vibeusage 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibeusage",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Codex CLI token usage tracker (macOS-first, notify-driven).",
   "license": "MIT",
   "repository": {

package/src/lib/ops/audit-source.js

@@ -39,6 +39,16 @@ const { spawnSync } = require("node:child_process");
 const DEFAULT_DAYS = 14;
 const DEFAULT_THRESHOLD_PCT = 25;
 
+// `resolveUserIdViaInsforge` and `queryDbTotalsViaInsforge` interpolate these
+// values into a SQL string handed to `insforge db query` (argv, not shell, but
+// the argv reaches a SQL executor with service-role authority). The three
+// values are validated against strict whitelists so a malicious / typo flag
+// like --user-id "foo'; DROP TABLE users; --" cannot reach the DB.
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SOURCE_ID_RE = /^[a-z][a-z0-9-]*$/;
+const ISO_TIMESTAMP_RE =
+  /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
+
 function runSourceAudit({
   strategy,
   days = DEFAULT_DAYS,
@@ -246,7 +256,7 @@ function nonneg(v) {
 }
 
 function resolveUserIdViaInsforge({ deviceId }) {
-  if (!deviceId) return null;
+  if (!deviceId || !UUID_RE.test(String(deviceId))) return null;
   const r = spawnSync(
     "insforge",
     [
@@ -264,6 +274,27 @@ function resolveUserIdViaInsforge({ deviceId }) {
 }
 
 function queryDbTotalsViaInsforge({ userId, source, windowStartIso }) {
+  if (!userId || !UUID_RE.test(String(userId))) {
+    return {
+      ok: false,
+      error: "invalid-user-id",
+      message: `refusing to query DB with non-UUID user id '${String(userId).slice(0, 40)}'`,
+    };
+  }
+  if (!source || !SOURCE_ID_RE.test(String(source))) {
+    return {
+      ok: false,
+      error: "invalid-source-id",
+      message: `refusing to query DB with non-identifier source '${String(source).slice(0, 40)}'`,
+    };
+  }
+  if (!windowStartIso || !ISO_TIMESTAMP_RE.test(String(windowStartIso))) {
+    return {
+      ok: false,
+      error: "invalid-window-start",
+      message: `refusing to query DB with non-ISO windowStartIso '${String(windowStartIso).slice(0, 40)}'`,
+    };
+  }
   const sql =
     `SELECT DATE(hour_start) AS day, SUM(total_tokens) AS tokens ` +
     `FROM vibeusage_tracker_hourly ` +
@@ -361,4 +392,8 @@ module.exports = {
   runSourceAudit,
   getStrategy,
   listRegisteredSources,
+  // Exported for targeted tests that assert the SQL-interpolation inputs are
+  // validated before reaching `insforge db query`.
+  queryDbTotalsViaInsforge,
+  resolveUserIdViaInsforge,
 };

package/src/lib/ops/sources/claude.js

@@ -11,14 +11,25 @@ module.exports = {
   },
   walkSessions({ root }) {
     if (!fs.existsSync(root)) return [];
+    // Recurse: Claude Code writes the main thread under
+    // `projects/<project>/<session>.jsonl` AND subagent threads under
+    // `projects/<project>/<sessionId>/subagents/agent-*.jsonl`. Subagents
+    // burn real Anthropic tokens, so the audit must include them. Sync's
+    // walkClaudeProjects (rollout.js) already recurses; this mirrors it.
     const out = [];
-    for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
-      if (!entry.isDirectory()) continue;
-      const dir = path.join(root, entry.name);
-      for (const f of fs.readdirSync(dir, { withFileTypes: true })) {
-        if (!f.isFile()) continue;
-        if (!f.name.endsWith(".jsonl")) continue;
-        out.push(path.join(dir, f.name));
+    const stack = [root];
+    while (stack.length) {
+      const dir = stack.pop();
+      let entries;
+      try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+      } catch (_err) {
+        continue;
+      }
+      for (const entry of entries) {
+        const p = path.join(dir, entry.name);
+        if (entry.isDirectory()) stack.push(p);
+        else if (entry.isFile() && entry.name.endsWith(".jsonl")) out.push(p);
       }
     }
     return out;