heyiam 0.2.29 → 0.3.1

package/README.md

@@ -0,0 +1,45 @@
+# heyiam
+
+[![npm version](https://img.shields.io/npm/v/heyiam)](https://www.npmjs.com/package/heyiam)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://github.com/interactivecats/heyi.am/blob/main/LICENSE)
+
+Local-first CLI that indexes your AI coding sessions. Search locally, enhance with AI, and publish a portfolio of real work.
+
+Discovers sessions from **Claude Code**, **Cursor**, **OpenAI Codex CLI**, and **Google Gemini CLI**.
+
+## Get Started
+
+```bash
+npx heyiam
+```
+
+Opens a local dashboard at `localhost:17845`. Browse projects, search sessions, and publish portfolio case studies to `heyi.am/:username`.
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `heyiam` / `heyiam open` | Start local dashboard |
+| `heyiam search [query]` | Full-text search across all sessions |
+| `heyiam time` | Your time vs agent time per project |
+| `heyiam context <id>` | Export session as compressed context for AI tools |
+| `heyiam archive` | Discover and archive sessions from all sources |
+| `heyiam sync` | Index sessions into SQLite |
+| `heyiam status` | Archive health, session counts, daemon status |
+
+## Privacy
+
+Everything stays local by default. Nothing leaves your machine unless you explicitly publish.
+
+- Sessions are read from local tool storage (read-only)
+- SQLite search index lives at `~/.local/share/heyiam/`
+- Config at `~/.config/heyiam/`
+- Common secret patterns are detected and redacted before upload, but this is not a guarantee
+
+AI enhancement runs locally using your own `ANTHROPIC_API_KEY`.
+
+## Links
+
+- [heyi.am](https://heyi.am) — published portfolios
+- [heyiam.com](https://heyiam.com) — dashboard and auth
+- [GitHub](https://github.com/interactivecats/heyi.am) — source code

package/dist/auth.js

@@ -19,7 +19,16 @@ export function writeConfig(filename, data, configDir = getConfigDir()) {
     writeFileSync(join(configDir, filename), JSON.stringify(data, null, 2), { mode: 0o600 });
 }
 export function getAuthToken(configDir = getConfigDir()) {
-    return readConfig(AUTH_FILE, configDir);
+    const raw = readConfig(AUTH_FILE, configDir);
+    if (!raw)
+        return null;
+    // Legacy configs may contain mixed-case usernames (prior to the
+    // normalize-on-write change). Always project to the canonical form so
+    // callers — URL construction, display, server requests — stay consistent.
+    if (raw.username && raw.username !== raw.username.toLowerCase()) {
+        return { ...raw, username: normalizeUsername(raw.username) };
+    }
+    return raw;
 }
 export function deleteAuthToken(configDir = getConfigDir()) {
     const filePath = join(configDir, AUTH_FILE);
@@ -27,8 +36,22 @@ export function deleteAuthToken(configDir = getConfigDir()) {
         unlinkSync(filePath);
     }
 }
+/**
+ * Normalize a username to the canonical form used everywhere in the CLI:
+ * lowercase, whitespace trimmed. Mirrors Phoenix's DB validation regex
+ * `^[a-z0-9-]+$`. Guards against Phoenix responses or legacy configs that
+ * contain mixed-case usernames (e.g. "Ben" -> "ben") so URL construction
+ * and display are consistent.
+ */
+export function normalizeUsername(username) {
+    return username.trim().toLowerCase();
+}
 export function saveAuthToken(token, username, configDir = getConfigDir()) {
-    const config = { token, username, savedAt: new Date().toISOString() };
+    const config = {
+        token,
+        username: normalizeUsername(username),
+        savedAt: new Date().toISOString(),
+    };
     writeConfig(AUTH_FILE, config, configDir);
 }
 export async function checkAuthStatus(apiBaseUrl, configDir = getConfigDir(), fetchFn = fetch) {
@@ -41,7 +64,10 @@ export async function checkAuthStatus(apiBaseUrl, configDir = getConfigDir(), fe
     if (!res.ok)
         return { authenticated: false };
     const body = (await res.json());
-    return { authenticated: true, username: body.username };
+    return {
+        authenticated: true,
+        username: body.username ? normalizeUsername(body.username) : body.username,
+    };
 }
 export async function deviceAuthFlow(apiBaseUrl, configDir = getConfigDir(), options = {}) {
     const fetchFn = options.fetchFn ?? fetch;

package/dist/config.js

@@ -1,4 +1,13 @@
 /** Base URL for the heyiam.com app API. Override with HEYIAM_API_URL for local dev. */
-export const API_URL = process.env.HEYIAM_API_URL ?? 'https://heyiam.com';
+const DEFAULT_API_URL = 'https://heyiam.com';
+export const API_URL = process.env.HEYIAM_API_URL ?? DEFAULT_API_URL;
 /** Base URL for the heyi.am public site. Override with HEYIAM_PUBLIC_URL for local dev. */
 export const PUBLIC_URL = process.env.HEYIAM_PUBLIC_URL ?? 'https://heyi.am';
+/** Warn once to stderr if a non-default API URL is in use (env var override). */
+let _apiUrlWarned = false;
+export function warnIfNonDefaultApiUrl() {
+    if (!_apiUrlWarned && API_URL !== DEFAULT_API_URL) {
+        console.warn(`[security] API_URL overridden to ${API_URL} — auth tokens will be sent to this host`);
+        _apiUrlWarned = true;
+    }
+}

package/dist/db.js

@@ -12,7 +12,6 @@ function getDataDir() {
 export function getDbPath() {
     return join(getDataDir(), 'sessions.db');
 }
-export const DB_PATH = join(homedir(), '.local', 'share', 'heyiam', 'sessions.db');
 const CURRENT_SCHEMA_VERSION = 5;
 // ── Singleton ────────────────────────────────────────────────
 let _db = null;

package/dist/export.js

@@ -9,9 +9,10 @@ import { mkdirSync, writeFileSync, readFileSync, statSync, existsSync } from 'no
 import { deflateRawSync } from 'node:zlib';
 import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { loadEnhancedData } from './settings.js';
-import { renderProjectHtml, renderSessionHtml } from './render/index.js';
-import { escapeHtml, displayNameFromDir } from './format-utils.js';
+import { loadEnhancedData, getDefaultTemplate } from './settings.js';
+import { renderProjectHtml, renderSessionHtml, renderPortfolioHtml } from './render/index.js';
+import { resolveTemplate, getTemplateCss } from './render/templates.js';
+import { escapeHtml, displayNameFromDir, toSlug } from './format-utils.js';
 import { buildProjectRenderData, buildSessionRenderData, buildSessionCard, } from './render/build-render-data.js';
 import { mergeActiveIntervals, sumIntervalMs } from './bridge.js';
 import { SCREENSHOTS_DIR } from './screenshot.js';
@@ -42,7 +43,7 @@ function resolveScreenshotDataUri(dirName, cache) {
         return `data:image/png;base64,${b64}`;
     }
     // Try local screenshot file
-    const slug = dirName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+    const slug = toSlug(dirName);
     const screenshotPath = join(SCREENSHOTS_DIR, `${slug}.png`);
     if (existsSync(screenshotPath)) {
         const buf = readFileSync(screenshotPath);
@@ -220,16 +221,19 @@ export async function exportHtml(dirName, cache, sessions, outputPath, username
             sourceTool: session.source ?? 'unknown',
         });
     });
-    // Compute stats the same way the dashboard does
+    // Prefer DB-computed stats from opts (includes subagent data); fall back to session-based computation
     const totalLoc = sessions.reduce((sum, s) => sum + s.linesOfCode, 0);
     const totalDurationMinutes = computeMergedSessionDuration(sessions);
     const totalFilesChanged = opts?.totalFilesChanged ?? new Set(sessions.flatMap(s => s.filesChanged.map(f => f.path))).size;
-    // Agent duration: sum child durations across all orchestrated sessions
-    const totalAgentMinutes = sessions
-        .filter((s) => s.isOrchestrated && s.children)
-        .reduce((sum, s) => sum + s.children.reduce((cs, c) => cs + c.durationMinutes, 0), 0);
-    const totalAgentDurationMinutes = totalAgentMinutes > 0 ? totalDurationMinutes + totalAgentMinutes : undefined;
-    const totalTokens = sessions.reduce((sum, s) => sum + (s.tokenUsage?.input ?? 0) + (s.tokenUsage?.output ?? 0), 0) || undefined;
+    const totalAgentDurationMinutes = opts?.totalAgentDurationMinutes ?? (() => {
+        const agentMin = sessions
+            .filter((s) => s.isOrchestrated && s.children)
+            .reduce((sum, s) => sum + s.children.reduce((cs, c) => cs + c.durationMinutes, 0), 0);
+        return agentMin > 0 ? totalDurationMinutes + agentMin : undefined;
+    })();
+    const totalTokens = (opts?.totalInputTokens || opts?.totalOutputTokens)
+        ? (opts.totalInputTokens ?? 0) + (opts.totalOutputTokens ?? 0) || undefined
+        : sessions.reduce((sum, s) => sum + (s.tokenUsage?.input ?? 0) + (s.tokenUsage?.output ?? 0), 0) || undefined;
     // Resolve screenshot for embedding
     const screenshotUrl = resolveScreenshotDataUri(dirName, cache);
     // Render project index.html — pass same data shape as dashboard
@@ -256,12 +260,14 @@ export async function exportHtml(dirName, cache, sessions, outputPath, username
         sessionCards,
         sessionBaseUrl: './sessions',
     });
+    const templateName = resolveTemplate(undefined, getDefaultTemplate());
     const projectBody = renderProjectHtml(projectRenderData, {
         arc: result.arc,
         fullSessions: sessions,
-    });
+    }, templateName);
     const projectHtml = buildStandalonePage(title, projectBody, {
         description: result.narrative?.slice(0, 200) || undefined,
+        templateName,
     });
     totalBytes += writeAndTrack(join(outputPath, 'index.html'), projectHtml, files);
     // Render session pages — only featured sessions (linked from project page)
@@ -279,10 +285,11 @@ export async function exportHtml(dirName, cache, sessions, outputPath, username
             projectSlug: slug,
             sessionSlug,
             sourceTool: session.source ?? 'unknown',
+            template: templateName,
         });
-        const sessionBody = renderSessionHtml(renderData);
+        const sessionBody = renderSessionHtml(renderData, templateName);
         const sessionDesc = (enhanced?.developerTake ?? session.developerTake ?? '').slice(0, 200) || undefined;
-        const sessionHtml = buildStandalonePage(session.title, sessionBody, { description: sessionDesc });
+        const sessionHtml = buildStandalonePage(session.title, sessionBody, { description: sessionDesc, templateName });
         totalBytes += writeAndTrack(join(sessionsDir, `${sessionSlug}.html`), sessionHtml, files);
     }
     return { files, totalBytes, outputPath };
@@ -318,11 +325,15 @@ function buildProjectRenderInputs(dirName, cache, sessions, username, opts) {
     const totalLoc = sessions.reduce((sum, s) => sum + s.linesOfCode, 0);
     const totalDurationMinutes = computeMergedSessionDuration(sessions);
     const totalFilesChanged = opts?.totalFilesChanged ?? new Set(sessions.flatMap(s => s.filesChanged.map(f => f.path))).size;
-    const totalAgentMinutes = sessions
-        .filter((s) => s.isOrchestrated && s.children)
-        .reduce((sum, s) => sum + s.children.reduce((cs, c) => cs + c.durationMinutes, 0), 0);
-    const totalAgentDurationMinutes = totalAgentMinutes > 0 ? totalDurationMinutes + totalAgentMinutes : undefined;
-    const totalTokens = sessions.reduce((sum, s) => sum + (s.tokenUsage?.input ?? 0) + (s.tokenUsage?.output ?? 0), 0) || undefined;
+    const totalAgentDurationMinutes = opts?.totalAgentDurationMinutes ?? (() => {
+        const agentMin = sessions
+            .filter((s) => s.isOrchestrated && s.children)
+            .reduce((sum, s) => sum + s.children.reduce((cs, c) => cs + c.durationMinutes, 0), 0);
+        return agentMin > 0 ? totalDurationMinutes + agentMin : undefined;
+    })();
+    const totalTokens = (opts?.totalInputTokens || opts?.totalOutputTokens)
+        ? (opts.totalInputTokens ?? 0) + (opts.totalOutputTokens ?? 0) || undefined
+        : sessions.reduce((sum, s) => sum + (s.tokenUsage?.input ?? 0) + (s.tokenUsage?.output ?? 0), 0) || undefined;
     return { result, slug, title, sessionCards, totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, totalTokens };
 }
 /**
@@ -346,15 +357,17 @@ export function generateProjectHtmlFragment(dirName, cache, sessions, username =
         totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, totalTokens,
         sessionCards,
     });
+    const templateName = resolveTemplate(undefined, getDefaultTemplate());
     return renderProjectHtml(renderData, {
         arc: result.arc,
         fullSessions: sessions,
-    });
+    }, templateName);
 }
 export function generateHtmlFiles(dirName, cache, sessions, username = 'local', opts) {
     const files = [];
     const { result, slug, title, sessionCards, totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, totalTokens } = buildProjectRenderInputs(dirName, cache, sessions, username, opts);
     const screenshotUrl = resolveScreenshotDataUri(dirName, cache);
+    const templateName = resolveTemplate(undefined, getDefaultTemplate());
     const projectRenderData = buildProjectRenderData({
         username, slug, title,
         narrative: result.narrative,
@@ -371,9 +384,10 @@ export function generateHtmlFiles(dirName, cache, sessions, username = 'local',
     const projectBody = renderProjectHtml(projectRenderData, {
         arc: result.arc,
         fullSessions: sessions,
-    });
+    }, templateName);
     files.push({ path: 'index.html', content: buildStandalonePage(title, projectBody, {
             description: result.narrative?.slice(0, 200) || undefined,
+            templateName,
         }) });
     const featuredSessions = pickFeaturedSessions(sessions, cache);
     for (const session of featuredSessions) {
@@ -384,12 +398,13 @@ export function generateHtmlFiles(dirName, cache, sessions, username = 'local',
             session, enhanced, username,
             projectSlug: slug, sessionSlug,
             sourceTool: session.source ?? 'unknown',
+            template: templateName,
         });
-        const sessionBody = renderSessionHtml(renderData);
+        const sessionBody = renderSessionHtml(renderData, templateName);
         const sessionDesc = (enhanced?.developerTake ?? session.developerTake ?? '').slice(0, 200) || undefined;
         files.push({
             path: `sessions/${sessionSlug}.html`,
-            content: buildStandalonePage(session.title, sessionBody, { description: sessionDesc }),
+            content: buildStandalonePage(session.title, sessionBody, { description: sessionDesc, templateName }),
         });
     }
     return files;
@@ -409,7 +424,9 @@ export function createZipBuffer(entries) {
     const dosDate = (((now.getFullYear() - 1980) << 9) | ((now.getMonth() + 1) << 5) | now.getDate()) & 0xffff;
     for (const entry of entries) {
         const nameBytes = Buffer.from(entry.path, 'utf-8');
-        const raw = Buffer.from(entry.content, 'utf-8');
+        const raw = Buffer.isBuffer(entry.content)
+            ? entry.content
+            : Buffer.from(entry.content, 'utf-8');
         const compressed = deflateRawSync(raw);
         const crc = crc32(raw);
         // Local file header
@@ -490,9 +507,9 @@ function getInlineMountJs() {
     }
 }
 function buildStandalonePage(title, bodyHtml, opts) {
-    const css = getInlineCss();
+    const css = opts?.templateName ? getTemplateCss(opts.templateName) : getInlineCss();
     const cssTag = css
-        ? `<style>${css}\nbody { overflow: auto !important; min-height: auto !important; background: var(--color-surface, #f8f9fb); }</style>`
+        ? `<style>${css}\nbody { overflow: auto !important; min-height: auto !important; }\n#root { min-height: auto !important; }</style>`
         : '';
     const mountJs = getInlineMountJs();
     const scriptTag = mountJs ? `<script>${mountJs}</script>` : '';
@@ -516,7 +533,7 @@ function buildStandalonePage(title, bodyHtml, opts) {
   ${ogTags}
   <link rel="preconnect" href="https://fonts.googleapis.com" />
   <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-  <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600;700&family=Inter:wght@400;500;600;700&family=Space+Grotesk:wght@400;500;600;700&display=swap" rel="stylesheet" />
+  <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600;700&family=Inter:wght@400;500;600;700&family=Space+Grotesk:wght@400;500;600;700&family=Cormorant+Garamond:ital,wght@0,400;0,600;1,400&family=Newsreader:ital,wght@0,400;0,600;1,400&display=swap" rel="stylesheet" />
   ${cssTag}
 </head>
 <body>
@@ -525,3 +542,83 @@ function buildStandalonePage(title, bodyHtml, opts) {
 </body>
 </html>`;
 }
+// ── Portfolio site export (Phase 1) ────────────────────────────
+/**
+ * Render a portfolio landing page to a body HTML fragment (no `<html>` shell).
+ *
+ * Used by the upload path (Phase 2) to store pre-rendered HTML in
+ * `users.rendered_portfolio_html` for Phoenix to serve.
+ */
+export function generatePortfolioHtmlFragment(data, templateName) {
+    const template = templateName ?? resolveTemplate(undefined, getDefaultTemplate());
+    return renderPortfolioHtml(data, template);
+}
+/**
+ * Rewrite hardcoded `/{username}/{slug}` absolute project links produced by
+ * the current portfolio Liquid templates into relative links that resolve
+ * against `projects/{slug}/index.html` when opened from disk.
+ *
+ * AUDIT FINDING (Phase 1): all 29 portfolio.liquid templates (editorial,
+ * blueprint, kinetic, and 26 others) hardcode `/{{ user.username }}/{{ p.slug }}`.
+ * Introducing a per-context base URL variable would require changes to
+ * `render/liquid.ts` and every template — out of scope for this phase, which
+ * only permits editing export.ts, types.ts, and three template files. We
+ * rewrite the URLs at the generator boundary instead. Hosted Phoenix serving
+ * is unaffected: the render output still contains absolute paths when routed
+ * through `renderPortfolioHtml` directly.
+ */
+function rewritePortfolioProjectLinks(html, username) {
+    // Escape regex metacharacters in username before embedding.
+    const safeUser = username.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // Matches href="/{username}/{slug}" and href="/{username}/{slug}/{session}"
+    const projectOnly = new RegExp(`href="/${safeUser}/([a-z0-9][a-z0-9-]*)"`, 'g');
+    const projectSession = new RegExp(`href="/${safeUser}/([a-z0-9][a-z0-9-]*)/([a-z0-9][a-z0-9-]*)"`, 'g');
+    return html
+        .replace(projectSession, 'href="projects/$1/sessions/$2.html"')
+        .replace(projectOnly, 'href="projects/$1/index.html"');
+}
+/**
+ * Generate a complete static portfolio site as a directory tree.
+ *
+ * Output structure:
+ * ```
+ * {outputDir}/
+ *   index.html                          — portfolio landing page
+ *   projects/{slug}/index.html          — per-project detail page
+ *   projects/{slug}/sessions/{slug}.html — per-session pages (featured)
+ * ```
+ *
+ * All internal links are relative; the resulting directory can be opened
+ * directly via `file://` without a server. Font loading remains CDN-linked.
+ *
+ * @param portfolioData  Render data for the landing page.
+ * @param projects       Per-project inputs. Each must have a unique dirName.
+ * @param outputDir      Absolute output directory. Caller is responsible for
+ *                       validating the path before calling.
+ * @param templateName   Optional template override (defaults to user setting).
+ */
+export async function generatePortfolioSite(portfolioData, projects, outputDir, templateName) {
+    const files = [];
+    let totalBytes = 0;
+    mkdirSync(outputDir, { recursive: true });
+    const template = templateName ?? resolveTemplate(undefined, getDefaultTemplate());
+    const username = portfolioData.user.username;
+    // ── Landing page ────────────────────────────────────────────
+    const portfolioBody = rewritePortfolioProjectLinks(renderPortfolioHtml(portfolioData, template), username);
+    const portfolioHtml = buildStandalonePage(portfolioData.user.displayName || username, portfolioBody, {
+        description: portfolioData.user.bio?.slice(0, 200) || undefined,
+        templateName: template,
+    });
+    totalBytes += writeAndTrack(join(outputDir, 'index.html'), portfolioHtml, files);
+    // ── Per-project sub-sites ───────────────────────────────────
+    const projectsRoot = join(outputDir, 'projects');
+    mkdirSync(projectsRoot, { recursive: true });
+    for (const p of projects) {
+        const projectSlug = slugify(p.dirName);
+        const projectDir = join(projectsRoot, projectSlug);
+        const result = await exportHtml(p.dirName, p.cache, p.sessions, projectDir, username, p.opts);
+        files.push(...result.files);
+        totalBytes += result.totalBytes;
+    }
+    return { files, totalBytes, outputPath: outputDir };
+}

package/dist/format-utils.js

@@ -16,6 +16,11 @@ export function displayNameFromDir(dirName) {
     const segments = dirName.split('-').filter(Boolean);
     return segments.length > 0 ? segments[segments.length - 1] : dirName;
 }
+/** Generate a URL-safe slug from a string. */
+export function toSlug(s, maxLen) {
+    const slug = s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
+    return maxLen !== undefined ? slug.slice(0, maxLen) : slug;
+}
 /** Escape LIKE wildcards in user input for safe use in SQL LIKE clauses. */
 export function escapeLikeWildcards(str) {
     return str.replace(/[%_]/g, (c) => `\\${c}`);