cchubber 0.5.8 → 0.6.1

package/README.md

@@ -32,6 +32,16 @@ A single HTML report that tells you three things: what you spent, why you spent
 - CLAUDE.md section-by-section analysis with per-message cost impact
 - Cache break estimation even when diff files don't exist on your CC version
 
+**Your week against your plan:**
+Directly under the "Did you spend them well?" strip, the report shows how much of your last 7 days of Claude Code (and Codex) work went to what you said you'd do: one number, what it was measured against, where the rest went, and the day you drifted most. "What you said you'd do" is read from a `PLAN.md`, `plan.md` or `TODO.md` checklist in the project you work in (or a Mover OS Daily Note). With no written plan, or no work in the window, the section says what to add instead of showing a number. It runs on your machine and nothing is uploaded; detour names are your own words with paths, keys and links removed. No flag needed, it is part of `npx cchubber`.
+
+**Your usage on other models:**
+Right under the grade card, the report reprices your own tokens on every current frontier model's list price (Claude Fable 5.1, Opus 5.5, Sonnet 5.5, GPT-6 Astra and Sol, Gemini 4 Argon, DeepSeek V4 Pro, Kimi K3) and replays your real days as a six-second race. It also shows how many tokens Claude read for every token it wrote, what you paid (when your plan is detected), and, when you have a written plan, how much of your last week went to it (computed locally). Buttons download a 1200x675 card, copy the text, or open a pre-filled post on X. You click; the page never posts. No flag needed, it is part of `npx cchubber`. `--json` includes it as `reprice`.
+
+- **Sources:** prices come live from [LiteLLM](https://github.com/BerriAI/litellm)'s `model_prices_and_context_window.json`, fetched on each run. A model LiteLLM does not list yet (today Gemini 4 Argon, priced from [blog.google](https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/), checked 30 Sep 2026, introductory price with the later price shown too) comes from `src/data/price-overrides.js`, used only while LiteLLM has no entry, so live data wins the day it adds the model. Offline, bundled prices dated 30 Sep 2026 are used and the report says so.
+- **Gaps:** where a provider lists no cache-read price, the input price is used (no discount assumed); where it lists no cache-write price, or zero, cache writes are billed as input. The report names which models that touched.
+- **Fine print:** same tokens on each model's list price, cache included. Another model would use a different number of tokens, so this compares prices, not outcomes.
+
 **The shareable card:**
 An animated card with your grade, spend, cache ratio, and diagnosis line. Export as video. Post it. Let people see the numbers Anthropic won't show them.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cchubber",
-  "version": "0.5.8",
+  "version": "0.6.1",
   "description": "What you spent. Why you spent it. Is that normal. — Claude Code usage diagnosis with beautiful HTML reports.",
   "type": "module",
   "bin": {

package/src/analyzers/cost-calculator.js

@@ -13,6 +13,14 @@ const FALLBACK_PRICING = {
 
 // Dynamic pricing cache (populated by fetchPricing)
 let dynamicPricing = null;
+// The whole LiteLLM JSON (every provider) from that same fetch, kept for --vs. Null when the fetch failed.
+let rawLiteLLM = null;
+let rawFetchedAt = null;
+
+/** The raw LiteLLM table and when it was fetched, or null when offline. Call after fetchPricing(). */
+export function getLiteLLMRaw() {
+  return rawLiteLLM ? { data: rawLiteLLM, fetchedAt: rawFetchedAt } : null;
+}
 
 /**
  * Fetch latest pricing from LiteLLM. Returns map of model -> pricing.
@@ -36,6 +44,7 @@ export async function fetchPricing() {
 
     // Parse LiteLLM format into our format
     const pricing = {};
+    const fetchedAt = Date.now();
     for (const [key, info] of Object.entries(data)) {
       if (!key.startsWith('claude') && !key.includes('claude')) continue;
 
@@ -52,6 +61,8 @@ export async function fetchPricing() {
 
     if (Object.keys(pricing).length > 0) {
       dynamicPricing = pricing;
+      rawLiteLLM = data;
+      rawFetchedAt = fetchedAt;
       return pricing;
     }
   } catch {

package/src/analyzers/drift-privacy.js

@@ -0,0 +1,245 @@
+/**
+ * What the drift card is allowed to show of your prompts.
+ * Always on: keys, tokens, links, file paths, emails and long numbers are replaced before any words reach the card.
+ * With --redact: detour names become categories, so no prompt text is shown at all.
+ */
+
+// Shapes of the credentials people paste most. Anything key-like that no rule names is caught by the last two.
+const SECRETS = [
+  /\bsk-(?:ant-|proj-|live-|test-|or-)?[A-Za-z0-9_-]{12,}/g,
+  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{16,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{16,}/g,
+  /\bglpat-[A-Za-z0-9_-]{16,}/g,
+  /\bxox[abprs]-[A-Za-z0-9-]{10,}/g,
+  /\bAKIA[0-9A-Z]{16}\b/g,
+  /\bAIza[0-9A-Za-z_-]{30,}/g,
+  /\bnpm_[A-Za-z0-9]{30,}/g,
+  /\b(?:rk|pk|sk)_(?:live|test)_[A-Za-z0-9]{16,}/g,
+  /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{3,}/g,
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+  /\b(?:bearer|token|api[_-]?key|secret|password|passwd|pwd)\s*[:=]\s*\S+/gi,
+  /\b[A-Fa-f0-9]{32,}\b/g,
+  // 24+ characters mixing upper case, lower case and digits, with no spaces: almost never a word
+  /\b(?=[A-Za-z0-9+/_-]*\d)(?=[A-Za-z0-9+/_-]*[a-z])(?=[A-Za-z0-9+/_-]*[A-Z])[A-Za-z0-9+/_-]{24,}={0,2}/g,
+];
+
+const URL = /\b(?:https?:\/\/|www\.)\S+|\b[\w-]+\.(?:com|dev|io|ai|app|co|net|org|so|sh|me|gg|ly|uk|xyz)\/\S*/gi;
+const EMAIL = /\b[\w.+-]+@[\w-]+(?:\.[\w-]+)+\b/g;
+// Home paths, absolute paths with at least two parts (so "/goal" survives), Windows paths, and relative paths
+// that end in a file extension
+const PATH = /~\/[\w.@\/-]+|(?<![\w.])\/[\w.@-]+(?:\/[\w.@-]*)+|\b[A-Za-z]:\\[^\s"']+|\b(?:[\w.@-]+\/)+[\w@-]+\.[A-Za-z0-9]{1,6}\b/g;
+// Nine or more digits (phone, card, account numbers); dates like 2026-09-29 have eight and are kept
+const LONG_NUMBER = /\b\d(?:[ -]?\d){8,}\b/g;
+
+export function scrub(text) {
+  let s = String(text || '');
+  for (const re of SECRETS) s = s.replace(re, ' [key] ');
+  return s
+    .replace(URL, ' [link] ')
+    .replace(EMAIL, ' [email] ')
+    .replace(PATH, ' [file] ')
+    .replace(LONG_NUMBER, ' [number] ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+// Chat filler at the front of a prompt, dropped so the name starts at the point
+const LEAD_FILLER = new Set(['yo', 'bro', 'bruh', 'broski', 'brudda', 'mate', 'man', 'ok', 'okay', 'alr', 'alright', 'so',
+  'and', 'also', 'btw', 'but', 'nah', 'yeah', 'yh', 'yes', 'hey', 'hi', 'oh', 'well', 'right', 'um', 'uh', 'ngl', 'tbh',
+  'lol', 'gng', 'wait', 'hmm', 'actually', 'basically', 'look', 'listen', 'now', 'then', 'please', 'pls',
+  'i', 'meant', 'mean', 'means', 'think', 'thought', 'saying', 'wondering', 'idk', 'just', 'like', 'the', 'thing', 'is',
+  'can', 'could', 'would', 'will', 'you', 'we', 'do', 'does', 'should', 'lets', 'let']);
+
+/**
+ * A detour's name: the start of the user's own prompt, scrubbed, lower-cased and cut to a short phrase.
+ * Returns '' when nothing readable is left (a prompt that was only a link, say).
+ */
+export function shortName(text, { maxWords = 7, maxChars = 44 } = {}) {
+  let s = scrub(String(text || '').replace(/\[Image[^\]]*\]/gi, ' '))
+    // The placeholders scrub() leaves ([link], [file], ...) carry no meaning in a name, so drop them entirely
+    .replace(/\[(?:key|link|file|email|number)\]/g, ' ')
+    .replace(/[‘’]/g, "'").replace(/["“”`*_#>@]/g, '').replace(/\s+/g, ' ').trim();
+  // The first sentence that says something; "Why?" alone borrows the next one
+  const parts = s.split(/(?<=[.?!])\s+|\n+/).map(p => p.trim()).filter(Boolean);
+  let phrase = '';
+  for (const p of parts) {
+    phrase = phrase ? `${phrase} ${p}` : p;
+    if (phrase.split(' ').filter(w => !LEAD_FILLER.has(w.toLowerCase())).length >= 3) break;
+  }
+  let words = phrase.split(' ').filter(Boolean);
+  while (words.length && LEAD_FILLER.has(words[0].toLowerCase().replace(/[^a-z]/g, ''))) words.shift();
+  // Placeholders left by scrub() carry no meaning at the edges
+  while (words.length && /^\[\w+\]$/.test(words[words.length - 1])) words.pop();
+  if (!words.some(w => /[a-z]{2,}/i.test(w) && !/^\[\w+\]$/.test(w))) return '';
+  let out = '';
+  let cut = false;
+  for (const [i, w] of words.entries()) {
+    const next = out ? `${out} ${w}` : w;
+    if (i >= maxWords || next.length > maxChars) { cut = true; break; }
+    out = next;
+  }
+  out = out.replace(/[,;:\-]+$/, '').toLowerCase();
+  return cut ? `${out}…` : out.replace(/[.!]+$/, '');
+}
+
+// For --redact: the kind of detour, never its words. First matching rule wins.
+const CATEGORIES = [
+  ['food and health', /\b(food|eat|ate|eating|cook|cooking|cooked|recipes?|chicken|rice|protein|calories?|kcal|meals?|lunch|dinner|breakfast|snacks?|gym|workout|weights?|sleep|hrv|spo2|steps|doctor|ill|sick|cough|diet|macros?|brownies?)\b/],
+  ['shopping', /\b(buy|bought|prices?|deals?|offers?|cheap|cheaper|discount|orders?|argos|amazon|ebay|marketplace|freezer|fridge|laptop|macbook|listing|shop|shopping|stock)\b|£/],
+  ['paperwork', /\b(ticket|appeal|fine|parking|insurance|bank|tax|invoice|letter|form|council|visa|passport|contract|claim|refund)\b/],
+  ['setup and tooling', /\b(install|setup|set up|config|settings|terminal|sessions?|account|accounts|login|log in|permissions?|mcp|remote|disk|storage|cache|space|update|upgrade|plugins?|extensions?|hooks?|cli|history)\b/],
+  ['design', /\b(design|ui|ux|fonts?|colou?rs?|logo|brand|branding|mascots?|landing|layout|figma|icons?|animation|motion|screens?)\b/],
+  ['content and marketing', /\b(posts?|tweets?|videos?|reels?|captions?|content|launch|viral|marketing|seo|newsletter|youtube|tiktok|instagram|x\.com|audience)\b/],
+  ['research', /\b(research|analy[sz]e|analysis|compare|markets?|competitors?|trends?|bookmarks?|threads?|reddit|articles?|news|ipo|benchmarks?)\b/],
+  ['money', /\b(money|revenue|pricing|business|income|profit|sales|sell|selling|customers?|startup)\b/],
+  ['code', /\b(bug|fix|error|refactor|tests?|deploy|build|api|function|script|database|db|server|endpoint|repo|commit|branch|code)\b/],
+];
+
+export function categorize(text) {
+  const s = String(text || '').toLowerCase();
+  for (const [name, re] of CATEGORIES) if (re.test(s)) return name;
+  return 'something else';
+}
+
+// ---------------------------------------------------------------------------------------------------------------
+// Readable labels for the drift section. shortName() above keeps the raw start of a prompt; labelName() turns it into
+// something a person recognises, or says what the detour touched, or names its kind. scrub() runs first, always.
+// ---------------------------------------------------------------------------------------------------------------
+
+// Openers that only lead into the point. Multi-word ones first so "question is" goes as one.
+const OPENERS = [
+  'at the', 'on the', 'in the', 'question is', 'the question is', 'can you', 'could you', 'would you', 'will you', 'i want to', 'i want',
+  'i need to', 'i need', 'i would like to', 'make sure', 'lets', "let's", 'let us', 'ok so', 'okay so', 'so', 'also', 'ok', 'okay', 'and', 'but',
+  'i think that', 'i think', 'i feel like', 'i feel', 'i guess', 'i mean', 'i was thinking', 'i dont know', "i don't know", 'maybe', 'btw', 'yo', 'hey', 'please', 'pls', 'now', 'then', 'actually', 'basically', 'well', 'the', 'a', 'an', 'i',
+];
+// Words that carry no topic on their own, for counting how much a label really says
+const THIN = new Set(`a an the and or but nor so if of to in on at by for with from as is am are was were be been being it its it's this that these those
+  here there i me my we our you your he she they them his her their do does did done doing have has had not no yes yeah
+  can could would should will shall may might must just also too very really quite much many more most some any all etc
+  what when where which who whom whose why how than then thus about into onto over under up down out off again still even
+  thing things stuff bit lot lots like kind sort one ones`.split(/\s+/).filter(Boolean));
+// A label that ends on one of these was cut mid-thought
+const DANGLING = new Set(['or', 'and', 'but', 'the', 'a', 'an', 'to', 'of', 'in', 'on', 'at', 'for', 'with', 'was', 'is', 'are', 'that', 'this',
+  'so', 'if', 'as', 'by', 'from', 'etc', 'how', 'what', 'my', 'your', 'our', 'their', 'it', 'its']);
+
+const LABEL_MAX = 32;
+
+/** The prompt with everything that reads as markup or decoration removed: tags, [Image #1], pasted-content ids, bullets. */
+function tidy(text) {
+  return String(text || '')
+    .replace(/\[(?:Image|Pasted|Attached|File)[^\]]*\]/gi, ' ')
+    // <pastedcontent id=2b8c ...>, also when the closing > never came
+    .replace(/<\/?[a-z][\w:-]*(?:\s+[\w:-]+\s*=\s*[^\s>]+)*\s*>?/gi, ' ')
+    .replace(/<[^>\n]*>/g, ' ')
+    .replace(/[●•·▪◦○◉■□▶►→←↑↓✓✗✔✘★☆]/g, ' ')
+    .replace(/(?:^|\s)[-*>#|]+(?=\s|$)/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+const plain = (w) => w.toLowerCase().replace(/[^a-z0-9']/g, '');
+const meaningful = (w) => { const p = plain(w); return p.length >= 2 && /[a-z]/.test(p) && !THIN.has(p) && !/^\d/.test(p); };
+
+// "1/5 skill gates" -> "skill gates": numbering, fractions and lone digits at the front say nothing
+const stripLeadNumbers = (s) => s.replace(/^(?:[\d#./:-]+\s+)+/, '');
+
+function stripOpeners(s) {
+  let out = s;
+  for (let i = 0; i < 6; i++) {
+    const low = out.toLowerCase();
+    const hit = OPENERS.find(o => low === o || low.startsWith(o + ' '));
+    if (!hit) break;
+    out = out.slice(hit.length).trim();
+  }
+  return out;
+}
+
+// Cut to the cap at a word boundary, never ending on a dangling word
+function capWords(words) {
+  let out = '';
+  for (const w of words) {
+    const next = out ? `${out} ${w}` : w;
+    if (next.length > LABEL_MAX) break;
+    out = next;
+  }
+  // A cut inside brackets leaves "skill gates (design and writing": drop the open bracket and what follows
+  out = out.replace(/\s*[(\[][^)\]]*$/, '');
+  const parts = out.split(' ');
+  while (parts.length > 1 && DANGLING.has(plain(parts[parts.length - 1]))) parts.pop();
+  return parts.join(' ');
+}
+
+/** The readable label a prompt earns on its own, or '' when it does not say enough to be one. */
+export function promptLabel(text) {
+  const cleaned = tidy(scrub(tidy(text)).replace(/\[(?:key|link|file|email|number)\]/g, ' '));
+  const body = stripLeadNumbers(stripOpeners(stripLeadNumbers(cleaned)))
+    .replace(/[‘’]/g, "'").replace(/["“”`*_@]/g, '').replace(/(?:\.{2,}|…)+\s*$/, '').replace(/\s+/g, ' ').trim();
+  // The first sentence that says something
+  const parts = body.split(/(?<=[.?!])\s+|\n+/).map(p => p.trim()).filter(Boolean);
+  let phrase = '';
+  for (const p of parts) {
+    phrase = phrase ? `${phrase} ${p}` : p;
+    if (phrase.split(' ').filter(meaningful).length >= 3) break;
+  }
+  const words = phrase.replace(/[.?!,;:]+$/, '').split(' ').filter(Boolean);
+  if (words.filter(meaningful).length < 3) return '';
+  // Looks like a fragment: it was cut off, or it ends on a joining word
+  if (DANGLING.has(plain(words[words.length - 1])) && words.length <= 7) return '';
+  const label = capWords(words.slice(0, 8)).replace(/[,;:\-]+$/, '').toLowerCase();
+  return label.split(' ').filter(meaningful).length >= 3 ? label : '';
+}
+
+const FOLDER_SKIP = new Set(['users', 'user', 'home', 'documents', 'desktop', 'downloads', 'library', 'private', 'tmp', 'var', 'opt', 'node_modules', 'dist', 'build', '.git', '.claude']);
+const EXT_NOUN = { md: 'notes', mdx: 'notes', txt: 'notes', html: 'pages', htm: 'pages', css: 'styles', scss: 'styles', js: 'code', mjs: 'code', ts: 'code', tsx: 'code', jsx: 'code', py: 'code', sh: 'scripts', json: 'data', yml: 'config', yaml: 'config', toml: 'config', png: 'images', jpg: 'images', jpeg: 'images', svg: 'images', pdf: 'documents' };
+
+/**
+ * What a run of work touched: the folder its files mostly sit in ("site/compare pages"), else the project folder it ran in.
+ * `files` are absolute paths, `cwd` the folder the session ran in. Returns '' when there is nothing safe to say.
+ */
+export function touchedLabel(files = [], cwd = '', home = '') {
+  const tally = new Map();
+  const exts = new Map();
+  const cwdClean = String(cwd || '').replace(/[\\/]+$/, '');
+  for (const f of files) {
+    let p = String(f);
+    if (cwdClean && p.startsWith(cwdClean + '/')) p = p.slice(cwdClean.length + 1);
+    else p = p.split(/[\\/]/).slice(-3).join('/');
+    const segs = p.split(/[\\/]/).filter(Boolean);
+    const file = segs.pop() || '';
+    const homeBase = String(home || '').split(/[\\/]/).filter(Boolean).pop();
+    const dirs = segs.filter(s => !FOLDER_SKIP.has(s.toLowerCase()) && !s.startsWith('.') && s !== homeBase).slice(0, 2);
+    const ext = (file.split('.').pop() || '').toLowerCase();
+    if (dirs.length) {
+      const k = dirs.join('/');
+      tally.set(k, (tally.get(k) || 0) + 1);
+      if (EXT_NOUN[ext]) exts.set(k + '|' + EXT_NOUN[ext], (exts.get(k + '|' + EXT_NOUN[ext]) || 0) + 1);
+    }
+  }
+  const pretty = (s) => s.replace(/([a-z])([A-Z])/g, '$1 $2').replace(/[_-]+/g, ' ').toLowerCase();
+  const best = [...tally].sort((a, b) => b[1] - a[1])[0];
+  if (best) {
+    const noun = [...exts].filter(([k]) => k.startsWith(best[0] + '|')).sort((a, b) => b[1] - a[1])[0];
+    const dir = pretty(best[0]);
+    const word = noun ? noun[0].split('|')[1] : '';
+    return word && !dir.endsWith(word) ? `${dir} ${word}` : dir;
+  }
+  // No folder to name: the project the work ran in, unless that is the home folder or plumbing
+  const base = cwdClean.split(/[\\/]/).filter(Boolean).pop() || '';
+  const homeBase = String(home || '').split(/[\\/]/).filter(Boolean).pop();
+  if (base && base !== homeBase && !FOLDER_SKIP.has(base.toLowerCase())) return pretty(base);
+  return '';
+}
+
+/**
+ * The name shown for a detour. Its own words when they make a readable label; else what it touched; else its kind.
+ * Everything that reaches the page has been through scrub() and is at most ~32 characters.
+ * `touched`: { files, cwd, home } for the work the detour covered.
+ */
+export function labelName(text, touched = {}, category = categorize(text)) {
+  const own = promptLabel(text);
+  if (own) return own;
+  const t = touchedLabel(touched.files, touched.cwd, touched.home);
+  const safe = t ? scrub(t).replace(/\[(?:key|link|file|email|number)\]/g, ' ').replace(/\s+/g, ' ').trim() : '';
+  if (safe && meaningful(safe.split(' ')[0]) && safe.length <= LABEL_MAX + 12) return capWords(safe.split(' '));
+  return category;
+}

package/src/analyzers/drift-run.js

@@ -0,0 +1,53 @@
+import { readTranscripts, defaultCodexDir } from '../readers/transcripts.js';
+import { readStatedPlans, moverVault } from '../readers/stated-plan.js';
+import { analyzeDrift } from './drift.js';
+
+const DAY = 86400000;
+
+/**
+ * The whole drift pipeline: read the last `days` of local sessions, find what you said you'd do, and label the work.
+ * Everything is local. Returns the analysis plus which sources were read, for the report's "how this was measured".
+ */
+export function runDrift(claudeDir, { days = 7, until = Date.now(), codexDir = defaultCodexDir() } = {}) {
+  const start = new Date(until);
+  start.setHours(0, 0, 0, 0);
+  start.setDate(start.getDate() - (days - 1));
+  const since = start.getTime();
+
+  const sessions = readTranscripts({ claudeDir, codexDir, since, until });
+  const codexSeen = sessions.some(s => s.agent === 'codex');
+
+  const vault = moverVault();
+  const plans = readStatedPlans({ vault });
+  const drift = analyzeDrift(sessions, { since, until, planFor: plans.planFor, planNotes: plans.notes() });
+
+  return {
+    ...drift,
+    windowDays: days,   // the length of the window; drift.days is the day-by-day list and must not be overwritten
+    inputs: {
+      claude: sessions.filter(s => s.agent === 'claude').length,
+      codex: sessions.filter(s => s.agent === 'codex').length,
+      codexPresent: codexSeen,
+      mover: plans.mover,
+    },
+  };
+}
+
+/**
+ * Drift as the plain report needs it: never throws, and says which of four things happened so the page can be honest.
+ *   ok       a written plan was found and there was agent work: `drift` holds the analysis
+ *   no-work  nothing from Claude Code or Codex in the window
+ *   no-plan  work, but no written plan to measure it against (the first-ask fallback is not shown as a headline)
+ *   error    the pipeline failed on this machine
+ */
+export function driftForReport(claudeDir, opts = {}) {
+  const days = opts.days || 7;
+  try {
+    const drift = runDrift(claudeDir, { days });
+    if (!drift.available) return { state: 'no-work', days };
+    if (!drift.source?.planNames?.length) return { state: 'no-plan', days, drift };
+    return { state: 'ok', days, drift };
+  } catch {
+    return { state: 'error', days };
+  }
+}