Audit Cc Tail — Security skill for Claude Code

audit-cc-tail

Detects how many distinct model variants Anthropic is serving behind each Claude family name (haiku / sonnet / opus) by clustering behavioral fingerprints extracted from your local Claude Code JSONL history.

Clusters both **text responses** (stylometric features) and **tool-call responses** (structural features) separately — giving two independent signals per family.

Grows more accurate over time as more responses accumulate.

How it works

1. Ingest — reads ~/.claude/projects/**/*.jsonl (parallel backfill + live watch), classifies each response as text, tool_use, or mixed, extracts feature vectors for both text and tool content
2. Cluster — runs sklearn.BayesianGaussianMixture (Dirichlet process prior) per family × mode (text + tools); active component count = estimated distinct model variants
3. Dashboard — 3-column TUI (one panel per family) with scrollable sections, token analytics, model version progression, daily sparklines, and both text and tool cluster views

Requirements

• Bun ≥ 1.3
• Python ≥ 3.10 with scikit-learn and numpy
• Claude Code installed (provides ~/.claude/projects/)

Setup

bun install
python -m pip install scikit-learn numpy

If Python is not at `C:/Python312/python.exe`, update `PYTHON` in `src/cluster.ts`.

Usage

bun start

Migrates the DB, then spawns ingest + cluster (hourly) + dashboard as child processes. Auto-restarts crashed workers. `Ctrl+C` kills all.

Individual commands:

bun run src/index.ts migrate     # apply schema only
bun run src/index.ts ingest      # backfill + watch
bun run src/index.ts cluster     # cluster once
bun run src/index.ts cluster --watch  # cluster hourly
bun run src/index.ts dashboard   # TUI dashboard

Dashboard keys: `tab` — switch panel focus | `j/k` — scroll | `q` — quit

Database

`audit.db` — libsql/SQLite local file.

table	purpose
responses	one row per assistant messag