@traice/codex-collector 0.1.0 → 0.1.2

package/install.mjs

@@ -1,71 +1,81 @@
 #!/usr/bin/env node
-import { createHash, randomBytes } from 'node:crypto';
-import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, copyFileSync } from 'node:fs';
-import { homedir, hostname, userInfo } from 'node:os';
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const DEFAULT_OUT_DIR = '~/.traice/internal-spend-codex';
-const LEGACY_INSTALL_CONFIG = '.traice-internal-spend/install.json';
-const DEFAULT_WORKSPACE_SLUG = 'internal-spend-poc';
-const DEFAULT_WORKSPACE_NAME = 'Internal Spend POC';
-const DEFAULT_KEY_NAME = 'internal-spend-codex-device';
-const BEGIN_MARKER = '# BEGIN trAIce Internal Spend Codex OTel';
-const END_MARKER = '# END trAIce Internal Spend Codex OTel';
-const LEGACY_BEGIN_MARKER = '# BEGIN trAIce Codex OTel POC';
-const LEGACY_END_MARKER = '# END trAIce Codex OTel POC';
-const LAUNCH_AGENT_LABEL = 'com.traice.internal-spend-codex-collector';
+import { createHash, randomBytes } from "node:crypto";
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, copyFileSync } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const DEFAULT_OUT_DIR = "~/.traice/internal-spend-codex";
+const LEGACY_INSTALL_CONFIG = ".traice-internal-spend/install.json";
+const DEFAULT_WORKSPACE_SLUG = "internal-spend-poc";
+const DEFAULT_WORKSPACE_NAME = "Internal Spend POC";
+const DEFAULT_KEY_NAME = "internal-spend-codex-device";
+const BEGIN_MARKER = "# BEGIN trAIce Internal Spend Codex OTel";
+const END_MARKER = "# END trAIce Internal Spend Codex OTel";
+const LEGACY_BEGIN_MARKER = "# BEGIN trAIce Codex OTel POC";
+const LEGACY_END_MARKER = "# END trAIce Codex OTel POC";
+const LAUNCH_AGENT_LABEL = "com.traice.internal-spend-codex-collector";
 
 const args = parseArgs(process.argv.slice(2));
-loadEnvFile(resolve('apps/web/.env'));
+const inheritedApiKey = process.env.TRAICE_API_KEY;
+loadEnvFile(resolve("apps/web/.env"));
 
-const outDir = resolveHome(args.get('out') ?? DEFAULT_OUT_DIR);
-const installPath = resolve(outDir, 'install.json');
+const outDir = resolveHome(args.get("out") ?? DEFAULT_OUT_DIR);
+const installPath = resolve(outDir, "install.json");
 const serverUrl = normalizeUrl(
-  args.get('server-url') ??
-    process.env.TRAICE_API_URL ??
-    process.env.NEXT_PUBLIC_APP_URL ??
-    'http://127.0.0.1:3003',
+  args.get("server-url") ?? process.env.TRAICE_API_URL ?? process.env.NEXT_PUBLIC_APP_URL ?? "http://127.0.0.1:3003",
 );
-const workspaceSlug = args.get('workspace-slug') ?? DEFAULT_WORKSPACE_SLUG;
-const workspaceName = args.get('workspace-name') ?? DEFAULT_WORKSPACE_NAME;
-const keyName = args.get('key-name') ?? DEFAULT_KEY_NAME;
-const codexHome = resolveHome(args.get('codex-home') ?? process.env.CODEX_HOME ?? '~/.codex');
-const listenHost = args.get('listen-host') ?? '127.0.0.1';
-const listenPort = parsePort(args.get('listen-port') ?? '4318');
-const patchCodexConfig = args.get('patch-codex-config') !== 'false';
-const installLaunchAgent = args.get('launch-agent') === 'true' || args.get('start-service') === 'true';
-const employeeEmail = args.get('employee-email') ?? process.env.TRAICE_EMPLOYEE_EMAIL ?? gitConfig('user.email') ?? `${userInfo().username}@local.dev`;
-const employeeName = args.get('employee-name') ?? process.env.TRAICE_EMPLOYEE_NAME ?? gitConfig('user.name') ?? userInfo().username;
-const teamName = args.get('team-name') ?? process.env.TRAICE_TEAM_NAME ?? 'Engineering';
-const sourcePrincipal = args.get('source-principal') ?? `${hostname()}:${userInfo().username}`;
-const seatMonthlyUsd = parseOptionalMoney(args.get('seat-monthly-usd') ?? process.env.TRAICE_SEAT_MONTHLY_USD);
+const workspaceSlug = args.get("workspace-slug") ?? DEFAULT_WORKSPACE_SLUG;
+const workspaceName = args.get("workspace-name") ?? DEFAULT_WORKSPACE_NAME;
+const keyName = args.get("key-name") ?? DEFAULT_KEY_NAME;
+const codexHome = resolveHome(args.get("codex-home") ?? process.env.CODEX_HOME ?? "~/.codex");
+const listenHost = args.get("listen-host") ?? "127.0.0.1";
+const listenPort = parsePort(args.get("listen-port") ?? "4318");
+const patchCodexConfig = (args.get("patch-codex-config") ?? args.get("patch-settings")) !== "false";
+const installLaunchAgent = args.get("launch-agent") === "true" || args.get("start-service") === "true";
+const employeeEmail =
+  args.get("employee-email") ??
+  process.env.TRAICE_EMPLOYEE_EMAIL ??
+  gitConfig("user.email") ??
+  `${userInfo().username}@local.dev`;
+const employeeName =
+  args.get("employee-name") ?? process.env.TRAICE_EMPLOYEE_NAME ?? gitConfig("user.name") ?? userInfo().username;
+const teamName = args.get("team-name") ?? process.env.TRAICE_TEAM_NAME ?? "Engineering";
+const sourcePrincipal = args.get("source-principal") ?? `${hostname()}:${userInfo().username}`;
+const seatMonthlyUsd = parseOptionalMoney(args.get("seat-monthly-usd") ?? process.env.TRAICE_SEAT_MONTHLY_USD);
 const providedApiKey = readApiKey();
+const backfillHours = parseBackfillHours(args.get("backfill-hours") ?? "all");
 
-mkdirSync(outDir, { recursive: true });
+mkdirSync(outDir, { recursive: true, mode: 0o700 });
+try {
+  chmodSync(outDir, 0o700);
+} catch {
+  // Best effort on non-POSIX filesystems. Windows inherits the user-profile ACL.
+}
 
 const previousInstall = readJsonIfExists(installPath) ?? readLegacyInstallIfDefaultOut();
-const previousApiKey = typeof previousInstall?.apiKey === 'string' ? previousInstall.apiKey : null;
+const previousApiKey = typeof previousInstall?.apiKey === "string" ? previousInstall.apiKey : null;
 
 let prisma = null;
 
 try {
-  const setup = providedApiKey ? providedApiKeySetup(providedApiKey) : await localDevSetup();
+  const reusableApiKey = providedApiKey || previousApiKey;
+  const setup = reusableApiKey ? providedApiKeySetup(reusableApiKey, !providedApiKey) : await localDevSetup();
 
   const installConfig = {
-    version: 1,
+    version: 2,
     installedAt: new Date().toISOString(),
     serverUrl,
     apiKey: setup.key.raw,
     apiKeyPrefix: setup.key.prefix,
     workspaceId: setup.workspace.id,
     workspaceSlug: setup.workspace.slug,
-    sourceKey: 'codex-local',
-    sourceName: 'Codex local collector',
-    sourceKind: 'codex_otel',
-    tool: 'codex',
-    category: 'coding_agent',
+    sourceKey: "codex-local",
+    sourceName: "Codex local collector",
+    sourceKind: "codex_otel",
+    tool: "codex",
+    category: "coding_agent",
     employeeEmail,
     employeeName,
     teamName,
@@ -75,7 +85,7 @@ try {
     listenHost,
     listenPort,
     pollIntervalMs: 3000,
-    backfillHours: 6,
+    backfillHours,
     includeZeroOutput: false,
   };
 
@@ -88,10 +98,10 @@ try {
 
   const configResult = patchCodexConfig
     ? patchUserCodexConfig({ codexHome, listenHost, listenPort })
-    : { status: 'skipped', path: resolve(codexHome, 'config.toml') };
+    : { status: "skipped", path: resolve(codexHome, "config.toml") };
   const launchAgentResult = installLaunchAgent
     ? installUserLaunchAgent({ installPath, outDir })
-    : { status: 'skipped' };
+    : { status: "skipped" };
 
   console.log(
     JSON.stringify(
@@ -115,41 +125,43 @@ try {
   await prisma?.$disconnect();
 }
 
-function providedApiKeySetup(rawApiKey) {
+function providedApiKeySetup(rawApiKey, reused) {
   return {
-    mode: 'provided_api_key',
+    mode: "provided_api_key",
     workspace: { id: null, slug: workspaceSlug, name: workspaceName, plan: null },
     key: {
       raw: rawApiKey,
       prefix: rawApiKey.slice(0, 12),
-      reused: true,
+      reused,
     },
   };
 }
 
 function readLegacyInstallIfDefaultOut() {
-  if (args.get('out')) return null;
+  if (args.get("out")) return null;
   return readJsonIfExists(resolve(LEGACY_INSTALL_CONFIG));
 }
 
 async function localDevSetup() {
   if (!process.env.POSTGRES_PRISMA_URL || !process.env.POSTGRES_URL_NON_POOLING) {
-    console.error([
-      'Missing API key and local database environment.',
-      'For a normal install, set TRAICE_API_KEY or pass --api-key-stdin.',
-      'For local repo development, check apps/web/.env for POSTGRES_PRISMA_URL and POSTGRES_URL_NON_POOLING.',
-    ].join('\n'));
+    console.error(
+      [
+        "Missing API key and local database environment.",
+        "For a normal install, set TRAICE_API_KEY or pass --api-key-stdin.",
+        "For local repo development, check apps/web/.env for POSTGRES_PRISMA_URL and POSTGRES_URL_NON_POOLING.",
+      ].join("\n"),
+    );
     process.exit(2);
   }
 
-  const { PrismaClient } = await import('@prisma/client');
+  const { PrismaClient } = await import("@prisma/client");
   prisma = new PrismaClient();
   const workspace = await prisma.workspace.upsert({
     where: { slug: workspaceSlug },
     create: {
       name: workspaceName,
       slug: workspaceSlug,
-      plan: 'TEAM',
+      plan: "TEAM",
       captureSamplesOptIn: false,
       internalSpendEnabled: true,
     },
@@ -162,12 +174,12 @@ async function localDevSetup() {
 
   const key = await ensureApiKey(workspace.id, keyName, previousApiKey);
   await ensureInternalSource(workspace.id, seatMonthlyUsd);
-  if (process.env.DEV_AUTH_ENABLED === 'true') {
-    await ensureDevMembership(workspace.id, args.get('dev-user') ?? 'admin@local.dev');
+  if (process.env.DEV_AUTH_ENABLED === "true") {
+    await ensureDevMembership(workspace.id, args.get("dev-user") ?? "admin@local.dev");
   }
 
   return {
-    mode: 'local_dev_bootstrap',
+    mode: "local_dev_bootstrap",
     workspace: { id: workspace.id, slug: workspace.slug, name: workspace.name, plan: workspace.plan },
     key,
   };
@@ -178,7 +190,7 @@ async function ensureDevMembership(workspaceId, email) {
     where: { email },
     create: {
       email,
-      name: email.split('@')[0],
+      name: email.split("@")[0],
       emailVerified: new Date(),
     },
     update: {
@@ -188,35 +200,36 @@ async function ensureDevMembership(workspaceId, email) {
 
   await prisma.workspaceUser.upsert({
     where: { workspaceId_userId: { workspaceId, userId: user.id } },
-    create: { workspaceId, userId: user.id, role: 'OWNER' },
-    update: { role: 'OWNER' },
+    create: { workspaceId, userId: user.id, role: "OWNER" },
+    update: { role: "OWNER" },
   });
 }
 
 async function ensureInternalSource(workspaceId, monthlySeatUsd) {
-  const metadata = monthlySeatUsd > 0
-    ? {
-        subscription: {
-          monthlySeatUsd,
-          allocation: 'monthly_seat_commitment',
-          note: 'Subscription commitment is shown separately from per-request usage cost.',
-        },
-      }
-    : undefined;
+  const metadata =
+    monthlySeatUsd > 0
+      ? {
+          subscription: {
+            monthlySeatUsd,
+            allocation: "monthly_seat_commitment",
+            note: "Subscription commitment is shown separately from per-request usage cost.",
+          },
+        }
+      : undefined;
 
   await prisma.internalSource.upsert({
-    where: { workspaceId_key: { workspaceId, key: 'codex-local' } },
+    where: { workspaceId_key: { workspaceId, key: "codex-local" } },
     create: {
       workspaceId,
-      key: 'codex-local',
-      name: 'Codex local collector',
-      kind: 'codex_otel',
+      key: "codex-local",
+      name: "Codex local collector",
+      kind: "codex_otel",
       ...(metadata ? { metadata } : {}),
     },
     update: {
-      name: 'Codex local collector',
-      kind: 'codex_otel',
-      status: 'active',
+      name: "Codex local collector",
+      kind: "codex_otel",
+      status: "active",
       ...(metadata ? { metadata } : {}),
     },
   });
@@ -247,49 +260,49 @@ async function ensureApiKey(workspaceId, name, previousRawKey) {
 
 function patchUserCodexConfig({ codexHome, listenHost, listenPort }) {
   mkdirSync(codexHome, { recursive: true });
-  const configPath = resolve(codexHome, 'config.toml');
-  const current = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
+  const configPath = resolve(codexHome, "config.toml");
+  const current = existsSync(configPath) ? readFileSync(configPath, "utf8") : "";
   const block = [
     BEGIN_MARKER,
-    '[otel]',
+    "[otel]",
     'environment = "traice-device"',
-    'log_user_prompt = false',
+    "log_user_prompt = false",
     `exporter = { otlp-http = { endpoint = "http://${listenHost}:${listenPort}/v1/logs", protocol = "json" } }`,
     'trace_exporter = "none"',
     'metrics_exporter = "none"',
     END_MARKER,
-    '',
-  ].join('\n');
+    "",
+  ].join("\n");
 
   if (current.includes(BEGIN_MARKER) || current.includes(LEGACY_BEGIN_MARKER)) {
     const begin = current.includes(BEGIN_MARKER) ? BEGIN_MARKER : LEGACY_BEGIN_MARKER;
     const end = current.includes(BEGIN_MARKER) ? END_MARKER : LEGACY_END_MARKER;
-    const pattern = new RegExp(`${escapeRegExp(begin)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, 'm');
+    const pattern = new RegExp(`${escapeRegExp(begin)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, "m");
     writeFileSync(configPath, current.replace(pattern, block));
-    return { status: 'updated', path: configPath };
+    return { status: "updated", path: configPath };
   }
 
   if (/^\s*\[otel\]\s*$/m.test(current)) {
     return {
-      status: 'blocked_existing_otel',
+      status: "blocked_existing_otel",
       path: configPath,
-      message: 'Existing [otel] table found; left it unchanged.',
+      message: "Existing [otel] table found; left it unchanged.",
     };
   }
 
   const next = current.trimEnd().length > 0 ? `${current.trimEnd()}\n\n${block}` : block;
   writeFileSync(configPath, next);
-  return { status: 'added', path: configPath };
+  return { status: "added", path: configPath };
 }
 
 function installUserLaunchAgent({ installPath, outDir }) {
-  const launchAgentsDir = resolveHome('~/Library/LaunchAgents');
+  const launchAgentsDir = resolveHome("~/Library/LaunchAgents");
   mkdirSync(launchAgentsDir, { recursive: true });
   const plistPath = resolve(launchAgentsDir, `${LAUNCH_AGENT_LABEL}.plist`);
   const nodePath = process.execPath;
   const collectorPath = copyCollectorForService(outDir);
-  const logPath = resolve(outDir, 'collector.log');
-  const errPath = resolve(outDir, 'collector.err.log');
+  const logPath = resolve(outDir, "collector.log");
+  const errPath = resolve(outDir, "collector.err.log");
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -321,21 +334,21 @@ function installUserLaunchAgent({ installPath, outDir }) {
   writeFileSync(plistPath, plist);
 
   const guiTarget = `gui/${process.getuid()}`;
-  spawnSync('launchctl', ['bootout', guiTarget, plistPath], { stdio: 'ignore' });
-  const result = spawnSync('launchctl', ['bootstrap', guiTarget, plistPath], { encoding: 'utf8' });
+  spawnSync("launchctl", ["bootout", guiTarget, plistPath], { stdio: "ignore" });
+  const result = spawnSync("launchctl", ["bootstrap", guiTarget, plistPath], { encoding: "utf8" });
   if (result.status !== 0) {
     return {
-      status: 'written_not_loaded',
+      status: "written_not_loaded",
       path: plistPath,
-      error: (result.stderr || result.stdout || '').trim(),
+      error: (result.stderr || result.stdout || "").trim(),
     };
   }
-  return { status: 'loaded', path: plistPath, logPath, errPath };
+  return { status: "loaded", path: plistPath, logPath, errPath };
 }
 
 function copyCollectorForService(outDir) {
-  const sourcePath = fileURLToPath(new URL('./collector.mjs', import.meta.url));
-  const targetPath = resolve(outDir, 'collector.mjs');
+  const sourcePath = fileURLToPath(new URL("./collector.mjs", import.meta.url));
+  const targetPath = resolve(outDir, "collector.mjs");
   copyFileSync(sourcePath, targetPath);
   try {
     chmodSync(targetPath, 0o755);
@@ -346,24 +359,26 @@ function copyCollectorForService(outDir) {
 }
 
 function readApiKey() {
-  if (args.get('api-key-stdin') === 'true') {
-    return readFileSync(0, 'utf8').trim();
+  if (args.get("api-key-stdin") === "true") {
+    return readFileSync(0, "utf8").trim();
   }
-  return args.get('api-key') ?? process.env.TRAICE_API_KEY;
+  // A repo-local .env is loaded for database development only. It must not
+  // silently replace a device's saved production credential on reinstall.
+  return args.get("api-key") ?? inheritedApiKey;
 }
 
 function parseArgs(argv) {
   const parsed = new Map();
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
-    if (!arg.startsWith('--')) continue;
+    if (!arg.startsWith("--")) continue;
     const key = arg.slice(2);
     const next = argv[i + 1];
-    if (next && !next.startsWith('--')) {
+    if (next && !next.startsWith("--")) {
       parsed.set(key, next);
       i += 1;
     } else {
-      parsed.set(key, 'true');
+      parsed.set(key, "true");
     }
   }
   return parsed;
@@ -371,9 +386,9 @@ function parseArgs(argv) {
 
 function gitConfig(key) {
   try {
-    const value = execFileSync('git', ['config', '--global', key], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
+    const value = execFileSync("git", ["config", "--global", key], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
     }).trim();
     return value || null;
   } catch {
@@ -383,9 +398,9 @@ function gitConfig(key) {
 
 function loadEnvFile(path) {
   if (!existsSync(path)) return;
-  for (const line of readFileSync(path, 'utf8').split('\n')) {
+  for (const line of readFileSync(path, "utf8").split("\n")) {
     const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
+    if (!trimmed || trimmed.startsWith("#")) continue;
     const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
     if (!match) continue;
     const [, key, rawValue] = match;
@@ -395,10 +410,7 @@ function loadEnvFile(path) {
 }
 
 function unquoteEnvValue(value) {
-  if (
-    (value.startsWith('"') && value.endsWith('"')) ||
-    (value.startsWith("'") && value.endsWith("'"))
-  ) {
+  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
     return value.slice(1, -1);
   }
   return value;
@@ -407,19 +419,19 @@ function unquoteEnvValue(value) {
 function readJsonIfExists(path) {
   if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    return JSON.parse(readFileSync(path, "utf8"));
   } catch {
     return null;
   }
 }
 
 function normalizeUrl(value) {
-  return String(value).replace(/\/+$/, '');
+  return String(value).replace(/\/+$/, "");
 }
 
 function resolveHome(value) {
-  if (value === '~') return homedir();
-  if (value.startsWith('~/')) return resolve(homedir(), value.slice(2));
+  if (value === "~") return homedir();
+  if (value.startsWith("~/")) return resolve(homedir(), value.slice(2));
   return resolve(value);
 }
 
@@ -433,8 +445,8 @@ function parsePort(value) {
 }
 
 function parseOptionalMoney(value) {
-  if (value == null || value === '') return 0;
-  const parsed = Number(String(value).replace(/[$,]/g, ''));
+  if (value == null || value === "") return 0;
+  const parsed = Number(String(value).replace(/[$,]/g, ""));
   if (!Number.isFinite(parsed) || parsed < 0) {
     console.error(`Invalid USD amount: ${value}`);
     process.exit(2);
@@ -442,8 +454,18 @@ function parseOptionalMoney(value) {
   return parsed;
 }
 
+function parseBackfillHours(value) {
+  if (["all", "full", "infinity"].includes(String(value).toLowerCase())) return "all";
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    console.error(`Invalid backfill hours: ${value}. Use a non-negative number or "all".`);
+    process.exit(2);
+  }
+  return parsed;
+}
+
 function generateApiKey() {
-  const raw = `lm_live_${randomBytes(24).toString('hex')}`;
+  const raw = `lm_live_${randomBytes(24).toString("hex")}`;
   return {
     raw,
     prefix: raw.slice(0, 12),
@@ -452,18 +474,18 @@ function generateApiKey() {
 }
 
 function hashApiKey(raw) {
-  return createHash('sha256').update(raw).digest('hex');
+  return createHash("sha256").update(raw).digest("hex");
 }
 
 function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 function escapeXml(value) {
   return String(value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&apos;');
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@traice/codex-collector",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Local Codex usage collector for trAIce Internal Spend.",
   "license": "UNLICENSED",
   "type": "module",