@cspeach/cli 1.1.33 → 1.1.35

package/dist/usage/usage-reporter.js

@@ -0,0 +1,270 @@
+/**
+ * Security batch item 3 — usage counts from byok / ai-hub / local model
+ * calls (managed calls are counted by the proxy). Counts only: seat (the
+ * bearer), skill, model, four token counters, turn time, CLI version, session
+ * id, request id. Never prompts, responses, source, object names, SAP system
+ * ids or file paths. Queued, sent in background batches; never blocks a turn.
+ */
+import { randomUUID } from 'node:crypto';
+import { loadConfig } from '../config/loader.js';
+import { CLI_VERSION } from '../lib/version.js';
+import { enqueueUsage, leaseBatch, ackBatch, deleteUsageQueue, keyPrefixFor } from './usage-queue.js';
+import { countedTokens, addLocalUsage } from '../connection/local-usage.js';
+/**
+ * The dated default (spec item 3, "Rollout"): with usage_reporting unset,
+ * reporting is OFF before this instant and ON from it — the 2 weeks' notice.
+ * Task 13 sets it to the publish day + 14 days.
+ */
+export const USAGE_REPORTING_DEFAULT_ON_FROM = '2026-10-26T00:00:00.000Z';
+export const BATCH_SIZE = 100;
+const FLUSH_DELAY_MS = 1500;
+const SEND_TIMEOUT_MS = 5000;
+const MAX_ROUNDS = 10;
+/** Statuses that mean "this batch will never be accepted": drop it, never retry (F3). */
+const DROP_STATUSES = new Set([400, 413, 422]);
+const REQUEST_ID_RE = /^[A-Za-z0-9_-]{8,128}$/;
+/** The proxy's per-field limits (cspeach-proxy/src/routes/usage.ts): a label it would reject is made safe here, never dropped. */
+const MAX_TOKENS = 50_000_000;
+const VERSION_RE = /^(\d{1,4})\.(\d{1,5})\.(\d{1,6})(?:[-+].*)?$/;
+function label(v, bad, max, fallback) {
+    const s = (typeof v === 'string' ? v : '').replace(bad, '-').slice(0, max);
+    return s.length > 0 ? s : fallback;
+}
+const count = (v) => typeof v === 'number' && Number.isFinite(v) && v > 0 ? Math.min(Math.floor(v), MAX_TOKENS) : 0;
+/** F6 — x.y.z the proxy accepts: prerelease / build metadata stripped; anything else '0.0.0'. */
+export function normaliseCliVersion(v) {
+    const m = VERSION_RE.exec(String(v ?? '').trim());
+    return m ? `${m[1]}.${m[2]}.${m[3]}` : '0.0.0';
+}
+/**
+ * F7 — a local model may be configured as a file path (a gguf on disk). Only
+ * its file name, without the extension, is reported; a plain model name
+ * (`llama3.1:70b`) has no path and is left as it is.
+ */
+function localModelName(m) {
+    if (!/[\\/]/.test(m) && !/^[A-Za-z]:/.test(m))
+        return m;
+    const base = m.split(/[\\/]/).pop() ?? '';
+    // Only real model-file extensions (final review, Task 9 I2): a version dot
+    // in a name such as qwen2.5 is part of the name.
+    return base.replace(/^[A-Za-z]:/, '').replace(/\.(?:gguf|bin|safetensors|pt|pth|onnx)$/i, '');
+}
+export function usageReportingState(cfg, now = new Date(), onFrom = USAGE_REPORTING_DEFAULT_ON_FROM, companyRequired = false) {
+    // Azure tenant mode, Task 8b (plan D11): the company's settings say usage
+    // counts are required — on, whatever the dated default or a stored "off".
+    if (companyRequired)
+        return { on: true, why: 'company-required' };
+    if (cfg.usage_reporting === 'on')
+        return { on: true, why: 'set-on' };
+    if (cfg.usage_reporting === 'off')
+        return { on: false, why: 'set-off' };
+    return now.getTime() >= Date.parse(onFrom) ? { on: true, why: 'default-on' } : { on: false, why: 'default-off-until', onFrom };
+}
+/**
+ * The one record shape POST /v1/usage takes — built field by field, so
+ * nothing else a caller passes can ride along. Null for managed calls (the
+ * proxy counts those) and for a call that never started. A started call
+ * with zero tokens (a local server that reports no usage) is still a turn
+ * and is recorded with zeros (F2).
+ */
+export function usageRecordFor(c) {
+    if (c.mode !== 'byok' && c.mode !== 'ai-hub' && c.mode !== 'local' && c.mode !== 'azure')
+        return null;
+    if (c.started === false)
+        return null;
+    const model = c.mode === 'local' && typeof c.model === 'string' ? localModelName(c.model) : c.model;
+    return {
+        request_id: typeof c.requestId === 'string' && REQUEST_ID_RE.test(c.requestId) ? c.requestId : randomUUID(),
+        mode: c.mode,
+        skill: label(c.skill, /[^A-Za-z0-9_-]/g, 64, 'none'),
+        model: label(model, /[^A-Za-z0-9._:/@-]/g, 100, 'unknown'),
+        input_tokens: count(c.input),
+        output_tokens: count(c.output),
+        cache_read_tokens: count(c.cacheRead),
+        cache_write_tokens: count(c.cacheWrite),
+        cli_version: normaliseCliVersion(CLI_VERSION),
+        session_id: label(c.sessionId, /[^A-Za-z0-9_-]/g, 64, 'none'),
+        at: (c.at ?? new Date()).toISOString(),
+    };
+}
+/**
+ * Azure tenant mode, Task 8b — why the company keeps usage counts on for this
+ * seat, or null when the developer's switch applies:
+ *  - 'required': the company's settings require usage counts;
+ *  - 'limit': this seat has a monthly limit (fix round 1, ruling 1), which
+ *    needs the counts even when the company made them optional.
+ * Only azure mode reads it; every other mode answers null with no I/O.
+ * Settings the company removed no longer keep anything on.
+ */
+export async function companyUsageRule(cfg) {
+    if (cfg.llm?.mode !== 'azure')
+        return null;
+    const { readConnectionCache } = await import('../connection/cache.js');
+    const c = await readConnectionCache().catch(() => null);
+    if (!c || c.removed)
+        return null;
+    if (c.connection.usage_counts === 'required')
+        return 'required';
+    return c.connection.limit ? 'limit' : null;
+}
+/** True when the company keeps usage counts on for this seat (required, or a monthly limit). */
+export async function companyRequiresUsageCounts(cfg) {
+    return (await companyUsageRule(cfg)) !== null;
+}
+/** Only azure asks the company; every other mode keeps today's switch exactly. */
+async function requiredFor(cfg, deps) {
+    if (cfg.llm?.mode !== 'azure')
+        return false;
+    return (deps.companyRequired ?? companyRequiresUsageCounts)(cfg).catch(() => false);
+}
+async function defaultGetKey() {
+    const { getStore } = await import('../auth/api-key.js');
+    return (await getStore()).get();
+}
+let flushTimer = null;
+function scheduleDefault(run) {
+    if (flushTimer)
+        return;
+    flushTimer = setTimeout(() => { flushTimer = null; run(); }, FLUSH_DELAY_MS);
+    flushTimer.unref?.();
+}
+/** After each non-managed model call. Never throws; never awaits the network. */
+export async function reportCallUsage(c, deps = {}) {
+    try {
+        const rec = usageRecordFor(c);
+        if (!rec)
+            return;
+        // Task 8b — the monthly limit counts every azure call on this laptop,
+        // whether or not the counts are reported (honest-developer control).
+        if (rec.mode === 'azure')
+            await (deps.addLocal ?? ((n) => addLocalUsage(n)))(countedTokens(rec)).catch(() => { });
+        const cfg = await (deps.loadConfig ?? loadConfig)();
+        if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))(), undefined, await requiredFor(cfg, deps)).on) {
+            // Off: no queue file is written, and an existing one is deleted.
+            await deleteUsageQueue();
+            return;
+        }
+        // F10 — a record belongs to the seat that made the call; not signed in → no record.
+        const key = await (deps.getKey ?? defaultGetKey)();
+        if (!key)
+            return;
+        if (!(await enqueueUsage(rec, keyPrefixFor(key))))
+            return;
+        (deps.scheduleFlush ?? scheduleDefault)(() => {
+            try {
+                void flushUsageQueue(cfg.proxy_url, deps).catch(() => { });
+            }
+            catch { /* best effort */ }
+        });
+    }
+    catch { /* usage counts are best effort */ }
+}
+/**
+ * Send this seat's queued records in batches of at most 100 to the CSPeach
+ * proxy, with the seat's key. Re-checks first (F10): a managed seat, a seat
+ * with reporting off, or no key sends nothing. Each batch is leased (F1): it
+ * stays on disk until the proxy answered, then exactly those request ids are
+ * removed. 2xx → removed; 400 / 413 / 422 → removed (never accepted, F3);
+ * anything else or no answer → kept for later. Never logs the key.
+ */
+export async function flushUsageQueue(proxyUrl, deps = {}) {
+    const none = { sent: 0, kept: 0 };
+    let cfg;
+    try {
+        cfg = await (deps.loadConfig ?? loadConfig)();
+    }
+    catch {
+        return none;
+    }
+    if ((cfg.llm?.mode ?? 'managed') === 'managed')
+        return none;
+    if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))(), undefined, await requiredFor(cfg, deps)).on)
+        return none;
+    let key;
+    try {
+        key = await (deps.getKey ?? defaultGetKey)();
+    }
+    catch {
+        key = null;
+    }
+    if (!key)
+        return none;
+    const seat = keyPrefixFor(key);
+    const ack = deps.ack ?? ackBatch;
+    let sent = 0;
+    for (let round = 0; round < MAX_ROUNDS; round++) {
+        const batch = await leaseBatch(BATCH_SIZE, seat);
+        if (batch.length === 0)
+            break;
+        const ids = batch.map((r) => r.request_id);
+        let r;
+        try {
+            r = await (deps.fetchImpl ?? fetch)(`${proxyUrl.replace(/\/$/, '')}/v1/usage`, {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${key}`, 'content-type': 'application/json', 'User-Agent': `cspeach/${CLI_VERSION}` },
+                body: JSON.stringify({ records: batch }),
+                signal: AbortSignal.timeout(SEND_TIMEOUT_MS),
+            });
+        }
+        catch {
+            return { sent, kept: batch.length }; // offline: the lease simply lapses; nothing was removed
+        }
+        // F8 — always read the body (frees the socket); the rejected count is a
+        // debug line only, and never carries the key.
+        const text = await r.text().catch(() => '');
+        if (r.ok) {
+            sent += batch.length;
+            if (process.env.CSPEACH_DEBUG === '1') {
+                let rejected = 0;
+                try {
+                    rejected = Number(JSON.parse(text).rejected) || 0;
+                }
+                catch { /* not JSON */ }
+                if (rejected > 0)
+                    process.stderr.write(`[usage] the proxy rejected ${rejected} usage record(s)\n`);
+            }
+            // A failed removal keeps the batch for a resend (the proxy dedupes);
+            // stop here rather than lease the same batch again this flush.
+            if (!(await ack(ids)))
+                return { sent, kept: 0 };
+            continue;
+        }
+        if (DROP_STATUSES.has(r.status)) {
+            if (!(await ack(ids)))
+                return { sent, kept: 0 };
+            continue;
+        }
+        return { sent, kept: batch.length }; // 401 / 403 / 404 / 429 / 5xx: keep for later
+    }
+    return { sent, kept: 0 };
+}
+/**
+ * Controller ruling (Task 9 fix round 1) — at REPL / one-shot start, a
+ * non-managed seat with reporting on sends what is waiting. Fire-and-forget:
+ * returns at once (true when a flush was started), never throws, adds no
+ * start-up latency. Managed: returns false with no I/O at all.
+ */
+export function startUsageFlushAtStartup(cfg, deps = {}) {
+    try {
+        if ((cfg.llm?.mode ?? 'managed') === 'managed')
+            return false;
+        const flush = deps.flush ?? ((url) => flushUsageQueue(url));
+        if (cfg.llm?.mode === 'azure') {
+            // Task 8b — whether the company requires counts is read from disk, so
+            // the decision is async: fire-and-forget like the flush itself.
+            void (async () => {
+                if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))(), undefined, await requiredFor(cfg, deps)).on)
+                    return;
+                await flush(cfg.proxy_url);
+            })().catch(() => { });
+            return true;
+        }
+        if (!usageReportingState(cfg, (deps.now ?? (() => new Date()))()).on)
+            return false;
+        void Promise.resolve(flush(cfg.proxy_url)).catch(() => { });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cspeach/cli",
-  "version": "1.1.33",
-  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, 34 skills, safety gates.",
+  "version": "1.1.35",
+  "description": "CSPeach — AI-assisted ABAP development CLI. Direct SAP access, signed skills, safety gates.",
   "keywords": [
     "abap",
     "sap",
@@ -52,8 +52,9 @@
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.90.0",
+    "@azure/msal-node": "6.0.1",
     "@cspeach/register-core": "0.4.0",
-    "@cspeach/sap-client": "0.1.18",
+    "@cspeach/sap-client": "0.1.20",
     "@iarna/toml": "^2.2.5",
     "@inkjs/ui": "^2.0.0",
     "@inquirer/prompts": "^7.0.0",