tokenoscopy 0.3.1 → 0.4.0

package/README.md

@@ -4,12 +4,14 @@
 
 ```bash
 npm install -g tokenoscopy
-tokenoscopy init --key tok_…
+tokenoscopy init
 ```
 
-Sign in at [tokenoscopy.com](https://tokenoscopy.com) and the **Setup** screen
-hands you that command with your key already written into it, then waits for
-your first session and shows it to you as it lands.
+No key to paste: `init` opens your browser to pair the machine with your
+workspace, you confirm the code it shows, and it finishes in the terminal.
+The **Setup** screen at [tokenoscopy.com](https://tokenoscopy.com) then waits
+for your first session and shows it to you as it lands. Headless or CI? Pass
+a key from Settings → Ingest keys with `--key tok_…` (or `TOKENOSCOPY_KEY`).
 
 Install globally rather than relying on `npx`: the budget guard runs before
 every Bash and MCP tool call, and `npx` re-resolves the package each time.

package/dist/{chunk-AZYPMFOF.js → chunk-KU3AJVVR.js}

@@ -1,7 +1,9 @@
+import { readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+import { z } from 'zod';
+
 // src/auth-mode.ts
-import { readFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
 function keyWasRejected(key, cfg) {
   const rejected = cfg?.customApiKeyResponses?.rejected ?? [];
   return rejected.includes(key.slice(-20));
@@ -157,9 +159,6 @@ function redactValue(value) {
   }
   return value;
 }
-
-// ../shared/src/events.ts
-import { z } from "zod";
 var agentProductSchema = z.enum([
   "claude_code",
   "codex",
@@ -266,12 +265,12 @@ var sessionSummarySchema = z.object({
   /** Count of transcript records the parser did not recognize (drift signal). */
   unknown_record_count: z.number().int().nonnegative().default(0)
 });
-var flushUploadSchema = z.object({
+z.object({
   schema_version: z.literal(1),
   summary: sessionSummarySchema,
   events: z.array(sessionEventSchema)
 });
-var hookEventSchema = z.object({
+z.object({
   hook_event_name: z.string(),
   session_id: z.string().min(8),
   transcript_path: z.string().optional(),
@@ -288,14 +287,14 @@ var hookEventSchema = z.object({
   agent_id: z.string().optional(),
   agent_type: z.string().optional()
 }).passthrough();
-var guardCheckRequestSchema = z.object({
+z.object({
   session_id: z.string().min(8),
   tool_name: z.string(),
   cwd: z.string().optional(),
   git_repo: z.string().optional()
 });
 var guardDecisionSchema = z.enum(["allow", "ask", "deny"]);
-var guardCheckResponseSchema = z.object({
+z.object({
   decision: guardDecisionSchema,
   reason: z.string().optional(),
   budget: z.object({
@@ -357,22 +356,6 @@ function estimateCostUsd(model, usage) {
   return Math.round(cost * 1e6) / 1e6;
 }
 
-// ../shared/src/diagnose.ts
-var DIAG = {
-  /** A session counts as live if it produced an event this recently. */
-  LIVE_WINDOW_MS: 15 * 6e4,
-  RUNAWAY_MIN_COST: 10,
-  RUNAWAY_CTX_TOKENS: 4e5,
-  RUNAWAY_CYCLE: 40,
-  RUNAWAY_REPEAT: 10,
-  BLOAT_CTX_TOKENS: 2e5,
-  BLOAT_MIN_COST: 5,
-  CYCLE_MIN: 25,
-  REPEAT_MIN: 5,
-  /** Requests that rebuilt the cache, summed, before it's worth a habit change. */
-  REBUILD_MIN_COST: 3
-};
-
 // ../shared/src/guard-contract.ts
 var GUARD_TIMEOUT_MS = 1500;
 var ALLOW_CACHE_MS = 15e3;
@@ -466,9 +449,6 @@ function withRelPath(event, root) {
   return { ...event, payload: { ...event.payload, rel_path: rel } };
 }
 
-// ../shared/src/anatomy.ts
-var CACHE_TTL_MS = 5 * 6e4;
-
 // src/transcript.ts
 var SKIPPED_TYPES = /* @__PURE__ */ new Set([
   "summary",
@@ -739,19 +719,4 @@ function parseTranscript(jsonl) {
   return { summary, events, warnings };
 }
 
-export {
-  classifyAuth,
-  readClaudeJson,
-  detectAuth,
-  detectAuthMode,
-  costIsRealMoney,
-  redactText,
-  redactValue,
-  GUARD_TIMEOUT_MS,
-  ALLOW_CACHE_MS,
-  naturalDedupKey,
-  truncatePayload,
-  withRelPath,
-  repoLabelFromCwd,
-  parseTranscript
-};
+export { ALLOW_CACHE_MS, GUARD_TIMEOUT_MS, classifyAuth, costIsRealMoney, detectAuth, detectAuthMode, naturalDedupKey, parseTranscript, readClaudeJson, redactText, redactValue, repoLabelFromCwd, truncatePayload, withRelPath };

package/dist/cli.js

@@ -1,25 +1,11 @@
 #!/usr/bin/env node
-import {
-  ALLOW_CACHE_MS,
-  GUARD_TIMEOUT_MS,
-  detectAuth,
-  detectAuthMode,
-  naturalDedupKey,
-  parseTranscript,
-  redactValue,
-  truncatePayload,
-  withRelPath
-} from "./chunk-AZYPMFOF.js";
+import { detectAuth, GUARD_TIMEOUT_MS, parseTranscript, detectAuthMode, withRelPath, redactValue, ALLOW_CACHE_MS, truncatePayload, naturalDedupKey } from './chunk-KU3AJVVR.js';
+import { existsSync, readFileSync, readdirSync, statSync, watch, copyFileSync, writeFileSync, mkdirSync } from 'fs';
+import { homedir, userInfo, hostname, tmpdir } from 'os';
+import { join } from 'path';
+import { execFileSync, spawn } from 'child_process';
+import { createInterface } from 'readline/promises';
 
-// src/commands/doctor.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
-
-// src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
 var DEFAULT_API_URL = "https://tokenoscopy.com";
 function configDir() {
   return process.env.TOKENOSCOPY_CONFIG_DIR ?? join(homedir(), ".config", "tokenoscopy");
@@ -59,10 +45,10 @@ async function runDoctor() {
     out("\u2717 no config \u2014 run `npx tokenoscopy init`");
     failures++;
   }
-  const settingsPath = join2(homedir2(), ".claude", "settings.json");
-  if (existsSync2(settingsPath)) {
+  const settingsPath = join(homedir(), ".claude", "settings.json");
+  if (existsSync(settingsPath)) {
     try {
-      const settings = JSON.parse(readFileSync2(settingsPath, "utf8"));
+      const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
       const raw = JSON.stringify(settings.hooks ?? {});
       const hasHttp = raw.includes("/api/ingest/hook");
       const hasFlush = raw.includes("tokenoscopy flush");
@@ -87,8 +73,8 @@ async function runDoctor() {
   }[auth.mode];
   out(`${auth.mode === "unknown" ? "\u26A0" : "\u2713"} billing lane: ${laneLabel}`);
   out(`  evidence: ${auth.evidence}`);
-  const projectsDir = join2(homedir2(), ".claude", "projects");
-  if (existsSync2(projectsDir)) {
+  const projectsDir = join(homedir(), ".claude", "projects");
+  if (existsSync(projectsDir)) {
     out(`\u2713 transcript directory readable (${projectsDir})`);
   } else {
     out(`\u26A0 no transcript directory yet (${projectsDir}) \u2014 appears after the first session`);
@@ -131,13 +117,6 @@ async function runDoctor() {
 ${failures} problem(s) found.`);
   return failures === 0 ? 0 : 1;
 }
-
-// src/commands/flush.ts
-import { readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
-
-// src/identity.ts
-import { execFileSync } from "child_process";
-import { hostname, userInfo } from "os";
 function git(args, cwd) {
   try {
     const out = execFileSync("git", args, {
@@ -274,14 +253,14 @@ async function runFlush(args) {
       }
     }
   }
-  if (!transcriptPath || !existsSync3(transcriptPath)) {
+  if (!transcriptPath || !existsSync(transcriptPath)) {
     process.stderr.write("tokenoscopy flush: no transcript to flush\n");
     return 0;
   }
   let upload;
   try {
     const { summary, events, warnings } = parseTranscript(
-      readFileSync3(transcriptPath, "utf8")
+      readFileSync(transcriptPath, "utf8")
     );
     const identity = detectIdentity(summary.cwd);
     summary.actor.machine_id = identity.machine;
@@ -351,18 +330,13 @@ async function runFlush(args) {
   }
   return 0;
 }
-
-// src/commands/guard.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
 function cachePath(sessionId) {
   const safe = sessionId.replace(/[^a-zA-Z0-9-]/g, "").slice(0, 64);
-  return join3(tmpdir(), `tokenoscopy-guard-${safe}.json`);
+  return join(tmpdir(), `tokenoscopy-guard-${safe}.json`);
 }
 function readAllowCache(sessionId) {
   try {
-    const raw = JSON.parse(readFileSync4(cachePath(sessionId), "utf8"));
+    const raw = JSON.parse(readFileSync(cachePath(sessionId), "utf8"));
     return typeof raw.until === "number" && raw.until > Date.now();
   } catch {
     return false;
@@ -370,7 +344,7 @@ function readAllowCache(sessionId) {
 }
 function writeAllowCache(sessionId) {
   try {
-    writeFileSync2(
+    writeFileSync(
       cachePath(sessionId),
       JSON.stringify({ until: Date.now() + ALLOW_CACHE_MS })
     );
@@ -447,13 +421,121 @@ async function runGuard() {
     return 0;
   }
 }
+function interpretPoll(status, body) {
+  const b = body && typeof body === "object" ? body : {};
+  if (status === 202) {
+    const interval = typeof b.interval === "number" && b.interval > 0 ? b.interval : 3;
+    return { kind: "pending", interval };
+  }
+  if (status === 200 && typeof b.key === "string" && b.key.startsWith("tok_")) {
+    return {
+      kind: "paired",
+      key: b.key,
+      hostname: typeof b.hostname === "string" ? b.hostname : "this machine"
+    };
+  }
+  if (status === 410 || status === 404) {
+    return { kind: "gone", reason: typeof b.error === "string" ? b.error : "gone" };
+  }
+  return { kind: "retry" };
+}
+function goneMessage(reason) {
+  switch (reason) {
+    case "expired":
+      return "The pairing code expired before it was confirmed.";
+    case "consumed":
+      return "That pairing was already collected by another init.";
+    default:
+      return "That pairing is no longer valid.";
+  }
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+  try {
+    const child = spawn(cmd[0], cmd[1], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.on("error", () => void 0);
+    child.unref();
+  } catch {
+  }
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function startPairing(apiUrl) {
+  try {
+    const res = await fetch(`${apiUrl}/api/pair/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ hostname: hostname() }),
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (typeof body.device_code !== "string" || typeof body.user_code !== "string" || typeof body.verification_url !== "string") {
+      return null;
+    }
+    return {
+      device_code: body.device_code,
+      user_code: body.user_code,
+      verification_url: body.verification_url,
+      expires_in: typeof body.expires_in === "number" ? body.expires_in : 600,
+      interval: typeof body.interval === "number" ? body.interval : 3
+    };
+  } catch {
+    return null;
+  }
+}
+async function pairMachine(apiUrl, opts = { browser: true }) {
+  const out = opts.out ?? ((line) => process.stderr.write(`${line}
+`));
+  const start = await startPairing(apiUrl);
+  if (!start) {
+    out(`\u2717 Couldn't start pairing with ${apiUrl}.`);
+    return null;
+  }
+  out(`  Open  ${start.verification_url}`);
+  out(`  Code  ${start.user_code}   (this machine: ${hostname()})`);
+  if (opts.browser) openBrowser(start.verification_url);
+  out("  waiting for you to confirm in the browser\u2026");
+  const deadline = Date.now() + start.expires_in * 1e3;
+  let interval = start.interval;
+  while (Date.now() < deadline) {
+    await sleep(interval * 1e3);
+    let outcome;
+    try {
+      const res = await fetch(`${apiUrl}/api/pair/poll`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ device_code: start.device_code }),
+        signal: AbortSignal.timeout(8e3)
+      });
+      let body = null;
+      try {
+        body = await res.json();
+      } catch {
+        body = null;
+      }
+      outcome = interpretPoll(res.status, body);
+    } catch {
+      outcome = { kind: "retry" };
+    }
+    if (outcome.kind === "paired") {
+      out(`\u2713 paired as ${outcome.hostname}`);
+      return outcome.key;
+    }
+    if (outcome.kind === "gone") {
+      out(`\u2717 ${goneMessage(outcome.reason)}`);
+      return null;
+    }
+    if (outcome.kind === "pending") interval = outcome.interval;
+    else interval = Math.min(interval * 2, 15);
+  }
+  out("\u2717 Timed out waiting for the browser.");
+  return null;
+}
 
 // src/commands/init.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync3, copyFileSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join4 } from "path";
-import { createInterface } from "readline/promises";
 var MARKER = "tokenoscopy";
 function isOurs(group) {
   return JSON.stringify(group).toLowerCase().includes(MARKER);
@@ -462,7 +544,7 @@ function resolveInvocation() {
   const override = process.env.TOKENOSCOPY_BIN?.trim();
   if (override) return override;
   try {
-    const found = execFileSync2("command", ["-v", "tokenoscopy"], {
+    const found = execFileSync("command", ["-v", "tokenoscopy"], {
       encoding: "utf8",
       shell: "/bin/sh",
       timeout: 2e3,
@@ -522,11 +604,20 @@ async function runInit(args) {
   const flags = /* @__PURE__ */ new Map();
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
-    if (a === "--project" || a === "--print") flags.set(a, true);
+    if (a === "--project" || a === "--print" || a === "--no-browser") flags.set(a, true);
     else if (a.startsWith("--")) flags.set(a, args[++i] ?? "");
   }
   const apiUrl = flags.get("--url") || process.env.TOKENOSCOPY_API_URL || DEFAULT_API_URL;
   let key = flags.get("--key") || process.env.TOKENOSCOPY_KEY || "";
+  if (!key && process.stdin.isTTY) {
+    const paired = await pairMachine(apiUrl, { browser: !flags.get("--no-browser") });
+    if (paired) key = paired;
+    else {
+      process.stderr.write(
+        "  Paste a key from Settings \u2192 Ingest keys instead, or re-run with --key tok_\u2026\n"
+      );
+    }
+  }
   if (!key) {
     const rl = createInterface({ input: process.stdin, output: process.stderr });
     key = (await rl.question("Paste your ingest key (tok_\u2026): ")).trim();
@@ -553,11 +644,11 @@ async function runInit(args) {
   }
   const config = { apiUrl, key };
   saveConfig(config);
-  const settingsPath = flags.get("--project") ? join4(process.cwd(), ".claude", "settings.json") : join4(homedir3(), ".claude", "settings.json");
+  const settingsPath = flags.get("--project") ? join(process.cwd(), ".claude", "settings.json") : join(homedir(), ".claude", "settings.json");
   let settings = {};
-  if (existsSync4(settingsPath)) {
+  if (existsSync(settingsPath)) {
     try {
-      settings = JSON.parse(readFileSync5(settingsPath, "utf8"));
+      settings = JSON.parse(readFileSync(settingsPath, "utf8"));
       copyFileSync(settingsPath, `${settingsPath}.tokenoscopy-backup`);
     } catch {
       process.stderr.write(`\u2717 ${settingsPath} exists but isn't valid JSON \u2014 fix it first.
@@ -574,12 +665,12 @@ async function runInit(args) {
 `);
     return 0;
   }
-  const dir = join4(settingsPath, "..");
-  if (!existsSync4(dir)) {
-    const { mkdirSync: mkdirSync2 } = await import("fs");
+  const dir = join(settingsPath, "..");
+  if (!existsSync(dir)) {
+    const { mkdirSync: mkdirSync2 } = await import('fs');
     mkdirSync2(dir, { recursive: true });
   }
-  writeFileSync3(settingsPath, `${JSON.stringify(settings, null, 2)}
+  writeFileSync(settingsPath, `${JSON.stringify(settings, null, 2)}
 `);
   process.stderr.write(
     [
@@ -592,15 +683,10 @@ async function runInit(args) {
   );
   return 0;
 }
-
-// src/commands/tail.ts
-import { watch, existsSync as existsSync5, readdirSync, statSync } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join5 } from "path";
 var DEBOUNCE_MS = 3e3;
 async function runTail(args) {
-  const projectsDir = process.env.TOKENOSCOPY_PROJECTS_DIR ?? join5(homedir4(), ".claude", "projects");
-  if (!existsSync5(projectsDir)) {
+  const projectsDir = process.env.TOKENOSCOPY_PROJECTS_DIR ?? join(homedir(), ".claude", "projects");
+  if (!existsSync(projectsDir)) {
     process.stderr.write(`tokenoscopy tail: ${projectsDir} does not exist
 `);
     return 1;
@@ -612,7 +698,7 @@ async function runTail(args) {
     const cutoff = Date.now() - days * 24 * 3600 * 1e3;
     let count = 0;
     for (const dir of readdirSync(projectsDir)) {
-      const full = join5(projectsDir, dir);
+      const full = join(projectsDir, dir);
       let entries;
       try {
         entries = readdirSync(full);
@@ -621,7 +707,7 @@ async function runTail(args) {
       }
       for (const f of entries) {
         if (!f.endsWith(".jsonl")) continue;
-        const p = join5(full, f);
+        const p = join(full, f);
         try {
           if (statSync(p).mtimeMs >= cutoff) {
             await runFlush(["--transcript", p]);
@@ -640,14 +726,14 @@ async function runTail(args) {
   const pending = /* @__PURE__ */ new Map();
   watch(projectsDir, { recursive: true }, (_event, filename) => {
     if (!filename || !filename.endsWith(".jsonl")) return;
-    const full = join5(projectsDir, filename);
+    const full = join(projectsDir, filename);
     const existing = pending.get(full);
     if (existing) clearTimeout(existing);
     pending.set(
       full,
       setTimeout(() => {
         pending.delete(full);
-        if (existsSync5(full)) {
+        if (existsSync(full)) {
           void runFlush(["--transcript", full]);
         }
       }, DEBOUNCE_MS)
@@ -665,7 +751,9 @@ Usage: tokenoscopy <command> [options]
 
 Commands:
   init      Wire Claude Code hooks + transcript flush to your workspace
-              --key tok_\u2026      ingest key (or TOKENOSCOPY_KEY)
+              (no key: opens the browser to pair this machine)
+              --key tok_\u2026      ingest key (or TOKENOSCOPY_KEY) \u2014 headless / CI
+              --no-browser     print the pairing link instead of opening it
               --url https://\u2026  API base (default https://tokenoscopy.com)
               --project        write hooks to ./.claude/settings.json (CI)
               --print          print the hook config instead of writing

package/dist/index.js

@@ -1,22 +1 @@
-import {
-  classifyAuth,
-  costIsRealMoney,
-  detectAuth,
-  detectAuthMode,
-  parseTranscript,
-  readClaudeJson,
-  redactText,
-  redactValue,
-  repoLabelFromCwd
-} from "./chunk-AZYPMFOF.js";
-export {
-  classifyAuth,
-  costIsRealMoney,
-  detectAuth,
-  detectAuthMode,
-  parseTranscript,
-  readClaudeJson,
-  redactText,
-  redactValue,
-  repoLabelFromCwd
-};
+export { classifyAuth, costIsRealMoney, detectAuth, detectAuthMode, parseTranscript, readClaudeJson, redactText, redactValue, repoLabelFromCwd } from './chunk-KU3AJVVR.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenoscopy",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Flight recorder & spend control for coding-agent fleets. Records Claude Code sessions (hooks + transcripts), replays them, and enforces budgets.",
   "license": "MIT",
   "type": "module",