ai-spend-agent 0.9.8 → 0.9.10

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { beginWorkspaceEnrollment, finishWorkspaceEnrollment, workspaceStatus, prepareWorkspacePush, sendWorkspacePending, disconnectWorkspace, WORKSPACE_ORIGIN, workspaceCanonicalJson, } from "./workspaceConnect.js";
+import { beginWorkspaceEnrollment, finishWorkspaceEnrollment, workspaceStatus, prepareWorkspacePush, sendWorkspacePending, disconnectWorkspace, WORKSPACE_ORIGIN, workspaceCanonicalJson, WorkspaceEnrollmentRefusal, } from "./workspaceConnect.js";
 import { workspaceClock } from "./lib/clock.js";
 import { randomUUID } from "node:crypto";
 import { realpathSync } from "node:fs";
@@ -1063,6 +1063,14 @@ async function workspaceCommand(args, runtime) {
             const status = await workspaceStatus(runtime.homeDirectory);
             if (status.state === "not_connected")
                 return ok("This machine has no completed local Workspace pairing. No logs or network were read.");
+            if (status.state === "enrollment_pending")
+                return ok([
+                    `Unfinished connection request: ${status.requestId.slice(-8)}`,
+                    status.enrollment === "prepared"
+                        ? "No native exchange was attempted. Run npx aibill@latest workspace connect to display this request again, or npx aibill@latest workspace connect --restart to replace an expired or cancelled request."
+                        : `The exchange outcome is unknown. Local keys remain. Do not restart or replay; reconcile this machine at ${WORKSPACE_ORIGIN}/settings/machines.`,
+                    "No logs or network were read."
+                ].join("\n"));
             return ok([`Workspace: ${status.origin}`, `Last accepted push: ${status.lastAcceptedAt ?? "no push yet"}`,
                 `Pairing state: local record present; disconnect ${status.disconnect ?? "not requested"}`,
                 `Acknowledged fact keys: ${status.acknowledgedFacts}`, `Pending batch: ${status.pending?.state ?? "none"}`,
@@ -1070,10 +1078,14 @@ async function workspaceCommand(args, runtime) {
         }
         if (action === "connect") {
             if (!args.workspaceCode) {
-                if (!await consent("Create a private device key and display its public enrollment request? No session facts are sent. [y/N] "))
-                    return ok("Not paired.");
-                const prepared = await beginWorkspaceEnrollment(runtime.homeDirectory);
-                return ok([`Open ${WORKSPACE_ORIGIN}/settings/machines, paste this public request and confirm enrollment:`, prepared.bundle,
+                if (!await consent(args.workspaceRestart
+                    ? "Replace any unused connection request with a new private key and public request? The previous unused key will be removed; connected or uncertain exchanges cannot be restarted. No session facts are sent. [y/N] "
+                    : "Create a private device key, or display an existing unused connection request? No session facts are sent. [y/N] "))
+                    return fail("Connection request unchanged. No new request was created.");
+                const prepared = await beginWorkspaceEnrollment(runtime.homeDirectory, { restart: args.workspaceRestart });
+                return ok([`${prepared.disposition === "reused" ? "Reused" : "New"} connection request: ${prepared.request.requestId.slice(-8)}`,
+                    ...(prepared.disposition === "reused" ? ["This is the same unfinished request. If it expired or was cancelled in the browser, run npx aibill@latest workspace connect --restart."] : []),
+                    `Open ${WORKSPACE_ORIGIN}/settings/machines, paste this public request and confirm enrollment:`, prepared.bundle,
                     "Then run: npx aibill workspace connect <response-bundle>", "The private device key stays on this machine. No session facts were sent."].join("\n"));
             }
             const result = await finishWorkspaceEnrollment({ home: runtime.homeDirectory, bundle: args.workspaceCode,
@@ -1092,7 +1104,7 @@ async function workspaceCommand(args, runtime) {
                     : "Revoke this machine's Workspace grant and remove its local pairing after the accepted receipt? [y/N] ") });
             return result.state === "revoked" ? ok("Workspace revoked this machine grant. Local pairing was removed.")
                 : result.state === "abandoned" ? ok("Unused native pairing key removed. No remote revocation was claimed. Run npx aibill workspace connect to start a new request.")
-                    : result.state === "cancelled" ? ok("Pairing kept.") : result.state === "not_paired" ? ok("No completed local pairing exists.")
+                    : result.state === "cancelled" ? fail("Pairing kept. Disconnect was not confirmed; no request or key was removed.") : result.state === "not_paired" ? ok("No completed local pairing exists.")
                         : fail(`Disconnect outcome is unknown. Local keys remain; no retry was sent. Reconcile this machine at ${WORKSPACE_ORIGIN}/settings/machines.`);
         }
         const status = await workspaceStatus(runtime.homeDirectory);
@@ -1104,12 +1116,27 @@ async function workspaceCommand(args, runtime) {
             return fail("A retained batch was refused. No new envelope or nonce was created; resolve the refusal before pushing again.");
         const now = runtime.workspaceNow ?? workspaceClock.now();
         const loaded = status.pending ? undefined : runtime.workspaceLoadCalls ? await runtime.workspaceLoadCalls()
-            : await loadLocalAgentFinancialUsage({ workspaceDailyFacts: true, sinceIso: workspaceClock.daysBefore(now, 30) });
-        if (loaded?.diagnostics.some(item => item.code !== "directory_missing"))
-            return fail("Local source reading is incomplete. No facts were replaced or sent; resolve the reported source coverage before pushing.");
+            : await loadLocalAgentFinancialUsage({ workspaceDailyFacts: true, sinceIso: workspaceClock.daysBefore(now, 30),
+                untilIso: `${now.slice(0, 10)}T00:00:00.000Z` });
+        const representedUnknowns = loaded?.diagnostics.filter(item => item.code === "unsupported_token_shape"
+            && item.workspaceFactCoverage === "unknown_tokens").reduce((count, item) => count + item.count, 0) ?? 0;
+        const blockingDiagnostics = loaded?.diagnostics.filter(item => item.code !== "directory_missing"
+            && !(item.code === "unsupported_token_shape" && item.workspaceFactCoverage === "unknown_tokens")) ?? [];
+        if (blockingDiagnostics.length) {
+            const counts = new Map();
+            for (const diagnostic of blockingDiagnostics) {
+                const label = `${localAgentFormatLabel(diagnostic.agent)}: ${diagnostic.code}${diagnostic.workspaceReason ? ` (${diagnostic.workspaceReason})` : ""}`;
+                counts.set(label, (counts.get(label) ?? 0) + diagnostic.count);
+            }
+            return fail(["Local source reading is incomplete. No facts were replaced or sent.",
+                "Local scan diagnostics (counts, without paths or transcript contents):",
+                ...[...counts].sort(([left], [right]) => left.localeCompare(right)).map(([label, count]) => `${label}: ${count}`),
+                "Share these diagnostic counts for help before retrying. Do not delete logs or reconnect this machine."].join("\n"));
+        }
         const prepared = await prepareWorkspacePush({ home: runtime.homeDirectory, calls: loaded?.calls ?? [], generatedAt: now,
             confirm: (payload, coverage) => consent(["Exact outgoing local facts (no prompts, paths, session IDs, or amounts):", payload,
                 `Excluded calls: ${coverage.excludedCalls}. Missing token components: ${coverage.incompleteComponents}.`,
+                ...(representedUnknowns ? [`${representedUnknowns} incomplete local usage records are represented by unknown token values, never zero.`] : []),
                 status.pending?.state === "uncertain" ? "This retries only the identical retained signed batch with its original nonce. Send this exact batch again? [y/N] "
                     : "Machine tokens remain separate from provider-reported tokens and billed costs. Send this batch? [y/N] "].join("\n")) });
         if (prepared.state === "unchanged")
@@ -1125,8 +1152,12 @@ async function workspaceCommand(args, runtime) {
             : sent.state === "refused" ? fail("Workspace refused this batch. Its exact envelope and refusal are retained; no new nonce was created.")
                 : fail("Push outcome is unknown. The exact signed envelope is retained; run workspace push to review and explicitly retry this exact batch.");
     }
-    catch {
+    catch (error) {
         // Never echo remote payloads, raw argument bundles, tokens or filesystem contents.
+        if (error instanceof WorkspaceEnrollmentRefusal)
+            return fail(error.reason === "connected"
+                ? "This machine is already connected. Disconnect it before starting another connection request."
+                : `The earlier exchange outcome is unknown. Local keys remain. Do not restart or replay; reconcile this machine at ${WORKSPACE_ORIGIN}/settings/machines.`);
         return fail("Workspace operation stopped safely. Local state was not reset; inspect pairing status and permissions before continuing.");
     }
 }
@@ -6721,8 +6752,12 @@ function parseArgs(argv) {
         parsed.workspaceAction = rest.shift();
         if (parsed.workspaceAction === "connect" && rest[0] && !rest[0].startsWith("--"))
             parsed.workspaceCode = rest.shift();
+        if (parsed.workspaceAction === "connect" && !parsed.workspaceCode && rest.length === 1 && rest[0] === "--restart") {
+            parsed.workspaceRestart = true;
+            rest.shift();
+        }
         if (rest.length)
-            parsed.parseErrors.push("workspace accepts only connect [response-bundle], push, status, or disconnect");
+            parsed.parseErrors.push("workspace accepts only connect [response-bundle], connect --restart, push, status, or disconnect");
     }
     if (command === "statusline" && rest[0] && !rest[0].startsWith("--")) {
         parsed.statuslineAction = rest.shift();
@@ -7389,6 +7424,7 @@ function helpText(telemetryDisclosure) {
         "",
         "Optional Workspace machine attribution (explicit consent, no provider calls):",
         "  npx aibill workspace connect         Prepare this machine's public pairing request",
+        "  npx aibill workspace connect --restart Replace an unused request after browser expiry or cancellation",
         "  npx aibill workspace connect <code>  Finish the browser-confirmed pairing",
         "  npx aibill workspace push            Preview and send local session facts",
         "  npx aibill workspace status          Read local pairing/pending status only",

package/dist/workspaceConnect.d.ts

@@ -92,6 +92,10 @@ export declare function aggregateWorkspaceFacts(calls: readonly LocalAgentCall[]
 export declare function buildWorkspaceEnvelope(device: WorkspaceDevice, facts: WorkspaceFact[], generatedAt: string): WorkspaceEnvelope;
 export type WorkspaceStatus = {
     state: "not_connected";
+} | {
+    state: "enrollment_pending";
+    enrollment: "prepared" | "exchange_uncertain";
+    requestId: string;
 } | {
     state: "connected";
     origin: string;
@@ -191,10 +195,17 @@ export type WorkspaceEnrollmentResponse = {
     };
 };
 export declare function encodeWorkspaceBundle(value: WorkspaceEnrollmentRequest | WorkspaceEnrollmentResponse): string;
+export declare class WorkspaceEnrollmentRefusal extends Error {
+    readonly reason: "connected" | "exchange_uncertain";
+    constructor(reason: "connected" | "exchange_uncertain");
+}
 /** Generates native custody before displaying public enrollment material. No network call. */
-export declare function beginWorkspaceEnrollment(home?: string): Promise<{
+export declare function beginWorkspaceEnrollment(home?: string, options?: {
+    restart?: boolean;
+}): Promise<{
     request: WorkspaceEnrollmentRequest;
     bundle: string;
+    disposition: "created" | "reused" | "restarted";
 }>;
 export declare function validateWorkspaceEnrollmentResponse(request: WorkspaceEnrollmentRequest, response: WorkspaceEnrollmentResponse, now: string): string;
 /** Exchange is marked uncertain durably before dispatch and is never retried implicitly. */

package/dist/workspaceConnect.js

@@ -358,10 +358,14 @@ export async function workspaceStatus(home = homedir()) {
         throw error;
     }
     const state = await readState(path);
-    return state ? { state: "connected", origin: state.device.origin, lastAcceptedAt: state.lastAcceptedAt,
+    if (!state) {
+        const enrollment = await readEnrollment(path);
+        return enrollment ? { state: "enrollment_pending", enrollment: enrollment.state, requestId: enrollment.request.requestId }
+            : { state: "not_connected" };
+    }
+    return { state: "connected", origin: state.device.origin, lastAcceptedAt: state.lastAcceptedAt,
         acknowledgedFacts: Object.keys(state.facts).length, disconnect: state.disconnect?.state ?? null, pending: state.pending ? { state: state.pending.state,
-            factCount: state.pending.envelope.facts.length, generatedAt: state.pending.envelope.generatedAt, refusal: state.pending.refusal } : null }
-        : { state: "not_connected" };
+            factCount: state.pending.envelope.facts.length, generatedAt: state.pending.envelope.generatedAt, refusal: state.pending.refusal } : null };
 }
 /** HTTPS native transport avoids browser Origin/Sec-Fetch headers and never follows redirects. */
 export const workspaceTransport = (path, payload, token) => workspaceNativeRequest(path, payload, token);
@@ -567,22 +571,29 @@ async function readEnrollment(path) {
         await handle.close();
     }
 }
+export class WorkspaceEnrollmentRefusal extends Error {
+    reason;
+    constructor(reason) {
+        super("Workspace enrollment unavailable");
+        this.reason = reason;
+    }
+}
 /** Generates native custody before displaying public enrollment material. No network call. */
-export async function beginWorkspaceEnrollment(home = homedir()) {
+export async function beginWorkspaceEnrollment(home = homedir(), options = {}) {
     return withState(home, async (device, _save, path) => {
         if (device)
-            throw Error("This machine is already connected. Disconnect it in the Workspace before pairing it again.");
+            throw new WorkspaceEnrollmentRefusal("connected");
         const retained = await readEnrollment(path);
         if (retained?.state === "exchange_uncertain")
-            throw Error("The earlier exchange outcome is unknown. Revoke that enrollment in the Workspace before starting again.");
-        if (retained)
-            return { request: retained.request, bundle: encodeWorkspaceBundle(retained.request) };
+            throw new WorkspaceEnrollmentRefusal("exchange_uncertain");
+        if (retained && !options.restart)
+            return { request: retained.request, bundle: encodeWorkspaceBundle(retained.request), disposition: "reused" };
         const pair = generateKeyPairSync("ed25519"), ref = () => `oref_${randomBytes(32).toString("base64url")}`;
         const request = { schemaVersion: "1", kind: "tilden_machine_enrollment_request", origin: WORKSPACE_ORIGIN,
             publicKey: pair.publicKey.export({ format: "jwk" }).x, keyId: ref(), requestId: ref() };
         await atomicPrivateJson(path, ENROLLMENT_FILE, { version: 1, request,
             privateKeyPem: pair.privateKey.export({ format: "pem", type: "pkcs8" }).toString(), state: "prepared" });
-        return { request, bundle: encodeWorkspaceBundle(request) };
+        return { request, bundle: encodeWorkspaceBundle(request), disposition: retained ? "restarted" : "created" };
     });
 }
 export function validateWorkspaceEnrollmentResponse(request, response, now) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-spend-agent",
-  "version": "0.9.8",
+  "version": "0.9.10",
   "funding": "https://asktilden.com",
   "description": "Local-first financial accountability CLI: Claude Code/Codex attribution, provenance, and next actions, plus experimental Gemini CLI cost evidence.",
   "type": "module",
@@ -55,8 +55,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@agent-finops/core": "0.9.8",
-    "@agent-finops/report": "0.9.8",
+    "@agent-finops/core": "0.9.10",
+    "@agent-finops/report": "0.9.10",
     "yocto-spinner": "^1.2.0"
   }
 }