costgrep-cli 0.7.3 → 0.7.5

package/README.md

@@ -1,6 +1,7 @@
 # costgrep
 
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/costgrep-cli.svg)](https://www.npmjs.com/package/costgrep-cli)
 [![test](https://github.com/Paraphern/costgrep/actions/workflows/test.yml/badge.svg)](https://github.com/Paraphern/costgrep/actions/workflows/test.yml)
 [![self-audit](https://github.com/Paraphern/costgrep/actions/workflows/audit.yml/badge.svg)](https://github.com/Paraphern/costgrep/actions/workflows/audit.yml)
 
@@ -51,6 +52,18 @@ dependencies (single-file CLI core + a plain `agents.json` for the classifier
 lists — the core works standalone if the data file is missing), no telemetry,
 no code/log access — workflow-run metadata only.
 
+## Install
+
+```bash
+npx costgrep-cli --repo owner/name          # one-shot
+npm i -g costgrep-cli && costgrep --repo owner/name
+```
+
+The npm package is **`costgrep-cli`** (both binaries: `costgrep` and `costgrep-cli`).
+Honest naming note: npm's typosquat filter blocks the plain name `costgrep` as
+"too similar to `postgres`" (edit distance, really) — the repo, the GitHub action
+and everything else stay `costgrep`.
+
 ## Quick start (composite action)
 
 ```yaml

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "costgrep-cli",
-  "version": "0.7.3",
+  "version": "0.7.5",
   "description": "GitHub Actions cost breakdown: human vs AI agent vs bot. Zero-dependency CLI + composite action.",
   "type": "module",
   "license": "Apache-2.0",
@@ -8,7 +8,7 @@
   "homepage": "https://github.com/Paraphern/costgrep#readme",
   "repository": { "type": "git", "url": "git+https://github.com/Paraphern/costgrep.git" },
   "bugs": "https://github.com/Paraphern/costgrep/issues",
-  "bin": { "costgrep": "scripts/costgrep.mjs" },
+  "bin": { "costgrep": "scripts/costgrep.mjs", "costgrep-cli": "scripts/costgrep.mjs" },
   "scripts": {
     "test": "node --test"
   },

package/scripts/costgrep.mjs

@@ -22,7 +22,7 @@ import { parseArgs } from 'node:util';
 
 const API = process.env.COSTGREP_API || 'https://api.github.com'; // env override exists for local-mock verification only
 const HTTP_TIMEOUT = Math.max(1_000, parseInt(process.env.COSTGREP_TIMEOUT_MS, 10) || 30_000);
-const VERSION = '0.7.3'; // keep in sync with package.json
+const VERSION = '0.7.5'; // keep in sync with package.json
 
 // ---------------------------------------------------------------------------
 // Rate matrix — GitHub-hosted runners, list prices effective 2026-01-01.
@@ -175,7 +175,7 @@ async function gh(path, token) {
       if (attempt === 0) {
         const wait = Math.min(Math.max(reset - Date.now(), 2000), 60_000);
         if (!process.env.COSTGREP_NO_WAIT) {
-          console.error(`rate limit hit, retrying in ${Math.round(wait / 1000)}s`);
+          console.error(`rate limit hit (${token ? 'token' : 'anonymous access: 60 requests/hour'}), retrying in ${Math.round(wait / 1000)}s — pass --token (Actions:read) for 5000/hour`);
           await new Promise(r => setTimeout(r, wait));
           continue;
         }
@@ -933,6 +933,9 @@ async function main() {
     const vis = await repoVisibility(args.repo, token);
     const runs = await listRuns(args.repo, since, token, args['max-runs']);
     runsArr = runs;
+    if (!token && runs.length > 40) {
+      console.error(`hint: no --token given — anonymous access allows 60 requests/hour and this audit needs ~${runs.length + Math.ceil(runs.length / 100)} calls; it may fail mid-way. A fine-grained PAT with Actions:read raises the limit to 5000/hour.`);
+    }
     const jobsByRun = new Map();
     let done = 0;
     for (const run of runs) {