feat: real plugin events from Claude Code hooks; remove showcase mock loop

- scripts/live.ts: strip continuous showcase loop. The 7-phase verification
  remains; bare `npx tsx scripts/live.ts` exits ~15s. No more synthetic
  cockpit animation.
- scripts/hooks/claude-code-emit.mjs: per-session plugin-state.json
  accumulates tool counts, errors, file access, anchor intent. Each hook
  now emits derived plugin events alongside the base mcp.* / lifecycle.*:
    PreToolUse  -> + crow.trust.scored (Bayesian posterior_mean)
    PostToolUse -> + gorgon.hotspot (rate-limited 1/5), naga.spec_check &
                    lich.review (stub-clean on Edit/Write)
    UserPromptSubmit -> + djinn.anchor.set (first prompt) /
                          djinn.drift.observed (subsequent) +
                          emu.context_update (turn budget)
    SessionEnd  -> resets plugin-state for next session
- inspector/src/lib.rs: bare `enchanter` no longer falls through to the
  showcase loop or demo mode when hooks aren't installed. Prints clear
  guidance naming three options and exits 0.
- docs/claude-code-integration.md: derived-event mapping table; notes that
  naga/lich are stubs pending diff parsing, gorgon emits ~once/5, emu
  budget is hardcoded 200 turns until v0.7 reads ~/.claude.json.
- 4 new tests covering crow trust derivation, djinn anchor/drift, emu
  turn budget, and naga+lich on Edit (5->9 tests in the hooks suite).

Author: klaiderman

docs/claude-code-integration.md

@@ -49,6 +49,42 @@ emitter resolves the cache base the same way the inspector does:
 | `SessionEnd`       | `session.closed`                                                      |
 | `PreCompact`       | `phase.entered` (phase=cross-session, plugin=compactor)               |
 
+## Derived plugin events
+
+Each hook also emits derived events that drive the cockpit's PLUGINS table
+from real session activity. These are computed from a per-session state
+file at `~/.cache/enchanter/plugin-state.json` (or `%LOCALAPPDATA%\...` on
+Windows) that accumulates tool counts, error counts, file access, and the
+session anchor across hook firings. The state file is rewritten atomically
+(write tmp + rename) and reset on `SessionEnd`.
+
+| Hook                | Derived event(s)                                                       |
+|---------------------|------------------------------------------------------------------------|
+| `UserPromptSubmit`  | `djinn.anchor.set` (first prompt only) — locks `anchor_intent` (≤200 chars) |
+|                     | `djinn.drift.observed` (subsequent prompts) — word-overlap drift vs. anchor, capped at 0.5 |
+|                     | `emu.context_update` — `turn_estimate = max(12, 200 - turn_count)`, `context_size = prompt_chars` |
+| `PreToolUse`        | `crow.trust.scored` — `posterior_mean = 1 - errors/total` per tool, `observation_count = total` |
+| `PostToolUse`       | `gorgon.hotspot` — top file by access count, `heat = count/total`. **Rate-limited to once every 5 PostToolUse events** to avoid flooding |
+|                     | `naga.spec_check` — Edit/Write only. **Stub-clean verdict** — real algorithm requires diff parsing (deferred to a future release) |
+|                     | `lich.review` — Edit/Write only. **Stub-clean verdict** — same caveat as naga |
+
+### Notes
+
+- **emu's "turns left"**: derived from `200 - turn_count` where `turn_count`
+  is the number of `UserPromptSubmit` events seen this session. The 200-turn
+  budget is hardcoded; v0.7 will pull session quotas from `~/.claude.json`.
+- **gorgon rate-limit**: 5-event cadence chosen to balance signal vs. noise.
+  Edit/Write/Read activity tends to cluster, so emitting on every PostToolUse
+  would spam the cockpit; less frequent than 5 makes the heat-map feel stale.
+- **naga + lich are stubs**: both emit `status: "clean"` unconditionally
+  on Edit/Write. The real algorithms (drift detection vs. spec, sandbox-depth
+  audit) need the actual diff content, which the hook payload doesn't provide
+  in a usable form. Verdicts are visual placeholders until the diff parser
+  lands.
+- **crow trust accumulates within a session**: the posterior is reset every
+  time the cache file disappears (SessionEnd, manual delete). Cross-session
+  trust would need a second persistent store — out of scope for v0.6.
+
 ## Disable
 
 Re-run the installer with `--uninstall`:

inspector/src/lib.rs

@@ -172,9 +172,16 @@ fn claude_code_hook_jsonl() -> PathBuf {
 ///    cache dir exists (hooks installed but no events yet) → tail it.
 ///    This is the "real Claude Code work" path — every tool call, prompt,
 ///    session boundary lights up the cockpit from authentic hook output.
-/// 3. stdin is a TTY AND `scripts/live.ts` is reachable from cwd → boot
-///    the showcase runtime. Fallback when hooks aren't wired up.
-/// 4. stdin is a TTY AND nothing else → demo mode (synthetic emitter).
+/// 3. stdin is a TTY AND no hooks installed → print a clear message naming
+///    three options and exit 0. We deliberately do NOT fall through to a
+///    synthetic showcase loop — confusing real-vs-synthetic data is worse
+///    than not opening the cockpit. `enchanter live` and `enchanter inspect`
+///    remain explicit opt-ins for advanced users (monorepo dev / pipe mode).
+///
+/// Note: `src/demo.rs` is now legacy fallback only — the synthetic emitter
+/// is no longer wired by default. It still triggers if `enchanter inspect`
+/// runs and stdin is a TTY (an unusual user setup) but bare `enchanter`
+/// no longer routes there.
 fn default_command() -> Command {
     use std::io::IsTerminal;
     if !std::io::stdin().is_terminal() {
@@ -202,13 +209,18 @@ fn default_command() -> Command {
         });
     }
 
-    // Showcase fallback when running from the monorepo with the demo script.
-    if std::path::Path::new("scripts/live.ts").is_file() {
-        return Command::Live(LiveArgs::default());
-    }
-
-    // Last-resort synthetic demo (handled by app::run when stdin is TTY).
-    Command::Inspect(InspectArgs::default())
+    // No hooks → print guidance and exit. Better than launching a synthetic
+    // demo and confusing the user about real-vs-fake data.
+    eprintln!(
+        "[enchanter] No Claude Code hooks installed. Three options:\n  \
+         1. Install hooks (recommended for real usage):\n     \
+         cd <enchanter-dir> && node scripts/hooks/install-hooks.mjs\n  \
+         2. Pipe events manually:\n     \
+         <runtime> | enchanter\n  \
+         3. Replay a captured JSONL:\n     \
+         enchanter inspect --from <file.jsonl>"
+    );
+    std::process::exit(0);
 }
 
 /// Library entry point invoked from `main`.

scripts/hooks/claude-code-emit.mjs

@@ -51,6 +51,7 @@ function resolveCacheBase() {
 const cacheDir = path.join(resolveCacheBase(), 'enchanter');
 const outPath = path.join(cacheDir, 'claude-code.jsonl');
 const errPath = path.join(cacheDir, 'claude-code.err');
+const stateFile = path.join(cacheDir, 'plugin-state.json');
 
 // --------------------------------------------------------------------------
 // Logging helpers — never throw, never touch stdout.
@@ -229,6 +230,108 @@ async function readStdinJson() {
   });
 }
 
+// --------------------------------------------------------------------------
+// Per-session plugin-state — accumulates across hook invocations within one
+// Claude Code session so derived events (crow trust posterior, gorgon
+// hotspot file, djinn anchor drift, emu turn budget) can be computed from
+// real history. Schema is documented in docs/claude-code-integration.md.
+// File is rewritten atomically (write tmp + rename) so concurrent hook
+// firings don't tear the JSON. Reset at SessionEnd.
+// --------------------------------------------------------------------------
+function makeFreshState(sessionId) {
+  return {
+    session_id: sessionId || '',
+    turn_count: 0,
+    tool_counts: {},
+    tool_errors: {},
+    file_access_counts: {},
+    anchor_intent: '',
+    last_prompt_text: '',
+    started_at: nowSec(),
+    // Counter so gorgon emits roughly every 5 events (rate limit).
+    gorgon_tick: 0,
+  };
+}
+
+function readState(sessionId) {
+  try {
+    const raw = fs.readFileSync(stateFile, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === 'object') {
+      // If the cached state is from a different session, start fresh.
+      if (sessionId && parsed.session_id && parsed.session_id !== sessionId) {
+        return makeFreshState(sessionId);
+      }
+      // Backfill missing fields if older state file exists.
+      const fresh = makeFreshState(sessionId);
+      return { ...fresh, ...parsed };
+    }
+  } catch {
+    /* missing or corrupt — fall through to fresh */
+  }
+  return makeFreshState(sessionId);
+}
+
+function writeState(state) {
+  try {
+    ensureCacheDir();
+    const tmp = stateFile + '.tmp';
+    fs.writeFileSync(tmp, JSON.stringify(state));
+    fs.renameSync(tmp, stateFile);
+  } catch (err) {
+    logError('plugin-state write failed', err);
+  }
+}
+
+function resetState() {
+  try {
+    fs.unlinkSync(stateFile);
+  } catch {
+    /* fine if missing */
+  }
+}
+
+// Word-overlap drift: 1.0 - (overlap / max(words(a), words(b))). Capped at 0.5.
+function computeDrift(anchorText, currentText) {
+  const tok = (s) =>
+    String(s || '')
+      .toLowerCase()
+      .split(/[^a-z0-9]+/i)
+      .filter((w) => w.length >= 3);
+  const a = new Set(tok(anchorText));
+  const b = new Set(tok(currentText));
+  if (a.size === 0 || b.size === 0) return 0;
+  let overlap = 0;
+  for (const w of a) if (b.has(w)) overlap += 1;
+  const denom = Math.max(a.size, b.size);
+  const drift = 1.0 - overlap / denom;
+  return Math.min(0.5, Math.max(0, drift));
+}
+
+// Best-effort: pull a file path off Claude Code's tool_input shape.
+// Edit/Read/Write all use `file_path`; NotebookEdit uses `notebook_path`;
+// Bash has no canonical file arg.
+function extractFilePath(toolName, toolInput) {
+  if (!toolInput || typeof toolInput !== 'object') return null;
+  const candidates = ['file_path', 'notebook_path', 'path'];
+  for (const k of candidates) {
+    const v = toolInput[k];
+    if (typeof v === 'string' && v.length > 0) return v;
+  }
+  return null;
+}
+
+// Inspect tool_response for an error signal.
+function isErrorResponse(response) {
+  if (!response) return false;
+  if (typeof response === 'string') return false;
+  if (typeof response !== 'object') return false;
+  if (response.error) return true;
+  if (typeof response.status === 'string' && response.status !== 'ok') return true;
+  if (response.is_error === true) return true;
+  return false;
+}
+
 // --------------------------------------------------------------------------
 // Event mapping.
 // --------------------------------------------------------------------------
@@ -267,6 +370,52 @@ function emitForHook(eventName, payload) {
           payload: { prompt_chars: prompt.length },
         }),
       );
+
+      // Derived plugin events ----------------------------------------------
+      const state = readState(session_id);
+      const isFirstPrompt = !state.anchor_intent;
+      if (isFirstPrompt) {
+        state.anchor_intent = prompt.slice(0, 200);
+        // djinn.anchor.set on the first user prompt of the session — locks
+        // the session intent that subsequent prompts get measured against.
+        appendEvent(
+          base({
+            type: 'djinn.anchor.set',
+            plugin: 'djinn',
+            phase: 'anchor',
+            intent: state.anchor_intent,
+          }),
+        );
+      } else {
+        // Subsequent prompts → drift relative to the locked anchor.
+        const drift = computeDrift(state.anchor_intent, prompt);
+        appendEvent(
+          base({
+            type: 'djinn.drift.observed',
+            plugin: 'djinn',
+            phase: 'post-session',
+            drift,
+            intent: state.anchor_intent,
+          }),
+        );
+      }
+      state.last_prompt_text = prompt.slice(0, 200);
+      state.turn_count += 1;
+
+      // emu.context_update — turns LEFT in a 200-turn budget, floored at 12
+      // so the cockpit never flashes 0 (matches the live.ts demo behavior).
+      const turnEstimate = Math.max(12, 200 - state.turn_count);
+      appendEvent(
+        base({
+          type: 'emu.context_update',
+          plugin: 'emu',
+          phase: 'pre-dispatch',
+          turn_estimate: turnEstimate,
+          context_size: prompt.length,
+        }),
+      );
+
+      writeState(state);
       break;
     }
 
@@ -282,6 +431,36 @@ function emitForHook(eventName, payload) {
           payload: { args: truncArgs(toolInput) },
         }),
       );
+
+      // Derived plugin events ----------------------------------------------
+      const state = readState(session_id);
+      const total = (state.tool_counts[toolName] || 0) + 1;
+      const errors = state.tool_errors[toolName] || 0;
+      state.tool_counts[toolName] = total;
+
+      // crow.trust.scored — Bayesian posterior_mean from observed errors.
+      // Uniform prior 0.5 when total <= 0 (impossible here since we just
+      // bumped it, so this branch is documentation for behavior).
+      const posteriorMean = total > 0 ? 1.0 - errors / total : 0.5;
+      appendEvent(
+        base({
+          type: 'crow.trust.scored',
+          plugin: 'crow',
+          phase: 'trust-gate',
+          tool_name: toolName,
+          posterior_mean: posteriorMean,
+          observation_count: total,
+        }),
+      );
+
+      // Track file access — fuels gorgon.hotspot on PostToolUse.
+      const filePath = extractFilePath(toolName, toolInput);
+      if (filePath) {
+        state.file_access_counts[filePath] =
+          (state.file_access_counts[filePath] || 0) + 1;
+      }
+
+      writeState(state);
       break;
     }
 
@@ -337,6 +516,77 @@ function emitForHook(eventName, payload) {
           );
         }
       }
+
+      // Derived plugin events ----------------------------------------------
+      const state = readState(session_id);
+
+      // Bump error counter if the tool failed — this feeds the next call's
+      // crow posterior_mean.
+      if (isErrorResponse(response)) {
+        state.tool_errors[toolName] = (state.tool_errors[toolName] || 0) + 1;
+      }
+
+      const filePath = extractFilePath(toolName, payload.tool_input);
+      const isMutator = toolName === 'Edit' || toolName === 'Write';
+      const isReader = toolName === 'Read';
+
+      // gorgon.hotspot — rate-limited to ~once every 5 hooks. Reports the
+      // currently-hottest file from accumulated access counts. Skipped when
+      // we have no access data yet (early in the session).
+      state.gorgon_tick += 1;
+      if (state.gorgon_tick % 5 === 0) {
+        let topFile = null;
+        let topCount = 0;
+        let total = 0;
+        for (const [f, c] of Object.entries(state.file_access_counts)) {
+          total += c;
+          if (c > topCount) {
+            topCount = c;
+            topFile = f;
+          }
+        }
+        if (topFile && total > 0) {
+          appendEvent(
+            base({
+              type: 'gorgon.hotspot',
+              plugin: 'gorgon',
+              phase: 'cross-session',
+              file: topFile,
+              heat: topCount / total,
+            }),
+          );
+        }
+      }
+
+      // naga + lich — stub-clean verdicts on Edit/Write. Real spec/sandbox
+      // analysis requires diff parsing (deferred); these stubs let the
+      // PLUGINS table light up on real edit activity.
+      if ((isMutator || isReader) && filePath) {
+        if (isMutator) {
+          appendEvent(
+            base({
+              type: 'naga.spec_check',
+              plugin: 'naga',
+              phase: 'post-response',
+              file: filePath,
+              status: 'clean',
+              drift: 0,
+            }),
+          );
+          appendEvent(
+            base({
+              type: 'lich.review',
+              plugin: 'lich',
+              phase: 'post-response',
+              file: filePath,
+              sandbox_depth: 0,
+              status: 'clean',
+            }),
+          );
+        }
+      }
+
+      writeState(state);
       break;
     }
 
@@ -360,6 +610,8 @@ function emitForHook(eventName, payload) {
 
     case 'SessionEnd': {
       appendEvent(base({ type: 'session.closed' }));
+      // Wipe per-session plugin-state so the NEXT session starts clean.
+      resetState();
       break;
     }