@thispointon/kondi-chat 0.1.2

package/src/audit/ledger.ts

@@ -0,0 +1,253 @@
+/**
+ * Audit Ledger — append-only log of every LLM call and verification.
+ *
+ * Records what was sent, what came back, which model handled it,
+ * how much it cost, and what task it was for. Persisted to disk
+ * alongside the session for full auditability.
+ */
+
+import { writeFileSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import type { LedgerEntry, LedgerPhase, LLMResponse, ProviderId } from '../types.ts';
+
+// ---------------------------------------------------------------------------
+// Pricing table (USD per 1M tokens)
+// ---------------------------------------------------------------------------
+
+/**
+ * Pricing per 1M tokens.
+ * `cachedInput` is the discounted rate for prompt-cached bytes — typically
+ * 10% of standard (Anthropic) or 50% (OpenAI/Z.AI). If omitted, we use the
+ * standard input rate as a conservative fallback.
+ */
+const PRICING: Record<string, { input: number; output: number; cachedInput?: number }> = {
+  // Anthropic (cache-read priced at ~10% of input on current plans)
+  // Opus 4.6 dropped to $5/$25 (was $15/$75). Sonnet 4.6 stays $3/$15.
+  'claude-opus-4-20250514':     { input: 5,    output: 25,  cachedInput: 0.50 },
+  'claude-sonnet-4-5-20250929': { input: 3,    output: 15,  cachedInput: 0.30 },
+  'claude-haiku-4-5-20251001':  { input: 1,    output: 5,   cachedInput: 0.10 },
+  // OpenAI (cached reads at 50% of input)
+  'gpt-5.4':                    { input: 2.5,  output: 15,  cachedInput: 1.25 },
+  'gpt-5.4-mini':               { input: 0.75, output: 4.5, cachedInput: 0.375 },
+  'gpt-5.4-nano':               { input: 0.20, output: 1.25, cachedInput: 0.10 },
+  'gpt-4o':                     { input: 2.5,  output: 10,  cachedInput: 1.25 },
+  'gpt-4o-mini':                { input: 0.15, output: 0.6, cachedInput: 0.075 },
+  // DeepSeek — https://api-docs.deepseek.com/quick_start/pricing
+  // V4 Pro at 75% discount through May 31 2026.
+  // Cache hit reduced to 1/10 of launch price as of April 26 2026.
+  'deepseek-v4-pro':            { input: 0.435, output: 0.87,  cachedInput: 0.003625 },
+  'deepseek-v4-flash':          { input: 0.14,  output: 0.28,  cachedInput: 0.0028 },
+  // Legacy names (being deprecated, map to v4-flash / v4-flash-reasoning)
+  'deepseek-chat':              { input: 0.14,  output: 0.28,  cachedInput: 0.0028 },
+  'deepseek-reasoner':          { input: 0.14,  output: 0.28,  cachedInput: 0.0028 },
+  // Google — https://ai.google.dev/gemini-api/docs/pricing
+  'models/gemini-2.5-flash':    { input: 0.30, output: 2.50, cachedInput: 0.03 },
+  'models/gemini-2.5-pro':      { input: 1.25, output: 10.0, cachedInput: 0.125 },
+  // xAI
+  'grok-3':                     { input: 3,    output: 15 },
+  // Z.AI GLM — https://docs.z.ai/guides/overview/pricing
+  'glm-5.1':                    { input: 1.4,  output: 4.4,  cachedInput: 0.26 },
+  'glm-5':                      { input: 1.0,  output: 3.2,  cachedInput: 0.20 },
+  'glm-5-turbo':                { input: 1.2,  output: 4.0,  cachedInput: 0.24 },
+  'glm-4.7':                    { input: 0.6,  output: 2.2,  cachedInput: 0.11 },
+  'glm-4.6':                    { input: 0.6,  output: 2.2,  cachedInput: 0.11 },
+  'glm-4.5':                    { input: 0.6,  output: 2.2,  cachedInput: 0.11 },
+  'glm-4.5-air':                { input: 0.2,  output: 1.1,  cachedInput: 0.03 },
+  'glm-4.5-flash':              { input: 0,    output: 0 },
+  'glm-4.7-flash':              { input: 0,    output: 0 },
+};
+
+/**
+ * Estimate cost in USD.
+ * @param cachedInputTokens  Portion of inputTokens served from prompt cache.
+ *                           Billed at the model's `cachedInput` rate (typically
+ *                           10–50% of standard input) instead of `input`.
+ */
+export function estimateCost(
+  model: string,
+  inputTokens: number,
+  outputTokens: number,
+  cachedInputTokens = 0,
+): number {
+  const p = PRICING[model] || { input: 3, output: 15 };
+  const cached = Math.min(cachedInputTokens, inputTokens);
+  const uncachedInput = inputTokens - cached;
+  const cachedRate = p.cachedInput ?? p.input;
+  return (uncachedInput * p.input + cached * cachedRate + outputTokens * p.output) / 1_000_000;
+}
+
+// ---------------------------------------------------------------------------
+// Ledger
+// ---------------------------------------------------------------------------
+
+export class Ledger {
+  private entries: LedgerEntry[] = [];
+  private sessionId: string;
+  private storageDir?: string;
+
+  constructor(sessionId: string, storageDir?: string) {
+    this.sessionId = sessionId;
+    this.storageDir = storageDir;
+
+    if (storageDir) {
+      mkdirSync(storageDir, { recursive: true });
+      const existing = this.loadFromDisk();
+      if (existing) this.entries = existing;
+    }
+  }
+
+  /**
+   * Record an LLM call in the ledger.
+   */
+  record(
+    phase: LedgerPhase,
+    response: LLMResponse,
+    promptSummary: string,
+    opts?: { taskId?: string; promoted?: boolean },
+  ): LedgerEntry {
+    const cached = response.cachedInputTokens ?? 0;
+    const cost = estimateCost(response.model, response.inputTokens, response.outputTokens, cached);
+
+    const entry: LedgerEntry = {
+      id: `${this.sessionId}-${this.entries.length.toString().padStart(4, '0')}`,
+      timestamp: new Date().toISOString(),
+      phase,
+      provider: response.provider,
+      model: response.model,
+      inputTokens: response.inputTokens,
+      outputTokens: response.outputTokens,
+      latencyMs: response.latencyMs,
+      costUsd: cost,
+      cached: response.cached ?? cached > 0,
+      ...(cached > 0 ? { cachedInputTokens: cached } : {}),
+      promptSummary: truncate(promptSummary, 500),
+      responseSummary: truncate(response.content, 500),
+      taskId: opts?.taskId,
+      promoted: opts?.promoted,
+    };
+
+    this.entries.push(entry);
+    this.persistToDisk();
+
+    return entry;
+  }
+
+  /**
+   * Record a local verification step (no LLM call).
+   */
+  recordVerification(
+    taskId: string,
+    passed: boolean,
+    output: string,
+  ): LedgerEntry {
+    const entry: LedgerEntry = {
+      id: `${this.sessionId}-${this.entries.length.toString().padStart(4, '0')}`,
+      timestamp: new Date().toISOString(),
+      phase: 'verify',
+      provider: 'ollama' as ProviderId, // placeholder — no actual provider
+      model: 'local',
+      inputTokens: 0,
+      outputTokens: 0,
+      latencyMs: 0,
+      costUsd: 0,
+      cached: false,
+      promptSummary: `Verification for task ${taskId}`,
+      responseSummary: truncate(output, 500),
+      taskId,
+    };
+
+    this.entries.push(entry);
+    this.persistToDisk();
+
+    return entry;
+  }
+
+  // -------------------------------------------------------------------------
+  // Queries
+  // -------------------------------------------------------------------------
+
+  getAll(): LedgerEntry[] {
+    return [...this.entries];
+  }
+
+  getByPhase(phase: LedgerPhase): LedgerEntry[] {
+    return this.entries.filter(e => e.phase === phase);
+  }
+
+  getByTask(taskId: string): LedgerEntry[] {
+    return this.entries.filter(e => e.taskId === taskId);
+  }
+
+  getTotals(): {
+    calls: number;
+    inputTokens: number;
+    outputTokens: number;
+    costUsd: number;
+    byPhase: Record<string, { calls: number; inputTokens: number; outputTokens: number; costUsd: number }>;
+    byModel: Record<string, { calls: number; inputTokens: number; outputTokens: number; costUsd: number }>;
+  } {
+    const byPhase: Record<string, { calls: number; inputTokens: number; outputTokens: number; costUsd: number }> = {};
+    const byModel: Record<string, { calls: number; inputTokens: number; outputTokens: number; costUsd: number }> = {};
+
+    let totalInput = 0;
+    let totalOutput = 0;
+    let totalCost = 0;
+
+    for (const e of this.entries) {
+      totalInput += e.inputTokens;
+      totalOutput += e.outputTokens;
+      totalCost += e.costUsd;
+
+      if (!byPhase[e.phase]) byPhase[e.phase] = { calls: 0, inputTokens: 0, outputTokens: 0, costUsd: 0 };
+      byPhase[e.phase].calls++;
+      byPhase[e.phase].inputTokens += e.inputTokens;
+      byPhase[e.phase].outputTokens += e.outputTokens;
+      byPhase[e.phase].costUsd += e.costUsd;
+
+      if (!byModel[e.model]) byModel[e.model] = { calls: 0, inputTokens: 0, outputTokens: 0, costUsd: 0 };
+      byModel[e.model].calls++;
+      byModel[e.model].inputTokens += e.inputTokens;
+      byModel[e.model].outputTokens += e.outputTokens;
+      byModel[e.model].costUsd += e.costUsd;
+    }
+
+    return {
+      calls: this.entries.length,
+      inputTokens: totalInput,
+      outputTokens: totalOutput,
+      costUsd: totalCost,
+      byPhase,
+      byModel,
+    };
+  }
+
+  // -------------------------------------------------------------------------
+  // Persistence
+  // -------------------------------------------------------------------------
+
+  private persistToDisk(): void {
+    if (!this.storageDir) return;
+    const path = join(this.storageDir, `${this.sessionId}-ledger.json`);
+    writeFileSync(path, JSON.stringify(this.entries, null, 2));
+  }
+
+  private loadFromDisk(): LedgerEntry[] | null {
+    if (!this.storageDir) return null;
+    const path = join(this.storageDir, `${this.sessionId}-ledger.json`);
+    if (!existsSync(path)) return null;
+    try {
+      return JSON.parse(readFileSync(path, 'utf-8'));
+    } catch {
+      return null;
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function truncate(s: string, maxLen: number): string {
+  if (s.length <= maxLen) return s;
+  return s.slice(0, maxLen) + '...';
+}

package/src/audit/telemetry.ts

@@ -0,0 +1,165 @@
+/**
+ * Telemetry — opt-in, local-only, schema-enforced usage metrics.
+ *
+ * v1 does not ship any network code. Events accumulate in
+ * `.kondi-chat/telemetry.json` (separate from analytics.json). Users must
+ * explicitly run `/telemetry enable` before any event is recorded.
+ *
+ * The schema is a closed union; unknown fields are rejected at emit time to
+ * uphold the privacy claim. No prompts, paths, URLs, or free text allowed.
+ */
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+
+export type FeatureId =
+  | 'session_started' | 'session_resumed' | 'undo_invoked'
+  | 'checkpoint_created' | 'checkpoint_restored'
+  | 'sub_agent_spawned' | 'hook_executed' | 'web_search'
+  | 'image_uploaded' | 'memory_loaded' | 'memory_updated'
+  | 'council_invoked' | 'non_interactive_run' | 'profile_changed';
+
+export type ToolCategoryId =
+  | 'filesystem_read' | 'filesystem_write' | 'filesystem_edit'
+  | 'search_code' | 'run_command' | 'create_task' | 'update_plan'
+  | 'git' | 'web' | 'mcp' | 'council' | 'update_memory' | 'spawn_agent';
+
+export type ErrorCategoryId =
+  | 'llm_timeout' | 'llm_rate_limit' | 'llm_auth'
+  | 'network' | 'permission_denied' | 'tool_error' | 'config_error'
+  | 'provider_fallback' | 'backend_crash';
+
+export type TelemetryEvent =
+  | { kind: 'feature_used'; feature: FeatureId; timestamp: string }
+  | { kind: 'tool_called'; tool: ToolCategoryId; succeeded: boolean; timestamp: string }
+  | { kind: 'error_occurred'; category: ErrorCategoryId; recoverable: boolean; timestamp: string };
+
+export type TelemetryState = 'disabled' | 'local-only' | 'remote-enabled';
+
+interface PersistedTelemetry {
+  state: TelemetryState;
+  installationId?: string;
+  events: TelemetryEvent[];
+}
+
+const FEATURE_SET = new Set<FeatureId>([
+  'session_started', 'session_resumed', 'undo_invoked',
+  'checkpoint_created', 'checkpoint_restored',
+  'sub_agent_spawned', 'hook_executed', 'web_search',
+  'image_uploaded', 'memory_loaded', 'memory_updated',
+  'council_invoked', 'non_interactive_run', 'profile_changed',
+]);
+
+const TOOL_SET = new Set<ToolCategoryId>([
+  'filesystem_read', 'filesystem_write', 'filesystem_edit',
+  'search_code', 'run_command', 'create_task', 'update_plan',
+  'git', 'web', 'mcp', 'council', 'update_memory', 'spawn_agent',
+]);
+
+const ERROR_SET = new Set<ErrorCategoryId>([
+  'llm_timeout', 'llm_rate_limit', 'llm_auth',
+  'network', 'permission_denied', 'tool_error', 'config_error',
+  'provider_fallback', 'backend_crash',
+]);
+
+const MAX_EVENTS = 10_000;
+
+export class TelemetryEmitter {
+  private path: string;
+  private data: PersistedTelemetry;
+
+  constructor(storageDir: string) {
+    this.path = join(storageDir, 'telemetry.json');
+    this.data = this.load();
+    // Environment override (Spec 15 clarifications): force disabled + delete.
+    if (process.env.KONDI_CHAT_NO_TELEMETRY === '1') {
+      this.data.state = 'disabled';
+      this.data.events = [];
+      this.save();
+    }
+  }
+
+  getState(): TelemetryState { return this.data.state; }
+
+  setState(state: TelemetryState): void {
+    this.data.state = state;
+    if (state === 'disabled') this.data.events = [];
+    this.save();
+  }
+
+  enable(): void { this.setState('local-only'); }
+  disable(): void { this.setState('disabled'); }
+
+  /** Record an event if telemetry is not disabled. Unknown fields are rejected. */
+  record(event: TelemetryEvent): void {
+    if (this.data.state === 'disabled') return;
+    if (!this.validate(event)) {
+      process.stderr.write(`[telemetry] rejected malformed event: ${JSON.stringify(event)}\n`);
+      return;
+    }
+    this.data.events.push(event);
+    if (this.data.events.length > MAX_EVENTS) {
+      this.data.events = this.data.events.slice(-MAX_EVENTS);
+    }
+    this.save();
+  }
+
+  export(): string {
+    return JSON.stringify(this.data, null, 2);
+  }
+
+  deleteAll(): void {
+    this.data.events = [];
+    this.save();
+  }
+
+  format(): string {
+    const lines = [`Telemetry state: ${this.data.state}`];
+    if (this.data.state === 'disabled') {
+      lines.push('  (no events recorded)');
+      lines.push('  enable with: /telemetry enable');
+      return lines.join('\n');
+    }
+    const counts: Record<string, number> = {};
+    for (const e of this.data.events) {
+      const key = e.kind === 'feature_used' ? `feature:${e.feature}`
+                : e.kind === 'tool_called' ? `tool:${e.tool}`
+                : `error:${e.category}`;
+      counts[key] = (counts[key] || 0) + 1;
+    }
+    lines.push(`Total events: ${this.data.events.length}`);
+    for (const [k, v] of Object.entries(counts).sort((a, b) => b[1] - a[1])) {
+      lines.push(`  ${k.padEnd(40)} ${v}`);
+    }
+    return lines.join('\n');
+  }
+
+  private validate(event: TelemetryEvent): boolean {
+    switch (event.kind) {
+      case 'feature_used': return FEATURE_SET.has(event.feature);
+      case 'tool_called': return TOOL_SET.has(event.tool) && typeof event.succeeded === 'boolean';
+      case 'error_occurred': return ERROR_SET.has(event.category) && typeof event.recoverable === 'boolean';
+    }
+    return false;
+  }
+
+  private load(): PersistedTelemetry {
+    if (!existsSync(this.path)) {
+      return { state: 'disabled', events: [] };
+    }
+    try {
+      const raw = JSON.parse(readFileSync(this.path, 'utf-8'));
+      if (raw && typeof raw === 'object' && raw.state) return raw as PersistedTelemetry;
+    } catch { /* fall through */ }
+    return { state: 'disabled', events: [] };
+  }
+
+  private save(): void {
+    try {
+      mkdirSync(dirname(this.path), { recursive: true });
+      writeFileSync(this.path, JSON.stringify(this.data, null, 2));
+    } catch (e) {
+      process.stderr.write(`[telemetry] save failed: ${(e as Error).message}\n`);
+    }
+  }
+}