codeply-cli 0.5.6 → 0.6.0

package/lib/snapshot.js

@@ -1,146 +1,146 @@
-/**
- * Undo for agent changes: a hidden git repository, kept outside the project,
- * that records the project's files before a message runs so exactly what that
- * message changed can be put back.
- *
- * The approach (a separate --git-dir pointed at the project as --work-tree,
- * trees written with write-tree, files restored with checkout) follows
- * opencode's snapshot/index.ts, MIT License, Copyright (c) 2025 opencode.
- *
- * It never touches the project's own .git: no commits, no index, no refs.
- * The project's .gitignore still applies, plus a built-in list of heavy
- * folders so a project without a .gitignore doesn't snapshot node_modules.
- * Every function fails soft (returns null/false) when git is missing.
- */
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const crypto = require('crypto');
-const { execFile } = require('child_process');
-
-const ROOT = path.join(os.homedir(), '.codeply', 'snapshots');
-const TIMEOUT_MS = 30000;
-const EXCLUDES = [
-  'node_modules/', '.git/', 'dist/', 'build/', 'out/', '.next/', '.nuxt/', '.turbo/', '.cache/', 'coverage/',
-  '__pycache__/', '.venv/', 'venv/', 'target/', '*.log', '.DS_Store', 'Thumbs.db',
-];
-const MAX_FILE_BYTES = 5 * 1024 * 1024;
-
-function gitDirFor(cwd) {
-  const key = crypto.createHash('sha1').update(path.resolve(cwd).toLowerCase()).digest('hex').slice(0, 16);
-  return path.join(ROOT, key);
-}
-
-function git(cwd, args, { input } = {}) {
-  const gitDir = gitDirFor(cwd);
-  const full = [
-    '-c', 'core.autocrlf=false', '-c', 'core.longpaths=true', '-c', 'core.fsmonitor=false',
-    '-c', 'core.quotepath=false', '-c', `safe.directory=*`,
-    `--git-dir=${gitDir}`, `--work-tree=${path.resolve(cwd)}`, ...args,
-  ];
-  return new Promise((resolve) => {
-    const child = execFile('git', full, { cwd, timeout: TIMEOUT_MS, windowsHide: true, maxBuffer: 32 * 1024 * 1024 },
-      (err, stdout, stderr) => resolve({ ok: !err, out: String(stdout || ''), err: String(stderr || (err && err.message) || '') }));
-    if (input != null) { child.stdin.end(input); }
-  });
-}
-
-async function ensureRepo(cwd) {
-  const gitDir = gitDirFor(cwd);
-  if (!fs.existsSync(path.join(gitDir, 'HEAD'))) {
-    fs.mkdirSync(gitDir, { recursive: true });
-    const r = await git(cwd, ['init', '-q']);
-    if (!r.ok) return false;
-    fs.writeFileSync(path.join(gitDir, 'codeply-project.txt'), path.resolve(cwd));
-  }
-  // Refreshed every time so changes to the list reach existing repos.
-  fs.mkdirSync(path.join(gitDir, 'info'), { recursive: true });
-  fs.writeFileSync(path.join(gitDir, 'info', 'exclude'), EXCLUDES.join('\n') + '\n');
-  return true;
-}
-
-/** Big files (videos, datasets) that aren't gitignored are left out, like opencode does. */
-async function excludeLargeUntracked(cwd) {
-  const r = await git(cwd, ['ls-files', '--others', '--exclude-standard', '-z']);
-  if (!r.ok || !r.out) return [];
-  const big = [];
-  for (const rel of r.out.split('\0').filter(Boolean)) {
-    try { if (fs.statSync(path.join(cwd, rel)).size > MAX_FILE_BYTES) big.push(rel); } catch {}
-  }
-  return big;
-}
-
-/**
- * Record the project's current files.
- * @returns {Promise<string|null>} a tree hash, or null if snapshots are unavailable
- */
-async function track(cwd) {
-  try {
-    if (!cwd || !fs.existsSync(cwd) || !(await ensureRepo(cwd))) return null;
-    const big = await excludeLargeUntracked(cwd);
-    const add = await git(cwd, ['add', '-A', '--', '.', ...big.map((b) => `:(exclude,literal)${b}`)]);
-    if (!add.ok) return null;
-    const tree = await git(cwd, ['write-tree']);
-    return tree.ok ? tree.out.trim() || null : null;
-  } catch { return null; }
-}
-
-/** Files that differ between two recorded trees. */
-async function changedFiles(cwd, fromTree, toTree) {
-  if (!fromTree || !toTree || fromTree === toTree) return [];
-  const r = await git(cwd, ['diff-tree', '-r', '--name-status', '--no-renames', '-z', fromTree, toTree]);
-  if (!r.ok) return [];
-  const parts = r.out.split('\0').filter(Boolean);
-  const out = [];
-  for (let i = 0; i + 1 < parts.length; i += 2) {
-    out.push({ status: parts[i], file: parts[i + 1] }); // A added, M modified, D deleted
-  }
-  return out;
-}
-
-/** Does `file` exist in `tree`? */
-async function inTree(cwd, tree, file) {
-  const r = await git(cwd, ['cat-file', '-e', `${tree}:${file}`]);
-  return r.ok;
-}
-
-/**
- * Put `files` back the way they were in `tree`: restore the ones it had,
- * delete the ones it didn't (they were created after it).
- * @returns {Promise<{ok:boolean, restored:string[], removed:string[], failed:string[]}>}
- */
-async function restore(cwd, tree, files) {
-  const restored = [], removed = [], failed = [];
-  if (!tree || !(await ensureRepo(cwd))) return { ok: false, restored, removed, failed: files.slice() };
-  const existed = [];
-  for (const f of files) {
-    if (await inTree(cwd, tree, f)) existed.push(f);
-    else {
-      try { fs.rmSync(path.join(cwd, f), { force: true }); removed.push(f); } catch { failed.push(f); }
-    }
-  }
-  for (let i = 0; i < existed.length; i += 100) {
-    const batch = existed.slice(i, i + 100);
-    const r = await git(cwd, ['checkout', tree, '--', ...batch]);
-    if (r.ok) restored.push(...batch);
-    else {
-      // One bad path shouldn't block the rest.
-      for (const f of batch) {
-        const one = await git(cwd, ['checkout', tree, '--', f]);
-        (one.ok ? restored : failed).push(f);
-      }
-    }
-  }
-  return { ok: failed.length === 0, restored, removed, failed };
-}
-
-/** Is git usable here at all? Cached. */
-let gitAvailable;
-function available() {
-  if (gitAvailable !== undefined) return Promise.resolve(gitAvailable);
-  return new Promise((resolve) => {
-    execFile('git', ['--version'], { timeout: 5000, windowsHide: true }, (err) => { gitAvailable = !err; resolve(gitAvailable); });
-  });
-}
-
-module.exports = { track, changedFiles, restore, available, gitDirFor };
+/**
+ * Undo for agent changes: a hidden git repository, kept outside the project,
+ * that records the project's files before a message runs so exactly what that
+ * message changed can be put back.
+ *
+ * The approach (a separate --git-dir pointed at the project as --work-tree,
+ * trees written with write-tree, files restored with checkout) follows
+ * opencode's snapshot/index.ts, MIT License, Copyright (c) 2025 opencode.
+ *
+ * It never touches the project's own .git: no commits, no index, no refs.
+ * The project's .gitignore still applies, plus a built-in list of heavy
+ * folders so a project without a .gitignore doesn't snapshot node_modules.
+ * Every function fails soft (returns null/false) when git is missing.
+ */
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+const { execFile } = require('child_process');
+
+const ROOT = path.join(os.homedir(), '.codeply', 'snapshots');
+const TIMEOUT_MS = 30000;
+const EXCLUDES = [
+  'node_modules/', '.git/', 'dist/', 'build/', 'out/', '.next/', '.nuxt/', '.turbo/', '.cache/', 'coverage/',
+  '__pycache__/', '.venv/', 'venv/', 'target/', '*.log', '.DS_Store', 'Thumbs.db',
+];
+const MAX_FILE_BYTES = 5 * 1024 * 1024;
+
+function gitDirFor(cwd) {
+  const key = crypto.createHash('sha1').update(path.resolve(cwd).toLowerCase()).digest('hex').slice(0, 16);
+  return path.join(ROOT, key);
+}
+
+function git(cwd, args, { input } = {}) {
+  const gitDir = gitDirFor(cwd);
+  const full = [
+    '-c', 'core.autocrlf=false', '-c', 'core.longpaths=true', '-c', 'core.fsmonitor=false',
+    '-c', 'core.quotepath=false', '-c', `safe.directory=*`,
+    `--git-dir=${gitDir}`, `--work-tree=${path.resolve(cwd)}`, ...args,
+  ];
+  return new Promise((resolve) => {
+    const child = execFile('git', full, { cwd, timeout: TIMEOUT_MS, windowsHide: true, maxBuffer: 32 * 1024 * 1024 },
+      (err, stdout, stderr) => resolve({ ok: !err, out: String(stdout || ''), err: String(stderr || (err && err.message) || '') }));
+    if (input != null) { child.stdin.end(input); }
+  });
+}
+
+async function ensureRepo(cwd) {
+  const gitDir = gitDirFor(cwd);
+  if (!fs.existsSync(path.join(gitDir, 'HEAD'))) {
+    fs.mkdirSync(gitDir, { recursive: true });
+    const r = await git(cwd, ['init', '-q']);
+    if (!r.ok) return false;
+    fs.writeFileSync(path.join(gitDir, 'codeply-project.txt'), path.resolve(cwd));
+  }
+  // Refreshed every time so changes to the list reach existing repos.
+  fs.mkdirSync(path.join(gitDir, 'info'), { recursive: true });
+  fs.writeFileSync(path.join(gitDir, 'info', 'exclude'), EXCLUDES.join('\n') + '\n');
+  return true;
+}
+
+/** Big files (videos, datasets) that aren't gitignored are left out, like opencode does. */
+async function excludeLargeUntracked(cwd) {
+  const r = await git(cwd, ['ls-files', '--others', '--exclude-standard', '-z']);
+  if (!r.ok || !r.out) return [];
+  const big = [];
+  for (const rel of r.out.split('\0').filter(Boolean)) {
+    try { if (fs.statSync(path.join(cwd, rel)).size > MAX_FILE_BYTES) big.push(rel); } catch {}
+  }
+  return big;
+}
+
+/**
+ * Record the project's current files.
+ * @returns {Promise<string|null>} a tree hash, or null if snapshots are unavailable
+ */
+async function track(cwd) {
+  try {
+    if (!cwd || !fs.existsSync(cwd) || !(await ensureRepo(cwd))) return null;
+    const big = await excludeLargeUntracked(cwd);
+    const add = await git(cwd, ['add', '-A', '--', '.', ...big.map((b) => `:(exclude,literal)${b}`)]);
+    if (!add.ok) return null;
+    const tree = await git(cwd, ['write-tree']);
+    return tree.ok ? tree.out.trim() || null : null;
+  } catch { return null; }
+}
+
+/** Files that differ between two recorded trees. */
+async function changedFiles(cwd, fromTree, toTree) {
+  if (!fromTree || !toTree || fromTree === toTree) return [];
+  const r = await git(cwd, ['diff-tree', '-r', '--name-status', '--no-renames', '-z', fromTree, toTree]);
+  if (!r.ok) return [];
+  const parts = r.out.split('\0').filter(Boolean);
+  const out = [];
+  for (let i = 0; i + 1 < parts.length; i += 2) {
+    out.push({ status: parts[i], file: parts[i + 1] }); // A added, M modified, D deleted
+  }
+  return out;
+}
+
+/** Does `file` exist in `tree`? */
+async function inTree(cwd, tree, file) {
+  const r = await git(cwd, ['cat-file', '-e', `${tree}:${file}`]);
+  return r.ok;
+}
+
+/**
+ * Put `files` back the way they were in `tree`: restore the ones it had,
+ * delete the ones it didn't (they were created after it).
+ * @returns {Promise<{ok:boolean, restored:string[], removed:string[], failed:string[]}>}
+ */
+async function restore(cwd, tree, files) {
+  const restored = [], removed = [], failed = [];
+  if (!tree || !(await ensureRepo(cwd))) return { ok: false, restored, removed, failed: files.slice() };
+  const existed = [];
+  for (const f of files) {
+    if (await inTree(cwd, tree, f)) existed.push(f);
+    else {
+      try { fs.rmSync(path.join(cwd, f), { force: true }); removed.push(f); } catch { failed.push(f); }
+    }
+  }
+  for (let i = 0; i < existed.length; i += 100) {
+    const batch = existed.slice(i, i + 100);
+    const r = await git(cwd, ['checkout', tree, '--', ...batch]);
+    if (r.ok) restored.push(...batch);
+    else {
+      // One bad path shouldn't block the rest.
+      for (const f of batch) {
+        const one = await git(cwd, ['checkout', tree, '--', f]);
+        (one.ok ? restored : failed).push(f);
+      }
+    }
+  }
+  return { ok: failed.length === 0, restored, removed, failed };
+}
+
+/** Is git usable here at all? Cached. */
+let gitAvailable;
+function available() {
+  if (gitAvailable !== undefined) return Promise.resolve(gitAvailable);
+  return new Promise((resolve) => {
+    execFile('git', ['--version'], { timeout: 5000, windowsHide: true }, (err) => { gitAvailable = !err; resolve(gitAvailable); });
+  });
+}
+
+module.exports = { track, changedFiles, restore, available, gitDirFor };

package/lib/subagents.js

@@ -105,7 +105,7 @@ function findSubagentByName(name) {
 // completely wrong specialist instead of just staying General.
 const AUTO_ROUTES = [
   { id: 'security', re: /\b(vulnerabilit(?:y|ies)|xss|csrf|sql\s?injections?|penetration\s?tests?|pentest|exploits?|security\b|auth(?:entication|orization)?\s?(?:bugs?|bypass(?:es)?|checks?|flows?|tokens?)|hash(?:ing)?\s?passwords?|encrypt(?:ion|ed)?|secrets?\s?(?:leak(?:ed)?|expos(?:ed|ure))|credentials?(?:\s?leak(?:ed)?)?|rate\s?limit(?:ing)?|owasp|csp\b|cors\b|jwt\b|sanitiz(?:e|ing|ation)|injection\s?attacks?)\b/i },
-  { id: 'database', re: /\b(databases?|db\s?schemas?|schemas?\s?(?:change|design|migration)|migrat(?:ion|ions|e|ing)|sql\s?quer(?:y|ies)|quer(?:y|ies)\s?(?:plan|slow|performance)|add(?:ing)?\s?an?\s?index|indexes?|foreign\s?keys?|primary\s?keys?|postgres(?:ql)?|mysql|sqlite|mongo(?:db)?|n\+1\s?quer|tables?\s?(?:column|row|schema)|orm\b|prisma\b|supabase\s?tables?)\b/i },
+  { id: 'database', re: /\b(databases?|db\s?schemas?|schemas?\s?(?:change|design|migration)|migrat(?:ion|ions|e|ing)|sql\s?quer(?:y|ies)|quer(?:y|ies)\s?(?:plan|slow|performance)|add(?:ing)?\s?(?:an?\s?)?(?:db\s?|database\s?|sql\s?|unique\s?|composite\s?)?(?:index|indexes|indices)|(?:database|db|sql|table|column|unique|composite|missing|btree|gin)\s?(?:index|indexes|indices)|(?:index|indexes|indices)\s+(?:on|for)\s+(?:the\s+)?(?:\w+\s+)?(?:tables?|columns?|fields?|quer(?:y|ies))|(?:create|drop)\s?(?:unique\s?)?index|foreign\s?keys?|primary\s?keys?|postgres(?:ql)?|mysql|sqlite|mongo(?:db)?|n\+1\s?quer|tables?\s?(?:column|row|schema)|orm\b|prisma\b|supabase\s?tables?)\b/i },
   { id: 'devops', re: /\b(ci\/cd|ci\s?pipelines?|github\s?actions|deploy(?:ment|ments|ing|ed)?|rollbacks?|dockerfiles?|docker\s?compose|kubernetes|k8s|zero[- ]downtime|infra(?:structure)?(?:\s?as\s?code)?|env(?:ironment)?\s?variables?|secrets?\s?manager|build\s?pipelines?|hosting|vercel|netlify|render\.com|health\s?checks?|uptime|logging\s?(?:setup|infra)|monitoring|observability)\b/i },
   { id: 'testing', re: /\b(unit\s?tests?|write\s?(?:a\s?|some\s?)?tests?|regression\s?tests?|e2e\s?tests?|end[- ]to[- ]end\s?tests?|test\s?coverage|flaky\s?tests?|reproduce\s?(?:this|the)\s?bugs?|test\s?suites?|qa\s?pass|edge\s?cases?|testing\s?strategy|test\s?(?:the|this|my|it|out)\b|does\s?(?:it|this)\s?works?|check\s?if\s?(?:it|this)\s?works?)\b/i },
   { id: 'backend', re: /\b(api\s?(?:endpoints?|routes?|integrations?)|rest\s?api|backend\s?(?:logic|routes?|bugs?|code)|business\s?logic|server[- ]side|race\s?conditions?|idempotent|webhooks?|graphql|endpoints?\s?(?:for|to)|route\s?handlers?|server\s?errors?)\b/i },
@@ -140,7 +140,9 @@ const NICHE_ALIASES = {
 function detectExplicitMention(message) {
   const text = String(message || '');
   for (const a of listSubagents()) {
-    if (new RegExp(`\\b${a.name}\\b`, 'i').test(text)) return a.id;
+    // A mascot name inside a file name or path is not a mention: the
+    // database role is called Index, and "index.html" is not asking for it.
+    if (new RegExp(`(?<![\\w./\\\\-])${a.name}(?![\\w/\\\\-]|\\.\\w)`, 'i').test(text)) return a.id;
     for (const alias of NICHE_ALIASES[a.id] || []) {
       if (new RegExp(`\\b${alias}\\s+(?:agent|specialist|bot)\\b`, 'i').test(text)) return a.id;
     }

package/lib/telemetry.js

@@ -1,105 +1,105 @@
-/**
- * Usage counts for Codeply's admin dashboard: which app was used (Craft, Crew
- * or the CLI), which model, Auto or the user's own key, tokens in and out, and
- * the app version. Never prompts, replies, files or anything typed.
- *
- * Events wait in memory and go out in small batches (about once a minute, and
- * once more before the process exits) to Codeply's track function, only when
- * the user is signed in to Codeply. A Cloud run inside GitHub Actions has no
- * sign-in; it sends with the usage key Craft put in the repo's secrets
- * (CODEPLY_TRACK_KEY). Off with CODEPLY_TELEMETRY=0, or "telemetry": false in
- * ~/.codeply/config.json.
- *
- * Which app a call belongs to: the host sets a default (Craft's main process
- * says "craft"; the CLI is "cli" by default), and Crew runs its bots inside
- * withProduct('crew', ...), which follows the call through every await.
- */
-const { AsyncLocalStorage } = require('async_hooks');
-
-const als = new AsyncLocalStorage();
-const defaults = { product: 'cli', version: '', platform: process.platform };
-try { defaults.version = require('../package.json').version || ''; } catch {}
-let queue = [];
-let timer = null;
-let sending = false;
-const FLUSH_MS = 60_000;
-const MAX_QUEUE = 500;
-
-function enabled() {
-  if (process.env.CODEPLY_TELEMETRY === '0') return false;
-  try { return require('./config.js').getConfig().telemetry !== false; } catch { return true; }
-}
-
-/** The host says what it is: setDefaults({ product: 'craft', version: '1.1.14' }). */
-function setDefaults(d) { Object.assign(defaults, d || {}); }
-
-/** Run fn with every AI call inside it counted for this product. */
-function withProduct(product, fn) { return als.run({ product }, fn); }
-
-function currentProduct() { const s = als.getStore(); return (s && s.product) || defaults.product; }
-
-function push(ev) {
-  if (!enabled()) return;
-  queue.push({ product: currentProduct(), version: defaults.version, platform: defaults.platform, at: new Date().toISOString(), ...ev });
-  if (queue.length > MAX_QUEUE) queue = queue.slice(-MAX_QUEUE);
-  if (queue.length >= 40) flush();
-  else if (!timer) { timer = setTimeout(() => { timer = null; flush(); }, FLUSH_MS); if (timer.unref) timer.unref(); }
-}
-
-/** One model call: { model, provider, tokens_in, tokens_out, ms }. */
-function recordAi(ev) {
-  if (ev && ev.model === 'fake') return; // the engine tests' stand-in model is not real use
-  push({ kind: 'ai', ...ev });
-}
-
-/** The app was opened (counts active users even on a day with no AI call), once an hour at most. */
-const lastOpen = new Map();
-function recordOpen(product) {
-  const p = product || currentProduct();
-  if (Date.now() - (lastOpen.get(p) || 0) < 3600_000) return;
-  lastOpen.set(p, Date.now());
-  push({ kind: 'open', product: p });
-}
-
-async function flush() {
-  if (sending || !queue.length || !enabled()) return;
-  sending = true;
-  const batch = queue.slice(0, 100);
-  try {
-    const auth = require('./auth.js');
-    const trackKey = String(process.env.CODEPLY_TRACK_KEY || '').trim();
-    const token = trackKey ? null : await auth.getAccessToken().catch(() => null);
-    if (!token && !trackKey) { queue = []; return; } // signed out: nothing is kept or sent
-    const res = await fetch(`${auth.SUPABASE_URL}/functions/v1/track`, {
-      method: 'POST',
-      headers: { ...(trackKey ? { 'x-codeply-track-key': trackKey } : { Authorization: `Bearer ${token}` }), apikey: auth.SUPABASE_ANON_KEY, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ events: batch }),
-      signal: AbortSignal.timeout(15_000),
-    });
-    if (res.ok || res.status === 400) queue = queue.slice(batch.length); // sent (or unusable): drop them
-  } catch {
-    // Offline: they wait for the next flush.
-  } finally {
-    sending = false;
-    if (queue.length && !timer) { timer = setTimeout(() => { timer = null; flush(); }, FLUSH_MS); if (timer.unref) timer.unref(); }
-  }
-}
-
-/** Token counts from any provider's response shape, or an estimate from the text. */
-function tokensOf(data, messages) {
-  const u = (data && data.usage) || {};
-  const tin = u.prompt_tokens ?? u.input_tokens ?? (data && data.prompt_eval_count);
-  const tout = u.completion_tokens ?? u.output_tokens ?? (data && data.eval_count);
-  if (tin != null || tout != null) return { tokens_in: Number(tin) || 0, tokens_out: Number(tout) || 0 };
-  const chars = (arr) => arr.reduce((n, m) => n + (typeof m.content === 'string' ? m.content.length : JSON.stringify(m.content || '').length), 0);
-  const reply = data && data.choices && data.choices[0] && data.choices[0].message ? String(data.choices[0].message.content || '') : '';
-  return { tokens_in: Math.round(chars(messages || []) / 4), tokens_out: Math.round(reply.length / 4) };
-}
-
-// Send what is waiting before the process ends (short CLI commands and Cloud
-// runs finish long before the minute timer). beforeExit fires again after the
-// send; with the queue empty, flush does nothing and the process exits.
-let exitFlushes = 0;
-process.on('beforeExit', () => { if (queue.length && exitFlushes++ < 3) flush(); });
-
-module.exports = { setDefaults, withProduct, currentProduct, recordAi, recordOpen, flush, tokensOf };
+/**
+ * Usage counts for Codeply's admin dashboard: which app was used (Craft, Crew
+ * or the CLI), which model, Auto or the user's own key, tokens in and out, and
+ * the app version. Never prompts, replies, files or anything typed.
+ *
+ * Events wait in memory and go out in small batches (about once a minute, and
+ * once more before the process exits) to Codeply's track function, only when
+ * the user is signed in to Codeply. A Cloud run inside GitHub Actions has no
+ * sign-in; it sends with the usage key Craft put in the repo's secrets
+ * (CODEPLY_TRACK_KEY). Off with CODEPLY_TELEMETRY=0, or "telemetry": false in
+ * ~/.codeply/config.json.
+ *
+ * Which app a call belongs to: the host sets a default (Craft's main process
+ * says "craft"; the CLI is "cli" by default), and Crew runs its bots inside
+ * withProduct('crew', ...), which follows the call through every await.
+ */
+const { AsyncLocalStorage } = require('async_hooks');
+
+const als = new AsyncLocalStorage();
+const defaults = { product: 'cli', version: '', platform: process.platform };
+try { defaults.version = require('../package.json').version || ''; } catch {}
+let queue = [];
+let timer = null;
+let sending = false;
+const FLUSH_MS = 60_000;
+const MAX_QUEUE = 500;
+
+function enabled() {
+  if (process.env.CODEPLY_TELEMETRY === '0') return false;
+  try { return require('./config.js').getConfig().telemetry !== false; } catch { return true; }
+}
+
+/** The host says what it is: setDefaults({ product: 'craft', version: '1.1.14' }). */
+function setDefaults(d) { Object.assign(defaults, d || {}); }
+
+/** Run fn with every AI call inside it counted for this product. */
+function withProduct(product, fn) { return als.run({ product }, fn); }
+
+function currentProduct() { const s = als.getStore(); return (s && s.product) || defaults.product; }
+
+function push(ev) {
+  if (!enabled()) return;
+  queue.push({ product: currentProduct(), version: defaults.version, platform: defaults.platform, at: new Date().toISOString(), ...ev });
+  if (queue.length > MAX_QUEUE) queue = queue.slice(-MAX_QUEUE);
+  if (queue.length >= 40) flush();
+  else if (!timer) { timer = setTimeout(() => { timer = null; flush(); }, FLUSH_MS); if (timer.unref) timer.unref(); }
+}
+
+/** One model call: { model, provider, tokens_in, tokens_out, ms }. */
+function recordAi(ev) {
+  if (ev && ev.model === 'fake') return; // the engine tests' stand-in model is not real use
+  push({ kind: 'ai', ...ev });
+}
+
+/** The app was opened (counts active users even on a day with no AI call), once an hour at most. */
+const lastOpen = new Map();
+function recordOpen(product) {
+  const p = product || currentProduct();
+  if (Date.now() - (lastOpen.get(p) || 0) < 3600_000) return;
+  lastOpen.set(p, Date.now());
+  push({ kind: 'open', product: p });
+}
+
+async function flush() {
+  if (sending || !queue.length || !enabled()) return;
+  sending = true;
+  const batch = queue.slice(0, 100);
+  try {
+    const auth = require('./auth.js');
+    const trackKey = String(process.env.CODEPLY_TRACK_KEY || '').trim();
+    const token = trackKey ? null : await auth.getAccessToken().catch(() => null);
+    if (!token && !trackKey) { queue = []; return; } // signed out: nothing is kept or sent
+    const res = await fetch(`${auth.SUPABASE_URL}/functions/v1/track`, {
+      method: 'POST',
+      headers: { ...(trackKey ? { 'x-codeply-track-key': trackKey } : { Authorization: `Bearer ${token}` }), apikey: auth.SUPABASE_ANON_KEY, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ events: batch }),
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (res.ok || res.status === 400) queue = queue.slice(batch.length); // sent (or unusable): drop them
+  } catch {
+    // Offline: they wait for the next flush.
+  } finally {
+    sending = false;
+    if (queue.length && !timer) { timer = setTimeout(() => { timer = null; flush(); }, FLUSH_MS); if (timer.unref) timer.unref(); }
+  }
+}
+
+/** Token counts from any provider's response shape, or an estimate from the text. */
+function tokensOf(data, messages) {
+  const u = (data && data.usage) || {};
+  const tin = u.prompt_tokens ?? u.input_tokens ?? (data && data.prompt_eval_count);
+  const tout = u.completion_tokens ?? u.output_tokens ?? (data && data.eval_count);
+  if (tin != null || tout != null) return { tokens_in: Number(tin) || 0, tokens_out: Number(tout) || 0 };
+  const chars = (arr) => arr.reduce((n, m) => n + (typeof m.content === 'string' ? m.content.length : JSON.stringify(m.content || '').length), 0);
+  const reply = data && data.choices && data.choices[0] && data.choices[0].message ? String(data.choices[0].message.content || '') : '';
+  return { tokens_in: Math.round(chars(messages || []) / 4), tokens_out: Math.round(reply.length / 4) };
+}
+
+// Send what is waiting before the process ends (short CLI commands and Cloud
+// runs finish long before the minute timer). beforeExit fires again after the
+// send; with the queue empty, flush does nothing and the process exits.
+let exitFlushes = 0;
+process.on('beforeExit', () => { if (queue.length && exitFlushes++ < 3) flush(); });
+
+module.exports = { setDefaults, withProduct, currentProduct, recordAi, recordOpen, flush, tokensOf };