@rosh100yx/outlier 0.4.24 → 0.7.0

package/bin/postinstall.js

@@ -1,20 +1,21 @@
 #!/usr/bin/env node
 
-const cyan = (text) => `\x1b[36m${text}\x1b[0m`;
-const dim = (text) => `\x1b[2m${text}\x1b[0m`;
-const bold = (text) => `\x1b[1m${text}\x1b[0m`;
+const cyan = (t) => `\x1b[36m${t}\x1b[0m`;
+const dim = (t) => `\x1b[2m${t}\x1b[0m`;
+const bold = (t) => `\x1b[1m${t}\x1b[0m`;
+const green = (t) => `\x1b[32m${t}\x1b[0m`;
 
-console.log('\n' + bold('Welcome to Outlier') + ' - AI Code Governance for the Terminal');
-console.log(dim('────────────────────────────────────────────────────────────'));
-console.log('To start the interactive wizard and audit your codebase, type:\n');
-console.log(`  ${cyan('outlier')}\n`);
-console.log('Available Commands:');
-console.log(`  ${cyan('outlier status')}        Run full AI reliance & capability audit`);
-console.log(`  ${cyan('outlier authorship')}    Scan git history for AI co-authorship ratio`);
-console.log(`  ${cyan('outlier carbon')}        Scan local logs for token waste & carbon cost`);
-console.log(`  ${cyan('outlier capabilities')}  Audit active MCPs, skills, and orchestrations`);
-console.log(`  ${cyan('outlier policy')}        Configure CI/CD guardrails and thresholds`);
-console.log(`  ${cyan('outlier impact')}        See the compounding horizon of AI Deskilling`);
-console.log(`  ${cyan('outlier knowledge')}     Explore core literature and METR references`);
-console.log(`  ${cyan('outlier participate')}   Help build the literature on AI deskilling`);
-console.log(dim('────────────────────────────────────────────────────────────\n'));
+console.log('\n' + bold('  Outlier installed') + dim(' · AI code governance for the terminal'));
+console.log(dim('  ──────────────────────────────────────────────────────────'));
+console.log('  Run it before you start coding. It reads your local git history');
+console.log('  and AI logs — ' + green('on your machine') + ' — and shows you:');
+console.log('    • how much of your code AI wrote');
+console.log('    • what it cost (tokens, $, wasted context, carbon)');
+console.log('    • whether you are keeping the skill while you use the speed');
+console.log('');
+console.log('  Start your first audit:');
+console.log(`      ${cyan('outlier')}`);
+console.log('');
+console.log('  Other commands:  ' + dim('outlier --help'));
+console.log(dim('  ──────────────────────────────────────────────────────────'));
+console.log('  ' + green('Local-first:') + ' nothing ever leaves your machine.\n');

package/data/grid-factors.json

@@ -1,7 +1,20 @@
 {
   "vietnam": 681,
-  "france": 21.7,
-  "us_east": 380,
+  "india_average": 715,
+  "indonesia": 650,
+  "china": 581,
   "singapore": 408,
-  "india_average": 715
+  "japan": 470,
+  "south_korea": 415,
+  "australia": 510,
+  "us_east": 380,
+  "us_west": 210,
+  "canada": 120,
+  "brazil": 95,
+  "uk": 210,
+  "germany": 350,
+  "france": 21.7,
+  "norway": 28,
+  "sweden": 41,
+  "global_average": 450
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rosh100yx/outlier",
-  "version": "0.4.24",
+  "version": "0.7.0",
   "description": "AI Code Governance & Capability Auditing for the Terminal. Measures AI reliance, context waste, and enforces local CI/CD policies.",
   "bin": {
     "outlier": "bin/outlier.js"

package/src/capabilities.ts

@@ -1,76 +1,116 @@
 import { homedir } from 'os';
 import { join } from 'path';
-import { existsSync, readdirSync } from 'fs';
+import { existsSync, readdirSync, readFileSync } from 'fs';
+
+// Reach = what a tool can actually do to you if an agent (or a prompt injection) drives it.
+export type Reach = 'read' | 'network' | 'model' | 'data' | 'write-local' | 'write-remote' | 'deploy' | 'exec' | 'money';
+
+export interface ToolReach {
+  name: string;
+  reach: Reach;
+}
+
+export type BlastRadius = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
 
 export interface CapabilitiesStats {
-  mcps: string[];
+  mcps: ToolReach[];
   skills: string[];
+  subagents: number;
+  hooks: string[];        // lifecycle events with auto-firing hooks
   hasOrchestration: boolean;
+  blastRadius: BlastRadius;
+  blastReasons: string[]; // plain-language reasons for the score
+}
+
+// Classify an MCP/tool by name into a reach category. Keyword-based, since names vary.
+export function classifyReach(name: string): Reach {
+  const n = name.toLowerCase();
+  if (/(stripe|payment|infinity|kucoin|wallet|billing|payout)/.test(n)) return 'money';
+  if (/(shell|bash|exec|terminal|command|sandbox)/.test(n)) return 'exec';
+  if (/(cloudflare|vercel|netlify|modal|deploy|fly\.io|render|heroku|aws|gcp|azure)/.test(n)) return 'deploy';
+  if (/(github|gitlab|git|bitbucket)/.test(n)) return 'write-remote';
+  if (/(filesystem|file|fs|disk)/.test(n)) return 'write-local';
+  if (/(memory|supermemory|mem|obsidian|notion|airtable|coda|database|sql|store)/.test(n)) return 'data';
+  if (/(openrouter|ollama|openai|anthropic|llm|model|hugging)/.test(n)) return 'model';
+  if (/(exa|web|fetch|search|brave|browser|http|scrape)/.test(n)) return 'network';
+  return 'network'; // unknown tool: assume it can reach out
+}
+
+const REACH_RISK: Record<Reach, number> = {
+  read: 0, model: 1, network: 1, 'data': 2, 'write-local': 2, 'write-remote': 3, deploy: 3, exec: 4, money: 4,
+};
+
+function scoreBlast(reaches: Reach[]): { radius: BlastRadius; reasons: string[] } {
+  const reasons: string[] = [];
+  const has = (r: Reach) => reaches.includes(r);
+  if (has('money')) reasons.push('can move money');
+  if (has('exec')) reasons.push('can run shell commands');
+  if (has('deploy')) reasons.push('can deploy to production');
+  if (has('write-remote')) reasons.push('can push to your remote repos');
+  if (has('write-local')) reasons.push('can write your local files');
+  if (has('data')) reasons.push('can read/write your stored data');
+  const netCount = reaches.filter(r => r === 'network' || r === 'model').length;
+  if (netCount >= 3) reasons.push(`reaches ${netCount} external services`);
+
+  const max = reaches.reduce((m, r) => Math.max(m, REACH_RISK[r]), 0);
+  let radius: BlastRadius = 'LOW';
+  if (max >= 4) radius = 'CRITICAL';
+  else if (max >= 3) radius = 'HIGH';
+  else if (max >= 2) radius = 'MEDIUM';
+  return { radius, reasons };
+}
+
+function readJson(path: string): any {
+  try { return JSON.parse(readFileSync(path, 'utf-8')); } catch { return null; }
+}
+
+function countDir(path: string, ext = '.md'): number {
+  try { return readdirSync(path).filter(f => f.endsWith(ext)).length; } catch { return 0; }
 }
 
 export async function getCapabilitiesStats(repoPath: string = process.cwd(), homeDirPath: string = homedir()): Promise<CapabilitiesStats> {
-  const stats: CapabilitiesStats = {
-    mcps: [],
-    skills: [],
-    hasOrchestration: false
-  };
-
-  // Check for AGENTS.md (Orchestration Policy)
-  if (existsSync(join(repoPath, 'AGENTS.md'))) {
-    stats.hasOrchestration = true;
-  }
+  const mcpNames = new Set<string>();
 
-  // Scan local project skills
-  const projectSkillsPath = join(repoPath, '.agents', 'skills');
-  if (existsSync(projectSkillsPath)) {
-    try {
-      const skills = readdirSync(projectSkillsPath, { withFileTypes: true })
-        .filter(dirent => dirent.isDirectory())
-        .map(dirent => dirent.name);
-      stats.skills.push(...skills);
-    } catch (e) {}
+  // MCP servers — the agent's actual tool reach. Read from every place they live.
+  for (const cfg of [
+    join(homeDirPath, '.claude.json'),
+    join(homeDirPath, '.claude', 'settings.json'),
+    join(repoPath, '.mcp.json'),
+    join(repoPath, '.claude', 'settings.json'),
+  ]) {
+    const j = readJson(cfg);
+    if (j?.mcpServers) Object.keys(j.mcpServers).forEach(k => mcpNames.add(k));
   }
-
-  // Scan global skills (Gemini / Claude)
-  const geminiSkillsPath = join(homeDirPath, '.gemini', 'skills');
-  if (existsSync(geminiSkillsPath)) {
-    try {
-      const skills = readdirSync(geminiSkillsPath, { withFileTypes: true })
-        .filter(dirent => dirent.isDirectory())
-        .map(dirent => dirent.name);
-      
-      // Only add if not already added (dedupe)
-      for (const skill of skills) {
-        if (!stats.skills.includes(skill)) stats.skills.push(skill);
-      }
-    } catch (e) {}
+  // Gemini-style MCP dir
+  const geminiMcp = join(homeDirPath, '.gemini', 'antigravity-cli', 'mcp');
+  if (existsSync(geminiMcp)) {
+    try { readdirSync(geminiMcp, { withFileTypes: true }).filter(d => d.isDirectory()).forEach(d => mcpNames.add(d.name)); } catch {}
   }
 
-  // Scan MCPs from gemini config
-  const geminiMcpPath = join(homeDirPath, '.gemini', 'antigravity-cli', 'mcp');
-  if (existsSync(geminiMcpPath)) {
-    try {
-      const mcps = readdirSync(geminiMcpPath, { withFileTypes: true })
-        .filter(dirent => dirent.isDirectory())
-        .map(dirent => dirent.name);
-      stats.mcps.push(...mcps);
-    } catch (e) {}
+  const mcps: ToolReach[] = [...mcpNames].map(name => ({ name, reach: classifyReach(name) }));
+
+  // Skills
+  const skills: string[] = [];
+  for (const p of [join(repoPath, '.agents', 'skills'), join(homeDirPath, '.claude', 'skills'), join(homeDirPath, '.gemini', 'skills')]) {
+    if (existsSync(p)) {
+      try { readdirSync(p, { withFileTypes: true }).filter(d => d.isDirectory()).forEach(d => { if (!skills.includes(d.name)) skills.push(d.name); }); } catch {}
+    }
   }
 
-  // Also check Claude settings for legacy MCPs/Plugins
-  const claudeSettingsPath = join(homeDirPath, '.claude', 'settings.json');
-  if (existsSync(claudeSettingsPath)) {
-    try {
-      const claudeSettings = require(claudeSettingsPath);
-      if (claudeSettings.enabledPlugins) {
-        Object.keys(claudeSettings.enabledPlugins).forEach(plugin => {
-          if (claudeSettings.enabledPlugins[plugin] && !stats.mcps.includes(plugin)) {
-            stats.mcps.push(`plugin:${plugin}`);
-          }
-        });
-      }
-    } catch (e) {}
+  // Sub-agents (Claude Code agent definitions)
+  const subagents = countDir(join(homeDirPath, '.claude', 'agents')) + countDir(join(repoPath, '.claude', 'agents'));
+
+  // Hooks — automation that fires on the developer's behalf (a real governance surface)
+  const hooks: string[] = [];
+  for (const cfg of [join(homeDirPath, '.claude', 'settings.json'), join(repoPath, '.claude', 'settings.json')]) {
+    const j = readJson(cfg);
+    if (j?.hooks) Object.keys(j.hooks).forEach(k => { if (!hooks.includes(k)) hooks.push(k); });
   }
 
-  return stats;
+  // Orchestration policy
+  const hasOrchestration = existsSync(join(repoPath, 'AGENTS.md')) || existsSync(join(repoPath, '.mcp.json'));
+
+  const { radius, reasons } = scoreBlast(mcps.map(m => m.reach));
+
+  return { mcps, skills, subagents, hooks, hasOrchestration, blastRadius: radius, blastReasons: reasons };
 }

package/src/carbon.ts

@@ -1,7 +1,9 @@
 import { homedir } from 'os';
 import { join } from 'path';
-import { readFile, access } from 'fs/promises';
+import { readFile, access, readdir } from 'fs/promises';
 import gridFactors from '../data/grid-factors.json';
+import { energyKwhByModel } from './emissions';
+import { detectSources, provLabel, type Provenance } from './sources';
 
 export interface CarbonStats {
   totalTokens: number;
@@ -13,51 +15,98 @@ export interface CarbonStats {
   localCo2Kg: number;
   localRegion: string;
   sessions: number;
-  estUsd: number;       // estimated spend in USD
-  costIsReal: boolean;  // true if summed from the log's own cost field, false if estimated from tokens
+  estUsd: number;          // estimated spend in USD
+  costIsReal: boolean;     // true if summed from the log's own cost field, false if estimated
+  tokenProvenance: Provenance;
+  carbonProvenance: Provenance;
+  sourceLabel: string;     // e.g. "estimated · Claude Code transcripts"
 }
 
 export interface TokenLogParser {
-  parse(): Promise<{ total: number, output: number, cache: number, sessions: number, cost: number }>;
+  parse(): Promise<{ total: number, output: number, cache: number, sessions: number, cost: number, outputByModel: Record<string, number> }>;
 }
 
 export class ClaudeLogParser implements TokenLogParser {
   private baseDir: string;
-  constructor(baseDir = homedir()) {
+  private cwd: string;
+  constructor(baseDir = homedir(), cwd = process.cwd()) {
     this.baseDir = baseDir;
+    this.cwd = cwd;
   }
+
   async parse() {
+    // Primary source: the standard Claude Code session transcripts for THIS repo.
+    // Claude Code stores them at ~/.claude/projects/<cwd-with-slashes-as-dashes>/*.jsonl,
+    // one JSON object per line; assistant turns carry `message.usage`.
+    const slug = this.cwd.replace(/\//g, '-');
+    const projectDir = join(this.baseDir, '.claude', 'projects', slug);
+    try {
+      const files = (await readdir(projectDir)).filter(f => f.endsWith('.jsonl'));
+      if (files.length > 0) {
+        let total = 0, output = 0, cache = 0;
+        const sessions = new Set<string>();
+        const outputByModel: Record<string, number> = {};
+        for (const file of files) {
+          let text = '';
+          try { text = await readFile(join(projectDir, file), 'utf-8'); } catch { continue; }
+          for (const line of text.split('\n')) {
+            if (!line.trim()) continue;
+            try {
+              const d = JSON.parse(line);
+              const msg = d.message || {};
+              const u = msg.usage || d.usage;
+              if (u) {
+                const inp = u.input_tokens || 0;
+                const out = u.output_tokens || 0;
+                const cr = u.cache_read_input_tokens || 0;
+                const cw = u.cache_creation_input_tokens || 0;
+                total += inp + out + cr + cw;
+                output += out;
+                cache += cr;
+                const model = msg.model || 'default';
+                outputByModel[model] = (outputByModel[model] || 0) + out;
+              }
+              if (d.sessionId) sessions.add(d.sessionId);
+            } catch {}
+          }
+        }
+        // Standard transcripts carry no cost field; cost is estimated downstream.
+        return { total, output, cache, sessions: sessions.size, cost: 0, outputByModel };
+      }
+    } catch {}
+
+    // Fallback: the optional tokenomics-log.jsonl (written by a custom Stop hook;
+    // carries a real cost_usd field when present).
     const logPath = join(this.baseDir, '.claude', 'tokenomics-log.jsonl');
-    
     try {
       await access(logPath);
     } catch {
-      return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0 };
+      return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0, outputByModel: {} };
     }
-
     const text = await readFile(logPath, 'utf-8');
-    const lines = text.trim().split('\n').filter(l => l.length > 0);
-
     let total = 0, output = 0, cache = 0, cost = 0;
     const sessions = new Set<string>();
-
-    for (const line of lines) {
+    const outputByModel: Record<string, number> = {};
+    for (const line of text.split('\n')) {
+      if (!line.trim()) continue;
       try {
         const data = JSON.parse(line);
         total += data.total_tokens || 0;
         output += data.output_tokens || 0;
         cache += data.cache_read || 0;
-        cost += data.cost_usd || 0; // present when the log was written with a cost field
+        cost += data.cost_usd || 0;
         if (data.session_id) sessions.add(data.session_id);
-      } catch (e) {}
+        const model = data.model || 'default';
+        outputByModel[model] = (outputByModel[model] || 0) + (data.output_tokens || 0);
+      } catch {}
     }
-    return { total, output, cache, sessions: sessions.size, cost };
+    return { total, output, cache, sessions: sessions.size, cost, outputByModel };
   }
 }
 
 class CursorLogParser implements TokenLogParser {
   async parse() {
-    return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0 };
+    return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0, outputByModel: {} };
   }
 }
 
@@ -77,13 +126,14 @@ function getLocalGridFactor(): { region: string, factor: number } {
     if (tz.includes('Singapore')) return { region: 'Singapore', factor: gridFactors.singapore };
     if (tz.includes('Calcutta') || tz.includes('Kolkata') || tz.includes('Asia/Kabul')) return { region: 'India', factor: gridFactors.india_average };
   } catch (e) {}
-  return { region: 'Global Average', factor: 450 };
+  return { region: 'Global Average', factor: gridFactors.global_average };
 }
 
 export async function getCarbonStats(): Promise<CarbonStats> {
   const parsers: TokenLogParser[] = [new ClaudeLogParser(), new CursorLogParser()];
-  
+
   let totalTokens = 0, outputTokens = 0, cacheReadTokens = 0, sessions = 0, loggedCost = 0;
+  const outputByModel: Record<string, number> = {};
 
   for (const parser of parsers) {
     const stats = await parser.parse();
@@ -92,11 +142,18 @@ export async function getCarbonStats(): Promise<CarbonStats> {
     cacheReadTokens += stats.cache;
     sessions += stats.sessions;
     loggedCost += stats.cost;
+    for (const [m, out] of Object.entries(stats.outputByModel)) {
+      outputByModel[m] = (outputByModel[m] || 0) + out;
+    }
   }
 
-  const energyKwh = (outputTokens / 1_000_000) * 0.662;
+  // Model-aware energy (replaces the single flat 0.662 coefficient).
+  const energyKwh = energyKwhByModel(outputByModel);
   const localGrid = getLocalGridFactor();
 
+  // Source provenance for honest labelling in the UI.
+  const sources = detectSources();
+
   // Prefer the log's own cost field (accurate); fall back to a rough token estimate.
   const costIsReal = loggedCost > 0;
   const estUsd = costIsReal ? loggedCost : estimateUsd(outputTokens, cacheReadTokens, totalTokens);
@@ -112,6 +169,9 @@ export async function getCarbonStats(): Promise<CarbonStats> {
     localRegion: localGrid.region,
     sessions,
     estUsd,
-    costIsReal
+    costIsReal,
+    tokenProvenance: sources.tokenSource.provenance,
+    carbonProvenance: sources.carbonSource.provenance,
+    sourceLabel: provLabel(sources.tokenSource)
   };
 }