hacklab 26.921.1 → 26.921.2

package/README.md

@@ -1,15 +1,17 @@
 # Hacklab CLI
 
-A Bun CLI for updating your Hacklab bio and social links with your coding agent.
+A CLI for updating your Hacklab bio and social links with your coding agent.
 
-Requires Bun 1.4.2 or newer.
+Requires Node.js 22 or newer. Bun 1.4.2 or newer is also supported.
 
 ```sh
-bun add --global hacklab@beta
+npm install --global hacklab@beta
 hacklab --help
 ```
 
-Sign in at [Hacklab](https://beta.hacklab.so/?onboarding=1) and copy the agent instructions. They include a one-hour credential scoped to your profile. Keep it private and pass it as `HACKLAB_ONBOARDING_TOKEN` in the upload command's environment.
+For Bun, use `bun install --global hacklab@beta` and `bunx --bun hacklab@beta --help`.
+
+Copy the agent instructions from the signed-in onboarding dialog. They contain no credentials. When you upload, the CLI opens a browser page to sign in with GitHub and authorize the CLI through Better Auth. Check that the code matches your terminal before approving.
 
 ## Preview a profile
 
@@ -29,18 +31,47 @@ Review the exact bio and links first. Agents must ask the user for approval befo
 hacklab onboard --file /path/to/profile.json --confirm-upload
 ```
 
-Only the bio and social links are uploaded. The CLI does not scan projects or upload source code, local paths, session transcripts, or usage statistics.
+Confirmed onboarding first syncs usage, then saves the profile, sharing one browser authorization. Approval must cover both the profile and the usage report. Preview mode does neither. If syncing fails, onboarding stops before saving the profile.
+
+## Sync usage
+
+```sh
+hacklab sync
+```
+
+The CLI includes pinned `ccusage@20.0.24` and runs `ccusage session --json`. No separate ccusage installation is needed. Its stdout is posted unchanged to `/api/token-usage`. This report includes agent/session identifiers, tokens, costs, model breakdowns, and metadata, which can include project paths. Source code and transcript contents are not uploaded.
+
+The API accepts the exact `{ session, totals }` envelope. `token_usage` stores each session with the upstream camelCase field names and nested JSON unchanged; only the authenticated `user_id` is added by the server. Totals are validated but not stored because they can be derived from the session rows. Repeated syncs replace counts for the same user, agent, and period rather than adding them. Missing sessions are retained, so syncing another machine does not delete earlier uploads. Reports are limited to 20 MB. The first upload uses browser authorization. Later commands reuse the saved session, checking that it is still valid; expired or revoked sessions open the browser again. Credentials are stored per Hacklab origin in `~/.config/hacklab/credentials/`, with owner-only directory and file permissions on Unix. Run `hacklab logout` to forget local authorization for the current Hacklab server.
+
+## Log in
+
+```sh
+hacklab login
+```
+
+Authorizes the CLI and saves the session without collecting or uploading usage. An existing valid session is reused. To check the authorization dialog again, run `hacklab logout` followed by `hacklab login`.
+
+## Log out
+
+```sh
+hacklab logout
+hacklab sync
+```
+
+Logout clears the saved CLI credential for the current Hacklab server, even when offline. The next sync opens the authorization dialog on the Arena again. Your browser stays signed in. Other Hacklab servers' credentials are preserved; this command does not revoke the server session.
 
 ## Local development
 
+Building from source requires Bun 1.4.2 or newer; the published package runs with Node.js without Bun.
+
 From the Hacklab repository:
 
 ```sh
 bun install --frozen-lockfile
-bunx turbo run build --filter=hacklab
+bun run --cwd packages/cli build:dev
 cd packages/cli
 bun link
-hacklab onboard --file /path/to/profile.json --url http://localhost:3000
+hacklab onboard --file /path/to/profile.json
 ```
 
-Use instructions and a credential from the local onboarding dialog. Credentials are bound to their issuing origin and cannot be used interchangeably between localhost and production.
+Source runs and `build:dev` always use `http://localhost:3000`. Production builds embed `BETTER_AUTH_URL` from the build environment or `apps/web/.env` / `.env.local`; it must be an HTTPS origin. Set the production URL before running `bun run build` or publishing. No `--url` override is supported. Credentials are saved locally for reuse and are never copied into the prompt. Development and production credentials are stored separately.

package/dist/index.js

@@ -1,27 +1,197 @@
-#!/usr/bin/env bun
-// @bun
+#!/usr/bin/env node
 
 // src/index.ts
-import { parseArgs } from "util";
+import { parseArgs } from "node:util";
 // package.json
-var version = "26.921.1";
+var version = "26.921.2";
+
+// src/auth.ts
+import { spawn } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+
+// src/credentials.ts
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var credentialsDirectory = join(homedir(), ".config", "hacklab", "credentials");
+function credentialPath(origin, directory) {
+  return join(directory, `${createHash("sha256").update(origin).digest("hex")}.json`);
+}
+async function readCredential(origin, directory = credentialsDirectory) {
+  try {
+    const value = JSON.parse(await readFile(credentialPath(origin, directory), "utf8"));
+    return value?.origin === origin && typeof value.token === "string" && value.token.length > 0 ? value.token : null;
+  } catch (error) {
+    if (error instanceof SyntaxError || error.code === "ENOENT")
+      return null;
+    throw new Error("Could not read saved Hacklab authorization.");
+  }
+}
+async function saveCredential(origin, token, directory = credentialsDirectory) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await chmod(directory, 448);
+  const path = credentialPath(origin, directory);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, JSON.stringify({ origin, token }), { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function removeCredential(origin, directory = credentialsDirectory) {
+  await rm(credentialPath(origin, directory), { force: true });
+}
+
+// src/auth.ts
+var clientId = "hacklab-cli";
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => console.log("Open the authorization URL above in your browser."));
+  child.unref();
+}
+async function authenticate(origin, launchBrowser = openBrowser, directory = credentialsDirectory) {
+  const saved = await readCredential(origin, directory);
+  if (saved) {
+    const response = await fetch(`${origin}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${saved}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(30000)
+    });
+    if (response.ok) {
+      const session = await response.json();
+      if (session?.session?.id && session.user?.id)
+        return saved;
+      if (session !== null)
+        throw new Error("Invalid saved authorization response. Try again later.");
+    } else if (response.status !== 401) {
+      throw new Error(`Could not verify saved Hacklab authorization (HTTP ${response.status}). Try again later.`);
+    }
+    await removeCredential(origin, directory);
+    console.log("Your saved Hacklab authorization expired or was revoked. Sign in again.");
+  }
+  const request = (path, body) => fetch(`${origin}/api/auth${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(30000)
+  });
+  const response = await request("/device/code", { client_id: clientId });
+  if (!response.ok)
+    throw new Error(`Could not start CLI sign-in (HTTP ${response.status}).`);
+  const code = await response.json();
+  const verification = new URL(code.verification_uri_complete, origin);
+  if (verification.origin !== origin || !code.device_code || !code.user_code || !Number.isFinite(code.expires_in) || code.expires_in <= 0 || !Number.isFinite(code.interval) || code.interval <= 0) {
+    throw new Error("Invalid CLI authorization response.");
+  }
+  console.log(`Opening your browser to sign in to Hacklab.
+If it does not open, visit: ${verification.href}
+Waiting for you to connect your account…`);
+  launchBrowser(verification.href);
+  const deadline = Date.now() + code.expires_in * 1000;
+  let interval = code.interval * 1000;
+  while (Date.now() < deadline) {
+    await sleep(Math.min(interval, deadline - Date.now()));
+    if (Date.now() >= deadline)
+      break;
+    const tokenResponse = await request("/device/token", {
+      client_id: clientId,
+      device_code: code.device_code,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    const result = await tokenResponse.json();
+    if (tokenResponse.ok && result.access_token) {
+      await saveCredential(origin, result.access_token, directory);
+      return result.access_token;
+    }
+    if (result.error === "authorization_pending")
+      continue;
+    if (result.error === "slow_down") {
+      interval += 5000;
+      continue;
+    }
+    if (result.error === "access_denied")
+      throw new Error("CLI authorization was denied. Nothing uploaded.");
+    if (result.error === "expired_token")
+      break;
+    throw new Error(`CLI sign-in failed (HTTP ${tokenResponse.status}). Run the command again to retry.`);
+  }
+  throw new Error("CLI sign-in expired. Run the command again to retry.");
+}
 
 // src/onboard.ts
-function normalizeOrigin(value) {
-  const url = new URL(value);
-  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
-  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.protocol !== "https:" && !(local && url.protocol === "http:"))
-    throw new Error("Use an HTTPS Hacklab origin, or HTTP localhost for development.");
-  return url.origin;
+import { readFile as readFile2, stat } from "node:fs/promises";
+
+// src/origin.ts
+function cliOrigin() {
+  return "https://beta.hacklab.so";
 }
+
+// src/sync.ts
+import { spawn as spawn2 } from "node:child_process";
+import { once } from "node:events";
+import { createRequire } from "node:module";
+import { text } from "node:stream/consumers";
+async function collectUsage() {
+  const require2 = createRequire(import.meta.url);
+  const child = spawn2(process.execPath, [require2.resolve("ccusage/src/cli.js"), "session", "--json"], { stdio: ["ignore", "pipe", "inherit"] });
+  const [body, [exitCode]] = await Promise.all([text(child.stdout), once(child, "close")]);
+  if (exitCode !== 0)
+    throw new Error(`ccusage failed (exit ${exitCode}). Nothing synced.`);
+  let report;
+  try {
+    report = JSON.parse(body);
+  } catch {
+    throw new Error("ccusage returned invalid JSON. Nothing synced.");
+  }
+  if (!Array.isArray(report?.session) || !report.totals) {
+    throw new Error("Unexpected ccusage report. Nothing synced.");
+  }
+  if (Buffer.byteLength(body) > 20 * 1024 * 1024)
+    throw new Error("Usage report exceeds 20 MB. Nothing synced.");
+  return body;
+}
+async function uploadUsage(origin, token, body) {
+  const response = await fetch(`${origin}/api/token-usage`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+    body,
+    redirect: "error",
+    signal: AbortSignal.timeout(60000)
+  });
+  if (!response.ok)
+    throw new Error(`Hacklab rejected the usage report (HTTP ${response.status}). Run hacklab sync to retry.`);
+  const result = await response.json();
+  if (result.ok !== true)
+    throw new Error("Hacklab did not confirm the sync. Run hacklab sync to retry.");
+  console.log(`Synced ${result.sessions} usage sessions to Hacklab.`);
+  if (result.sessions === 0)
+    console.log("No usage found. Use your coding agent, then run hacklab sync again to complete onboarding.");
+}
+async function sync() {
+  const origin = cliOrigin();
+  const token = await authenticate(origin);
+  console.log("Collecting ccusage session data…");
+  const body = await collectUsage();
+  await uploadUsage(origin, token, body);
+}
+
+// src/onboard.ts
 async function onboard(options) {
-  const origin = normalizeOrigin(options.origin);
-  const file = Bun.file(options.file);
+  const origin = cliOrigin();
+  const file = await stat(options.file);
   if (file.size > 8192)
     throw new Error("Profile must be smaller than 8 KB.");
-  const profile = await file.json();
+  const contents = await readFile2(options.file);
+  if (contents.byteLength > 8192)
+    throw new Error("Profile must be smaller than 8 KB.");
+  const profile = JSON.parse(contents.toString("utf8"));
   if (!profile || typeof profile !== "object" || Array.isArray(profile) || Object.keys(profile).some((key) => !["bio", "socials"].includes(key)) || typeof profile.bio !== "string" || !profile.bio.trim() || profile.bio.trim().length > 160 || /[\r\n]/.test(profile.bio) || !profile.socials || typeof profile.socials !== "object" || Array.isArray(profile.socials))
-    throw new Error("Expected a one-line bio (1\u2013160 characters) and a socials object, with no other fields.");
+    throw new Error("Expected a one-line bio (1–160 characters) and a socials object, with no other fields.");
   const hosts = {
     github: ["github.com"],
     linkedin: ["linkedin.com"],
@@ -48,21 +218,12 @@ async function onboard(options) {
   console.log(`Hacklab profile preview for ${origin}:
 ${payload}`);
   if (!options.confirmUpload) {
-    console.log("Nothing uploaded. Ask the user to approve this exact profile, then run again with --confirm-upload.");
+    console.log("Nothing uploaded. Ask the user to approve this exact profile and the first ccusage session sync, then run again with --confirm-upload.");
     return;
   }
-  const token = Bun.env.HACKLAB_ONBOARDING_TOKEN;
-  if (!token)
-    throw new Error("Set HACKLAB_ONBOARDING_TOKEN from the signed-in onboarding dialog.");
-  let claims;
-  try {
-    claims = JSON.parse(Buffer.from(token.split(".")[0], "base64url").toString());
-  } catch {
-    throw new Error("Invalid onboarding token. Copy fresh agent instructions.");
-  }
-  if (claims.audience !== origin || typeof claims.expiresAt !== "number" || claims.expiresAt <= Date.now()) {
-    throw new Error("Onboarding token is expired or belongs to another Hacklab origin. Copy fresh agent instructions.");
-  }
+  const usage = await collectUsage();
+  const token = await authenticate(origin);
+  await uploadUsage(origin, token, usage);
   const response = await fetch(`${origin}/api/onboarding`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -71,7 +232,7 @@ ${payload}`);
     signal: AbortSignal.timeout(30000)
   });
   if (!response.ok) {
-    throw new Error(`Hacklab rejected the profile (HTTP ${response.status}). Check the profile and token before retrying.`);
+    throw new Error(`Hacklab rejected the profile (HTTP ${response.status}). Check the profile and sign-in before retrying.`);
   }
   const result = await response.json();
   if (result.ok !== true)
@@ -82,33 +243,44 @@ ${payload}`);
 // src/index.ts
 var help = `Hacklab CLI
 
+Get started:
+  npm install -g hacklab@beta
+  hacklab sync
+
 Usage:
-  hacklab onboard --file <profile.json> [--url <origin>] [--confirm-upload]
+  hacklab sync
+  hacklab onboard --file <profile.json> [--confirm-upload]
+  hacklab login
+  hacklab logout
   hacklab --help
   hacklab --version
 
-Onboarding:
+Optional profile update:
   --file            Local JSON containing bio and socials
-  --url             Hacklab origin (default: https://beta.hacklab.so)
-  --confirm-upload  Upload only after the user approves the exact profile
+  --confirm-upload  Upload after approval of the profile and first usage sync
 
 Without --confirm-upload, onboard validates and previews locally without uploading.
-Uploads require HACKLAB_ONBOARDING_TOKEN from the signed-in onboarding dialog.
-Bun 1.4.2 or newer is required.`;
+Confirmed onboarding also runs the first usage sync.
+Sync signs in automatically and uploads unmodified ccusage session --json data.
+Onboarding completes when Hacklab receives your usage.
+The first upload opens your browser to authorize the CLI.
+Later uploads reuse saved authorization until it expires or is revoked.
+Login authorizes the CLI without uploading any data.
+Logout clears saved authorization for this Hacklab server.
+Requires Node.js 22 or newer. Bun 1.4.2 or newer is also supported.`;
 try {
   const { values, positionals } = parseArgs({
-    args: Bun.argv.slice(2),
+    args: process.argv.slice(2),
     options: {
       help: { type: "boolean", short: "h" },
       version: { type: "boolean", short: "v" },
       file: { type: "string" },
-      url: { type: "string" },
       "confirm-upload": { type: "boolean" }
     },
     allowPositionals: true
   });
-  if (positionals.length > 1 || positionals[0] && positionals[0] !== "onboard") {
-    throw new Error("Unknown command. Use hacklab onboard or hacklab --help.");
+  if (positionals.length > 1 || positionals[0] && !["onboard", "sync", "login", "logout"].includes(positionals[0])) {
+    throw new Error("Unknown command. Use hacklab onboard, hacklab sync, hacklab login, hacklab logout, or hacklab --help.");
   }
   if (values.help) {
     console.log(help);
@@ -119,10 +291,23 @@ try {
       throw new Error("Pass --file with the local profile JSON to preview or upload.");
     await onboard({
       file: values.file,
-      origin: values.url ?? "https://beta.hacklab.so",
       confirmUpload: values["confirm-upload"] ?? false
     });
-  } else if (values.file || values.url || values["confirm-upload"]) {
+  } else if (positionals[0] === "login") {
+    if (values.file || values["confirm-upload"])
+      throw new Error("Profile options require the onboard command.");
+    await authenticate(cliOrigin());
+    console.log("Signed in to Hacklab. Run hacklab sync to upload usage.");
+  } else if (positionals[0] === "logout") {
+    if (values.file || values["confirm-upload"])
+      throw new Error("Profile options require the onboard command.");
+    await removeCredential(cliOrigin());
+    console.log("Saved CLI authorization cleared. Run hacklab sync to sign in again.");
+  } else if (positionals[0] === "sync") {
+    if (values.file || values["confirm-upload"])
+      throw new Error("Profile options require the onboard command.");
+    await sync();
+  } else if (values.file || values["confirm-upload"]) {
     throw new Error("Profile options require the onboard command.");
   } else {
     console.log(help);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hacklab",
-  "version": "26.921.1",
-  "description": "Bun CLI for agent-assisted Hacklab profile onboarding",
+  "version": "26.921.2",
+  "description": "CLI for agent-assisted Hacklab profile onboarding",
   "bin": {
     "hacklab": "./dist/index.js"
   },
@@ -14,18 +14,22 @@
     "tag": "beta"
   },
   "scripts": {
-    "build": "bun build src/index.ts --target=bun --outdir=dist && chmod +x dist/index.js",
+    "build": "bun --env-file=../../apps/web/.env --env-file=../../apps/web/.env.local build.ts",
     "start": "bun src/index.ts",
     "lint": "oxlint .",
     "check-types": "tsc --noEmit",
     "prepack": "bun run build",
-    "test": "bun test"
+    "build:dev": "bun build.ts --development"
+  },
+  "dependencies": {
+    "ccusage": "20.0.24"
   },
   "devDependencies": {
-    "@types/bun": "^1.4.2",
-    "typescript": "^7.0.2"
+    "@types/bun": "catalog:",
+    "@types/node": "catalog:",
+    "typescript": "catalog:"
   },
   "engines": {
-    "bun": ">=1.4.2"
+    "node": ">=22"
   }
 }