tokmon 0.23.4 → 0.24.0

package/README.md

@@ -26,6 +26,22 @@ npm install -g tokmon
 
 Then run `tokmon`. On first launch you'll pick which providers to track; press `q` to quit any time.
 
+## CLI Data Queries
+
+Scripts and coding agents can query the same daemon directly without opening the interactive dashboard:
+
+```bash
+tokmon usage                              # current-month usage by provider/account/model
+tokmon usage --period week --provider codex
+tokmon usage --model opus --json          # stable machine-readable schema
+tokmon usage --period all --json --compact
+tokmon providers --json                   # accounts plus local config/auth/usage paths
+tokmon snapshot --refresh                 # complete raw daemon snapshot
+tokmon config path                        # tokmon config file location
+```
+
+`usage` refreshes local history by default; use `--cached` for the fastest cached answer or `--refresh` to refresh billing as well. JSON reports include `schemaVersion`, exact provider/account source IDs, per-model token and cost fields, and a `sources` collection that maps every model row to its provider home and discovered local paths. Run `tokmon usage --help` or `tokmon providers --help` for every filter and example.
+
 ## Providers
 
 **Usage providers** — full cost & token history (Today / Week / Month, sparkline, per-model table):
@@ -81,7 +97,7 @@ For **Claude / Codex / Cursor / Grok** — Daily, Weekly, and Monthly breakdowns
 
 ## Web Dashboard
 
-Prefer a browser? `tokmon serve` starts a local web dashboard with the same data as the TUI — charts, global filtering, and shareable images — in a terminal-styled UI. Press `w` (or `W`) inside the TUI to open its authenticated local URL.
+Prefer a browser? `tokmon serve` starts a local web dashboard with the same data as the TUI — charts, global filtering, and shareable images — in a terminal-styled UI. Press `w` (or `W`) inside the TUI to open its ordinary local URL.
 
 ```bash
 tokmon serve            # opens http://127.0.0.1:4317 in your browser
@@ -89,9 +105,7 @@ tokmon serve --port 8080
 tokmon serve --no-open  # don't auto-open the browser
 ```
 
-It binds to `127.0.0.1` only and reads the same data read-only — nothing leaves your machine. It renders instantly from a cached snapshot, then streams live updates over an authenticated WebSocket, and goes idle when no tab is open. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
-
-The URL opened by `W` contains a capability in its fragment. Fragments are not sent with normal page requests or referrers, but keeping it in the address makes the complete URL copyable into another local browser while that daemon is running. Treat that URL as private; after the daemon restarts, press `W` again for a fresh one.
+It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
 
 ### Overview
 
@@ -188,6 +202,10 @@ Press `s` to open.
 ```
 tokmon [options]            Launch the terminal dashboard
 tokmon serve [options]      Launch the web dashboard (http://127.0.0.1:4317)
+tokmon usage [options]      Query usage by model (human or JSON)
+tokmon providers [options]  Show accounts and local provider paths
+tokmon snapshot [options]   Print the raw daemon snapshot as JSON
+tokmon config [path]        Print the tokmon config file location
 
 Options:
 -i, --interval <seconds>  Refresh interval in seconds (default: from config, or 2)
@@ -224,7 +242,7 @@ tokmon runs entirely on your machine and reads everything **read-only**:
 
 ## How It Works
 
-tokmon runs a small local **daemon** that does all the data collection. The terminal UI and the web dashboard are both thin clients of it, talking over a loopback-only WebSocket — so a single process does the work and the TUI and web always show the same numbers. The daemon starts automatically with the TUI (and standalone via `tokmon serve`), and idle-pauses when nothing is watching.
+tokmon runs a small local **daemon** that does all the data collection. The terminal UI and the web dashboard are both thin clients of it, talking over a local WebSocket — loopback-only by default — so a single process does the work and the TUI and web always show the same numbers. The daemon starts automatically with the TUI (and standalone via `tokmon serve`), and idle-pauses when nothing is watching.
 
 **Usage & cost**
 - Parses each tool's local session logs — Claude / Codex / pi `JSONL`, Cursor / opencode `SQLite` — and aggregates cost and token usage per day, week, and month.

package/dist/{bootstrap-ink-BIOLTP7F.js → bootstrap-ink-HL2BYNW3.js}

@@ -1,28 +1,27 @@
 #!/usr/bin/env node
 import {
-  PROVIDERS,
-  PROVIDER_ORDER,
-  TOKMON_WS_METHODS,
-  TOKMON_WS_PATH,
-  TokmonRpcGroup,
+  createDaemonRpcClient
+} from "./chunk-45ZP755H.js";
+import {
   accountsByProvider,
   buildAccounts,
+  fetchPeak,
+  modelColor
+} from "./chunk-42H7R376.js";
+import {
+  PROVIDERS,
+  PROVIDER_ORDER,
   coalesceTables,
   col,
   currency,
   detectProviders,
-  fetchPeak,
-  modelColor,
   resolveTimezone,
   shortDate,
   systemTimezone,
   time,
   tokens,
   withTimeout
-} from "./chunk-2AFQKH5O.js";
-import {
-  glyphs
-} from "./chunk-RF4GGQGM.js";
+} from "./chunk-O27I2XFN.js";
 import {
   COLOR_PALETTE,
   DEFAULTS,
@@ -37,7 +36,10 @@ import {
   sanitizeTyped,
   saveConfigSync,
   snapshotCacheFile
-} from "./chunk-DJPUYMZM.js";
+} from "./chunk-5CWOJMAH.js";
+import {
+  glyphs
+} from "./chunk-RF4GGQGM.js";
 
 // src/bootstrap-ink.tsx
 import { render } from "ink";
@@ -530,7 +532,7 @@ import { Box as Box4, Text as Text4 } from "ink";
 import { memo as memo3 } from "react";
 import { Box as Box3, Text as Text3 } from "ink";
 import { Fragment as Fragment2, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
-var GENERAL_ROWS = 8;
+var GENERAL_ROWS = 9;
 var SETTINGS_TABS = ["general", "providers", "accounts"];
 var SETTINGS_TAB_LABELS = {
   general: "General",
@@ -624,7 +626,9 @@ var SettingsView = memo3(function SettingsView2({
           " ",
           glyphs().caretR
         ] })
-      ] })
+      ] }),
+      /* @__PURE__ */ jsx3(Row, { cursor, idx: 8, label: "Network access", children: /* @__PURE__ */ jsx3(Text3, { bold: true, color: config.allowNetworkAccess ? "red" : "green", children: config.allowNetworkAccess ? "LAN (unsafe)" : "local only" }) }),
+      config.allowNetworkAccess && /* @__PURE__ */ jsx3(Text3, { color: "red", children: "  Warning: dashboard data and settings will be exposed to your local network after daemon restart." })
     ] }),
     activeTab === "providers" && /* @__PURE__ */ jsxs3(Fragment2, { children: [
       /* @__PURE__ */ jsx3(Text3, { bold: true, dimColor: true, children: "Providers" }),
@@ -1605,287 +1609,19 @@ function TinyRow({ provider, accounts, stats, width }) {
 
 // src/client/use-daemon.ts
 import { useEffect as useEffect3, useMemo, useRef as useRef2, useState as useState3 } from "react";
-
-// src/client/daemon-rpc-client.ts
-import { Cause, Context, Duration, Effect, Exit, Fiber, Layer, ManagedRuntime, Schedule, Stream } from "effect";
-import { RpcClient, RpcSerialization } from "effect/unstable/rpc";
-import * as Socket from "effect/unstable/socket/Socket";
-var TokmonRpcClient = class extends Context.Service()(
-  "tokmon/client/DaemonRpcClient/TokmonRpcClient"
-) {
-};
-var dynamicImport = new Function("specifier", "return import(specifier)");
-function toWsUrl(baseUrl, token) {
-  const base = typeof window === "undefined" ? void 0 : window.location.origin;
-  const url = new URL(baseUrl, base);
-  if (url.protocol === "http:") url.protocol = "ws:";
-  else if (url.protocol === "https:") url.protocol = "wss:";
-  if (url.protocol !== "ws:" && url.protocol !== "wss:") {
-    throw new Error(`unsupported daemon RPC protocol: ${url.protocol}`);
-  }
-  url.hash = "";
-  url.searchParams.delete("tokmonToken");
-  url.pathname = TOKMON_WS_PATH;
-  if (token) url.searchParams.set("wsToken", token);
-  return url.toString();
-}
-function shouldUseNodeTransport(transport) {
-  if (transport === "node") return true;
-  if (transport === "browser") return false;
-  return typeof window === "undefined";
-}
-async function socketLayerFor(url, transport) {
-  if (shouldUseNodeTransport(transport)) {
-    const NodeSocket = await dynamicImport("@effect/platform-node/NodeSocket");
-    return NodeSocket.layerWebSocket(url);
-  }
-  return Socket.layerWebSocket(url).pipe(
-    Layer.provide(Socket.layerWebSocketConstructorGlobal)
-  );
-}
-function retryPolicy(options) {
-  const baseDelay = options.reconnectBaseDelayMs ?? 250;
-  const policy = Schedule.exponential(Duration.millis(baseDelay), 1.5).pipe(
-    Schedule.either(Schedule.spaced(Duration.millis(2500)))
-  );
-  return typeof options.reconnectAttempts === "number" ? policy.pipe(Schedule.both(Schedule.recurs(options.reconnectAttempts))) : policy;
-}
-function createDaemonRpcClient(baseUrl, options = {}) {
-  const url = toWsUrl(baseUrl, options.wsToken);
-  const fibers = /* @__PURE__ */ new Set();
-  let session = null;
-  let sessionPromise = null;
-  let closed = false;
-  const setConn = (state, error) => {
-    options.onConn?.(state, error);
-  };
-  const resetSession = (active) => {
-    if (active !== void 0 && active !== null && active !== session) {
-      void active.runtime.dispose().catch(() => {
-      });
-      return;
-    }
-    const dead = active ?? session;
-    session = null;
-    sessionPromise = null;
-    if (dead) void dead.runtime.dispose().catch(() => {
-    });
-  };
-  const makeProtocolLayer = async () => {
-    const socketLayer = await socketLayerFor(url, options.transport);
-    const connectionHooksLayer = Layer.succeed(
-      RpcClient.ConnectionHooks,
-      RpcClient.ConnectionHooks.of({
-        onConnect: Effect.sync(() => {
-          setConn("live");
-        }),
-        onDisconnect: Effect.sync(() => {
-          if (!closed) {
-            setConn("reconnecting");
-          }
-        })
-      })
-    );
-    return Layer.effect(
-      RpcClient.Protocol,
-      RpcClient.makeProtocolSocket({
-        retryPolicy: retryPolicy(options),
-        retryTransientErrors: true
-      })
-    ).pipe(
-      Layer.provide(Layer.mergeAll(socketLayer, RpcSerialization.layerJson, connectionHooksLayer))
-    );
-  };
-  const ensureSession = async () => {
-    if (closed) throw new Error("daemon RPC client is closed");
-    if (session) return session;
-    if (sessionPromise) return sessionPromise;
-    setConn("connecting");
-    sessionPromise = (async () => {
-      let runtime;
-      try {
-        const protocolLayer = await makeProtocolLayer();
-        const clientLayer = Layer.effect(
-          TokmonRpcClient,
-          RpcClient.make(TokmonRpcGroup)
-        ).pipe(
-          Layer.provide(protocolLayer)
-        );
-        runtime = ManagedRuntime.make(clientLayer);
-        await runtime.runPromise(TokmonRpcClient.asEffect());
-        if (closed) {
-          await runtime.dispose();
-          throw new Error("daemon RPC client is closed");
-        }
-        session = { runtime };
-        return session;
-      } catch (error) {
-        sessionPromise = null;
-        await runtime?.dispose().catch(() => {
-        });
-        if (!closed) setConn("error", error);
-        throw error;
-      }
-    })();
-    return sessionPromise;
-  };
-  const run = async (effectFor) => {
-    const active = await ensureSession();
-    try {
-      return await active.runtime.runPromise(
-        TokmonRpcClient.use((client) => effectFor(client))
-      );
-    } catch (error) {
-      if (!closed) {
-        resetSession(active);
-        setConn("error", error);
-      }
-      throw error;
-    }
-  };
-  const subscribe = (streamFor, onValue, staleAfterFor) => {
-    if (closed) return () => {
-    };
-    let fiber = null;
-    let unsubscribed = false;
-    let retryTimer = null;
-    let watchdogTimer = null;
-    let lastValueAt = 0;
-    let staleAfterMs = Number.POSITIVE_INFINITY;
-    let watchdogRestart = false;
-    const stopFiber = () => {
-      if (!fiber) return;
-      const current = fiber;
-      fiber = null;
-      fibers.delete(current);
-      void (session?.runtime.runPromise(Fiber.interrupt(current)) ?? Effect.runPromise(Fiber.interrupt(current))).catch(() => {
-      });
-    };
-    const scheduleRetry = () => {
-      if (closed || unsubscribed || retryTimer) return;
-      retryTimer = setTimeout(() => {
-        retryTimer = null;
-        start();
-      }, options.reconnectBaseDelayMs ?? 250);
-      retryTimer.unref?.();
-    };
-    if (staleAfterFor) {
-      const checkEveryMs = Math.min(5e3, Math.max(10, (options.snapshotStaleFloorMs ?? 9e4) / 2));
-      watchdogTimer = setInterval(() => {
-        if (!fiber || lastValueAt === 0 || Date.now() - lastValueAt <= staleAfterMs) return;
-        watchdogRestart = true;
-        lastValueAt = Date.now();
-        setConn("reconnecting");
-        stopFiber();
-      }, checkEveryMs);
-      watchdogTimer.unref?.();
-    }
-    const start = () => {
-      void (async () => {
-        try {
-          const active = await ensureSession();
-          if (closed || unsubscribed) return;
-          lastValueAt = Date.now();
-          staleAfterMs = options.snapshotStaleFloorMs ?? 9e4;
-          const currentFiber = active.runtime.runFork(
-            TokmonRpcClient.use(
-              (client) => streamFor(client).pipe(
-                Stream.runForEach(
-                  (value) => Effect.sync(() => {
-                    lastValueAt = Date.now();
-                    if (staleAfterFor) staleAfterMs = staleAfterFor(value);
-                    try {
-                      onValue(value);
-                    } catch {
-                    }
-                  })
-                )
-              )
-            )
-          );
-          fiber = currentFiber;
-          fibers.add(currentFiber);
-          currentFiber.addObserver((exit) => {
-            fibers.delete(currentFiber);
-            if (fiber === currentFiber) fiber = null;
-            if (closed || unsubscribed) return;
-            const stale = watchdogRestart;
-            watchdogRestart = false;
-            resetSession(active);
-            if (stale || Exit.isSuccess(exit)) setConn("reconnecting");
-            else setConn("error", Cause.squash(exit.cause));
-            scheduleRetry();
-          });
-        } catch (error) {
-          if (!closed && !unsubscribed) {
-            resetSession();
-            setConn("error", error);
-            scheduleRetry();
-          }
-        }
-      })();
-    };
-    start();
-    return () => {
-      unsubscribed = true;
-      if (retryTimer) {
-        clearTimeout(retryTimer);
-        retryTimer = null;
-      }
-      if (watchdogTimer) {
-        clearInterval(watchdogTimer);
-        watchdogTimer = null;
-      }
-      stopFiber();
-    };
-  };
-  return {
-    getConfig: () => run((client) => client[TOKMON_WS_METHODS.getConfig]({})).then((state) => state),
-    setConfig: (config) => run((client) => client[TOKMON_WS_METHODS.setConfig](config)).then((state) => state),
-    refresh: (scope = "all") => run((client) => client[TOKMON_WS_METHODS.refresh]({ scope })),
-    browseFs: (path) => run((client) => client[TOKMON_WS_METHODS.browseFs]({ path })),
-    subscribeSnapshot: (onSnapshot) => subscribe(
-      (client) => client[TOKMON_WS_METHODS.snapshot]({}).pipe(Stream.map((value) => value)),
-      onSnapshot,
-      (snapshot) => Math.max(options.snapshotStaleFloorMs ?? 9e4, snapshot.intervalMs * 3)
-    ),
-    subscribeConfig: (onConfig) => subscribe((client) => client[TOKMON_WS_METHODS.config]({}).pipe(Stream.map((value) => value)), onConfig),
-    async close() {
-      if (closed) return;
-      closed = true;
-      setConn("closed");
-      const active = [...fibers];
-      fibers.clear();
-      const activeSession = session ?? await sessionPromise?.catch(() => null) ?? null;
-      await Promise.all(active.map(
-        (fiber) => (activeSession?.runtime.runPromise(Fiber.interrupt(fiber)) ?? Effect.runPromise(Fiber.interrupt(fiber))).catch(() => {
-        })
-      ));
-      session = null;
-      sessionPromise = null;
-      if (activeSession) {
-        await activeSession.runtime.dispose().catch(() => {
-        });
-      }
-    }
-  };
-}
-
-// src/client/use-daemon.ts
-function useDaemon(baseUrl, wsToken) {
+function useDaemon(baseUrl) {
   const [snapshot, setSnapshot] = useState3(null);
   const [conn, setConn] = useState3("connecting");
   const [config, setConfigState] = useState3(null);
   const client = useMemo(() => {
-    if (!baseUrl || !wsToken) return null;
+    if (!baseUrl) return null;
     return createDaemonRpcClient(baseUrl, {
       transport: "node",
-      wsToken,
       onConn: (state) => {
         if (state !== "closed") setConn(state);
       }
     });
-  }, [baseUrl, wsToken]);
+  }, [baseUrl]);
   const clientRef = useRef2(client);
   clientRef.current = client;
   useEffect3(() => {
@@ -2383,6 +2119,10 @@ function handleSettings(input, key, ctx) {
     }
     if (index === 7 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
       updateConfig((current) => ({ ...current, defaultFocus: current.defaultFocus === "all" ? "last" : "all" }));
+      return;
+    }
+    if (index === 8 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
+      updateConfig((current) => ({ ...current, allowNetworkAccess: !current.allowNetworkAccess }));
     }
   }
 }
@@ -3304,10 +3044,10 @@ function useAccountForm({ cfg, detected, updateConfig, trackedAccountRows, setSe
 
 // src/app.tsx
 import { Fragment as Fragment4, jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
-function App({ interval: cliInterval, initialConfig, baseUrl = null, wsToken = null, mode = "degraded" }) {
-  const connected = mode === "connected" && baseUrl !== null && wsToken !== null;
+function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "degraded" }) {
+  const connected = mode === "connected" && baseUrl !== null;
   const degraded = !connected;
-  const daemon = useDaemon(connected ? baseUrl : null, connected ? wsToken : null);
+  const daemon = useDaemon(connected ? baseUrl : null);
   const { config, configSaveError, updateConfig } = useConfigState({
     initialConfig,
     cliInterval,
@@ -3643,16 +3383,16 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, wsToken = n
       return;
     }
     if (webRef.current) {
-      openUrl(webRef.current.browserUrl);
+      openUrl(webRef.current.url);
       return;
     }
     if (webStartingRef.current) return;
     webStartingRef.current = true;
     try {
-      const { startWebServer } = await import("./server-UHQEOVQH.js");
+      const { startWebServer } = await import("./server-X63FGHIZ.js");
       const ctrl = await startWebServer({ config: cfg, log: false });
       webRef.current = ctrl;
-      openUrl(ctrl.browserUrl);
+      openUrl(ctrl.url);
     } catch {
     } finally {
       webStartingRef.current = false;
@@ -3850,6 +3590,12 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, wsToken = n
       glyphs().middot,
       " showing last known data"
     ] }),
+    cfg.allowNetworkAccess && /* @__PURE__ */ jsxs12(Text12, { color: "red", children: [
+      glyphs().warn,
+      " unsafe network access enabled ",
+      glyphs().middot,
+      " dashboard may be reachable from your LAN after daemon restart"
+    ] }),
     configSaveError && /* @__PURE__ */ jsxs12(Text12, { color: "red", children: [
       glyphs().warn,
       " ",
@@ -3970,7 +3716,6 @@ async function bootstrapInk({ interval, config, daemon, mode }) {
         interval,
         initialConfig: config,
         baseUrl: daemon.baseUrl,
-        wsToken: daemon.wsToken,
         mode
       }
     ) })

package/dist/{chunk-RM3ZE44Z.js → chunk-3TJVFKXV.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   cacheDir
-} from "./chunk-DJPUYMZM.js";
+} from "./chunk-5CWOJMAH.js";
 
 // src/web/lockfile.ts
 import { closeSync, fchmodSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";