@subvalue/cli 0.1.3 → 0.1.4

package/PRE_RELEASE.md

@@ -6,13 +6,13 @@ The normal installation command is `npx @subvalue/cli`. These instructions valid
 
 Install Node.js **24.13 or newer** on Windows, macOS or Linux. Check `node --version`.
 
-With access to the private repository, open the latest successful [Validate run](https://github.com/axelmtn/subvalue/actions/workflows/ci.yml). Download its `subvalue-cli-…` artifact and unzip it. Only `subvalue-cli-0.1.2.tgz` should be inside. The artifact expires after 14 days; a new Validate run regenerates it.
+With repository access, open the latest successful [Validate run](https://github.com/axelmtn/subvalue/actions/workflows/ci.yml). Download its `subvalue-cli-…` artifact and unzip it. Only one `subvalue-cli-<version>.tgz` should be inside. The artifact expires after 14 days; a new Validate run regenerates it.
 
-Put the `.tgz` in a new folder outside any repository. Open a terminal in that folder.
+Put the `.tgz` in a new folder outside any repository. Rename this test copy to `subvalue-cli.tgz` and open a terminal in that folder. The commands below work for any package version.
 
 ```sh
-npx --offline --yes --package ./subvalue-cli-0.1.2.tgz subvalue --dry-run
-npx --offline --yes --package ./subvalue-cli-0.1.2.tgz subvalue
+npx --offline --yes --package ./subvalue-cli.tgz subvalue --dry-run
+npx --offline --yes --package ./subvalue-cli.tgz subvalue
 ```
 
 The first command checks detection without reading session contents. The second scans real local usage, opens the browser, and serves only `127.0.0.1`. A different loopback port is selected if 4731 is occupied. No demo data is injected.
@@ -29,7 +29,7 @@ The first command checks detection without reading session contents. The second
 For scan timings and cache counts:
 
 ```sh
-npx --offline --yes --package ./subvalue-cli-0.1.2.tgz subvalue --verbose
+npx --offline --yes --package ./subvalue-cli.tgz subvalue --verbose
 ```
 
 Default metadata storage:
@@ -40,7 +40,7 @@ Default metadata storage:
 
 Do not send source logs, databases, credentials or conversation content when reporting a problem. Report the OS, Node version, safe error text, scan timing and cache counts. Review screenshots before sharing them.
 
-## Build from the private checkout
+## Build from source
 
 ```sh
 npm ci --ignore-scripts --no-audit --no-fund

package/README.md

@@ -11,12 +11,14 @@ npx @subvalue/cli --dry-run
 npx @subvalue/cli
 ```
 
-The source repository is currently private. For optional installation from a local package, see [Package validation](PRE_RELEASE.md).
+For optional installation from a local package, see [Package validation](PRE_RELEASE.md).
 
 ## Run locally
 
 Requires **Node.js 24.13 or newer**. Runtime and production build have no external dependencies.
 
+For development, install dependencies with `npm ci --ignore-scripts`. Run `npm run check` for formatting, TypeScript, ESLint, build and unit/integration tests, then `npm run test:e2e` for browser and receipt-export checks. `npm run format` applies the shared format; CI rejects formatting drift on Windows, Linux and macOS.
+
 ```sh
 npm run build
 npm start -- --dry-run
@@ -107,7 +109,7 @@ Browser validation uses an isolated headless browser with fixture data. Windows
 
 GitHub Actions validates Windows, Linux, and macOS on both Apple Silicon and Intel. Each runner checks types, lint, build, unit/integration tests, responsive browser pages, receipt PNG export, and the locally packed CLI from a temporary directory outside the checkout. The package requires Node.js 24.13 or newer on each platform.
 
-Static landing output is `apps/web/dist`, suitable for a static host including Vercel. It contains no local API server or user data. Its preview is marked as an example. Public GitHub links remain release placeholders while the repository is private.
+Static landing output is `apps/web/dist`, suitable for a static host including Vercel. It contains no local API server or user data. Its preview is marked as an example. The source repository is public at [github.com/axelmtn/subvalue](https://github.com/axelmtn/subvalue).
 
 ## Package / release
 
@@ -118,4 +120,4 @@ npm pack --workspace @subvalue/cli --ignore-scripts --pack-destination artifacts
 
 Package contents are allowlisted to `dist/`, README, PRE_RELEASE, PRIVACY, and LICENSE. No lifecycle/postinstall scripts or runtime dependencies. Local databases, exports, attachments and test artifacts are ignored by Git and excluded from npm contents.
 
-The initial npm release is published manually from the audited package. The GitHub repository stays private. npm does not support provenance for private source repositories; no provenance attestation is claimed for this release. The future release workflow remains disabled until trusted publishing is configured and `NPM_PUBLISH_ENABLED=true` is set. It uses a protected environment and OIDC rather than a permanent npm token.
+Manual npm releases use the audited package and do not claim a provenance attestation. The source repository is public. The future release workflow remains disabled until trusted publishing is configured and `NPM_PUBLISH_ENABLED=true` is set. It uses a protected environment and OIDC rather than a permanent npm token.

package/dist/PRICING.md

@@ -2,21 +2,21 @@
 
 USD per million tokens, standard first-party API equivalent. Exact public model IDs only. A mapping's HIGH confidence describes identity, not completeness of retained history. This catalog is bundled and makes no network requests.
 
-| Model | Effective date | Input / cached input / output | Evidence |
-|---|---|---|---|
-| GPT-5.6 Sol | 2026-07-09 | 5 / 0.50 / 30 | [Launch](https://openai.com/index/gpt-5-6/) |
-| GPT-5.6 Sol | 2026-08-21 | 4 / 0.40 / 20 | [API changelog, Aug 21](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-5.6-sol) |
-| GPT-5.6 Luna | 2026-07-09 | 1 / 0.10 / 6 | [Launch](https://openai.com/index/gpt-5-6/) |
-| GPT-5.6 Luna | 2026-07-30 | 0.20 / 0.02 / 1.20 | [Price change](https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/), [model](https://developers.openai.com/api/docs/models/gpt-5.6-luna) |
-| GPT-6 Astra | 2026-09-03 | 10 / 1 / 50 | [API changelog](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-6-astra) |
-| GPT-6 Sol | 2026-09-22 | 2 / 0.20 / 10 | [API changelog, Sep 22](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-6-sol) |
-| GPT-6 Luna | 2026-09-22 | 0.10 / 0.01 / 0.50 | [API changelog, Sep 22](https://developers.openai.com/api/docs/changelog) |
-| GPT-6.1 Sol | 2026-09-29 | 2 / 0.10 / 10 | [API changelog, Sep 29](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-6.1-sol) |
-| Claude Fable 5 | 2026-06-09; restored 2026-07-01 | 10 / 1 / 50 | [Announcement, including suspension](https://www.anthropic.com/news/claude-fable-5-mythos-5), [release notes](https://platform.claude.com/docs/en/release-notes/overview) |
-| Claude Opus 4.8 | 2026-05-28 | 5 / 0.50 / 25 | [Announcement](https://www.anthropic.com/news/claude-opus-4-8) |
-| Claude Opus 5 | 2026-07-24 | 5 / 0.50 / 25 | [Announcement](https://www.anthropic.com/news/claude-opus-5) |
-| Claude Opus 4.7 / 4.6 / 4.5 | 2026-04-16 / 2026-02-05 / 2025-11-24 | 5 / 0.50 / 25 | [4.7](https://www.anthropic.com/news/claude-opus-4-7), [4.6](https://www.anthropic.com/news/claude-opus-4-6), [4.5](https://www.anthropic.com/news/claude-opus-4-5) |
-| Claude Sonnet 4.5 / 4.6 | 2025-09-29 / 2026-02-17 | 3 / 0.30 / 15 | [4.5](https://www.anthropic.com/news/claude-sonnet-4-5), [4.6](https://www.anthropic.com/news/claude-sonnet-4-6) |
+| Model                       | Effective date                       | Input / cached input / output | Evidence                                                                                                                                                                  |
+| --------------------------- | ------------------------------------ | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| GPT-5.6 Sol                 | 2026-07-09                           | 5 / 0.50 / 30                 | [Launch](https://openai.com/index/gpt-5-6/)                                                                                                                               |
+| GPT-5.6 Sol                 | 2026-08-21                           | 4 / 0.40 / 20                 | [API changelog, Aug 21](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-5.6-sol)                             |
+| GPT-5.6 Luna                | 2026-07-09                           | 1 / 0.10 / 6                  | [Launch](https://openai.com/index/gpt-5-6/)                                                                                                                               |
+| GPT-5.6 Luna                | 2026-07-30                           | 0.20 / 0.02 / 1.20            | [Price change](https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/), [model](https://developers.openai.com/api/docs/models/gpt-5.6-luna)      |
+| GPT-6 Astra                 | 2026-09-03                           | 10 / 1 / 50                   | [API changelog](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-6-astra)                                     |
+| GPT-6 Sol                   | 2026-09-22                           | 2 / 0.20 / 10                 | [API changelog, Sep 22](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-6-sol)                               |
+| GPT-6 Luna                  | 2026-09-22                           | 0.10 / 0.01 / 0.50            | [API changelog, Sep 22](https://developers.openai.com/api/docs/changelog)                                                                                                 |
+| GPT-6.1 Sol                 | 2026-09-29                           | 2 / 0.10 / 10                 | [API changelog, Sep 29](https://developers.openai.com/api/docs/changelog), [model](https://developers.openai.com/api/docs/models/gpt-6.1-sol)                             |
+| Claude Fable 5              | 2026-06-09; restored 2026-07-01      | 10 / 1 / 50                   | [Announcement, including suspension](https://www.anthropic.com/news/claude-fable-5-mythos-5), [release notes](https://platform.claude.com/docs/en/release-notes/overview) |
+| Claude Opus 4.8             | 2026-05-28                           | 5 / 0.50 / 25                 | [Announcement](https://www.anthropic.com/news/claude-opus-4-8)                                                                                                            |
+| Claude Opus 5               | 2026-07-24                           | 5 / 0.50 / 25                 | [Announcement](https://www.anthropic.com/news/claude-opus-5)                                                                                                              |
+| Claude Opus 4.7 / 4.6 / 4.5 | 2026-04-16 / 2026-02-05 / 2025-11-24 | 5 / 0.50 / 25                 | [4.7](https://www.anthropic.com/news/claude-opus-4-7), [4.6](https://www.anthropic.com/news/claude-opus-4-6), [4.5](https://www.anthropic.com/news/claude-opus-4-5)       |
+| Claude Sonnet 4.5 / 4.6     | 2025-09-29 / 2026-02-17              | 3 / 0.30 / 15                 | [4.5](https://www.anthropic.com/news/claude-sonnet-4-5), [4.6](https://www.anthropic.com/news/claude-sonnet-4-6)                                                          |
 
 Cache policy: [OpenAI](https://developers.openai.com/api/docs/guides/prompt-caching), [Claude](https://platform.claude.com/docs/en/about-claude/pricing). OpenAI cache writes replace the ordinary input rate, at 1.25× input; cached input and writes are subsets of reported input. Claude input, cache read and cache creation are separate. Claude writes cost 1.25× (5m) or 2× (1h) input. Unknown durations stay unavailable.
 
@@ -28,7 +28,6 @@ A new model has one documented initial rate: launch-day API-equivalent estimates
 
 `codex-auto-review`, unknown aliases, nonstandard tiers/speeds and server tool charges remain unavailable. No inferred subscription billing, regional surcharge, discounts, batch rate or tax. These are standard API-equivalent estimates, not reconstructed invoices.
 
-
 ## Catalog completeness audit — October 5, 2026
 
 The [OpenAI standard text/code pricing table](https://developers.openai.com/api/docs/pricing) was checked in full, including its embedded table data: all 40 rows have matching input, cached-input, cache-write (where published), and output rates. A separate checked fixture verifies every row. Six additional older Codex models are covered from their individual official model pages: GPT-5-Codex, GPT-5.1-Codex, GPT-5.1-Codex-Max, GPT-5.1-Codex-Mini, GPT-5.2-Codex and Codex-Mini-Latest. GPT-5.3-Codex, GPT-5.6-Cyber and Chat-Latest are also explicitly covered. Older/current-only snapshots start October 5; current prices are never silently backdated to unverified historical periods. No prefix-based or invented snapshot aliases.

package/dist/packages/cli/src/index.js

@@ -1,24 +1,113 @@
 #!/usr/bin/env node
 import path from 'node:path';
-import {fileURLToPath} from 'node:url';
-import {dataDirectory,openBrowser} from './runtime.js';
-import {detectedProviders,sourceRoots} from '../../core/src/security.js';
-                                                     
-import {scan} from '../../core/src/scanner.js';
-import {startServer} from './server.js';
-const argv=process.argv.slice(2);const allowed=new Set(['--dry-run','--demo','--no-open','--scan-only','--help','--port','--data-dir','--verbose']);
-function value(flag       )                 {const i=argv.indexOf(flag);return i<0?undefined:argv[i+1];}
-async function main(){
-  for(let i=0;i<argv.length;i++){if(!allowed.has(argv[i]))throw new Error('Unknown option. Use --help.');if(['--port','--data-dir'].includes(argv[i])){if(!argv[i+1]||argv[i+1].startsWith('--'))throw new Error('Option requires a value');i++;}}
-  if(argv.includes('--help')){console.log('SubValue\n\nsubvalue [--dry-run] [--no-open] [--scan-only] [--verbose] [--port 4731] [--data-dir DIRECTORY]\nsubvalue --demo\n\nRequires Node.js 24.13+. No account or API keys.');return;}
-  if(argv.includes('--dry-run')){const d=detectedProviders();console.log(`Codex       ${d.codex?'Detected':'Not detected'}\nClaude Code ${d.claude?'Detected':'Not detected'}\n\nSources:`);for(const r of sourceRoots())console.log(r.safeLabel);return;}
-  const demo=argv.includes('--demo');const port=Number(value('--port')??4731);if(!Number.isInteger(port)||port<0||port>65535)throw new Error('Invalid port');
-  let store                ;
+import { fileURLToPath } from 'node:url';
+import { dataDirectory, openBrowser } from './runtime.js';
+import { detectedProviders, sourceRoots } from '../../core/src/security.js';
+                                                       
+import { scan } from '../../core/src/scanner.js';
+import { startServer } from './server.js';
+const argv = process.argv.slice(2);
+const allowed = new Set([
+  '--dry-run',
+  '--demo',
+  '--no-open',
+  '--scan-only',
+  '--help',
+  '--port',
+  '--data-dir',
+  '--verbose',
+]);
+function value(flag        )                     {
+  const i = argv.indexOf(flag);
+  return i < 0 ? undefined : argv[i + 1];
+}
+async function main() {
+  for (let i = 0; i < argv.length; i++) {
+    if (!allowed.has(argv[i])) throw new Error('Unknown option. Use --help.');
+    if (['--port', '--data-dir'].includes(argv[i])) {
+      if (!argv[i + 1] || argv[i + 1].startsWith('--')) throw new Error('Option requires a value');
+      i++;
+    }
+  }
+  if (argv.includes('--help')) {
+    console.log(
+      'SubValue\n\nsubvalue [--dry-run] [--no-open] [--scan-only] [--verbose] [--port 4731] [--data-dir DIRECTORY]\nsubvalue --demo\n\nRequires Node.js 24.13+. No account or API keys.',
+    );
+    return;
+  }
+  if (argv.includes('--dry-run')) {
+    const d = detectedProviders();
+    console.log(
+      `Codex       ${d.codex ? 'Detected' : 'Not detected'}\nClaude Code ${d.claude ? 'Detected' : 'Not detected'}\n\nSources:`,
+    );
+    for (const r of sourceRoots()) console.log(r.safeLabel);
+    return;
+  }
+  const demo = argv.includes('--demo');
+  const port = Number(value('--port') ?? 4731);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw new Error('Invalid port');
+  let store                   ;
   console.log('SubValue\n');
-  if(!demo){const {Store}=await import('../../core/src/storage.js');store=new Store(value('--data-dir')??dataDirectory());let last=0;const verbose=argv.includes('--verbose');const started=Date.now();console.log('Scanning local usage…');const result=await scan(store,{onProgress:p=>{if(Date.now()-last>1000||p.phase==='complete'){last=Date.now();const text=`${p.provider}: ${p.files}/${p.total} files · ${Math.round(p.bytes/1e6)} MB`;if(verbose)console.log(text);else if(process.stdout.isTTY)process.stdout.write(`\r${text.padEnd(65)}`);}}});if(!verbose&&process.stdout.isTTY)process.stdout.write('\r'+' '.repeat(65)+'\r');for(const s of result)console.log(`${s.provider==='codex'?'Codex      ':'Claude Code'} ${s.diagnostics.records?'✓':s.detected?'No usage found':'Not detected'}`);if(verbose)console.log(`${((Date.now()-started)/1000).toFixed(1)}s · ${result.reduce((n,s)=>n+s.cached,0)} files cached`);if(argv.includes('--scan-only')){store.close();return;}}
-  const running=await startServer({store,port,publicDirectory:path.resolve(path.dirname(fileURLToPath(import.meta.url)),'../../../public'),demo}).catch(e=>{store?.close();throw e;});
-  let closing=false;const close=async()=>{if(closing)return;closing=true;await running.close();store?.close();process.exit(0);};process.on('SIGINT',()=>void close());process.on('SIGTERM',()=>void close());
-  if(demo)console.log('DEMO — fixture data');
-  if(!argv.includes('--no-open')){console.log('Opening dashboard…');console.log(running.url);if(!await openBrowser(running.url))console.log(`Open in your browser: ${running.url}`);}else console.log(running.url);
+  if (!demo) {
+    const { Store } = await import('../../core/src/storage.js');
+    store = new Store(value('--data-dir') ?? dataDirectory());
+    let last = 0;
+    const verbose = argv.includes('--verbose');
+    const started = Date.now();
+    console.log('Scanning local usage…');
+    const result = await scan(store, {
+      onProgress: (p) => {
+        if (Date.now() - last > 1000 || p.phase === 'complete') {
+          last = Date.now();
+          const text = `${p.provider}: ${p.files}/${p.total} files · ${Math.round(p.bytes / 1e6)} MB`;
+          if (verbose) console.log(text);
+          else if (process.stdout.isTTY) process.stdout.write(`\r${text.padEnd(65)}`);
+        }
+      },
+    });
+    if (!verbose && process.stdout.isTTY) process.stdout.write('\r' + ' '.repeat(65) + '\r');
+    for (const s of result)
+      console.log(
+        `${s.provider === 'codex' ? 'Codex      ' : 'Claude Code'} ${s.diagnostics.records ? '✓' : s.detected ? 'No usage found' : 'Not detected'}`,
+      );
+    if (verbose)
+      console.log(
+        `${((Date.now() - started) / 1000).toFixed(1)}s · ${result.reduce((n, s) => n + s.cached, 0)} files cached`,
+      );
+    if (argv.includes('--scan-only')) {
+      store.close();
+      return;
+    }
+  }
+  const running = await startServer({
+    store,
+    port,
+    publicDirectory: path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../public'),
+    demo,
+  }).catch((e) => {
+    store?.close();
+    throw e;
+  });
+  let closing = false;
+  const close = async () => {
+    if (closing) return;
+    closing = true;
+    await running.close();
+    store?.close();
+    process.exit(0);
+  };
+  process.on('SIGINT', () => void close());
+  process.on('SIGTERM', () => void close());
+  if (demo) console.log('DEMO — fixture data');
+  if (!argv.includes('--no-open')) {
+    console.log('Opening dashboard…');
+    console.log(running.url);
+    if (!(await openBrowser(running.url))) console.log(`Open in your browser: ${running.url}`);
+  } else console.log(running.url);
 }
-main().catch(()=>{console.error('SubValue could not start. Check the port, data-directory permissions, and Node version. No source files were modified.');process.exitCode=1;});
+main().catch(() => {
+  console.error(
+    'SubValue could not start. Check the port, data-directory permissions, and Node version. No source files were modified.',
+  );
+  process.exitCode = 1;
+});

package/dist/packages/cli/src/protocol.js

@@ -0,0 +1,13 @@
+                                                                      
+                                                              
+
+/** Safe bootstrap metadata shared by the local server and bundled dashboard. */
+                                    
+                
+                     
+                          
+                
+                          
+                    
+                                
+ 

package/dist/packages/cli/src/runtime.js

@@ -1,22 +1,52 @@
 import os from 'node:os';
 import path from 'node:path';
-import {spawn} from 'node:child_process';
+import { spawn } from 'node:child_process';
 
-export function dataDirectory(platform=process.platform,home=os.homedir(),env                  =process.env)        {
-  if(platform==='win32')return path.join(env.LOCALAPPDATA&&path.isAbsolute(env.LOCALAPPDATA)?env.LOCALAPPDATA:path.join(home,'AppData','Local'),'SubValue');
-  if(platform==='darwin')return path.join(home,'Library','Application Support','SubValue');
-  return path.join(env.XDG_DATA_HOME&&path.isAbsolute(env.XDG_DATA_HOME)?env.XDG_DATA_HOME:path.join(home,'.local','share'),'subvalue');
+export function dataDirectory(
+  platform = process.platform,
+  home = os.homedir(),
+  env                    = process.env,
+)         {
+  if (platform === 'win32')
+    return path.join(
+      env.LOCALAPPDATA && path.isAbsolute(env.LOCALAPPDATA)
+        ? env.LOCALAPPDATA
+        : path.join(home, 'AppData', 'Local'),
+      'SubValue',
+    );
+  if (platform === 'darwin') return path.join(home, 'Library', 'Application Support', 'SubValue');
+  return path.join(
+    env.XDG_DATA_HOME && path.isAbsolute(env.XDG_DATA_HOME)
+      ? env.XDG_DATA_HOME
+      : path.join(home, '.local', 'share'),
+    'subvalue',
+  );
 }
 
-export function openBrowser(url       ,launch=spawn,platform=process.platform)                  {
+export function openBrowser(
+  url        ,
+  launch = spawn,
+  platform = process.platform,
+)                   {
   // URLs are generated by our loopback server; no shell interpolation is used.
-  if(!/^http:\/\/127\.0\.0\.1:\d+$/.test(url))return Promise.resolve(false);
-  const executable=platform==='win32'?'rundll32':platform==='darwin'?'open':'xdg-open';
-  const args=platform==='win32'?['url.dll,FileProtocolHandler',url]:[url];
-  return new Promise(resolve=>{
-    const child=launch(executable,args,{stdio:'ignore',windowsHide:true});
-    let finished=false;const done=(ok        )=>{if(finished)return;finished=true;clearTimeout(timeout);resolve(ok);};
-    const timeout=setTimeout(()=>{child.unref();done(true);},3000);
-    child.once('error',()=>done(false));child.once('exit',code=>done(code===0));
+  if (!/^http:\/\/127\.0\.0\.1:\d+$/.test(url)) return Promise.resolve(false);
+  const executable =
+    platform === 'win32' ? 'rundll32' : platform === 'darwin' ? 'open' : 'xdg-open';
+  const args = platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+  return new Promise((resolve) => {
+    const child = launch(executable, args, { stdio: 'ignore', windowsHide: true });
+    let finished = false;
+    const done = (ok         ) => {
+      if (finished) return;
+      finished = true;
+      clearTimeout(timeout);
+      resolve(ok);
+    };
+    const timeout = setTimeout(() => {
+      child.unref();
+      done(true);
+    }, 3000);
+    child.once('error', () => done(false));
+    child.once('exit', (code) => done(code === 0));
   });
 }