hacklab 26.921.1 → 26.921.3

package/README.md

@@ -1,46 +1,36 @@
 # Hacklab CLI
 
-A Bun CLI for updating your Hacklab bio and social links with your coding agent.
-
-Requires Bun 1.4.2 or newer.
+Sync coding agent usage to Hacklab. Requires Node.js 22+ or Bun 1.4.2+.
 
 ```sh
-bun add --global hacklab@beta
-hacklab --help
+npm install --global hacklab@beta
+hacklab sync
 ```
 
-Sign in at [Hacklab](https://beta.hacklab.so/?onboarding=1) and copy the agent instructions. They include a one-hour credential scoped to your profile. Keep it private and pass it as `HACKLAB_ONBOARDING_TOKEN` in the upload command's environment.
-
-## Preview a profile
+The first sync opens your browser to sign in and authorize the CLI. Check that the code matches your terminal before approving. Later commands reuse saved authorization until it expires or is revoked.
 
-Create a local JSON file containing a one-line `bio` (at most 160 characters) and a `socials` object. Supported social keys are `github`, `linkedin`, `x`, `instagram`, `youtube`, `huggingface`, `producthunt`, and `goodreads`. Use full HTTPS profile URLs. Omitted links remain unchanged; `null` removes a link.
+## Commands
 
 ```sh
-hacklab onboard --file /path/to/profile.json
+hacklab sync       # Sign in and upload usage
+hacklab login      # Sign in without uploading
+hacklab logout     # Clear saved authorization
+hacklab --help
+hacklab --version
 ```
 
-This validates and previews locally without making a network request.
-
-## Upload after approval
-
-Review the exact bio and links first. Agents must ask the user for approval before using `--confirm-upload`.
-
-```sh
-hacklab onboard --file /path/to/profile.json --confirm-upload
-```
+The CLI runs bundled `ccusage@20.0.24 session --json` and uploads its output to `/api/token-usage`. Reports include session identifiers, tokens, costs, model breakdowns, and metadata that may include project paths. Source code and transcripts are not uploaded. Reports are limited to 20 MB. Repeated syncs update existing sessions; sessions from other machines are retained.
 
-Only the bio and social links are uploaded. The CLI does not scan projects or upload source code, local paths, session transcripts, or usage statistics.
+Credentials are stored per server in `~/.config/hacklab/credentials/`, with owner-only permissions on Unix. Logout removes the local credential for the current server; it does not sign out your browser or revoke the server session.
 
-## Local development
+## Development
 
-From the Hacklab repository:
+Building requires Bun 1.4.2+.
 
 ```sh
 bun install --frozen-lockfile
-bunx turbo run build --filter=hacklab
-cd packages/cli
-bun link
-hacklab onboard --file /path/to/profile.json --url http://localhost:3000
+bun run --cwd packages/cli build:dev
+bun run --cwd packages/cli start --help
 ```
 
-Use instructions and a credential from the local onboarding dialog. Credentials are bound to their issuing origin and cannot be used interchangeably between localhost and production.
+Source runs and development builds use `http://localhost:3000`. Production builds embed `BETTER_AUTH_URL` from the build environment or `apps/web/.env` / `.env.local`; it must be an HTTPS origin. No `--url` override is supported. Development and production credentials are stored separately.

package/dist/index.js

@@ -1,129 +1,215 @@
-#!/usr/bin/env bun
-// @bun
+#!/usr/bin/env node
 
 // src/index.ts
-import { parseArgs } from "util";
+import { parseArgs } from "node:util";
 // package.json
-var version = "26.921.1";
+var version = "26.921.3";
 
-// src/onboard.ts
-function normalizeOrigin(value) {
-  const url = new URL(value);
-  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
-  if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.protocol !== "https:" && !(local && url.protocol === "http:"))
-    throw new Error("Use an HTTPS Hacklab origin, or HTTP localhost for development.");
-  return url.origin;
+// src/auth.ts
+import { spawn } from "node:child_process";
+import { setTimeout as sleep } from "node:timers/promises";
+
+// src/credentials.ts
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var credentialsDirectory = join(homedir(), ".config", "hacklab", "credentials");
+function credentialPath(origin, directory) {
+  return join(directory, `${createHash("sha256").update(origin).digest("hex")}.json`);
 }
-async function onboard(options) {
-  const origin = normalizeOrigin(options.origin);
-  const file = Bun.file(options.file);
-  if (file.size > 8192)
-    throw new Error("Profile must be smaller than 8 KB.");
-  const profile = await file.json();
-  if (!profile || typeof profile !== "object" || Array.isArray(profile) || Object.keys(profile).some((key) => !["bio", "socials"].includes(key)) || typeof profile.bio !== "string" || !profile.bio.trim() || profile.bio.trim().length > 160 || /[\r\n]/.test(profile.bio) || !profile.socials || typeof profile.socials !== "object" || Array.isArray(profile.socials))
-    throw new Error("Expected a one-line bio (1\u2013160 characters) and a socials object, with no other fields.");
-  const hosts = {
-    github: ["github.com"],
-    linkedin: ["linkedin.com"],
-    x: ["x.com", "twitter.com"],
-    instagram: ["instagram.com"],
-    youtube: ["youtube.com"],
-    huggingface: ["huggingface.co"],
-    producthunt: ["producthunt.com"],
-    goodreads: ["goodreads.com"]
-  };
-  for (const [platform, value] of Object.entries(profile.socials)) {
-    if (!Object.hasOwn(hosts, platform))
-      throw new Error(`Unsupported social platform: ${platform}`);
-    if (value === null)
-      continue;
-    if (typeof value !== "string" || value.length > 500)
-      throw new Error(`Invalid ${platform} profile URL.`);
-    const url = new URL(value);
-    if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname === "/" || !hosts[platform].includes(url.hostname.replace(/^www\./, ""))) {
-      throw new Error(`Use an HTTPS ${platform} profile URL.`);
+async function readCredential(origin, directory = credentialsDirectory) {
+  try {
+    const value = JSON.parse(await readFile(credentialPath(origin, directory), "utf8"));
+    return value?.origin === origin && typeof value.token === "string" && value.token.length > 0 ? value.token : null;
+  } catch (error) {
+    if (error instanceof SyntaxError || error.code === "ENOENT")
+      return null;
+    throw new Error("Could not read saved Hacklab authorization.");
+  }
+}
+async function saveCredential(origin, token, directory = credentialsDirectory) {
+  await mkdir(directory, { recursive: true, mode: 448 });
+  await chmod(directory, 448);
+  const path = credentialPath(origin, directory);
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, JSON.stringify({ origin, token }), { mode: 384, flag: "wx" });
+    await rename(temporary, path);
+  } finally {
+    await rm(temporary, { force: true });
+  }
+}
+async function removeCredential(origin, directory = credentialsDirectory) {
+  await rm(credentialPath(origin, directory), { force: true });
+}
+
+// src/auth.ts
+var clientId = "hacklab-cli";
+function openBrowser(url) {
+  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
+  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
+  const child = spawn(command, args, { stdio: "ignore", detached: true });
+  child.on("error", () => console.log("Open the authorization URL above in your browser."));
+  child.unref();
+}
+async function authenticate(origin, launchBrowser = openBrowser, directory = credentialsDirectory) {
+  const saved = await readCredential(origin, directory);
+  if (saved) {
+    const response = await fetch(`${origin}/api/auth/get-session`, {
+      headers: { Authorization: `Bearer ${saved}` },
+      redirect: "error",
+      signal: AbortSignal.timeout(30000)
+    });
+    if (response.ok) {
+      const session = await response.json();
+      if (session?.session?.id && session.user?.id)
+        return saved;
+      if (session !== null)
+        throw new Error("Invalid saved authorization response. Try again later.");
+    } else if (response.status !== 401) {
+      throw new Error(`Could not verify saved Hacklab authorization (HTTP ${response.status}). Try again later.`);
     }
+    await removeCredential(origin, directory);
+    console.log("Your saved Hacklab authorization expired or was revoked. Sign in again.");
   }
-  const payload = JSON.stringify({ bio: profile.bio.trim(), socials: profile.socials }, null, 2);
-  console.log(`Hacklab profile preview for ${origin}:
-${payload}`);
-  if (!options.confirmUpload) {
-    console.log("Nothing uploaded. Ask the user to approve this exact profile, then run again with --confirm-upload.");
-    return;
+  const request = (path, body) => fetch(`${origin}/api/auth${path}`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+    redirect: "error",
+    signal: AbortSignal.timeout(30000)
+  });
+  const response = await request("/device/code", { client_id: clientId });
+  if (!response.ok)
+    throw new Error(`Could not start CLI sign-in (HTTP ${response.status}).`);
+  const code = await response.json();
+  const verification = new URL(code.verification_uri_complete, origin);
+  if (verification.origin !== origin || !code.device_code || !code.user_code || !Number.isFinite(code.expires_in) || code.expires_in <= 0 || !Number.isFinite(code.interval) || code.interval <= 0) {
+    throw new Error("Invalid CLI authorization response.");
   }
-  const token = Bun.env.HACKLAB_ONBOARDING_TOKEN;
-  if (!token)
-    throw new Error("Set HACKLAB_ONBOARDING_TOKEN from the signed-in onboarding dialog.");
-  let claims;
+  console.log(`Opening your browser to sign in to Hacklab.
+If it does not open, visit: ${verification.href}
+Waiting for you to connect your account…`);
+  launchBrowser(verification.href);
+  const deadline = Date.now() + code.expires_in * 1000;
+  let interval = code.interval * 1000;
+  while (Date.now() < deadline) {
+    await sleep(Math.min(interval, deadline - Date.now()));
+    if (Date.now() >= deadline)
+      break;
+    const tokenResponse = await request("/device/token", {
+      client_id: clientId,
+      device_code: code.device_code,
+      grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+    });
+    const result = await tokenResponse.json();
+    if (tokenResponse.ok && result.access_token) {
+      await saveCredential(origin, result.access_token, directory);
+      return result.access_token;
+    }
+    if (result.error === "authorization_pending")
+      continue;
+    if (result.error === "slow_down") {
+      interval += 5000;
+      continue;
+    }
+    if (result.error === "access_denied")
+      throw new Error("CLI authorization was denied. Nothing uploaded.");
+    if (result.error === "expired_token")
+      break;
+    throw new Error(`CLI sign-in failed (HTTP ${tokenResponse.status}). Run the command again to retry.`);
+  }
+  throw new Error("CLI sign-in expired. Run the command again to retry.");
+}
+
+// src/origin.ts
+function cliOrigin() {
+  return "https://hacklab.so";
+}
+
+// src/sync.ts
+import { spawn as spawn2 } from "node:child_process";
+import { once } from "node:events";
+import { createRequire } from "node:module";
+import { text } from "node:stream/consumers";
+async function collectUsage() {
+  const require2 = createRequire(import.meta.url);
+  const child = spawn2(process.execPath, [require2.resolve("ccusage/src/cli.js"), "session", "--json"], { stdio: ["ignore", "pipe", "inherit"] });
+  const [body, [exitCode]] = await Promise.all([text(child.stdout), once(child, "close")]);
+  if (exitCode !== 0)
+    throw new Error(`ccusage failed (exit ${exitCode}). Nothing synced.`);
+  let report;
   try {
-    claims = JSON.parse(Buffer.from(token.split(".")[0], "base64url").toString());
+    report = JSON.parse(body);
   } catch {
-    throw new Error("Invalid onboarding token. Copy fresh agent instructions.");
+    throw new Error("ccusage returned invalid JSON. Nothing synced.");
   }
-  if (claims.audience !== origin || typeof claims.expiresAt !== "number" || claims.expiresAt <= Date.now()) {
-    throw new Error("Onboarding token is expired or belongs to another Hacklab origin. Copy fresh agent instructions.");
+  if (!Array.isArray(report?.session) || !report.totals) {
+    throw new Error("Unexpected ccusage report. Nothing synced.");
   }
-  const response = await fetch(`${origin}/api/onboarding`, {
+  if (Buffer.byteLength(body) > 20 * 1024 * 1024)
+    throw new Error("Usage report exceeds 20 MB. Nothing synced.");
+  return body;
+}
+async function uploadUsage(origin, token, body) {
+  const response = await fetch(`${origin}/api/token-usage`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: payload,
+    body,
     redirect: "error",
-    signal: AbortSignal.timeout(30000)
+    signal: AbortSignal.timeout(60000)
   });
-  if (!response.ok) {
-    throw new Error(`Hacklab rejected the profile (HTTP ${response.status}). Check the profile and token before retrying.`);
-  }
+  if (!response.ok)
+    throw new Error(`Hacklab rejected the usage report (HTTP ${response.status}). Run hacklab sync to retry.`);
   const result = await response.json();
   if (result.ok !== true)
-    throw new Error("Hacklab did not confirm the update. Check the website before retrying.");
-  console.log("Your Hacklab bio and social links were saved.");
+    throw new Error("Hacklab did not confirm the sync. Run hacklab sync to retry.");
+  console.log(`Synced ${result.sessions} usage sessions to Hacklab.`);
+  if (result.sessions === 0)
+    console.log("No usage found. Use your coding agent, then run hacklab sync again.");
+}
+async function sync() {
+  const origin = cliOrigin();
+  const token = await authenticate(origin);
+  console.log("Collecting ccusage session data…");
+  const body = await collectUsage();
+  await uploadUsage(origin, token, body);
 }
 
 // src/index.ts
 var help = `Hacklab CLI
 
 Usage:
-  hacklab onboard --file <profile.json> [--url <origin>] [--confirm-upload]
-  hacklab --help
-  hacklab --version
-
-Onboarding:
-  --file            Local JSON containing bio and socials
-  --url             Hacklab origin (default: https://beta.hacklab.so)
-  --confirm-upload  Upload only after the user approves the exact profile
-
-Without --confirm-upload, onboard validates and previews locally without uploading.
-Uploads require HACKLAB_ONBOARDING_TOKEN from the signed-in onboarding dialog.
-Bun 1.4.2 or newer is required.`;
+  hacklab sync       Sign in and upload usage
+  hacklab login      Sign in without uploading
+  hacklab logout     Clear saved authorization
+  hacklab --help     Show help
+  hacklab --version  Show version`;
 try {
   const { values, positionals } = parseArgs({
-    args: Bun.argv.slice(2),
+    args: process.argv.slice(2),
     options: {
       help: { type: "boolean", short: "h" },
-      version: { type: "boolean", short: "v" },
-      file: { type: "string" },
-      url: { type: "string" },
-      "confirm-upload": { type: "boolean" }
+      version: { type: "boolean", short: "v" }
     },
     allowPositionals: true
   });
-  if (positionals.length > 1 || positionals[0] && positionals[0] !== "onboard") {
-    throw new Error("Unknown command. Use hacklab onboard or hacklab --help.");
+  if (positionals.length > 1 || positionals[0] && !["sync", "login", "logout"].includes(positionals[0])) {
+    throw new Error("Unknown command. Run hacklab --help for usage.");
   }
   if (values.help) {
     console.log(help);
   } else if (values.version) {
     console.log(version);
-  } else if (positionals[0] === "onboard") {
-    if (!values.file)
-      throw new Error("Pass --file with the local profile JSON to preview or upload.");
-    await onboard({
-      file: values.file,
-      origin: values.url ?? "https://beta.hacklab.so",
-      confirmUpload: values["confirm-upload"] ?? false
-    });
-  } else if (values.file || values.url || values["confirm-upload"]) {
-    throw new Error("Profile options require the onboard command.");
+  } else if (positionals[0] === "login") {
+    await authenticate(cliOrigin());
+    console.log("Signed in to Hacklab. Run hacklab sync to upload usage.");
+  } else if (positionals[0] === "logout") {
+    await removeCredential(cliOrigin());
+    console.log("Saved CLI authorization cleared. Run hacklab sync to sign in again.");
+  } else if (positionals[0] === "sync") {
+    await sync();
   } else {
     console.log(help);
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hacklab",
-  "version": "26.921.1",
-  "description": "Bun CLI for agent-assisted Hacklab profile onboarding",
+  "version": "26.921.3",
+  "description": "CLI for syncing coding agent usage to Hacklab",
   "bin": {
     "hacklab": "./dist/index.js"
   },
@@ -14,18 +14,22 @@
     "tag": "beta"
   },
   "scripts": {
-    "build": "bun build src/index.ts --target=bun --outdir=dist && chmod +x dist/index.js",
+    "build": "bun --env-file=../../apps/web/.env --env-file=../../apps/web/.env.local build.ts",
     "start": "bun src/index.ts",
     "lint": "oxlint .",
     "check-types": "tsc --noEmit",
     "prepack": "bun run build",
-    "test": "bun test"
+    "build:dev": "bun build.ts --development"
+  },
+  "dependencies": {
+    "ccusage": "20.0.24"
   },
   "devDependencies": {
-    "@types/bun": "^1.4.2",
-    "typescript": "^7.0.2"
+    "@types/bun": "catalog:",
+    "@types/node": "catalog:",
+    "typescript": "catalog:"
   },
   "engines": {
-    "bun": ">=1.4.2"
+    "node": ">=22"
   }
 }