@hasna/economy 0.2.40 → 0.2.41

package/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this repository are tracked here. This project follows semantic versioning for published npm packages when practical.
+
+## @hasna/economy 0.2.41 - 2026-06-24
+
+- Added root open-source project files for release notes, security reporting, contributing guidance, and conduct expectations.
+- Added npm repository, issue tracker, and homepage metadata.
+- Added package file allow-list coverage for release notes and security metadata.
+- Ignored local `.takumi/` SQLite state so private local telemetry is not accidentally staged.
+
+## @hasna/economy-sdk 0.2.1 - 2026-06-24
+
+- Added npm repository, issue tracker, and homepage metadata.
+- Added a package README and full Apache-2.0 license file to the SDK tarball.
+
+## @hasna/economy 0.2.40 - 2026-06-24
+
+- Added `economy brief` with text and JSON fleet summaries for tokens, cache reads/writes, cost, machine rows, agent rows, account rows, and freshness.
+- Added Codewith state-store ingestion from `~/.codewith/state_5.sqlite` alongside legacy Codex ingestion, with distinct session IDs and ingest cursors.
+- Added macOS machine identity fallback so apple hosts report stable machine IDs instead of generic `mac` hostnames.
+- Added brief pre-read sync and SQL aggregation changes to keep the command responsive on large merged fleet databases.
+- Added pricing coverage for current Claude Opus and Codewith GPT-5.5 model identifiers.
+- Hardened billing, database, and Codex ingest tests used in the release verification flow.
+- Published and fleet-installed `@hasna/economy@0.2.40`; the release was verified on spark01, spark02, and apple03 after correcting an apple03 Bun-global shim drift.
+
+## @hasna/economy-sdk 0.2.0 - 2026-06-24
+
+- Current published SDK package for the Economy REST API client.
+- Release metadata now points to the public Hasna Economy repository and Apache-2.0 license.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,23 @@
+# Code Of Conduct
+
+Hasna Economy is an open-source project for practical engineering collaboration. Contributors are expected to keep discussion professional, specific, and respectful.
+
+## Expected Behavior
+
+- Be direct about technical risks while staying respectful toward people.
+- Assume good intent when asking for clarification.
+- Keep issues and pull requests focused on reproducible facts, concrete proposals, and maintainable outcomes.
+- Respect privacy. Do not post secrets, private telemetry, credentials, or personal data.
+
+## Unacceptable Behavior
+
+- harassment, threats, insults, or discriminatory comments;
+- publishing private contact details, credentials, tokens, logs, or databases without consent;
+- sustained off-topic disruption of issues, pull requests, or release work;
+- misrepresenting validation, release, or security status.
+
+## Enforcement
+
+Maintainers may edit, hide, or remove comments; close issues or pull requests; restrict repository access; or escalate to platform moderation when needed to protect the project and its users.
+
+If you need to report conduct concerns, contact the maintainers through the repository's normal private security or maintainer channels.

package/CONTRIBUTING.md

@@ -0,0 +1,39 @@
+# Contributing
+
+Thanks for contributing to Hasna Economy.
+
+## Development Setup
+
+Use Bun for package management and validation.
+
+```bash
+bun install
+bun test
+bun run typecheck
+bun run build
+```
+
+Dashboard work lives under `dashboard/` and SDK work lives under `sdk/`. Run package-local commands from those directories when changing those packages.
+
+## Release And Package Hygiene
+
+Before proposing a release change:
+
+- keep unrelated local work separate;
+- do not commit local databases, private telemetry, `.env` files, credentials, logs, or machine-specific state;
+- verify `bun pm pack --dry-run --ignore-scripts` for publishable packages;
+- verify package entry points after `bun run build`;
+- update `CHANGELOG.md` for user-visible package changes;
+- keep package metadata, license fields, and release notes consistent with Apache-2.0.
+
+## Pull Requests
+
+Each pull request should describe the behavior change, validation commands, package/release impact, and any known migration or compatibility concern. Include tests when behavior changes, especially around ingest, billing, packaging, CLI commands, and server APIs.
+
+## Code Style
+
+Follow the existing TypeScript style. Prefer small, direct modules over broad refactors. Use structured APIs for data parsing and keep changes scoped to the behavior under review.
+
+## Security
+
+Report vulnerabilities according to [SECURITY.md](SECURITY.md). Do not publish private exploit details in public issues or pull requests.

package/README.md

@@ -263,6 +263,10 @@ cd dashboard && bun run lint
 cd menubar && swift build -c release
 ```
 
+## Open Source
+
+Economy is published under the Apache-2.0 license. See [CONTRIBUTING.md](CONTRIBUTING.md) for local development and release hygiene, [SECURITY.md](SECURITY.md) for vulnerability reporting, [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for community expectations, and [CHANGELOG.md](CHANGELOG.md) for release notes.
+
 ## HTTP mode
 
 Shared Streamable HTTP transport for multi-agent sessions (stdio remains the default):

package/SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are handled for the latest published versions of `@hasna/economy` and `@hasna/economy-sdk`.
+
+## Reporting A Vulnerability
+
+Please report vulnerabilities privately through GitHub Security Advisories for `hasna/economy` when available. If that is not available, open a minimal GitHub issue that says you need a private security contact without including exploit details.
+
+Do not include secrets, access tokens, private database contents, or exploit payloads in public issues, pull requests, logs, screenshots, or package artifacts.
+
+## Expected Response
+
+Hasna maintainers will triage reports based on impact, affected package versions, exploitability, and whether user data or credentials can be exposed. Confirmed vulnerabilities are fixed in source, validated with focused tests, and released through the normal package process.
+
+## Scope
+
+In scope:
+
+- credential or token exposure;
+- unsafe package contents;
+- auth, account, or tenant boundary bypasses;
+- remote code execution or command injection;
+- unintended publication of local databases or private telemetry.
+
+Out of scope:
+
+- attacks requiring direct write access to a user's local Economy database;
+- reports based only on dependency age without a demonstrated vulnerable path;
+- denial-of-service reports that require unbounded local filesystem control.