agent-insights 0.0.9 → 0.0.12

package/dist/cli.js

@@ -21,6 +21,9 @@ function configFile() {
 function authFile() {
   return join(configRoot(), "auth.json");
 }
+function bypassSecretFile() {
+  return join(configRoot(), "bypass-secret");
+}
 function sessionCacheDir() {
   return join(configRoot(), "session-cache");
 }
@@ -251,9 +254,9 @@ async function saveAuth(state) {
   }
 }
 async function clearAuth() {
-  const { unlink } = await import("fs/promises");
+  const { unlink: unlink2 } = await import("fs/promises");
   try {
-    await unlink(authFile());
+    await unlink2(authFile());
   } catch (err) {
     if (err.code !== "ENOENT") throw err;
   }
@@ -299,9 +302,17 @@ import { spawn } from "child_process";
 import { randomUUID } from "crypto";
 
 // src/config/config.ts
-init_paths();
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { dirname } from "path";
+
+// src/config/analyzer.ts
+var DEFAULT_ANALYZER_URL = "https://agent-insights.labs.vercel.dev";
+function getAnalyzerUrl() {
+  return process.env.AGENT_INSIGHTS_ANALYZER_URL || DEFAULT_ANALYZER_URL;
+}
+
+// src/config/config.ts
+init_paths();
 function defaultConfig() {
   return {
     version: 1,
@@ -330,7 +341,7 @@ function defaultConfig() {
     },
     sessionAnalysis: {
       enabled: false,
-      analyzerUrl: process.env.AGENT_INSIGHTS_ANALYZER_URL ?? "",
+      analyzerUrl: getAnalyzerUrl(),
       githubIssueRepo: "vercel-labs/agent-insights"
     },
     agents: {
@@ -878,8 +889,49 @@ init_store();
 
 // src/transcript/store.ts
 init_store();
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { put } from "@vercel/blob";
+
+// src/config/bypass.ts
+init_paths();
+import { chmod as chmod2, mkdir as mkdir5, readFile as readFile5, unlink, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname5 } from "path";
+async function loadBypassSecret() {
+  const fromEnv = process.env.AGENT_INSIGHTS_BYPASS_SECRET || process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+  if (fromEnv) return fromEnv;
+  try {
+    const raw = (await readFile5(bypassSecretFile(), "utf8")).trim();
+    return raw || void 0;
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+}
+async function saveBypassSecret(secret) {
+  const path = bypassSecretFile();
+  await mkdir5(dirname5(path), { recursive: true });
+  await writeFile5(path, secret.trim(), { encoding: "utf8", mode: 384 });
+  try {
+    await chmod2(path, 384);
+  } catch {
+  }
+}
+async function clearBypassSecret() {
+  try {
+    await unlink(bypassSecretFile());
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+}
+async function withBypassHeader(headers) {
+  const secret = await loadBypassSecret();
+  if (secret) {
+    headers["x-vercel-protection-bypass"] = secret;
+  }
+  return headers;
+}
+
+// src/transcript/store.ts
 var NoopTranscriptStore = class {
   async upload() {
     throw new Error("transcript store disabled (transcriptStore.type=none)");
@@ -896,7 +948,7 @@ var BlobTranscriptStore = class {
   token;
   prefix;
   async upload(input) {
-    const body = await readFile5(input.transcriptPath);
+    const body = await readFile6(input.transcriptPath);
     const requestedPath = buildPathname(
       this.prefix,
       input.userHash,
@@ -927,19 +979,16 @@ var AnalyzerTranscriptStore = class {
         "transcript store: not logged in \u2014 run `agent-insights login`"
       );
     }
-    const body = await readFile5(input.transcriptPath);
+    const body = await readFile6(input.transcriptPath);
     const url = new URL("/api/sessions/upload", this.analyzerUrl).toString();
-    const res = await fetch(url, {
-      method: "POST",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/jsonl",
-        "x-session-id": input.sessionId,
-        "x-agent": input.agent,
-        "x-user-hash": input.userHash
-      },
-      body
+    const headers = await withBypassHeader({
+      authorization: `Bearer ${token}`,
+      "content-type": "application/jsonl",
+      "x-session-id": input.sessionId,
+      "x-agent": input.agent,
+      "x-user-hash": input.userHash
     });
+    const res = await fetch(url, { method: "POST", headers, body });
     if (!res.ok) {
       const text = await res.text().catch(() => "");
       throw new Error(
@@ -957,27 +1006,43 @@ var AnalyzerTranscriptStore = class {
     };
   }
   async ping() {
-    if (!this.analyzerUrl) {
+    const token = await getValidToken();
+    if (!token) {
       return {
         ok: false,
-        reason: "analyzer URL not set (AGENT_INSIGHTS_ANALYZER_URL)"
+        reason: "not logged in \u2014 run `agent-insights login`"
       };
     }
-    const token = await getValidToken();
-    if (!token) {
+    try {
+      const url = new URL("/api/sessions/upload", this.analyzerUrl).toString();
+      const headers = await withBypassHeader({
+        authorization: `Bearer ${token}`
+      });
+      const res = await fetch(url, { method: "POST", headers });
+      if (res.status === 400) return { ok: true };
+      if (res.status === 401 || res.status === 403) {
+        const ct = res.headers.get("content-type") ?? "";
+        if (ct.includes("text/html")) {
+          return {
+            ok: false,
+            reason: "blocked by Vercel deployment protection \u2014 set a bypass secret via `agent-insights init --bypass-secret <secret>`"
+          };
+        }
+        return { ok: false, reason: `analyzer rejected token (${res.status})` };
+      }
+      return { ok: false, reason: `unexpected status ${res.status}` };
+    } catch (err) {
       return {
         ok: false,
-        reason: "not logged in \u2014 run `agent-insights login`"
+        reason: `analyzer unreachable: ${err.message}`
       };
     }
-    return { ok: true };
   }
 };
 function createTranscriptStore(cfg) {
   if (cfg.type === "none") return new NoopTranscriptStore();
   if (cfg.type === "analyzer") {
-    const analyzerUrl = process.env.AGENT_INSIGHTS_ANALYZER_URL ?? "";
-    return new AnalyzerTranscriptStore(analyzerUrl);
+    return new AnalyzerTranscriptStore(getAnalyzerUrl());
   }
   const token = process.env[cfg.tokenEnv];
   if (!token) {
@@ -1093,9 +1158,9 @@ async function runHook(eventName, opts) {
         size: result.size,
         pathname: result.pathname
       });
-      if (cfg.userConsent.sessionAnalysis && cfg.sessionAnalysis.analyzerUrl) {
+      if (cfg.userConsent.sessionAnalysis) {
         await notifyAnalyzer({
-          analyzerUrl: cfg.sessionAnalysis.analyzerUrl,
+          analyzerUrl: getAnalyzerUrl(),
           payload: {
             sessionId: mapped.sessionId ?? "unknown",
             agent: adapter.id,
@@ -1115,10 +1180,11 @@ async function notifyAnalyzer(opts) {
   try {
     const { getValidToken: getValidToken2 } = await Promise.resolve().then(() => (init_store(), store_exports));
     const token = await getValidToken2();
-    const headers = {
+    const baseHeaders = {
       "content-type": "application/json"
     };
-    if (token) headers["authorization"] = `Bearer ${token}`;
+    if (token) baseHeaders["authorization"] = `Bearer ${token}`;
+    const headers = await withBypassHeader(baseHeaders);
     const url = new URL("/api/sessions", opts.analyzerUrl).toString();
     const res = await fetch(url, {
       method: "POST",
@@ -1207,7 +1273,7 @@ function parseJsonObject(raw) {
 }
 
 // src/commands/init.ts
-import { createInterface } from "readline/promises";
+import { checkbox, confirm, password } from "@inquirer/prompts";
 import kleur3 from "kleur";
 init_paths();
 init_store();
@@ -1232,33 +1298,43 @@ async function runInit(opts) {
   log.info("");
   const existing = await loadConfig();
   const interactive = !opts.yes && Boolean(process.stdin.isTTY && process.stdout.isTTY);
-  let choices;
-  if (interactive) {
-    choices = await promptChoices(opts, existing !== null);
-  } else {
-    if (existing && !opts.force) {
+  if (existing && !opts.force) {
+    if (!interactive) {
       log.warn(
         `Config already exists at ${configFile()} \u2014 re-run with --force to overwrite, or use interactive mode.`
       );
       return;
     }
+    log.warn(`Config already exists at ${configFile()}.`);
+    const overwrite = await safePrompt(
+      () => confirm({ message: "Overwrite existing config?", default: true })
+    );
+    if (overwrite === void 0) return;
+    if (!overwrite) {
+      log.info("Aborted \u2014 existing config left in place.");
+      return;
+    }
+    log.info("");
+  }
+  let choices;
+  if (interactive) {
+    const result = await promptChoices(opts);
+    if (!result) return;
+    choices = result;
+  } else {
     choices = {
       agents: parseAgents(opts.agents),
       transcripts: opts.transcripts ?? true,
-      analysis: opts.analysis ?? false,
-      telemetry: opts.telemetry ?? false,
-      overwrite: true
+      analysis: opts.analysis ?? true,
+      telemetry: opts.telemetry ?? true,
+      bypassSecret: opts.bypassSecret
     };
   }
-  if (existing && !choices.overwrite) {
-    log.info("Aborted \u2014 existing config left in place.");
-    return;
-  }
   if (choices.agents.size === 0) {
     log.fail("No agents selected \u2014 nothing to install.");
     process.exit(1);
   }
-  const cfg = existing ?? defaultConfig();
+  const cfg = defaultConfig();
   cfg.userConsent.transcriptSync = choices.transcripts;
   cfg.userConsent.sessionAnalysis = choices.analysis;
   cfg.userConsent.eventTelemetry = choices.telemetry;
@@ -1266,6 +1342,15 @@ async function runInit(opts) {
   cfg.agents.cursor.enabled = choices.agents.has("cursor");
   await saveConfig(cfg);
   log.ok(`Wrote config to ${configFile()}`);
+  if (choices.bypassSecret !== void 0) {
+    if (choices.bypassSecret === "") {
+      await clearBypassSecret();
+      log.ok("Cleared stored deployment-protection bypass secret.");
+    } else {
+      await saveBypassSecret(choices.bypassSecret);
+      log.ok("Saved deployment-protection bypass secret.");
+    }
+  }
   const installHooks = opts.hooks ?? true;
   const repoRoot = process.cwd();
   if (installHooks) {
@@ -1280,65 +1365,85 @@ async function runInit(opts) {
   log.info(`Config root: ${configRoot()}`);
   log.hint("Run `agent-insights doctor` to verify the setup.");
 }
-async function promptChoices(opts, hasExisting) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    let overwrite = true;
-    if (hasExisting && !opts.force) {
-      log.warn(`Config already exists at ${configFile()}.`);
-      overwrite = await confirm(rl, "Overwrite existing config?", false);
-      if (!overwrite) return emptyChoices();
-    }
-    log.info("");
-    log.info(kleur3.bold("Which agents would you like to install hooks for?"));
-    const agents = /* @__PURE__ */ new Set();
-    const requested = opts.agents ? parseAgents(opts.agents) : null;
-    for (const adapter of adapterList) {
-      const defaultYes = requested ? requested.has(adapter.id) : true;
-      const enabled = await confirm(rl, `  ${adapter.label}?`, defaultYes);
-      if (enabled) agents.add(adapter.id);
-    }
-    log.info("");
-    log.info(kleur3.bold("Consent options:"));
-    const transcripts = await confirm(
-      rl,
-      "  Sync session transcripts to Vercel Blob?",
-      opts.transcripts ?? true
-    );
-    const analysis = await confirm(
-      rl,
-      "  Enable SessionEnd analysis (internal LLM review)?",
-      opts.analysis ?? false
-    );
-    const telemetry = await confirm(
-      rl,
-      "  Send OTLP event telemetry?",
-      opts.telemetry ?? false
+async function promptChoices(opts) {
+  const requested = opts.agents ? parseAgents(opts.agents) : null;
+  const selected = await safePrompt(
+    () => checkbox({
+      message: "Which agents would you like to install hooks for?",
+      choices: adapterList.map((adapter) => ({
+        name: adapter.label,
+        value: adapter.id,
+        checked: requested ? requested.has(adapter.id) : true
+      })),
+      required: true
+    })
+  );
+  if (selected === void 0) return void 0;
+  const transcripts = await safePrompt(
+    () => confirm({
+      message: "Sync session transcripts to Vercel Blob?",
+      default: opts.transcripts ?? true
+    })
+  );
+  if (transcripts === void 0) return void 0;
+  const analysis = await safePrompt(
+    () => confirm({
+      message: "Enable SessionEnd analysis (internal LLM review)?",
+      default: opts.analysis ?? true
+    })
+  );
+  if (analysis === void 0) return void 0;
+  const telemetry = await safePrompt(
+    () => confirm({
+      message: "Send OTLP event telemetry?",
+      default: opts.telemetry ?? true
+    })
+  );
+  if (telemetry === void 0) return void 0;
+  let bypassSecret;
+  if (opts.bypassSecret !== void 0) {
+    bypassSecret = opts.bypassSecret;
+  } else {
+    const existing = await loadBypassSecret();
+    const answer = await safePrompt(
+      () => password({
+        message: existing ? "Vercel deployment-protection bypass secret (Enter to keep existing, '-' to clear):" : "Vercel deployment-protection bypass secret (Enter to skip):",
+        mask: true
+      })
     );
-    log.info("");
-    return { agents, transcripts, analysis, telemetry, overwrite };
-  } finally {
-    rl.close();
+    if (answer === void 0) return void 0;
+    const trimmed = answer.trim();
+    if (trimmed === "") bypassSecret = void 0;
+    else if (trimmed === "-") bypassSecret = "";
+    else bypassSecret = trimmed;
   }
-}
-function emptyChoices() {
   return {
-    agents: /* @__PURE__ */ new Set(),
-    transcripts: false,
-    analysis: false,
-    telemetry: false,
-    overwrite: false
+    agents: new Set(selected),
+    transcripts,
+    analysis,
+    telemetry,
+    bypassSecret
   };
 }
-async function confirm(rl, question, defaultYes) {
-  const suffix = defaultYes ? "[Y/n]" : "[y/N]";
-  const answer = (await rl.question(`${question} ${suffix} `)).trim().toLowerCase();
-  if (!answer) return defaultYes;
-  return answer.startsWith("y");
+async function safePrompt(run) {
+  try {
+    return await run();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "ExitPromptError" || err.name === "AbortPromptError")) {
+      log.info("Aborted.");
+      return void 0;
+    }
+    throw err;
+  }
 }
 function parseAgents(value) {
   const out = /* @__PURE__ */ new Set();
-  const list = (value ?? "claude-code,cursor").split(",").map((s) => s.trim()).filter(Boolean);
+  const trimmed = (value ?? "").trim();
+  if (trimmed === "*") {
+    for (const a of adapterList) out.add(a.id);
+    return out;
+  }
+  const list = (trimmed || "claude-code,cursor").split(",").map((s) => s.trim()).filter(Boolean);
   for (const id of list) {
     if (id === "claude-code" || id === "cursor") out.add(id);
     else log.warn(`Unknown agent id "${id}" \u2014 skipping.`);
@@ -1464,7 +1569,7 @@ function yn(v) {
 var program = new Command();
 program.name("agent-insights").description(
   "Internal CLI for AI coding agent observability (Claude Code, Cursor)."
-).version("0.0.9");
+).version("0.0.12");
 program.command("login").description("Authenticate with Vercel (Sign in with Vercel).").action(async () => {
   await runLogin();
 });
@@ -1474,9 +1579,12 @@ program.command("logout").description("Clear stored credentials.").action(async
 program.command("init").description(
   "Install agent hooks globally. Interactive by default; use --yes for non-interactive."
 ).option(
-  "--agents <list>",
-  "Comma-separated agent ids (claude-code,cursor)"
-).option("--transcripts", "Opt into transcript sync to Vercel Blob").option("--no-transcripts", "Skip transcript sync").option("--analysis", "Opt into SessionEnd analysis (Phase 2)").option("--telemetry", "Opt into OTLP event telemetry (Phase 3)").option("--no-hooks", "Skip installing per-agent hooks").option("--force", "Overwrite existing config").option("-y, --yes", "Non-interactive \u2014 accept defaults / passed flags").action(async (opts) => {
+  "-a, --agents <list>",
+  "Comma-separated agent ids (claude-code,cursor); use '*' for all"
+).option("--transcripts", "Opt into transcript sync to Vercel Blob").option("--no-transcripts", "Skip transcript sync").option("--analysis", "Opt into SessionEnd analysis (Phase 2)").option("--telemetry", "Opt into OTLP event telemetry (Phase 3)").option("--no-hooks", "Skip installing per-agent hooks").option("--force", "Overwrite existing config").option("-y, --yes", "Non-interactive \u2014 accept defaults / passed flags").option(
+  "--bypass-secret <secret>",
+  "Vercel deployment-protection bypass secret (use '' to clear)"
+).action(async (opts) => {
   await runInit(opts);
 });
 program.command("status").description("Show current config, consent, and adapter state.").option("--json", "Emit machine-readable JSON").action(async (opts) => {