@sayknow-cli/stats 0.4.7 → 0.5.0

package/dist/types/client/api.d.ts

@@ -1,4 +1,9 @@
 import type { BehaviorDashboardStats, CostDashboardStats, DashboardStats, MessageStats, ModelDashboardStats, OverviewStats, RequestDetails } from "./types";
+interface SyncResponse {
+    processed: number;
+    files: number;
+    totalMessages: number;
+}
 export declare function getStats(range?: string): Promise<DashboardStats>;
 export declare function getOverviewStats(range?: string): Promise<OverviewStats>;
 export declare function getModelDashboardStats(range?: string): Promise<ModelDashboardStats>;
@@ -6,5 +11,6 @@ export declare function getCostDashboardStats(range?: string): Promise<CostDashb
 export declare function getRecentRequests(limit?: number): Promise<MessageStats[]>;
 export declare function getRecentErrors(limit?: number): Promise<MessageStats[]>;
 export declare function getRequestDetails(id: number): Promise<RequestDetails>;
-export declare function sync(): Promise<any>;
+export declare function sync(): Promise<SyncResponse>;
 export declare function getBehaviorDashboardStats(range?: string): Promise<BehaviorDashboardStats>;
+export {};

package/dist/types/compiled-client-assets.d.ts

@@ -0,0 +1,3 @@
+export declare function createCompiledClientAssetHandler(loadArchiveBytes: () => Uint8Array | null | Promise<Uint8Array | null>): {
+    response(requestPath: string): Promise<Response>;
+};

package/dist/types/server.d.ts

@@ -1,7 +1,18 @@
+import type { DashboardStats } from "./types";
+interface SyncResult {
+    processed: number;
+    files: number;
+}
+export interface StatsServerOptions {
+    getDashboardStats?: (range?: string | null) => Promise<DashboardStats>;
+    syncAllSessions?: () => Promise<SyncResult>;
+    getTotalMessageCount?: () => Promise<number>;
+}
 /**
  * Start the HTTP server.
  */
-export declare function startServer(port?: number): Promise<{
+export declare function startServer(port?: number, options?: StatsServerOptions): Promise<{
     port: number;
     stop: () => void;
 }>;
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/stats",
-	"version": "0.4.7",
+	"version": "0.5.0",
 	"description": "Local observability dashboard for pi AI usage statistics",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -30,6 +30,7 @@
 	"scripts": {
 		"build": "bun run build.ts",
 		"dev": "bun run src/index.ts",
+		"test": "bun test",
 		"check": "biome check . && bun run check:types",
 		"check:types": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
 		"lint": "biome lint .",
@@ -37,8 +38,8 @@
 		"fmt": "biome format --write ."
 	},
 	"dependencies": {
-		"@sayknow-cli/ai": "0.4.7",
-		"@sayknow-cli/utils": "0.4.7",
+		"@sayknow-cli/ai": "0.5.0",
+		"@sayknow-cli/utils": "0.5.0",
 		"@tailwindcss/node": "^4.2.4",
 		"chart.js": "^4.5.1",
 		"date-fns": "^4.1.0",

package/src/client/api.ts

@@ -10,6 +10,12 @@ import type {
 
 const API_BASE = "/api";
 
+interface SyncResponse {
+	processed: number;
+	files: number;
+	totalMessages: number;
+}
+
 export async function getStats(range = "24h"): Promise<DashboardStats> {
 	const res = await fetch(`${API_BASE}/stats?range=${encodeURIComponent(range)}`);
 	if (!res.ok) throw new Error("Failed to fetch stats");
@@ -52,10 +58,10 @@ export async function getRequestDetails(id: number): Promise<RequestDetails> {
 	return res.json() as Promise<RequestDetails>;
 }
 
-export async function sync(): Promise<any> {
-	const res = await fetch(`${API_BASE}/sync`);
+export async function sync(): Promise<SyncResponse> {
+	const res = await fetch(`${API_BASE}/sync`, { method: "POST" });
 	if (!res.ok) throw new Error("Failed to sync");
-	return res.json();
+	return res.json() as Promise<SyncResponse>;
 }
 
 export async function getBehaviorDashboardStats(range = "24h"): Promise<BehaviorDashboardStats> {

package/src/compiled-client-assets.ts

@@ -0,0 +1,96 @@
+import * as path from "node:path";
+
+const INDEX_ASSET = "index.html";
+const UNSAFE_ARCHIVE_NAME = /[\u0000-\u001f\u007f%?#]/u;
+const WINDOWS_ABSOLUTE_PATH = /^[a-zA-Z]:\//;
+
+const CONTENT_TYPES: Readonly<Record<string, string>> = Object.freeze({
+	".css": "text/css; charset=utf-8",
+	".gif": "image/gif",
+	".html": "text/html; charset=utf-8",
+	".ico": "image/x-icon",
+	".jpeg": "image/jpeg",
+	".jpg": "image/jpeg",
+	".js": "text/javascript; charset=utf-8",
+	".json": "application/json; charset=utf-8",
+	".map": "application/json; charset=utf-8",
+	".png": "image/png",
+	".svg": "image/svg+xml",
+	".ttf": "font/ttf",
+	".webp": "image/webp",
+	".woff": "font/woff",
+	".woff2": "font/woff2",
+});
+
+function normalizeArchiveName(archiveName: string): string {
+	const normalized = archiveName.normalize("NFC");
+	const segments = normalized.split("/");
+	if (
+		!normalized ||
+		normalized.startsWith("/") ||
+		WINDOWS_ABSOLUTE_PATH.test(normalized) ||
+		normalized.includes("\\") ||
+		UNSAFE_ARCHIVE_NAME.test(normalized) ||
+		segments.some(segment => !segment || segment === "." || segment === "..")
+	) {
+		throw new Error(`Unsafe compiled stats client archive entry: ${JSON.stringify(archiveName)}`);
+	}
+	return normalized;
+}
+
+function contentType(assetName: string): string {
+	return CONTENT_TYPES[path.posix.extname(assetName).toLowerCase()] ?? "application/octet-stream";
+}
+
+async function parseArchive(archiveBytes: Uint8Array): Promise<ReadonlyMap<string, Blob>> {
+	const files = await new Bun.Archive(archiveBytes).files();
+	const assets = new Map<string, Blob>();
+	for (const [archiveName, file] of files) {
+		const assetName = normalizeArchiveName(archiveName);
+		if (assets.has(assetName)) {
+			throw new Error(`Duplicate compiled stats client archive entry: ${JSON.stringify(assetName)}`);
+		}
+		assets.set(assetName, new Blob([file], { type: contentType(assetName) }));
+	}
+	if (!assets.has(INDEX_ASSET)) {
+		throw new Error("Compiled stats client archive is missing index.html");
+	}
+	return assets;
+}
+
+function responseForPath(assets: ReadonlyMap<string, Blob>, requestPath: string): Response {
+	const assetName = requestPath === "/" ? INDEX_ASSET : requestPath.replace(/^\//, "");
+	const asset = assets.get(assetName);
+	if (asset) return new Response(asset);
+	return new Response(assets.get(INDEX_ASSET));
+}
+
+export function createCompiledClientAssetHandler(
+	loadArchiveBytes: () => Uint8Array | null | Promise<Uint8Array | null>,
+): { response(requestPath: string): Promise<Response> } {
+	let initialization: Promise<ReadonlyMap<string, Blob>> | null = null;
+
+	async function getAssets(): Promise<ReadonlyMap<string, Blob>> {
+		if (initialization) return await initialization;
+		const attempt = (async () => {
+			const archiveBytes = await loadArchiveBytes();
+			if (!archiveBytes) {
+				throw new Error("Compiled stats client bundle missing. Rebuild binary with embedded stats assets.");
+			}
+			return await parseArchive(archiveBytes);
+		})();
+		initialization = attempt;
+		try {
+			return await attempt;
+		} catch (error) {
+			if (initialization === attempt) initialization = null;
+			throw error;
+		}
+	}
+
+	return {
+		async response(requestPath) {
+			return responseForPath(await getAssets(), requestPath);
+		},
+	};
+}

package/src/server.ts

@@ -1,5 +1,4 @@
 import * as fs from "node:fs/promises";
-import * as os from "node:os";
 import * as path from "node:path";
 import { $ } from "bun";
 import {
@@ -14,7 +13,9 @@ import {
 	getTotalMessageCount,
 	syncAllSessions,
 } from "./aggregator";
+import { createCompiledClientAssetHandler } from "./compiled-client-assets";
 import embeddedClientArchiveTxt from "./embedded-client.generated.txt";
+import type { DashboardStats } from "./types";
 
 const getEmbeddedClientArchive = (() => {
 	const txt = embeddedClientArchiveTxt.replaceAll(/[\s\r\n]/g, "").trim();
@@ -29,58 +30,24 @@ const IS_BUN_COMPILED =
 	import.meta.url.includes("$bunfs") ||
 	import.meta.url.includes("~BUN") ||
 	import.meta.url.includes("%7EBUN");
+const compiledClientAssets = createCompiledClientAssetHandler(() => getEmbeddedClientArchive?.() ?? null);
 
-const COMPILED_CLIENT_DIR_ROOT = path.join(os.tmpdir(), "skc-stats-client");
-let compiledClientDirPromise: Promise<string> | null = null;
-
-function sanitizeArchivePath(archivePath: string): string | null {
-	const normalized = archivePath.replaceAll("\\", "/").replace(/^\.\//, "");
-	if (!normalized || normalized === ".") return null;
-	if (normalized.includes("..") || path.isAbsolute(normalized)) return null;
-	return normalized;
+interface SyncResult {
+	processed: number;
+	files: number;
 }
 
-async function extractEmbeddedClientArchive(archiveBytes: Buffer, outputDir: string): Promise<void> {
-	const archive = new Bun.Archive(archiveBytes);
-	const files = await archive.files();
-	const extractRoot = path.resolve(outputDir);
-
-	for (const [archivePath, file] of files) {
-		const sanitizedPath = sanitizeArchivePath(archivePath);
-		if (!sanitizedPath) continue;
-		const destinationPath = path.resolve(extractRoot, sanitizedPath);
-		if (!destinationPath.startsWith(extractRoot + path.sep)) {
-			throw new Error(`Archive entry escapes extraction directory: ${archivePath}`);
-		}
-		await Bun.write(destinationPath, file);
-	}
+export interface StatsServerOptions {
+	getDashboardStats?: (range?: string | null) => Promise<DashboardStats>;
+	syncAllSessions?: () => Promise<SyncResult>;
+	getTotalMessageCount?: () => Promise<number>;
 }
 
-async function getCompiledClientDir(): Promise<string> {
-	if (!IS_BUN_COMPILED) return STATIC_DIR;
-	if (compiledClientDirPromise) return compiledClientDirPromise;
-
-	const archiveBytes = getEmbeddedClientArchive?.();
-	if (!archiveBytes) {
-		throw new Error("Compiled stats client bundle missing. Rebuild binary with embedded stats assets.");
-	}
-
-	compiledClientDirPromise = (async () => {
-		const bundleHash = Bun.hash(archiveBytes).toString(16);
-		const outputDir = path.join(COMPILED_CLIENT_DIR_ROOT, bundleHash);
-		const markerPath = path.join(outputDir, "index.html");
-		try {
-			const marker = await fs.stat(markerPath);
-			if (marker.isFile()) return outputDir;
-		} catch {}
-
-		await fs.rm(outputDir, { recursive: true, force: true });
-		await fs.mkdir(outputDir, { recursive: true });
-		await extractEmbeddedClientArchive(archiveBytes, outputDir);
-		return outputDir;
-	})();
-
-	return compiledClientDirPromise;
+interface ApiContext {
+	getDashboardStats: (range?: string | null) => Promise<DashboardStats>;
+	syncAllSessions: () => Promise<SyncResult>;
+	getTotalMessageCount: () => Promise<number>;
+	syncInProgress: boolean;
 }
 
 async function getLatestMtime(dir: string): Promise<number> {
@@ -167,7 +134,7 @@ const ensureClientBuild = async () => {
 /**
  * Handle API requests.
  */
-async function handleApi(req: Request): Promise<Response> {
+async function handleApi(req: Request, context: ApiContext): Promise<Response> {
 	const url = new URL(req.url);
 	const path = url.pathname;
 
@@ -175,7 +142,7 @@ async function handleApi(req: Request): Promise<Response> {
 	const range = url.searchParams.get("range");
 
 	if (path === "/api/stats") {
-		const stats = await getDashboardStats(range);
+		const stats = await context.getDashboardStats(range);
 		return Response.json(stats);
 	}
 
@@ -212,17 +179,17 @@ async function handleApi(req: Request): Promise<Response> {
 	}
 
 	if (path === "/api/stats/models") {
-		const stats = await getDashboardStats(range);
+		const stats = await context.getDashboardStats(range);
 		return Response.json(stats.byModel);
 	}
 
 	if (path === "/api/stats/folders") {
-		const stats = await getDashboardStats(range);
+		const stats = await context.getDashboardStats(range);
 		return Response.json(stats.byFolder);
 	}
 
 	if (path === "/api/stats/timeseries") {
-		const stats = await getDashboardStats(range);
+		const stats = await context.getDashboardStats(range);
 		return Response.json(stats.timeSeries);
 	}
 
@@ -235,21 +202,70 @@ async function handleApi(req: Request): Promise<Response> {
 	}
 
 	if (path === "/api/sync") {
-		const result = await syncAllSessions();
-		const count = await getTotalMessageCount();
-		return Response.json({ ...result, totalMessages: count });
+		if (context.syncInProgress) {
+			return Response.json({ error: "Sync already in progress" }, { status: 409 });
+		}
+		context.syncInProgress = true;
+		try {
+			const result = await context.syncAllSessions();
+			const count = await context.getTotalMessageCount();
+			return Response.json({ ...result, totalMessages: count });
+		} finally {
+			context.syncInProgress = false;
+		}
 	}
 
 	return new Response("Not Found", { status: 404 });
 }
 
+function forbidden(): Response {
+	return new Response("Forbidden", { status: 403 });
+}
+
+function methodNotAllowed(allowedMethod: "GET" | "POST"): Response {
+	return new Response("Method Not Allowed", { status: 405, headers: { Allow: allowedMethod } });
+}
+
+function validateApiRequest(req: Request, url: URL, boundPort: number): Response | null {
+	const authority = req.headers.get("Host");
+	const allowedAuthorities =
+		boundPort === 80
+			? new Set(["localhost", "localhost:80", "127.0.0.1", "127.0.0.1:80"])
+			: new Set([`localhost:${boundPort}`, `127.0.0.1:${boundPort}`]);
+	if (!authority || !allowedAuthorities.has(authority)) return forbidden();
+
+	if (url.protocol !== "http:" || (url.hostname !== "localhost" && url.hostname !== "127.0.0.1")) {
+		return forbidden();
+	}
+
+	const requestPort = url.port ? Number.parseInt(url.port, 10) : 80;
+	if (requestPort !== boundPort) return forbidden();
+
+	const origin = req.headers.get("Origin");
+	if (origin !== null) {
+		try {
+			const parsedOrigin = new URL(origin);
+			if (parsedOrigin.origin !== origin || origin !== url.origin) return forbidden();
+		} catch {
+			return forbidden();
+		}
+	}
+
+	const allowedMethod = url.pathname === "/api/sync" ? "POST" : "GET";
+	if (req.method !== allowedMethod) return methodNotAllowed(allowedMethod);
+	if (url.pathname === "/api/sync" && origin === null) return forbidden();
+
+	return null;
+}
+
 /**
  * Handle static file requests.
  */
 async function handleStatic(requestPath: string): Promise<Response> {
-	const staticDir = IS_BUN_COMPILED ? await getCompiledClientDir() : STATIC_DIR;
+	if (IS_BUN_COMPILED) return await compiledClientAssets.response(requestPath);
+
 	const filePath = requestPath === "/" ? "/index.html" : requestPath;
-	const fullPath = path.join(staticDir, filePath);
+	const fullPath = path.join(STATIC_DIR, filePath);
 
 	const file = Bun.file(fullPath);
 	if (await file.exists()) {
@@ -257,7 +273,7 @@ async function handleStatic(requestPath: string): Promise<Response> {
 	}
 
 	// SPA fallback
-	const index = Bun.file(path.join(staticDir, "index.html"));
+	const index = Bun.file(path.join(STATIC_DIR, "index.html"));
 	if (await index.exists()) {
 		return new Response(index);
 	}
@@ -268,52 +284,43 @@ async function handleStatic(requestPath: string): Promise<Response> {
 /**
  * Start the HTTP server.
  */
-export async function startServer(port = 3847): Promise<{ port: number; stop: () => void }> {
+export async function startServer(
+	port = 3847,
+	options: StatsServerOptions = {},
+): Promise<{ port: number; stop: () => void }> {
 	await ensureClientBuild();
+	const apiContext: ApiContext = {
+		getDashboardStats: options.getDashboardStats ?? getDashboardStats,
+		syncAllSessions: options.syncAllSessions ?? syncAllSessions,
+		getTotalMessageCount: options.getTotalMessageCount ?? getTotalMessageCount,
+		syncInProgress: false,
+	};
 
 	const server = Bun.serve({
 		hostname: "127.0.0.1",
 		port,
 		async fetch(req) {
-			const url = new URL(req.url);
+			let url: URL;
+			try {
+				url = new URL(req.url);
+			} catch {
+				return forbidden();
+			}
 			const path = url.pathname;
 
-			// CORS headers for local development
-			const corsHeaders = {
-				"Access-Control-Allow-Origin": "*",
-				"Access-Control-Allow-Methods": "GET, POST, OPTIONS",
-				"Access-Control-Allow-Headers": "Content-Type",
-			};
-
-			if (req.method === "OPTIONS") {
-				return new Response(null, { headers: corsHeaders });
+			if (path.startsWith("/api/")) {
+				const policyResponse = validateApiRequest(req, url, server.port ?? port);
+				if (policyResponse) return policyResponse;
 			}
 
 			try {
-				let response: Response;
-
 				if (path.startsWith("/api/")) {
-					response = await handleApi(req);
-				} else {
-					response = await handleStatic(path);
-				}
-
-				// Add CORS headers to all responses
-				const headers = new Headers(response.headers);
-				for (const [key, value] of Object.entries(corsHeaders)) {
-					headers.set(key, value);
+					return await handleApi(req, apiContext);
 				}
-
-				return new Response(response.body, {
-					status: response.status,
-					headers,
-				});
+				return await handleStatic(path);
 			} catch (error) {
 				console.error("Server error:", error);
-				return Response.json(
-					{ error: error instanceof Error ? error.message : "Unknown error" },
-					{ status: 500, headers: corsHeaders },
-				);
+				return Response.json({ error: error instanceof Error ? error.message : "Unknown error" }, { status: 500 });
 			}
 		},
 	});