behavior-wrapped 0.2.17 → 0.2.19

package/README.md

@@ -26,7 +26,7 @@ Every selected session is scanned locally for explicit blockers. The judge recei
 
 The deck links to hosted token and agent/user word-ratio distributions, opt-in top-user rankings, and a public wall of opted-in favorite phrases. Its final card offers an optional research donation with standard local redactions, a customizable redaction review, or a deliberately unredacted copy. Every detailed mode allows sessions and messages to be excluded, text to be edited, and timestamps remain off by default. The unredacted path shows every included line and requires a separate warning and explicit acknowledgement that credentials and private details may be transmitted. No donation data is transmitted until the user checks the final research-consent box and presses Donate; the localhost helper then encrypts the reviewed bundle before it leaves the machine.
 
-When developing from this repository, run `npm install`, then `npm run wrapped`. Add `--demo` to use synthetic fixtures or `--no-open` to leave the browser closed. For fast formatting work, run `npm run wrapped -- --test`; test mode skips consent and all LLM calls, uses deterministic local fallbacks, keeps the report on localhost, and does not publish it. `--no-llm` is an alias for `--test`.
+When developing from this repository, run `npm install`, then `npm run wrapped`. Add `--demo` to use synthetic fixtures or `--no-open` to leave the browser closed. If you decline remote AI analysis, the CLI offers a local-only report: deterministic usage statistics and a locally counted favorite phrase remain, while AI-judged interaction tone, usage topics, and instrumental workarounds are omitted. Local-only reports stay on localhost and are excluded from the leaderboard. For fast formatting work, run `npm run wrapped -- --test`; test mode skips consent and all LLM calls, uses the same deterministic local fallbacks, keeps the report on localhost, and does not publish it. `--no-llm` is an alias for `--test`.
 
 For privacy-safe judge diagnostics, run `npm run wrapped -- --verbose` (or `--debug`). Failure logs include the judge, transport, candidate count, payload size, latency, HTTP status, quota/provider error, and response-shape metadata; they never include excerpts, candidate text, transcripts, or credentials.
 
@@ -53,7 +53,7 @@ For hosted-page UI development, run `npm run dev`. The normal end-to-end develop
 - The CLI reads the selected JSONL files from the canonical Claude Code and Codex directories. Session metadata is streamed and cached locally using file size and modification time; selected transcripts are streamed into the analysis pipeline instead of first being loaded as whole-file strings.
 - Transcript parsing, deterministic statistics, language classification, heuristic findings, phrase counting, candidate selection, blocker-window detection, and redaction run locally. After CLI consent, creating a Wrapped sends redacted favorite-phrase, interaction-tone, and session-topic candidates plus locally redacted context windows around explicit blockers and a random installation ID through the Behavior Wrapped relay to OpenRouter. Topic shares weight Luna's session classifications by each session's locally counted tokens.
 - Public reports are reduced to the same strict allowlist locally and again by the Worker. They contain only sanitized aggregate statistics—including counts for four fixed stock phrases—generalized findings, the redacted favorite phrase and frustration quote, and the localhost donation-helper link. They never contain session IDs, evidence, transcripts, prompts, session dates, project names, code, paths, or tool output. Deleting a locally managed report also requests deletion of its public copy.
-- Viewing the leaderboard compares the report's aggregate token, word-ratio, Good Human Score (thanks as a share of thank-or-scold moments), and instrumental-workaround values without storing a leaderboard entry. Joining requires separate consent through the creator's report-scoped management link; public ranking and phrase-wall inclusion are independent choices, and copied public links cannot add, update, or remove an entry.
+- Remote-analysis reports can compare aggregate token, word-ratio, Good Human Score (thanks as a share of thank-or-scold moments), and instrumental-workaround values on the leaderboard. Local-only reports are not published or included because the interaction-tone and workaround values are intentionally omitted.
 - Browser payloads never include source file paths or raw tool outputs.
 - Share-card PNG exports contain only aggregates and generalized findings.
 - Donation discovery, default redaction, preview, exclusion, editing, schema validation, and authenticated AES-256-GCM encryption happen on localhost. A fresh content key protects each donation and is wrapped with a rotation-versioned RSA-OAEP public key. The private key is not present in the npm package, Worker, D1, or R2. An optional unredacted mode applies no automatic redactions and requires a mode-specific acknowledgement before encryption.