marmot-logger 1.0.0 → 1.0.1

package/README.md

@@ -1,170 +1,349 @@
 # Marmot
 
-Activity monitoring tool for developer workflows. Tracks file changes, terminal commands, git operations, and Claude Code hooks.
+Activity monitoring and logging tool for developer workflows. Creates tamper-evident audit trails by tracking file changes, terminal commands, git operations, and Claude Code hooks with optional cryptographic signing.
 
-## Installation
+## Project Structure
 
-```bash
-npm install -g marmot-logger
+```
+marmot/
+├── bin/
+│   └── marmot.js              # CLI entry point (Commander.js)
+├── src/
+│   ├── index.js               # Public API exports
+│   ├── cli/                   # Command handlers
+│   │   ├── init.js            # marmot init
+│   │   ├── enable.js          # marmot enable <plugin>
+│   │   ├── disable.js         # marmot disable <plugin>
+│   │   ├── status.js          # marmot status
+│   │   ├── logs.js            # marmot logs
+│   │   ├── monitor.js         # marmot monitor
+│   │   ├── verify.js          # marmot verify
+│   │   ├── log.js             # marmot log <event> (internal, used by hooks)
+│   │   └── login.js           # marmot login
+│   ├── core/
+│   │   ├── config.js          # Config management (load/save/paths)
+│   │   ├── logger.js          # Log entry persistence
+│   │   ├── signer.js          # Remote signing service client
+│   │   └── gitignore.js       # .gitignore pattern parsing
+│   └── plugins/
+│       ├── index.js           # Plugin registry
+│       ├── file-monitor.js    # File change detection via rsync + git diff
+│       ├── terminal.js        # Bash command logging via PROMPT_COMMAND
+│       ├── git-hooks.js       # Git hook integration
+│       ├── claude-hooks.js    # Claude Code IDE integration
+│       └── makefile.js        # Makefile target logging (manual setup)
+├── openapi.yaml               # Signing service API specification
+└── package.json
 ```
 
-Or use with npx:
+## Tech Stack
 
-```bash
-npx marmot-logger init
-```
+- **Runtime**: Node.js >= 16.0.0
+- **Dependencies**: `commander` (CLI), `chalk` (terminal colors)
+- **External Tools**: `rsync`, `git` (for file-monitor plugin)
 
-## Quick Start
+## Development Setup
 
 ```bash
-# Initialize marmot in your project
-marmot init
+# Clone and install
+git clone <repo>
+cd marmot
+npm install
 
-# Enable plugins
-marmot enable file-monitor    # Track file changes
-marmot enable terminal        # Log terminal commands
-marmot enable git-hooks       # Log git operations
-marmot enable claude-hooks    # Log Claude Code activity
+# Link for local development
+npm link
 
-# Check status
-marmot status
-
-# View recent logs
-marmot logs --last 20
+# Now 'marmot' command is available globally
+marmot --help
 ```
 
-## Configuration
+## Architecture
 
-### Environment Variables
+### Configuration Storage
 
-- `MARMOT_URL` - Signing service URL (default: `https://logging.drazou.net`)
-- `MARMOT_API_KEY` - API key for signing service (required)
+Config is stored in `/tmp/marmot/<hash>/` where `<hash>` is MD5 of the absolute project path. This keeps marmot data out of the project directory.
 
-```bash
-export MARMOT_API_KEY=your-api-key
+```
+/tmp/marmot/<hash>/
+├── .marmotrc.json      # Project config
+├── snapshot/           # File monitor snapshot (rsync copy)
+└── terminal-hook.sh    # Generated bash hook script
 ```
 
-### Project Configuration
-
-Marmot creates `.marmotrc.json` in your project root:
+Logs are written to `./marmot-logs/` in the project directory.
+
+### Config Resolution Priority
+
+1. Environment variables (`MARMOT_API_KEY`, `MARMOT_URL`)
+2. `.env` file in project root
+3. Cached values in `.marmotrc.json`
+4. Defaults (`https://logging.drazou.net`, `./marmot-logs/`)
+
+### Core Modules
+
+**[config.js](src/core/config.js)** - Configuration management
+- `loadConfig(projectDir)` / `saveConfig(config, projectDir)` - JSON persistence
+- `getSigningUrl(projectDir)` / `getApiKey(projectDir)` - Multi-source resolution
+- `getMarmotDir(projectDir)` - Returns `/tmp/marmot/<hash>`
+- `enablePlugin(config, name)` / `disablePlugin(config, name)` - Toggle plugins
+
+**[logger.js](src/core/logger.js)** - Activity logging
+- `logEvent(eventType, path, size, extra, projectDir)` - Main logging API
+- `readLogs(logFile, options)` - Parse JSON Lines log files
+- `verifyLogs(logFile, projectDir)` - Verify signatures with backend
+- Logs to `./marmot-logs/file_events_YYYY-MM-DD.log` (JSON Lines format)
+- Falls back to unsigned entries if signing service unavailable
+
+**[signer.js](src/core/signer.js)** - Remote signing client
+- `getToken(projectDir)` / `refreshToken(projectDir)` - Token management
+- `sign(entry, projectDir)` - Sign entry with backend service
+- `verify(entry, projectDir)` - Verify entry signature
+- `healthCheck(projectDir)` - Service connectivity check
+- 10-second request timeout, automatic token refresh on 401
+
+**[gitignore.js](src/core/gitignore.js)** - Exclusion patterns
+- `parseGitignore(projectDir)` - Parse .gitignore file
+- `shouldExclude(filePath, projectDir)` - Check if path matches exclusions
+- `buildRsyncExcludes(projectDir)` - Generate rsync --exclude args
+- Always excludes: `.git`, `logs/`
+
+### Plugin System
+
+All plugins export `enable(projectConfig)` and `disable(projectConfig)` functions.
+
+**[file-monitor.js](src/plugins/file-monitor.js)**
+- Uses rsync to create snapshot, git diff to detect changes
+- Installs cron job: `* * * * * cd <project> && marmot monitor`
+- Events: `created`, `modified`, `deleted`, `monitor_initialized`
+- Modified events include `additions` and `deletions` line counts
+
+**[terminal.js](src/plugins/terminal.js)**
+- Generates bash hook using `PROMPT_COMMAND`
+- Adds source line to `~/.bashrc`
+- De-duplicates consecutive identical commands
+- Events: `terminal` with `command` field
+
+**[git-hooks.js](src/plugins/git-hooks.js)**
+- Installs hooks in `.git/hooks/`: `post-commit`, `pre-push`, `post-checkout`, `post-merge`
+- Can coexist with existing hooks (appends marmot commands)
+- Events: `git_commit`, `git_push`, `git_checkout`, `git_merge`
+
+**[claude-hooks.js](src/plugins/claude-hooks.js)**
+- Configures hooks in `.claude/settings.local.json`
+- Events: `PreToolUse`, `PostToolUse`, `Stop`, `SubagentStop`, `UserPromptSubmit`, `SessionStart`, `SessionEnd`
+- Logged as `claude_hook_<EventType>`
+
+**[makefile.js](src/plugins/makefile.js)**
+- Non-intrusive: only prints manual setup instructions
+- Users add logging commands to their Makefile
+- Events: `make_command`
+
+### CLI Commands
+
+| Command | Handler | Description |
+|---------|---------|-------------|
+| `marmot init` | [init.js](src/cli/init.js) | Create config, log directory, update .gitignore |
+| `marmot enable <plugin>` | [enable.js](src/cli/enable.js) | Enable plugin and run setup |
+| `marmot disable <plugin>` | [disable.js](src/cli/disable.js) | Disable plugin and cleanup |
+| `marmot status` | [status.js](src/cli/status.js) | Show config, plugin status, signing health |
+| `marmot logs [--today] [--last N]` | [logs.js](src/cli/logs.js) | Display log entries with color coding |
+| `marmot monitor` | [monitor.js](src/cli/monitor.js) | Run file monitor once (for cron) |
+| `marmot verify [--file PATH]` | [verify.js](src/cli/verify.js) | Verify log signatures |
+| `marmot log <event> [-d JSON]` | [log.js](src/cli/log.js) | Log event (used internally by hooks) |
+| `marmot login` | [login.js](src/cli/login.js) | Set API key interactively |
+
+### Log Format
+
+JSON Lines format - one JSON object per line:
 
 ```json
-{
-  "logDir": "./logs",
-  "snapshotDir": "./.marmot-snapshot",
-  "plugins": {
-    "file-monitor": {
-      "enabled": true,
-      "exclude": [".git", "node_modules", ".marmot-snapshot"]
-    },
-    "terminal": { "enabled": true },
-    "git-hooks": { "enabled": true },
-    "claude-hooks": { "enabled": true }
-  }
-}
+{"timestamp":"2025-12-22T14:30:00Z","uuid":"550e8400-e29b-41d4-a716-446655440000","event":"modified","path":"/project/src/index.js","size":1234,"additions":10,"deletions":5,"signed":true}
+{"timestamp":"2025-12-22T14:31:00Z","uuid":"...","event":"terminal","path":"/project","command":"npm test","size":0,"signed":true}
+{"timestamp":"2025-12-22T14:32:00Z","uuid":"...","event":"git_commit","path":"abc1234: Fix bug","size":0,"signed":true}
 ```
 
-## Plugins
+Fields added by signing service: `timestamp`, `uuid`, `signed: true`
 
-### File Monitor
+### Signing Service API
 
-Detects file changes using git diff against a snapshot.
+See [openapi.yaml](openapi.yaml) for full specification. Endpoints:
 
-```bash
-marmot enable file-monitor
+| Endpoint | Method | Auth | Description |
+|----------|--------|------|-------------|
+| `/token` | POST | None | Exchange API key for bearer token |
+| `/sign` | POST | Bearer | Sign a log entry, returns entry with uuid/timestamp |
+| `/verify` | POST | Bearer | Verify a signed entry |
+| `/health` | GET | None | Service health check |
 
-# Run manually or via cron
-marmot monitor
+## Programmatic API
 
-# Add to crontab for every minute:
-* * * * * cd /path/to/project && npx marmot monitor >> ./logs/cron.log 2>&1
-```
+```javascript
+const marmot = require('marmot-logger');
 
-### Terminal
+// Configuration
+const config = marmot.loadConfig();
+marmot.saveConfig(config);
+marmot.createDefaultConfig();
 
-Logs terminal commands executed in the project directory.
+// Logging
+await marmot.log({
+  event: 'custom_event',
+  path: '/path/to/file',
+  size: 1234,
+  metadata: { custom: 'data' }
+});
 
-```bash
-marmot enable terminal
+const entries = marmot.readLogs('./marmot-logs/file_events_2025-12-22.log');
+const results = await marmot.verifyLogs('./marmot-logs/file_events_2025-12-22.log');
 
-# Add to ~/.bashrc:
-source "/path/to/project/.marmot/terminal-hook.sh"
+// Signing
+const signed = await marmot.sign(entry);
+const result = await marmot.verify(entry);
+const health = await marmot.healthCheck();
 ```
 
-### Git Hooks
+## Environment Variables
 
-Logs git operations (commit, push, checkout, merge).
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `MARMOT_API_KEY` | API key for signing service | (required for signing) |
+| `MARMOT_URL` | Signing service URL | `https://logging.drazou.net` |
 
-```bash
-marmot enable git-hooks
+## Default Config
+
+```json
+{
+  "logDir": "./marmot-logs",
+  "bearerToken": "broken-bearer",
+  "plugins": {
+    "file-monitor": { "enabled": false },
+    "terminal": { "enabled": false },
+    "git-hooks": {
+      "enabled": false,
+      "events": ["commit", "push", "checkout", "merge"]
+    },
+    "makefile": { "enabled": false },
+    "claude-hooks": {
+      "enabled": false,
+      "events": ["PreToolUse", "PostToolUse", "Stop", "SubagentStop", "UserPromptSubmit", "SessionStart", "SessionEnd"]
+    }
+  }
+}
 ```
 
-Hooks are automatically installed in `.git/hooks/`.
+## Adding a New Plugin
 
-### Claude Hooks
+1. Create `src/plugins/my-plugin.js`:
 
-Logs Claude Code IDE activity.
+```javascript
+const chalk = require('chalk');
 
-```bash
-marmot enable claude-hooks
-```
+async function enable(projectConfig) {
+  const projectDir = process.cwd();
+  // Setup logic: install hooks, cron jobs, etc.
+  console.log(chalk.bold('My Plugin Setup:'));
+  console.log('  Plugin enabled successfully');
+}
 
-Hooks are configured in `.claude/settings.local.json`.
+async function disable(projectConfig) {
+  // Cleanup logic: remove hooks, cron jobs, etc.
+  console.log(chalk.bold('My Plugin Disabled'));
+}
 
-## CLI Commands
+module.exports = { enable, disable };
+```
 
-| Command | Description |
-|---------|-------------|
-| `marmot init` | Initialize marmot in current project |
-| `marmot enable <plugin>` | Enable a plugin |
-| `marmot disable <plugin>` | Disable a plugin |
-| `marmot status` | Show status and enabled plugins |
-| `marmot logs` | View recent log entries |
-| `marmot logs --today` | View today's logs |
-| `marmot logs --last N` | View last N entries |
-| `marmot verify` | Verify log signatures |
-| `marmot monitor` | Run file monitor once |
+2. Register in [src/plugins/index.js](src/plugins/index.js):
 
-## Log Format
+```javascript
+module.exports = {
+  // ... existing plugins
+  'my-plugin': require('./my-plugin')
+};
+```
 
-Logs are stored as JSON Lines in `./logs/file_events_YYYY-MM-DD.log`:
+3. Add default config in [src/core/config.js](src/core/config.js) `DEFAULT_CONFIG.plugins`:
 
-```json
-{"timestamp":"2025-12-22T14:30:00Z","uuid":"...","event":"modified","path":"/project/src/index.js","size":1234,"additions":10,"deletions":5,"signed":true}
-{"timestamp":"2025-12-22T14:31:00Z","uuid":"...","event":"terminal","path":"/project","command":"npm test","size":0,"signed":true}
-{"timestamp":"2025-12-22T14:32:00Z","uuid":"...","event":"git_commit","path":"abc1234: Fix bug","size":0,"signed":true}
+```javascript
+'my-plugin': {
+  enabled: false,
+  // plugin-specific options
+}
 ```
 
-## Event Types
+4. Update CLI help in [bin/marmot.js](bin/marmot.js) (enable command description).
 
-| Event | Description |
-|-------|-------------|
-| `created` | File created |
-| `modified` | File modified (includes additions/deletions) |
-| `deleted` | File deleted |
-| `terminal` | Terminal command executed |
-| `git_commit` | Git commit made |
-| `git_push` | Git push executed |
-| `git_checkout` | Git branch checkout |
-| `git_merge` | Git merge completed |
-| `make_command` | Make target executed |
-| `claude_hook_*` | Claude Code hook events |
+## Adding a New CLI Command
 
-## API
+1. Create handler in `src/cli/my-command.js`:
 
 ```javascript
-const marmot = require('marmot-logger');
+const chalk = require('chalk');
+const config = require('../core/config');
+
+module.exports = async function myCommand(options) {
+  const projectConfig = config.loadConfig();
+  if (!projectConfig) {
+    console.log(chalk.red('Marmot not initialized. Run: marmot init'));
+    process.exit(1);
+  }
+  // Command logic
+};
+```
 
-// Log an event programmatically
-await marmot.log({
-  event: 'custom_event',
-  path: '/path/to/file',
-  size: 1234,
-  metadata: { custom: 'data' }
-});
+2. Register in [bin/marmot.js](bin/marmot.js):
+
+```javascript
+const myCommand = require('../src/cli/my-command');
 
-// Verify logs
-const results = await marmot.verifyLogs('./logs/file_events_2025-12-22.log');
+program
+  .command('my-command')
+  .description('Description of my command')
+  .option('-f, --flag', 'Option description')
+  .action(myCommand);
+```
+
+## Event Types Reference
+
+| Event | Source | Extra Fields |
+|-------|--------|--------------|
+| `created` | file-monitor | - |
+| `modified` | file-monitor | `additions`, `deletions` |
+| `deleted` | file-monitor | - |
+| `monitor_initialized` | file-monitor | - |
+| `terminal` | terminal | `command` |
+| `git_commit` | git-hooks | - |
+| `git_push` | git-hooks | - |
+| `git_checkout` | git-hooks | - |
+| `git_merge` | git-hooks | - |
+| `make_command` | makefile | - |
+| `claude_hook_PreToolUse` | claude-hooks | tool details in path |
+| `claude_hook_PostToolUse` | claude-hooks | tool details in path |
+| `claude_hook_Stop` | claude-hooks | stop reason in path |
+| `claude_hook_SubagentStop` | claude-hooks | stop reason in path |
+| `claude_hook_UserPromptSubmit` | claude-hooks | prompt preview in path |
+| `claude_hook_SessionStart` | claude-hooks | session ID in path |
+| `claude_hook_SessionEnd` | claude-hooks | session ID in path |
+
+## Data Flow
+
+```
+Plugin detects activity
+    │
+    ▼
+logger.logEvent(type, path, size, extra)
+    │
+    ▼
+signer.sign(entry) ──────► Signing Service
+    │                           │
+    │ (fallback if unavailable) │
+    ▼                           ▼
+Unsigned entry             Signed entry with uuid/timestamp
+    │                           │
+    └───────────┬───────────────┘
+                │
+                ▼
+    Append to ./marmot-logs/file_events_YYYY-MM-DD.log
 ```
 
 ## License

package/bin/marmot.js

@@ -11,6 +11,7 @@ const status = require('../src/cli/status');
 const verify = require('../src/cli/verify');
 const logs = require('../src/cli/logs');
 const monitor = require('../src/cli/monitor');
+const processMonitorCmd = require('../src/cli/process-monitor');
 const log = require('../src/cli/log');
 const login = require('../src/cli/login');
 
@@ -26,7 +27,7 @@ program
 
 program
   .command('enable <plugin>')
-  .description('Enable a plugin (file-monitor, terminal, git-hooks, makefile, claude-hooks)')
+  .description('Enable a plugin (file-monitor, terminal, git-hooks, makefile, claude-hooks, process-monitor)')
   .action(enable);
 
 program
@@ -57,6 +58,11 @@ program
   .description('Run file monitor once (for cron/scripts)')
   .action(monitor);
 
+program
+  .command('process-monitor')
+  .description('Run process monitor once (for cron/scripts)')
+  .action(processMonitorCmd);
+
 program
   .command('log <event>')
   .description('Log an event (used by hooks)')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "marmot-logger",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Activity monitoring tool for developer workflows - tracks file changes, terminal commands, git operations, and Claude Code hooks",
   "main": "src/index.js",
   "bin": {

package/src/cli/disable.js

@@ -2,7 +2,7 @@ const chalk = require('chalk');
 const config = require('../core/config');
 const plugins = require('../plugins');
 
-const VALID_PLUGINS = ['file-monitor', 'terminal', 'git-hooks', 'makefile', 'claude-hooks'];
+const VALID_PLUGINS = ['file-monitor', 'terminal', 'git-hooks', 'makefile', 'claude-hooks', 'process-monitor'];
 
 module.exports = async function disable(pluginName) {
   if (!VALID_PLUGINS.includes(pluginName)) {

package/src/cli/enable.js

@@ -2,7 +2,7 @@ const chalk = require('chalk');
 const config = require('../core/config');
 const plugins = require('../plugins');
 
-const VALID_PLUGINS = ['file-monitor', 'terminal', 'git-hooks', 'makefile', 'claude-hooks'];
+const VALID_PLUGINS = ['file-monitor', 'terminal', 'git-hooks', 'makefile', 'claude-hooks', 'process-monitor'];
 
 module.exports = async function enable(pluginName) {
   if (!VALID_PLUGINS.includes(pluginName)) {

package/src/cli/process-monitor.js

@@ -0,0 +1,32 @@
+const chalk = require('chalk');
+const config = require('../core/config');
+const processMonitor = require('../plugins/process-monitor');
+
+module.exports = async function processMonitorCommand() {
+  const projectConfig = config.loadConfig();
+
+  if (!projectConfig) {
+    console.log(chalk.red('Marmot not initialized. Run: marmot init'));
+    process.exit(1);
+  }
+
+  if (!config.isPluginEnabled(projectConfig, 'process-monitor')) {
+    console.log(chalk.yellow('Process monitor plugin is not enabled.'));
+    console.log('Run:', chalk.cyan('marmot enable process-monitor'));
+    process.exit(1);
+  }
+
+  try {
+    const changes = await processMonitor.run(projectConfig);
+
+    if (changes === 0) {
+      // No changes, silent exit for cron usage
+      process.exit(0);
+    }
+
+    console.log(chalk.green(`Detected ${changes} process change(s)`));
+  } catch (err) {
+    console.error(chalk.red(`Process monitor error: ${err.message}`));
+    process.exit(1);
+  }
+};

package/src/core/config.js

@@ -25,6 +25,9 @@ const DEFAULT_CONFIG = {
     'claude-hooks': {
       enabled: false,
       events: ['PreToolUse', 'PostToolUse', 'Stop', 'SubagentStop', 'UserPromptSubmit', 'SessionStart', 'SessionEnd']
+    },
+    'process-monitor': {
+      enabled: false
     }
   }
 };

package/src/plugins/index.js

@@ -3,5 +3,6 @@ module.exports = {
   'terminal': require('./terminal'),
   'git-hooks': require('./git-hooks'),
   'makefile': require('./makefile'),
-  'claude-hooks': require('./claude-hooks')
+  'claude-hooks': require('./claude-hooks'),
+  'process-monitor': require('./process-monitor')
 };

package/src/plugins/process-monitor.js

@@ -0,0 +1,303 @@
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+const chalk = require('chalk');
+const config = require('../core/config');
+const logger = require('../core/logger');
+
+const MARMOT_CRON_MARKER = '# marmot-process-monitor';
+const SNAPSHOT_FILENAME = 'process-snapshot.json';
+
+function getCrontab() {
+  try {
+    return execSync('crontab -l 2>/dev/null', { encoding: 'utf8' });
+  } catch (err) {
+    return '';
+  }
+}
+
+function setCrontab(content) {
+  try {
+    execSync(`echo "${content.replace(/"/g, '\\"')}" | crontab -`, { encoding: 'utf8' });
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
+function getProcessSnapshotPath(projectDir) {
+  const marmotDir = config.getMarmotDir(projectDir);
+  return path.join(marmotDir, SNAPSHOT_FILENAME);
+}
+
+function getProcessInfo(pid) {
+  try {
+    const procDir = `/proc/${pid}`;
+
+    // Read cwd (working directory)
+    let cwd = null;
+    try {
+      cwd = fs.readlinkSync(path.join(procDir, 'cwd'));
+    } catch (e) {
+      // Permission denied or process ended
+      return null;
+    }
+
+    // Read cmdline (command)
+    let cmdline = '';
+    try {
+      const cmdlineRaw = fs.readFileSync(path.join(procDir, 'cmdline'), 'utf8');
+      cmdline = cmdlineRaw.split('\0').filter(s => s).join(' ');
+    } catch (e) {
+      cmdline = '[unknown]';
+    }
+
+    // Read stat for ppid and starttime
+    let ppid = null;
+    let starttime = null;
+    try {
+      const stat = fs.readFileSync(path.join(procDir, 'stat'), 'utf8');
+      // stat format: pid (comm) state ppid ... field 22 is starttime
+      // Handle comm containing spaces/parens by finding last )
+      const lastParen = stat.lastIndexOf(')');
+      if (lastParen !== -1) {
+        const afterComm = stat.slice(lastParen + 2); // skip ') '
+        const fields = afterComm.split(/\s+/);
+        // fields[0] = state, fields[1] = ppid, ..., fields[19] = starttime
+        ppid = parseInt(fields[1]) || null;
+        starttime = parseInt(fields[19]) || null;
+      }
+    } catch (e) {
+      // Ignore stat errors
+    }
+
+    return {
+      pid,
+      cwd,
+      cmdline,
+      ppid,
+      starttime,
+      key: `${pid}-${starttime || 0}`
+    };
+  } catch (e) {
+    return null;
+  }
+}
+
+function getProjectProcesses(projectDir) {
+  const processes = {};
+  const resolvedProjectDir = path.resolve(projectDir);
+
+  try {
+    const entries = fs.readdirSync('/proc');
+
+    for (const entry of entries) {
+      if (!/^\d+$/.test(entry)) continue;
+
+      const pid = parseInt(entry);
+      const info = getProcessInfo(pid);
+
+      if (!info || !info.cwd) continue;
+
+      // Check if cwd is within project directory
+      if (info.cwd === resolvedProjectDir ||
+          info.cwd.startsWith(resolvedProjectDir + '/')) {
+        processes[info.key] = {
+          pid: info.pid,
+          cwd: info.cwd,
+          cmdline: info.cmdline,
+          ppid: info.ppid,
+          starttime: info.starttime,
+          key: info.key,
+          firstSeen: Date.now()
+        };
+      }
+    }
+  } catch (e) {
+    // /proc read error
+  }
+
+  return processes;
+}
+
+function loadSnapshot(projectDir) {
+  const snapshotPath = getProcessSnapshotPath(projectDir);
+
+  if (!fs.existsSync(snapshotPath)) {
+    return null;
+  }
+
+  try {
+    const content = fs.readFileSync(snapshotPath, 'utf8');
+    return JSON.parse(content);
+  } catch (e) {
+    return null;
+  }
+}
+
+function saveSnapshot(snapshot, projectDir) {
+  const snapshotPath = getProcessSnapshotPath(projectDir);
+  const marmotDir = config.getMarmotDir(projectDir);
+
+  if (!fs.existsSync(marmotDir)) {
+    fs.mkdirSync(marmotDir, { recursive: true });
+  }
+
+  fs.writeFileSync(snapshotPath, JSON.stringify(snapshot, null, 2));
+}
+
+async function run(projectConfig, projectDir = process.cwd()) {
+  const logDir = config.getLogDir(projectConfig, projectDir);
+
+  // Ensure log directory exists
+  if (!fs.existsSync(logDir)) {
+    fs.mkdirSync(logDir, { recursive: true });
+  }
+
+  // Get current processes in project directory
+  const currentProcesses = getProjectProcesses(projectDir);
+
+  // Load previous snapshot
+  const previousSnapshot = loadSnapshot(projectDir);
+
+  // First run: initialize snapshot
+  if (!previousSnapshot) {
+    const snapshot = {
+      processes: currentProcesses,
+      lastRun: Date.now()
+    };
+    saveSnapshot(snapshot, projectDir);
+    await logger.logEvent('process_monitor_initialized', projectDir, 0, {
+      processCount: Object.keys(currentProcesses).length
+    }, projectDir);
+    return 1;
+  }
+
+  const previousProcesses = previousSnapshot.processes || {};
+  let changesFound = 0;
+
+  // Detect new processes (process_started)
+  for (const key of Object.keys(currentProcesses)) {
+    if (!previousProcesses[key]) {
+      const proc = currentProcesses[key];
+      changesFound++;
+      await logger.logEvent('process_started', proc.cwd, 0, {
+        pid: proc.pid,
+        cmdline: proc.cmdline,
+        ppid: proc.ppid
+      }, projectDir);
+      currentProcesses[key].firstSeen = Date.now();
+    } else {
+      // Preserve firstSeen from previous snapshot
+      currentProcesses[key].firstSeen = previousProcesses[key].firstSeen;
+    }
+  }
+
+  // Detect ended processes (process_ended)
+  for (const key of Object.keys(previousProcesses)) {
+    if (!currentProcesses[key]) {
+      const proc = previousProcesses[key];
+      changesFound++;
+
+      // Calculate duration in seconds
+      const duration = Math.round((Date.now() - (proc.firstSeen || previousSnapshot.lastRun)) / 1000);
+
+      await logger.logEvent('process_ended', proc.cwd, 0, {
+        pid: proc.pid,
+        cmdline: proc.cmdline,
+        ppid: proc.ppid,
+        duration
+      }, projectDir);
+    }
+  }
+
+  // Update snapshot
+  const newSnapshot = {
+    processes: currentProcesses,
+    lastRun: Date.now()
+  };
+  saveSnapshot(newSnapshot, projectDir);
+
+  return changesFound;
+}
+
+async function enable(projectConfig) {
+  const projectDir = process.cwd();
+  const marmotDir = config.getMarmotDir(projectDir);
+  const logDir = config.getLogDir(projectConfig, projectDir);
+  const snapshotPath = getProcessSnapshotPath(projectDir);
+
+  console.log('');
+  console.log(chalk.bold('Process Monitor Plugin Setup:'));
+  console.log(`  Marmot directory: ${chalk.cyan(marmotDir)}`);
+  console.log(`  Snapshot file: ${chalk.cyan(snapshotPath)}`);
+  console.log(`  Tracking: ${chalk.cyan('Processes with cwd in project directory')}`);
+
+  // Install cron job
+  const cronJob = `* * * * * cd "${projectDir}" && marmot process-monitor >> "${logDir}/process-cron.log" 2>&1 ${MARMOT_CRON_MARKER}`;
+  const currentCrontab = getCrontab();
+
+  if (currentCrontab.includes(projectDir) && currentCrontab.includes('marmot process-monitor')) {
+    console.log(`  Cron job: ${chalk.yellow('Already installed')}`);
+  } else {
+    const newCrontab = currentCrontab.trim() + '\n' + cronJob + '\n';
+    if (setCrontab(newCrontab)) {
+      console.log(`  Cron job: ${chalk.green('Installed (runs every minute)')}`);
+    } else {
+      console.log(`  Cron job: ${chalk.red('Failed to install')}`);
+      console.log('');
+      console.log('To add manually:');
+      console.log(chalk.cyan(`  crontab -e`));
+      console.log('Then add:');
+      console.log(chalk.cyan(`  ${cronJob}`));
+    }
+  }
+
+  console.log('');
+  console.log('Or run manually with:');
+  console.log(chalk.cyan('  marmot process-monitor'));
+}
+
+async function disable(projectConfig) {
+  const projectDir = process.cwd();
+  const snapshotPath = getProcessSnapshotPath(projectDir);
+
+  console.log('');
+  console.log(chalk.bold('Process Monitor Plugin Disabled:'));
+
+  // Remove cron job
+  const currentCrontab = getCrontab();
+  if (currentCrontab.includes(projectDir) && currentCrontab.includes('marmot process-monitor')) {
+    const lines = currentCrontab.split('\n');
+    const filteredLines = lines.filter(line => {
+      if (line.includes(projectDir) && line.includes('marmot process-monitor')) return false;
+      if (line.includes(MARMOT_CRON_MARKER)) return false;
+      return true;
+    });
+
+    const newCrontab = filteredLines.join('\n').replace(/\n{3,}/g, '\n\n').trim();
+
+    if (setCrontab(newCrontab + '\n')) {
+      console.log(`  Cron job: ${chalk.green('Removed')}`);
+    } else {
+      console.log(`  Cron job: ${chalk.red('Failed to remove')}`);
+      console.log('  Remove manually with: crontab -e');
+    }
+  } else {
+    console.log(`  Cron job: ${chalk.gray('Not found')}`);
+  }
+
+  // Keep snapshot but inform user
+  if (fs.existsSync(snapshotPath)) {
+    console.log(`  Snapshot: ${chalk.cyan(snapshotPath)} (preserved)`);
+    console.log('  To remove snapshot: rm ' + snapshotPath);
+  }
+}
+
+module.exports = {
+  run,
+  enable,
+  disable,
+  getProjectProcesses,
+  getProcessInfo
+};