@inetafrica/open-claudia 2.6.11 → 2.6.13

package/core/handlers.js

@@ -302,6 +302,38 @@ register({
   },
 });
 
+// Where the magic link should point. Explicit WEB_PUBLIC_URL wins; else the
+// machine's first non-internal IPv4 (so a phone on the same wifi can reach
+// it); else localhost.
+function dashboardBaseUrl() {
+  const explicit = (process.env.WEB_PUBLIC_URL || "").trim().replace(/\/+$/, "");
+  if (explicit) return explicit;
+  const port = process.env.WEB_PORT || "8080";
+  const ifaces = require("os").networkInterfaces();
+  for (const name of Object.keys(ifaces)) {
+    for (const ni of ifaces[name] || []) {
+      if (ni.family === "IPv4" && !ni.internal) return `http://${ni.address}:${port}`;
+    }
+  }
+  return `http://localhost:${port}`;
+}
+
+register({
+  name: "dashboard", aliases: ["weblink"], description: "Get a one-time login link to the web dashboard", ownerOnly: true,
+  handler: async (env) => {
+    if (!ownerEnv(env)) return;
+    const { mint, TTL_MS } = require("./web-otp");
+    const { token } = mint();
+    const url = `${dashboardBaseUrl()}/otp/${token}`;
+    const mins = Math.round(TTL_MS / 60000);
+    const lines = [`Web dashboard login (valid ${mins} min, single use):`, url];
+    if (process.env.WEB_UI !== "true") {
+      lines.push("", "Note: the web UI isn't enabled yet — set WEB_UI=true in ~/.open-claudia/.env and /restart, then this link will work.");
+    }
+    send(lines.join("\n"));
+  },
+});
+
 async function requestAgentSpaceUpgrade() {
   const apiUrl = process.env.AGENTSPACE_API_URL;
   const token = process.env.AGENTSPACE_POD_TOKEN;

package/core/runner.js

@@ -28,6 +28,35 @@ const skillsLib = require("./skills");
 const packsLib = require("./packs");
 const entitiesLib = require("./entities");
 const packReview = require("./pack-review");
+const { appendUsageRecord } = require("./usage-log");
+
+const PKG_VERSION = require("../package.json").version;
+
+// One JSONL record per completed user turn (real turns only — compaction
+// summary/seed and sub-agent capture runs are excluded). Powers the web
+// dashboard's per-version tokenomics graphs.
+function logTurnUsage(state, usage, costUsd) {
+  if (!usage) return;
+  const backend = state.settings?.backend || "claude";
+  const input = usage.input_tokens || 0;
+  const cacheRead = usage.cache_read_input_tokens || usage.cached_input_tokens || 0;
+  const cacheCreation = usage.cache_creation_input_tokens || 0;
+  const output = usage.output_tokens || 0;
+  appendUsageRecord({
+    ts: new Date().toISOString(),
+    version: PKG_VERSION,
+    backend,
+    model: state.settings?.model || (backend === "claude" ? DEFAULT_CLAUDE_MODEL : null),
+    userId: state.userId || null,
+    sessionId: state[getActiveSessionKey(state)] || null,
+    inputTokens: input,
+    outputTokens: output,
+    cacheReadTokens: cacheRead,
+    cacheCreationTokens: cacheCreation,
+    contextTokens: input + cacheRead + cacheCreation,
+    costUsd: typeof costUsd === "number" ? costUsd : 0,
+  });
+}
 
 function telegramHtmlOpts(extra = {}) {
   const adapter = currentAdapter();
@@ -817,6 +846,7 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
         u.outputTokens += output;
         u.cacheReadTokens += cached;
         u.lastInputTokens = input + cached;
+        logTurnUsage(state, evt.usage, 0);
         saveState();
       }
       if (evt.type === "result" && evt.session_id) {
@@ -832,6 +862,10 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
           u.lastInputTokens = (evt.usage.input_tokens || 0) +
             (evt.usage.cache_read_input_tokens || 0) +
             (evt.usage.cache_creation_input_tokens || 0);
+          // Codex already logged this turn at turn.completed — don't double-count.
+          if (settings.backend !== "codex") {
+            logTurnUsage(state, evt.usage, typeof evt.total_cost_usd === "number" ? evt.total_cost_usd : 0);
+          }
         }
         if (typeof evt.total_cost_usd === "number") state.sessionUsage.costUsd += evt.total_cost_usd;
         saveState();

package/core/usage-log.js

@@ -0,0 +1,17 @@
+// Durable per-turn token-usage log. Each completed user turn appends one
+// JSONL record tagged with the open-claudia version + model, so the web
+// dashboard can graph tokenomics over time and compare across versions.
+
+const fs = require("fs");
+const path = require("path");
+const CONFIG_DIR = require("../config-dir");
+
+const USAGE_HISTORY_FILE = path.join(CONFIG_DIR, "usage-history.jsonl");
+
+function appendUsageRecord(record) {
+  try {
+    fs.appendFileSync(USAGE_HISTORY_FILE, JSON.stringify(record) + "\n");
+  } catch (e) {}
+}
+
+module.exports = { appendUsageRecord, USAGE_HISTORY_FILE };

package/core/web-otp.js

@@ -0,0 +1,44 @@
+// One-time login tokens for the web dashboard. The bot mints a token via
+// the /dashboard command and hands back a magic link; web.js burns the
+// token on first use and sets the session cookie. File-backed so it
+// survives a restart and works whether or not web + bot share a process.
+
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const CONFIG_DIR = require("../config-dir");
+
+const OTP_FILE = path.join(CONFIG_DIR, ".web-otp.json");
+const TTL_MS = 10 * 60 * 1000;
+
+function _load() {
+  try { return JSON.parse(fs.readFileSync(OTP_FILE, "utf-8")); } catch (e) { return []; }
+}
+
+function _save(list) {
+  try { fs.writeFileSync(OTP_FILE, JSON.stringify(list), { mode: 0o600 }); } catch (e) {}
+}
+
+function mint(ttlMs = TTL_MS) {
+  const token = crypto.randomBytes(32).toString("hex");
+  const expiresAt = Date.now() + ttlMs;
+  const now = Date.now();
+  const list = _load().filter((e) => e && e.expiresAt > now);
+  list.push({ token, expiresAt });
+  _save(list);
+  return { token, expiresAt };
+}
+
+// Validate and burn (single use). Returns true only if the token was
+// present and unexpired; prunes expired entries either way.
+function consume(token) {
+  if (!token || typeof token !== "string") return false;
+  const now = Date.now();
+  const list = _load();
+  const idx = list.findIndex((e) => e && e.token === token && e.expiresAt > now);
+  const remaining = list.filter((e, i) => e && e.expiresAt > now && i !== idx);
+  if (remaining.length !== list.length) _save(remaining);
+  return idx !== -1;
+}
+
+module.exports = { mint, consume, OTP_FILE, TTL_MS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.6.11",
+  "version": "2.6.13",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {

package/web.js

@@ -12,6 +12,7 @@ const SOUL_FILE = path.join(CONFIG_DIR, "soul.md");
 const CRONS_FILE = path.join(CONFIG_DIR, "crons.json");
 const SESSIONS_FILE = path.join(CONFIG_DIR, "sessions.json");
 const WEB_PASSWORD_FILE = path.join(CONFIG_DIR, ".web-password");
+const USAGE_HISTORY_FILE = path.join(CONFIG_DIR, "usage-history.jsonl");
 const PORT = parseInt(process.env.WEB_PORT || "8080", 10);
 
 // ── Password management ────────────────────────────────────────────
@@ -180,6 +181,48 @@ function isConfigured() {
   return fs.existsSync(ENV_FILE);
 }
 
+function loadUsageHistory() {
+  let raw;
+  try { raw = fs.readFileSync(USAGE_HISTORY_FILE, "utf-8"); } catch (e) { return []; }
+  const out = [];
+  for (const line of raw.split("\n")) {
+    const t = line.trim();
+    if (!t) continue;
+    try { out.push(JSON.parse(t)); } catch (e) {}
+  }
+  return out;
+}
+
+// Group usage records by a key (version / model) and return per-group
+// averages so the dashboard can compare tokenomics across versions.
+function aggregateUsage(records, keyName) {
+  const map = new Map();
+  for (const r of records) {
+    const k = r[keyName] || r.backend || "unknown";
+    let m = map.get(k);
+    if (!m) { m = { key: k, turns: 0, input: 0, output: 0, ctx: 0, cost: 0, first: r.ts, last: r.ts }; map.set(k, m); }
+    m.turns += 1;
+    m.input += r.inputTokens || 0;
+    m.output += r.outputTokens || 0;
+    m.ctx += r.contextTokens || 0;
+    m.cost += r.costUsd || 0;
+    if (r.ts && r.ts < m.first) m.first = r.ts;
+    if (r.ts && r.ts > m.last) m.last = r.ts;
+  }
+  return [...map.values()]
+    .sort((a, b) => (a.first < b.first ? -1 : a.first > b.first ? 1 : 0))
+    .map((m) => ({
+      [keyName]: m.key,
+      turns: m.turns,
+      avgContextTokens: m.turns ? m.ctx / m.turns : 0,
+      avgInputTokens: m.turns ? m.input / m.turns : 0,
+      avgOutputTokens: m.turns ? m.output / m.turns : 0,
+      totalCostUsd: m.cost,
+      firstTs: m.first,
+      lastTs: m.last,
+    }));
+}
+
 // ── Telegram helpers ───────────────────────────────────────────────
 
 function telegramGet(token, method) {
@@ -387,6 +430,26 @@ async function handleAPI(req, res, body) {
     return res.end(JSON.stringify({ content: loadLogs() }));
   }
 
+  // Token usage history (for the Usage dashboard)
+  if (url === "/api/usage") {
+    const records = loadUsageHistory();
+    const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf-8"));
+    const series = records.slice(-500).map((r) => ({
+      ts: r.ts,
+      version: r.version || "?",
+      contextTokens: r.contextTokens || 0,
+      outputTokens: r.outputTokens || 0,
+    }));
+    res.writeHead(200, { "Content-Type": "application/json" });
+    return res.end(JSON.stringify({
+      currentVersion: pkg.version,
+      totalRecords: records.length,
+      byVersion: aggregateUsage(records, "version"),
+      byModel: aggregateUsage(records, "model"),
+      series,
+    }));
+  }
+
   // Change password
   if (url === "/api/password" && req.method === "POST") {
     const { current, newPassword } = JSON.parse(body);
@@ -457,7 +520,12 @@ function getHTML() {
   .msg.ok { background: #052e16; color: #22c55e; }
   .msg.err { background: #2a0a0a; color: #dc2626; }
   .hidden { display: none; }
+  table.usage-table { width: 100%; border-collapse: collapse; font-size: 13px; }
+  table.usage-table th, table.usage-table td { text-align: left; padding: 8px 6px; border-bottom: 1px solid #222; white-space: nowrap; }
+  table.usage-table th { color: #888; font-weight: 500; }
+  table.usage-table td:first-child { color: #e0e0e0; }
 </style>
+<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
 </head>
 <body>
 <div id="app"></div>
@@ -536,6 +604,7 @@ async function doForceChange() {
 function render() {
   const tabs = [
     { id: "dashboard", label: "Dashboard" },
+    { id: "usage", label: "Usage" },
     { id: "auth", label: "Users" },
     { id: "soul", label: "Soul" },
     { id: "crons", label: "Crons" },
@@ -576,6 +645,27 @@ async function loadTab() {
         <div class="list-item"><span>Claude</span><span>\${status.claudePath}</span></div>
       </div>\`;
   }
+  else if (currentTab === "usage") {
+    const u = await api("/api/usage");
+    if (!u) return;
+    if (!u.totalRecords) {
+      el.innerHTML = '<div class="card"><h2>Token Usage</h2><p style="color:#888">No usage recorded yet. Send a few messages and check back — each turn is logged with the running version.</p></div>';
+      return;
+    }
+    el.innerHTML =
+      '<div class="card">' +
+        '<h2>Avg context tokens / turn — by version</h2>' +
+        '<p style="color:#888;font-size:13px;margin-bottom:12px;">Lower is better. Current: v' + u.currentVersion + ' · ' + u.totalRecords + ' turns logged</p>' +
+        '<canvas id="chart-version" height="150"></canvas>' +
+      '</div>' +
+      '<div class="card">' +
+        '<h2>Trend — recent turns</h2>' +
+        '<canvas id="chart-trend" height="150"></canvas>' +
+      '</div>' +
+      '<div class="card"><h2>By version</h2>' + usageTableHTML(u.byVersion, "version") + '</div>' +
+      '<div class="card"><h2>By model</h2>' + usageTableHTML(u.byModel, "model") + '</div>';
+    renderUsageCharts(u);
+  }
   else if (currentTab === "auth") {
     const auth = await api("/api/auth");
     if (!auth) return;
@@ -680,6 +770,55 @@ async function loadTab() {
   }
 }
 
+function fmtK(n) { n = Math.round(n || 0); return n >= 1000 ? (n / 1000).toFixed(1) + "k" : String(n); }
+
+function usageTableHTML(rows, keyName) {
+  if (!rows || !rows.length) return '<p style="color:#888">No data.</p>';
+  const head = '<table class="usage-table"><thead><tr><th>' + keyName +
+    '</th><th>turns</th><th>avg ctx/turn</th><th>avg in</th><th>avg out</th><th>cost</th></tr></thead><tbody>';
+  const body = rows.map(function (r) {
+    const name = r[keyName] || "—";
+    return '<tr><td>' + name + '</td><td>' + r.turns + '</td><td>' + fmtK(r.avgContextTokens) +
+      '</td><td>' + fmtK(r.avgInputTokens) + '</td><td>' + fmtK(r.avgOutputTokens) +
+      '</td><td>$' + (r.totalCostUsd || 0).toFixed(3) + '</td></tr>';
+  }).join("");
+  return head + body + "</tbody></table>";
+}
+
+let _usageCharts = {};
+function renderUsageCharts(u) {
+  if (typeof Chart === "undefined") return;
+  Object.values(_usageCharts).forEach(function (c) { try { c.destroy(); } catch (e) {} });
+  _usageCharts = {};
+  const grid = { color: "#222" };
+  const ticks = { color: "#888" };
+  const vc = document.getElementById("chart-version");
+  if (vc) {
+    _usageCharts.version = new Chart(vc, {
+      type: "bar",
+      data: {
+        labels: u.byVersion.map(function (v) { return v.version; }),
+        datasets: [{ label: "Avg context tokens / turn", data: u.byVersion.map(function (v) { return Math.round(v.avgContextTokens); }), backgroundColor: "#6366f1" }],
+      },
+      options: { plugins: { legend: { display: false } }, scales: { y: { ticks: ticks, grid: grid, beginAtZero: true }, x: { ticks: ticks, grid: grid } } },
+    });
+  }
+  const tc = document.getElementById("chart-trend");
+  if (tc) {
+    _usageCharts.trend = new Chart(tc, {
+      type: "line",
+      data: {
+        labels: u.series.map(function (s, i) { return i + 1; }),
+        datasets: [
+          { label: "Context tokens", data: u.series.map(function (s) { return s.contextTokens; }), borderColor: "#6366f1", backgroundColor: "transparent", pointRadius: 0, tension: 0.2 },
+          { label: "Output tokens", data: u.series.map(function (s) { return s.outputTokens; }), borderColor: "#22c55e", backgroundColor: "transparent", pointRadius: 0, tension: 0.2 },
+        ],
+      },
+      options: { plugins: { legend: { labels: { color: "#888" } } }, scales: { y: { ticks: ticks, grid: grid, beginAtZero: true }, x: { ticks: ticks, grid: grid } } },
+    });
+  }
+}
+
 async function removeAuth(chatId) { await api("/api/auth/remove", { method: "POST", body: { chatId } }); loadTab(); }
 async function approveAuth(chatId) { await api("/api/auth/approve", { method: "POST", body: { chatId } }); loadTab(); }
 async function denyAuth(chatId) { await api("/api/auth/deny", { method: "POST", body: { chatId } }); loadTab(); }
@@ -756,6 +895,22 @@ function startWebServer() {
     res.setHeader("Access-Control-Allow-Headers", "Content-Type");
     if (req.method === "OPTIONS") { res.writeHead(204); return res.end(); }
 
+    // One-time magic-link login: /otp/<token> from the bot's /dashboard
+    // command. Burns the token, sets the session cookie, redirects to /.
+    if (req.method === "GET" && req.url.startsWith("/otp/")) {
+      const token = decodeURIComponent(req.url.slice(5).split("?")[0].split("/")[0]);
+      const { consume } = require("./core/web-otp");
+      if (consume(token)) {
+        res.writeHead(302, {
+          "Location": "/",
+          "Set-Cookie": `oc_session=${authToken()}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`,
+        });
+        return res.end();
+      }
+      res.writeHead(401, { "Content-Type": "text/html" });
+      return res.end('<!DOCTYPE html><html><head><meta name="viewport" content="width=device-width, initial-scale=1.0"><style>body{font-family:-apple-system,sans-serif;background:#0f0f0f;color:#e0e0e0;display:flex;align-items:center;justify-content:center;min-height:100vh;text-align:center;padding:20px}</style></head><body><div><h2>Link expired or already used</h2><p style="color:#888">Send /dashboard in the bot for a fresh link.</p></div></body></html>');
+    }
+
     if (req.url.startsWith("/api/")) {
       let body = "";
       req.on("data", (d) => { body += d; });