pisama-claude-code 0.3.1__tar.gz → 0.3.2__tar.gz

pisama_claude_code-0.3.2/PKG-INFO

@@ -0,0 +1,211 @@
+Metadata-Version: 2.4
+Name: pisama-claude-code
+Version: 0.3.2
+Summary: Trace capture for Claude Code sessions - sync to PISAMA platform for analysis
+Project-URL: Homepage, https://pisama.dev
+Project-URL: Documentation, https://pisama.dev/docs/claude-code
+Project-URL: Repository, https://github.com/tn-pisama/pisama-claude-code
+Author-email: PISAMA Team <team@pisama.dev>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent,claude,claude-code,forensics,llm,observability,pisama,self-healing
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Topic :: System :: Monitoring
+Requires-Python: >=3.10
+Requires-Dist: click>=8.0.0
+Requires-Dist: httpx>=0.25.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: rich>=13.0.0
+Provides-Extra: all
+Requires-Dist: pisama-core>=0.1.0; extra == 'all'
+Provides-Extra: core
+Requires-Dist: pisama-core>=0.1.0; extra == 'core'
+Provides-Extra: dev
+Requires-Dist: pytest-asyncio>=0.21.0; extra == 'dev'
+Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
+Requires-Dist: pytest>=7.0.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# pisama-claude-code
+
+Trace capture for Claude Code sessions with token usage and cost tracking.
+
+[![PyPI version](https://badge.fury.io/py/pisama-claude-code.svg)](https://pypi.org/project/pisama-claude-code/)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+## Installation
+
+```bash
+pip install pisama-claude-code
+```
+
+## Quick Start
+
+```bash
+# Install capture hooks
+pisama-cc install
+
+# View recent traces
+pisama-cc traces
+
+# Show token usage and cost
+pisama-cc usage --by-model --by-tool
+
+# Export traces
+pisama-cc export -o traces.jsonl
+```
+
+## Overview
+
+Lightweight trace capture client for Claude Code. Captures tool calls, token usage, and costs. Optionally syncs to PISAMA platform for analysis.
+
+**This package captures traces. Analysis happens on the platform.**
+
+```
+┌─────────────────────┐         ┌─────────────────────┐
+│   Claude Code       │         │   PISAMA Platform   │
+│   + pisama-cc       │ ──────▶ │   (analysis)        │
+│   (capture)         │  sync   │   (detection)       │
+└─────────────────────┘         │   (self-healing)    │
+                                └─────────────────────┘
+```
+
+## Features
+
+### Local Features (no platform needed)
+
+| Feature | Description |
+|---------|-------------|
+| Trace capture | Capture all tool calls (Bash, Read, Write, etc.) |
+| Token tracking | Input, output, and cache tokens per call |
+| Cost calculation | USD cost per trace and session totals |
+| Model tracking | Track which Claude model is used |
+| Local storage | SQLite + JSONL in `~/.claude/pisama/traces/` |
+| Export | JSONL and gzip formats |
+
+### Platform Features (requires connection)
+
+| Feature | Description |
+|---------|-------------|
+| Failure detection | 28 MAST failure modes |
+| Severity scores | Confidence and severity ratings |
+| Fix suggestions | AI-powered remediation |
+| Self-healing | Automatic intervention |
+| Dashboard | Visual analytics |
+
+## CLI Commands
+
+```bash
+pisama-cc install       # Install capture hooks to ~/.claude/hooks/
+pisama-cc uninstall     # Remove hooks
+pisama-cc status        # Show status, token totals, and cost
+pisama-cc traces        # View recent traces
+pisama-cc traces -v     # Verbose: show tokens and cost per trace
+pisama-cc usage         # Token usage and cost breakdown
+pisama-cc usage --by-model --by-tool  # Grouped breakdown
+pisama-cc export -o FILE  # Export to JSONL
+pisama-cc export --compress  # Export to gzip
+pisama-cc connect       # Connect to PISAMA platform
+pisama-cc sync          # Upload traces to platform
+pisama-cc analyze       # Run failure detection (requires platform)
+```
+
+## Example Output
+
+### Status
+```
+📊 PISAMA Status
+========================================
+
+🔧 Hook Installation:
+   ✅ pisama-capture.py
+   ✅ pisama-pre.sh
+   ✅ pisama-post.sh
+   All hooks installed
+
+📁 Local Traces: 1400
+   Input tokens:  9,580
+   Output tokens: 79,569
+   Total cost:    $43.22
+   Models: claude-opus-4-5-20251101
+```
+
+### Usage Breakdown
+```
+📊 Token Usage Summary (last 100 traces)
+==================================================
+Input tokens:           10,234
+Output tokens:          85,421
+Cache read tokens:   1,234,567
+Total tokens:           95,655
+Total cost:        $    52.34
+
+📈 By Model:
+--------------------------------------------------
+  claude-opus-4-5-20251101            $52.34
+
+🔧 By Tool:
+--------------------------------------------------
+  Bash                   45 calls  $25.12
+  Read                   30 calls  $15.34
+  Write                  20 calls  $8.45
+  Edit                   5 calls   $3.43
+```
+
+## Model Pricing
+
+Supported models and pricing (per 1M tokens):
+
+| Model | Input | Output | Cache Read |
+|-------|-------|--------|------------|
+| claude-opus-4-5 | $15.00 | $75.00 | $1.50 |
+| claude-sonnet-4 | $3.00 | $15.00 | $0.30 |
+| claude-3-5-sonnet | $3.00 | $15.00 | $0.30 |
+| claude-3-5-haiku | $0.80 | $4.00 | $0.08 |
+
+## Privacy
+
+- Traces stored locally in `~/.claude/pisama/traces/`
+- Secrets automatically redacted (API keys, passwords, tokens)
+- File paths anonymized (home directory → `~`)
+- Platform sync is opt-in
+
+## Requirements
+
+- Python 3.10+
+- Claude Code CLI
+
+## Configuration
+
+After installation, add hooks to `~/.claude/settings.local.json`:
+
+```json
+{
+  "hooks": {
+    "PreToolCall": [
+      {
+        "command": "~/.claude/hooks/pisama-pre.sh",
+        "timeout": 2000
+      }
+    ],
+    "PostToolCall": [
+      {
+        "command": "~/.claude/hooks/pisama-post.sh",
+        "timeout": 2000
+      }
+    ]
+  }
+}
+```
+
+## License
+
+MIT

pisama_claude_code-0.3.2/README.md

@@ -0,0 +1,176 @@
+# pisama-claude-code
+
+Trace capture for Claude Code sessions with token usage and cost tracking.
+
+[![PyPI version](https://badge.fury.io/py/pisama-claude-code.svg)](https://pypi.org/project/pisama-claude-code/)
+[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
+## Installation
+
+```bash
+pip install pisama-claude-code
+```
+
+## Quick Start
+
+```bash
+# Install capture hooks
+pisama-cc install
+
+# View recent traces
+pisama-cc traces
+
+# Show token usage and cost
+pisama-cc usage --by-model --by-tool
+
+# Export traces
+pisama-cc export -o traces.jsonl
+```
+
+## Overview
+
+Lightweight trace capture client for Claude Code. Captures tool calls, token usage, and costs. Optionally syncs to PISAMA platform for analysis.
+
+**This package captures traces. Analysis happens on the platform.**
+
+```
+┌─────────────────────┐         ┌─────────────────────┐
+│   Claude Code       │         │   PISAMA Platform   │
+│   + pisama-cc       │ ──────▶ │   (analysis)        │
+│   (capture)         │  sync   │   (detection)       │
+└─────────────────────┘         │   (self-healing)    │
+                                └─────────────────────┘
+```
+
+## Features
+
+### Local Features (no platform needed)
+
+| Feature | Description |
+|---------|-------------|
+| Trace capture | Capture all tool calls (Bash, Read, Write, etc.) |
+| Token tracking | Input, output, and cache tokens per call |
+| Cost calculation | USD cost per trace and session totals |
+| Model tracking | Track which Claude model is used |
+| Local storage | SQLite + JSONL in `~/.claude/pisama/traces/` |
+| Export | JSONL and gzip formats |
+
+### Platform Features (requires connection)
+
+| Feature | Description |
+|---------|-------------|
+| Failure detection | 28 MAST failure modes |
+| Severity scores | Confidence and severity ratings |
+| Fix suggestions | AI-powered remediation |
+| Self-healing | Automatic intervention |
+| Dashboard | Visual analytics |
+
+## CLI Commands
+
+```bash
+pisama-cc install       # Install capture hooks to ~/.claude/hooks/
+pisama-cc uninstall     # Remove hooks
+pisama-cc status        # Show status, token totals, and cost
+pisama-cc traces        # View recent traces
+pisama-cc traces -v     # Verbose: show tokens and cost per trace
+pisama-cc usage         # Token usage and cost breakdown
+pisama-cc usage --by-model --by-tool  # Grouped breakdown
+pisama-cc export -o FILE  # Export to JSONL
+pisama-cc export --compress  # Export to gzip
+pisama-cc connect       # Connect to PISAMA platform
+pisama-cc sync          # Upload traces to platform
+pisama-cc analyze       # Run failure detection (requires platform)
+```
+
+## Example Output
+
+### Status
+```
+📊 PISAMA Status
+========================================
+
+🔧 Hook Installation:
+   ✅ pisama-capture.py
+   ✅ pisama-pre.sh
+   ✅ pisama-post.sh
+   All hooks installed
+
+📁 Local Traces: 1400
+   Input tokens:  9,580
+   Output tokens: 79,569
+   Total cost:    $43.22
+   Models: claude-opus-4-5-20251101
+```
+
+### Usage Breakdown
+```
+📊 Token Usage Summary (last 100 traces)
+==================================================
+Input tokens:           10,234
+Output tokens:          85,421
+Cache read tokens:   1,234,567
+Total tokens:           95,655
+Total cost:        $    52.34
+
+📈 By Model:
+--------------------------------------------------
+  claude-opus-4-5-20251101            $52.34
+
+🔧 By Tool:
+--------------------------------------------------
+  Bash                   45 calls  $25.12
+  Read                   30 calls  $15.34
+  Write                  20 calls  $8.45
+  Edit                   5 calls   $3.43
+```
+
+## Model Pricing
+
+Supported models and pricing (per 1M tokens):
+
+| Model | Input | Output | Cache Read |
+|-------|-------|--------|------------|
+| claude-opus-4-5 | $15.00 | $75.00 | $1.50 |
+| claude-sonnet-4 | $3.00 | $15.00 | $0.30 |
+| claude-3-5-sonnet | $3.00 | $15.00 | $0.30 |
+| claude-3-5-haiku | $0.80 | $4.00 | $0.08 |
+
+## Privacy
+
+- Traces stored locally in `~/.claude/pisama/traces/`
+- Secrets automatically redacted (API keys, passwords, tokens)
+- File paths anonymized (home directory → `~`)
+- Platform sync is opt-in
+
+## Requirements
+
+- Python 3.10+
+- Claude Code CLI
+
+## Configuration
+
+After installation, add hooks to `~/.claude/settings.local.json`:
+
+```json
+{
+  "hooks": {
+    "PreToolCall": [
+      {
+        "command": "~/.claude/hooks/pisama-pre.sh",
+        "timeout": 2000
+      }
+    ],
+    "PostToolCall": [
+      {
+        "command": "~/.claude/hooks/pisama-post.sh",
+        "timeout": 2000
+      }
+    ]
+  }
+}
+```
+
+## License
+
+MIT

{pisama_claude_code-0.3.1 → pisama_claude_code-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pisama-claude-code"
-version = "0.3.1"
+version = "0.3.2"
 description = "Trace capture for Claude Code sessions - sync to PISAMA platform for analysis"
 readme = "README.md"
 license = "MIT"

{pisama_claude_code-0.3.1 → pisama_claude_code-0.3.2}/src/pisama_claude_code/__init__.py

@@ -1,6 +1,6 @@
 """PISAMA Claude Code Integration - Trace capture, failure detection, and self-healing."""
 
-__version__ = "0.1.0"
+__version__ = "0.3.2"
 
 # Lazy imports to avoid loading everything at startup
 def install(force: bool = False):

{pisama_claude_code-0.3.1 → pisama_claude_code-0.3.2}/src/pisama_claude_code/cli.py

@@ -53,7 +53,7 @@ def save_config(config: dict):
 
 
 @click.group()
-@click.version_option(version="0.3.1")
+@click.version_option(version="0.3.2")
 def main():
     """PISAMA Claude Code - Trace capture and sync."""
     pass
@@ -680,5 +680,463 @@ def mark_synced(traces: list):
             }) + "\n")
 
 
+# =============================================================================
+# VAULT COMMANDS - PII Tokenization Vault Management
+# =============================================================================
+
+@main.group()
+def vault():
+    """Manage the PII tokenization vault."""
+    pass
+
+
+@vault.command("status")
+def vault_status():
+    """Show vault status and statistics."""
+    try:
+        from pisama_core.tokenization import TokenVault, KeychainManager
+    except ImportError:
+        click.echo("❌ pisama-core not installed or tokenization not available")
+        click.echo("   Install with: pip install pisama-core[tokenization]")
+        return
+
+    vault_path = CONFIG_DIR / "vault.db"
+
+    click.echo("🔐 PISAMA Vault Status")
+    click.echo("=" * 50)
+
+    # Check keychain
+    click.echo("\n🔑 Encryption Key:")
+    try:
+        keychain = KeychainManager(allow_file_fallback=True)
+        status = keychain.get_status()
+        if status["available"]:
+            click.echo(f"   Backend: {status['backend']}")
+            if status["key_exists"]:
+                click.echo("   ✅ Key stored")
+                if not status["is_secure"]:
+                    click.echo("   ⚠️  Using file fallback (less secure)")
+            else:
+                click.echo("   ❌ No key found")
+                click.echo("   Key will be auto-generated on first use")
+        else:
+            click.echo("   ❌ Keychain not available")
+    except Exception as e:
+        click.echo(f"   ❌ Error: {e}")
+
+    # Check vault database
+    click.echo("\n💾 Vault Database:")
+    if vault_path.exists():
+        size_kb = vault_path.stat().st_size // 1024
+        click.echo(f"   Path: {vault_path}")
+        click.echo(f"   Size: {size_kb} KB")
+
+        try:
+            token_vault = TokenVault(vault_path)
+            token_vault.initialize()
+            stats = token_vault.get_stats()
+
+            click.echo(f"   Total tokens: {stats.get('total_tokens', 0):,}")
+            click.echo(f"   Sessions: {stats.get('unique_sessions', 0)}")
+
+            by_type = stats.get("by_type", {})
+            if by_type:
+                click.echo("   By type:")
+                for pii_type, count in sorted(by_type.items()):
+                    click.echo(f"      {pii_type}: {count:,}")
+
+            if not stats.get("encryption_available"):
+                click.echo("   ⚠️  Encryption not available (install cryptography)")
+
+            token_vault.close()
+        except Exception as e:
+            click.echo(f"   ❌ Error reading vault: {e}")
+    else:
+        click.echo(f"   Path: {vault_path}")
+        click.echo("   Status: Not created yet")
+        click.echo("   Will be created on first tokenization")
+
+    # Tokenization config
+    click.echo("\n⚙️  Configuration:")
+    config_data = get_config()
+    tokenization = config_data.get("tokenization", {})
+    enabled = tokenization.get("enabled", True)
+    click.echo(f"   Tokenization: {'enabled' if enabled else 'disabled'}")
+
+
+@vault.command("lookup")
+@click.argument("token")
+@click.option("--reason", "-r", required=True, help="Reason for lookup (audit log)")
+@click.option("--ticket", "-t", help="Incident ticket reference")
+def vault_lookup(token: str, reason: str, ticket: Optional[str]):
+    """Look up a token to reveal original value (with audit logging)."""
+    try:
+        from pisama_core.tokenization import TokenVault, KeychainManager, TokenParser
+    except ImportError:
+        click.echo("❌ pisama-core not installed")
+        return
+
+    vault_path = CONFIG_DIR / "vault.db"
+
+    if not vault_path.exists():
+        click.echo("❌ Vault not found")
+        return
+
+    # Validate token format
+    parser = TokenParser()
+    if not parser.is_valid_token(token):
+        click.echo(f"❌ Invalid token format: {token}")
+        click.echo("   Expected: [TYPE:sess:random]")
+        return
+
+    # Get encryption key
+    keychain = KeychainManager(allow_file_fallback=True)
+    key = keychain.get_key()
+
+    if key is None:
+        click.echo("❌ No encryption key found")
+        return
+
+    # Lookup in vault
+    token_vault = TokenVault(vault_path)
+    token_vault.initialize()
+
+    try:
+        original = token_vault.retrieve(token, key)
+
+        if original:
+            click.echo(f"Token: {token}")
+            click.echo(f"Value: {original}")
+
+            # Get token info
+            info = token_vault.get_token_info(token)
+            if info:
+                click.echo(f"Type: {info.pii_type}")
+                click.echo(f"Session: {info.session_id}")
+                click.echo(f"Created: {info.created_at}")
+
+            # Log to audit
+            _log_vault_access(token, reason, ticket, "lookup")
+            click.echo(f"\n✅ Access logged (reason: {reason})")
+        else:
+            click.echo(f"❌ Token not found: {token}")
+    finally:
+        token_vault.close()
+
+
+@vault.command("delete")
+@click.option("--token", help="Delete specific token")
+@click.option("--session", help="Delete all tokens for session")
+@click.option("--value-hash", help="Delete by value hash (GDPR erasure)")
+@click.option("--reason", "-r", required=True, help="Reason for deletion")
+@click.option("--confirm", is_flag=True, help="Skip confirmation prompt")
+def vault_delete(
+    token: Optional[str],
+    session: Optional[str],
+    value_hash: Optional[str],
+    reason: str,
+    confirm: bool,
+):
+    """Delete tokens from vault (GDPR erasure support)."""
+    try:
+        from pisama_core.tokenization import TokenVault
+    except ImportError:
+        click.echo("❌ pisama-core not installed")
+        return
+
+    if not any([token, session, value_hash]):
+        click.echo("❌ Specify --token, --session, or --value-hash")
+        return
+
+    vault_path = CONFIG_DIR / "vault.db"
+    if not vault_path.exists():
+        click.echo("❌ Vault not found")
+        return
+
+    token_vault = TokenVault(vault_path)
+    token_vault.initialize()
+
+    try:
+        if token:
+            if not confirm:
+                click.confirm(f"Delete token {token}?", abort=True)
+            deleted = token_vault.delete_token(token)
+            if deleted:
+                click.echo(f"✅ Deleted token: {token}")
+                _log_vault_access(token, reason, None, "delete")
+            else:
+                click.echo(f"❌ Token not found: {token}")
+
+        elif session:
+            tokens = token_vault.list_session_tokens(session)
+            if not tokens:
+                click.echo(f"No tokens found for session: {session}")
+                return
+
+            if not confirm:
+                click.confirm(f"Delete {len(tokens)} tokens for session {session}?", abort=True)
+
+            count = token_vault.delete_session(session)
+            click.echo(f"✅ Deleted {count} tokens for session {session}")
+            _log_vault_access(f"session:{session}", reason, None, "delete_session")
+
+        elif value_hash:
+            if not confirm:
+                click.confirm(f"Delete all tokens with value hash {value_hash[:16]}...?", abort=True)
+
+            count = token_vault.delete_by_value_hash(value_hash)
+            if count > 0:
+                click.echo(f"✅ Deleted {count} tokens (GDPR erasure)")
+                _log_vault_access(f"hash:{value_hash[:16]}", reason, None, "gdpr_erasure")
+            else:
+                click.echo("No matching tokens found")
+
+    finally:
+        token_vault.close()
+
+
+@vault.command("health")
+def vault_health():
+    """Check vault health and integrity."""
+    try:
+        from pisama_core.tokenization import TokenVault, KeychainManager
+    except ImportError:
+        click.echo("❌ pisama-core not installed")
+        return
+
+    vault_path = CONFIG_DIR / "vault.db"
+
+    click.echo("🏥 Vault Health Check")
+    click.echo("=" * 50)
+
+    issues = []
+
+    # Check vault file
+    click.echo("\n1. Vault Database:")
+    if vault_path.exists():
+        click.echo("   ✅ Database exists")
+        size = vault_path.stat().st_size
+        if size > 100 * 1024 * 1024:  # 100MB
+            click.echo(f"   ⚠️  Large database ({size // 1024 // 1024} MB)")
+            issues.append("Consider running 'pisama-cc vault vacuum'")
+    else:
+        click.echo("   ⚠️  Database not created yet")
+
+    # Check encryption key
+    click.echo("\n2. Encryption Key:")
+    try:
+        keychain = KeychainManager(allow_file_fallback=True)
+        if keychain.key_exists():
+            click.echo("   ✅ Key available")
+            status = keychain.get_status()
+            if not status["is_secure"]:
+                click.echo("   ⚠️  Using file fallback (less secure)")
+                issues.append("Consider enabling OS keychain for better security")
+        else:
+            click.echo("   ⚠️  No key (will be created on first use)")
+    except Exception as e:
+        click.echo(f"   ❌ Error: {e}")
+        issues.append(f"Keychain error: {e}")
+
+    # Check database integrity
+    click.echo("\n3. Database Integrity:")
+    if vault_path.exists():
+        try:
+            import sqlite3
+            conn = sqlite3.connect(str(vault_path))
+            result = conn.execute("PRAGMA integrity_check").fetchone()
+            if result[0] == "ok":
+                click.echo("   ✅ Integrity check passed")
+            else:
+                click.echo(f"   ❌ Integrity issue: {result[0]}")
+                issues.append("Database integrity issue detected")
+            conn.close()
+        except Exception as e:
+            click.echo(f"   ❌ Error: {e}")
+            issues.append(f"Database error: {e}")
+    else:
+        click.echo("   ⚠️  No database to check")
+
+    # Summary
+    click.echo("\n" + "=" * 50)
+    if issues:
+        click.echo(f"⚠️  {len(issues)} issue(s) found:")
+        for issue in issues:
+            click.echo(f"   • {issue}")
+    else:
+        click.echo("✅ All checks passed")
+
+
+@vault.command("backup")
+@click.option("--output", "-o", help="Output path (default: vault-backup-{date}.db)")
+def vault_backup(output: Optional[str]):
+    """Create a backup of the vault database."""
+    vault_path = CONFIG_DIR / "vault.db"
+
+    if not vault_path.exists():
+        click.echo("❌ No vault to backup")
+        return
+
+    # Generate backup path
+    if output:
+        backup_path = Path(output)
+    else:
+        date_str = datetime.now().strftime("%Y%m%d-%H%M%S")
+        backup_path = CONFIG_DIR / f"vault-backup-{date_str}.db"
+
+    # Copy vault
+    import shutil
+    try:
+        shutil.copy2(vault_path, backup_path)
+        size_kb = backup_path.stat().st_size // 1024
+        click.echo(f"✅ Backup created: {backup_path} ({size_kb} KB)")
+    except Exception as e:
+        click.echo(f"❌ Backup failed: {e}")
+
+
+@vault.command("restore")
+@click.argument("backup_path")
+@click.option("--confirm", is_flag=True, help="Skip confirmation")
+def vault_restore(backup_path: str, confirm: bool):
+    """Restore vault from a backup."""
+    backup = Path(backup_path)
+
+    if not backup.exists():
+        click.echo(f"❌ Backup not found: {backup_path}")
+        return
+
+    vault_path = CONFIG_DIR / "vault.db"
+
+    if vault_path.exists() and not confirm:
+        click.confirm("This will overwrite the current vault. Continue?", abort=True)
+
+    import shutil
+    try:
+        shutil.copy2(backup, vault_path)
+        click.echo(f"✅ Vault restored from {backup_path}")
+    except Exception as e:
+        click.echo(f"❌ Restore failed: {e}")
+
+
+@vault.command("vacuum")
+def vault_vacuum():
+    """Compact the vault database to reclaim space."""
+    try:
+        from pisama_core.tokenization import TokenVault
+    except ImportError:
+        click.echo("❌ pisama-core not installed")
+        return
+
+    vault_path = CONFIG_DIR / "vault.db"
+
+    if not vault_path.exists():
+        click.echo("❌ No vault to vacuum")
+        return
+
+    size_before = vault_path.stat().st_size
+
+    token_vault = TokenVault(vault_path)
+    token_vault.initialize()
+    token_vault.vacuum()
+    token_vault.close()
+
+    size_after = vault_path.stat().st_size
+    saved = size_before - size_after
+
+    click.echo(f"✅ Vault compacted")
+    click.echo(f"   Before: {size_before // 1024} KB")
+    click.echo(f"   After:  {size_after // 1024} KB")
+    click.echo(f"   Saved:  {saved // 1024} KB")
+
+
+def _log_vault_access(target: str, reason: str, ticket: Optional[str], action: str):
+    """Log vault access to audit log."""
+    import os
+
+    audit_log = CONFIG_DIR / "audit_log.jsonl"
+    audit_log.parent.mkdir(parents=True, exist_ok=True)
+
+    entry = {
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "action": action,
+        "target": target,
+        "reason": reason,
+        "ticket": ticket,
+        "principal": os.environ.get("USER", "unknown"),
+    }
+
+    with open(audit_log, "a") as f:
+        f.write(json.dumps(entry) + "\n")
+
+
+# =============================================================================
+# TOKENIZE COMMAND - Manual tokenization testing
+# =============================================================================
+
+@main.group()
+def tokenize():
+    """PII tokenization tools."""
+    pass
+
+
+@tokenize.command("test")
+@click.argument("text")
+@click.option("--patterns", help="Comma-separated list of patterns to use")
+def tokenize_test(text: str, patterns: Optional[str]):
+    """Test PII detection on a string."""
+    try:
+        from pisama_core.tokenization import PIIDetector
+    except ImportError:
+        click.echo("❌ pisama-core not installed")
+        return
+
+    detector = PIIDetector()
+
+    # Filter patterns if specified
+    if patterns:
+        pattern_list = [p.strip() for p in patterns.split(",")]
+        for name in list(detector.patterns.keys()):
+            if name not in pattern_list:
+                detector.disable_pattern(name)
+
+    matches = detector.detect(text)
+
+    click.echo("PII Detection Results")
+    click.echo("=" * 50)
+    click.echo(f"\nInput: \"{text}\"")
+
+    if matches:
+        click.echo("\nDetected:")
+        for m in matches:
+            click.echo(f"  [{m.pii_type}] \"{m.value}\" at position {m.start}-{m.end}")
+    else:
+        click.echo("\nNo PII detected")
+
+
+@tokenize.command("config")
+def tokenize_config():
+    """Show tokenization configuration."""
+    config_data = get_config()
+    tokenization = config_data.get("tokenization", {})
+
+    click.echo("⚙️  Tokenization Configuration")
+    click.echo("=" * 50)
+    click.echo(f"Enabled: {tokenization.get('enabled', True)}")
+    click.echo(f"Fail-open: {tokenization.get('fail_open', True)}")
+
+    custom = tokenization.get("custom_patterns", {})
+    if custom:
+        click.echo("\nCustom Patterns:")
+        for name, pattern in custom.items():
+            if not name.startswith("_"):
+                click.echo(f"  {name}: {pattern}")
+
+    exclusions = tokenization.get("exclusions", [])
+    if exclusions:
+        click.echo("\nExclusions:")
+        for e in exclusions:
+            click.echo(f"  {e}")
+
+
 if __name__ == "__main__":
     main()

{pisama_claude_code-0.3.1 → pisama_claude_code-0.3.2}/src/pisama_claude_code/hooks/capture_hook.py

@@ -8,6 +8,7 @@ Now includes:
 - AI response capture from transcript
 - Token usage tracking
 - Cost calculation
+- PII tokenization (optional, configurable)
 
 Usage:
     Install in ~/.claude/hooks/ and configure in settings.local.json
@@ -16,6 +17,11 @@ Usage:
 import json
 import os
 import sys
+from typing import Any
+
+# PII Tokenization configuration
+TOKENIZATION_ENABLED = os.environ.get("PISAMA_TOKENIZATION", "1") == "1"
+TOKENIZATION_FIELDS = ["tool_input", "tool_output", "ai_response"]
 
 # Claude model pricing (per 1M tokens) - as of Jan 2025
 MODEL_PRICING = {
@@ -47,6 +53,71 @@ def calculate_cost(model: str, usage: dict) -> float:
     return round(cost, 6)
 
 
+def get_tokenizer(session_id: str) -> Any:
+    """Get a Tokenizer instance for PII protection.
+
+    Returns None if tokenization is disabled or unavailable.
+    """
+    if not TOKENIZATION_ENABLED:
+        return None
+
+    try:
+        from pisama_core.tokenization import Tokenizer
+        return Tokenizer(
+            session_id=session_id,
+            enabled=True,
+            fail_open=True,  # Don't fail if tokenization has issues
+        )
+    except ImportError:
+        return None
+    except Exception:
+        return None
+
+
+def tokenize_trace_data(
+    trace: dict,
+    session_id: str,
+    fields: list[str] | None = None,
+) -> dict:
+    """Tokenize sensitive fields in trace data.
+
+    Args:
+        trace: The trace dictionary to tokenize.
+        session_id: Session ID for token scoping.
+        fields: Fields to tokenize (defaults to TOKENIZATION_FIELDS).
+
+    Returns:
+        Trace with PII tokenized (or original if tokenization unavailable).
+    """
+    if not TOKENIZATION_ENABLED:
+        return trace
+
+    tokenizer = get_tokenizer(session_id)
+    if tokenizer is None:
+        return trace
+
+    fields = fields or TOKENIZATION_FIELDS
+    result = trace.copy()
+
+    try:
+        for field in fields:
+            if field in result and result[field]:
+                value = result[field]
+                if isinstance(value, str):
+                    result[field] = tokenizer.tokenize_string(value)
+                elif isinstance(value, dict):
+                    result[field] = tokenizer.tokenize_dict(value)
+        return result
+    except Exception:
+        # Fail open - return original trace if tokenization fails
+        return trace
+    finally:
+        try:
+            tokenizer.close()
+        except Exception:
+            pass
+
+
 def get_last_assistant_message(transcript_path: str) -> dict:
     """Read transcript and get the last assistant message with usage."""
     try:
@@ -178,6 +249,10 @@ def _fallback_capture(hook_data: dict, hook_type: str) -> None:
         "raw": hook_data,
     }
 
+    # Tokenize PII before storage (PostToolUse only to avoid double-tokenization)
+    if hook_type in ("post", "PostToolUse"):
+        trace = tokenize_trace_data(trace, session_id)
+
     with open(jsonl_path, "a") as f:
         f.write(json.dumps(trace) + "\n")
 
@@ -221,6 +296,7 @@ def _fallback_capture(hook_data: dict, hook_type: str) -> None:
             except sqlite3.OperationalError:
                 pass  # Column already exists
 
+        # Use tokenized values from trace dict
         conn.execute("""
             INSERT INTO traces (
                 session_id, timestamp, hook_type, tool_name, tool_input, tool_output,
@@ -232,15 +308,15 @@ def _fallback_capture(hook_data: dict, hook_type: str) -> None:
             timestamp,
             hook_type,
             tool_name,
-            json.dumps(tool_input) if tool_input else None,
-            json.dumps(tool_output) if tool_output else None,
+            json.dumps(trace.get("tool_input")) if trace.get("tool_input") else None,
+            json.dumps(trace.get("tool_output")) if trace.get("tool_output") else None,
             os.getcwd(),
             model,
             usage.get("input_tokens"),
             usage.get("output_tokens"),
             usage.get("cache_read_input_tokens"),
             cost,
-            ai_response,
+            trace.get("ai_response"),
         ))
         conn.commit()
         conn.close()

pisama_claude_code-0.3.1/PKG-INFO

@@ -1,105 +0,0 @@
-Metadata-Version: 2.4
-Name: pisama-claude-code
-Version: 0.3.1
-Summary: Trace capture for Claude Code sessions - sync to PISAMA platform for analysis
-Project-URL: Homepage, https://pisama.dev
-Project-URL: Documentation, https://pisama.dev/docs/claude-code
-Project-URL: Repository, https://github.com/tn-pisama/pisama-claude-code
-Author-email: PISAMA Team <team@pisama.dev>
-License-Expression: MIT
-License-File: LICENSE
-Keywords: agent,claude,claude-code,forensics,llm,observability,pisama,self-healing
-Classifier: Development Status :: 4 - Beta
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Topic :: Software Development :: Libraries :: Python Modules
-Classifier: Topic :: System :: Monitoring
-Requires-Python: >=3.10
-Requires-Dist: click>=8.0.0
-Requires-Dist: httpx>=0.25.0
-Requires-Dist: pydantic>=2.0.0
-Requires-Dist: rich>=13.0.0
-Provides-Extra: all
-Requires-Dist: pisama-core>=0.1.0; extra == 'all'
-Provides-Extra: core
-Requires-Dist: pisama-core>=0.1.0; extra == 'core'
-Provides-Extra: dev
-Requires-Dist: pytest-asyncio>=0.21.0; extra == 'dev'
-Requires-Dist: pytest-cov>=4.0.0; extra == 'dev'
-Requires-Dist: pytest>=7.0.0; extra == 'dev'
-Description-Content-Type: text/markdown
-
-# pisama-claude-code
-
-> **Coming Soon** - This package is in private development.
-
-Trace capture for Claude Code sessions.
-
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-
-## Overview
-
-Lightweight trace capture client for Claude Code. Captures tool calls and syncs to PISAMA platform for analysis.
-
-**This package captures traces. Analysis happens on the platform.**
-
-```
-┌─────────────────────┐         ┌─────────────────────┐
-│   Claude Code       │         │   PISAMA Platform   │
-│   + pisama-cc       │ ──────▶ │   (analysis)        │
-│   (capture)         │  sync   │   (detection)       │
-└─────────────────────┘         │   (self-healing)    │
-                                └─────────────────────┘
-```
-
-## Features
-
-| Feature | pisama-claude-code | Platform |
-|---------|-------------------|----------|
-| Trace capture | ✅ | - |
-| Local storage | ✅ | - |
-| Export to JSONL | ✅ | - |
-| Sync to platform | ✅ | ✅ |
-| Failure detection (28 modes) | - | ✅ |
-| Severity & explanations | - | ✅ |
-| Fix suggestions | - | ✅ |
-| Self-healing | - | ✅ |
-| Dashboard | - | ✅ |
-
-## CLI Commands
-
-```bash
-pisama-cc install     # Install capture hooks
-pisama-cc uninstall   # Remove hooks
-pisama-cc status      # Show status
-pisama-cc traces      # View local traces
-pisama-cc export      # Export to file
-pisama-cc connect     # Connect to platform
-pisama-cc sync        # Upload traces
-pisama-cc analyze     # Run analysis (requires platform)
-```
-
-## Privacy
-
-- Traces stored locally in `~/.claude/pisama/traces/`
-- Secrets automatically redacted
-- Paths anonymized
-- Platform sync is opt-in
-
-## Requirements
-
-- Python 3.10+
-- Claude Code CLI
-
-## Status
-
-Private beta. Contact team@pisama.dev for early access.
-
-## License
-
-MIT

pisama_claude_code-0.3.1/README.md

@@ -1,70 +0,0 @@
-# pisama-claude-code
-
-> **Coming Soon** - This package is in private development.
-
-Trace capture for Claude Code sessions.
-
-[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-
-## Overview
-
-Lightweight trace capture client for Claude Code. Captures tool calls and syncs to PISAMA platform for analysis.
-
-**This package captures traces. Analysis happens on the platform.**
-
-```
-┌─────────────────────┐         ┌─────────────────────┐
-│   Claude Code       │         │   PISAMA Platform   │
-│   + pisama-cc       │ ──────▶ │   (analysis)        │
-│   (capture)         │  sync   │   (detection)       │
-└─────────────────────┘         │   (self-healing)    │
-                                └─────────────────────┘
-```
-
-## Features
-
-| Feature | pisama-claude-code | Platform |
-|---------|-------------------|----------|
-| Trace capture | ✅ | - |
-| Local storage | ✅ | - |
-| Export to JSONL | ✅ | - |
-| Sync to platform | ✅ | ✅ |
-| Failure detection (28 modes) | - | ✅ |
-| Severity & explanations | - | ✅ |
-| Fix suggestions | - | ✅ |
-| Self-healing | - | ✅ |
-| Dashboard | - | ✅ |
-
-## CLI Commands
-
-```bash
-pisama-cc install     # Install capture hooks
-pisama-cc uninstall   # Remove hooks
-pisama-cc status      # Show status
-pisama-cc traces      # View local traces
-pisama-cc export      # Export to file
-pisama-cc connect     # Connect to platform
-pisama-cc sync        # Upload traces
-pisama-cc analyze     # Run analysis (requires platform)
-```
-
-## Privacy
-
-- Traces stored locally in `~/.claude/pisama/traces/`
-- Secrets automatically redacted
-- Paths anonymized
-- Platform sync is opt-in
-
-## Requirements
-
-- Python 3.10+
-- Claude Code CLI
-
-## Status
-
-Private beta. Contact team@pisama.dev for early access.
-
-## License
-
-MIT