hotfix: scan only the prompt field from the hook stdin envelope

[fahadsiddiqui]

Problem

Claude Code pipes a full UserPromptSubmit JSON envelope into the hook, but scripts/prompt-guard.js read stdin as if it were the bare prompt. Everything downstream operated on the raw JSON string.

Most visibly, redact mode handed back the whole envelope as the "cleaned copy you can paste instead":

---
{"session_id":"a24ce33f-…","transcript_path":"/Users/…/a24ce33f.jsonl","cwd":"/Users/…/otters","prompt_id":"c8320832-…","permission_mode":"default","hook_event_name":"UserPromptSubmit","prompt":"my email is <PII_1>"}
---

Fix

Added an extractPrompt(raw) helper that parses the stdin payload and scans only payload.prompt. It falls back to the raw text when stdin doesn't look like JSON or fails to parse, so the guard still scans something when the script is piped a prompt manually or if the protocol changes.

Redact mode now returns:

---
my email is <PII_1>
---

Secondary win: transcript_path, cwd and the envelope UUIDs are no longer scanned. They were a false-positive source across all three modes — capable of producing findings, inflating the risk score, and blocking prompts that contained no sensitive data of their own.

Tests

New tests/prompt-payload.test.ts spawns the real hook script against a realistic envelope:

• redact mode returns the cleaned prompt and leaks no envelope keys
• a clean prompt in a metadata-heavy envelope is allowed through
• sensitive data inside the prompt field still blocks
• non-JSON stdin falls back to a raw scan

Full suite: 351 passing, lint clean.

Notes

No dist/ change — the fix is in scripts/, which ships as-is, so the CI dist/ freshness check is unaffected.