ccgauge 1.0.3 → 1.0.4

package/.next/standalone/node_modules/semver/internal/re.js

@@ -0,0 +1,223 @@
+'use strict'
+
+const {
+  MAX_SAFE_COMPONENT_LENGTH,
+  MAX_SAFE_BUILD_LENGTH,
+  MAX_LENGTH,
+} = require('./constants')
+const debug = require('./debug')
+exports = module.exports = {}
+
+// The actual regexps go on exports.re
+const re = exports.re = []
+const safeRe = exports.safeRe = []
+const src = exports.src = []
+const safeSrc = exports.safeSrc = []
+const t = exports.t = {}
+let R = 0
+
+const LETTERDASHNUMBER = '[a-zA-Z0-9-]'
+
+// Replace some greedy regex tokens to prevent regex dos issues. These regex are
+// used internally via the safeRe object since all inputs in this library get
+// normalized first to trim and collapse all extra whitespace. The original
+// regexes are exported for userland consumption and lower level usage. A
+// future breaking change could export the safer regex only with a note that
+// all input should have extra whitespace removed.
+const safeRegexReplacements = [
+  ['\\s', 1],
+  ['\\d', MAX_LENGTH],
+  [LETTERDASHNUMBER, MAX_SAFE_BUILD_LENGTH],
+]
+
+const makeSafeRegex = (value) => {
+  for (const [token, max] of safeRegexReplacements) {
+    value = value
+      .split(`${token}*`).join(`${token}{0,${max}}`)
+      .split(`${token}+`).join(`${token}{1,${max}}`)
+  }
+  return value
+}
+
+const createToken = (name, value, isGlobal) => {
+  const safe = makeSafeRegex(value)
+  const index = R++
+  debug(name, index, value)
+  t[name] = index
+  src[index] = value
+  safeSrc[index] = safe
+  re[index] = new RegExp(value, isGlobal ? 'g' : undefined)
+  safeRe[index] = new RegExp(safe, isGlobal ? 'g' : undefined)
+}
+
+// The following Regular Expressions can be used for tokenizing,
+// validating, and parsing SemVer version strings.
+
+// ## Numeric Identifier
+// A single `0`, or a non-zero digit followed by zero or more digits.
+
+createToken('NUMERICIDENTIFIER', '0|[1-9]\\d*')
+createToken('NUMERICIDENTIFIERLOOSE', '\\d+')
+
+// ## Non-numeric Identifier
+// Zero or more digits, followed by a letter or hyphen, and then zero or
+// more letters, digits, or hyphens.
+
+createToken('NONNUMERICIDENTIFIER', `\\d*[a-zA-Z-]${LETTERDASHNUMBER}*`)
+
+// ## Main Version
+// Three dot-separated numeric identifiers.
+
+createToken('MAINVERSION', `(${src[t.NUMERICIDENTIFIER]})\\.` +
+                   `(${src[t.NUMERICIDENTIFIER]})\\.` +
+                   `(${src[t.NUMERICIDENTIFIER]})`)
+
+createToken('MAINVERSIONLOOSE', `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.` +
+                        `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.` +
+                        `(${src[t.NUMERICIDENTIFIERLOOSE]})`)
+
+// ## Pre-release Version Identifier
+// A numeric identifier, or a non-numeric identifier.
+// Non-numeric identifiers include numeric identifiers but can be longer.
+// Therefore non-numeric identifiers must go first.
+
+createToken('PRERELEASEIDENTIFIER', `(?:${src[t.NONNUMERICIDENTIFIER]
+}|${src[t.NUMERICIDENTIFIER]})`)
+
+createToken('PRERELEASEIDENTIFIERLOOSE', `(?:${src[t.NONNUMERICIDENTIFIER]
+}|${src[t.NUMERICIDENTIFIERLOOSE]})`)
+
+// ## Pre-release Version
+// Hyphen, followed by one or more dot-separated pre-release version
+// identifiers.
+
+createToken('PRERELEASE', `(?:-(${src[t.PRERELEASEIDENTIFIER]
+}(?:\\.${src[t.PRERELEASEIDENTIFIER]})*))`)
+
+createToken('PRERELEASELOOSE', `(?:-?(${src[t.PRERELEASEIDENTIFIERLOOSE]
+}(?:\\.${src[t.PRERELEASEIDENTIFIERLOOSE]})*))`)
+
+// ## Build Metadata Identifier
+// Any combination of digits, letters, or hyphens.
+
+createToken('BUILDIDENTIFIER', `${LETTERDASHNUMBER}+`)
+
+// ## Build Metadata
+// Plus sign, followed by one or more period-separated build metadata
+// identifiers.
+
+createToken('BUILD', `(?:\\+(${src[t.BUILDIDENTIFIER]
+}(?:\\.${src[t.BUILDIDENTIFIER]})*))`)
+
+// ## Full Version String
+// A main version, followed optionally by a pre-release version and
+// build metadata.
+
+// Note that the only major, minor, patch, and pre-release sections of
+// the version string are capturing groups.  The build metadata is not a
+// capturing group, because it should not ever be used in version
+// comparison.
+
+createToken('FULLPLAIN', `v?${src[t.MAINVERSION]
+}${src[t.PRERELEASE]}?${
+  src[t.BUILD]}?`)
+
+createToken('FULL', `^${src[t.FULLPLAIN]}$`)
+
+// like full, but allows v1.2.3 and =1.2.3, which people do sometimes.
+// also, 1.0.0alpha1 (prerelease without the hyphen) which is pretty
+// common in the npm registry.
+createToken('LOOSEPLAIN', `[v=\\s]*${src[t.MAINVERSIONLOOSE]
+}${src[t.PRERELEASELOOSE]}?${
+  src[t.BUILD]}?`)
+
+createToken('LOOSE', `^${src[t.LOOSEPLAIN]}$`)
+
+createToken('GTLT', '((?:<|>)?=?)')
+
+// Something like "2.*" or "1.2.x".
+// Note that "x.x" is a valid xRange identifer, meaning "any version"
+// Only the first item is strictly required.
+createToken('XRANGEIDENTIFIERLOOSE', `${src[t.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`)
+createToken('XRANGEIDENTIFIER', `${src[t.NUMERICIDENTIFIER]}|x|X|\\*`)
+
+createToken('XRANGEPLAIN', `[v=\\s]*(${src[t.XRANGEIDENTIFIER]})` +
+                   `(?:\\.(${src[t.XRANGEIDENTIFIER]})` +
+                   `(?:\\.(${src[t.XRANGEIDENTIFIER]})` +
+                   `(?:${src[t.PRERELEASE]})?${
+                     src[t.BUILD]}?` +
+                   `)?)?`)
+
+createToken('XRANGEPLAINLOOSE', `[v=\\s]*(${src[t.XRANGEIDENTIFIERLOOSE]})` +
+                        `(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})` +
+                        `(?:\\.(${src[t.XRANGEIDENTIFIERLOOSE]})` +
+                        `(?:${src[t.PRERELEASELOOSE]})?${
+                          src[t.BUILD]}?` +
+                        `)?)?`)
+
+createToken('XRANGE', `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAIN]}$`)
+createToken('XRANGELOOSE', `^${src[t.GTLT]}\\s*${src[t.XRANGEPLAINLOOSE]}$`)
+
+// Coercion.
+// Extract anything that could conceivably be a part of a valid semver
+createToken('COERCEPLAIN', `${'(^|[^\\d])' +
+              '(\\d{1,'}${MAX_SAFE_COMPONENT_LENGTH}})` +
+              `(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?` +
+              `(?:\\.(\\d{1,${MAX_SAFE_COMPONENT_LENGTH}}))?`)
+createToken('COERCE', `${src[t.COERCEPLAIN]}(?:$|[^\\d])`)
+createToken('COERCEFULL', src[t.COERCEPLAIN] +
+              `(?:${src[t.PRERELEASE]})?` +
+              `(?:${src[t.BUILD]})?` +
+              `(?:$|[^\\d])`)
+createToken('COERCERTL', src[t.COERCE], true)
+createToken('COERCERTLFULL', src[t.COERCEFULL], true)
+
+// Tilde ranges.
+// Meaning is "reasonably at or greater than"
+createToken('LONETILDE', '(?:~>?)')
+
+createToken('TILDETRIM', `(\\s*)${src[t.LONETILDE]}\\s+`, true)
+exports.tildeTrimReplace = '$1~'
+
+createToken('TILDE', `^${src[t.LONETILDE]}${src[t.XRANGEPLAIN]}$`)
+createToken('TILDELOOSE', `^${src[t.LONETILDE]}${src[t.XRANGEPLAINLOOSE]}$`)
+
+// Caret ranges.
+// Meaning is "at least and backwards compatible with"
+createToken('LONECARET', '(?:\\^)')
+
+createToken('CARETTRIM', `(\\s*)${src[t.LONECARET]}\\s+`, true)
+exports.caretTrimReplace = '$1^'
+
+createToken('CARET', `^${src[t.LONECARET]}${src[t.XRANGEPLAIN]}$`)
+createToken('CARETLOOSE', `^${src[t.LONECARET]}${src[t.XRANGEPLAINLOOSE]}$`)
+
+// A simple gt/lt/eq thing, or just "" to indicate "any version"
+createToken('COMPARATORLOOSE', `^${src[t.GTLT]}\\s*(${src[t.LOOSEPLAIN]})$|^$`)
+createToken('COMPARATOR', `^${src[t.GTLT]}\\s*(${src[t.FULLPLAIN]})$|^$`)
+
+// An expression to strip any whitespace between the gtlt and the thing
+// it modifies, so that `> 1.2.3` ==> `>1.2.3`
+createToken('COMPARATORTRIM', `(\\s*)${src[t.GTLT]
+}\\s*(${src[t.LOOSEPLAIN]}|${src[t.XRANGEPLAIN]})`, true)
+exports.comparatorTrimReplace = '$1$2$3'
+
+// Something like `1.2.3 - 1.2.4`
+// Note that these all use the loose form, because they'll be
+// checked against either the strict or loose comparator form
+// later.
+createToken('HYPHENRANGE', `^\\s*(${src[t.XRANGEPLAIN]})` +
+                   `\\s+-\\s+` +
+                   `(${src[t.XRANGEPLAIN]})` +
+                   `\\s*$`)
+
+createToken('HYPHENRANGELOOSE', `^\\s*(${src[t.XRANGEPLAINLOOSE]})` +
+                        `\\s+-\\s+` +
+                        `(${src[t.XRANGEPLAINLOOSE]})` +
+                        `\\s*$`)
+
+// Star ranges basically just allow anything at all.
+createToken('STAR', '(<|>)?=?\\s*\\*')
+// >=0.0.0 is like a star
+createToken('GTE0', '^\\s*>=\\s*0\\.0\\.0\\s*$')
+createToken('GTE0PRE', '^\\s*>=\\s*0\\.0\\.0-0\\s*$')

package/.next/standalone/node_modules/semver/package.json

@@ -0,0 +1,78 @@
+{
+  "name": "semver",
+  "version": "7.7.4",
+  "description": "The semantic version parser used by npm.",
+  "main": "index.js",
+  "scripts": {
+    "test": "tap",
+    "snap": "tap",
+    "lint": "npm run eslint",
+    "postlint": "template-oss-check",
+    "lintfix": "npm run eslint -- --fix",
+    "posttest": "npm run lint",
+    "template-oss-apply": "template-oss-apply --force",
+    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/template-oss": "4.29.0",
+    "benchmark": "^2.1.4",
+    "tap": "^16.0.0"
+  },
+  "license": "ISC",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/npm/node-semver.git"
+  },
+  "bin": {
+    "semver": "bin/semver.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "classes/",
+    "functions/",
+    "internal/",
+    "ranges/",
+    "index.js",
+    "preload.js",
+    "range.bnf"
+  ],
+  "tap": {
+    "timeout": 30,
+    "coverage-map": "map.js",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "engines": {
+    "node": ">=10"
+  },
+  "author": "GitHub Inc.",
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.29.0",
+    "engines": ">=10",
+    "distPaths": [
+      "classes/",
+      "functions/",
+      "internal/",
+      "ranges/",
+      "index.js",
+      "preload.js",
+      "range.bnf"
+    ],
+    "allowPaths": [
+      "/classes/",
+      "/functions/",
+      "/internal/",
+      "/ranges/",
+      "/index.js",
+      "/preload.js",
+      "/range.bnf",
+      "/benchmarks"
+    ],
+    "publish": "true"
+  }
+}

package/.next/standalone/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccgauge",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Local web dashboard for Claude Code and OpenAI Codex CLI token usage and cost",
   "keywords": [
     "claude",
@@ -64,10 +64,16 @@
     "start:next": "next start -p 3737",
     "lint": "eslint .",
     "typecheck": "tsc --noEmit",
-    "test": "node --experimental-strip-types --no-warnings scripts/test-codex-parser.mjs",
+    "test": "node --experimental-strip-types --no-warnings scripts/test-codex-parser.mjs && node --experimental-strip-types --no-warnings scripts/test-turns.mjs && node --experimental-strip-types --no-warnings scripts/test-source-merge.mjs && node --experimental-strip-types --no-warnings scripts/test-cost-from-usage.mjs && node --experimental-strip-types --no-warnings scripts/test-range.mjs && node scripts/check-parser-versions.mjs && node scripts/check-readme-images.mjs",
     "test:mcp": "node scripts/test-mcp-server.mjs",
     "clean": "node -e \"for (const p of ['.next','node_modules','tsconfig.tsbuildinfo']) require('node:fs').rmSync(p,{recursive:true,force:true})\"",
     "screenshots": "node scripts/screenshots.mjs",
+    "site:dev": "cd site && astro dev --port 4321",
+    "site:build": "cd site && astro build",
+    "site:preview": "cd site && astro preview --port 4322",
+    "site:check": "cd site && astro check",
+    "site:gen:placeholders": "node site/scripts/gen-placeholders.mjs",
+    "site:clean": "node -e \"for (const p of ['site/dist','site/.astro','site/node_modules']) require('node:fs').rmSync(p,{recursive:true,force:true})\"",
     "prepack": "pnpm build"
   },
   "dependencies": {
@@ -77,10 +83,15 @@
     "open": "^10.1.0"
   },
   "devDependencies": {
+    "@astrojs/check": "^0.9.4",
+    "@astrojs/tailwind": "^5.1.4",
     "@eslint/eslintrc": "^3.3.5",
+    "@fontsource-variable/geist": "^5.1.1",
+    "@fontsource-variable/geist-mono": "^5.1.1",
     "@types/node": "^22.10.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "astro": "^4.16.18",
     "autoprefixer": "^10.4.20",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",

package/.next/standalone/public/favicon.svg

@@ -1,7 +1,21 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" fill="none">
-  <rect width="64" height="64" rx="14" fill="#4F46E5"/>
-  <path d="M14 41 A18 18 0 0 1 50 41" stroke="#fff" stroke-opacity="0.32" stroke-width="4.5" stroke-linecap="round"/>
-  <path d="M14 41 A18 18 0 0 1 43.2 25.4" stroke="#fff" stroke-width="4.5" stroke-linecap="round"/>
-  <line x1="32" y1="41" x2="42" y2="27" stroke="#fff" stroke-width="2.5" stroke-linecap="round"/>
-  <circle cx="32" cy="41" r="3" fill="#fff"/>
+  <title>ccgauge</title>
+  <rect x="3" y="3" width="58" height="58" rx="16" fill="#6366F1"/>
+  <rect x="3.75" y="3.75" width="56.5" height="56.5" rx="15.25" stroke="#FFFFFF" stroke-opacity="0.18" stroke-width="1.5"/>
+  <path d="M15 39.5 A17 17 0 0 1 49 39.5" stroke="#FFFFFF" stroke-opacity="0.24" stroke-width="5" stroke-linecap="round"/>
+  <path d="M20.8 39.5 A11.2 11.2 0 0 1 43.2 39.5" stroke="#FFFFFF" stroke-opacity="0.2" stroke-width="1.8" stroke-linecap="round"/>
+  <path d="M15 39.5 A17 17 0 0 1 42.8 26" stroke="#FFFFFF" stroke-width="5" stroke-linecap="round"/>
+  <g stroke="#FFFFFF" stroke-linecap="round" stroke-width="2" stroke-opacity="0.54">
+    <path d="M18.1 34.2 L15 32.4"/>
+    <path d="M24 28.5 L22.3 25.5"/>
+    <path d="M32 26.2 L32 22.8"/>
+    <path d="M40 28.5 L41.7 25.5"/>
+    <path d="M45.9 34.2 L49 32.4"/>
+  </g>
+  <path d="M32 39.5 L42.8 26" stroke="#FFFFFF" stroke-width="3.4" stroke-linecap="round"/>
+  <circle cx="32" cy="39.5" r="4.8" fill="#FFFFFF"/>
+  <circle cx="32" cy="39.5" r="2" fill="#4F46E5"/>
+  <rect x="17" y="46" width="7" height="5" rx="2" fill="#34D399"/>
+  <rect x="28.5" y="43" width="7" height="8" rx="2" fill="#FBBF24"/>
+  <rect x="40" y="45" width="7" height="6" rx="2" fill="#93C5FD"/>
 </svg>

package/CHANGELOG.md

@@ -5,6 +5,70 @@ All notable changes to **ccgauge** are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.4] — 2026-05-18
+
+Correctness fixes + much stronger test coverage, plus a brand refresh
+and a marketing-site restructure. No new runtime features.
+
+### Fixed
+
+- **Windows path sanitization.** `sanitizeForUser` now also strips
+  forward-slashed, JSON-escaped, and long-path (`\\?\`) variants of
+  `homedir()`, not just the literal `C:\Users\<name>` form. macOS /
+  Linux behaviour unchanged.
+- **5h-block empty state** follows the active source —
+  `?source=codex` no longer says "Send a message in Claude Code".
+  Same fix on the Codex tab inside the All view.
+- **`combineTimeBuckets` shared-reference bug.** Shallow-cloned model
+  entries were aliased back into the indexer's aggregator cache, so
+  downstream mutations could poison subsequent reads. Deep-cloned on
+  insertion; pinned by a new test.
+- **`safeMcpHandler` non-Error throws** are now wrapped + scrubbed
+  before re-throw; the previous branch silently fell through, shipping
+  unscrubbed payloads into the MCP envelope.
+
+### Added
+
+- **6 test / drift scripts**, all wired into `pnpm test`:
+  `test-turns`, `test-source-merge`, `test-cost-from-usage`,
+  `test-range` (fixture-based unit tests for the four core code
+  paths), plus `check-parser-versions` and `check-readme-images` (CI
+  drift guards for silently-stale-cache and broken-npm-image
+  regressions).
+
+### Changed
+
+- **Refined gauge brand mark**, unified across the dashboard, the
+  marketing site, and both favicons. Cleaner geometry (centre at
+  (32, 41), radius 18; arc + needle terminating on the dial rim),
+  Indigo-400 → -600 gradient background, white-ring pivot. New shared
+  `<LogoMark>` component on the marketing site so its Nav + Footer
+  now use the same mark as the dashboard.
+- **Marketing site is source-only.** Removed `site/package.json` and
+  `site/pnpm-lock.yaml`; Astro deps live in root `devDependencies`,
+  commands are explicit `pnpm site:*`. Still excluded from the npm
+  tarball (`pnpm pack --dry-run | grep -c '^site/'` → `0`).
+- **Theme-aware product screenshots.** New `<ThemedScreenshot>`
+  component swaps between dark / light captures via the
+  `.theme-light` class on `<html>`. 24 captures (6 pages × 2 locales
+  × 2 themes) generated by an expanded `scripts/screenshots.mjs`.
+- **OG cards** regenerated at higher fidelity.
+- **`cost_estimator` MCP tool** description spells out that reasoning
+  tokens are already counted inside `output_tokens` — don't
+  double-count.
+- **Activity heatmap tooltip** finally renders the share / of-peak
+  labels that were defined but never used.
+- **`CacheCreationBlock` type** extracted in `parse-jsonl.ts`.
+- **CLI `readState()`** type-guards `pid` / `url` / `logFile`.
+
+### Internal
+
+- MCP server warm-up comment clarifies the fire-and-forget
+  `getMcpIndexerReady()` is a cold-start shave — tool handlers still
+  await the same memoized init promise.
+- `AGENTS.md` + bundled READMEs updated for the source-only site
+  layout and the new `pnpm site:*` command set.
+
 ## [1.0.3] — 2026-05-15
 
 A focused **MCP server** correctness + performance + ergonomics pass,

package/README.md

@@ -461,6 +461,8 @@ pnpm test              # codex parser smoke test (Node 22+)
 pnpm build             # next build + copy static into .next/standalone
 pnpm start             # run bin/cli.mjs against the standalone build
 pnpm screenshots       # regenerate docs/screenshots/*.png
+pnpm site:dev          # marketing site dev server, http://localhost:4321
+pnpm site:build        # build only the site/ marketing site
 pnpm clean             # rm -rf .next node_modules
 ```
 

package/README.zh-CN.md

@@ -454,6 +454,8 @@ pnpm test              # codex parser 烟测（Node 22+）
 pnpm build             # next build + 把 static 拷进 .next/standalone
 pnpm start             # 用 bin/cli.mjs 跑 standalone 产物
 pnpm screenshots       # 重新生成 docs/screenshots/*.png
+pnpm site:dev          # 产品官网开发服务，http://localhost:4321
+pnpm site:build        # 只构建 site/ 产品官网
 pnpm clean             # rm -rf .next node_modules
 ```
 
@@ -508,10 +510,11 @@ pnpm publish --access public  # 会自动先跑 pnpm build（prepublishOnly）
 ## 产品官网
 
 产品官网（Astro + Tailwind 自建、中英双语、暗 / 亮主题、独立部署）放在
-[`site/`](./site/) 目录。它跟着主仓库一起在 git 里，但**不会**进 npm 包。
+[`site/`](./site/) 目录。它跟着主仓库一起在 git 里，但**不会**进 npm 包；
+命令和依赖统一由根目录 `package.json` 管理。
 
 ```bash
-cd site && pnpm install && pnpm dev   # http://localhost:4321
+pnpm site:dev   # http://localhost:4321
 ```
 
 构建 / 部署细节见 [`site/README.md`](./site/README.md)。

package/bin/cli.mjs

@@ -587,9 +587,18 @@ async function readState() {
   try {
     const raw = await readFile(STATE_FILE, 'utf8');
     const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== 'object') return null;
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return null;
     // Treat unknown / future versions as stale (auto-clean on next stop/start).
     if (parsed.version !== STATE_VERSION) return null;
+    // Type-guard the fields callers actually use — `stop`, `status`, and
+    // `restart` all assume these have the right shape. A hand-edited
+    // state.json with the right `version` but garbage in `pid` could
+    // otherwise crash `safeKill()` or `isProcessRunning()`.
+    if (typeof parsed.pid !== 'number' || !Number.isInteger(parsed.pid) || parsed.pid <= 0) {
+      return null;
+    }
+    if (typeof parsed.url !== 'string' || !parsed.url) return null;
+    if (typeof parsed.logFile !== 'string' || !parsed.logFile) return null;
     return parsed;
   } catch {
     return null;