tokentrace 0.12.1 → 0.14.0

package/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to TokenTrace are documented here.
 
 ## Unreleased
 
+## [0.14.0] - 2026-05-20
+
+### Added
+
+- `tokentrace mcp` now starts a local stdio MCP server for capabilities, status, Scan Health, evidence, repair queue, reports, and explicit local scans.
+- Added a validated MCP registry manifest for the npm package, with `tokentrace mcp` as the stdio entrypoint and no placeholder secrets.
+
+### Changed
+
+- Agent discovery, package smoke checks, packed-install smoke checks, and package inspection now cover the MCP server surface.
+
+## [0.13.0] - 2026-05-20
+
+### Changed
+
+- Overview now uses focused data assembly and smaller panel components, with quieter local development overlays.
+- Overview trend aggregation now avoids SQLite localtime bucketing so large local databases load the first dashboard view much faster.
+- Overview now uses a page-specific analytics profile to avoid computing secondary page insights during first load.
+- Slow dashboard analytics queries now surface through internal timing guardrails and doctor output.
+- CLI startup code is split into focused context, help, runtime, serve, and command modules while keeping the executable entrypoint thin.
+- Analytics queries are split into summary, trends, entities, repair, scan-trust, and insight domains to reduce hotspot risk.
+- Scan Health is split into focused diagnostics panels so the route stays limited to data assembly and composition.
+- Session Explorer now has sticky dense-table headers, clearer active-filter chips, row-density controls, faster reset actions, and stronger empty states.
+- Session Explorer filtering, summaries, high-cost thresholding, active-filter labels, and saved-view serialization now live in pure helper functions.
+- Repair now highlights the top unknown-cost cause, next best repair, expected impact, and clearer resolved, ignored, and parser-review state copy backed by executable repair actions.
+- Repair page data loading, summary cards, guidance, and repair queue table now live in focused modules so the route stays small.
+- Model Rates now has clearer repair-context copy, edit validation, duplicate provider/model warnings, save-result feedback, and CSV import/export for bulk rate changes.
+- Codex CLI ingestion now handles JSON-array session exports, warns on malformed local records, and persistence now reports empty, duplicate, or mismatched replacement imports before writing.
+- Unknown-cost repair actions are split into a focused helper module for clearer repair causes, next actions, and resolved-state copy.
+- Settings is split into focused scan, import profile, guardrail, package trust, export, storage, and custom-folder sections.
+- Mobile navigation now uses a compact command menu plus priority shortcuts, and first-run setup now leads users through local folders, model rates, scan, Scan Health, and review without cloud or sample-data assumptions.
+- Dashboard tables, page actions, and compact metric cards now behave better at narrow mobile widths.
+- `tokentrace serve` now prints clearer startup progress, help examples, browser-open guidance, and fixed-port conflict recovery steps.
+- CLI smoke checks are split into discovery, JSON/data, runtime watch, and dashboard serve modules so package smoke failures point to the broken surface.
+- Route loading copy now reinforces that TokenTrace is reading local database records without sending telemetry.
+- Repair and Model Rates now use mobile card layouts on narrow screens instead of forcing wide table workflows.
+- Unknown-cost repair, scan ingestion, Evidence Trail, and Pricing Settings internals are split into smaller focused modules to reduce hotspot risk and make future repair work safer.
+- Pricing saves, model-rate refreshes, and scans now report a repair delta showing unknown-cost before/after counts, resolved groups, and the top remaining blocked cause.
+- Settings now defers dense package trust, guardrail, import profile, and export sections while preserving section anchors.
+- Added `npm run browser:guard` to fail browser smoke runs on console errors, page errors, Next dev overlay issues, blank charts, and severe mobile overflow.
+
 ## [0.12.1] - 2026-05-19
 
 ### Fixed

package/README.md

@@ -41,6 +41,7 @@ tokentrace capabilities --json
                         # Alias for agent discovery manifest
 tokentrace roadmap --json
                         # Print release status handoff
+tokentrace mcp          # Start the local stdio MCP server
 tokentrace scan         # Scan local AI CLI usage logs
 tokentrace doctor --json
                         # Inspect scan health and repair recommendations
@@ -106,6 +107,19 @@ or npm package contents before invoking commands:
 - [llms.txt](llms.txt)
 - [docs/agent-discovery.schema.json](docs/agent-discovery.schema.json)
 
+MCP-capable clients can start the local stdio server after installing or using
+the npm package:
+
+```bash
+tokentrace mcp
+```
+
+The MCP server exposes the same local-first surfaces as tools: capabilities,
+status, Scan Health, evidence, repair queue, reports, and an explicit scan tool.
+It does not scan files on startup, and its scan tool requires
+`confirmLocalScan=true` before reading local usage files or writing the local
+database.
+
 When the local dashboard is already running, agents can fetch the same manifest
 over localhost:
 

package/TOKENTRACE_AGENT.md

@@ -19,6 +19,16 @@ tokentrace capabilities --json
 
 The manifest follows the schema in `docs/agent-discovery.schema.json`.
 
+MCP-capable clients can use the local stdio server:
+
+```bash
+tokentrace mcp
+```
+
+The MCP server does not scan on startup. Its `run_scan` tool requires
+`confirmLocalScan=true` before reading local usage files or writing the local
+database.
+
 If the local dashboard is already running, the same manifest is available from:
 
 ```bash
@@ -67,6 +77,7 @@ curl http://127.0.0.1:3030/api/roadmap
 - Do not call processed tokens current context size. Use `ctx` for live context-window pressure.
 - Treat database paths, source file paths, prompts, and raw transcript settings as local sensitive data.
 - Discovery is read-only: it does not scan files, initialize the dashboard database, start a server, or make a network request.
+- MCP startup is read-only; use `run_scan` only when the human expects a local scan.
 
 ## Integrations
 

package/app/api/prices/route.ts

@@ -62,6 +62,7 @@ export async function POST(request: Request) {
     interactionsChecked: result.interactionsChecked,
     unknownCostInteractions: result.unknownCostInteractions,
     modelAliasesUpdated: result.modelsUpdated,
-    resolvedRepairItems: result.resolvedRepairItems
+    resolvedRepairItems: result.resolvedRepairItems,
+    repairDelta: result.repairDelta
   });
 }