@f5-sales-demo/xcsh-stats 21.13.1 → 21.14.0

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh-stats",
-	"version": "21.13.1",
+	"version": "21.14.0",
 	"description": "Local observability dashboard for pi AI usage statistics",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -38,8 +38,8 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@f5-sales-demo/pi-ai": "21.13.1",
-		"@f5-sales-demo/pi-utils": "21.13.1",
+		"@f5-sales-demo/pi-ai": "21.14.0",
+		"@f5-sales-demo/pi-utils": "21.14.0",
 		"@tailwindcss/node": "^4.2",
 		"chart.js": "^4.5",
 		"date-fns": "~4.4.0",

package/src/db.ts

@@ -101,6 +101,16 @@ export function setFileOffset(sessionFile: string, offset: number, lastModified:
 	stmt.run(sessionFile, offset, lastModified);
 }
 
+function normalizeUsageCost(cost: MessageStats["usage"]["cost"]): MessageStats["usage"]["cost"] {
+	const partial = cost as Partial<MessageStats["usage"]["cost"]>;
+	const input = partial.input ?? 0;
+	const output = partial.output ?? 0;
+	const cacheRead = partial.cacheRead ?? 0;
+	const cacheWrite = partial.cacheWrite ?? 0;
+	const total = partial.total ?? input + output + cacheRead + cacheWrite;
+	return { input, output, cacheRead, cacheWrite, total };
+}
+
 /**
  * Insert message stats into the database.
  */
@@ -119,6 +129,7 @@ export function insertMessageStats(stats: MessageStats[]): number {
 	let inserted = 0;
 	const insert = db.transaction(() => {
 		for (const s of stats) {
+			const cost = normalizeUsageCost(s.usage.cost);
 			const result = stmt.run(
 				s.sessionFile,
 				s.entryId,
@@ -137,11 +148,11 @@ export function insertMessageStats(stats: MessageStats[]): number {
 				s.usage.cacheWrite,
 				s.usage.totalTokens,
 				s.usage.premiumRequests ?? 0,
-				s.usage.cost.input,
-				s.usage.cost.output,
-				s.usage.cost.cacheRead,
-				s.usage.cost.cacheWrite,
-				s.usage.cost.total,
+				cost.input,
+				cost.output,
+				cost.cacheRead,
+				cost.cacheWrite,
+				cost.total,
 			);
 			if (result.changes > 0) inserted++;
 		}

package/src/index.ts

@@ -130,8 +130,8 @@ Examples:
 
 		// Start server
 		const port = parseInt(values.port || "3847", 10);
-		const { port: actualPort } = await startServer(port);
-		console.log(`Dashboard available at: http://localhost:${actualPort}`);
+		const { hostname, port: actualPort } = await startServer(port);
+		console.log(`Dashboard available at: http://${hostname}:${actualPort}`);
 		console.log("Press Ctrl+C to stop\n");
 
 		// Keep process running

package/src/server.ts

@@ -12,6 +12,8 @@ import {
 } from "./aggregator";
 import embeddedClientArchiveTxt from "./embedded-client.generated.txt";
 
+const STATS_DASHBOARD_HOSTNAME = "127.0.0.1";
+
 const getEmbeddedClientArchive = (() => {
 	const txt = embeddedClientArchiveTxt.replaceAll(/[\s\r\n]/g, "").trim();
 	if (!txt) return null;
@@ -157,6 +159,8 @@ const ensureClientBuild = async () => {
 </body>
 </html>`;
 
+	// STATIC_DIR is derived only from import.meta.dir; no HTML input reaches this filesystem path.
+	// nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag
 	await Bun.write(path.join(STATIC_DIR, "index.html"), indexHtml);
 };
 
@@ -244,24 +248,18 @@ async function handleStatic(requestPath: string): Promise<Response> {
 /**
  * Start the HTTP server.
  */
-export async function startServer(port = 3847): Promise<{ port: number; stop: () => void }> {
+export async function startServer(port = 3847): Promise<{ hostname: string; port: number; stop: () => void }> {
 	await ensureClientBuild();
 
 	const server = Bun.serve({
 		port,
+		hostname: STATS_DASHBOARD_HOSTNAME,
 		async fetch(req) {
 			const url = new URL(req.url);
 			const path = url.pathname;
 
-			// CORS headers for local development
-			const corsHeaders = {
-				"Access-Control-Allow-Origin": "*",
-				"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-				"Access-Control-Allow-Headers": "Content-Type",
-			};
-
 			if (req.method === "OPTIONS") {
-				return new Response(null, { headers: corsHeaders });
+				return new Response(null, { status: 204 });
 			}
 
 			try {
@@ -273,27 +271,16 @@ export async function startServer(port = 3847): Promise<{ port: number; stop: ()
 					response = await handleStatic(path);
 				}
 
-				// Add CORS headers to all responses
-				const headers = new Headers(response.headers);
-				for (const [key, value] of Object.entries(corsHeaders)) {
-					headers.set(key, value);
-				}
-
-				return new Response(response.body, {
-					status: response.status,
-					headers,
-				});
+				return response;
 			} catch (error) {
 				console.error("Server error:", error);
-				return Response.json(
-					{ error: error instanceof Error ? error.message : "Unknown error" },
-					{ status: 500, headers: corsHeaders },
-				);
+				return Response.json({ error: error instanceof Error ? error.message : "Unknown error" }, { status: 500 });
 			}
 		},
 	});
 
 	return {
+		hostname: STATS_DASHBOARD_HOSTNAME,
 		port: server.port ?? port,
 		stop: () => server.stop(),
 	};