@hasna/economy 0.3.27 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,106 @@
 # Changelog
 
+## 0.4.0
+
+### Minor Changes
+
+- 00118b3: Resolve credentials through the `@hasna/contracts` 1.0.2 client chain (hasna/apps#1720).
+
+  The CLI, the MCP server and the `./sdk` store surface no longer carry a
+  credential chain of their own. All three route through the one resolver in
+  `@hasna/contracts` (bumped from 0.13.4 to the exact 1.0.2), which reads, per
+  call: an explicit `--api-key`/`--profile`, then `HASNA_ECONOMY_API_KEY_OVERRIDE`
+  / `HASNA_PROFILE` / `HASNA_ECONOMY_API_KEY_REF`, then the macOS Keychain item
+  `hasna.credentials.economy.api-key`, then `~/.hasna/economy/config/credentials`
+  (0600, `HASNA_ECONOMY_API_KEY=…`), then `HASNA_ECONOMY_API_KEY`. The authority
+  follows the same ladder — `HASNA_ECONOMY_API_URL`, the Keychain `api-url` item,
+  the credentials file — and now DEFAULTS to the fleet gateway
+  `https://api.hasna.com/economy` once a credential resolves, so a key alone is a
+  complete configuration. A long-lived MCP server re-resolves the credential on
+  every request, so a rotation heals without a restart.
+
+  What this removes:
+
+  - The app's own legacy env chain: the unprefixed serve token `ECONOMY_API_TOKEN`
+    (canonical `HASNA_ECONOMY_API_TOKEN` remains) and `ECONOMY_MACHINE_ID`
+    (canonical `HASNA_ECONOMY_MACHINE_ID`).
+  - Retired `*_MODE` / `*_STORAGE_MODE` switches stay a hard error, and the
+    DEPRECATED notice is gone: `HASNA_ECONOMY_API_KEY` is a legitimate resolver
+    tier, it just sits below the Keychain and the credentials file.
+  - Nothing reads `~/.hasna/fleet-env`, `~/.hasna/cloud`, `~/.config/hasna` or
+    `$XDG_CONFIG_HOME` — the resolver never consults those locations.
+
+  What this keeps and adds:
+
+  - Fail loud (owner directive 2026-09-04): hosted with no credential = non-zero
+    exit, no SQLite file, no `economy-local-fallback` event, and an error naming
+    every tier consulted. Local mode is served only by the explicit opt-in
+    `HASNA_ECONOMY_LOCAL=1` (alias `ECONOMY_LOCAL=1` for one release), which
+    yields to every hosted signal and now prints one `economy: local mode …` line
+    on stderr.
+  - `economy transport` (new CLI command): reports the resolved transport and the
+    credential SOURCE — `/v1` authority, `api_url_source`, `api_key_source`,
+    `api_key_tier` — never the key value; `--json` for the full report. It is the
+    one surface that reports a refusal instead of throwing.
+  - The `./sdk` store surface (`getStore`) is unchanged in shape, and it is the
+    ONLY SDK: the Store takes no `baseUrl`, so the package can never attach an
+    ambient fleet key to a caller-supplied one (hasna/apps#1794) — the authority
+    and the credential both come from the resolver, per call.
+  - `@hasna/contracts` stays a runtime dependency (economy builds with
+    `--packages external`), so the published declarations importing its types
+    resolve for consumers. The `/v1/machines` and `/v1/fleet` surfaces are
+    unchanged and keep working against the resolved authority.
+
+### Patch Changes
+
+- 361d51b: Fail-closed / resolver validation fixes for the hosted-by-default client
+  (hasna/apps#1720, validation round 1).
+
+  - **MCP: no SQLite under the app home in hosted mode.** `economy-mcp` opened
+    the agent-lifecycle registry (`agent-registry.db` plus its WAL/SHM sidecars)
+    at startup — in hosted mode too, before any tool was called. The registry
+    store is now resolved on first tool use, and a hosted client keeps it in
+    memory for the life of the process; only the explicit `HASNA_ECONOMY_LOCAL=1`
+    opt-in persists `agent-registry.db` beside the local store
+    (`HASNA_AGENT_REGISTRY_DB_PATH` still names a file explicitly in either lane).
+  - **MCP: the fail-closed diagnostic is the first stderr line**
+    (`MCP server error: Economy fails closed …`, naming the Keychain item, the
+    credentials file and `HASNA_ECONOMY_API_KEY`) instead of Bun's code frame.
+  - **`economy transport` exits 1 when no credential resolves.** The report is
+    still printed (`--json` included), so the diagnostic stays readable while a
+    script can no longer take a refusal for a hosted transport.
+  - **`economy-otel` follows the storage seam.** With a resolved credential the
+    sidecar forwards the request/session rows of every accepted payload to the
+    shared API's `/v1/ingest` (the response gains `forwarded`; nothing is written
+    under `~/.hasna/economy`); under `HASNA_ECONOMY_LOCAL=1` it writes the
+    on-box store and announces local mode on stderr; with neither it fails
+    closed before binding. `economy-otel` stays undeclared in
+    `hasna.contract.json` because `-otel` is outside the contract kit's bin
+    allowlist.
+  - **Hosted `economy sync` keeps its mtime cache as a JSON file under the cache
+    root** (`HASNA_CACHE_HOME`, else `~/Library/Caches/Hasna/economy` on macOS /
+    `~/.cache/hasna/economy` elsewhere; `HASNA_ECONOMY_INGEST_CACHE` overrides)
+    instead of `~/.hasna/economy/ingest-cache.db`. An older cache file is simply
+    not read — one re-read, absorbed by the server's idempotent upserts — and can
+    be deleted.
+  - **Manifest:** the CLI and MCP surfaces declare `authMode: api-key`
+    (credential via the `@hasna/contracts` chain) and the SDK surface
+    `exportSubpath: ./sdk`.
+  - **No `-sdk` split package.** The unpublished in-tree `@hasna/economy-sdk`
+    (`sdk/`) is removed: the SDK is the `./sdk` export of this one package — the
+    Store abstraction, which takes no `baseUrl` and therefore never attaches an
+    ambient fleet key to a caller-supplied one (hasna/apps#1794).
+  - Test hygiene: `src/mcp/http.test.ts` restores the local opt-in it pins, so
+    the #1788 ambient-gate test passes in the full suite; new spawned-bin tests
+    cover the MCP hosted / fail-closed arms, the three `economy-otel` lanes and
+    the `economy transport` exit codes.
+
+## 0.3.28
+
+### Patch Changes
+
+- Switch @hasna/economy local path reads/writes through the @hasna/paths resolver (XDG/macOS home layout). The legacy `~/.hasna/economy` data root (with the `HASNA_ECONOMY_HOME` / `ECONOMY_HOME` exact-app overrides layered on top of the existing `HASNA_ECONOMY_DB_PATH` / `ECONOMY_DB` store override) stays the effective data root until the store has actually been migrated to the XDG data home or the operator sets the data-kind override `HASNA_DATA_HOME` — an existing local store never becomes invisible on upgrade. The install-time postinstall now creates the same effective data root (and its `training` subdir) the runtime resolves. The OpenLoops ingest read (`economy sync --loops`) resolves the loops store through the resolver with a legacy-read fallback, so it keeps working whichever side of the XDG migration `@hasna/loops` is on. Dependency pinned exactly to `@hasna/paths@0.1.0` — the wave-wide pin for the hasna/apps resolver-switch lanes (XDG home migration, hotfixes plan 0f49f56a, task P3.3).
+
 ## 0.3.27
 
 ### Patch Changes

package/CONTRIBUTING.md

@@ -13,7 +13,7 @@ bun run typecheck
 bun run build
 ```
 
-Dashboard work lives under `dashboard/` and SDK work lives under `sdk/`. Run package-local commands from those directories when changing those packages.
+The SDK is the `./sdk` export subpath of this package (`src/index.ts`, the Store abstraction); there is no separate `sdk/` package to build or publish.
 
 ## Release And Package Hygiene
 

package/README.md

@@ -1,6 +1,6 @@
 # @hasna/economy
 
-AI coding cost tracker for Claude Code, Takumi, Codex, Gemini, OpenCode, Cursor, Pi, and Hermes. It ships as a CLI, MCP server, REST API, web dashboard, and native macOS menu bar app.
+AI coding cost tracker for Claude Code, Takumi, Codex, Gemini, OpenCode, Cursor, Pi, and Hermes. It ships as a CLI, MCP server, REST API, and native macOS menu bar app.
 
 [![npm](https://img.shields.io/npm/v/@hasna/economy)](https://www.npmjs.com/package/@hasna/economy)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
@@ -14,7 +14,7 @@ AI coding cost tracker for Claude Code, Takumi, Codex, Gemini, OpenCode, Cursor,
 - Seeds editable model pricing with input, output, cache-read, 5-minute cache-write, 1-hour cache-write, and context-cache storage rates.
 - Handles tiered pricing such as Gemini long-prompt rates and OpenAI long-context rates.
 - Reconciles estimates against Anthropic, OpenAI, and Gemini billing sources.
-- Exposes cost data through CLI commands, an MCP server, REST endpoints, and a dashboard.
+- Exposes cost data through CLI commands, an MCP server, and REST endpoints.
 - Syncs project metadata from the `@hasna/projects` registry during full local sync.
 - Sends budget alert webhooks and retries failed deliveries on later syncs.
 
@@ -33,12 +33,6 @@ economy pricing list
 economy serve --port 3456
 ```
 
-Open the dashboard with:
-
-```bash
-economy dashboard --port 3456
-```
-
 ## Documentation
 
 - [CLI reference](docs/cli.md)
@@ -124,7 +118,7 @@ economy sync --hermes
 economy sync --loops
 ```
 
-`economy sync --loops` reads `~/.hasna/loops/loops.db` in read-only mode and imports OpenLoops orchestration/judge `goal_runs.tokens_used` into `loop:*` cost centers. It intentionally does not ingest dispatched coding-agent work from loops; heavy agent spend remains captured by the existing per-agent ingesters and can be analyzed alongside loop cost centers through account/profile attribution.
+`economy sync --loops` reads the OpenLoops store (`~/.hasna/loops/loops.db` by default, resolved through the `@hasna/paths` XDG data home once the loops store has migrated there) in read-only mode and imports OpenLoops orchestration/judge `goal_runs.tokens_used` into `loop:*` cost centers. It intentionally does not ingest dispatched coding-agent work from loops; heavy agent spend remains captured by the existing per-agent ingesters and can be analyzed alongside loop cost centers through account/profile attribution.
 
 Useful repair options:
 
@@ -237,7 +231,7 @@ Start the server:
 economy-serve --port 3456
 ```
 
-The canonical API uses `/v1`; `/api` remains a legacy alias for the dashboard and older clients. For example:
+The canonical API uses `/v1`; `/api` remains a legacy alias for older clients. For example:
 
 - `GET /health`, `/ready`, `/version`, and `/openapi.json`
 - `GET /v1/summary?period=today`
@@ -248,8 +242,6 @@ The canonical API uses `/v1`; `/api` remains a legacy alias for the dashboard an
 
 See the [REST API reference](docs/rest-api.md) for every route, response envelopes, authentication, and legacy aliases. The server publishes the current generated contract at `/openapi.json`.
 
-The server also serves the built dashboard when `dashboard/dist` is present. The dashboard includes account-scoped session filtering, subscription plan create/update/delete controls in Savings, and savings/usage/account tables for subscription-aware cost analysis.
-
 ## Native macOS Menubar
 
 The `menubar/` app is a native SwiftUI `MenuBarExtra` app, not Electron. It targets Swift 5.9+ and macOS 14+, and talks to the REST API exposed by `economy-serve`. It shows today/week/month spend, token and request counts, top agents, top accounts, top projects, active subscription plans, subscription savings, multi-agent usage snapshots, recent sessions, and fleet status. The default server URL is `http://127.0.0.1:3456`.
@@ -272,11 +264,13 @@ economy menubar uninstall
 
 ## Data Directory
 
-Data is stored in `~/.hasna/economy/`.
+Data is stored under a single data root resolved through the `@hasna/paths` resolver (XDG/macOS home layout). The legacy `~/.hasna/economy/` stays the effective root until the store is actually migrated to the XDG data home or the operator sets the data-kind override `HASNA_DATA_HOME`; the exact-app overrides `HASNA_ECONOMY_HOME` / `ECONOMY_HOME` win unconditionally.
+
+The main SQLite database lives at `<data-root>/economy.db` (`~/.hasna/economy/economy.db` by default). Older `~/.economy/` data is copied on first open when the new directory does not exist. Override the database path with `HASNA_ECONOMY_DB_PATH` or `ECONOMY_DB`.
 
-The main SQLite database lives at `~/.hasna/economy/economy.db`. Older `~/.economy/` data is copied on first open when the new directory does not exist. Override the database path with `HASNA_ECONOMY_DB_PATH` or `ECONOMY_DB`.
+For shared deployments, CLI, MCP and `./sdk` can use a remote `/v1` API instead of local SQLite. Their credential is resolved by `@hasna/contracts` 1.0.2, fresh per request, from: an explicit `--api-key`/`--profile` argument, the env pointers `HASNA_ECONOMY_API_KEY_OVERRIDE` / `HASNA_PROFILE` / `HASNA_ECONOMY_API_KEY_REF`, the macOS Keychain item `hasna.credentials.economy.api-key`, the 0600 file `~/.hasna/economy/config/credentials` (`HASNA_ECONOMY_API_KEY=…`), then `HASNA_ECONOMY_API_KEY` in the environment. The authority follows the same ladder (`HASNA_ECONOMY_API_URL`, the Keychain `api-url` item, the credentials file) and defaults to the fleet gateway `https://api.hasna.com/economy`. Unprefixed `ECONOMY_API_URL`/`ECONOMY_API_KEY` aliases are legacy, accepted for one release.
 
-For shared deployments, CLI and MCP can use a remote `/v1` API instead of local SQLite by setting `HASNA_ECONOMY_API_URL` and `HASNA_ECONOMY_API_KEY`. See [configuration](docs/configuration.md) for client resolution, server auth, Postgres mode, and all environment variables.
+**A run without a credential fails closed**: non-zero exit, no SQLite file, no local-fallback event. The on-box store is served only with the explicit opt-in `HASNA_ECONOMY_LOCAL=1` (alias `ECONOMY_LOCAL=1`), which prints `economy: local mode …` on stderr. See [configuration](docs/configuration.md) for the full client resolution, server auth, Postgres mode, and all environment variables.
 
 ## Development
 
@@ -285,7 +279,6 @@ bun test
 bun run typecheck
 bun run build
 bun scripts/sync-openapi.ts
-cd dashboard && bun run lint
 cd menubar && swift build -c release
 ```
 

package/SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Security fixes are handled for the latest published versions of `@hasna/economy` and `@hasna/economy-sdk`.
+Security fixes are handled for the latest published version of `@hasna/economy` (the CLI, MCP, server and `./sdk` surfaces ship in that one package).
 
 ## Reporting A Vulnerability
 

package/dist/cli/commands/extras.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extras.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/extras.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiDnC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2S/D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyC5D"}
+{"version":3,"file":"extras.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/extras.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAmDnC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+V/D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyC5D"}