[1aifanatic]

Closes #21

Stacked on #33. This branch includes #33's commit (the hook output contract). #33 removes prompt compression, so classification is the only path that sends prompts, and that's what the controls here assume. Review #33 first; once it merges, this diff shrinks to the second commit (Document data flows and add per-stage cloud controls).

Controls

Each one is independent, and the defaults are unchanged:

Variable	Effect
SCALEDOWN_CLASSIFY_DISABLE=true	UserPromptSubmit skips classification, so the prompt is never sent. Tool-output compression and the proxy keep working.
SCALEDOWN_POST_TOOL_LOCAL_ONLY=true	PostToolUse keeps the zero-latency ls/grep/git structural filter and never sends tool output.
SCALEDOWN_LOCAL_ONLY=true	No Scaledown requests at all: it implies the two settings above plus SCALEDOWN_PROXY_DISABLE, and no API key is required.
SCALEDOWN_POST_TOOL_DISABLE, SCALEDOWN_PROXY_DISABLE	Existing settings, now documented alongside the new ones.

Plus dietcode clear-cache, which deletes ~/.scaledown/proxy (running summaries) and ~/.scaledown/proxy-cache (stashed originals for sd_retrieve). It leaves the config and stats alone. uninstall now mentions it.

Docs: new README section "Data flows & privacy"

• A table covering each stage: when it fires, what is sent (full prompt, tool output including file contents, older turns as both flattened text and structured blocks), the endpoint, and the switch that turns it off. It also covers the one-off test classify call during setup.
• What stays local (filters, progress bar, sd_retrieve), the proxy's upstream, and the status line's npm registry update check.
• Local-only mode.
• A local storage table with retention: the proxy files have no automatic expiry, and the table says so.
• Service terms: I couldn't find a published privacy policy, terms or data-retention/training statement at scaledown.ai or docs.scaledown.ai (/privacy and /terms return 404, and neither site links to any). The README says that plainly and asks maintainers to add the links. I didn't invent any policy text.
• The env var table gains SCALEDOWN_BASE_URL and the three new variables.

Tests (the acceptance checks)

• hooks/hook-contract.test.ts (built hooks; temporary HOME; stub Scaledown API that records every request):
  • classify disabled: zero requests, and tool compression still calls /compress/raw/;
  • post-tool local-only: a large output makes zero requests and stays unchanged, while ls output is still filtered;
  • SCALEDOWN_LOCAL_ONLY with no API key: zero requests from either hook, and local filtering still applied.
• New src/local-only.test.ts (os.homedir mocked to a temp dir):
  • config defaults and independence;
  • local-only needs no key;
  • proxy control vs local-only: the same request is summarized normally, but in local-only mode it's forwarded byte-for-byte unchanged with zero summarize calls;
  • clearProxyStore removes only the proxy files.
• Both suites are in npm run test:unit. tsc --noEmit is clean. The 87 tests across the hook, local-only and niah suites pass. src/client.test.ts still fails with the pre-existing jest is not defined error that fix: restore ESM test execution and cover proxy tests in CI #26 fixes.
• Manual check: HOME=<tmp> node dist/bin/setup.js clear-cache removed both proxy dirs and kept stats.json.

Not done

• No automatic retention or expiry for the proxy cache. Maintainers should decide whether the cache should expire automatically; clear-cache is the manual option for now.
• The service's actual retention and training practices can't be verified from the client side.

🤖 Generated with Claude Code