@traice/codex-collector 0.1.0 → 0.1.3

package/credentials.mjs

@@ -0,0 +1,75 @@
+import { createHash } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+const KEYRING_SERVICE = "trAIce Codex Collector";
+
+export async function storeApiKey(configPath, apiKey, mode = "auto", dependencies = {}) {
+  const account = `config-${createHash("sha256").update(resolve(configPath)).digest("hex").slice(0, 24)}`;
+  if (mode !== "file") {
+    try {
+      const entry = await createEntry(KEYRING_SERVICE, account, dependencies);
+      await entry.setPassword(apiKey);
+      if ((await entry.getPassword()) !== apiKey) throw new Error("credential verification failed");
+      return { credential: { backend: "os-keyring", service: KEYRING_SERVICE, account } };
+    } catch (error) {
+      if (mode === "keyring") throw new Error(`OS credential store unavailable: ${errorMessage(error)}`);
+      return {
+        credential: writeProtectedFile(configPath, apiKey),
+        warning: `OS credential store unavailable; using a user-only protected file (${errorMessage(error)}).`,
+      };
+    }
+  }
+  return { credential: writeProtectedFile(configPath, apiKey) };
+}
+
+export async function readApiKeyCredential(credential, dependencies = {}) {
+  if (credential?.backend === "os-keyring") {
+    const entry = await createEntry(credential.service, credential.account, dependencies);
+    const apiKey = await entry.getPassword();
+    if (!apiKey) throw new Error("Collector API key was not found in the OS credential store. Re-run install.");
+    return apiKey;
+  }
+  if (credential?.backend === "protected-file") {
+    const stored = dependencies.readJson?.(credential.path) ?? readJson(credential.path);
+    if (stored?.apiKey) return stored.apiKey;
+    throw new Error(`Collector API key was not found in ${credential.path}. Re-run install.`);
+  }
+  return null;
+}
+
+async function createEntry(service, account, dependencies) {
+  if (dependencies.createEntry) return dependencies.createEntry(service, account);
+  const { AsyncEntry } = await import("@napi-rs/keyring");
+  return new AsyncEntry(service, account);
+}
+
+function writeProtectedFile(configPath, apiKey) {
+  const directory = dirname(resolve(configPath));
+  const path = resolve(directory, "credentials.json");
+  mkdirSync(directory, { recursive: true, mode: 0o700 });
+  try {
+    chmodSync(directory, 0o700);
+  } catch {
+    // Windows uses the ACL inherited from the user's profile directory.
+  }
+  writeFileSync(path, `${JSON.stringify({ apiKey }, null, 2)}\n`, { mode: 0o600 });
+  try {
+    chmodSync(path, 0o600);
+  } catch {
+    // Best effort on non-POSIX filesystems.
+  }
+  return { backend: "protected-file", path };
+}
+
+function readJson(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}

package/install.mjs

@@ -1,71 +1,87 @@
 #!/usr/bin/env node
-import { createHash, randomBytes } from 'node:crypto';
-import { execFileSync, spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, copyFileSync } from 'node:fs';
-import { homedir, hostname, userInfo } from 'node:os';
-import { resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const DEFAULT_OUT_DIR = '~/.traice/internal-spend-codex';
-const LEGACY_INSTALL_CONFIG = '.traice-internal-spend/install.json';
-const DEFAULT_WORKSPACE_SLUG = 'internal-spend-poc';
-const DEFAULT_WORKSPACE_NAME = 'Internal Spend POC';
-const DEFAULT_KEY_NAME = 'internal-spend-codex-device';
-const BEGIN_MARKER = '# BEGIN trAIce Internal Spend Codex OTel';
-const END_MARKER = '# END trAIce Internal Spend Codex OTel';
-const LEGACY_BEGIN_MARKER = '# BEGIN trAIce Codex OTel POC';
-const LEGACY_END_MARKER = '# END trAIce Codex OTel POC';
-const LAUNCH_AGENT_LABEL = 'com.traice.internal-spend-codex-collector';
+import { createHash, randomBytes } from "node:crypto";
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync, copyFileSync } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readApiKeyCredential, storeApiKey } from "./credentials.mjs";
+
+const DEFAULT_OUT_DIR = "~/.traice/internal-spend-codex";
+const LEGACY_INSTALL_CONFIG = ".traice-internal-spend/install.json";
+const DEFAULT_WORKSPACE_SLUG = "internal-spend-poc";
+const DEFAULT_WORKSPACE_NAME = "Internal Spend POC";
+const DEFAULT_KEY_NAME = "internal-spend-codex-device";
+const BEGIN_MARKER = "# BEGIN trAIce Internal Spend Codex OTel";
+const END_MARKER = "# END trAIce Internal Spend Codex OTel";
+const LEGACY_BEGIN_MARKER = "# BEGIN trAIce Codex OTel POC";
+const LEGACY_END_MARKER = "# END trAIce Codex OTel POC";
+const LAUNCH_AGENT_LABEL = "com.traice.internal-spend-codex-collector";
 
 const args = parseArgs(process.argv.slice(2));
-loadEnvFile(resolve('apps/web/.env'));
+const inheritedApiKey = process.env.TRAICE_API_KEY;
+loadEnvFile(resolve("apps/web/.env"));
 
-const outDir = resolveHome(args.get('out') ?? DEFAULT_OUT_DIR);
-const installPath = resolve(outDir, 'install.json');
+const outDir = resolveHome(args.get("out") ?? DEFAULT_OUT_DIR);
+const installPath = resolve(outDir, "install.json");
 const serverUrl = normalizeUrl(
-  args.get('server-url') ??
-    process.env.TRAICE_API_URL ??
-    process.env.NEXT_PUBLIC_APP_URL ??
-    'http://127.0.0.1:3003',
+  args.get("server-url") ?? process.env.TRAICE_API_URL ?? process.env.NEXT_PUBLIC_APP_URL ?? "http://127.0.0.1:3003",
 );
-const workspaceSlug = args.get('workspace-slug') ?? DEFAULT_WORKSPACE_SLUG;
-const workspaceName = args.get('workspace-name') ?? DEFAULT_WORKSPACE_NAME;
-const keyName = args.get('key-name') ?? DEFAULT_KEY_NAME;
-const codexHome = resolveHome(args.get('codex-home') ?? process.env.CODEX_HOME ?? '~/.codex');
-const listenHost = args.get('listen-host') ?? '127.0.0.1';
-const listenPort = parsePort(args.get('listen-port') ?? '4318');
-const patchCodexConfig = args.get('patch-codex-config') !== 'false';
-const installLaunchAgent = args.get('launch-agent') === 'true' || args.get('start-service') === 'true';
-const employeeEmail = args.get('employee-email') ?? process.env.TRAICE_EMPLOYEE_EMAIL ?? gitConfig('user.email') ?? `${userInfo().username}@local.dev`;
-const employeeName = args.get('employee-name') ?? process.env.TRAICE_EMPLOYEE_NAME ?? gitConfig('user.name') ?? userInfo().username;
-const teamName = args.get('team-name') ?? process.env.TRAICE_TEAM_NAME ?? 'Engineering';
-const sourcePrincipal = args.get('source-principal') ?? `${hostname()}:${userInfo().username}`;
-const seatMonthlyUsd = parseOptionalMoney(args.get('seat-monthly-usd') ?? process.env.TRAICE_SEAT_MONTHLY_USD);
+const workspaceSlug = args.get("workspace-slug") ?? DEFAULT_WORKSPACE_SLUG;
+const workspaceName = args.get("workspace-name") ?? DEFAULT_WORKSPACE_NAME;
+const keyName = args.get("key-name") ?? DEFAULT_KEY_NAME;
+const codexHome = resolveHome(args.get("codex-home") ?? process.env.CODEX_HOME ?? "~/.codex");
+const listenHost = args.get("listen-host") ?? "127.0.0.1";
+const listenPort = parsePort(args.get("listen-port") ?? "4318");
+const patchCodexConfig = (args.get("patch-codex-config") ?? args.get("patch-settings")) !== "false";
+const installLaunchAgent = args.get("launch-agent") === "true" || args.get("start-service") === "true";
+const employeeEmail =
+  args.get("employee-email") ??
+  process.env.TRAICE_EMPLOYEE_EMAIL ??
+  gitConfig("user.email") ??
+  `${userInfo().username}@local.dev`;
+const employeeName =
+  args.get("employee-name") ?? process.env.TRAICE_EMPLOYEE_NAME ?? gitConfig("user.name") ?? userInfo().username;
+const teamName = args.get("team-name") ?? process.env.TRAICE_TEAM_NAME ?? "Engineering";
+const sourcePrincipal = args.get("source-principal") ?? `${hostname()}:${userInfo().username}`;
+const seatMonthlyUsd = parseOptionalMoney(args.get("seat-monthly-usd") ?? process.env.TRAICE_SEAT_MONTHLY_USD);
 const providedApiKey = readApiKey();
+const backfillHours = parseBackfillHours(args.get("backfill-hours") ?? "all");
+const credentialStore = parseCredentialStore(args.get("credential-store") ?? "auto");
 
-mkdirSync(outDir, { recursive: true });
+mkdirSync(outDir, { recursive: true, mode: 0o700 });
+try {
+  chmodSync(outDir, 0o700);
+} catch {
+  // Best effort on non-POSIX filesystems. Windows inherits the user-profile ACL.
+}
 
 const previousInstall = readJsonIfExists(installPath) ?? readLegacyInstallIfDefaultOut();
-const previousApiKey = typeof previousInstall?.apiKey === 'string' ? previousInstall.apiKey : null;
+let previousApiKey = typeof previousInstall?.apiKey === "string" ? previousInstall.apiKey : null;
+if (!providedApiKey && !previousApiKey && previousInstall?.apiKeyCredential) {
+  previousApiKey = await readApiKeyCredential(previousInstall.apiKeyCredential);
+}
 
 let prisma = null;
 
 try {
-  const setup = providedApiKey ? providedApiKeySetup(providedApiKey) : await localDevSetup();
+  const reusableApiKey = providedApiKey || previousApiKey;
+  const setup = reusableApiKey ? providedApiKeySetup(reusableApiKey, !providedApiKey) : await localDevSetup();
+  const storedApiKey = await storeApiKey(installPath, setup.key.raw, credentialStore);
 
   const installConfig = {
-    version: 1,
+    version: 2,
     installedAt: new Date().toISOString(),
     serverUrl,
-    apiKey: setup.key.raw,
+    apiKeyCredential: storedApiKey.credential,
     apiKeyPrefix: setup.key.prefix,
     workspaceId: setup.workspace.id,
     workspaceSlug: setup.workspace.slug,
-    sourceKey: 'codex-local',
-    sourceName: 'Codex local collector',
-    sourceKind: 'codex_otel',
-    tool: 'codex',
-    category: 'coding_agent',
+    sourceKey: "codex-local",
+    sourceName: "Codex local collector",
+    sourceKind: "codex_otel",
+    tool: "codex",
+    category: "coding_agent",
     employeeEmail,
     employeeName,
     teamName,
@@ -75,7 +91,7 @@ try {
     listenHost,
     listenPort,
     pollIntervalMs: 3000,
-    backfillHours: 6,
+    backfillHours,
     includeZeroOutput: false,
   };
 
@@ -88,10 +104,10 @@ try {
 
   const configResult = patchCodexConfig
     ? patchUserCodexConfig({ codexHome, listenHost, listenPort })
-    : { status: 'skipped', path: resolve(codexHome, 'config.toml') };
+    : { status: "skipped", path: resolve(codexHome, "config.toml") };
   const launchAgentResult = installLaunchAgent
     ? installUserLaunchAgent({ installPath, outDir })
-    : { status: 'skipped' };
+    : { status: "skipped" };
 
   console.log(
     JSON.stringify(
@@ -100,6 +116,10 @@ try {
         mode: setup.mode,
         workspace: setup.workspace,
         apiKey: { prefix: setup.key.prefix, reused: setup.key.reused },
+        credentialStorage: {
+          backend: storedApiKey.credential.backend,
+          warning: storedApiKey.warning,
+        },
         identity: { employeeEmail, employeeName, teamName, sourcePrincipal },
         cost: { seatMonthlyUsd },
         installConfig: installPath,
@@ -115,41 +135,43 @@ try {
   await prisma?.$disconnect();
 }
 
-function providedApiKeySetup(rawApiKey) {
+function providedApiKeySetup(rawApiKey, reused) {
   return {
-    mode: 'provided_api_key',
+    mode: "provided_api_key",
     workspace: { id: null, slug: workspaceSlug, name: workspaceName, plan: null },
     key: {
       raw: rawApiKey,
       prefix: rawApiKey.slice(0, 12),
-      reused: true,
+      reused,
     },
   };
 }
 
 function readLegacyInstallIfDefaultOut() {
-  if (args.get('out')) return null;
+  if (args.get("out")) return null;
   return readJsonIfExists(resolve(LEGACY_INSTALL_CONFIG));
 }
 
 async function localDevSetup() {
   if (!process.env.POSTGRES_PRISMA_URL || !process.env.POSTGRES_URL_NON_POOLING) {
-    console.error([
-      'Missing API key and local database environment.',
-      'For a normal install, set TRAICE_API_KEY or pass --api-key-stdin.',
-      'For local repo development, check apps/web/.env for POSTGRES_PRISMA_URL and POSTGRES_URL_NON_POOLING.',
-    ].join('\n'));
+    console.error(
+      [
+        "Missing API key and local database environment.",
+        "For a normal install, set TRAICE_API_KEY or pass --api-key-stdin.",
+        "For local repo development, check apps/web/.env for POSTGRES_PRISMA_URL and POSTGRES_URL_NON_POOLING.",
+      ].join("\n"),
+    );
     process.exit(2);
   }
 
-  const { PrismaClient } = await import('@prisma/client');
+  const { PrismaClient } = await import("@prisma/client");
   prisma = new PrismaClient();
   const workspace = await prisma.workspace.upsert({
     where: { slug: workspaceSlug },
     create: {
       name: workspaceName,
       slug: workspaceSlug,
-      plan: 'TEAM',
+      plan: "TEAM",
       captureSamplesOptIn: false,
       internalSpendEnabled: true,
     },
@@ -162,12 +184,12 @@ async function localDevSetup() {
 
   const key = await ensureApiKey(workspace.id, keyName, previousApiKey);
   await ensureInternalSource(workspace.id, seatMonthlyUsd);
-  if (process.env.DEV_AUTH_ENABLED === 'true') {
-    await ensureDevMembership(workspace.id, args.get('dev-user') ?? 'admin@local.dev');
+  if (process.env.DEV_AUTH_ENABLED === "true") {
+    await ensureDevMembership(workspace.id, args.get("dev-user") ?? "admin@local.dev");
   }
 
   return {
-    mode: 'local_dev_bootstrap',
+    mode: "local_dev_bootstrap",
     workspace: { id: workspace.id, slug: workspace.slug, name: workspace.name, plan: workspace.plan },
     key,
   };
@@ -178,7 +200,7 @@ async function ensureDevMembership(workspaceId, email) {
     where: { email },
     create: {
       email,
-      name: email.split('@')[0],
+      name: email.split("@")[0],
       emailVerified: new Date(),
     },
     update: {
@@ -188,35 +210,36 @@ async function ensureDevMembership(workspaceId, email) {
 
   await prisma.workspaceUser.upsert({
     where: { workspaceId_userId: { workspaceId, userId: user.id } },
-    create: { workspaceId, userId: user.id, role: 'OWNER' },
-    update: { role: 'OWNER' },
+    create: { workspaceId, userId: user.id, role: "OWNER" },
+    update: { role: "OWNER" },
   });
 }
 
 async function ensureInternalSource(workspaceId, monthlySeatUsd) {
-  const metadata = monthlySeatUsd > 0
-    ? {
-        subscription: {
-          monthlySeatUsd,
-          allocation: 'monthly_seat_commitment',
-          note: 'Subscription commitment is shown separately from per-request usage cost.',
-        },
-      }
-    : undefined;
+  const metadata =
+    monthlySeatUsd > 0
+      ? {
+          subscription: {
+            monthlySeatUsd,
+            allocation: "monthly_seat_commitment",
+            note: "Subscription commitment is shown separately from per-request usage cost.",
+          },
+        }
+      : undefined;
 
   await prisma.internalSource.upsert({
-    where: { workspaceId_key: { workspaceId, key: 'codex-local' } },
+    where: { workspaceId_key: { workspaceId, key: "codex-local" } },
     create: {
       workspaceId,
-      key: 'codex-local',
-      name: 'Codex local collector',
-      kind: 'codex_otel',
+      key: "codex-local",
+      name: "Codex local collector",
+      kind: "codex_otel",
       ...(metadata ? { metadata } : {}),
     },
     update: {
-      name: 'Codex local collector',
-      kind: 'codex_otel',
-      status: 'active',
+      name: "Codex local collector",
+      kind: "codex_otel",
+      status: "active",
       ...(metadata ? { metadata } : {}),
     },
   });
@@ -247,49 +270,49 @@ async function ensureApiKey(workspaceId, name, previousRawKey) {
 
 function patchUserCodexConfig({ codexHome, listenHost, listenPort }) {
   mkdirSync(codexHome, { recursive: true });
-  const configPath = resolve(codexHome, 'config.toml');
-  const current = existsSync(configPath) ? readFileSync(configPath, 'utf8') : '';
+  const configPath = resolve(codexHome, "config.toml");
+  const current = existsSync(configPath) ? readFileSync(configPath, "utf8") : "";
   const block = [
     BEGIN_MARKER,
-    '[otel]',
+    "[otel]",
     'environment = "traice-device"',
-    'log_user_prompt = false',
+    "log_user_prompt = false",
     `exporter = { otlp-http = { endpoint = "http://${listenHost}:${listenPort}/v1/logs", protocol = "json" } }`,
     'trace_exporter = "none"',
     'metrics_exporter = "none"',
     END_MARKER,
-    '',
-  ].join('\n');
+    "",
+  ].join("\n");
 
   if (current.includes(BEGIN_MARKER) || current.includes(LEGACY_BEGIN_MARKER)) {
     const begin = current.includes(BEGIN_MARKER) ? BEGIN_MARKER : LEGACY_BEGIN_MARKER;
     const end = current.includes(BEGIN_MARKER) ? END_MARKER : LEGACY_END_MARKER;
-    const pattern = new RegExp(`${escapeRegExp(begin)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, 'm');
+    const pattern = new RegExp(`${escapeRegExp(begin)}[\\s\\S]*?${escapeRegExp(end)}\\n?`, "m");
     writeFileSync(configPath, current.replace(pattern, block));
-    return { status: 'updated', path: configPath };
+    return { status: "updated", path: configPath };
   }
 
   if (/^\s*\[otel\]\s*$/m.test(current)) {
     return {
-      status: 'blocked_existing_otel',
+      status: "blocked_existing_otel",
       path: configPath,
-      message: 'Existing [otel] table found; left it unchanged.',
+      message: "Existing [otel] table found; left it unchanged.",
     };
   }
 
   const next = current.trimEnd().length > 0 ? `${current.trimEnd()}\n\n${block}` : block;
   writeFileSync(configPath, next);
-  return { status: 'added', path: configPath };
+  return { status: "added", path: configPath };
 }
 
 function installUserLaunchAgent({ installPath, outDir }) {
-  const launchAgentsDir = resolveHome('~/Library/LaunchAgents');
+  const launchAgentsDir = resolveHome("~/Library/LaunchAgents");
   mkdirSync(launchAgentsDir, { recursive: true });
   const plistPath = resolve(launchAgentsDir, `${LAUNCH_AGENT_LABEL}.plist`);
   const nodePath = process.execPath;
   const collectorPath = copyCollectorForService(outDir);
-  const logPath = resolve(outDir, 'collector.log');
-  const errPath = resolve(outDir, 'collector.err.log');
+  const logPath = resolve(outDir, "collector.log");
+  const errPath = resolve(outDir, "collector.err.log");
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -321,21 +344,21 @@ function installUserLaunchAgent({ installPath, outDir }) {
   writeFileSync(plistPath, plist);
 
   const guiTarget = `gui/${process.getuid()}`;
-  spawnSync('launchctl', ['bootout', guiTarget, plistPath], { stdio: 'ignore' });
-  const result = spawnSync('launchctl', ['bootstrap', guiTarget, plistPath], { encoding: 'utf8' });
+  spawnSync("launchctl", ["bootout", guiTarget, plistPath], { stdio: "ignore" });
+  const result = spawnSync("launchctl", ["bootstrap", guiTarget, plistPath], { encoding: "utf8" });
   if (result.status !== 0) {
     return {
-      status: 'written_not_loaded',
+      status: "written_not_loaded",
       path: plistPath,
-      error: (result.stderr || result.stdout || '').trim(),
+      error: (result.stderr || result.stdout || "").trim(),
     };
   }
-  return { status: 'loaded', path: plistPath, logPath, errPath };
+  return { status: "loaded", path: plistPath, logPath, errPath };
 }
 
 function copyCollectorForService(outDir) {
-  const sourcePath = fileURLToPath(new URL('./collector.mjs', import.meta.url));
-  const targetPath = resolve(outDir, 'collector.mjs');
+  const sourcePath = fileURLToPath(new URL("./collector.mjs", import.meta.url));
+  const targetPath = resolve(outDir, "collector.mjs");
   copyFileSync(sourcePath, targetPath);
   try {
     chmodSync(targetPath, 0o755);
@@ -346,24 +369,26 @@ function copyCollectorForService(outDir) {
 }
 
 function readApiKey() {
-  if (args.get('api-key-stdin') === 'true') {
-    return readFileSync(0, 'utf8').trim();
+  if (args.get("api-key-stdin") === "true") {
+    return readFileSync(0, "utf8").trim();
   }
-  return args.get('api-key') ?? process.env.TRAICE_API_KEY;
+  // A repo-local .env is loaded for database development only. It must not
+  // silently replace a device's saved production credential on reinstall.
+  return args.get("api-key") ?? inheritedApiKey;
 }
 
 function parseArgs(argv) {
   const parsed = new Map();
   for (let i = 0; i < argv.length; i += 1) {
     const arg = argv[i];
-    if (!arg.startsWith('--')) continue;
+    if (!arg.startsWith("--")) continue;
     const key = arg.slice(2);
     const next = argv[i + 1];
-    if (next && !next.startsWith('--')) {
+    if (next && !next.startsWith("--")) {
       parsed.set(key, next);
       i += 1;
     } else {
-      parsed.set(key, 'true');
+      parsed.set(key, "true");
     }
   }
   return parsed;
@@ -371,9 +396,9 @@ function parseArgs(argv) {
 
 function gitConfig(key) {
   try {
-    const value = execFileSync('git', ['config', '--global', key], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
+    const value = execFileSync("git", ["config", "--global", key], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
     }).trim();
     return value || null;
   } catch {
@@ -383,9 +408,9 @@ function gitConfig(key) {
 
 function loadEnvFile(path) {
   if (!existsSync(path)) return;
-  for (const line of readFileSync(path, 'utf8').split('\n')) {
+  for (const line of readFileSync(path, "utf8").split("\n")) {
     const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith('#')) continue;
+    if (!trimmed || trimmed.startsWith("#")) continue;
     const match = trimmed.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
     if (!match) continue;
     const [, key, rawValue] = match;
@@ -395,10 +420,7 @@ function loadEnvFile(path) {
 }
 
 function unquoteEnvValue(value) {
-  if (
-    (value.startsWith('"') && value.endsWith('"')) ||
-    (value.startsWith("'") && value.endsWith("'"))
-  ) {
+  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
     return value.slice(1, -1);
   }
   return value;
@@ -407,19 +429,19 @@ function unquoteEnvValue(value) {
 function readJsonIfExists(path) {
   if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync(path, 'utf8'));
+    return JSON.parse(readFileSync(path, "utf8"));
   } catch {
     return null;
   }
 }
 
 function normalizeUrl(value) {
-  return String(value).replace(/\/+$/, '');
+  return String(value).replace(/\/+$/, "");
 }
 
 function resolveHome(value) {
-  if (value === '~') return homedir();
-  if (value.startsWith('~/')) return resolve(homedir(), value.slice(2));
+  if (value === "~") return homedir();
+  if (value.startsWith("~/")) return resolve(homedir(), value.slice(2));
   return resolve(value);
 }
 
@@ -433,8 +455,8 @@ function parsePort(value) {
 }
 
 function parseOptionalMoney(value) {
-  if (value == null || value === '') return 0;
-  const parsed = Number(String(value).replace(/[$,]/g, ''));
+  if (value == null || value === "") return 0;
+  const parsed = Number(String(value).replace(/[$,]/g, ""));
   if (!Number.isFinite(parsed) || parsed < 0) {
     console.error(`Invalid USD amount: ${value}`);
     process.exit(2);
@@ -442,8 +464,24 @@ function parseOptionalMoney(value) {
   return parsed;
 }
 
+function parseBackfillHours(value) {
+  if (["all", "full", "infinity"].includes(String(value).toLowerCase())) return "all";
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    console.error(`Invalid backfill hours: ${value}. Use a non-negative number or "all".`);
+    process.exit(2);
+  }
+  return parsed;
+}
+
+function parseCredentialStore(value) {
+  if (["auto", "keyring", "file"].includes(value)) return value;
+  console.error(`Invalid credential store: ${value}. Use "auto", "keyring", or "file".`);
+  process.exit(2);
+}
+
 function generateApiKey() {
-  const raw = `lm_live_${randomBytes(24).toString('hex')}`;
+  const raw = `lm_live_${randomBytes(24).toString("hex")}`;
   return {
     raw,
     prefix: raw.slice(0, 12),
@@ -452,18 +490,18 @@ function generateApiKey() {
 }
 
 function hashApiKey(raw) {
-  return createHash('sha256').update(raw).digest('hex');
+  return createHash("sha256").update(raw).digest("hex");
 }
 
 function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
 function escapeXml(value) {
   return String(value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&apos;');
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@traice/codex-collector",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Local Codex usage collector for trAIce Internal Spend.",
   "license": "UNLICENSED",
   "type": "module",
@@ -14,13 +14,16 @@
   "engines": {
     "node": ">=20"
   },
+  "dependencies": {
+    "@napi-rs/keyring": "^1.3.0"
+  },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@ssh.github.com/shmulikdav/trAIce.git",
+    "url": "git+https://github.com/runtraice/trAIce.git",
     "directory": "tools/internal-spend-codex"
   },
   "bugs": {
-    "url": "https://github.com/shmulikdav/trAIce/issues"
+    "url": "https://github.com/runtraice/trAIce/issues"
   },
   "homepage": "https://runtraice.com",
   "keywords": [
@@ -37,6 +40,7 @@
   "files": [
     "cli.mjs",
     "collector.mjs",
+    "credentials.mjs",
     "install.mjs",
     "README.md"
   ]