@trazum/cli 1.50.0 → 1.50.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trazum/cli",
-  "version": "1.50.0",
+  "version": "1.50.2",
   "description": "Trazum CLI: find where your LLM bill goes, price every finding per month, and enforce token budgets in CI.",
   "license": "MIT",
   "author": "David Mu\u00f1oz Rey",
@@ -37,7 +37,7 @@
     "prepublishOnly": "npm run build && npm test"
   },
   "dependencies": {
-    "@trazum/core": "1.50.0"
+    "@trazum/core": "1.50.2"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",

package/src/i18n/en.ts

@@ -57,6 +57,8 @@ ${bold('USAGE')}
   trazum conform <file|-> [--contract <name>]
   trazum models
   trazum rules
+  trazum feedback
+  trazum --version
 
 ${bold('OPTIONS FOR init')}
   --dry-run                   Print the config it would write and write nothing.
@@ -88,6 +90,17 @@ ${bold('OPTIONS FOR conform')}
   The second never gates. Choosing not to log sessions is a decision, not a
   defect. See docs/format.md.
 
+${bold('OPTIONS FOR feedback')}
+  (none)
+
+  Prints where to report a wrong optimisation, a bug, a question or a security
+  problem — and a blank issue with the version, runtime and platform already
+  filled in, printed in full first so nothing travels you have not read.
+
+  It sends nothing. Trazum has no telemetry: no ping, no install hook, no
+  anonymous counter, and a test fails the build if this command ever reaches
+  the network.
+
 ${bold('OPTIONS FOR prune')}
   --cases <file>              One input per line, or a JSON array. Required.
   --yes                       Actually spend the calls. Without it the estimate is
@@ -907,7 +920,8 @@ ${bold('EXAMPLES')}
     findingRoute: (model) => `The same work fits ${model}, which is cheaper per token.`,
     findingBatch: () => 'The Batch API halves both halves of the bill, for work that can wait.',
     findingTotal: (usd, days) => `Together: $${usd} over the same ${days} days.`,
-    findingNext: () => 'trazum plan <your log> ranks every action, not just this one.',
+    findingNext: () =>
+      'trazum plan <your log> ranks every action, not just this one. If a figure here looks wrong, trazum feedback says where to tell us — it sends nothing on its own.',
 
     wouldOverwrite: (keys) => `This replaces keys you already set: ${keys}. Pass --yes to write anyway.`,
     nothingToWrite: () => 'No config written: nothing above could be justified from what is here.',
@@ -919,6 +933,22 @@ ${bold('EXAMPLES')}
       `${path} exists and could not be parsed, so nothing was written over it. Fix or move it first.`,
   },
 
+  feedback: {
+    heading: () => 'Telling us something',
+    sendsNothing: () =>
+      'This command sends nothing, and neither does anything else here. Trazum has no telemetry: no ping, no install hook, no anonymous counter. A tool whose whole argument is that it reads your bill without uploading it cannot also be quietly reporting on you, and a test fails the build if this command ever reaches the network.',
+    whereHeading: () => 'Where',
+    wrongOptimisation: () =>
+      'A rule changed what a prompt asks for — the report that matters most, and the failure this product exists to avoid:',
+    bug: () => 'Anything else that is wrong:',
+    question: () => 'A question, or an idea you are not sure about:',
+    security: () => 'A security problem — privately, never a public issue:',
+    environmentHeading: () => 'What a maintainer will ask for',
+    environmentOnly: () =>
+      'That is the whole of it. Nothing about your work is here — not the config, not a prompt, not a label, not a figure. Those are what a good report needs and what only you can decide to share.',
+    linkHeading: () => 'A blank issue with the above already filled in',
+  },
+
   conform: {
     noTarget: () =>
       'Pass a file to check — a usage log, or any document Trazum emits. Use "-" to read from stdin.',

package/src/i18n/es.ts

@@ -44,6 +44,8 @@ ${bold('USO')}
   trazum conform <fichero|-> [--contract <nombre>]
   trazum models
   trazum rules
+  trazum feedback
+  trazum --version
 
 ${bold('OPCIONES DE init')}
   --dry-run                   Imprime la configuración que escribiría y no escribe nada.
@@ -75,6 +77,18 @@ ${bold('OPCIONES DE conform')}
   La segunda nunca hace fallar nada. Decidir no registrar sesiones es una
   decisión, no un defecto. Ver docs/format.md.
 
+${bold('OPCIONES DE feedback')}
+  (ninguna)
+
+  Imprime dónde reportar una optimización incorrecta, un fallo, una pregunta o
+  un problema de seguridad — y una incidencia en blanco con la versión, el
+  runtime y la plataforma ya puestos, mostrados enteros antes para que no viaje
+  nada que no hayas leído.
+
+  No envía nada. Trazum no tiene telemetría: ni ping, ni hook de instalación, ni
+  contador anónimo, y una prueba hace fallar la compilación si este comando
+  llega a tocar la red.
+
 ${bold('OPCIONES DE prune')}
   --cases <fichero>           Una entrada por línea, o un array JSON. Obligatorio.
   --yes                       Gasta las llamadas de verdad. Sin él se imprime la
@@ -940,7 +954,8 @@ ${bold('EJEMPLOS')}
     findingRoute: (model) => `El mismo trabajo cabe en ${model}, más barato por token.`,
     findingBatch: () => 'La API de lotes reduce a la mitad ambas mitades de la factura, para trabajo que puede esperar.',
     findingTotal: (usd, days) => `Juntas: $${usd} en esos mismos ${days} días.`,
-    findingNext: () => 'trazum plan <tu registro> ordena todas las acciones, no solo esta.',
+    findingNext: () =>
+      'trazum plan <tu registro> ordena todas las acciones, no solo esta. Si alguna cifra de aquí parece mal, trazum feedback dice dónde contarlo — no envía nada por su cuenta.',
 
     wouldOverwrite: (keys) => `Esto reemplaza claves que ya tenías: ${keys}. Pasa --yes para escribir igualmente.`,
     nothingToWrite: () => 'No se escribió configuración: nada de lo anterior se pudo justificar con lo que hay aquí.',
@@ -952,6 +967,22 @@ ${bold('EJEMPLOS')}
       `${path} existe y no se pudo interpretar, así que no se escribió nada encima. Arréglalo o muévelo primero.`,
   },
 
+  feedback: {
+    heading: () => 'Contarnos algo',
+    sendsNothing: () =>
+      'Este comando no envía nada, y nada más aquí lo hace tampoco. Trazum no tiene telemetría: ni ping, ni hook de instalación, ni contador anónimo. Una herramienta cuyo argumento entero es que lee tu factura sin subirla no puede a la vez estar informando sobre ti en silencio, y una prueba hace fallar la compilación si este comando llega a tocar la red.',
+    whereHeading: () => 'Dónde',
+    wrongOptimisation: () =>
+      'Una regla cambió lo que pedía un prompt — el informe que más importa, y el fallo que este producto existe para evitar:',
+    bug: () => 'Cualquier otra cosa que esté mal:',
+    question: () => 'Una pregunta, o una idea de la que no estás seguro:',
+    security: () => 'Un problema de seguridad — en privado, nunca en una incidencia pública:',
+    environmentHeading: () => 'Lo que te va a preguntar quien mantiene esto',
+    environmentOnly: () =>
+      'Y eso es todo. Aquí no hay nada de tu trabajo — ni la configuración, ni un prompt, ni una etiqueta, ni una cifra. Eso es lo que necesita un buen informe y lo que solo tú puedes decidir compartir.',
+    linkHeading: () => 'Una incidencia en blanco con lo de arriba ya puesto',
+  },
+
   conform: {
     noTarget: () =>
       'Pasa un archivo para comprobar — un registro de consumo, o cualquier documento que emita Trazum. Usa "-" para leer de la entrada estándar.',

package/src/i18n/types.ts

@@ -252,6 +252,25 @@ export interface CliMessages {
    * Two halves, and the copy keeps them apart everywhere: problems gate, gaps
    * do not. Choosing not to log sessions is a decision, not a defect.
    */
+  /**
+   * Where to say something, and the standing fact that this command sends
+   * nothing. The second half is not decoration: a tool that offers to help you
+   * file a report is exactly the shape of a tool that phones home, and the
+   * only way to be believed is to say so where somebody is looking.
+   */
+  feedback: {
+    heading(): string;
+    sendsNothing(): string;
+    whereHeading(): string;
+    wrongOptimisation(): string;
+    bug(): string;
+    question(): string;
+    security(): string;
+    environmentHeading(): string;
+    environmentOnly(): string;
+    linkHeading(): string;
+  };
+
   conform: {
     noTarget(): string;
     badContract(given: string, known: string): string;

package/src/index.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env node
+import { readFileSync } from 'node:fs';
 import { open, readdir, readFile, stat, writeFile } from 'node:fs/promises';
-import { join, resolve as resolvePath } from 'node:path';
+import { dirname, join, resolve as resolvePath } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { gunzipSync } from 'node:zlib';
 
 import {
@@ -528,7 +530,7 @@ function disabledRules(args: Args, config: TrazumConfig): RuleId[] | undefined {
  * a threshold is set — `--max-growh 5` would have been ignored and the build
  * gone green. Silence is the wrong answer for a typo.
  */
-const GLOBAL_FLAGS = ['help', 'h', 'locale', 'json', 'config', 'pricing', 'pricing-live'];
+const GLOBAL_FLAGS = ['help', 'h', 'version', 'v', 'locale', 'json', 'config', 'pricing', 'pricing-live'];
 const COMMAND_FLAGS: Record<string, string[]> = {
   optimize: [
     'level', 'model', 'calls', 'output-tokens', 'cache-hit-rate', 'batch',
@@ -554,6 +556,7 @@ const COMMAND_FLAGS: Record<string, string[]> = {
   rank: ['level', 'model', 'calls', 'output-tokens', 'batch', 'disable', 'prompt', 'markdown-out'],
   init: ['dry-run', 'yes', 'json', 'pricing', 'pricing-live'],
   conform: ['contract', 'json'],
+  feedback: [],
   where: [],
   rules: [],
   blame: ['limit', 'model', 'calls', 'output-tokens', 'batch', 'prompt', 'markdown-out'],
@@ -1476,6 +1479,44 @@ const INIT_LOG_CANDIDATES = [
  * nobody has vouched for.
  */
 
+/**
+ * Where feedback goes. Compiled in, never configurable.
+ *
+ * A flag or a config key naming this host would let a fork — or anything that
+ * had rewritten a config on disk — point somebody's bug report, and the
+ * prefilled body with it, at a machine they did not choose. It is one string
+ * and it stays one string.
+ */
+/**
+ * Which Trazum this is.
+ *
+ * Read from the manifest beside the built entry point rather than baked in by
+ * a generator, so it cannot drift from what npm installed — the one number a
+ * bug report is useless without is the one that must not be a copy.
+ *
+ * `readFileSync` at module load, deliberately: every other read in this file
+ * is async and inside a command, but a version has to be available to
+ * `--version` before any command is chosen, and one small synchronous read at
+ * startup is cheaper than making the whole entry point await.
+ *
+ * A failure falls back to `unknown` rather than throwing. A tool that will not
+ * start because it cannot find its own manifest is worse than one that admits
+ * it does not know — and `unknown` in a bug report is itself a useful fact
+ * about how somebody installed it.
+ */
+const VERSION: string = (() => {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const manifest: unknown = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
+    const found = (manifest as { version?: unknown }).version;
+    return typeof found === 'string' ? found : 'unknown';
+  } catch {
+    return 'unknown';
+  }
+})();
+
+const FEEDBACK_REPO = 'https://github.com/Davmunrey/Trazum';
+
 /** Problems listed before the rest are counted. A wall of them helps nobody. */
 const MAX_CONFORM_PROBLEMS = 20;
 
@@ -1949,6 +1990,80 @@ async function commandConform(args: Args, t: CliMessages): Promise<void> {
   console.log();
 }
 
+/**
+ * `trazum feedback` — where to say it, and what to say.
+ *
+ * **This command sends nothing.** Trazum has no telemetry: the CLI makes no
+ * network call it was not explicitly asked to make, and there is no ping, no
+ * install hook and no anonymous counter anywhere in it. That is not an
+ * omission somebody has been meaning to fix — a tool whose entire argument is
+ * that it reads your bill without uploading it cannot also be quietly
+ * reporting on you, and the security suite fails the build if this command
+ * ever reaches the network.
+ *
+ * So the loop is closed the only honest way: the person decides to send
+ * something, and this makes that as cheap as possible. It prints the four
+ * places worth writing to, and a **prefilled link** carrying the facts a
+ * maintainer always has to ask for — version, runtime, platform — printed in
+ * full first, so nothing travels that the sender has not read.
+ *
+ * Nothing about *their work* is in it. Not the config, not a prompt, not a
+ * label, not a figure. Those are the things a bug report needs and the things
+ * only the reporter can decide to share, and a command that helpfully attached
+ * them would be the leak this product exists not to be.
+ */
+function commandFeedback(t: CliMessages): void {
+  const version = VERSION;
+  /**
+   * Facts about the machine, and nothing about the person.
+   *
+   * `process.platform` and the Node version are what every "cannot reproduce"
+   * thread eventually asks for. The locale is here because Trazum ships two
+   * languages and a report reading wrong in one of them is a real bug class.
+   */
+  const environment = [
+    `Trazum ${version}`,
+    `Node ${process.version}`,
+    `${process.platform} ${process.arch}`,
+    `locale ${t.locale}`,
+  ];
+
+  const body = [
+    '<!-- What happened, and what you expected instead. -->',
+    '',
+    '',
+    '---',
+    ...environment.map((line) => `- ${line}`),
+  ].join('\n');
+  const url =
+    `${FEEDBACK_REPO}/issues/new?body=${encodeURIComponent(body)}`;
+
+  console.log();
+  console.log(c.bold(t.feedback.heading()));
+  console.log(`  ${c.dim(wrap(t.feedback.sendsNothing(), 74, '    '))}`);
+  console.log();
+
+  console.log(c.bold(t.feedback.whereHeading()));
+  console.log(`  ${t.feedback.wrongOptimisation()}`);
+  console.log(`    ${c.dim(`${FEEDBACK_REPO}/issues/new?template=wrong_optimisation.yml`)}`);
+  console.log(`  ${t.feedback.bug()}`);
+  console.log(`    ${c.dim(`${FEEDBACK_REPO}/issues/new?template=bug_report.yml`)}`);
+  console.log(`  ${t.feedback.question()}`);
+  console.log(`    ${c.dim(`${FEEDBACK_REPO}/discussions`)}`);
+  console.log(`  ${t.feedback.security()}`);
+  console.log(`    ${c.dim(`${FEEDBACK_REPO}/security/advisories/new`)}`);
+  console.log();
+
+  console.log(c.bold(t.feedback.environmentHeading()));
+  for (const line of environment) console.log(`  ${line}`);
+  console.log(`  ${c.dim(wrap(t.feedback.environmentOnly(), 74, '    '))}`);
+  console.log();
+
+  console.log(c.bold(t.feedback.linkHeading()));
+  console.log(`  ${url}`);
+  console.log();
+}
+
 function commandModels(t: CliMessages, pricing: PricingCatalogue): void {
   const n = (value: number): string => value.toLocaleString(t.numberLocale);
   const col = t.models.columns;
@@ -7835,6 +7950,20 @@ async function main(): Promise<void> {
     return;
   }
 
+  /**
+   * Before the help branch, and before the config loads.
+   *
+   * `trazum --version` on its own is how somebody answers "which one is
+   * installed", and it has to work when the config is broken — that is
+   * precisely the moment they are being asked. Placed above `!args.command`
+   * for the same reason `--clear-suggestion-cache` is: with nothing else on
+   * the line, the help branch would have swallowed it.
+   */
+  if (boolFlag(args, 'version') || boolFlag(args, 'v')) {
+    console.log(VERSION);
+    return;
+  }
+
   if (boolFlag(args, 'help') || boolFlag(args, 'h') || !args.command) {
     console.log(
       t.help(
@@ -7942,6 +8071,9 @@ async function main(): Promise<void> {
     case 'models':
       commandModels(t, pricing);
       break;
+    case 'feedback':
+      commandFeedback(t);
+      break;
     case 'conform':
       await commandConform(args, t);
       break;