@ipv9/tokentracker-cli 0.39.48 → 0.39.49

package/README.md

@@ -78,7 +78,7 @@ Both bundle their own Node runtime, so there is nothing else to install. They sh
 
 ## ✨ What you get
 
-- 🔒 **Your usage data never leaves your machine.** Token counts and timestamps only — never prompts, responses, or file contents. No account, no telemetry, no analytics, no phone-home. TokenTracker does make a few outbound calls *on your behalf* (model prices, your own plan quotas); every one is named in [Privacy](#-privacy) below, and none of them carry your usage.
+- 🔒 **Your usage data never leaves your machine.** Usage metadata only — source, model, token and conversation counts, timestamps, and derived cost; never prompts, responses, message bodies, or private user-code paths. No account, no telemetry, no analytics, no phone-home. TokenTracker does make documented outbound calls *on your behalf* (for example model prices, provider authentication/quotas, and opt-in tools); none upload token-usage metadata.
 - 📊 **One calm web dashboard.** Your whole picture in the browser at a local URL, no login — light or dark, auto-refreshing while the tab is open. [What's on it ↓](#-the-dashboard)
 - 📈 **Quota at a glance, on every card.** Live plan-quota usage (e.g. 5h + weekly) as color-coded chips right on each provider's card — see how close you are to your limits without leaving the overview. Where the provider reports countable units you get the actual number rather than a percentage to convert in your head: GitHub Copilot reads `158/300` premium requests. Full windows + reset countdowns on the Limits page. Covers Claude, Codex, Cursor, Gemini, Kimi, Z.AI, Kiro, Copilot, and Antigravity.
 - 💰 **Cost you can trust — and a price tag when it can't.** 2,200+ models priced from [LiteLLM](https://github.com/BerriAI/litellm) (refreshed daily) with a bundled offline snapshot, so USD totals are right even without a network. A model too new to have a price is badged **pricing missing** rather than quietly counted as $0, and prices refresh in the background instead of waiting for a restart. Cross-provider records are de-duplicated to match each provider's own billing.
@@ -122,14 +122,14 @@ Rate-limit providers are auto-detected where possible. For Z.AI / GLM Coding Pla
 ## 🧩 How it works
 
 ```
-AI CLI tools  →  hooks / passive readers  →  local queue file  →  dashboard
-   (logs)         (token counts only)        (30-min buckets)     (your browser)
+AI CLI tools  →  hooks / passive readers  →  local queue files  →  dashboard
+   (logs)         (usage metadata)           (30-min buckets)     (your browser)
 ```
 
 1. Your AI tools write logs during normal use.
-2. Lightweight hooks (or passive file readers) pick up token counts locally — never prompt or response content. Some tools keep their logs in SQLite (Cursor, Kiro, Zed and friends); TokenTracker only ever *reads* those.
-3. Counts are aggregated into 30-minute UTC buckets and appended to one plain-text file: `~/.tokentracker/tracker/queue.jsonl`.
-4. The dashboard reads that file and renders it in your browser's timezone.
+2. Lightweight hooks and passive readers parse tool logs locally, then retain only approved usage metadata — never prompts or response content. Some tools keep their logs in SQLite (Cursor, Kiro, Zed and friends); TokenTracker reads those databases without modifying them.
+3. Counts are aggregated into 30-minute UTC buckets and appended to `~/.tokentracker/tracker/queue.jsonl`; per-project counts and local project identifiers are also written to `~/.tokentracker/tracker/project.queue.jsonl`.
+4. The dashboard reads those local queues, derives cost, renders in your browser's timezone, and may cache usage summaries and daily rows in browser localStorage.
 
 No account, no upload of your usage, and no server to sign in to.
 
@@ -139,11 +139,13 @@ No account, no upload of your usage, and no server to sign in to.
 
 | Protection | What it means |
 |---|---|
-| **No content** | Only token counts and timestamps. Never prompts, responses, or files. |
-| **Your usage stays local** | Every count TokenTracker collects is written to one file on your disk and read back by a server on your own machine. There is no endpoint it uploads usage to. |
-| **Auditable in one command** | You don't have to take our word for it — the store is an append-only text file you can open yourself: `cat ~/.tokentracker/tracker/queue.jsonl`. It's numbers and timestamps. |
+| **Usage metadata only** | Source, model, token and conversation counts, timestamps, and derived cost. Never prompts, responses, message bodies, or private user-code paths. |
+| **Your usage stays local** | Usage rows stay in `queue.jsonl` and `project.queue.jsonl`; derived summaries may also be cached in browser localStorage. No TokenTracker endpoint uploads usage. |
+| **Auditable locally** | Inspect both queue files with `cat ~/.tokentracker/tracker/{queue.jsonl,project.queue.jsonl}` and inspect optional browser localStorage caches in your browser's developer tools. The project queue includes local project identifiers. |
 | **No telemetry** | No analytics, no crash reporting, no phone-home, no account. |
 
+Credentials are used only for declared provider authentication or quota flows and their credential files; never place them in TokenTracker queues, logs, fixtures, diagnostics, API responses, or unrelated outbound payloads.
+
 **Outbound calls.** TokenTracker is local-first, not network-free. It reaches these hosts and no others. None of them carry your usage data — but some do reveal that *you* are asking, so they are listed with who makes the call.
 
 This table is checked in CI against [`outbound-hosts.json`](outbound-hosts.json): a host the code can reach but the file does not declare fails the build, and so does a declared host missing from this table. It is not maintained by memory.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ipv9/tokentracker-cli",
-  "version": "0.39.48",
+  "version": "0.39.49",
   "description": "Local-first token and cost dashboard for 22 AI coding tools, including Claude Code, Codex, Cursor, Gemini, Kiro, OpenCode, OpenClaw, Copilot, Antigravity, Zed, and Goose.",
   "main": "src/cli.js",
   "bin": {

package/src/cli.js

@@ -75,7 +75,7 @@ function printHelp() {
       "  - Every Code notify installs when ~/.code/config.toml exists.",
       "  - OpenClaw hook auto-links when OpenClaw is installed (requires gateway restart).",
       "  - serve prints the local dashboard URL; pass --open to ask the OS to open a browser.",
-      "  - sync parses ~/.codex/sessions/**/rollout-*.jsonl and ~/.code/sessions/**/rollout-*.jsonl into the local queue. Nothing is uploaded.",
+      "  - sync parses ~/.codex/sessions/**/rollout-*.jsonl and ~/.code/sessions/**/rollout-*.jsonl into local queues; sync does not upload token-usage metadata.",
       "  - --from-openclaw marks sync runs triggered by OpenClaw hooks.",
       "  - --debug shows original backend errors.",
       "",

package/src/commands/init.js

@@ -218,7 +218,7 @@ function renderWelcome() {
       "",
       `${BOLD}Token Tracker${RESET}  ${color("Local-first usage across " + providerCount + " AI CLIs", DIM)}`,
       DIVIDER,
-      `${CYAN}Nothing leaves your machine — token counts only, never prompts or responses.${RESET}`,
+      `${CYAN}Usage metadata stays local — never prompts or responses; optional outbound calls are documented.${RESET}`,
       DIVIDER,
       "",
       `  Tracks: ${providerLine}`,
@@ -304,7 +304,7 @@ async function runSetup({
   // Scrub cloud credentials and endpoints on upgrade. Spreading the previous
   // config forward kept a live InsForge bearer token in config.json, and this
   // branch also removed the `status` / `diagnostics` lines that used to reveal
-  // it — so the user is told "local-only, nothing is uploaded" while a valid
+  // it — making the user-facing local-usage privacy claim false while a valid
   // credential sits on disk with nothing left to report or rotate it.
   const {
     deviceToken: _removedDeviceToken,
@@ -932,11 +932,9 @@ if (debugEnabled) {
 }
 
 // Throttle spawn: at most once per 20 seconds.
-// Parsing local logs and uploading to the cloud are two separate decisions.
-// This hook makes only the first one. It runs whether or not a device token
-// exists, because a local-only install still needs its queue refreshed when a
-// session ends. Upload stays gated on a device token inside sync itself, so
-// no credential here means local parse happens and nothing is transmitted.
+// This hook only starts local parsing and queue refresh. Provider quota/auth
+// requests are separate, declared server flows; this generated hook does not
+// upload token-usage metadata or carry provider credentials.
 try {
   const throttlePath = path.join(trackerDir, 'sync.throttle');
   const now = Date.now();