agent-insights 0.0.10 → 0.0.12

package/dist/cli.js

@@ -21,6 +21,9 @@ function configFile() {
 function authFile() {
   return join(configRoot(), "auth.json");
 }
+function bypassSecretFile() {
+  return join(configRoot(), "bypass-secret");
+}
 function sessionCacheDir() {
   return join(configRoot(), "session-cache");
 }
@@ -251,9 +254,9 @@ async function saveAuth(state) {
   }
 }
 async function clearAuth() {
-  const { unlink } = await import("fs/promises");
+  const { unlink: unlink2 } = await import("fs/promises");
   try {
-    await unlink(authFile());
+    await unlink2(authFile());
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -299,9 +302,17 @@ import { spawn } from "child_process";
 import { randomUUID } from "crypto";
 
 // src/config/config.ts
-init_paths();
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { dirname } from "path";
+
+// src/config/analyzer.ts
+var DEFAULT_ANALYZER_URL = "https://agent-insights.labs.vercel.dev";
+function getAnalyzerUrl() {
+  return process.env.AGENT_INSIGHTS_ANALYZER_URL || DEFAULT_ANALYZER_URL;
+}
+
+// src/config/config.ts
+init_paths();
 function defaultConfig() {
   return {
     version: 1,
@@ -330,7 +341,7 @@ function defaultConfig() {
     },
     sessionAnalysis: {
       enabled: false,
-      analyzerUrl: process.env.AGENT_INSIGHTS_ANALYZER_URL ?? "",
+      analyzerUrl: getAnalyzerUrl(),
       githubIssueRepo: "vercel-labs/agent-insights"
     },
     agents: {
@@ -878,8 +889,49 @@ init_store();
 
 // src/transcript/store.ts
 init_store();
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { put } from "@vercel/blob";
+
+// src/config/bypass.ts
+init_paths();
+import { chmod as chmod2, mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname5 } from "path";
+async function loadBypassSecret() {
+  const fromEnv = process.env.AGENT_INSIGHTS_BYPASS_SECRET || process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+  if (fromEnv) return fromEnv;
+  try {
+    const raw = (await readFile5(bypassSecretFile(), "utf8")).trim();
+    return raw || void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+}
+async function saveBypassSecret(secret) {
+  const path = bypassSecretFile();
+  await mkdir5(dirname5(path), { recursive: true });
+  await writeFile5(path, secret.trim(), { encoding: "utf8", mode: 384 });
+  try {
+    await chmod2(path, 384);
+  } catch {
+  }
+}
+async function clearBypassSecret() {
+  try {
+    await unlink(bypassSecretFile());
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function withBypassHeader(headers) {
+  const secret = await loadBypassSecret();
+  if (secret) {
+    headers["x-vercel-protection-bypass"] = secret;
+  }
+  return headers;
+}
+
+// src/transcript/store.ts
 var NoopTranscriptStore = class {
   async upload() {
     throw new Error("transcript store disabled (transcriptStore.type=none)");
@@ -896,7 +948,7 @@ var BlobTranscriptStore = class {
   token;
   prefix;
   async upload(input) {
-    const body = await readFile5(input.transcriptPath);
+    const body = await readFile6(input.transcriptPath);
     const requestedPath = buildPathname(
       this.prefix,
       input.userHash,
@@ -927,19 +979,16 @@ var AnalyzerTranscriptStore = class {
         "transcript store: not logged in \u2014 run `agent-insights login`"
       );
     }
-    const body = await readFile5(input.transcriptPath);
+    const body = await readFile6(input.transcriptPath);
     const url = new URL("/api/sessions/upload", this.analyzerUrl).toString();
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/jsonl",
-        "x-session-id": input.sessionId,
-        "x-agent": input.agent,
-        "x-user-hash": input.userHash
-      },
-      body
+    const headers = await withBypassHeader({
+      authorization: `Bearer ${token}`,
+      "content-type": "application/jsonl",
+      "x-session-id": input.sessionId,
+      "x-agent": input.agent,
+      "x-user-hash": input.userHash
     });
+    const res = await fetch(url, { method: "POST", headers, body });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
       throw new Error(
@@ -957,27 +1006,43 @@ var AnalyzerTranscriptStore = class {
     };
   }
   async ping() {
-    if (!this.analyzerUrl) {
+    const token = await getValidToken();
+    if (!token) {
       return {
         ok: false,
-        reason: "analyzer URL not set (AGENT_INSIGHTS_ANALYZER_URL)"
+        reason: "not logged in \u2014 run `agent-insights login`"
       };
     }
-    const token = await getValidToken();
-    if (!token) {
+    try {
+      const url = new URL("/api/sessions/upload", this.analyzerUrl).toString();
+      const headers = await withBypassHeader({
+        authorization: `Bearer ${token}`
+      });
+      const res = await fetch(url, { method: "POST", headers });
+      if (res.status === 400) return { ok: true };
+      if (res.status === 401 || res.status === 403) {
+        const ct = res.headers.get("content-type") ?? "";
+        if (ct.includes("text/html")) {
+          return {
+            ok: false,
+            reason: "blocked by Vercel deployment protection \u2014 set a bypass secret via `agent-insights init --bypass-secret <secret>`"
+          };
+        }
+        return { ok: false, reason: `analyzer rejected token (${res.status})` };
+      }
+      return { ok: false, reason: `unexpected status ${res.status}` };
+    } catch (err) {
       return {
         ok: false,
-        reason: "not logged in \u2014 run `agent-insights login`"
+        reason: `analyzer unreachable: ${err.message}`
       };
     }
-    return { ok: true };
   }
 };
 function createTranscriptStore(cfg) {
   if (cfg.type === "none") return new NoopTranscriptStore();
   if (cfg.type === "analyzer") {
-    const analyzerUrl = process.env.AGENT_INSIGHTS_ANALYZER_URL ?? "";
-    return new AnalyzerTranscriptStore(analyzerUrl);
+    return new AnalyzerTranscriptStore(getAnalyzerUrl());
   }
   const token = process.env[cfg.tokenEnv];
   if (!token) {
@@ -1093,9 +1158,9 @@ async function runHook(eventName, opts) {
         size: result.size,
         pathname: result.pathname
       });
-      if (cfg.userConsent.sessionAnalysis && cfg.sessionAnalysis.analyzerUrl) {
+      if (cfg.userConsent.sessionAnalysis) {
         await notifyAnalyzer({
-          analyzerUrl: cfg.sessionAnalysis.analyzerUrl,
+          analyzerUrl: getAnalyzerUrl(),
           payload: {
             sessionId: mapped.sessionId ?? "unknown",
             agent: adapter.id,
@@ -1115,10 +1180,11 @@ async function notifyAnalyzer(opts) {
   try {
     const { getValidToken: getValidToken2 } = await Promise.resolve().then(() => (init_store(), store_exports));
     const token = await getValidToken2();
-    const headers = {
+    const baseHeaders = {
       "content-type": "application/json"
     };
-    if (token) headers["authorization"] = `Bearer ${token}`;
+    if (token) baseHeaders["authorization"] = `Bearer ${token}`;
+    const headers = await withBypassHeader(baseHeaders);
     const url = new URL("/api/sessions", opts.analyzerUrl).toString();
     const res = await fetch(url, {
       method: "POST",
@@ -1207,7 +1273,7 @@ function parseJsonObject(raw) {
 }
 
 // src/commands/init.ts
-import { checkbox, confirm } from "@inquirer/prompts";
+import { checkbox, confirm, password } from "@inquirer/prompts";
 import kleur3 from "kleur";
 init_paths();
 init_store();
@@ -1241,7 +1307,7 @@ async function runInit(opts) {
     }
     log.warn(`Config already exists at ${configFile()}.`);
     const overwrite = await safePrompt(
-      () => confirm({ message: "Overwrite existing config?", default: false })
+      () => confirm({ message: "Overwrite existing config?", default: true })
     );
     if (overwrite === void 0) return;
     if (!overwrite) {
@@ -1259,8 +1325,9 @@ async function runInit(opts) {
     choices = {
       agents: parseAgents(opts.agents),
       transcripts: opts.transcripts ?? true,
-      analysis: opts.analysis ?? false,
-      telemetry: opts.telemetry ?? false
+      analysis: opts.analysis ?? true,
+      telemetry: opts.telemetry ?? true,
+      bypassSecret: opts.bypassSecret
     };
   }
   if (choices.agents.size === 0) {
@@ -1275,6 +1342,15 @@ async function runInit(opts) {
   cfg.agents.cursor.enabled = choices.agents.has("cursor");
   await saveConfig(cfg);
   log.ok(`Wrote config to ${configFile()}`);
+  if (choices.bypassSecret !== void 0) {
+    if (choices.bypassSecret === "") {
+      await clearBypassSecret();
+      log.ok("Cleared stored deployment-protection bypass secret.");
+    } else {
+      await saveBypassSecret(choices.bypassSecret);
+      log.ok("Saved deployment-protection bypass secret.");
+    }
+  }
   const installHooks = opts.hooks ?? true;
   const repoRoot = process.cwd();
   if (installHooks) {
@@ -1313,22 +1389,40 @@ async function promptChoices(opts) {
   const analysis = await safePrompt(
     () => confirm({
       message: "Enable SessionEnd analysis (internal LLM review)?",
-      default: opts.analysis ?? false
+      default: opts.analysis ?? true
     })
   );
   if (analysis === void 0) return void 0;
   const telemetry = await safePrompt(
     () => confirm({
       message: "Send OTLP event telemetry?",
-      default: opts.telemetry ?? false
+      default: opts.telemetry ?? true
     })
   );
   if (telemetry === void 0) return void 0;
+  let bypassSecret;
+  if (opts.bypassSecret !== void 0) {
+    bypassSecret = opts.bypassSecret;
+  } else {
+    const existing = await loadBypassSecret();
+    const answer = await safePrompt(
+      () => password({
+        message: existing ? "Vercel deployment-protection bypass secret (Enter to keep existing, '-' to clear):" : "Vercel deployment-protection bypass secret (Enter to skip):",
+        mask: true
+      })
+    );
+    if (answer === void 0) return void 0;
+    const trimmed = answer.trim();
+    if (trimmed === "") bypassSecret = void 0;
+    else if (trimmed === "-") bypassSecret = "";
+    else bypassSecret = trimmed;
+  }
   return {
     agents: new Set(selected),
     transcripts,
     analysis,
-    telemetry
+    telemetry,
+    bypassSecret
   };
 }
 async function safePrompt(run) {
@@ -1475,7 +1569,7 @@ function yn(v) {
 var program = new Command();
 program.name("agent-insights").description(
   "Internal CLI for AI coding agent observability (Claude Code, Cursor)."
-).version("0.0.10");
+).version("0.0.12");
 program.command("login").description("Authenticate with Vercel (Sign in with Vercel).").action(async () => {
   await runLogin();
 });
@@ -1487,7 +1581,10 @@ program.command("init").description(
 ).option(
   "-a, --agents <list>",
   "Comma-separated agent ids (claude-code,cursor); use '*' for all"
-).option("--transcripts", "Opt into transcript sync to Vercel Blob").option("--no-transcripts", "Skip transcript sync").option("--analysis", "Opt into SessionEnd analysis (Phase 2)").option("--telemetry", "Opt into OTLP event telemetry (Phase 3)").option("--no-hooks", "Skip installing per-agent hooks").option("--force", "Overwrite existing config").option("-y, --yes", "Non-interactive \u2014 accept defaults / passed flags").action(async (opts) => {
+).option("--transcripts", "Opt into transcript sync to Vercel Blob").option("--no-transcripts", "Skip transcript sync").option("--analysis", "Opt into SessionEnd analysis (Phase 2)").option("--telemetry", "Opt into OTLP event telemetry (Phase 3)").option("--no-hooks", "Skip installing per-agent hooks").option("--force", "Overwrite existing config").option("-y, --yes", "Non-interactive \u2014 accept defaults / passed flags").option(
+  "--bypass-secret <secret>",
+  "Vercel deployment-protection bypass secret (use '' to clear)"
+).action(async (opts) => {
   await runInit(opts);
 });
 program.command("status").description("Show current config, consent, and adapter state.").option("--json", "Emit machine-readable JSON").action(async (opts) => {