sprag-cli 3.68.0 → 3.70.0

package/src/team-ratchet.js

@@ -0,0 +1,176 @@
+/**
+ * team-ratchet — rules the user's team approved, kept in a tool-owned file.
+ *
+ * `sprag team sync` caches the approved rules in team-rules.json. This module
+ * only turns that cache into a ratchet file (no network), keeps the CLAUDE.md
+ * import in step with the file, and starts the detached sync when it is due.
+ * Every function degrades to a no-op for a machine that never joined a team.
+ *
+ *   Claude Code  ~/.claude/ratchet-team.md
+ *   Codex        <CODEX_HOME>/ratchet-team.md
+ */
+
+import * as childProcess from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { codexUserDir } from './agent.js';
+import { userLanguage } from './config.js';
+import { debug } from './debug.js';
+import {
+  HARNESS_BLOCK_BEGIN,
+  HARNESS_BLOCK_END,
+  TEAM_RATCHET_IMPORT_RE,
+  teamRatchetImportLine,
+} from './harness-templates.js';
+import { userDataDir } from './paths.js';
+import { writeStateFile, writeViaTmp } from './state-file.js';
+
+export { TEAM_RATCHET_IMPORT_RE, teamRatchetImportLine };
+
+export const TEAM_RATCHET_MARKER = '<!-- sprag:team-ratchet -->';
+const SYNC_INTERVAL_MS = 6 * 60 * 60 * 1000;
+const TOKEN_RE = /^spt_[0-9a-f]{32}$/;
+
+export const teamStatePathFor = (dir = userDataDir()) => join(dir, 'team.json');
+export const teamRulesCachePathFor = (dir = userDataDir()) => join(dir, 'team-rules.json');
+
+function readJson(file) {
+  try {
+    const v = JSON.parse(readFileSync(file, 'utf8'));
+    return v && typeof v === 'object' ? v : null;
+  } catch { return null; }
+}
+
+export function readTeamState(dir = userDataDir()) {
+  return readJson(teamStatePathFor(dir)) || {};
+}
+
+export function readTeamRulesCache(dir = userDataDir()) {
+  return readJson(teamRulesCachePathFor(dir));
+}
+
+export function isJoined(state) {
+  return !!(state && state.memberKey && state.left !== true);
+}
+
+export function teamSyncDue(state, now = Date.now()) {
+  if (!isJoined(state)) return false;
+  const at = Number(state.lastSyncAt);
+  return !Number.isFinite(at) || at <= 0 || now - at > SYNC_INTERVAL_MS;
+}
+
+export function autoJoinPending(state, env = process.env) {
+  return TOKEN_RE.test(env.SPRAG_TEAM_TOKEN || '') && !isJoined(state) && state?.left !== true;
+}
+
+export function teamSyncDisabled(env = process.env) {
+  return env.CTS_NO_TEAM_SYNC === '1';
+}
+
+export function teamRatchetPath({ agent = 'claude' } = {}) {
+  return agent === 'codex'
+    ? join(codexUserDir(), 'ratchet-team.md')
+    : join(homedir(), '.claude', 'ratchet-team.md');
+}
+
+export function renderTeamRatchet(cache, { lang = 'en', agent = 'claude' } = {}) {
+  if (!cache || !Array.isArray(cache.rules)) return null;
+  const removed = new Set(Array.isArray(cache.removed) ? cache.removed : []);
+  const live = cache.rules.filter((r) => r && typeof r.text === 'string' && r.text.trim() && !removed.has(r.id));
+  const ratchet = live.filter((r) => (r.scope || 'ratchet') !== 'model');
+  const model = live.filter((r) => r.scope === 'model');
+  if (!ratchet.length && !model.length) return null;
+  const ko = lang === 'ko' && agent !== 'codex';
+  const name = cache.teamName || '';
+  const head = ko
+    ? `# 팀 래칫 룰 (sprag 관리)\n\n팀 "${name}" 이 승인한 룰입니다. sprag 가 세션 시작 때 통째로 다시 쓰므로 직접 고치지 마십시오. 목록: \`sprag team rules\``
+    : `# Team Ratchet Rules (managed by sprag)\n\nRules approved by team "${name}". sprag rewrites this file at session start, so do not edit it by hand. List: \`sprag team rules\``;
+  const line = (r) => `- ${r.text.trim().replace(/\s*\n\s*/g, ' ')}`;
+  let out = `${TEAM_RATCHET_MARKER}\n${head}\n`;
+  if (ratchet.length) out += `\n## Rules\n\n${ratchet.map(line).join('\n')}\n`;
+  if (model.length) out += `\n## Model rules\n\n${model.map(line).join('\n')}\n`;
+  return out;
+}
+
+function writeIfChanged(file, text) {
+  let before = null;
+  try { before = readFileSync(file, 'utf8'); } catch { /* first write */ }
+  if (before === text) return false;
+  mkdirSync(dirname(file), { recursive: true });
+  writeViaTmp(`${file}.tmp-${process.pid}`, file, text);
+  return true;
+}
+
+function ownedFile(file) {
+  try { return readFileSync(file, 'utf8').split('\n', 1)[0].trim() === TEAM_RATCHET_MARKER; } catch { return false; }
+}
+
+export function syncTeamRatchet({ agent = 'claude', lang = userLanguage(), dir = userDataDir() } = {}) {
+  const file = teamRatchetPath({ agent });
+  const state = readTeamState(dir);
+  const text = isJoined(state) ? renderTeamRatchet(readTeamRulesCache(dir), { lang, agent }) : null;
+  if (text === null) {
+    if (existsSync(file) && ownedFile(file)) {
+      rmSync(file, { force: true });
+      return { file, rules: 0, changed: true, removed: true };
+    }
+    return { file, rules: 0, changed: false, removed: false };
+  }
+  const changed = writeIfChanged(file, text);
+  return { file, rules: (text.match(/^- /gm) || []).length, changed, removed: false };
+}
+
+/**
+ * Keep the team import in the global harness block in step with the file.
+ * Only the tool's own marked block is edited; a CLAUDE.md without it is left alone.
+ */
+export function ensureTeamImport() {
+  const file = join(homedir(), '.claude', 'CLAUDE.md');
+  let text;
+  try { text = readFileSync(file, 'utf8'); } catch { return { file, added: false, removed: false }; }
+  const begin = text.indexOf(HARNESS_BLOCK_BEGIN);
+  const end = text.indexOf(HARNESS_BLOCK_END);
+  if (begin < 0 || end < begin) return { file, added: false, removed: false };
+  const block = text.slice(begin, end);
+  const has = TEAM_RATCHET_IMPORT_RE.test(block);
+  const exists = existsSync(teamRatchetPath());
+  if (exists && !has) {
+    writeFileSync(file, `${text.slice(0, end)}${teamRatchetImportLine()}\n${text.slice(end)}`);
+    return { file, added: true, removed: false };
+  }
+  if (!exists && has) {
+    const cleaned = block.replace(/^@~\/\.claude\/ratchet-team\.md[ \t]*\r?\n?/m, '');
+    writeFileSync(file, `${text.slice(0, begin)}${cleaned}${text.slice(end)}`);
+    return { file, added: false, removed: true };
+  }
+  return { file, added: false, removed: false };
+}
+
+export function spawnTeamSyncIfDue({
+  state = readTeamState(), now = Date.now(), env = process.env,
+  spawn = childProcess.spawn, argv = process.argv, execPath = process.execPath,
+} = {}) {
+  if (teamSyncDisabled(env)) return false;
+  if (!autoJoinPending(state, env) && !teamSyncDue(state, now)) return false;
+  try {
+    spawn(execPath, [argv[1], 'team', 'sync', '--background'],
+      { detached: true, stdio: 'ignore', windowsHide: true }).unref();
+    return true;
+  } catch (e) {
+    debug('team-ratchet:spawn', e);
+    return false;
+  }
+}
+
+export function autoJoinNoticeBlock(dir = userDataDir(), lang = userLanguage()) {
+  const file = teamStatePathFor(dir);
+  const state = readJson(file);
+  if (!state || state.autoJoinNoticePending !== true) return null;
+  const name = state.teamName || '';
+  try { writeStateFile(file, `${JSON.stringify({ ...state, autoJoinNoticePending: false }, null, 2)}\n`); }
+  catch (e) { debug('team-ratchet:notice-clear', e); }
+  return lang === 'ko'
+    ? `Sprag: 이 PC는 SPRAG_TEAM_TOKEN 으로 팀 "${name}" 에 자동 참여됐습니다. 보내는 것은 하루 단위 집계(지출·절감·위임 횟수)뿐입니다. \`sprag team status --show-payload\` 로 내용을 확인하고 \`sprag team leave\` 로 멈출 수 있습니다.`
+    : `Sprag: this machine was enrolled in team "${name}" through SPRAG_TEAM_TOKEN. It sends daily aggregates only (spend, savings, delegation counts). See what is sent with \`sprag team status --show-payload\`; stop with \`sprag team leave\`.`;
+}

package/src/team-sync.js

@@ -0,0 +1,326 @@
+/**
+ * team-sync — the opt-in team layer's client core.
+ *
+ * sprag is local-only by default. Nothing here runs unless team.json holds a
+ * member key, which only `sprag team join` (or SPRAG_TEAM_TOKEN auto-join)
+ * writes. Once joined, the CLI uploads DAILY AGGREGATES ONLY — spend, savings,
+ * delegation counts and model-family share per local calendar day — and pulls
+ * the team's approved rules. No prompts, paths or transcripts leave the machine.
+ *
+ * Files in the user data dir:
+ *   team.json        membership state (mode 0600; holds the member key)
+ *   team-rules.json  last pulled team rules
+ *
+ * Opt out of all network traffic with CTS_NO_TEAM_SYNC=1.
+ */
+
+import { readFileSync, existsSync, rmSync, chmodSync } from 'node:fs';
+import { join } from 'node:path';
+import { userInfo } from 'node:os';
+import { createRequire } from 'node:module';
+import { userDataDir } from './paths.js';
+import { writeStateFile } from './state-file.js';
+import { debug } from './debug.js';
+import { loadLedger, modelFamily, roundUsd } from './savings-ledger.js';
+import { sessionCost, pricedParts } from './claude-price.js';
+
+const require = createRequire(import.meta.url);
+
+export const TEAM_API_URL = 'https://hiycfjwswtkixyoqkznm.supabase.co';
+// Public anon key (role=anon). Access is gated by the RPCs, not by this value.
+export const TEAM_ANON_KEY = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImhpeWNmandzd3RraXh5b3Frem5tIiwicm9sZSI6ImFub24iLCJpYXQiOjE3OTIyNTc4MzYsImV4cCI6MjEwNzgzMzgzNn0.gyYcvGD70CEX64aGV-dsmZgmmOBdvhJlzIpx9Qo2l3w';
+export const TEAM_SYNC_INTERVAL_MS = 6 * 60 * 60 * 1000;
+export const TEAM_STATE_VERSION = 1;
+
+const TOKEN_RE = /^spt_[0-9a-f]{32}$/;
+const MAX_ROWS = 400;
+
+export function teamStatePath(dir = userDataDir()) { return join(dir, 'team.json'); }
+export function teamRulesCachePath(dir = userDataDir()) { return join(dir, 'team-rules.json'); }
+
+export function loadTeamState(dir = userDataDir()) {
+  try {
+    const s = JSON.parse(readFileSync(teamStatePath(dir), 'utf8'));
+    return s && typeof s === 'object' && !Array.isArray(s) ? s : {};
+  } catch {
+    return {};
+  }
+}
+
+export function saveTeamState(state, dir = userDataDir()) {
+  const file = teamStatePath(dir);
+  writeStateFile(file, JSON.stringify(state, null, 2) + '\n');
+  if (process.platform !== 'win32') {
+    try { chmodSync(file, 0o600); } catch (e) { debug('team-sync', e); }
+  }
+}
+
+export function teamSyncDisabled(env = process.env) { return env.CTS_NO_TEAM_SYNC === '1'; }
+export function isJoined(state) { return !!(state && state.memberKey && !state.left); }
+
+export function teamSyncDue(state, now = Date.now()) {
+  return isJoined(state) && (!state.lastSyncAt || now - state.lastSyncAt >= TEAM_SYNC_INTERVAL_MS);
+}
+
+export async function rpc(fn, params, {
+  fetch = globalThis.fetch, timeoutMs = 8000, url = TEAM_API_URL, key = TEAM_ANON_KEY,
+} = {}) {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    const res = await fetch(`${url}/rest/v1/rpc/${fn}`, {
+      method: 'POST',
+      headers: { apikey: key, Authorization: `Bearer ${key}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify(params || {}),
+      signal: ctl.signal,
+    });
+    let body = null;
+    try { body = await res.json(); } catch { /* empty or non-JSON body */ }
+    if (!res.ok) {
+      const msg = (body && (body.message || body.hint)) || `HTTP ${res.status}`;
+      throw new Error(`${fn}: ${msg}`);
+    }
+    return body;
+  } catch (e) {
+    if (e && e.name === 'AbortError') throw new Error(`${fn}: timeout`);
+    throw e;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * One JSON request against the Supabase project, for the owner sign-in flow
+ * (GoTrue email code + the teams table). Same injectable fetch and 8s timeout
+ * as rpc(). Errors carry the server's own message. The access token only ever
+ * lives in memory: it is never written to disk or printed.
+ */
+async function apiJson(path, { body, accessToken, label, fetch = globalThis.fetch, timeoutMs = 8000, url = TEAM_API_URL, key = TEAM_ANON_KEY, prefer } = {}) {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    const headers = { apikey: key, 'Content-Type': 'application/json' };
+    if (accessToken) headers.Authorization = `Bearer ${accessToken}`;
+    if (prefer) headers.Prefer = prefer;
+    const res = await fetch(`${url}${path}`, { method: 'POST', headers, body: JSON.stringify(body || {}), signal: ctl.signal });
+    let data = null;
+    try { data = await res.json(); } catch { /* empty or non-JSON body */ }
+    if (!res.ok) {
+      const msg = (data && (data.msg || data.error_description || data.message)) || `HTTP ${res.status}`;
+      throw new Error(`${label}: ${msg}`);
+    }
+    return data;
+  } catch (e) {
+    if (e && e.name === 'AbortError') throw new Error(`${label}: timeout`);
+    throw e;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Email a 6-digit sign-in code (valid 15 minutes). Creates the user if new. */
+export async function requestSignInCode({ email, fetch } = {}) {
+  await apiJson('/auth/v1/otp', { body: { email, create_user: true }, label: 'sign-in', fetch });
+}
+
+/** Exchange the emailed code for a session. Returns { accessToken, userId }. */
+export async function verifySignInCode({ email, code, fetch } = {}) {
+  const r = await apiJson('/auth/v1/verify', { body: { type: 'email', email, token: code }, label: 'verify', fetch });
+  if (!r || !r.access_token || !r.user || !r.user.id) throw new Error('verify: no session returned');
+  return { accessToken: r.access_token, userId: r.user.id };
+}
+
+/** Insert a team owned by the signed-in user (RLS allows the owner insert). */
+export async function createTeam({ name, accessToken, userId, fetch } = {}) {
+  const r = await apiJson('/rest/v1/teams', {
+    body: { name, owner_uid: userId }, accessToken, prefer: 'return=representation', label: 'create team', fetch,
+  });
+  const row = Array.isArray(r) ? r[0] : r;
+  if (!row || !row.invite_token) throw new Error('create team: no invite token returned');
+  return { id: row.id, name: row.name, inviteToken: row.invite_token, plan: row.plan };
+}
+
+/** Local calendar day, same key as stats.js. */
+function dayKey(ms) {
+  const d = new Date(ms);
+  const pad = (n) => String(n).padStart(2, '0');
+  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())}`;
+}
+
+const round4 = (n) => Math.round(n * 10000) / 10000;
+
+/**
+ * Per-day rows, oldest first, only days with activity inside the window.
+ * saved_usd honours the `sprag saved reset` marks (events before a mark are
+ * skipped), the same way the ledger totals do. delegated_errors is always null:
+ * the ledger carries no error flag.
+ */
+export async function aggregateDaily({ now = Date.now(), dir = userDataDir(), days = 30, sessions = null } = {}) {
+  const { readResetMarks, isBeforeReset } = require('./saved-reset.cjs');
+  const doc2md = require('./doc2md-ledger.cjs');
+  const cutoff = now - days * 24 * 3600 * 1000;
+  const byDay = new Map();
+  const get = (day) => {
+    if (!byDay.has(day)) byDay.set(day, { spent: 0, saved: 0, runs: 0, fam: new Map() });
+    return byDay.get(day);
+  };
+  let marks = {};
+  try { marks = readResetMarks(dir) || {}; } catch (e) { debug('team-sync', e); }
+
+  try {
+    for (const e of Object.values(loadLedger().events)) {
+      if (!Number.isFinite(e.ts) || e.ts < cutoff || e.ts > now) continue;
+      if (isBeforeReset(e.ts, marks.routing)) continue;
+      const d = get(dayKey(e.ts));
+      const usd = Number(e.usd);
+      if (Number.isFinite(usd)) d.saved += usd;
+      d.runs += 1;
+      const fam = modelFamily(e.to);
+      d.fam.set(fam, (d.fam.get(fam) || 0) + 1);
+    }
+  } catch (e) { debug('team-sync', e); }
+
+  try {
+    for (const e of Object.values(doc2md.loadLedger(dir).events)) {
+      if (!Number.isFinite(e.ts) || e.ts < cutoff || e.ts > now) continue;
+      if (isBeforeReset(e.ts, marks.doc2md)) continue;
+      get(dayKey(e.ts)).saved += Number(e.usd) || 0;
+    }
+  } catch (e) { debug('team-sync', e); }
+
+  try {
+    let list = sessions;
+    if (!list) {
+      const { parseAllSessions } = await import('./parser.js');
+      list = await parseAllSessions({ days });
+    }
+    for (const s of list || []) {
+      if (!s || !s.startTime || !s.totals) continue;
+      const t = new Date(s.startTime).getTime();
+      if (!Number.isFinite(t) || t < cutoff || t > now) continue;
+      let cost = 0;
+      for (const part of pricedParts(s)) {
+        try {
+          const c = sessionCost(part.totals, part.model);
+          if (c) cost += c.actual;
+        } catch (e) { debug('team-sync', e); }
+      }
+      get(dayKey(t)).spent += cost;
+    }
+  } catch (e) { debug('team-sync', e); }
+
+  return [...byDay.entries()]
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+    .filter(([, d]) => d.spent || d.saved || d.runs)
+    .map(([day, d]) => ({
+      day,
+      spent_usd: round4(d.spent),
+      saved_usd: round4(d.saved),
+      delegated_runs: d.runs,
+      delegated_errors: null,
+      family_share: Object.fromEntries(
+        [...d.fam.entries()].map(([f, n]) => [f, Math.round((n / d.runs) * 1000) / 1000]),
+      ),
+    }));
+}
+
+export async function joinTeam({
+  token, displayName, agent = 'claude', autoJoined = false, fetch, dir = userDataDir(), version, now = Date.now(),
+} = {}) {
+  if (!TOKEN_RE.test(String(token || ''))) throw new Error('invalid invite token (expected spt_ + 32 hex characters)');
+  const name = String(displayName || '').trim() || 'member';
+  const r = await rpc('team_join', {
+    invite_token: token, display_name: name, agent, sprag_version: version || '', auto_joined: !!autoJoined,
+  }, { fetch });
+  if (!r || !r.member_key) throw new Error('team_join: no member key returned');
+  const state = {
+    version: TEAM_STATE_VERSION,
+    teamId: r.team_id,
+    teamName: r.team_name,
+    memberId: r.member_id,
+    memberKey: r.member_key,
+    plan: r.plan,
+    promptCapture: !!r.prompt_capture,
+    displayName: name,
+    agent,
+    joinedAt: now,
+    autoJoined: !!autoJoined,
+    autoJoinNoticePending: !!autoJoined,
+    lastSyncAt: null,
+    lastSyncRows: 0,
+  };
+  saveTeamState(state, dir);
+  return state;
+}
+
+export async function leaveTeam({ fetch, dir = userDataDir(), now = Date.now() } = {}) {
+  const prev = loadTeamState(dir);
+  let lastError;
+  if (prev.memberKey) {
+    try { await rpc('team_leave', { member_key: prev.memberKey }, { fetch }); }
+    catch (e) { debug('team-sync', e); lastError = e.message; }
+  }
+  const next = { version: TEAM_STATE_VERSION, left: true, leftAt: now, teamName: prev.teamName, displayName: prev.displayName };
+  if (lastError) next.lastError = lastError;
+  saveTeamState(next, dir);
+  try { rmSync(teamRulesCachePath(dir), { force: true }); } catch (e) { debug('team-sync', e); }
+  return next;
+}
+
+export async function syncTeam({
+  now = Date.now(), dir = userDataDir(), fetch, force = false, env = process.env, version, sessions,
+} = {}) {
+  if (teamSyncDisabled(env)) return { skipped: 'disabled' };
+  const state = loadTeamState(dir);
+  if (state.left) return { skipped: 'left' };
+  if (!isJoined(state)) return { skipped: 'not-joined' };
+  if (!force && !teamSyncDue(state, now)) return { skipped: 'not-due' };
+  try {
+    const rows = (await aggregateDaily({ now, dir, sessions })).slice(-MAX_ROWS);
+    await rpc('ledger_upsert', { member_key: state.memberKey, rows, sprag_version: version || '' }, { fetch });
+    const r = (await rpc('team_rules_get', { member_key: state.memberKey }, { fetch })) || {};
+    const rules = Array.isArray(r.rules) ? r.rules : [];
+    writeStateFile(teamRulesCachePath(dir), JSON.stringify({
+      version: 1, fetchedAt: now, teamId: r.team_id, teamName: r.team_name, plan: r.plan,
+      promptCapture: !!r.prompt_capture, rules, removed: Array.isArray(r.removed) ? r.removed : [],
+    }, null, 2) + '\n');
+    const next = { ...state, lastSyncAt: now, lastSyncRows: rows.length };
+    if (r.team_name) next.teamName = r.team_name;
+    if (r.plan) next.plan = r.plan;
+    if (r.prompt_capture !== undefined) next.promptCapture = !!r.prompt_capture;
+    delete next.lastError;
+    saveTeamState(next, dir);
+    return { uploaded: rows.length, rules: rules.length };
+  } catch (e) {
+    debug('team-sync', e);
+    // Stamp lastSyncAt too, so an offline machine backs off for the interval.
+    try { saveTeamState({ ...state, lastSyncAt: now, lastError: e.message }, dir); } catch (e2) { debug('team-sync', e2); }
+    return { error: e.message };
+  }
+}
+
+export async function autoJoin({ env = process.env, fetch, dir = userDataDir(), version, now = Date.now() } = {}) {
+  const token = env.SPRAG_TEAM_TOKEN;
+  if (!token || !TOKEN_RE.test(token)) return null;
+  const state = loadTeamState(dir);
+  // A state with `left: true` never auto-rejoins: leaving must beat the
+  // environment, or `sprag team leave` would be undone by the next session.
+  if (isJoined(state) || state.left) return null;
+  let name = 'member';
+  try { name = userInfo().username || 'member'; } catch { /* no passwd entry */ }
+  try {
+    return await joinTeam({ token, displayName: name, autoJoined: true, fetch, dir, version, now });
+  } catch (e) {
+    debug('team-sync', e);
+    return null;
+  }
+}
+
+export function autoJoinNotice(state, lang = 'en') {
+  if (!state || !state.autoJoinNoticePending) return null;
+  state.autoJoinNoticePending = false;
+  const name = state.teamName || '';
+  return lang === 'ko'
+    ? `Sprag: 이 PC는 SPRAG_TEAM_TOKEN 으로 팀 "${name}" 에 자동 참여됐습니다. 보내는 것은 하루 단위 집계(지출·절감·위임 횟수)뿐입니다. \`sprag team status --show-payload\` 로 내용을 확인하고 \`sprag team leave\` 로 멈출 수 있습니다.`
+    : `Sprag: this machine was enrolled in team "${name}" through SPRAG_TEAM_TOKEN. It sends daily aggregates only (spend, savings, delegation counts). See what is sent with \`sprag team status --show-payload\`; stop with \`sprag team leave\`.`;
+}

package/src/changelog.js

@@ -1,70 +0,0 @@
-/**
- * changelog — read one version's section out of CHANGELOG.md, and say whether a
- * notes draft is still waiting on a person.
- *
- * Separate from scripts/release-notes.mjs, which is a CLI: importing that file
- * runs its argument parsing and exits, so the extraction it depends on cannot be
- * tested through it. The boundary logic is the part worth pinning — a section
- * pulled one line short drops the release's last item, and one line long carries
- * the previous release's first, and the upgrade offer shows either without
- * complaint.
- *
- * The draft marker lives here for a reason. Two scripts gate on it — the one that
- * writes drafts and the one that deploys — and they used to carry the string
- * separately. Renaming it in one left the other looking for text that no longer
- * existed, and a gate that greps for an absent string does not fail: it passes,
- * and an unreviewed draft goes out as the release. One definition, imported.
- */
-
-/**
- * The body of one version's section, heading excluded.
- *
- * @param {string} changelog - CHANGELOG.md contents
- * @param {string} version - e.g. "3.45.0"
- * @returns {string|null} the section text, or null when that version has none
- */
-export function sectionFor(changelog, version) {
-  const lines = String(changelog).split(/\r?\n/);
-  // The version has to match to its end: without the boundary, "3.42.0" would
-  // also match the "### v3.42.7" heading and publish the wrong notes.
-  const head = new RegExp(`^### v${String(version).replace(/\./g, '\\.')}(\\s|$|\\()`);
-  const start = lines.findIndex((l) => head.test(l));
-  if (start < 0) return null;
-  const out = [];
-  for (let i = start + 1; i < lines.length; i += 1) {
-    // The next version heading ends this section, and so does a shallower one:
-    // "## All releases" is a container, not part of any release.
-    if (/^### v/.test(lines[i]) || /^## /.test(lines[i])) break;
-    out.push(lines[i]);
-  }
-  return out.join('\n').trim();
-}
-
-/**
- * The line `release-notes.mjs` writes at the top of a fresh draft, and the line
- * every gate refuses on. A draft still carrying it has not been through a person.
- */
-export const DRAFT_MARKER =
-  '<!-- REVIEW: edit this draft, add the English half, then delete this line -->';
-
-/** Heading that opens the Korean half of a bilingual release body. */
-export const KO_HEADING = '## 한국어';
-
-/**
- * The opening of the marker, which is what the gate actually matches. Spelled out
- * rather than sliced off `DRAFT_MARKER`, so that editing the marker's front does
- * not silently change what is being tested for.
- */
-const REVIEW_OPENING = '<!-- REVIEW:';
-
-/**
- * Whether a draft still needs review. Matches on the `<!-- REVIEW:` opening
- * rather than the whole line, so editing the wording of the instruction does not
- * quietly disarm the gate.
- *
- * @param {string} draft - the draft file's contents
- * @returns {boolean} true while the draft is unreviewed
- */
-export function needsReview(draft) {
-  return String(draft || '').includes(REVIEW_OPENING);
-}