devlabs-talent 0.1.0

package/README.md

@@ -0,0 +1,24 @@
+# devlabs-talent
+
+Builder-level local analyzer for DevLabs Agent Wrapped.
+
+```bash
+npx devlabs-talent@latest analyze --token <verified-upload-token>
+```
+
+Use `--color` to force the DevLabs terminal theme when recording or screenshotting output:
+
+```bash
+npx devlabs-talent@latest analyze --token <verified-upload-token> --color
+```
+
+After a successful upload, the CLI opens the shareable Wrapped URL in your default browser.
+Use `--no-open` to disable that behavior.
+
+The upload API defaults to `https://www.devlabs.club`, and the browser opens the public
+Wrapped URL on `https://www.devlabs.club` by default. Use `--api` only for non-production
+upload testing, and `--public-url` only if the public web host changes.
+
+The CLI scans safe local AI-agent usage sources across Claude Code, Codex, Cursor, and optional exported summaries. It shows a preview before upload and never uploads raw prompts, raw conversations, source code, secrets, environment variables, full local paths, or private filenames.
+
+Set `DEVLABS_API_URL` to test against a non-production DevLabs app.

package/bin/agent-wrapped.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { main } from '../src/cli.js';
+
+main(process.argv.slice(2)).catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exit(1);
+});

package/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "devlabs-talent",
+  "version": "0.1.0",
+  "description": "Generate safe DevLabs Agent Wrapped reports from builder-level AI agent usage.",
+  "type": "module",
+  "bin": {
+    "agent-wrapped": "bin/agent-wrapped.js",
+    "devlabs-agent-wrapped": "bin/agent-wrapped.js",
+    "devlabs-talent": "bin/agent-wrapped.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "analyze": "node ./bin/agent-wrapped.js analyze"
+  }
+}

package/src/cli.js

@@ -0,0 +1,32 @@
+import { analyzeCommand } from './commands/analyze.js';
+
+function usage() {
+  console.log(`DevLabs Agent Wrapped
+
+Usage:
+  agent-wrapped analyze --token <verified-upload-token> [--api <url>] [--public-url <url>] [--import <path>] [--yes] [--color] [--no-open]
+  agent-wrapped doctor
+  agent-wrapped login
+  agent-wrapped preview
+  agent-wrapped upload
+`);
+}
+
+export async function main(argv) {
+  const [command, ...rest] = argv;
+  if (!command || command === '--help' || command === '-h') {
+    usage();
+    return;
+  }
+  if (command === 'analyze') return analyzeCommand(rest);
+  if (command === 'doctor') {
+    console.log('Doctor checks are scaffolded. Run `agent-wrapped analyze --token <token>` to scan available agent sources.');
+    return;
+  }
+  if (command === 'login' || command === 'preview' || command === 'upload') {
+    console.log(`\`${command}\` is scaffolded for a future split-command flow. V1 uses \`analyze\` end to end.`);
+    return;
+  }
+  usage();
+  process.exitCode = 1;
+}

package/src/commands/analyze.js

@@ -0,0 +1,124 @@
+import fs from 'node:fs';
+import { createInterface } from 'node:readline/promises';
+import { stdin as input, stdout as output } from 'node:process';
+import { discoverAgentSources, readSourceSamples } from '../sources/discover.js';
+import { generateReport } from '../report/generateReport.js';
+import { previewReport } from '../preview/previewReport.js';
+import { uploadReport } from '../upload/uploadReport.js';
+import { decodeUploadToken } from '../upload/token.js';
+import { openBrowser } from '../utils/openBrowser.js';
+
+function parseArgs(argv) {
+  const args = {
+    imports: [],
+    yes: false,
+    color: undefined,
+    open: true,
+    api: process.env.DEVLABS_API_URL || 'https://www.devlabs.club',
+    publicUrl: process.env.DEVLABS_PUBLIC_URL || 'https://www.devlabs.club',
+  };
+  for (let index = 0; index < argv.length; index += 1) {
+    const item = argv[index];
+    if (item === '--token') args.token = argv[++index];
+    else if (item === '--api') args.api = argv[++index];
+    else if (item === '--public-url') args.publicUrl = argv[++index];
+    else if (item === '--import') args.imports.push(argv[++index]);
+    else if (item === '--yes' || item === '-y') args.yes = true;
+    else if (item === '--color') args.color = true;
+    else if (item === '--no-color') args.color = false;
+    else if (item === '--no-open') args.open = false;
+  }
+  return args;
+}
+
+function isYes(answer) {
+  return answer.trim().toLowerCase() === 'y' || answer.trim().toLowerCase() === 'yes';
+}
+
+function createPrompter(skipPrompts) {
+  if (skipPrompts) return { askYes: async () => true, close: () => {} };
+  if (!input.isTTY) {
+    const answers = fs.readFileSync(0, 'utf8').split(/\r?\n/);
+    return {
+      askYes: async (question) => {
+        output.write(question);
+        const answer = answers.shift() || '';
+        output.write('\n');
+        return isYes(answer);
+      },
+      close: () => {},
+    };
+  }
+  const rl = createInterface({ input, output });
+  return {
+    askYes: async (question) => isYes(await rl.question(question)),
+    close: () => rl.close(),
+  };
+}
+
+export async function analyzeCommand(argv) {
+  const args = parseArgs(argv);
+  if (!args.token) throw new Error('Missing --token. Copy the command from the DevLabs phone verification screen.');
+  const tokenPayload = decodeUploadToken(args.token);
+  if (!tokenPayload?.builderId) throw new Error('The upload token is malformed.');
+  const prompter = createPrompter(args.yes);
+
+  try {
+    console.log('DevLabs Agent Wrapped');
+    console.log('Scanning builder-level AI agent usage sources...');
+
+    const sources = await discoverAgentSources({ imports: args.imports });
+    if (!sources.length) {
+      console.log('No local agent sources found. Add exported summaries with `--import <path>` and run again.');
+      return;
+    }
+
+    console.log(`Detected ${sources.length} source${sources.length === 1 ? '' : 's'}:`);
+    for (const source of sources) {
+      console.log(`- ${source.agent}: ${source.kind} (${source.safeCountLabel})`);
+    }
+
+    if (!args.yes) {
+      const approvedSources = await prompter.askYes('Analyze these sources locally? [y/N] ');
+      if (!approvedSources) {
+        console.log('Analysis cancelled. Nothing was read or uploaded.');
+        return;
+      }
+    }
+
+    const samples = await readSourceSamples(sources);
+    const report = generateReport({
+      builderId: tokenPayload.builderId,
+      builderName: tokenPayload.email?.split('@')[0],
+      samples,
+      publicRoot: args.publicUrl,
+    });
+
+    previewReport(report, sources, { color: args.color });
+
+    if (!args.yes) {
+      const approved = await prompter.askYes('Upload this wrapped report to DevLabs? [y/N] ');
+      if (!approved) {
+        console.log('Upload cancelled. Nothing was sent to DevLabs.');
+        return;
+      }
+    }
+
+    const result = await uploadReport({
+      apiRoot: args.api,
+      token: args.token,
+      builderId: tokenPayload.builderId,
+      report,
+    });
+
+    console.log('Uploaded Agent Wrapped report.');
+    const publicUrl = new URL(result.publicUrl, args.publicUrl).toString();
+    console.log(`Public URL: ${publicUrl}`);
+    if (args.open) {
+      const opened = await openBrowser(publicUrl);
+      console.log(opened ? 'Opened shareable Wrapped card in your browser.' : 'Could not open browser automatically. Open the public URL above.');
+    }
+  } finally {
+    prompter.close();
+  }
+}

package/src/preview/previewReport.js

@@ -0,0 +1,165 @@
+function padRight(value, width) {
+  return String(value).padEnd(width, ' ');
+}
+
+function shouldUseColor(option) {
+  if (option === true) return true;
+  if (option === false) return false;
+  if (process.env.NO_COLOR) return false;
+  if (process.env.FORCE_COLOR) return true;
+  return Boolean(process.stdout.isTTY);
+}
+
+function makeTheme(colorOption) {
+  const enabled = shouldUseColor(colorOption);
+  const wrap = (open, close = '\x1b[0m') => (value) => (enabled ? `${open}${value}${close}` : value);
+  return {
+    enabled,
+    reset: '\x1b[0m',
+    orange: wrap('\x1b[38;2;250;125;34m'),
+    blue: wrap('\x1b[38;2;22;141;247m'),
+    cream: wrap('\x1b[38;2;251;246;243m'),
+    muted: wrap('\x1b[38;2;160;154;148m'),
+    green: wrap('\x1b[38;2;80;220;150m'),
+    yellow: wrap('\x1b[38;2;255;190;90m'),
+    bold: wrap('\x1b[1m', enabled ? '\x1b[22m' : ''),
+    dim: wrap('\x1b[2m', enabled ? '\x1b[22m' : ''),
+  };
+}
+
+function titleCase(value) {
+  return String(value || '')
+    .replace(/[-_]/g, ' ')
+    .replace(/\b\w/g, (char) => char.toUpperCase());
+}
+
+function confidenceLabel(value) {
+  return titleCase(value || 'moderate');
+}
+
+function bar(value, width = 16, theme = makeTheme(false)) {
+  const safeValue = Math.max(0, Math.min(100, Number(value) || 0));
+  const filled = Math.round((safeValue / 100) * width);
+  return `${theme.orange('█'.repeat(filled))}${theme.dim(theme.blue('░'.repeat(width - filled)))}`;
+}
+
+function wrappedLines(text, width = 68) {
+  const words = String(text || '').split(/\s+/).filter(Boolean);
+  const lines = [];
+  let current = '';
+  for (const word of words) {
+    if (`${current} ${word}`.trim().length > width) {
+      if (current) lines.push(current);
+      current = word;
+    } else {
+      current = `${current} ${word}`.trim();
+    }
+  }
+  if (current) lines.push(current);
+  return lines.length ? lines : ['No summary available yet.'];
+}
+
+function printMetricRows(rows, theme) {
+  for (const row of rows) {
+    console.log(
+      `  ${theme.cream(padRight(row.label, 14))} ${bar(row.value, 16, theme)} ${theme.orange(
+        `${String(Math.round(row.value)).padStart(3)}%`
+      )}`
+    );
+  }
+}
+
+function riskLine(report, theme) {
+  const risk = report.agentMaturity?.blindAcceptanceRisk || 'moderate';
+  if (risk === 'low') return theme.green('✓ Low blind-acceptance risk');
+  if (risk === 'moderate') return theme.yellow('⚠ Blind-acceptance risk is moderate');
+  return theme.yellow('⚠ Blind-acceptance risk is high');
+}
+
+function section(title, theme) {
+  console.log(theme.orange(theme.bold(title)));
+}
+
+export function previewReport(report, sources, options = {}) {
+  const theme = makeTheme(options.color);
+  const roles = report.founderRead?.bestFitRoles?.length
+    ? report.founderRead.bestFitRoles
+    : ['Early-stage AI builder'];
+  const languages = report.languages?.length
+    ? report.languages.slice(0, 5)
+    : [{ name: 'Unknown', percent: 100 }];
+  const frameworks = report.frameworks?.length
+    ? report.frameworks.map((framework) => framework.name).slice(0, 8)
+    : ['No framework signal yet'];
+  const buildSurface = report.buildSurface || {};
+  const signals = [
+    ...(report.founderRead?.strengths || []).slice(0, 3).map((item) => `${theme.green('✓')} ${item}`),
+    riskLine(report, theme),
+  ];
+
+  console.log('');
+  console.log(theme.blue('┌──────────────────────────────────────────────────────────────┐'));
+  console.log(theme.blue('│') + theme.cream(theme.bold('                 DEVLABS AGENT WRAPPED                        ')) + theme.blue('│'));
+  console.log(theme.blue('│') + theme.orange('          verified proof-of-work from agent usage              ') + theme.blue('│'));
+  console.log(theme.blue('└──────────────────────────────────────────────────────────────┘'));
+  console.log('');
+  console.log(`          ${theme.cream(theme.bold(String(report.archetype || 'AI-Native Builder').toUpperCase()))}`);
+  console.log('');
+  console.log(`                 ${theme.muted('Founder Fit:')} ${theme.orange(theme.bold(String(report.score).padStart(3)))} ${theme.cream('/ 100')}`);
+  console.log(`                 ${theme.muted('Confidence:')} ${theme.cream(confidenceLabel(report.confidence))}`);
+  console.log('');
+
+  section('Best Fit', theme);
+  for (const role of roles.slice(0, 4)) console.log(`  ${theme.cream(role)}`);
+  console.log('');
+
+  section('Languages', theme);
+  printMetricRows(languages.map((language) => ({ label: language.name, value: language.percent })), theme);
+  console.log('');
+
+  section('Frameworks', theme);
+  console.log(`  ${frameworks.map((item) => theme.cream(item)).join(theme.muted(' · '))}`);
+  console.log('');
+
+  section('Build Surface', theme);
+  printMetricRows([
+    { label: 'Frontend', value: buildSurface.frontend || 0 },
+    { label: 'Backend', value: buildSurface.backend || 0 },
+    { label: 'Database', value: buildSurface.database || 0 },
+    { label: 'Infra', value: buildSurface.infra || 0 },
+    { label: 'Tests', value: buildSurface.tests || 0 },
+  ], theme);
+  console.log('');
+
+  section('Validation', theme);
+  console.log(`  ${theme.cream(padRight('Build/test loops', 24))} ${theme.orange(report.validation?.buildTestLoops ?? 0)}`);
+  console.log(`  ${theme.cream(padRight('Error recovery loops', 24))} ${theme.orange(report.validation?.errorRecoveryLoops ?? 0)}`);
+  console.log(`  ${theme.cream(padRight('Successful reruns', 24))} ${theme.orange(report.validation?.successfulReruns ?? 0)}`);
+  console.log(`  ${theme.cream(padRight('Test discipline', 24))} ${theme.orange(((report.validation?.testDisciplineScore || 0) / 10).toFixed(1))} ${theme.cream('/ 10')}`);
+  console.log('');
+
+  section('Signal', theme);
+  for (const signal of signals) {
+    for (const line of wrappedLines(signal, 64)) console.log(`  ${theme.cream(line)}`);
+  }
+  console.log('');
+
+  section('Founder Read', theme);
+  for (const line of wrappedLines(report.founderRead?.summary, 64)) console.log(`  ${theme.cream(line)}`);
+  console.log('');
+
+  section('Source Coverage', theme);
+  console.log(`  ${theme.muted('Agents:')} ${theme.cream(report.sourceCoverage?.agents?.join(', ') || 'Limited')}`);
+  console.log(`  ${theme.muted('Sources:')} ${theme.cream(`${sources.length} source group${sources.length === 1 ? '' : 's'}`)}`);
+  console.log('');
+
+  section('Will Upload', theme);
+  console.log(`  ${theme.cream('Aggregated language, framework, build-surface, validation,')}`);
+  console.log(`  ${theme.cream('agent-maturity, evidence, and founder-read signals.')}`);
+  console.log('');
+
+  section('Will NOT Upload', theme);
+  console.log(`  ${theme.cream('Raw prompts, raw conversations, source code, secrets,')}`);
+  console.log(`  ${theme.cream('environment variables, full local paths, or private filenames.')}`);
+  console.log('');
+}

package/src/report/generateReport.js

@@ -0,0 +1,166 @@
+const LANGUAGE_PATTERNS = {
+  TypeScript: /\b(typescript|tsx|ts|react|next\.?js|astro)\b/gi,
+  JavaScript: /\b(javascript|node|express|vite|npm|pnpm)\b/gi,
+  Python: /\b(python|fastapi|django|flask|pytest|uv|pip)\b/gi,
+  SQL: /\b(sql|postgres|mysql|sqlite|prisma|supabase)\b/gi,
+  Shell: /\b(shell|bash|zsh|terminal|docker|deploy)\b/gi,
+  Go: /\b(go|golang|go\.mod)\b/gi,
+  Rust: /\b(rust|cargo|tokio)\b/gi,
+};
+
+const FRAMEWORK_PATTERNS = {
+  React: /\breact\b/gi,
+  'Next.js': /\bnext\.?js\b/gi,
+  Astro: /\bastro\b/gi,
+  Tailwind: /\btailwind\b/gi,
+  Prisma: /\bprisma\b/gi,
+  Postgres: /\bpostgres|postgresql\b/gi,
+  MongoDB: /\bmongodb|mongoose\b/gi,
+  FastAPI: /\bfastapi\b/gi,
+  Docker: /\bdocker\b/gi,
+  Vercel: /\bvercel\b/gi,
+  Cloudflare: /\bcloudflare\b/gi,
+};
+
+function countMatches(text, pattern) {
+  return [...text.matchAll(pattern)].length;
+}
+
+function clamp(value) {
+  return Math.max(0, Math.min(100, Math.round(value)));
+}
+
+function scoreFromTerms(text, terms) {
+  return terms.reduce((sum, term) => sum + countMatches(text, term), 0);
+}
+
+function makeReportId(builderId) {
+  return `agent-usage-${builderId}-${Date.now()}`;
+}
+
+export function generateReport({ builderId, builderName, samples, publicRoot }) {
+  const allText = samples.map((sample) => sample.text).join('\n').toLowerCase();
+  const agents = [...new Set(samples.map((sample) => sample.agent))];
+  const sessionCount = samples.length;
+
+  const languageHits = Object.entries(LANGUAGE_PATTERNS)
+    .map(([name, pattern]) => ({ name, hits: countMatches(allText, pattern) }))
+    .filter((item) => item.hits > 0)
+    .sort((a, b) => b.hits - a.hits)
+    .slice(0, 6);
+  const languageTotal = languageHits.reduce((sum, item) => sum + item.hits, 0) || 1;
+
+  const frameworks = Object.entries(FRAMEWORK_PATTERNS)
+    .map(([name, pattern]) => ({ name, hits: countMatches(allText, pattern) }))
+    .filter((item) => item.hits > 0)
+    .sort((a, b) => b.hits - a.hits)
+    .slice(0, 10)
+    .map((item) => ({
+      name: item.name,
+      confidence: item.hits >= 5 ? 'high' : item.hits >= 2 ? 'moderate' : 'low',
+      evidence: ['agent usage aggregate'],
+    }));
+
+  const planning = scoreFromTerms(allText, [/\b(plan|approach|architecture|spec|todo|step)\b/gi]);
+  const context = scoreFromTerms(allText, [/\b(context|agents\.md|claude\.md|rules|instructions)\b/gi]);
+  const iteration = scoreFromTerms(allText, [/\b(iterate|retry|fix|patch|refactor|debug)\b/gi]);
+  const verification = scoreFromTerms(allText, [/\b(test|build|lint|typecheck|verify|rerun|ci)\b/gi]);
+  const errors = scoreFromTerms(allText, [/\b(error|failed|exception|stack trace|regression)\b/gi]);
+
+  const frontend = scoreFromTerms(allText, [/\b(ui|react|component|frontend|css|tailwind|page|route)\b/gi]);
+  const backend = scoreFromTerms(allText, [/\b(api|server|auth|backend|database|endpoint|worker)\b/gi]);
+  const database = scoreFromTerms(allText, [/\b(database|postgres|mongo|sql|schema|migration|prisma)\b/gi]);
+  const infra = scoreFromTerms(allText, [/\b(deploy|vercel|cloudflare|docker|env|ci|github action)\b/gi]);
+  const tests = scoreFromTerms(allText, [/\b(test|spec|vitest|jest|playwright|pytest|lint|typecheck)\b/gi]);
+  const docs = scoreFromTerms(allText, [/\b(readme|docs|comment|instructions|agents\.md|claude\.md)\b/gi]);
+
+  const planningScore = clamp(35 + planning * 2.4);
+  const contextScore = clamp(35 + context * 3.8);
+  const iterationScore = clamp(35 + iteration * 2.1);
+  const verificationScore = clamp(30 + verification * 2.7);
+  const testDisciplineScore = clamp(25 + verification * 2.4 + tests * 1.2);
+  const score = clamp((planningScore + contextScore + iterationScore + verificationScore + testDisciplineScore) / 5);
+
+  return {
+    builderId,
+    reportId: makeReportId(builderId),
+    builderName,
+    archetype:
+      frontend && backend
+        ? 'AI-Native Full-Stack Shipper'
+        : verificationScore >= 70
+          ? 'AI-Native Reliability Builder'
+          : 'AI-Native Product Builder',
+    score,
+    percentile: score >= 90 ? 8 : score >= 80 ? 14 : score >= 70 ? 24 : 38,
+    confidence: sessionCount >= 12 ? 'high' : sessionCount >= 5 ? 'moderate' : 'low',
+    source: 'uploaded_agent_usage',
+    sourceSummary: {
+      claudeSessions: samples.filter((sample) => sample.agent === 'Claude Code').length,
+      codexSessions: samples.filter((sample) => sample.agent === 'Codex').length,
+      cursorSessions: samples.filter((sample) => sample.agent === 'Cursor').length,
+      manualImports: samples.filter((sample) => sample.agent === 'Manual import').length,
+      daysCovered: undefined,
+    },
+    sourceCoverage: {
+      agents,
+      sessionCount,
+      timeframeLabel: 'Local available agent usage',
+      confidenceNotes: [
+        'Report is generated from local agent usage summaries/configs and approved by the builder before upload.',
+        'Raw prompts, conversations, source code, full paths, private filenames, and secrets are not uploaded.',
+      ],
+    },
+    languages: languageHits.length
+      ? languageHits.map((item) => ({
+          name: item.name,
+          percent: Math.max(1, Math.round((item.hits / languageTotal) * 100)),
+          sessions: item.hits,
+          evidence: 'session_summary',
+        }))
+      : [{ name: 'TypeScript', percent: 100, sessions: 0, evidence: 'session_summary' }],
+    frameworks,
+    buildSurface: {
+      frontend: clamp(frontend * 4),
+      backend: clamp(backend * 4),
+      database: clamp(database * 5),
+      infra: clamp(infra * 5),
+      tests: clamp(tests * 4),
+      docs: clamp(docs * 5),
+    },
+    validation: {
+      buildTestLoops: Math.max(0, Math.round(verification / 3)),
+      errorRecoveryLoops: Math.max(0, Math.round(errors / 4)),
+      successfulReruns: Math.max(0, Math.round(verification / 5)),
+      testDisciplineScore,
+    },
+    agentMaturity: {
+      planningScore,
+      contextScore,
+      iterationScore,
+      verificationScore,
+      blindAcceptanceRisk: verificationScore >= 70 ? 'low' : verificationScore >= 45 ? 'moderate' : 'high',
+    },
+    founderRead: {
+      bestFitRoles: ['AI product engineer', 'Full-stack builder', 'Prototype engineer'],
+      summary:
+        'Uses AI agents across builder workflows with measurable planning, iteration, and verification signals. Review stack fit and verification score for role matching.',
+      strengths: [
+        agents.length ? `Agent usage observed across ${agents.join(', ')}.` : 'Agent usage sources detected.',
+        verificationScore >= 60 ? 'Shows repeated validation and rerun behavior.' : 'Has a baseline AI-agent workflow ready for stronger validation.',
+        contextScore >= 60 ? 'Uses context/instruction files to steer agents.' : 'Can improve reusable context hygiene.',
+      ],
+      weaknesses: verificationScore < 50 ? ['Validation/test discipline needs stronger evidence.'] : ['No major weakness detected from aggregate usage.'],
+      riskFlags: verificationScore < 45 ? ['Blind acceptance risk is elevated without stronger rerun/test signals.'] : [],
+    },
+    evidenceHighlights: [
+      `${sessionCount} safe local agent source file${sessionCount === 1 ? '' : 's'} analyzed.`,
+      agents.length ? `Sources included ${agents.join(', ')}.` : 'Agent source coverage was limited.',
+      'Only aggregated proof-of-work metrics are uploaded after local preview approval.',
+    ],
+    share: {
+      publicUrl: `${publicRoot.replace(/\/$/, '')}/builder/wrapped/${builderId}`,
+    },
+    createdAt: new Date().toISOString(),
+  };
+}

package/src/sources/discover.js

@@ -0,0 +1,101 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+
+const MAX_SAMPLE_BYTES = 160_000;
+const MAX_FILES_PER_SOURCE = 24;
+
+async function exists(target) {
+  try {
+    await fs.access(target);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function listFiles(dir, max = MAX_FILES_PER_SOURCE) {
+  const results = [];
+  async function walk(current) {
+    if (results.length >= max) return;
+    let entries = [];
+    try {
+      entries = await fs.readdir(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (results.length >= max) return;
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) await walk(full);
+      else if (/\.(json|jsonl|md|txt|toml)$/i.test(entry.name)) results.push(full);
+    }
+  }
+  await walk(dir);
+  return results;
+}
+
+async function addSource(sources, agent, kind, target) {
+  if (!(await exists(target))) return;
+  const stat = await fs.stat(target);
+  const files = stat.isDirectory() ? await listFiles(target) : [target];
+  if (!files.length) return;
+  sources.push({
+    agent,
+    kind,
+    target,
+    files,
+    safeCountLabel: stat.isDirectory() ? `${files.length}+ readable summary/config files` : '1 readable file',
+  });
+}
+
+export async function discoverAgentSources({ imports = [] } = {}) {
+  const home = os.homedir();
+  const sources = [];
+
+  await addSource(sources, 'Claude Code', 'local settings', path.join(home, '.claude', 'settings.json'));
+  await addSource(sources, 'Claude Code', 'session/export summaries', path.join(home, '.claude', 'projects'));
+  await addSource(sources, 'Codex', 'local config', path.join(home, '.codex', 'config.toml'));
+  await addSource(sources, 'Codex', 'session/export summaries', path.join(home, '.codex', 'sessions'));
+  await addSource(sources, 'Codex', 'agent instructions', path.join(home, '.codex', 'AGENTS.md'));
+  await addSource(sources, 'Cursor', 'rules and summaries', path.join(home, '.cursor'));
+
+  for (const manual of imports.filter(Boolean)) {
+    await addSource(sources, 'Manual import', 'exported session summary', path.resolve(manual));
+  }
+
+  return sources;
+}
+
+function redactSecrets(text) {
+  return text
+    .replace(/sk-[A-Za-z0-9_-]{12,}/g, '[REDACTED_SECRET]')
+    .replace(/(api[_-]?key|secret|token|password)\s*[:=]\s*["']?[^"'\s]+/gi, '$1=[REDACTED]')
+    .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, '[REDACTED_PRIVATE_KEY]')
+    .replace(/\/Users\/[^/\s]+\/[^\s]+/g, '[LOCAL_PATH]')
+    .replace(/[A-Za-z]:\\Users\\[^\\\s]+\\[^\s]+/g, '[LOCAL_PATH]');
+}
+
+export async function readSourceSamples(sources) {
+  const samples = [];
+  for (const source of sources) {
+    for (const file of source.files.slice(0, MAX_FILES_PER_SOURCE)) {
+      let text = '';
+      try {
+        const handle = await fs.open(file, 'r');
+        const buffer = Buffer.alloc(MAX_SAMPLE_BYTES);
+        const { bytesRead } = await handle.read(buffer, 0, MAX_SAMPLE_BYTES, 0);
+        await handle.close();
+        text = buffer.subarray(0, bytesRead).toString('utf8');
+      } catch {
+        continue;
+      }
+      samples.push({
+        agent: source.agent,
+        kind: source.kind,
+        text: redactSecrets(text),
+      });
+    }
+  }
+  return samples;
+}

package/src/upload/token.js

@@ -0,0 +1,15 @@
+function decodeBase64Url(value) {
+  const padded = value.padEnd(value.length + ((4 - (value.length % 4)) % 4), '=');
+  return Buffer.from(padded, 'base64url').toString('utf8');
+}
+
+export function decodeUploadToken(token) {
+  try {
+    const [, payload] = String(token).split('.');
+    if (!payload) return null;
+    const decoded = JSON.parse(decodeBase64Url(payload));
+    return decoded.kind === 'agent_wrapped_upload' ? decoded : null;
+  } catch {
+    return null;
+  }
+}

package/src/upload/uploadReport.js

@@ -0,0 +1,23 @@
+export async function uploadReport({ apiRoot, token, builderId, report }) {
+  const res = await fetch(new URL('/api/builder/wrapped/upload', apiRoot), {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({
+      builderId,
+      report,
+      localAnalysisVersion: '0.1.0',
+      consent: {
+        approvedAt: new Date().toISOString(),
+        rawContentUploaded: false,
+      },
+    }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.ok) {
+    throw new Error(`Upload failed: ${data.error || res.statusText}`);
+  }
+  return data;
+}

package/src/utils/openBrowser.js

@@ -0,0 +1,26 @@
+import { spawn } from 'node:child_process';
+
+export function openBrowser(url) {
+  const platform = process.platform;
+  const command =
+    platform === 'darwin'
+      ? 'open'
+      : platform === 'win32'
+        ? 'cmd'
+        : 'xdg-open';
+  const args = platform === 'win32' ? ['/c', 'start', '', url] : [url];
+
+  return new Promise((resolve) => {
+    try {
+      const child = spawn(command, args, {
+        detached: true,
+        stdio: 'ignore',
+      });
+      child.on('error', () => resolve(false));
+      child.unref();
+      resolve(true);
+    } catch {
+      resolve(false);
+    }
+  });
+}