agent-insights 0.0.10 → 0.0.13

package/dist/cli.js

@@ -21,6 +21,9 @@ function configFile() {
 function authFile() {
   return join(configRoot(), "auth.json");
 }
+function bypassSecretFile() {
+  return join(configRoot(), "bypass-secret");
+}
 function sessionCacheDir() {
   return join(configRoot(), "session-cache");
 }
@@ -219,11 +222,15 @@ __export(store_exports, {
   clearAuth: () => clearAuth,
   getValidToken: () => getValidToken,
   loadAuth: () => loadAuth,
+  loadEmail: () => loadEmail,
   saveAuth: () => saveAuth
 });
 import { chmod, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
 import { dirname as dirname4 } from "path";
 import { mkdir as mkdir4 } from "fs/promises";
+async function loadEmail() {
+  return (await loadAuth())?.email;
+}
 async function loadAuth() {
   try {
     const raw = await readFile4(authFile(), "utf8");
@@ -251,9 +258,9 @@ async function saveAuth(state) {
   }
 }
 async function clearAuth() {
-  const { unlink } = await import("fs/promises");
+  const { unlink: unlink2 } = await import("fs/promises");
   try {
-    await unlink(authFile());
+    await unlink2(authFile());
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -272,7 +279,8 @@ async function getValidToken() {
     const refreshed = {
       accessToken: tokens.access_token,
       refreshToken: tokens.refresh_token ?? auth.refreshToken,
-      expiresAt: Date.now() + tokens.expires_in * 1e3
+      expiresAt: Date.now() + tokens.expires_in * 1e3,
+      ...auth.email ? { email: auth.email } : {}
     };
     await saveAuth(refreshed);
     return refreshed.accessToken;
@@ -299,9 +307,17 @@ import { spawn } from "child_process";
 import { randomUUID } from "crypto";
 
 // src/config/config.ts
-init_paths();
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { dirname } from "path";
+
+// src/config/analyzer.ts
+var DEFAULT_ANALYZER_URL = "https://agent-insights.labs.vercel.dev";
+function getAnalyzerUrl() {
+  return process.env.AGENT_INSIGHTS_ANALYZER_URL || DEFAULT_ANALYZER_URL;
+}
+
+// src/config/config.ts
+init_paths();
 function defaultConfig() {
   return {
     version: 1,
@@ -330,7 +346,7 @@ function defaultConfig() {
     },
     sessionAnalysis: {
       enabled: false,
-      analyzerUrl: process.env.AGENT_INSIGHTS_ANALYZER_URL ?? "",
+      analyzerUrl: getAnalyzerUrl(),
       githubIssueRepo: "vercel-labs/agent-insights"
     },
     agents: {
@@ -647,16 +663,15 @@ var claudeCodeAdapter = {
     const path = resolveClaudePath(repoRoot, scope);
     const settings = await readJson(path);
     const next = { ...settings ?? {} };
-    const hooks = { ...next.hooks ?? {} };
+    const hooks = {};
+    for (const [event, raw] of Object.entries(next.hooks ?? {})) {
+      hooks[event] = normalizeEventHooks(raw);
+    }
     for (const event of CLAUDE_HOOK_EVENTS) {
-      const existing = (hooks[event] ?? []).filter(
-        (h) => !isAgentInsightsCommand(h.command)
+      const withoutInsights = removeAgentInsightsMatchers(
+        hooks[event] ?? []
       );
-      existing.push({
-        type: "command",
-        command: `${HOOK_COMMAND_NAME} hook ${event}`
-      });
-      hooks[event] = existing;
+      hooks[event] = addAgentInsightsHook(withoutInsights, event);
     }
     next.hooks = hooks;
     await mkdir2(dirname2(path), { recursive: true });
@@ -668,18 +683,16 @@ var claudeCodeAdapter = {
     const path = resolveClaudePath(repoRoot, scope);
     const settings = await readJson(path);
     if (!settings?.hooks) return { removed: false, path };
-    const hooks = { ...settings.hooks };
+    const hooks = {};
     let touched = false;
-    for (const [event, entries] of Object.entries(hooks)) {
-      const filtered = entries.filter(
-        (h) => !isAgentInsightsCommand(h.command)
-      );
-      if (filtered.length !== entries.length) touched = true;
-      if (filtered.length === 0) {
-        delete hooks[event];
-      } else {
-        hooks[event] = filtered;
+    for (const [event, raw] of Object.entries(settings.hooks)) {
+      const before = normalizeEventHooks(raw);
+      const after = removeAgentInsightsMatchers(before);
+      if (after.length !== before.length) touched = true;
+      else if (JSON.stringify(after) !== JSON.stringify(before)) {
+        touched = true;
       }
+      if (after.length > 0) hooks[event] = after;
     }
     settings.hooks = hooks;
     await writeFile2(path, `${JSON.stringify(settings, null, 2)}
@@ -692,7 +705,9 @@ var claudeCodeAdapter = {
     );
     if (!settings?.hooks) return false;
     return Object.values(settings.hooks).some(
-      (entries) => entries.some((h) => isAgentInsightsCommand(h.command))
+      (raw) => normalizeEventHooks(raw).some(
+        (group) => group.hooks.some((h) => isAgentInsightsCommand(h.command))
+      )
     );
   }
 };
@@ -703,6 +718,59 @@ function isAgentInsightsCommand(cmd) {
   if (!cmd) return false;
   return cmd.startsWith(`${HOOK_COMMAND_NAME} hook`);
 }
+function isHookCommand(value) {
+  if (!value || typeof value !== "object") return false;
+  const entry = value;
+  return entry.type === "command" && typeof entry.command === "string";
+}
+function normalizeEventHooks(raw) {
+  const groups = [];
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry;
+    if (Array.isArray(record.hooks)) {
+      const commands = record.hooks.filter(isHookCommand);
+      if (commands.length === 0) continue;
+      groups.push({
+        matcher: typeof record.matcher === "string" ? record.matcher : "",
+        hooks: commands
+      });
+      continue;
+    }
+    if (isHookCommand(record)) {
+      groups.push({
+        matcher: "",
+        hooks: [record]
+      });
+    }
+  }
+  return groups;
+}
+function removeAgentInsightsMatchers(matchers) {
+  const result = [];
+  for (const group of matchers) {
+    const hooks = group.hooks.filter(
+      (h) => !isAgentInsightsCommand(h.command)
+    );
+    if (hooks.length > 0) {
+      result.push({ ...group, hooks });
+    }
+  }
+  return result;
+}
+function addAgentInsightsHook(matchers, event) {
+  const command = `${HOOK_COMMAND_NAME} hook ${event}`;
+  const entry = { type: "command", command };
+  for (const group of matchers) {
+    if (group.matcher === "") {
+      if (!group.hooks.some((h) => h.command === command)) {
+        group.hooks.push(entry);
+      }
+      return matchers;
+    }
+  }
+  return [...matchers, { matcher: "", hooks: [entry] }];
+}
 async function readJson(path) {
   try {
     const raw = await readFile2(path, "utf8");
@@ -878,8 +946,49 @@ init_store();
 
 // src/transcript/store.ts
 init_store();
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { put } from "@vercel/blob";
+
+// src/config/bypass.ts
+init_paths();
+import { chmod as chmod2, mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname5 } from "path";
+async function loadBypassSecret() {
+  const fromEnv = process.env.AGENT_INSIGHTS_BYPASS_SECRET || process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+  if (fromEnv) return fromEnv;
+  try {
+    const raw = (await readFile5(bypassSecretFile(), "utf8")).trim();
+    return raw || void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+}
+async function saveBypassSecret(secret) {
+  const path = bypassSecretFile();
+  await mkdir5(dirname5(path), { recursive: true });
+  await writeFile5(path, secret.trim(), { encoding: "utf8", mode: 384 });
+  try {
+    await chmod2(path, 384);
+  } catch {
+  }
+}
+async function clearBypassSecret() {
+  try {
+    await unlink(bypassSecretFile());
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function withBypassHeader(headers) {
+  const secret = await loadBypassSecret();
+  if (secret) {
+    headers["x-vercel-protection-bypass"] = secret;
+  }
+  return headers;
+}
+
+// src/transcript/store.ts
 var NoopTranscriptStore = class {
   async upload() {
     throw new Error("transcript store disabled (transcriptStore.type=none)");
@@ -896,7 +1005,7 @@ var BlobTranscriptStore = class {
   token;
   prefix;
   async upload(input) {
-    const body = await readFile5(input.transcriptPath);
+    const body = await readFile6(input.transcriptPath);
     const requestedPath = buildPathname(
       this.prefix,
       input.userHash,
@@ -927,19 +1036,17 @@ var AnalyzerTranscriptStore = class {
         "transcript store: not logged in \u2014 run `agent-insights login`"
       );
     }
-    const body = await readFile5(input.transcriptPath);
+    const body = await readFile6(input.transcriptPath);
     const url = new URL("/api/sessions/upload", this.analyzerUrl).toString();
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/jsonl",
-        "x-session-id": input.sessionId,
-        "x-agent": input.agent,
-        "x-user-hash": input.userHash
-      },
-      body
+    const headers = await withBypassHeader({
+      authorization: `Bearer ${token}`,
+      "content-type": "application/jsonl",
+      "x-session-id": input.sessionId,
+      "x-agent": input.agent,
+      "x-user-hash": input.userHash,
+      ...input.userEmail ? { "x-user-email": input.userEmail } : {}
     });
+    const res = await fetch(url, { method: "POST", headers, body });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
       throw new Error(
@@ -957,27 +1064,43 @@ var AnalyzerTranscriptStore = class {
     };
   }
   async ping() {
-    if (!this.analyzerUrl) {
+    const token = await getValidToken();
+    if (!token) {
       return {
         ok: false,
-        reason: "analyzer URL not set (AGENT_INSIGHTS_ANALYZER_URL)"
+        reason: "not logged in \u2014 run `agent-insights login`"
       };
     }
-    const token = await getValidToken();
-    if (!token) {
+    try {
+      const url = new URL("/api/sessions/upload", this.analyzerUrl).toString();
+      const headers = await withBypassHeader({
+        authorization: `Bearer ${token}`
+      });
+      const res = await fetch(url, { method: "POST", headers });
+      if (res.status === 400) return { ok: true };
+      if (res.status === 401 || res.status === 403) {
+        const ct = res.headers.get("content-type") ?? "";
+        if (ct.includes("text/html")) {
+          return {
+            ok: false,
+            reason: "blocked by Vercel deployment protection \u2014 set a bypass secret via `agent-insights init --bypass-secret <secret>`"
+          };
+        }
+        return { ok: false, reason: `analyzer rejected token (${res.status})` };
+      }
+      return { ok: false, reason: `unexpected status ${res.status}` };
+    } catch (err) {
       return {
         ok: false,
-        reason: "not logged in \u2014 run `agent-insights login`"
+        reason: `analyzer unreachable: ${err.message}`
       };
     }
-    return { ok: true };
   }
 };
 function createTranscriptStore(cfg) {
   if (cfg.type === "none") return new NoopTranscriptStore();
   if (cfg.type === "analyzer") {
-    const analyzerUrl = process.env.AGENT_INSIGHTS_ANALYZER_URL ?? "";
-    return new AnalyzerTranscriptStore(analyzerUrl);
+    return new AnalyzerTranscriptStore(getAnalyzerUrl());
   }
   const token = process.env[cfg.tokenEnv];
   if (!token) {
@@ -1055,6 +1178,7 @@ async function runDoctor(opts) {
 }
 
 // src/commands/hook.ts
+init_store();
 async function runHook(eventName, opts) {
   const cfg = await loadConfig();
   if (!cfg || !cfg.enabled) {
@@ -1083,19 +1207,21 @@ async function runHook(eventName, opts) {
   if (mapped.type === "session.end" && cfg.userConsent.transcriptSync && mapped.transcriptPath) {
     try {
       const store = createTranscriptStore(cfg.transcriptStore);
+      const userEmail = await loadEmail();
       const result = await store.upload({
         transcriptPath: mapped.transcriptPath,
         userHash: event.userHash ?? userHash(),
         sessionId: mapped.sessionId ?? "unknown",
-        agent: adapter.id
+        agent: adapter.id,
+        ...userEmail ? { userEmail } : {}
       });
       debug("transcript uploaded", {
         size: result.size,
         pathname: result.pathname
       });
-      if (cfg.userConsent.sessionAnalysis && cfg.sessionAnalysis.analyzerUrl) {
+      if (cfg.userConsent.sessionAnalysis) {
         await notifyAnalyzer({
-          analyzerUrl: cfg.sessionAnalysis.analyzerUrl,
+          analyzerUrl: getAnalyzerUrl(),
           payload: {
             sessionId: mapped.sessionId ?? "unknown",
             agent: adapter.id,
@@ -1115,10 +1241,11 @@ async function notifyAnalyzer(opts) {
   try {
     const { getValidToken: getValidToken2 } = await Promise.resolve().then(() => (init_store(), store_exports));
     const token = await getValidToken2();
-    const headers = {
+    const baseHeaders = {
       "content-type": "application/json"
     };
-    if (token) headers["authorization"] = `Bearer ${token}`;
+    if (token) baseHeaders["authorization"] = `Bearer ${token}`;
+    const headers = await withBypassHeader(baseHeaders);
     const url = new URL("/api/sessions", opts.analyzerUrl).toString();
     const res = await fetch(url, {
       method: "POST",
@@ -1207,7 +1334,7 @@ function parseJsonObject(raw) {
 }
 
 // src/commands/init.ts
-import { checkbox, confirm } from "@inquirer/prompts";
+import { checkbox, confirm, password } from "@inquirer/prompts";
 import kleur3 from "kleur";
 init_paths();
 init_store();
@@ -1241,7 +1368,7 @@ async function runInit(opts) {
     }
     log.warn(`Config already exists at ${configFile()}.`);
     const overwrite = await safePrompt(
-      () => confirm({ message: "Overwrite existing config?", default: false })
+      () => confirm({ message: "Overwrite existing config?", default: true })
     );
     if (overwrite === void 0) return;
     if (!overwrite) {
@@ -1259,8 +1386,9 @@ async function runInit(opts) {
     choices = {
       agents: parseAgents(opts.agents),
       transcripts: opts.transcripts ?? true,
-      analysis: opts.analysis ?? false,
-      telemetry: opts.telemetry ?? false
+      analysis: opts.analysis ?? true,
+      telemetry: opts.telemetry ?? true,
+      bypassSecret: opts.bypassSecret
     };
   }
   if (choices.agents.size === 0) {
@@ -1275,6 +1403,15 @@ async function runInit(opts) {
   cfg.agents.cursor.enabled = choices.agents.has("cursor");
   await saveConfig(cfg);
   log.ok(`Wrote config to ${configFile()}`);
+  if (choices.bypassSecret !== void 0) {
+    if (choices.bypassSecret === "") {
+      await clearBypassSecret();
+      log.ok("Cleared stored deployment-protection bypass secret.");
+    } else {
+      await saveBypassSecret(choices.bypassSecret);
+      log.ok("Saved deployment-protection bypass secret.");
+    }
+  }
   const installHooks = opts.hooks ?? true;
   const repoRoot = process.cwd();
   if (installHooks) {
@@ -1313,22 +1450,40 @@ async function promptChoices(opts) {
   const analysis = await safePrompt(
     () => confirm({
       message: "Enable SessionEnd analysis (internal LLM review)?",
-      default: opts.analysis ?? false
+      default: opts.analysis ?? true
     })
   );
   if (analysis === void 0) return void 0;
   const telemetry = await safePrompt(
     () => confirm({
       message: "Send OTLP event telemetry?",
-      default: opts.telemetry ?? false
+      default: opts.telemetry ?? true
     })
   );
   if (telemetry === void 0) return void 0;
+  let bypassSecret;
+  if (opts.bypassSecret !== void 0) {
+    bypassSecret = opts.bypassSecret;
+  } else {
+    const existing = await loadBypassSecret();
+    const answer = await safePrompt(
+      () => password({
+        message: existing ? "Vercel deployment-protection bypass secret (Enter to keep existing, '-' to clear):" : "Vercel deployment-protection bypass secret (Enter to skip):",
+        mask: true
+      })
+    );
+    if (answer === void 0) return void 0;
+    const trimmed = answer.trim();
+    if (trimmed === "") bypassSecret = void 0;
+    else if (trimmed === "-") bypassSecret = "";
+    else bypassSecret = trimmed;
+  }
   return {
     agents: new Set(selected),
     transcripts,
     analysis,
-    telemetry
+    telemetry,
+    bypassSecret
   };
 }
 async function safePrompt(run) {
@@ -1399,7 +1554,8 @@ async function runLogin() {
   await saveAuth({
     accessToken: tokens.access_token,
     ...tokens.refresh_token !== void 0 ? { refreshToken: tokens.refresh_token } : {},
-    expiresAt: Date.now() + tokens.expires_in * 1e3
+    expiresAt: Date.now() + tokens.expires_in * 1e3,
+    email: userInfo2.email
   });
   const name = userInfo2.preferred_username ?? userInfo2.email;
   log.ok(`Logged in as ${kleur4.bold(name)} (${userInfo2.email})`);
@@ -1475,7 +1631,7 @@ function yn(v) {
 var program = new Command();
 program.name("agent-insights").description(
   "Internal CLI for AI coding agent observability (Claude Code, Cursor)."
-).version("0.0.10");
+).version("0.0.13");
 program.command("login").description("Authenticate with Vercel (Sign in with Vercel).").action(async () => {
   await runLogin();
 });
@@ -1487,7 +1643,10 @@ program.command("init").description(
 ).option(
   "-a, --agents <list>",
   "Comma-separated agent ids (claude-code,cursor); use '*' for all"
-).option("--transcripts", "Opt into transcript sync to Vercel Blob").option("--no-transcripts", "Skip transcript sync").option("--analysis", "Opt into SessionEnd analysis (Phase 2)").option("--telemetry", "Opt into OTLP event telemetry (Phase 3)").option("--no-hooks", "Skip installing per-agent hooks").option("--force", "Overwrite existing config").option("-y, --yes", "Non-interactive \u2014 accept defaults / passed flags").action(async (opts) => {
+).option("--transcripts", "Opt into transcript sync to Vercel Blob").option("--no-transcripts", "Skip transcript sync").option("--analysis", "Opt into SessionEnd analysis (Phase 2)").option("--telemetry", "Opt into OTLP event telemetry (Phase 3)").option("--no-hooks", "Skip installing per-agent hooks").option("--force", "Overwrite existing config").option("-y, --yes", "Non-interactive \u2014 accept defaults / passed flags").option(
+  "--bypass-secret <secret>",
+  "Vercel deployment-protection bypass secret (use '' to clear)"
+).action(async (opts) => {
   await runInit(opts);
 });
 program.command("status").description("Show current config, consent, and adapter state.").option("--json", "Emit machine-readable JSON").action(async (opts) => {