path.join(root, relPath);
   fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+  // Periodic regenerations (connector auto-detect every few minutes) must
+  // not churn backups when nothing changed.
+  try {
+    if (fs.existsSync(fullPath) && fs.readFileSync(fullPath, "utf8") === contents) {
+      return { path: relPath, backupPath: null, unchanged: true };
+    }
+  } catch {}
   const backupPath = backupIfExists(fullPath);
   fs.writeFileSync(fullPath, contents, "utf8");
   return { path: relPath, backupPath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "getprismo",
-  "version": "0.1.44",
+  "version": "0.1.46",
   "description": "Local AI coding workflow scanner for Codex, Claude Code, Cursor, and token-waste diagnostics.",
   "license": "MIT",
   "homepage": "https://github.com/shanirsh/prismodev#readme",