@vibe-cafe/vibe-usage 0.10.14 → 0.10.15

package/README.md

@@ -8,10 +8,10 @@ Track your AI coding tool token usage and sync to [vibecafe.ai](https://vibecafe
 npx @vibe-cafe/vibe-usage
 ```
 
-That's it. The CLI opens [vibecafe.ai/usage/device](https://vibecafe.ai/usage/device) in your browser; sign in, confirm the verification code shown in your terminal, click 「确认链接」, and the CLI receives an API key automatically.
+That's it. On first setup, the CLI asks whether project names and the device name may leave the machine (both default to **No**), then opens [vibecafe.ai/usage/device](https://vibecafe.ai/usage/device) in your browser. Sign in, confirm the verification code shown in your terminal, click 「确认链接」, and the CLI receives an API key automatically.
 
 After approval, it will:
-1. Save your API key to `~/.vibe-usage/config.json`
+1. Save your API key and local privacy choices to `~/.vibe-usage/config.json`
 2. Detect installed AI coding tools
 3. Run an initial sync of your usage data
 4. Prompt you to enable the background daemon for continuous syncing (recommended)
@@ -32,6 +32,8 @@ npx @vibe-cafe/vibe-usage init         # Re-run setup via browser login
 npx @vibe-cafe/vibe-usage init --manual-key <vbu_...>   # Skip browser, use pre-issued key (CI/headless)
 npx @vibe-cafe/vibe-usage sync         # Manual sync
 npx @vibe-cafe/vibe-usage sync --extra-codex-home /path/to/.codex  # Add another Codex Home for this run only
+npx @vibe-cafe/vibe-usage config set uploadProject false   # Never upload project names
+npx @vibe-cafe/vibe-usage config set uploadHostname false  # Use an opaque per-install device id
 npx @vibe-cafe/vibe-usage summary       # Print last 7 days as markdown (cost / tokens / by model / by project)
 npx @vibe-cafe/vibe-usage summary --days N  # Same, over the last N days (1-90)
 npx @vibe-cafe/vibe-usage daemon       # Continuous sync (every 30m, foreground)
@@ -155,10 +157,40 @@ Config stored at `~/.vibe-usage/config.json` (dev: `config.dev.json`).
 |-----|-------------|
 | `apiKey` | Your API key (starts with `vbu_`) |
 | `apiUrl` | Server URL (default: `https://vibecafe.ai`) |
-| `hostname` | Stable device name for usage tracking (set at init, reused across syncs) |
+| `hostname` | Stable device name or user-chosen alias; stays local when `uploadHostname=false` |
+| `uploadProject` | Local project-name control. `false` always wins over the Web setting |
+| `uploadHostname` | Local device-name control. `false` replaces the name at the final network boundary |
+| `deviceId` | Generated opaque per-install identity used when `uploadHostname=false` |
 | `codexExtraHome` | Optional additional Codex Home scanned together with `$CODEX_HOME` / `~/.codex` |
 
-The `hostname` is captured once during `init` and reused for all future syncs. This prevents macOS mDNS hostname changes (e.g., `MacBook-Pro` → `MacBook-Pro-2`) from creating duplicate device entries. To change it manually:
+New setups default both local upload controls to `false`. Existing configs without
+these keys retain their previous behavior until you choose a value: the Web
+project-name setting remains authoritative, and the configured device name is
+uploaded.
+
+```bash
+# Local false cannot be overridden by a later Web setting.
+npx @vibe-cafe/vibe-usage config set uploadProject false
+
+# Replaces the device name in buckets, sessions, and sync metadata with a
+# persistent random id such as device-0011223344556677.
+npx @vibe-cafe/vibe-usage config set uploadHostname false
+```
+
+The sanitization happens after every parser and before hashing or HTTP
+serialization. `cursor-cloud` remains a fixed, non-identifying sentinel so
+Cursor account exports still deduplicate across computers.
+
+These controls prevent future transmissions; they do not silently delete data
+already stored in the cloud. To remove previously uploaded identifiers, run
+`vibe-usage reset` after enabling both controls. A full reset deletes the
+account's existing usage before re-uploading the logs available on this
+computer, so coordinate first if the account syncs multiple computers.
+
+When device-name upload is enabled, `hostname` is captured once during `init`
+and reused for all future syncs. This prevents macOS mDNS hostname changes
+(for example, `MacBook-Pro` → `MacBook-Pro-2`) from creating duplicate device
+entries. It can also be set to a non-identifying alias:
 
 ```bash
 npx @vibe-cafe/vibe-usage config set hostname my-device-name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-cafe/vibe-usage",
-  "version": "0.10.14",
+  "version": "0.10.15",
   "description": "Track your AI coding tool token usage and sync to vibecafe.ai",
   "type": "module",
   "scripts": {

package/src/index.js

@@ -24,6 +24,8 @@ async function showStatus() {
     if (config.codexExtraHome) {
       console.log(`  Extra Codex Home: ${config.codexExtraHome}`);
     }
+    console.log(`  Project names: ${config.uploadProject === false ? 'hidden locally' : 'server setting'}`);
+    console.log(`  Device name: ${config.uploadHostname === false ? 'anonymous device id' : 'uploaded'}`);
   }
 
   console.log('\n  Detected tools:');
@@ -48,7 +50,15 @@ async function showStatus() {
   console.log();
 }
 
-const VALID_CONFIG_KEYS = ['apiKey', 'apiUrl', 'hostname', 'codexExtraHome'];
+const BOOLEAN_CONFIG_KEYS = new Set(['uploadProject', 'uploadHostname']);
+const VALID_CONFIG_KEYS = [
+  'apiKey',
+  'apiUrl',
+  'hostname',
+  'uploadProject',
+  'uploadHostname',
+  'codexExtraHome',
+];
 
 function handleConfig(args) {
   const sub = args[0];
@@ -81,6 +91,14 @@ function handleConfig(args) {
         console.error(`Valid keys: ${VALID_CONFIG_KEYS.join(', ')}`);
         process.exit(1);
       }
+      if (BOOLEAN_CONFIG_KEYS.has(key)) {
+        const normalized = value.toLowerCase();
+        if (normalized !== 'true' && normalized !== 'false') {
+          console.error(`${key} must be true or false.`);
+          process.exit(1);
+        }
+        value = normalized === 'true';
+      }
       if (key === 'codexExtraHome' && value !== '') {
         const validation = validateExtraCodexHome(value);
         if (!validation.ok) {
@@ -233,6 +251,8 @@ export async function run(rawArgs) {
     npx @vibe-cafe/vibe-usage config get <key>   Get a config value
     npx @vibe-cafe/vibe-usage config set <key> <value>  Set a config value
     npx @vibe-cafe/vibe-usage config set codexExtraHome <path>  Persist another Codex Home
+    npx @vibe-cafe/vibe-usage config set uploadProject false  Never upload project names
+    npx @vibe-cafe/vibe-usage config set uploadHostname false  Replace the device name with an anonymous id
     npx @vibe-cafe/vibe-usage help         Show this help
 `);
       break;

package/src/init.js

@@ -1,9 +1,9 @@
 import { createInterface } from 'node:readline';
 import { execFile } from 'node:child_process';
-import { hostname as osHostname, platform } from 'node:os';
+import { platform } from 'node:os';
 import { loadConfig, saveConfig } from './config.js';
 import { ingest, requestDeviceCode, pollDeviceCode } from './api.js';
-import { runSync } from './sync.js';
+import { resolveOptionalBoolean, resolveSyncHostname, runSync } from './sync.js';
 import { detectInstalledTools } from './tools.js';
 import { bigHeader, success, failure, warn, arrow, link, dim, divider } from './output.js';
 
@@ -30,6 +30,14 @@ function isDaemonPlatform() {
   return process.platform === 'linux' || process.platform === 'darwin';
 }
 
+async function resolvePrivacyChoice(existingValue, key, question) {
+  const configured = resolveOptionalBoolean(existingValue, key);
+  if (configured !== undefined) return configured;
+  if (!process.stdin.isTTY) return false;
+  const answer = (await prompt(question)).toLowerCase();
+  return answer === 'y' || answer === 'yes';
+}
+
 export async function runInit(options = {}) {
   const { apiKey: providedKey, codexExtraHome } = options;
 
@@ -51,7 +59,31 @@ export async function runInit(options = {}) {
   }
 
   const apiUrl = process.env.VIBE_USAGE_API_URL || 'https://vibecafe.ai';
-  const host = existing?.hostname || osHostname().replace(/\.local$/, '');
+  let uploadProject;
+  let uploadHostname;
+  let draftConfig;
+  let host;
+  try {
+    uploadProject = await resolvePrivacyChoice(
+      existing?.uploadProject,
+      'uploadProject',
+      '上传项目名以查看按项目统计？项目名可能包含客户或内部代号。 [y/N] ',
+    );
+    uploadHostname = await resolvePrivacyChoice(
+      existing?.uploadHostname,
+      'uploadHostname',
+      '上传设备名以区分电脑？选择否将使用匿名设备 ID。 [y/N] ',
+    );
+    draftConfig = {
+      ...(existing || {}),
+      uploadProject,
+      uploadHostname,
+    };
+    host = resolveSyncHostname(draftConfig).hostname;
+  } catch (err) {
+    console.error(failure(err.message));
+    process.exit(1);
+  }
 
   let apiKey;
   if (providedKey) {
@@ -77,10 +109,9 @@ export async function runInit(options = {}) {
   }
 
   const config = {
+    ...draftConfig,
     apiKey,
     apiUrl,
-    hostname: host,
-    ...(existing?.codexExtraHome ? { codexExtraHome: existing.codexExtraHome } : {}),
   };
   saveConfig(config);
 

package/src/reset.js

@@ -1,8 +1,7 @@
 import { createInterface } from 'node:readline';
-import { hostname as getHostname } from 'node:os';
-import { loadConfig } from './config.js';
+import { loadConfig, saveConfig } from './config.js';
 import { deleteAllData } from './api.js';
-import { runSync } from './sync.js';
+import { resolveSyncHostname, runSync } from './sync.js';
 import { clearState } from './state.js';
 import { success, failure, arrow, link, dim } from './output.js';
 
@@ -34,10 +33,18 @@ export async function runReset(args = [], deps = {}) {
     process.exit(1);
   }
 
-  // Target the hostname persisted at init — the same one sync.js uploads
-  // under. A fresh os.hostname() can have drifted since (macOS mDNS adds -2
-  // suffixes), which would delete zero rows, or another machine's rows.
-  const currentHost = config.hostname || getHostname().replace(/\.local$/, '');
+  // Target the exact privacy-safe identity sync.js uploads under. This keeps
+  // `reset --local` aligned with both the stable configured hostname and the
+  // anonymous per-install device id used when hostname upload is disabled.
+  let hostIdentity;
+  try {
+    hostIdentity = resolveSyncHostname(config);
+    if (hostIdentity.changed) saveConfig(config);
+  } catch (err) {
+    console.error(failure(err.message));
+    process.exit(1);
+  }
+  const currentHost = hostIdentity.hostname;
   const apiUrl = config.apiUrl || 'https://vibecafe.ai';
 
   if (hostOnly) {

package/src/sync.js

@@ -1,4 +1,5 @@
 import { hostname as osHostname } from 'node:os';
+import { randomBytes } from 'node:crypto';
 import { loadConfig, saveConfig } from './config.js';
 import {
   loadState, saveState, pruneState,
@@ -14,13 +15,83 @@ import { success, failure, warn, arrow, link, dim } from './output.js';
 const BATCH_SIZE = 100;
 const SESSION_BATCH_SIZE = 500;
 
+const ANONYMOUS_DEVICE_ID_PATTERN = /^device-[0-9a-f]{16}$/;
+const SHARED_HOSTNAME_SENTINELS = new Set(['cursor-cloud']);
+
+export function resolveOptionalBoolean(value, key) {
+  if (value === undefined) return undefined;
+  if (typeof value === 'boolean') return value;
+  const error = new Error(`配置 ${key} 必须是 true 或 false。`);
+  error.code = 'INVALID_CONFIG';
+  throw error;
+}
+
+export function resolveSyncHostname(config, {
+  systemHostname = () => osHostname().replace(/\.local$/, ''),
+  createDeviceId = () => `device-${randomBytes(8).toString('hex')}`,
+} = {}) {
+  const uploadHostname = resolveOptionalBoolean(config.uploadHostname, 'uploadHostname') ?? true;
+  const previousHostname = typeof config.hostname === 'string' && config.hostname.trim()
+    ? config.hostname.trim()
+    : undefined;
+
+  if (!uploadHostname) {
+    const existingDeviceId = typeof config.deviceId === 'string'
+      ? config.deviceId.trim().toLowerCase()
+      : '';
+    const hostname = ANONYMOUS_DEVICE_ID_PATTERN.test(existingDeviceId)
+      ? existingDeviceId
+      : createDeviceId();
+    const changed = config.deviceId !== hostname;
+    if (changed) config.deviceId = hostname;
+    return { hostname, previousHostname, uploadHostname, changed };
+  }
+
+  const hostname = previousHostname || systemHostname();
+  const changed = config.hostname !== hostname;
+  if (changed) config.hostname = hostname;
+  return { hostname, previousHostname, uploadHostname, changed };
+}
+
+export function applyHostnamePrivacy(records, hostname, uploadHostname) {
+  for (const record of records) {
+    if (uploadHostname) {
+      if (!record.hostname) record.hostname = hostname;
+    } else if (!SHARED_HOSTNAME_SENTINELS.has(record.hostname)) {
+      record.hostname = hostname;
+    }
+  }
+}
+
+// A hostname privacy toggle changes the server bucket key. Carry unchanged
+// local state across that key change so enabling privacy does not re-upload
+// all historical buckets beside their older server rows. Changed buckets still
+// upload under the anonymous id; `reset` remains the explicit way to remove
+// identifiers that were uploaded before the local control was enabled.
+export function migrateHiddenHostnameState(state, buckets, previousHostname, hostname) {
+  if (!previousHostname || previousHostname === hostname) return false;
+  let changed = false;
+  for (const bucket of buckets) {
+    if (bucket.hostname !== hostname) continue;
+    const oldKey = bucketKey({ ...bucket, hostname: previousHostname });
+    const newKey = bucketKey(bucket);
+    const currentHash = bucketHash(bucket);
+    if (state.buckets[oldKey] !== currentHash) continue;
+    if (!(newKey in state.buckets)) state.buckets[newKey] = currentHash;
+    delete state.buckets[oldKey];
+    changed = true;
+  }
+  return changed;
+}
+
 function formatBytes(bytes) {
   if (bytes < 1024) return `${bytes}B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
 
-export function resolveUploadProjectSetting(settings) {
+export function resolveUploadProjectSetting(settings, localSetting) {
+  if (localSetting === false) return false;
   if (typeof settings?.uploadProject !== 'boolean') {
     const error = new Error('SETTINGS_UNAVAILABLE');
     error.code = 'SETTINGS_UNAVAILABLE';
@@ -90,6 +161,18 @@ export async function runSync({
     saveConfig(config);
   }
 
+  let localUploadProject;
+  let hostIdentity;
+  try {
+    localUploadProject = resolveOptionalBoolean(config.uploadProject, 'uploadProject');
+    hostIdentity = resolveSyncHostname(config);
+    if (hostIdentity.changed) saveConfig(config);
+  } catch (err) {
+    console.error(failure(err.message));
+    if (throws) throw err;
+    process.exit(1);
+  }
+
   // Privacy is a required input, not an optional hint. If the settings API is
   // unavailable, treating it as `false` changes every project-bearing item's
   // incremental identity to `unknown` and can trigger a full-history upload.
@@ -97,36 +180,45 @@ export async function runSync({
   // no-op: no data upload and no state mutation.
   const apiUrl = config.apiUrl || 'https://vibecafe.ai';
   let uploadProject;
-  try {
-    const settings = await fetchSettings(apiUrl, config.apiKey);
-    uploadProject = resolveUploadProjectSetting(settings);
-    // Scope the cached privacy choice to the server that returned it. Reusing
-    // the value after `apiUrl` changes could expose project names to a
-    // different server during its first settings outage.
-    if (
-      config.lastUploadProject !== uploadProject
-      || config.lastUploadProjectApiUrl !== apiUrl
-    ) {
-      config.lastUploadProject = uploadProject;
-      config.lastUploadProjectApiUrl = apiUrl;
-      saveConfig(config);
-    }
-  } catch (err) {
-    if (err.message === 'UNAUTHORIZED') {
-      console.error(failure('API Key 无效，请运行 `npx @vibe-cafe/vibe-usage init` 重新配置。'));
-      if (throws) throw err;
-      process.exit(1);
-    }
-    // Settings endpoint unreachable (not auth): degrade to the last confirmed
-    // choice for this same server rather than hard-aborting every upload.
-    const cachedUploadProject = resolveCachedUploadProjectSetting(config, apiUrl);
-    if (typeof cachedUploadProject === 'boolean') {
-      uploadProject = cachedUploadProject;
-      if (!quiet) console.log(warn('设置接口不可用，沿用上次的项目名设置。'));
-    } else {
-      console.error(failure('暂时无法读取上传设置，本次同步已安全取消（未上传数据）。请稍后重试。'));
-      if (throws) throw err;
-      process.exit(1);
+  if (localUploadProject === false) {
+    // A local deny is authoritative and needs no server round trip. This is
+    // both fail-closed and usable when the settings endpoint is unavailable.
+    uploadProject = false;
+  } else {
+    try {
+      const settings = await fetchSettings(apiUrl, config.apiKey);
+      uploadProject = resolveUploadProjectSetting(settings, localUploadProject);
+      // Scope the cached privacy choice to the server that returned it. Reusing
+      // the value after `apiUrl` changes could expose project names to a
+      // different server during its first settings outage.
+      if (
+        config.lastUploadProject !== uploadProject
+        || config.lastUploadProjectApiUrl !== apiUrl
+      ) {
+        config.lastUploadProject = uploadProject;
+        config.lastUploadProjectApiUrl = apiUrl;
+        saveConfig(config);
+      }
+    } catch (err) {
+      if (err.message === 'UNAUTHORIZED') {
+        console.error(failure('API Key 无效，请运行 `npx @vibe-cafe/vibe-usage init` 重新配置。'));
+        if (throws) throw err;
+        process.exit(1);
+      }
+      // Settings endpoint unreachable (not auth): degrade to the last confirmed
+      // choice for this same server rather than hard-aborting every upload.
+      const cachedUploadProject = resolveCachedUploadProjectSetting(config, apiUrl);
+      if (typeof cachedUploadProject === 'boolean') {
+        uploadProject = resolveUploadProjectSetting(
+          { uploadProject: cachedUploadProject },
+          localUploadProject,
+        );
+        if (!quiet) console.log(warn('设置接口不可用，沿用上次的项目名设置。'));
+      } else {
+        console.error(failure('暂时无法读取上传设置，本次同步已安全取消（未上传数据）。请稍后重试。'));
+        if (throws) throw err;
+        process.exit(1);
+      }
     }
   }
 
@@ -221,23 +313,24 @@ export async function runSync({
     }
   }
 
-  let host = config.hostname;
-  if (!host) {
-    host = osHostname().replace(/\.local$/, '');
-    config.hostname = host;
-    saveConfig(config);
-  }
-  // Cloud-sourced parsers (e.g. cursor) pre-set their own hostname sentinel so
-  // the same account data isn't stored as separate rows per machine.
-  for (const b of allBuckets) if (!b.hostname) b.hostname = host;
-  for (const s of allSessions) if (!s.hostname) s.hostname = host;
+  const host = hostIdentity.hostname;
+  // Cloud-backed parsers use explicit non-identifying sentinels (currently
+  // `cursor-cloud`) so the same account data deduplicates across computers.
+  // Every other hostname is assigned here, at the final network boundary.
+  applyHostnamePrivacy(allBuckets, host, hostIdentity.uploadHostname);
+  applyHostnamePrivacy(allSessions, host, hostIdentity.uploadHostname);
 
   if (!quiet) {
     if (uploadProject) {
-      console.log(dim('  项目名: 上传（可在 Web 设置中关闭）'));
+      console.log(dim('  项目名: 上传（本机或 Web 设置均可关闭）'));
     } else {
       console.log(dim('  项目名: 已隐藏'));
     }
+    console.log(dim(
+      hostIdentity.uploadHostname
+        ? '  设备名: 上传'
+        : `  设备名: 已替换为匿名 ID (${host})`,
+    ));
   }
   if (!uploadProject) {
     for (const b of allBuckets) b.project = 'unknown';
@@ -253,6 +346,13 @@ export async function runSync({
   // Missing/corrupt state.json => empty maps => one-time full upload, then
   // incremental forever after.
   const state = loadState();
+  const migratedHostnameState = !hostIdentity.uploadHostname
+    && migrateHiddenHostnameState(
+      state,
+      allBuckets,
+      hostIdentity.previousHostname,
+      host,
+    );
   const changedBuckets = [];
   const changedSessions = [];
   const liveBucketKeys = new Set();
@@ -290,7 +390,7 @@ export async function runSync({
   const before = Object.keys(state.buckets).length + Object.keys(state.sessions).length;
   pruneState(state, liveBucketKeys, liveSessionKeys, okSources);
   const pruned = before - (Object.keys(state.buckets).length + Object.keys(state.sessions).length);
-  if (pruned > 0) saveState(state);
+  if (pruned > 0 || migratedHostnameState) saveState(state);
 
   if (changedBuckets.length === 0 && changedSessions.length === 0) {
     if (!quiet) console.log(dim('无新增数据。'));