appledger 0.2.0__tar.gz → 0.2.2__tar.gz

{appledger-0.2.0 → appledger-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: appledger
-Version: 0.2.0
+Version: 0.2.2
 Summary: The ledger for the AI app explosion: honest security checks, in plain language, for apps your people build with AI.
 Project-URL: Homepage, https://appledger.net/
 Project-URL: Repository, https://github.com/contentasoftware/appledger
@@ -25,7 +25,7 @@ Description-Content-Type: text/markdown
 
 # AppLedger honest check
 
-<!-- mcp-name: io.github.contentasoftware/appledger -->
+<!-- mcp-name: net.appledger/appledger -->
 
 Honest security feedback, in plain language, for apps people build with AI tools such as Claude Code, Codex, Cursor and Lovable.
 
@@ -45,16 +45,6 @@ Each run produces, in `<your-app>/.appledger/`:
 - `fix-prompt.md`: a ready-made fix request for your coding agent
 - `findings.json`: the same findings for tools and dashboards
 
-## AI effort behind the app
-
-Every check also reports how many AI tokens went into the app and what they would cost at API list prices. It reads the coding agents' own logs on your computer (Claude Code in `~/.claude/projects`, Codex in `~/.codex/sessions`), counts sessions that ran in the app's folder, and prices each reply by model, including cache reads and writes. These logs never leave your computer. On a flat-rate plan (Claude Pro, Max or Team) you pay your plan price instead, so the figure shows the work's value at API rates.
-
-```
-python -m appledger path/to/your-app --ai-cost
-```
-
-Codex support follows Codex's documented log format and hasn't been tested against real Codex logs yet.
-
 ## Two ways to run
 
 | Mode | What you install | Where your code goes |
@@ -108,7 +98,7 @@ Version 0.2.0 (upload preview, consent, secret-file exclusion, scheduling) is be
 
 ## Company dashboard
 
-Create a free account at [appledger.net](https://appledger.net/app/signup.php) to keep every app your people check in one ledger: owner, grade, score trend, who may use it and the AI cost behind it. Create a connection key under "Connect a computer", then save it on each computer:
+Create a free account at [appledger.net](https://appledger.net/app/signup.php) to keep every app your people check in one ledger: owner, grade, score trend, who may use it and which AI tool built it. Create a connection key under "Connect a computer", then save it on each computer:
 
 ```
 python -m appledger --connect al_your_key
@@ -116,7 +106,7 @@ python -m appledger --connect al_your_key
 
 Or tell Claude: "Connect AppLedger with this key: al_…". The key is saved in `~/.appledger/key`; `APPLEDGER_KEY` overrides it and `--disconnect` removes it.
 
-From then on each check also saves a summary to your dashboard: the app's name, score, grade, problem counts, up to 3 titles of the most serious problems, the scanners used and the AI cost totals. Never the code.
+From then on each check also saves a summary to your dashboard: the app's name, score, grade, problem counts, the list of problems found (level and short title, up to 60; never code or file paths), and the scanners used. Never the code.
 
 You can also add an app in the web app with **Add app**: register it without code, or upload a zip to check it in the browser (the zip is scanned and deleted the same way).
 

{appledger-0.2.0 → appledger-0.2.2}/README.md

@@ -1,6 +1,6 @@
 # AppLedger honest check
 
-<!-- mcp-name: io.github.contentasoftware/appledger -->
+<!-- mcp-name: net.appledger/appledger -->
 
 Honest security feedback, in plain language, for apps people build with AI tools such as Claude Code, Codex, Cursor and Lovable.
 
@@ -20,16 +20,6 @@ Each run produces, in `<your-app>/.appledger/`:
 - `fix-prompt.md`: a ready-made fix request for your coding agent
 - `findings.json`: the same findings for tools and dashboards
 
-## AI effort behind the app
-
-Every check also reports how many AI tokens went into the app and what they would cost at API list prices. It reads the coding agents' own logs on your computer (Claude Code in `~/.claude/projects`, Codex in `~/.codex/sessions`), counts sessions that ran in the app's folder, and prices each reply by model, including cache reads and writes. These logs never leave your computer. On a flat-rate plan (Claude Pro, Max or Team) you pay your plan price instead, so the figure shows the work's value at API rates.
-
-```
-python -m appledger path/to/your-app --ai-cost
-```
-
-Codex support follows Codex's documented log format and hasn't been tested against real Codex logs yet.
-
 ## Two ways to run
 
 | Mode | What you install | Where your code goes |
@@ -83,7 +73,7 @@ Version 0.2.0 (upload preview, consent, secret-file exclusion, scheduling) is be
 
 ## Company dashboard
 
-Create a free account at [appledger.net](https://appledger.net/app/signup.php) to keep every app your people check in one ledger: owner, grade, score trend, who may use it and the AI cost behind it. Create a connection key under "Connect a computer", then save it on each computer:
+Create a free account at [appledger.net](https://appledger.net/app/signup.php) to keep every app your people check in one ledger: owner, grade, score trend, who may use it and which AI tool built it. Create a connection key under "Connect a computer", then save it on each computer:
 
 ```
 python -m appledger --connect al_your_key
@@ -91,7 +81,7 @@ python -m appledger --connect al_your_key
 
 Or tell Claude: "Connect AppLedger with this key: al_…". The key is saved in `~/.appledger/key`; `APPLEDGER_KEY` overrides it and `--disconnect` removes it.
 
-From then on each check also saves a summary to your dashboard: the app's name, score, grade, problem counts, up to 3 titles of the most serious problems, the scanners used and the AI cost totals. Never the code.
+From then on each check also saves a summary to your dashboard: the app's name, score, grade, problem counts, the list of problems found (level and short title, up to 60; never code or file paths), and the scanners used. Never the code.
 
 You can also add an app in the web app with **Add app**: register it without code, or upload a zip to check it in the browser (the zip is scanned and deleted the same way).
 

{appledger-0.2.0 → appledger-0.2.2}/plugin/README.md

@@ -11,7 +11,7 @@ Full guide: https://appledger.net/docs/
 
 - "Is my app safe to share?"
 - "Add this app to AppLedger."
-- "How much did it cost to build this app with AI?"
+- "Check my app every week."
 
 ## Install
 
@@ -37,7 +37,7 @@ By default (hosted mode) **your project's source files are uploaded to the AppLe
 
 **You confirm first.** Before the first upload of a folder, your agent shows what would be sent (`preview_upload`) and asks you. If the code belongs to your employer or a client, make sure you're allowed to upload it, or use local mode.
 
-**Local mode** keeps the code on your computer: set `APPLEDGER_MODE=local` and install [Trivy](https://trivy.dev) and [Opengrep](https://github.com/opengrep/opengrep/releases). If the computer is connected to a dashboard, only a summary is saved there (app name, score, grade, problem counts, up to 3 top problem titles, scanners used, AI cost totals). Ask for "don't save to the dashboard" to skip even that.
+**Local mode** keeps the code on your computer: set `APPLEDGER_MODE=local` and install [Trivy](https://trivy.dev) and [Opengrep](https://github.com/opengrep/opengrep/releases). If the computer is connected to a dashboard, only a summary is saved there (app name, score, grade, problem counts, the list of problems found (level and short title, up to 60; never code or file paths), scanners used). Ask for "don't save to the dashboard" to skip even that.
 
 Results are written to a `.appledger/` folder inside your project, which is excluded from version control.
 
@@ -48,6 +48,6 @@ Results are written to a `.appledger/` folder inside your project, which is excl
 ## What's included
 
 - `check-my-app` skill: asks before uploading, runs the check, explains it, fixes problems with your permission and checks again
-- `appledger` MCP server with these tools: `preview_upload` (what would be sent, without sending), `check_app`, `get_fix_prompt`, `ai_cost` (AI tokens and cost behind the app, read from your Claude Code and Codex logs on this computer, never uploaded), `connect_dashboard`, `scanner_status`
+- `appledger` MCP server with these tools: `preview_upload` (what would be sent, without sending), `check_app`, `get_fix_prompt`, `connect_dashboard`, `scanner_status`
 
 More: https://appledger.net/

{appledger-0.2.0 → appledger-0.2.2}/pyproject.toml

@@ -1,44 +1,44 @@
-[build-system]
-requires = ["hatchling>=1.27"]
-build-backend = "hatchling.build"
-
-[project]
-name = "appledger"
-version = "0.2.0"
-description = "The ledger for the AI app explosion: honest security checks, in plain language, for apps your people build with AI."
-readme = "README.md"
-license = "MIT"
-license-files = ["LICENSE"]
-requires-python = ">=3.10"
-authors = [{ name = "Contenta Software" }]
-keywords = ["security", "mcp", "claude", "codex", "trivy", "opengrep", "vibe-coding", "governance"]
-classifiers = [
-    "Development Status :: 3 - Alpha",
-    "Intended Audience :: Developers",
-    "Intended Audience :: Information Technology",
-    "Operating System :: OS Independent",
-    "Programming Language :: Python :: 3",
-    "Topic :: Security",
-    "Topic :: Software Development :: Quality Assurance",
-]
-dependencies = [
-    "mcp>=1.20,<2",
-    "pyyaml>=6",
-    "packaging>=23",
-    "anyio>=4",
-]
-
-[project.urls]
-Homepage = "https://appledger.net/"
-Repository = "https://github.com/contentasoftware/appledger"
-Privacy = "https://appledger.net/privacy.html"
-
-[project.scripts]
-appledger = "appledger.scanner:main"
-appledger-mcp = "appledger.server:main"
-
-[tool.hatch.build.targets.wheel]
-packages = ["src/appledger"]
-
-[tool.hatch.build.targets.sdist]
-include = ["src/appledger", "README.md", "LICENSE", "pyproject.toml"]
+[build-system]
+requires = ["hatchling>=1.27"]
+build-backend = "hatchling.build"
+
+[project]
+name = "appledger"
+version = "0.2.2"
+description = "The ledger for the AI app explosion: honest security checks, in plain language, for apps your people build with AI."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+authors = [{ name = "Contenta Software" }]
+keywords = ["security", "mcp", "claude", "codex", "trivy", "opengrep", "vibe-coding", "governance"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Information Technology",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+]
+dependencies = [
+    "mcp>=1.20,<2",
+    "pyyaml>=6",
+    "packaging>=23",
+    "anyio>=4",
+]
+
+[project.urls]
+Homepage = "https://appledger.net/"
+Repository = "https://github.com/contentasoftware/appledger"
+Privacy = "https://appledger.net/privacy.html"
+
+[project.scripts]
+appledger = "appledger.scanner:main"
+appledger-mcp = "appledger.server:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/appledger"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/appledger", "README.md", "LICENSE", "pyproject.toml"]

{appledger-0.2.0 → appledger-0.2.2}/src/appledger/__init__.py

@@ -2,5 +2,5 @@
 
 from .scanner import ScanError, check, doctor
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 __all__ = ["ScanError", "check", "doctor", "__version__"]

{appledger-0.2.0 → appledger-0.2.2}/src/appledger/client.py

@@ -8,7 +8,8 @@ rest isn't. The upload goes over HTTPS, is scanned with Trivy and Opengrep, and
 the server right after.
 
 In local mode nothing is uploaded; with a connection key, record_check sends only a summary
-(name, score, problem counts and titles, AI cost) to the dashboard. Never the code.
+(name, score, problem counts, the problems' levels and titles) to the dashboard. Never the code
+or file paths.
 """
 
 import io
@@ -46,6 +47,8 @@ DATA_SUFFIXES = {
 VAULT_SUFFIXES = {".yml", ".yaml", ".txt", ".cfg", ".ini", ".conf", ".json", ""}
 DATA_FOLDER_WORDS = ("data", "dump", "export", "fixture", "sample", "traffic")
 MAX_DATA_JSON_BYTES = 100_000
+MAX_RECORDED_ISSUES = 60
+LEVEL_RANK = {"blocker": 0, "important": 1, "minor": 2}
 
 
 def looks_like_data(rel, size):
@@ -169,15 +172,6 @@ def forget_connection_key():
     KEY_FILE.unlink(missing_ok=True)
 
 
-def ai_fields(usage):
-    """The AI effort totals that go to the dashboard (never the logs themselves)."""
-    tools = [t["tool"] for t in (usage or {}).get("tools", []) if t.get("this_folder")]
-    spent = bool(usage and usage.get("tokens_total"))
-    return {"ai_tool": ", ".join(tools) or None,
-            "ai_tokens": usage["tokens_total"] if spent else None,
-            "ai_cost_usd": usage["cost_usd"] if spent else None}
-
-
 def clean_name(app_name, app_dir):
     return " ".join((app_name or Path(app_dir).name).split())
 
@@ -198,11 +192,11 @@ def error_message(e):
         return ""
 
 
-def hosted_scan(app_dir, app_name=None, usage=None, plan=None, save_to_dashboard=True, local_findings=None):
+def hosted_scan(app_dir, app_name=None, plan=None, save_to_dashboard=True, local_findings=None):
     """Returns (findings, scanner names, ledger) from the AppLedger service.
 
     Sends only the files in upload_plan (pass plan to reuse one already shown to the user). With
-    a connection key and save_to_dashboard, the app's name, score and AI cost totals are also
+    a connection key and save_to_dashboard, the app's name and score are also
     saved to the organisation's dashboard, and ledger says where. Otherwise ledger is None and
     the key isn't sent. local_findings (found on this computer, such as committed secrets files)
     are sent as level and title only, so the dashboard's score matches the local report.
@@ -210,9 +204,9 @@ def hosted_scan(app_dir, app_name=None, usage=None, plan=None, save_to_dashboard
     data, count, skipped = build_zip(app_dir, plan)
     boundary = uuid.uuid4().hex
     key = connection_key() if save_to_dashboard else None
-    fields = {"app_name": clean_name(app_name, app_dir), **ai_fields(usage)} if key else {}
+    fields = {"app_name": clean_name(app_name, app_dir)} if key else {}
     if key and local_findings:
-        fields["local_findings"] = json.dumps([{"level": f["level"], "title": f["title"]} for f in local_findings][:20])
+        fields["local_findings"] = json.dumps([{"level": f["level"], "title": summary_title(f)} for f in local_findings][:20])
     headers = {
         "Content-Type": f"multipart/form-data; boundary={boundary}",
         "Accept": "application/json",
@@ -235,10 +229,31 @@ def hosted_scan(app_dir, app_name=None, usage=None, plan=None, save_to_dashboard
     return result["findings"], result["scanners"], result.get("ledger")
 
 
-def record_payload(summary, counts, usage=None):
-    """The summary a local check sends to the dashboard: no code, no file contents, no logs.
+def summary_title(finding, limit=200):
+    """A problem's title for the dashboard: one line, without the file path some titles name in brackets."""
+    title = finding.get("title") or ""
+    where = (finding.get("where") or "").split(":")[0]
+    if where:
+        title = title.replace(f" ({where})", "")
+    return " ".join(title.split())[:limit]
+
+
+def summary_issues(findings, limit=MAX_RECORDED_ISSUES):
+    """The problems a dashboard summary lists, most serious first: level, title and topic only."""
+    issues = []
+    for f in sorted(findings, key=lambda f: LEVEL_RANK.get(f.get("level"), 9)):
+        title = summary_title(f)
+        if f.get("level") in LEVEL_RANK and title:
+            topic = " ".join(str(f.get("topic") or "").split())[:120] or None
+            issues.append({"level": f["level"], "title": title, "topic": topic})
+    return issues[:limit]
+
+
+def record_payload(summary, counts):
+    """The summary a local check sends to the dashboard: no code, no file contents or paths.
 
-    counts uses the plain level keys (blocker, important, minor).
+    counts uses the plain level keys (blocker, important, minor). issues lists up to 60 problems
+    (level, title, topic), most serious first.
     """
     return {
         "app_name": clean_name(summary["app"], summary["app"]),
@@ -246,8 +261,8 @@ def record_payload(summary, counts, usage=None):
         "grade": summary["grade"],
         "scanners": list(summary["scanners"]),
         "counts": {lvl: int(counts.get(lvl, 0)) for lvl in ("blocker", "important", "minor")},
-        "top_issues": [f["title"] for f in summary["findings"] if f["level"] == "blocker"][:3],
-        **ai_fields(usage),
+        "top_issues": [summary_title(f, 160) for f in summary["findings"] if f["level"] == "blocker"][:3],
+        "issues": summary_issues(summary["findings"]),
         "client_version": __version__,
     }
 

{appledger-0.2.0 → appledger-0.2.2}/src/appledger/scanner.py

@@ -224,19 +224,30 @@ def safest_fix(fixed_versions):
         return str(per_vuln[-1])
 
 
+def scanner_failed(name, stderr):
+    """On the hosted service, log the scanner's error and give the user a plain message without server
+    details; on the user's own computer, show the error so they can fix their setup."""
+    if os.environ.get("APPLEDGER_TRIVY_OFFLINE"):
+        print(f"{name} failed: {stderr.strip()[-1500:]}", file=sys.stderr)
+        return f"{name} couldn't check this project. Please try again later."
+    return f"{name} failed:\n" + stderr.strip()[-1500:]
+
+
 def run_trivy(app_dir):
     trivy = find_tool("APPLEDGER_TRIVY", ["trivy", "trivy.exe"])
     if not trivy:
         raise ScanError("Trivy is not installed. Install it from https://trivy.dev "
                         "(Windows: winget install AquaSecurity.Trivy, Mac: brew install trivy).")
     skip = [arg for d in sorted(SKIP_DIRS) for arg in ("--skip-dirs", d)]
+    offline = ["--skip-db-update", "--skip-java-db-update", "--offline-scan"] \
+        if os.environ.get("APPLEDGER_TRIVY_OFFLINE") else []
     proc = subprocess.run(
-        [trivy, "fs", "--quiet", "--scanners", "vuln,secret,misconfig", *skip,
+        [trivy, "fs", "--quiet", "--scanners", "vuln,secret,misconfig", *skip, *offline,
          "--format", "json", str(app_dir)],
         capture_output=True, text=True, encoding="utf-8", stdin=subprocess.DEVNULL,
     )
     if proc.returncode != 0:
-        raise ScanError("Trivy failed:\n" + proc.stderr.strip()[-1500:])
+        raise ScanError(scanner_failed("Trivy", proc.stderr))
     return json.loads(proc.stdout)
 
 
@@ -443,7 +454,7 @@ def run_opengrep(app_dir):
                            "--json", "--quiet", str(app_dir)],
                           capture_output=True, text=True, encoding="utf-8", stdin=subprocess.DEVNULL)
     if not proc.stdout.strip():
-        raise ScanError("Opengrep failed:\n" + proc.stderr.strip()[-1500:])
+        raise ScanError(scanner_failed("Opengrep", proc.stderr))
     data = json.loads(proc.stdout)
     for err in data.get("errors", []):
         print("Opengrep warning:", err.get("message", "")[:200], file=sys.stderr)
@@ -636,36 +647,7 @@ def write_fix_prompt(findings, app_name, scanners, path):
     Path(path).write_text("\n".join(lines) + "\n", encoding="utf-8")
 
 
-def usage_section(usage):
-    """HTML for the 'AI effort' part of the report, or '' when no agent logs were found."""
-    if not usage:
-        return ""
-    e = html.escape
-    rows = []
-    for tool in usage["tools"]:
-        here = tool["this_folder"]
-        if not here:
-            continue
-        for model, v in here["by_model"].items():
-            cost = f"${v['cost_usd']:,.2f}" if v.get("cost_usd") else "not priced"
-            rows.append(f"<tr><td>{e(tool['tool'])}</td><td>{e(model)}</td><td>{v['messages']:,}</td>"
-                        f"<td>{v['input'] + v['cache_write'] + v['cache_read'] + v['output']:,}</td><td>{cost}</td></tr>")
-    parent = [t["parent_folders"] for t in usage["tools"] if t.get("parent_folders")]
-    parent_note = (f"<p class=\"tech\">Another {sum(p['tokens_total'] for p in parent):,} tokens "
-                   f"(${sum(p['cost_usd'] for p in parent):,.2f}) were used in sessions started in a parent folder; "
-                   "they may include other work, so they're not counted above.</p>") if parent else ""
-    return f"""
-  <section class="usage">
-    <h2>AI effort that went into this app</h2>
-    <p><strong>{usage['tokens_total']:,} tokens</strong> over {usage['sessions']} session{'s' if usage['sessions'] != 1 else ''},
-       worth about <strong>${usage['cost_usd']:,.2f}</strong> at API list prices.</p>
-    <table><thead><tr><th>Tool</th><th>Model</th><th>Replies</th><th>Tokens</th><th>Est. cost</th></tr></thead>
-      <tbody>{''.join(rows)}</tbody></table>
-    <p class="tech">{e(usage['note'])} Prices: {e(usage['prices'])}.</p>{parent_note}
-  </section>"""
-
-
-def write_report(findings, app_name, scanners, path, usage=None):
+def write_report(findings, app_name, scanners, path):
     e = html.escape
     score = health_score(findings)
     grade = "A" if score >= 90 else "B" if score >= 75 else "C" if score >= 55 else "D" if score >= 30 else "F"
@@ -718,10 +700,6 @@ h1,h2,h3 {{ margin:0; line-height:1.2 }} p {{ margin:0 }}
 button {{ font:inherit; padding:8px 14px; border-radius:6px; border:1px solid var(--line); background:var(--surface); color:var(--ink); cursor:pointer }}
 button:focus-visible {{ outline:2px solid var(--accent); outline-offset:2px }}
 .fixbox {{ background:var(--surface); border:1px dashed var(--accent); border-radius:10px; padding:18px; display:flex; flex-direction:column; gap:10px }}
-.usage {{ background:var(--surface); border:1px solid var(--line); border-radius:10px; padding:18px; display:flex; flex-direction:column; gap:10px; overflow-x:auto }}
-.usage table {{ border-collapse:collapse; width:100%; min-width:460px; font-size:14px; font-variant-numeric:tabular-nums }}
-.usage th, .usage td {{ text-align:left; padding:6px 8px; border-bottom:1px solid var(--line) }}
-.usage th {{ font:600 11px/1 ui-monospace,Consolas,monospace; text-transform:uppercase; letter-spacing:.06em; color:var(--muted) }}
 @media (max-width:620px) {{ .summary {{ grid-template-columns:1fr }} .tiers li {{ grid-template-columns:1fr; gap:2px }} }}
 </style></head>
 <body><main>
@@ -737,7 +715,7 @@ button:focus-visible {{ outline:2px solid var(--accent); outline-offset:2px }}
         <span class="pill minor">{counts['minor']} good to know</span>
       </div></div>
   </section>
-  <section><h2 style="margin-bottom:12px">Who can use it right now</h2><ul class="tiers">{tiers}</ul></section>{usage_section(usage)}
+  <section><h2 style="margin-bottom:12px">Who can use it right now</h2><ul class="tiers">{tiers}</ul></section>
   <section class="fixbox">
     <h2>Fix it for me</h2>
     <p>AppLedger wrote a fix request for the coding agent that built this app (Claude Code, Cursor, Codex…). Open <code>fix-prompt.md</code>, paste it into the agent, then run the check again.</p>
@@ -771,15 +749,6 @@ def doctor():
     }
 
 
-def ai_usage_for(app_dir):
-    """Token use and cost from local agent logs; never lets a log problem break the check."""
-    from .usage import estimate_usage
-    try:
-        return estimate_usage(app_dir)
-    except (OSError, ValueError, KeyError, TypeError):
-        return None
-
-
 def grade_for(score):
     return "A" if score >= 90 else "B" if score >= 75 else "C" if score >= 55 else "D" if score >= 30 else "F"
 
@@ -839,11 +808,10 @@ def check(app_dir, out_dir=None, app_name=None, sonar_dir=None, code_scan=True,
 
     out = Path(out_dir) if out_dir else app_dir / OUTPUT_DIR_NAME
     out.mkdir(parents=True, exist_ok=True)
-    usage = ai_usage_for(app_dir)
     ledger = None
     local_findings = findings_for_secret_files(plan["secret_files_not_ignored"])
     if hosted:
-        findings, scanners, ledger = hosted_scan(app_dir, app_name, usage, plan, save_to_dashboard, local_findings)
+        findings, scanners, ledger = hosted_scan(app_dir, app_name, plan, save_to_dashboard, local_findings)
     else:
         findings, scanners = scan(app_dir, sonar_dir, code_scan)
     findings = dedupe(findings + local_findings)
@@ -853,7 +821,7 @@ def check(app_dir, out_dir=None, app_name=None, sonar_dir=None, code_scan=True,
     if not hosted and save_to_dashboard and connection_key():
         # Local mode sends no code: only the summary below, so the dashboard still shows the app.
         ledger = record_check(record_payload({"app": app_name, "score": score, "grade": grade_for(score),
-                                              "scanners": scanners, "findings": findings}, counts, usage))
+                                              "scanners": scanners, "findings": findings}, counts))
     summary = {
         "app": app_name, "score": score, "grade": grade_for(score), "scanners": scanners,
         "counts": {LEVELS[k]["label"]: v for k, v in counts.items()},
@@ -862,12 +830,11 @@ def check(app_dir, out_dir=None, app_name=None, sonar_dir=None, code_scan=True,
         "findings": findings,
         "report": str(out / "report.html"), "fix_prompt": str(out / "fix-prompt.md"),
         "checked_at": datetime.now().isoformat(timespec="seconds"),
-        "ai_usage": usage,
         "ledger": ledger,
     }
     (out / "findings.json").write_text(json.dumps(summary, indent=2), encoding="utf-8")
     write_fix_prompt(findings, app_name, scanners, out / "fix-prompt.md")
-    write_report(findings, app_name, scanners, out / "report.html", summary["ai_usage"])
+    write_report(findings, app_name, scanners, out / "report.html")
     (out / ".gitignore").write_text("*\n", encoding="utf-8")  # keep reports out of version control
     return summary
 
@@ -927,8 +894,6 @@ def main():
     ap.add_argument("--sonar-dir", help="folder with sonar-issues.json and sonar-hotspots.json")
     ap.add_argument("--no-code-scan", action="store_true", help="skip the Opengrep code scan")
     ap.add_argument("--doctor", action="store_true", help="show which scanners are available")
-    ap.add_argument("--ai-cost", action="store_true",
-                    help="only show how many AI tokens, and what they'd cost, went into this folder")
     ap.add_argument("--local", action="store_true",
                     help="run Trivy and Opengrep on this machine instead of the AppLedger service")
     ap.add_argument("--yes", action="store_true",
@@ -960,18 +925,6 @@ def main():
         print(f"Connected. Key saved in {where}. Every check from this computer now appears in {DASHBOARD_URL}")
         return
 
-    if args.ai_cost:
-        usage = ai_usage_for(Path(args.app_dir).resolve())
-        if not usage:
-            print("No Claude Code or Codex logs on this computer mention this folder.")
-            return
-        print(f"{usage['tokens_total']:,} tokens over {usage['sessions']} sessions, "
-              f"about ${usage['cost_usd']:,.2f} at API list prices.")
-        for tool in usage["tools"]:
-            for model, v in (tool["this_folder"] or {}).get("by_model", {}).items():
-                print(f"  {tool['tool']:12} {model:22} {v['messages']:>6,} replies  ${v.get('cost_usd', 0):>9,.2f}")
-        print(usage["note"])
-        return
     if args.doctor:
         for tool, where in doctor().items():
             print(f"{tool:15} {where or 'not found'}")

{appledger-0.2.0 → appledger-0.2.2}/src/appledger/server.py

@@ -5,8 +5,8 @@ commit, never secrets files) and sends them to the hosted AppLedger scanning ser
 scanners need to be installed. The first check of a folder needs the user's go-ahead: check_app
 returns needs_confirmation with a preview until it's called with confirm_upload=True.
 Set APPLEDGER_MODE=local to run Trivy and Opengrep on this machine instead, in which case no
-code leaves the computer. Tools: check_app, preview_upload, get_fix_prompt, ai_cost,
-connect_dashboard and scanner_status.
+code leaves the computer. Tools: check_app, preview_upload, get_fix_prompt, connect_dashboard
+and scanner_status.
 """
 
 import json
@@ -108,7 +108,6 @@ async def check_app(path: str, app_name: str | None = None, confirm_upload: bool
         "findings": [{k: f[k] for k in keep} for f in result["findings"]],
         "report": result["report"], "fix_prompt": result["fix_prompt"],
         "checked_by": "AppLedger scanning service" if hosted() else "scanners on this computer",
-        "ai_effort": short_usage(result.get("ai_usage")),
         "dashboard": dashboard,
     }
 
@@ -140,32 +139,6 @@ def preview_upload(path: str) -> dict:
     }
 
 
-def short_usage(usage):
-    if not usage:
-        return None
-    return {"tokens": usage["tokens_total"], "sessions": usage["sessions"],
-            "estimated_cost_usd": usage["cost_usd"], "note": usage["note"]}
-
-
-@mcp.tool(annotations=ToolAnnotations(title="Estimate the AI tokens and cost behind an app", readOnlyHint=True, destructiveHint=False,
-                                      openWorldHint=False))
-def ai_cost(path: str) -> dict:
-    """Estimate how many AI tokens went into building an app, and what they would cost at API list prices.
-
-    Reads Claude Code and Codex session logs on this computer for sessions run in that folder; nothing is
-    uploaded. Returns totals plus a breakdown per tool and model. People on flat-rate plans (Claude Pro,
-    Max, Team) pay their plan price instead, so present the figure as the work's value at API rates.
-
-    Args:
-        path: absolute path to the app's folder.
-    """
-    from .scanner import ai_usage_for
-    usage = ai_usage_for(Path(path).resolve())
-    if not usage:
-        return {"found": False, "message": "No Claude Code or Codex logs on this computer mention this folder."}
-    return {"found": True, **usage}
-
-
 @mcp.tool(annotations=ToolAnnotations(title="Get the fix request for an app", readOnlyHint=True, destructiveHint=False,
                                       openWorldHint=False))
 def get_fix_prompt(path: str) -> str:

appledger-0.2.0/src/appledger/usage.py

@@ -1,219 +0,0 @@
-"""Estimate how many AI tokens, and what they would cost, went into building a project.
-
-Reads the coding agents' own logs on this computer, so the numbers are measured, not guessed:
-
-    Claude Code   ~/.claude/projects/<folder>/*.jsonl   (CLAUDE_CONFIG_DIR overrides ~/.claude)
-    Codex         ~/.codex/sessions/**/*.jsonl          (CODEX_HOME overrides ~/.codex)
-
-Costs use Anthropic's API list prices. People on a flat-rate plan (Claude Pro/Max/Team) pay
-their plan price instead, so the figure shows the work's value at API rates, not their bill.
-Nothing here is sent anywhere.
-"""
-
-import json
-import os
-import re
-from collections import defaultdict
-from pathlib import Path
-
-PRICES_SOURCE = "https://platform.claude.com/docs/en/about-claude/pricing (checked 2026-10-12)"
-
-# USD per million tokens: input, 5-minute cache write, 1-hour cache write, cache read, output.
-CLAUDE_PRICES = {
-    "claude-fable-5-1": (10, 12.5, 20, 0.25, 50),
-    "claude-mythos-5-1": (10, 12.5, 20, 0.25, 50),
-    "claude-fable-5": (10, 12.5, 20, 1, 50),
-    "claude-mythos-5": (10, 12.5, 20, 1, 50),
-    "claude-opus-5-5": (4, 5, 8, 0.20, 20),
-    "claude-opus-5": (5, 6.25, 10, 0.50, 25),
-    "claude-opus-4-8": (5, 6.25, 10, 0.50, 25),
-    "claude-opus-4-7": (5, 6.25, 10, 0.50, 25),
-    "claude-opus-4-6": (5, 6.25, 10, 0.50, 25),
-    "claude-opus-4-5": (5, 6.25, 10, 0.50, 25),
-    "claude-opus-4-1": (15, 18.75, 30, 1.50, 75),
-    "claude-opus-4": (15, 18.75, 30, 1.50, 75),
-    "claude-sonnet-5-5": (2, 2.5, 4, 0.10, 10),
-    "claude-sonnet-5": (2, 2.5, 4, 0.20, 10),
-    "claude-sonnet-4-6": (3, 3.75, 6, 0.30, 15),
-    "claude-sonnet-4-5": (3, 3.75, 6, 0.30, 15),
-    "claude-sonnet-4": (3, 3.75, 6, 0.30, 15),
-    "claude-haiku-5-5": (0.10, 0.125, 0.20, 0.01, 0.50),
-    "claude-haiku-4-5": (1, 1.25, 2, 0.10, 5),
-    "claude-3-5-haiku": (0.80, 1, 1.60, 0.08, 4),
-}
-HAIKU_5_5_LONG = (0.50, 0.625, 1, 0.05, 2.50)  # prompts over 100,000 tokens
-FAST_MODE_FACTOR = 2.0   # fast mode on Opus 5.5 / 5 / 4.8 is billed at 2x the standard rates
-US_ONLY_FACTOR = 1.1     # inference_geo "us" on Claude 4.6 and later
-
-
-def claude_home():
-    return Path(os.environ.get("CLAUDE_CONFIG_DIR", Path.home() / ".claude"))
-
-
-def codex_home():
-    return Path(os.environ.get("CODEX_HOME", Path.home() / ".codex"))
-
-
-def price_key(model):
-    """Map a logged model name (dated, prefixed or regional) to a price table key."""
-    name = (model or "").lower().split("/")[-1]
-    name = re.sub(r"^(?:[a-z]{2,4}\.)?anthropic\.", "", name)          # Bedrock prefixes
-    name = re.sub(r"-v\d+(?::\d+)?$", "", name)                       # Bedrock "-v1:0"
-    name = re.sub(r"[-@]\d{8}$", "", name)                              # snapshot dates
-    for key in sorted(CLAUDE_PRICES, key=len, reverse=True):
-        if name == key or name.startswith(key + "-") or name.startswith(key + "@"):
-            return key
-    return None
-
-
-def message_cost(model, usage):
-    key = price_key(model)
-    if not key:
-        return None
-    cache_5m, cache_1h = cache_writes(usage)
-    inp, cread, out = usage.get("input_tokens", 0), usage.get("cache_read_input_tokens", 0), usage.get("output_tokens", 0)
-    rates = CLAUDE_PRICES[key]
-    if key == "claude-haiku-5-5" and inp + cread + cache_5m + cache_1h > 100_000:
-        rates = HAIKU_5_5_LONG
-    cost = (inp * rates[0] + cache_5m * rates[1] + cache_1h * rates[2] + cread * rates[3] + out * rates[4]) / 1e6
-    if usage.get("speed") == "fast":
-        cost *= FAST_MODE_FACTOR
-    if usage.get("inference_geo") == "us":
-        cost *= US_ONLY_FACTOR
-    return cost
-
-
-def cache_writes(usage):
-    detail = usage.get("cache_creation") or {}
-    if detail:
-        return detail.get("ephemeral_5m_input_tokens", 0), detail.get("ephemeral_1h_input_tokens", 0)
-    return usage.get("cache_creation_input_tokens", 0), 0
-
-
-def same_or_inside(child, parent):
-    child, parent = os.path.normcase(os.path.abspath(child)), os.path.normcase(os.path.abspath(parent))
-    return child == parent or child.startswith(parent.rstrip("\\/") + os.sep)
-
-
-def claude_code_usage(app_dir):
-    """Token use from Claude Code sessions run inside app_dir (and, separately, in its parent folders)."""
-    root = claude_home() / "projects"
-    if not root.is_dir():
-        return None
-    encoded = re.sub(r"[^A-Za-z0-9]", "-", os.path.abspath(app_dir))
-    candidates = [d for d in root.iterdir() if d.is_dir() and (
-        d.name.lower().startswith(encoded.lower()) or encoded.lower().startswith(d.name.lower() + "-"))]
-    messages = {}  # message id -> (model, usage, cwd, session, timestamp); streaming repeats each message
-    for folder in candidates:
-        for log in folder.rglob("*.jsonl"):
-            with open(log, encoding="utf-8", errors="replace") as fh:
-                for line in fh:
-                    if '"usage"' not in line:
-                        continue
-                    try:
-                        entry = json.loads(line)
-                    except ValueError:
-                        continue
-                    msg = entry.get("message")
-                    if entry.get("type") != "assistant" or not isinstance(msg, dict) or not msg.get("usage"):
-                        continue
-                    key = msg.get("id") or f"{log.name}:{entry.get('uuid')}"
-                    previous = messages.get(key)
-                    if previous and previous[1].get("output_tokens", 0) >= msg["usage"].get("output_tokens", 0):
-                        continue
-                    messages[key] = (msg.get("model"), msg["usage"], entry.get("cwd") or "",
-                                     entry.get("sessionId") or log.stem, entry.get("timestamp") or "")
-    inside, parent = new_totals(), new_totals()
-    for model, usage, cwd, session, ts in messages.values():
-        if model == "<synthetic>":
-            continue
-        bucket = inside if cwd and same_or_inside(cwd, app_dir) else parent if cwd and same_or_inside(app_dir, cwd) else None
-        if bucket is not None:
-            add(bucket, model, usage, session, ts)
-    return {"tool": "Claude Code", "this_folder": finish(inside), "parent_folders": finish(parent)}
-
-
-def codex_usage(app_dir):
-    """Token use from Codex sessions run inside app_dir. Codex logs running totals per session."""
-    root = codex_home() / "sessions"
-    if not root.is_dir():
-        return None
-    totals = new_totals()
-    for log in root.rglob("*.jsonl"):
-        cwd, model, last, ts = "", "", None, ""
-        with open(log, encoding="utf-8", errors="replace") as fh:
-            for line in fh:
-                try:
-                    entry = json.loads(line)
-                except ValueError:
-                    continue
-                payload = entry.get("payload") or {}
-                if entry.get("type") in ("session_meta", "turn_context"):
-                    cwd = payload.get("cwd") or cwd
-                    model = payload.get("model") or model
-                elif entry.get("type") == "event_msg" and payload.get("type") == "token_count":
-                    last = (payload.get("info") or {}).get("total_token_usage") or last
-                ts = entry.get("timestamp") or ts
-        if cwd and last and same_or_inside(cwd, app_dir):
-            usage = {"input_tokens": last.get("input_tokens", 0) - last.get("cached_input_tokens", 0),
-                     "cache_read_input_tokens": last.get("cached_input_tokens", 0),
-                     "output_tokens": last.get("output_tokens", 0)}
-            add(totals, model or "unknown", usage, log.stem, ts)
-    return {"tool": "Codex", "this_folder": finish(totals), "parent_folders": None}
-
-
-def new_totals():
-    return {"by_model": defaultdict(lambda: defaultdict(float)), "sessions": set(), "first": "", "last": ""}
-
-
-def add(totals, model, usage, session, ts):
-    m = totals["by_model"][model]
-    cache_5m, cache_1h = cache_writes(usage)
-    m["input"] += usage.get("input_tokens", 0)
-    m["cache_write"] += cache_5m + cache_1h
-    m["cache_read"] += usage.get("cache_read_input_tokens", 0)
-    m["output"] += usage.get("output_tokens", 0)
-    m["messages"] += 1
-    cost = message_cost(model, usage)
-    if cost is None:
-        m["unpriced"] += 1
-    else:
-        m["cost_usd"] += cost
-    totals["sessions"].add(session)
-    if ts:
-        totals["first"] = min(totals["first"] or ts, ts)
-        totals["last"] = max(totals["last"], ts)
-
-
-def finish(totals):
-    if not totals["by_model"]:
-        return None
-    by_model = {model: {k: round(v, 4) if k == "cost_usd" else int(v) for k, v in vals.items()}
-                for model, vals in totals["by_model"].items()}
-    tokens = sum(v["input"] + v["cache_write"] + v["cache_read"] + v["output"] for v in by_model.values())
-    return {
-        "sessions": len(totals["sessions"]), "first": totals["first"][:10], "last": totals["last"][:10],
-        "tokens_total": tokens,
-        "output_tokens": sum(v["output"] for v in by_model.values()),
-        "cost_usd": round(sum(v.get("cost_usd", 0) for v in by_model.values()), 2),
-        "unpriced_messages": sum(v.get("unpriced", 0) for v in by_model.values()),
-        "by_model": by_model,
-    }
-
-
-def estimate_usage(app_dir):
-    """Combine every agent log found for app_dir. Returns None when no logs mention this folder."""
-    found = [r for r in (claude_code_usage(app_dir), codex_usage(app_dir))
-             if r and (r["this_folder"] or r.get("parent_folders"))]
-    if not found:
-        return None
-    here = [r["this_folder"] for r in found if r["this_folder"]]
-    return {
-        "tools": found,
-        "tokens_total": sum(h["tokens_total"] for h in here),
-        "cost_usd": round(sum(h["cost_usd"] for h in here), 2),
-        "sessions": sum(h["sessions"] for h in here),
-        "prices": PRICES_SOURCE,
-        "note": ("Measured from the coding agents' logs on this computer and priced at API list prices. "
-                 "On a flat-rate plan (Claude Pro, Max or Team) you pay your plan price instead."),
-    }