@phnx-labs/agents-cli 1.21.1 → 1.21.3

package/dist/lib/secrets/usage-db.js

@@ -1,30 +1,9 @@
 /**
- * SQLite-backed usage read-model for `agents secrets`.
- *
- * A small local database at ~/.agents/secrets/secrets.db that records one
- * value-free row for every secret lifecycle/access event a bundle accrues over
- * its life — created, imported, exported, viewed, accessed (read for injection),
- * unlocked. It is the queryable, per-bundle counterpart to the append-only
- * ~/.agents/events.jsonl audit log: the SAME chokepoint (`emitSecretAudit`,
- * lib/secrets/audit.ts) feeds both, and this store answers "how often / how
- * recently / by whom was THIS bundle used?" without scanning the whole event
- * stream. It is a DERIVED index fed off the real access flow — the way
- * sessions.db indexes session metadata — never a second write path an operation
- * has to remember to call.
- *
- * Contract, mirroring the audit log: NEVER a secret value. Only metadata — the
- * bundle name, the event kind, key counts, the resolving agent/host, a status.
- *
- * Every write is best-effort: a failure here (missing runtime SQLite, a locked
- * db, a read-only fs) is swallowed so usage telemetry can never break secret
- * resolution. Set AGENTS_NO_USAGE_TRACK=1 to disable recording entirely (used by
- * tests and by callers that must stay perfectly silent).
+ * Secrets usage read-model — thin adapter over the analytics usage warehouse
+ * (`kind=secret`). Kept so `secrets view` / `list` / `activity` keep their API
+ * while the durable store lives at ~/.agents/.history/analytics/usage.db.
  */
-import * as fs from 'fs';
-import * as path from 'path';
-import Database from '../sqlite.js';
-import { getSecretsDbPath } from '../state.js';
-/** All event kinds, in the order `view` prints them. */
+import { recordUsage, getSecretBundleRollup, getSecretBundleAgents, getAllSecretBundleRollups, getSecretHistory, closeUsageDb, } from '../analytics/usage-db.js';
 export const SECRET_USAGE_EVENTS = [
     'access',
     'unlock',
@@ -33,28 +12,6 @@ export const SECRET_USAGE_EVENTS = [
     'create',
     'view',
 ];
-/** Events older than this are pruned on open so the history table stays bounded. */
-const EVENT_RETENTION_MS = 90 * 24 * 60 * 60 * 1000;
-const SCHEMA = `
-CREATE TABLE IF NOT EXISTS usage_events (
-  id INTEGER PRIMARY KEY AUTOINCREMENT,
-  ts TEXT NOT NULL,
-  bundle TEXT NOT NULL,
-  event TEXT NOT NULL,
-  agent TEXT,
-  host TEXT,
-  source TEXT,
-  status TEXT,
-  key_count INTEGER
-);
-CREATE INDEX IF NOT EXISTS idx_usage_bundle ON usage_events(bundle);
-CREATE INDEX IF NOT EXISTS idx_usage_bundle_event ON usage_events(bundle, event);
-CREATE INDEX IF NOT EXISTS idx_usage_ts ON usage_events(ts DESC);
-`;
-// Cached handle keyed by the resolved path, so a test that redirects
-// AGENTS_SECRETS_DB to a fresh temp file transparently reopens instead of
-// reusing a stale handle pointed at the previous path.
-let cached = null;
 function emptyEvents() {
     return {
         access: { count: 0, last: null },
@@ -65,68 +22,6 @@ function emptyEvents() {
         view: { count: 0, last: null },
     };
 }
-/**
- * Open (creating if needed) the usage DB, returning null on any failure so
- * every caller degrades to a no-op rather than throwing into secret resolution.
- */
-function open() {
-    const dbPath = getSecretsDbPath();
-    if (cached && cached.path === dbPath)
-        return cached.db;
-    if (cached) {
-        try {
-            cached.db.close();
-        }
-        catch { /* ignore */ }
-        cached = null;
-    }
-    try {
-        fs.mkdirSync(path.dirname(dbPath), { recursive: true });
-        const db = new Database(dbPath);
-        // WAL + a busy timeout so concurrent agent runs writing usage rows don't
-        // fail each other under load; every write is still best-effort besides.
-        db.pragma('journal_mode = WAL');
-        db.pragma('busy_timeout = 2000');
-        db.exec(SCHEMA);
-        // Bounded retention: this is a usage history for operators, not a compliance
-        // log (that is events.jsonl). Prune once per open on a 90-day window.
-        try {
-            db.prepare(`DELETE FROM usage_events WHERE ts < ?`).run(new Date(Date.now() - EVENT_RETENTION_MS).toISOString());
-        }
-        catch { /* prune is best-effort */ }
-        cached = { path: dbPath, db };
-        return db;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Record one usage event. Best-effort and value-free — swallows every error and
- * honors AGENTS_NO_USAGE_TRACK so telemetry never blocks or slows a read. Rows
- * with an empty bundle name are ignored (usage is per-bundle by definition).
- *
- * This is called from ONE place only — `emitSecretAudit` (lib/secrets/audit.ts)
- * — so every recorded event has already been written to the events.jsonl audit
- * log through the same chokepoint. Do not call it from a command handler; emit
- * the audit event instead.
- */
-export function recordSecretUsage(p) {
-    if (process.env.AGENTS_NO_USAGE_TRACK)
-        return;
-    if (!p.bundle)
-        return;
-    const db = open();
-    if (!db)
-        return;
-    try {
-        db.prepare(`INSERT INTO usage_events (ts, bundle, event, agent, host, source, status, key_count)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(new Date().toISOString(), p.bundle, p.event, p.agent ?? null, p.host ?? null, p.source ?? null, p.status ?? 'success', p.keyCount ?? null);
-    }
-    catch {
-        // Telemetry must never break secret resolution.
-    }
-}
 function toSummary(bundle, rows, byAgent) {
     const events = emptyEvents();
     let total = 0;
@@ -146,91 +41,56 @@ function toSummary(bundle, rows, byAgent) {
     }
     return { bundle, total, events, lastUsedAt, firstUsedAt, byAgent };
 }
-/**
- * Usage summary for one bundle, or undefined when nothing has ever been
- * recorded (or the DB is unavailable). Never throws.
- */
+export function recordSecretUsage(p) {
+    if (!p.bundle)
+        return;
+    const meta = {};
+    if (p.keyCount != null)
+        meta.keyCount = p.keyCount;
+    if (p.host)
+        meta.host = p.host;
+    recordUsage({
+        kind: 'secret',
+        name: p.bundle,
+        event: p.event,
+        agent: p.agent,
+        source: p.source,
+        status: p.status,
+        meta: Object.keys(meta).length ? meta : undefined,
+    });
+}
 export function getBundleUsage(bundle) {
-    const db = open();
-    if (!db)
+    const rows = getSecretBundleRollup(bundle);
+    if (rows.length === 0)
         return undefined;
-    try {
-        const rows = db
-            .prepare(`SELECT event, COUNT(*) AS n, MAX(ts) AS last, MIN(ts) AS first
-           FROM usage_events WHERE bundle = ? GROUP BY event`)
-            .all(bundle);
-        if (rows.length === 0)
-            return undefined;
-        const agents = db
-            .prepare(`SELECT agent, COUNT(*) AS n FROM usage_events
-           WHERE bundle = ? AND agent IS NOT NULL GROUP BY agent ORDER BY n DESC`)
-            .all(bundle);
-        return toSummary(bundle, rows, agents.map((a) => ({ agent: a.agent, count: a.n })));
-    }
-    catch {
-        return undefined;
-    }
+    const agents = getSecretBundleAgents(bundle);
+    return toSummary(bundle, rows, agents.map((a) => ({ agent: a.agent, count: a.n })));
 }
-/**
- * Usage summaries for every bundle that has any recorded event, keyed by bundle
- * name. Powers `secrets list --sort uses|used`. Empty map when the DB is
- * unavailable or has no rows. Never throws.
- */
 export function getAllBundleUsage() {
     const out = new Map();
-    const db = open();
-    if (!db)
-        return out;
-    try {
-        const rows = db
-            .prepare(`SELECT bundle, event, COUNT(*) AS n, MAX(ts) AS last, MIN(ts) AS first
-           FROM usage_events GROUP BY bundle, event`)
-            .all();
-        const byBundle = new Map();
-        for (const r of rows) {
-            const list = byBundle.get(r.bundle) ?? [];
-            list.push(r);
-            byBundle.set(r.bundle, list);
-        }
-        for (const [bundle, list] of byBundle)
-            out.set(bundle, toSummary(bundle, list, []));
-        return out;
-    }
-    catch {
-        return out;
+    const rows = getAllSecretBundleRollups();
+    const byBundle = new Map();
+    for (const r of rows) {
+        const list = byBundle.get(r.name) ?? [];
+        list.push(r);
+        byBundle.set(r.name, list);
     }
+    for (const [bundle, list] of byBundle)
+        out.set(bundle, toSummary(bundle, list, []));
+    return out;
 }
-/**
- * Recent events for the `secrets activity` timeline — one bundle when named,
- * else across all bundles — newest first. Empty when the DB is unavailable.
- * Never throws.
- */
 export function getUsageHistory(bundle, limit = 20) {
-    const db = open();
-    if (!db)
-        return [];
-    try {
-        const sql = bundle
-            ? `SELECT ts, bundle, event, agent, host, source, status, key_count AS keyCount
-           FROM usage_events WHERE bundle = ? ORDER BY ts DESC, id DESC LIMIT ?`
-            : `SELECT ts, bundle, event, agent, host, source, status, key_count AS keyCount
-           FROM usage_events ORDER BY ts DESC, id DESC LIMIT ?`;
-        const rows = bundle
-            ? db.prepare(sql).all(bundle, limit)
-            : db.prepare(sql).all(limit);
-        return rows;
-    }
-    catch {
-        return [];
-    }
+    return getSecretHistory(bundle, limit).map((r) => ({
+        ts: r.ts,
+        bundle: r.bundle,
+        event: r.event,
+        agent: r.agent,
+        host: r.host,
+        source: r.source,
+        status: r.status,
+        keyCount: r.keyCount,
+    }));
 }
-/** Close the cached handle. Used by tests between temp-db swaps. */
 export function closeSecretsUsageDb() {
-    if (cached) {
-        try {
-            cached.db.close();
-        }
-        catch { /* ignore */ }
-        cached = null;
-    }
+    closeUsageDb();
 }

package/dist/lib/session/db.d.ts

@@ -11,7 +11,7 @@ import type { SessionAgentId, SessionMeta } from './types.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/05-sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 21;
+export declare const SCHEMA_VERSION = 24;
 /** Raw row shape returned from the sessions table. */
 export interface SessionRow {
     id: string;
@@ -35,6 +35,7 @@ export interface SessionRow {
     cost_usd: number | null;
     duration_ms: number | null;
     model: string | null;
+    tool_call_count: number | null;
     file_path: string;
     file_mtime_ms: number | null;
     file_size: number | null;
@@ -53,6 +54,9 @@ export interface SessionRow {
     linear_project_url: string | null;
     actor: string | null;
     initiated_by: string | null;
+    /** NULL means "not yet computed" (a row scanned before this field existed) — see rowToMeta. */
+    used_browser: number | null;
+    used_computer: number | null;
 }
 /** File stat snapshot used to detect changes between scan runs. */
 export interface ScanStamp {
@@ -87,6 +91,18 @@ export interface QueryOptions {
      * with NULLs sorted last so unpriced rows never crowd out real data.
      */
     sortBy?: 'timestamp' | 'cost' | 'duration';
+    /**
+     * Only sessions that invoked this skill (#12), joined against
+     * session_resource_usage.kind='skill'. Matches either the full stored name
+     * (bare, or `plugin:name` for a plugin skill) or just the short name after
+     * the colon — `--skill design` finds a session that used `rush:design`.
+     */
+    skill?: string;
+    /**
+     * Only sessions that used a skill or slash-command owned by this plugin
+     * (#12), joined against session_resource_usage.plugin.
+     */
+    plugin?: string;
 }
 /** Open (or return the cached) sessions database, applying migrations as needed. */
 export declare function getDB(): Database.Database;