marmot-logger 1.0.4 → 1.0.6

package/README.md

@@ -1,6 +1,6 @@
 # Marmot
 
-Activity monitoring and logging tool for developer workflows. Creates tamper-evident audit trails by tracking file changes, terminal commands, git operations, and Claude Code hooks with optional cryptographic signing.
+Activity monitoring and logging tool for developer workflows. Creates tamper-evident audit trails by tracking file changes, terminal commands, git operations, process execution, and Claude Code hooks with optional cryptographic signing.
 
 ## Project Structure
 
@@ -17,6 +17,7 @@ marmot/
 │   │   ├── status.js          # marmot status
 │   │   ├── logs.js            # marmot logs
 │   │   ├── monitor.js         # marmot monitor
+│   │   ├── process-monitor.js # marmot process-monitor
 │   │   ├── verify.js          # marmot verify
 │   │   ├── log.js             # marmot log <event> (internal, used by hooks)
 │   │   └── login.js           # marmot login
@@ -31,6 +32,7 @@ marmot/
 │       ├── terminal.js        # Bash command logging via PROMPT_COMMAND
 │       ├── git-hooks.js       # Git hook integration
 │       ├── claude-hooks.js    # Claude Code IDE integration
+│       ├── process-monitor.js # Process tracking via /proc filesystem
 │       └── makefile.js        # Makefile target logging (manual setup)
 ├── openapi.yaml               # Signing service API specification
 └── package.json
@@ -61,23 +63,24 @@ marmot --help
 
 ### Configuration Storage
 
-Config is stored in `/tmp/marmot/<hash>/` where `<hash>` is MD5 of the absolute project path. This keeps marmot data out of the project directory.
+All marmot data is stored in `/tmp/marmot/<hash>/` where `<hash>` is MD5 of the absolute project path. This keeps marmot data completely out of the project directory.
 
 ```
 /tmp/marmot/<hash>/
-├── .marmotrc.json      # Project config
-├── snapshot/           # File monitor snapshot (rsync copy)
-└── terminal-hook.sh    # Generated bash hook script
+├── .marmotrc.json        # Project config
+├── logs/                 # Log files (default location)
+│   └── file_events_YYYY-MM-DD.log
+├── snapshot/             # File monitor snapshot (rsync copy)
+├── process-snapshot.json # Process monitor state
+└── terminal-hook.sh      # Generated bash hook script
 ```
 
-Logs are written to `./marmot-logs/` in the project directory.
-
 ### Config Resolution Priority
 
 1. Environment variables (`MARMOT_API_KEY`, `MARMOT_URL`)
 2. `.env` file in project root
 3. Cached values in `.marmotrc.json`
-4. Defaults (`https://logging.drazou.net`, `./marmot-logs/`)
+4. Defaults (`https://logging.drazou.net`, logs in marmot temp dir)
 
 ### Core Modules
 
@@ -85,13 +88,14 @@ Logs are written to `./marmot-logs/` in the project directory.
 - `loadConfig(projectDir)` / `saveConfig(config, projectDir)` - JSON persistence
 - `getSigningUrl(projectDir)` / `getApiKey(projectDir)` - Multi-source resolution
 - `getMarmotDir(projectDir)` - Returns `/tmp/marmot/<hash>`
+- `getLogDir(config, projectDir)` - Returns log directory (default: `/tmp/marmot/<hash>/logs`)
 - `enablePlugin(config, name)` / `disablePlugin(config, name)` - Toggle plugins
 
 **[logger.js](src/core/logger.js)** - Activity logging
 - `logEvent(eventType, path, size, extra, projectDir)` - Main logging API
 - `readLogs(logFile, options)` - Parse JSON Lines log files
 - `verifyLogs(logFile, projectDir)` - Verify signatures with backend
-- Logs to `./marmot-logs/file_events_YYYY-MM-DD.log` (JSON Lines format)
+- Logs to `<marmotDir>/logs/file_events_YYYY-MM-DD.log` (JSON Lines format)
 - Falls back to unsigned entries if signing service unavailable
 
 **[signer.js](src/core/signer.js)** - Remote signing client
@@ -130,8 +134,18 @@ All plugins export `enable(projectConfig)` and `disable(projectConfig)` function
 
 **[claude-hooks.js](src/plugins/claude-hooks.js)**
 - Configures hooks in `.claude/settings.local.json`
-- Events: `PreToolUse`, `PostToolUse`, `Stop`, `SubagentStop`, `UserPromptSubmit`, `SessionStart`, `SessionEnd`
+- Events: `PreToolUse`, `PostToolUse`, `Stop`, `SubagentStop`, `UserPromptSubmit`, `Notification`, `PreCompact`, `SessionStart`, `SessionEnd`
 - Logged as `claude_hook_<EventType>`
+- Tool events include `tool_name`, `tool_input` (full parameters), and `description`
+- `UserPromptSubmit` logs full untruncated prompt in `prompt` field
+
+**[process-monitor.js](src/plugins/process-monitor.js)**
+- Tracks processes launched from project directory via `/proc` filesystem
+- Polls at configurable interval (default: 15 seconds)
+- Cron job runs every minute, performs multiple polls within each minute
+- Automatically filters out marmot's own processes
+- Events: `process_started`, `process_ended`, `process_monitor_initialized`
+- `process_ended` includes `duration` in seconds
 
 **[makefile.js](src/plugins/makefile.js)**
 - Non-intrusive: only prints manual setup instructions
@@ -142,12 +156,13 @@ All plugins export `enable(projectConfig)` and `disable(projectConfig)` function
 
 | Command | Handler | Description |
 |---------|---------|-------------|
-| `marmot init` | [init.js](src/cli/init.js) | Create config, log directory, update .gitignore |
+| `marmot init` | [init.js](src/cli/init.js) | Create config and log directory |
 | `marmot enable <plugin>` | [enable.js](src/cli/enable.js) | Enable plugin and run setup |
 | `marmot disable <plugin>` | [disable.js](src/cli/disable.js) | Disable plugin and cleanup |
 | `marmot status` | [status.js](src/cli/status.js) | Show config, plugin status, signing health |
 | `marmot logs [--today] [--last N]` | [logs.js](src/cli/logs.js) | Display log entries with color coding |
 | `marmot monitor` | [monitor.js](src/cli/monitor.js) | Run file monitor once (for cron) |
+| `marmot process-monitor` | [process-monitor.js](src/cli/process-monitor.js) | Run process monitor once (for cron) |
 | `marmot verify [--file PATH]` | [verify.js](src/cli/verify.js) | Verify log signatures |
 | `marmot log <event> [-d JSON]` | [log.js](src/cli/log.js) | Log event (used internally by hooks) |
 | `marmot login` | [login.js](src/cli/login.js) | Set API key interactively |
@@ -160,6 +175,10 @@ JSON Lines format - one JSON object per line:
 {"timestamp":"2025-12-22T14:30:00Z","uuid":"550e8400-e29b-41d4-a716-446655440000","event":"modified","path":"/project/src/index.js","size":1234,"additions":10,"deletions":5,"signed":true}
 {"timestamp":"2025-12-22T14:31:00Z","uuid":"...","event":"terminal","path":"/project","command":"npm test","size":0,"signed":true}
 {"timestamp":"2025-12-22T14:32:00Z","uuid":"...","event":"git_commit","path":"abc1234: Fix bug","size":0,"signed":true}
+{"timestamp":"2025-12-22T14:33:00Z","uuid":"...","event":"process_started","path":"/project","pid":12345,"cmdline":"node server.js","ppid":1234,"signed":true}
+{"timestamp":"2025-12-22T14:35:00Z","uuid":"...","event":"process_ended","path":"/project","pid":12345,"cmdline":"node server.js","ppid":1234,"duration":120,"signed":true}
+{"timestamp":"2025-12-22T14:36:00Z","uuid":"...","event":"claude_hook_PreToolUse","path":"/project/src/file.js","tool_name":"Edit","tool_input":{"file_path":"/project/src/file.js","old_string":"...","new_string":"..."},"signed":true}
+{"timestamp":"2025-12-22T14:37:00Z","uuid":"...","event":"claude_hook_UserPromptSubmit","path":"/project","prompt":"Full user prompt text here...","signed":true}
 ```
 
 Fields added by signing service: `timestamp`, `uuid`, `signed: true`
@@ -193,8 +212,8 @@ await marmot.log({
   metadata: { custom: 'data' }
 });
 
-const entries = marmot.readLogs('./marmot-logs/file_events_2025-12-22.log');
-const results = await marmot.verifyLogs('./marmot-logs/file_events_2025-12-22.log');
+const entries = marmot.readLogs('/tmp/marmot/<hash>/logs/file_events_2025-12-22.log');
+const results = await marmot.verifyLogs('/tmp/marmot/<hash>/logs/file_events_2025-12-22.log');
 
 // Signing
 const signed = await marmot.sign(entry);
@@ -213,7 +232,7 @@ const health = await marmot.healthCheck();
 
 ```json
 {
-  "logDir": "./marmot-logs",
+  "logDir": null,
   "bearerToken": "broken-bearer",
   "plugins": {
     "file-monitor": { "enabled": false },
@@ -225,12 +244,18 @@ const health = await marmot.healthCheck();
     "makefile": { "enabled": false },
     "claude-hooks": {
       "enabled": false,
-      "events": ["PreToolUse", "PostToolUse", "Stop", "SubagentStop", "UserPromptSubmit", "SessionStart", "SessionEnd"]
+      "events": ["PreToolUse", "PostToolUse", "Stop", "SubagentStop", "UserPromptSubmit", "Notification", "PreCompact", "SessionStart", "SessionEnd"]
+    },
+    "process-monitor": {
+      "enabled": false,
+      "intervalSeconds": 15
     }
   }
 }
 ```
 
+**Note:** When `logDir` is `null` (default), logs are stored in `/tmp/marmot/<hash>/logs/`. Set a custom path to override.
+
 ## Adding a New Plugin
 
 1. Create `src/plugins/my-plugin.js`:
@@ -271,7 +296,9 @@ module.exports = {
 }
 ```
 
-4. Update CLI help in [bin/marmot.js](bin/marmot.js) (enable command description).
+4. Add to `VALID_PLUGINS` in [src/cli/enable.js](src/cli/enable.js) and [src/cli/disable.js](src/cli/disable.js).
+
+5. Update CLI help in [bin/marmot.js](bin/marmot.js) (enable command description).
 
 ## Adding a New CLI Command
 
@@ -317,13 +344,18 @@ program
 | `git_checkout` | git-hooks | - |
 | `git_merge` | git-hooks | - |
 | `make_command` | makefile | - |
-| `claude_hook_PreToolUse` | claude-hooks | tool details in path |
-| `claude_hook_PostToolUse` | claude-hooks | tool details in path |
-| `claude_hook_Stop` | claude-hooks | stop reason in path |
-| `claude_hook_SubagentStop` | claude-hooks | stop reason in path |
-| `claude_hook_UserPromptSubmit` | claude-hooks | prompt preview in path |
-| `claude_hook_SessionStart` | claude-hooks | session ID in path |
-| `claude_hook_SessionEnd` | claude-hooks | session ID in path |
+| `process_monitor_initialized` | process-monitor | `processCount` |
+| `process_started` | process-monitor | `pid`, `cmdline`, `ppid` |
+| `process_ended` | process-monitor | `pid`, `cmdline`, `ppid`, `duration` |
+| `claude_hook_PreToolUse` | claude-hooks | `tool_name`, `tool_input`, `description` |
+| `claude_hook_PostToolUse` | claude-hooks | `tool_name`, `tool_input`, `description` |
+| `claude_hook_Stop` | claude-hooks | `stop_reason` |
+| `claude_hook_SubagentStop` | claude-hooks | `stop_reason` |
+| `claude_hook_UserPromptSubmit` | claude-hooks | `prompt` (full untruncated) |
+| `claude_hook_Notification` | claude-hooks | `message` |
+| `claude_hook_PreCompact` | claude-hooks | - |
+| `claude_hook_SessionStart` | claude-hooks | `session_id` |
+| `claude_hook_SessionEnd` | claude-hooks | `session_id` |
 
 ## Data Flow
 
@@ -343,7 +375,7 @@ Unsigned entry             Signed entry with uuid/timestamp
     └───────────┬───────────────┘
                 │
                 ▼
-    Append to ./marmot-logs/file_events_YYYY-MM-DD.log
+    Append to /tmp/marmot/<hash>/logs/file_events_YYYY-MM-DD.log
 ```
 
 ## License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "marmot-logger",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "Activity monitoring tool for developer workflows - tracks file changes, terminal commands, git operations, and Claude Code hooks",
   "main": "src/index.js",
   "bin": {

package/src/cli/log.js

@@ -42,29 +42,39 @@ module.exports = async function log(event, options) {
 
     // Extract relevant fields based on hook type
     if (hookType === 'PreToolUse' || hookType === 'PostToolUse') {
-      const toolInput = data.tool_input || data;
-      const toolName = toolInput.tool_name || 'unknown';
-      const command = toolInput.command || '';
-      const filePath = toolInput.file_path || '';
-      const description = toolInput.description || '';
-
-      if (command) {
-        eventPath = `${toolName}: ${command.substring(0, 200)}`;
-      } else if (filePath) {
-        eventPath = `${toolName}: ${filePath}`;
-      } else if (description) {
-        eventPath = `${toolName}: ${description.substring(0, 200)}`;
+      // Tool name is at top level, tool_input contains the parameters
+      const toolName = data.tool_name || 'unknown';
+      const toolInput = data.tool_input || {};
+
+      extra.tool_name = toolName;
+      extra.tool_input = toolInput;
+
+      // Extract description if available (Bash tool has this)
+      if (toolInput.description) {
+        extra.description = toolInput.description;
+      }
+
+      // Use file_path as eventPath if available, otherwise use project dir
+      if (toolInput.file_path) {
+        eventPath = toolInput.file_path;
       } else {
-        eventPath = toolName;
+        eventPath = process.cwd();
       }
     } else if (hookType === 'Stop' || hookType === 'SubagentStop') {
-      eventPath = data.stop_reason || 'completed';
+      extra.stop_reason = data.stop_reason || 'completed';
+      eventPath = process.cwd();
     } else if (hookType === 'UserPromptSubmit') {
-      const prompt = data.prompt || data.user_prompt || '';
-      eventPath = `prompt: ${prompt.substring(0, 200)}`;
+      // Store full untruncated prompt
+      extra.prompt = data.prompt || data.user_prompt || '';
+      eventPath = process.cwd();
     } else if (hookType === 'SessionStart' || hookType === 'SessionEnd') {
-      const sessionId = data.session_id || 'unknown';
-      eventPath = `${hookType.toLowerCase()}: ${sessionId}`;
+      extra.session_id = data.session_id || 'unknown';
+      eventPath = process.cwd();
+    } else if (hookType === 'Notification') {
+      extra.message = data.message || '';
+      eventPath = process.cwd();
+    } else if (hookType === 'PreCompact') {
+      eventPath = process.cwd();
     }
   }
 

package/src/core/config.js

@@ -6,7 +6,7 @@ const CONFIG_FILE = '.marmotrc.json';
 const MARMOT_TMP_BASE = '/tmp/marmot';
 
 const DEFAULT_CONFIG = {
-  logDir: './marmot-logs',
+  logDir: null,  // null means use marmot temp dir (default)
   bearerToken: 'broken-bearer',
   plugins: {
     'file-monitor': {
@@ -24,7 +24,7 @@ const DEFAULT_CONFIG = {
     },
     'claude-hooks': {
       enabled: false,
-      events: ['PreToolUse', 'PostToolUse', 'Stop', 'SubagentStop', 'UserPromptSubmit', 'SessionStart', 'SessionEnd']
+      events: ['PreToolUse', 'PostToolUse', 'Stop', 'SubagentStop', 'UserPromptSubmit', 'Notification', 'PreCompact', 'SessionStart', 'SessionEnd']
     },
     'process-monitor': {
       enabled: false,
@@ -122,7 +122,12 @@ function getApiKey(projectDir = process.cwd()) {
 }
 
 function getLogDir(config, projectDir = process.cwd()) {
-  return path.resolve(projectDir, config.logDir || './logs');
+  if (config.logDir) {
+    // Custom log dir specified - resolve relative to project
+    return path.resolve(projectDir, config.logDir);
+  }
+  // Default: use marmot temp dir
+  return path.join(getMarmotDir(projectDir), 'logs');
 }
 
 function getSnapshotDir(config, projectDir = process.cwd()) {

package/src/plugins/claude-hooks.js

@@ -50,7 +50,8 @@ async function enable(projectConfig) {
   const projectDir = process.cwd();
   const events = projectConfig.plugins?.['claude-hooks']?.events || [
     'PreToolUse', 'PostToolUse', 'Stop', 'SubagentStop',
-    'UserPromptSubmit', 'SessionStart', 'SessionEnd'
+    'UserPromptSubmit', 'Notification', 'PreCompact',
+    'SessionStart', 'SessionEnd'
   ];
 
   const settings = loadClaudeSettings(projectDir);