fix(ENG-2966): log the classifier's load error, scan empty keys, document the marker

- Capture the library's warmup console warnings into the daemon log, so the
  notice and README point at a log that holds the actual load error.
- Fallback field pattern /^/ instead of /./, so an empty key is scanned too.
- README file table lists the per-session degraded marker; hook header comment
  covers the degraded notice; drop an unused test variable.

Verification: node --test 23/23.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: hiskudin

plugins/security/stackone-defender/README.md

@@ -106,8 +106,9 @@ The daemon reads this config only on startup, and it is a detached long-lived pr
 | `~/.claude/defender-daemon.log` | Daemon stderr (rotated) |
 | `~/.claude/defender-client.log` | Hook-side errors (transient) |
 | `~/.claude/defender-daemon.lock` | Spawn-time lockfile (transient) |
+| `~/.claude/defender-degraded-<session>` | Marks that a session was told the classifier is unavailable (empty, one per session) |
 
-All five are local-only. None of them get written to until Defender actually fires.
+All six are local-only. None of them get written to until Defender actually fires.
 
 > [!NOTE]
 > Older versions wrote `~/.claude/defender-feedback.jsonl` and read `~/.claude/defender-collector.json` for an internal FP-labeling loop. Both are gone from v2.6 onward; if either file is on your machine from an older install, it's harmless and can be deleted.

plugins/security/stackone-defender/scripts/build-defense.mjs

@@ -8,7 +8,16 @@
  */
 export async function buildDefense(PromptDefense, options, log) {
   const defense = new PromptDefense(options);
-  await defense.warmupTier2();
+  // The library reports why a load failed only through console.warn, which nobody sees.
+  const warnings = [];
+  const consoleWarn = console.warn;
+  console.warn = (...args) => warnings.push(args.join(" "));
+  try {
+    await defense.warmupTier2();
+  } finally {
+    console.warn = consoleWarn;
+  }
+  if (warnings.length > 0) log("warmup warnings", { warnings });
   if (defense.isTier2Ready()) return { defense, tier2Ready: true };
 
   log("Tier 2 unavailable, falling back to Tier 1 patterns");
@@ -18,7 +27,8 @@ export async function buildDefense(PromptDefense, options, log) {
     ...options,
     enableTier1: true,
     enableTier2: false,
-    config: { ...options.config, riskyFields: { fieldNames: [], fieldPatterns: [/./] } },
+    // /^/, not /./, so an empty key ("") is scanned too.
+    config: { ...options.config, riskyFields: { fieldNames: [], fieldPatterns: [/^/] } },
   });
   return { defense: fallback, tier2Ready: false };
 }

plugins/security/stackone-defender/scripts/scan-tool-result.mjs

@@ -2,8 +2,8 @@
 
 /**
  * PostToolUse hook — thin client that scans tool output via the defender daemon.
- * Reads JSON on stdin, writes one-line JSON to stdout on flagged content,
- * silent-exits otherwise. Self-installs node_modules on first run (the daemon
+ * Reads JSON on stdin, writes one-line JSON to stdout on flagged content or,
+ * once per session, when the classifier is unavailable; silent-exits otherwise. Self-installs node_modules on first run (the daemon
  * needs @stackone/defender resolvable before spawn). Falls back to silent-skip
  * if the daemon is unreachable.
  */

plugins/security/stackone-defender/tests/degraded-tier2.test.mjs

@@ -17,7 +17,6 @@ const here = dirname(fileURLToPath(import.meta.url));
 const pluginRoot = resolve(here, "..");
 const requireFrom = createRequire(join(pluginRoot, "package.json"));
 const { PromptDefense } = requireFrom("@stackone/defender");
-const defenderRoot = dirname(requireFrom.resolve("@stackone/defender"));
 
 const shippedConfig = JSON.parse(
   readFileSync(join(pluginRoot, "scripts", "defender-daemon.config.json"), "utf8"),
@@ -37,17 +36,22 @@ const INJECTION = {
 // file would hide the failure being tested. The loadable path is covered by qa-fixtures.
 test("a missing model falls back to Tier 1 and still blocks an overt injection", async () => {
   const messages = [];
+  const logged = {};
 
   const { defense, tier2Ready } = await buildDefense(
     PromptDefense,
     withModelPath(join(tmpdir(), "no-such-defender-model")),
-    (msg) => messages.push(msg),
+    (msg, extra) => {
+      messages.push(msg);
+      logged[msg] = extra;
+    },
   );
   const result = await defense.defendToolResult(INJECTION, "WebFetch");
 
   assert.equal(tier2Ready, false);
   assert.equal(result.allowed, false);
-  assert.deepEqual(messages, ["Tier 2 unavailable, falling back to Tier 1 patterns"]);
+  assert.deepEqual(messages, ["warmup warnings", "Tier 2 unavailable, falling back to Tier 1 patterns"]);
+  assert.match(logged["warmup warnings"].warnings.join("\n"), /no-such-defender-model/);
 });
 
 test("the Tier 1 fallback still allows benign prose", async () => {
@@ -65,6 +69,18 @@ test("the Tier 1 fallback still allows benign prose", async () => {
   assert.equal(result.allowed, true);
 });
 
+test("the Tier 1 fallback scans a field with an empty name", async () => {
+  const { defense } = await buildDefense(
+    PromptDefense,
+    withModelPath(join(tmpdir(), "no-such-defender-model")),
+    () => {},
+  );
+
+  const result = await defense.defendToolResult({ "": INJECTION.output }, "WebFetch");
+
+  assert.equal(result.allowed, false);
+});
+
 test("the Tier 1 fallback flags text that only discusses an injection phrase", async () => {
   // Accepted cost of degraded mode: without the classifier, patterns cannot tell an attack
   // from a file describing one. The degraded notice warns about this.