@rosh100yx/outlier 0.4.25 → 0.10.2

package/data/grid-factors.json

@@ -1,7 +1,20 @@
 {
   "vietnam": 681,
-  "france": 21.7,
-  "us_east": 380,
+  "india_average": 715,
+  "indonesia": 650,
+  "china": 581,
   "singapore": 408,
-  "india_average": 715
+  "japan": 470,
+  "south_korea": 415,
+  "australia": 510,
+  "us_east": 380,
+  "us_west": 210,
+  "canada": 120,
+  "brazil": 95,
+  "uk": 210,
+  "germany": 350,
+  "france": 21.7,
+  "norway": 28,
+  "sweden": 41,
+  "global_average": 450
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rosh100yx/outlier",
-  "version": "0.4.25",
+  "version": "0.10.2",
   "description": "AI Code Governance & Capability Auditing for the Terminal. Measures AI reliance, context waste, and enforces local CI/CD policies.",
   "bin": {
     "outlier": "bin/outlier.js"

package/src/aggregate.ts

@@ -0,0 +1,59 @@
+// #8 Light team/fleet aggregation — local-first, no export.
+//
+// Each developer runs `outlier --json > me.json` and drops it in a shared folder (or CI
+// collects them). `outlier aggregate <dir>` merges those JSON files into a team rollup.
+// No machine talks to another; it only reads JSON the team already produced. This is the
+// honest, minimal version of fleet view — real aggregation without a backend.
+
+import { readdirSync, readFileSync } from 'fs';
+import { join } from 'path';
+
+export interface TeamRollup {
+  developers: number;
+  avgAiPercent: number | null;
+  maxAiPercent: number | null;
+  totalEstUsd: number;
+  worstBlastRadius: string;
+  overLimit: number;        // how many devs are over their AI cap
+  reachWriteDeploy: number; // total write/deploy-capable tools across the team
+  notes: string[];
+}
+
+const BLAST_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+
+export function aggregateDir(dir: string): TeamRollup {
+  const files = readdirSync(dir).filter(f => f.endsWith('.json'));
+  const audits: any[] = [];
+  for (const f of files) {
+    try {
+      const j = JSON.parse(readFileSync(join(dir, f), 'utf-8'));
+      if (j?.tool === 'outlier') audits.push(j);
+    } catch {}
+  }
+
+  const aiPcts = audits.map(a => a.authorship?.aiPercent).filter((x: any) => typeof x === 'number');
+  const spends = audits.map(a => a.cost?.estUsd || 0);
+  const blasts = audits.map(a => a.reach?.blastRadius).filter(Boolean);
+  const overs = audits.filter(a => a.policy?.status === 'over').length;
+  const writeDeploy = audits.reduce((s, a) => s + (a.reach?.writeOrDeployCount || 0), 0);
+
+  const worst = blasts.reduce((m: string, b: string) =>
+    BLAST_ORDER.indexOf(b) > BLAST_ORDER.indexOf(m) ? b : m, 'LOW');
+
+  const notes: string[] = [];
+  if (aiPcts.length && Math.max(...aiPcts) > 70) notes.push('At least one developer is over 70% AI authorship.');
+  if (worst === 'HIGH' || worst === 'CRITICAL') notes.push(`Worst-case agent blast radius across the team is ${worst}.`);
+  if (overs > 0) notes.push(`${overs} developer(s) over their AI-authorship limit.`);
+  if (audits.length === 0) notes.push('No outlier --json files found in this folder.');
+
+  return {
+    developers: audits.length,
+    avgAiPercent: aiPcts.length ? +(aiPcts.reduce((a: number, b: number) => a + b, 0) / aiPcts.length).toFixed(1) : null,
+    maxAiPercent: aiPcts.length ? Math.max(...aiPcts) : null,
+    totalEstUsd: +spends.reduce((a: number, b: number) => a + b, 0).toFixed(2),
+    worstBlastRadius: worst,
+    overLimit: overs,
+    reachWriteDeploy: writeDeploy,
+    notes,
+  };
+}

package/src/capabilities.ts

@@ -1,76 +1,121 @@
 import { homedir } from 'os';
 import { join } from 'path';
-import { existsSync, readdirSync } from 'fs';
+import { existsSync, readdirSync, readFileSync } from 'fs';
+
+// Reach = what a tool can actually do to you if an agent (or a prompt injection) drives it.
+export type Reach = 'read' | 'network' | 'model' | 'data' | 'write-local' | 'write-remote' | 'deploy' | 'exec' | 'money';
+
+export interface ToolReach {
+  name: string;
+  reach: Reach;
+}
+
+export type BlastRadius = 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL';
 
 export interface CapabilitiesStats {
-  mcps: string[];
+  mcps: ToolReach[];
   skills: string[];
+  subagents: number;
+  hooks: string[];        // lifecycle events with auto-firing hooks
   hasOrchestration: boolean;
+  blastRadius: BlastRadius;
+  blastReasons: string[]; // plain-language reasons for the score
+}
+
+// Classify an MCP/tool by name into a reach category. Keyword-based, since names vary.
+export function classifyReach(name: string): Reach {
+  const n = name.toLowerCase();
+  if (/(stripe|payment|infinity|kucoin|wallet|billing|payout)/.test(n)) return 'money';
+  if (/(shell|bash|exec|terminal|command|sandbox)/.test(n)) return 'exec';
+  if (/(cloudflare|vercel|netlify|modal|deploy|fly\.io|render|heroku|aws|gcp|azure)/.test(n)) return 'deploy';
+  if (/(github|gitlab|git|bitbucket)/.test(n)) return 'write-remote';
+  if (/(filesystem|file|fs|disk)/.test(n)) return 'write-local';
+  if (/(memory|supermemory|mem|obsidian|notion|airtable|coda|database|sql|store)/.test(n)) return 'data';
+  if (/(openrouter|ollama|openai|anthropic|llm|model|hugging)/.test(n)) return 'model';
+  if (/(exa|web|fetch|search|brave|browser|http|scrape)/.test(n)) return 'network';
+  return 'network'; // unknown tool: assume it can reach out
+}
+
+const REACH_RISK: Record<Reach, number> = {
+  read: 0, model: 1, network: 1, 'data': 2, 'write-local': 2, 'write-remote': 3, deploy: 3, exec: 4, money: 4,
+};
+
+function scoreBlast(reaches: Reach[]): { radius: BlastRadius; reasons: string[] } {
+  const reasons: string[] = [];
+  const has = (r: Reach) => reaches.includes(r);
+  if (has('money')) reasons.push('can move money');
+  if (has('exec')) reasons.push('can run shell commands');
+  if (has('deploy')) reasons.push('can deploy to production');
+  if (has('write-remote')) reasons.push('can push to your remote repos');
+  if (has('write-local')) reasons.push('can write your local files');
+  if (has('data')) reasons.push('can read/write your stored data');
+  const netCount = reaches.filter(r => r === 'network' || r === 'model').length;
+  if (netCount >= 3) reasons.push(`reaches ${netCount} external services`);
+
+  const max = reaches.reduce((m, r) => Math.max(m, REACH_RISK[r]), 0);
+  let radius: BlastRadius = 'LOW';
+  if (max >= 4) radius = 'CRITICAL';
+  else if (max >= 3) radius = 'HIGH';
+  else if (max >= 2) radius = 'MEDIUM';
+  return { radius, reasons };
+}
+
+function readJson(path: string): any {
+  try { return JSON.parse(readFileSync(path, 'utf-8')); } catch { return null; }
+}
+
+function countDir(path: string, ext = '.md'): number {
+  try { return readdirSync(path).filter(f => f.endsWith(ext)).length; } catch { return 0; }
 }
 
 export async function getCapabilitiesStats(repoPath: string = process.cwd(), homeDirPath: string = homedir()): Promise<CapabilitiesStats> {
-  const stats: CapabilitiesStats = {
-    mcps: [],
-    skills: [],
-    hasOrchestration: false
-  };
-
-  // Check for AGENTS.md (Orchestration Policy)
-  if (existsSync(join(repoPath, 'AGENTS.md'))) {
-    stats.hasOrchestration = true;
-  }
+  const mcpNames = new Set<string>();
 
-  // Scan local project skills
-  const projectSkillsPath = join(repoPath, '.agents', 'skills');
-  if (existsSync(projectSkillsPath)) {
-    try {
-      const skills = readdirSync(projectSkillsPath, { withFileTypes: true })
-        .filter(dirent => dirent.isDirectory())
-        .map(dirent => dirent.name);
-      stats.skills.push(...skills);
-    } catch (e) {}
+  // MCP servers — the agent's actual tool reach. Read from every place they live.
+  // Read MCP servers from every place agents declare them (Claude, Cursor, Gemini, project).
+  for (const cfg of [
+    join(homeDirPath, '.claude.json'),
+    join(homeDirPath, '.claude', 'settings.json'),
+    join(homeDirPath, '.cursor', 'mcp.json'),
+    join(homeDirPath, '.gemini', 'config', 'mcp_config.json'),
+    join(homeDirPath, '.gemini', 'settings.json'),
+    join(repoPath, '.mcp.json'),
+    join(repoPath, '.cursor', 'mcp.json'),
+    join(repoPath, '.claude', 'settings.json'),
+  ]) {
+    const j = readJson(cfg);
+    if (j?.mcpServers) Object.keys(j.mcpServers).forEach(k => mcpNames.add(k));
   }
-
-  // Scan global skills (Gemini / Claude)
-  const geminiSkillsPath = join(homeDirPath, '.gemini', 'skills');
-  if (existsSync(geminiSkillsPath)) {
-    try {
-      const skills = readdirSync(geminiSkillsPath, { withFileTypes: true })
-        .filter(dirent => dirent.isDirectory())
-        .map(dirent => dirent.name);
-      
-      // Only add if not already added (dedupe)
-      for (const skill of skills) {
-        if (!stats.skills.includes(skill)) stats.skills.push(skill);
-      }
-    } catch (e) {}
+  // Gemini-style MCP dir
+  const geminiMcp = join(homeDirPath, '.gemini', 'antigravity-cli', 'mcp');
+  if (existsSync(geminiMcp)) {
+    try { readdirSync(geminiMcp, { withFileTypes: true }).filter(d => d.isDirectory()).forEach(d => mcpNames.add(d.name)); } catch {}
   }
 
-  // Scan MCPs from gemini config
-  const geminiMcpPath = join(homeDirPath, '.gemini', 'antigravity-cli', 'mcp');
-  if (existsSync(geminiMcpPath)) {
-    try {
-      const mcps = readdirSync(geminiMcpPath, { withFileTypes: true })
-        .filter(dirent => dirent.isDirectory())
-        .map(dirent => dirent.name);
-      stats.mcps.push(...mcps);
-    } catch (e) {}
+  const mcps: ToolReach[] = [...mcpNames].map(name => ({ name, reach: classifyReach(name) }));
+
+  // Skills
+  const skills: string[] = [];
+  for (const p of [join(repoPath, '.agents', 'skills'), join(homeDirPath, '.claude', 'skills'), join(homeDirPath, '.gemini', 'skills')]) {
+    if (existsSync(p)) {
+      try { readdirSync(p, { withFileTypes: true }).filter(d => d.isDirectory()).forEach(d => { if (!skills.includes(d.name)) skills.push(d.name); }); } catch {}
+    }
   }
 
-  // Also check Claude settings for legacy MCPs/Plugins
-  const claudeSettingsPath = join(homeDirPath, '.claude', 'settings.json');
-  if (existsSync(claudeSettingsPath)) {
-    try {
-      const claudeSettings = require(claudeSettingsPath);
-      if (claudeSettings.enabledPlugins) {
-        Object.keys(claudeSettings.enabledPlugins).forEach(plugin => {
-          if (claudeSettings.enabledPlugins[plugin] && !stats.mcps.includes(plugin)) {
-            stats.mcps.push(`plugin:${plugin}`);
-          }
-        });
-      }
-    } catch (e) {}
+  // Sub-agents (Claude Code agent definitions)
+  const subagents = countDir(join(homeDirPath, '.claude', 'agents')) + countDir(join(repoPath, '.claude', 'agents'));
+
+  // Hooks — automation that fires on the developer's behalf (a real governance surface)
+  const hooks: string[] = [];
+  for (const cfg of [join(homeDirPath, '.claude', 'settings.json'), join(repoPath, '.claude', 'settings.json')]) {
+    const j = readJson(cfg);
+    if (j?.hooks) Object.keys(j.hooks).forEach(k => { if (!hooks.includes(k)) hooks.push(k); });
   }
 
-  return stats;
+  // Orchestration policy
+  const hasOrchestration = existsSync(join(repoPath, 'AGENTS.md')) || existsSync(join(repoPath, '.mcp.json'));
+
+  const { radius, reasons } = scoreBlast(mcps.map(m => m.reach));
+
+  return { mcps, skills, subagents, hooks, hasOrchestration, blastRadius: radius, blastReasons: reasons };
 }

package/src/carbon.ts

@@ -2,6 +2,8 @@ import { homedir } from 'os';
 import { join } from 'path';
 import { readFile, access, readdir } from 'fs/promises';
 import gridFactors from '../data/grid-factors.json';
+import { energyKwhByModel } from './emissions';
+import { detectSources, provLabel, type Provenance } from './sources';
 
 export interface CarbonStats {
   totalTokens: number;
@@ -13,12 +15,15 @@ export interface CarbonStats {
   localCo2Kg: number;
   localRegion: string;
   sessions: number;
-  estUsd: number;       // estimated spend in USD
-  costIsReal: boolean;  // true if summed from the log's own cost field, false if estimated from tokens
+  estUsd: number;          // estimated spend in USD
+  costIsReal: boolean;     // true if summed from the log's own cost field, false if estimated
+  tokenProvenance: Provenance;
+  carbonProvenance: Provenance;
+  sourceLabel: string;     // e.g. "estimated · Claude Code transcripts"
 }
 
 export interface TokenLogParser {
-  parse(): Promise<{ total: number, output: number, cache: number, sessions: number, cost: number }>;
+  parse(): Promise<{ total: number, output: number, cache: number, sessions: number, cost: number, outputByModel: Record<string, number> }>;
 }
 
 export class ClaudeLogParser implements TokenLogParser {
@@ -40,6 +45,7 @@ export class ClaudeLogParser implements TokenLogParser {
       if (files.length > 0) {
         let total = 0, output = 0, cache = 0;
         const sessions = new Set<string>();
+        const outputByModel: Record<string, number> = {};
         for (const file of files) {
           let text = '';
           try { text = await readFile(join(projectDir, file), 'utf-8'); } catch { continue; }
@@ -47,7 +53,8 @@ export class ClaudeLogParser implements TokenLogParser {
             if (!line.trim()) continue;
             try {
               const d = JSON.parse(line);
-              const u = (d.message && d.message.usage) || d.usage;
+              const msg = d.message || {};
+              const u = msg.usage || d.usage;
               if (u) {
                 const inp = u.input_tokens || 0;
                 const out = u.output_tokens || 0;
@@ -56,13 +63,15 @@ export class ClaudeLogParser implements TokenLogParser {
                 total += inp + out + cr + cw;
                 output += out;
                 cache += cr;
+                const model = msg.model || 'default';
+                outputByModel[model] = (outputByModel[model] || 0) + out;
               }
               if (d.sessionId) sessions.add(d.sessionId);
             } catch {}
           }
         }
         // Standard transcripts carry no cost field; cost is estimated downstream.
-        return { total, output, cache, sessions: sessions.size, cost: 0 };
+        return { total, output, cache, sessions: sessions.size, cost: 0, outputByModel };
       }
     } catch {}
 
@@ -72,11 +81,12 @@ export class ClaudeLogParser implements TokenLogParser {
     try {
       await access(logPath);
     } catch {
-      return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0 };
+      return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0, outputByModel: {} };
     }
     const text = await readFile(logPath, 'utf-8');
     let total = 0, output = 0, cache = 0, cost = 0;
     const sessions = new Set<string>();
+    const outputByModel: Record<string, number> = {};
     for (const line of text.split('\n')) {
       if (!line.trim()) continue;
       try {
@@ -86,15 +96,17 @@ export class ClaudeLogParser implements TokenLogParser {
         cache += data.cache_read || 0;
         cost += data.cost_usd || 0;
         if (data.session_id) sessions.add(data.session_id);
+        const model = data.model || 'default';
+        outputByModel[model] = (outputByModel[model] || 0) + (data.output_tokens || 0);
       } catch {}
     }
-    return { total, output, cache, sessions: sessions.size, cost };
+    return { total, output, cache, sessions: sessions.size, cost, outputByModel };
   }
 }
 
 class CursorLogParser implements TokenLogParser {
   async parse() {
-    return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0 };
+    return { total: 0, output: 0, cache: 0, sessions: 0, cost: 0, outputByModel: {} };
   }
 }
 
@@ -105,6 +117,33 @@ function estimateUsd(output: number, cacheRead: number, total: number): number {
   return (output / 1e6) * 9 + (cacheRead / 1e6) * 0.3 + (otherInput / 1e6) * 3;
 }
 
+// #6 CodeCarbon: if the developer runs CodeCarbon, it writes a real MEASURED
+// emissions.csv (hardware energy, not a token estimate). Read the latest run.
+// Columns (codecarbon >=2): timestamp,project_name,...,duration,emissions,...,energy_consumed,...
+function readCodeCarbon(cwd: string, home: string): { energyKwh: number; co2Kg: number } | null {
+  const { readFileSync, existsSync } = require('fs');
+  const { join } = require('path');
+  for (const p of [join(cwd, 'emissions.csv'), join(home, '.codecarbon', 'emissions.csv')]) {
+    try {
+      if (!existsSync(p)) continue;
+      const lines = readFileSync(p, 'utf-8').trim().split('\n');
+      if (lines.length < 2) continue;
+      const header = lines[0].split(',');
+      const iEm = header.indexOf('emissions');           // kg CO2eq
+      const iEn = header.indexOf('energy_consumed');      // kWh
+      if (iEm === -1 && iEn === -1) continue;
+      let co2 = 0, kwh = 0;
+      for (const row of lines.slice(1)) {
+        const cols = row.split(',');
+        co2 += parseFloat(cols[iEm]) || 0;
+        kwh += parseFloat(cols[iEn]) || 0;
+      }
+      return { energyKwh: kwh, co2Kg: co2 };
+    } catch {}
+  }
+  return null;
+}
+
 function getLocalGridFactor(): { region: string, factor: number } {
   try {
     const tz = Intl.DateTimeFormat().resolvedOptions().timeZone;
@@ -114,13 +153,14 @@ function getLocalGridFactor(): { region: string, factor: number } {
     if (tz.includes('Singapore')) return { region: 'Singapore', factor: gridFactors.singapore };
     if (tz.includes('Calcutta') || tz.includes('Kolkata') || tz.includes('Asia/Kabul')) return { region: 'India', factor: gridFactors.india_average };
   } catch (e) {}
-  return { region: 'Global Average', factor: 450 };
+  return { region: 'Global Average', factor: gridFactors.global_average };
 }
 
 export async function getCarbonStats(): Promise<CarbonStats> {
   const parsers: TokenLogParser[] = [new ClaudeLogParser(), new CursorLogParser()];
-  
+
   let totalTokens = 0, outputTokens = 0, cacheReadTokens = 0, sessions = 0, loggedCost = 0;
+  const outputByModel: Record<string, number> = {};
 
   for (const parser of parsers) {
     const stats = await parser.parse();
@@ -129,10 +169,19 @@ export async function getCarbonStats(): Promise<CarbonStats> {
     cacheReadTokens += stats.cache;
     sessions += stats.sessions;
     loggedCost += stats.cost;
+    for (const [m, out] of Object.entries(stats.outputByModel)) {
+      outputByModel[m] = (outputByModel[m] || 0) + out;
+    }
   }
 
-  const energyKwh = (outputTokens / 1_000_000) * 0.662;
+  // Carbon: prefer CodeCarbon's measured hardware data; else model-aware estimate.
   const localGrid = getLocalGridFactor();
+  const measured = readCodeCarbon(process.cwd(), homedir());
+  const energyKwh = measured ? measured.energyKwh : energyKwhByModel(outputByModel);
+  const measuredCo2 = measured ? measured.co2Kg : null;
+
+  // Source provenance for honest labelling in the UI.
+  const sources = detectSources();
 
   // Prefer the log's own cost field (accurate); fall back to a rough token estimate.
   const costIsReal = loggedCost > 0;
@@ -145,10 +194,13 @@ export async function getCarbonStats(): Promise<CarbonStats> {
     energyKwh,
     co2KgVietnam: (energyKwh * gridFactors.vietnam) / 1000,
     co2KgFrance: (energyKwh * gridFactors.france) / 1000,
-    localCo2Kg: (energyKwh * localGrid.factor) / 1000,
-    localRegion: localGrid.region,
+    localCo2Kg: measuredCo2 !== null ? measuredCo2 : (energyKwh * localGrid.factor) / 1000,
+    localRegion: measured ? 'CodeCarbon (measured)' : localGrid.region,
     sessions,
     estUsd,
-    costIsReal
+    costIsReal,
+    tokenProvenance: sources.tokenSource.provenance,
+    carbonProvenance: sources.carbonSource.provenance,
+    sourceLabel: provLabel(sources.tokenSource)
   };
 }