@agent-finops/core 0.9.5 → 0.9.7

package/dist/deadContext.js

@@ -1,4 +1,5 @@
 import { loadAgentInventory } from "./agentInventory.js";
+import { safeUntrustedLabel, WITHHELD_ENTITY_LABEL, WITHHELD_FILE_LABEL } from "./untrustedLabel.js";
 import { findPricingRule } from "./modelPricing.js";
 import { loadToolInvocations } from "./toolInvocations.js";
 /**
@@ -97,15 +98,21 @@ export function computeDeadContext(items, invocations, config) {
         }
         dead.push({
             kind: item.kind,
-            name: item.name,
+            // Skill, subagent, slash-command, hook and MCP SERVER names, read off
+            // disk. They are printed by name on the readout and in the artifact.
+            name: safeUntrustedLabel(item.name, WITHHELD_ENTITY_LABEL),
             scope: item.scope,
             activation: item.activation,
+            // The STRUCTURED siblings travel with the name to every surface the name
+            // does, including the Apply artifact. Neutralizing the name and leaving
+            // the path beside it raw is the same inversion Blocker A was.
+            // `host` is the InventoryHost enum, not free text — bounded by the type.
             host: item.host,
             invocationTracking: item.invocationTracking,
             alwaysLoadedTokens: item.alwaysLoadedTokens,
             weightConfidence: item.weightConfidence,
-            path: item.path,
-            ownerDirs: item.ownerDirs
+            path: item.path === undefined ? undefined : safeUntrustedLabel(item.path, WITHHELD_FILE_LABEL),
+            ownerDirs: item.ownerDirs?.map((dir) => safeUntrustedLabel(dir, WITHHELD_FILE_LABEL))
         });
     }
     dead.sort((a, b) => b.alwaysLoadedTokens - a.alwaysLoadedTokens);

package/dist/glance.js

@@ -1,5 +1,5 @@
 import { dedupeCumulativeSessionCalls, sanitizeLocalActivityText } from "./localAgentLogs.js";
-import { canPriceTokenUsageAtScope, estimateTokenCostUsd, PRICING_TABLE_AS_OF } from "./modelPricing.js";
+import { canPriceTokenUsageAtScope, estimateTokenCostsUsd, PRICING_TABLE_AS_OF } from "./modelPricing.js";
 import { subscriptionPlans } from "./planMath.js";
 import { buildContextHealth } from "./contextHealth.js";
 import { localAgentFormatDescriptors, localAgentFormatSupports } from "./localAgentFormats/registry.js";
@@ -106,7 +106,7 @@ export function buildUsageGlance(calls, options = {}) {
         "Claude Code transcripts do not report plan headroom. Missing limits remain unavailable instead of being inferred.",
         "Cursor and GitHub Copilot require their provider connections because their local chat stores are not treated as authoritative billing transcripts.",
         ...(qualitativeComplete ? [] : [
-            "Main focus, anomaly, and context-change handoff are unavailable because the bounded qualitative index is incomplete; no global driver was inferred from a selected subset."
+            "Main focus, anomaly, and context-change handoff are unavailable because some session transcripts have not been read yet; no global driver was inferred from a partly-read subset."
         ])
     ];
     return {
@@ -202,10 +202,10 @@ function buildCoverageLimitedPrimaryAction(input) {
         kind: "session_handoff",
         intent: "inspect_current_work",
         label: project ? `Refresh evidence · ${project}` : "Refresh evidence",
-        detail: `Main focus unavailable · qualitative index ${status}`,
+        detail: `Main focus unavailable · session transcripts ${status === "partial" ? "only partly read" : "not available"}`,
         ...(project ? { project } : {}),
         agentPrompt: [
-            "aibill's bounded qualitative evidence is incomplete.",
+            "Some coding-agent session transcripts have not been read yet.",
             "Do not infer a global main focus, waste cause, or context change from the selected subset.",
             `Run \`${aibillImproveCommandV0()}\` from the exact project root to refresh the private index, then review the new evidence before editing.`
         ].join("\n"),
@@ -793,9 +793,13 @@ function limitActionName(limit) {
 function callCost(call) {
     if (call.usageSupport === "unsupported_token_shape")
         return undefined;
-    if (!canPriceTokenUsageAtScope(call.model, call.usage, call.usageScope === "turn" ? "request" : "aggregate"))
+    if (!canPriceTokenUsageAtScope(call.model, call.usage, call.usageScope === "turn" ? "request" : "aggregate", call.maxRequestPromptTokens))
         return undefined;
-    return estimateTokenCostUsd(call.model, call.usage);
+    // Tier must come from the largest single request, exactly as the report's
+    // aggregation does — otherwise the statusline and the receipt disagree on
+    // the same session (a cache-heavy Codex session voided here while the
+    // receipt prices it, or priced here at 2x).
+    return estimateTokenCostsUsd(call.model, [call.usage], [call.maxRequestPromptTokens]);
 }
 function inputSideTokens(call) {
     return call.usage.inputTokens +

package/dist/insights.js

@@ -1,4 +1,5 @@
 import { hasCallLevelProvenance, hasPricedEvidence, spendComparisonKey, spendInsightSchema } from "./schema.js";
+import { safeUntrustedLabel, safeUntrustedLabels, WITHHELD_ENTITY_LABEL, WITHHELD_OPERATION_LABEL } from "./untrustedLabel.js";
 const confidenceRank = {
     verified: 0,
     estimated: 1,
@@ -32,7 +33,10 @@ function spikeInsights(records, summary) {
         const topProject = topBreakdown(currentRecords, (record) => record.projectId);
         const topModels = breakdown(currentRecords, (record) => record.model).slice(0, 2).map((entry) => entry.key);
         const deltaUsd = roundMoney(anomaly.currentAmountUsd - anomaly.previousAmountUsd);
-        const likelyOwner = topAgent?.key ?? topProject?.key ?? topClient?.key ?? "an unassigned owner";
+        // Ownership lead is an agent/project/client id off the records — it lands
+        // mid-sentence in `summary`, so it is neutralized at the interpolation
+        // point like every other untrusted fragment.
+        const likelyOwner = safeEntity(topAgent?.key ?? topProject?.key ?? topClient?.key ?? "an unassigned owner");
         const cohortSuffix = stableSuffix(anomaly.comparisonKey ?? "legacy");
         const isProviderBilledCost = currentRecords.length > 0 && currentRecords.every((record) => record.usageGranularity === "billing_bucket" &&
             record.costConfidence === "verified");
@@ -50,14 +54,14 @@ function spikeInsights(records, summary) {
                 { label: `Previous cohort ${isProviderBilledCost ? "spend" : "value"}`, value: formatUsd(anomaly.previousAmountUsd) },
                 { label: `Current cohort ${isProviderBilledCost ? "spend" : "value"}`, value: formatUsd(anomaly.currentAmountUsd) },
                 { label: `${evidenceLabel} increase`, value: formatUsd(deltaUsd), detail: `${formatMultiplier(anomaly.multiplier)} day-over-day multiplier` },
-                topAgent ? { label: "Ownership lead", value: topAgent.key, detail: `${formatUsd(topAgent.amountUsd)} across ${topAgent.recordCount} cohort records` } : undefined,
-                topClient ? { label: "Client concentration", value: topClient.key, detail: `${formatUsd(topClient.amountUsd)} on spike day` } : undefined,
-                topModels.length > 0 ? { label: "Dominant models", value: topModels.join(", ") } : undefined
+                topAgent ? { label: "Ownership lead", value: safeEntity(topAgent.key), detail: `${formatUsd(topAgent.amountUsd)} across ${topAgent.recordCount} cohort records` } : undefined,
+                topClient ? { label: "Client concentration", value: safeEntity(topClient.key), detail: `${formatUsd(topClient.amountUsd)} on spike day` } : undefined,
+                topModels.length > 0 ? { label: "Dominant models", value: safeUntrustedLabels(topModels).join(", ") } : undefined
             ]),
-            affectedClients: keysFrom(currentRecords, (record) => record.clientId),
-            affectedProjects: keysFrom(currentRecords, (record) => record.projectId),
-            affectedAgents: keysFrom(currentRecords, (record) => record.agentId),
-            affectedModels: keysFrom(currentRecords, (record) => record.model),
+            affectedClients: safeUntrustedLabels(keysFrom(currentRecords, (record) => record.clientId)),
+            affectedProjects: safeUntrustedLabels(keysFrom(currentRecords, (record) => record.projectId)),
+            affectedAgents: safeUntrustedLabels(keysFrom(currentRecords, (record) => record.agentId)),
+            affectedModels: safeUntrustedLabels(keysFrom(currentRecords, (record) => record.model)),
             estimatedImpactUsd: deltaUsd,
             confidence: anomaly.confidence,
             recommendedAction: `Review and reconcile the provider-cohort records from ${anomaly.key}, confirm the accountable owner, and obtain run-level evidence before diagnosing behavior or changing a policy.`,
@@ -81,24 +85,27 @@ function agentCostDriverInsights(records, summary) {
     const topModel = topBreakdown(agentRecords, (record) => record.model);
     const hasRunLevelEvidence = agentRecords.length > 0 && agentRecords.every(hasCallLevelProvenance);
     return [{
-            id: `agent-spend-concentration-${topAgent.key}`,
+            // The id is a STRUCTURED field beside the neutralized title, and it is
+            // rendered (`Canonical candidate ID: ...`). Slug the neutralized form, not
+            // the raw key.
+            id: `agent-spend-concentration-${slug(safeEntity(topAgent.key))}`,
             kind: "optimization_opportunity",
             severity: "medium",
-            title: `${topAgent.key} spend concentration needs owner and budget review`,
-            summary: `${topAgent.key} is attached to ${formatPercent(share)} of tracked spend. Concentration alone does not prove abnormal behavior or an avoidable dollar amount${hasRunLevelEvidence ? "." : "; the evidence is aggregate rather than run-level."}`,
+            title: `${safeEntity(topAgent.key)} spend concentration needs owner and budget review`,
+            summary: `${safeEntity(topAgent.key)} is attached to ${formatPercent(share)} of tracked spend. Concentration alone does not prove abnormal behavior or an avoidable dollar amount${hasRunLevelEvidence ? "." : "; the evidence is aggregate rather than run-level."}`,
             evidence: compactEvidence([
                 { label: "Attributed spend", value: formatUsd(topAgent.amountUsd), detail: `${topAgent.recordCount} ${hasRunLevelEvidence ? "call-level" : "aggregate"} record${topAgent.recordCount === 1 ? "" : "s"}` },
                 { label: "Share of tracked spend", value: formatPercent(share) },
-                topModel ? { label: "Dominant model or billing label", value: topModel.key, detail: `${formatUsd(topModel.amountUsd)} in this concentration` } : undefined,
-                topOperation ? { label: "Operation label", value: topOperation.key, detail: hasRunLevelEvidence ? "Call-level attribution" : "Not verified as one call or run" } : undefined
+                topModel ? { label: "Dominant model or billing label", value: safeEntity(topModel.key), detail: `${formatUsd(topModel.amountUsd)} in this concentration` } : undefined,
+                topOperation ? { label: "Operation label", value: safeEntity(topOperation.key), detail: hasRunLevelEvidence ? "Call-level attribution" : "Not verified as one call or run" } : undefined
             ]),
-            affectedClients: keysFrom(agentRecords, (record) => record.clientId),
-            affectedProjects: keysFrom(agentRecords, (record) => record.projectId),
-            affectedAgents: [topAgent.key],
-            affectedModels: keysFrom(agentRecords, (record) => record.model),
+            affectedClients: safeUntrustedLabels(keysFrom(agentRecords, (record) => record.clientId)),
+            affectedProjects: safeUntrustedLabels(keysFrom(agentRecords, (record) => record.projectId)),
+            affectedAgents: [safeEntity(topAgent.key)],
+            affectedModels: safeUntrustedLabels(keysFrom(agentRecords, (record) => record.model)),
             estimatedImpactUsd: 0,
             confidence: topAgent.confidence,
-            recommendedAction: `Confirm who owns ${topAgent.key}, reconcile the spend to its approved budget, and collect behavioral evidence before setting a cap or savings target.`,
+            recommendedAction: `Confirm who owns ${safeEntity(topAgent.key)}, reconcile the spend to its approved budget, and collect behavioral evidence before setting a cap or savings target.`,
             verificationNeeded: "Confirm the budget owner and expected range; concentration alone is not behavioral evidence."
         }];
 }
@@ -113,7 +120,7 @@ function contextBloatInsights(records) {
     const scopedRecords = topOperation
         ? highInputRecords.filter((record) => record.operation === topOperation.key)
         : highInputRecords;
-    const operationLabel = topOperation?.key ?? "large-context calls";
+    const operationLabel = safeUntrustedLabel(topOperation?.key ?? "large-context calls", WITHHELD_OPERATION_LABEL);
     const totalInputTokens = scopedRecords.reduce((total, record) => total + record.inputTokens, 0);
     const scopedSpend = roundMoney(sumRecords(scopedRecords));
     if (scopedSpend < 20) {
@@ -131,16 +138,27 @@ function contextBloatInsights(records) {
                 { label: "Spend attached to large context", value: formatUsd(scopedSpend) },
                 { label: "Dominant operation", value: operationLabel }
             ],
-            affectedClients: keysFrom(scopedRecords, (record) => record.clientId),
-            affectedProjects: keysFrom(scopedRecords, (record) => record.projectId),
-            affectedAgents: keysFrom(scopedRecords, (record) => record.agentId),
-            affectedModels: keysFrom(scopedRecords, (record) => record.model),
+            affectedClients: safeUntrustedLabels(keysFrom(scopedRecords, (record) => record.clientId)),
+            affectedProjects: safeUntrustedLabels(keysFrom(scopedRecords, (record) => record.projectId)),
+            affectedAgents: safeUntrustedLabels(keysFrom(scopedRecords, (record) => record.agentId)),
+            affectedModels: safeUntrustedLabels(keysFrom(scopedRecords, (record) => record.model)),
             estimatedImpactUsd: 0,
             confidence: combinedConfidence(scopedRecords.map((record) => record.costConfidence)),
             recommendedAction: `Inspect representative ${operationLabel} prompts locally and run a matched before/after with the same acceptance criteria before proposing one reversible context change.`,
             verificationNeeded: "Measure token and quality deltas on matched calls; no savings counterfactual is present yet."
         }];
 }
+/**
+ * A breakdown key rendered for a HUMAN. The same slot holds a client, a
+ * project, an agent, a model or an operation depending on which grouping won,
+ * so it takes the dimension-neutral marker.
+ *
+ * Display only. The raw key is still what `records.filter(...)` matches on —
+ * rewriting a matching key would silently empty the cohort behind the finding.
+ */
+function safeEntity(value) {
+    return safeUntrustedLabel(value, WITHHELD_ENTITY_LABEL);
+}
 function topBreakdown(records, select) {
     return breakdown(records, select)[0];
 }

package/dist/localAgentLogs.d.ts

@@ -49,6 +49,16 @@ export type LocalAgentCall = {
     latestTurnUsage?: LocalAgentTurnUsage;
     /** Whether `usage` is one model turn or the session's cumulative financial total. */
     usageScope?: "turn" | "session_cumulative";
+    /**
+     * Largest single-request prompt (effective input, cache reads included)
+     * observed within a `session_cumulative` `usage`. Tiered per-request pricing
+     * is selected per request, never from a cumulative sum: a cache-heavy session
+     * routinely clears a per-request tier threshold in aggregate while no single
+     * request did. This evidence lets pricing keep such a total on the base tier
+     * (exact) instead of failing closed to "missing". Absent for turn-scoped
+     * calls, which are already a single request.
+     */
+    maxRequestPromptTokens?: number;
     /**
      * Whether the transcript exposed the input/output components required for
      * pricing. A total-only snapshot is still usage evidence, but pricing it as
@@ -374,7 +384,7 @@ export type LocalAgentStreamCheckpointAdapter = {
     writeStreamCheckpoint: (agent: LocalAgentFormatId, pathHash: string, checkpoint: Readonly<LocalAgentStreamCheckpointRecord>) => Promise<void>;
     deleteStreamCheckpoint: (agent: LocalAgentFormatId, pathHash: string) => Promise<void>;
 };
-export declare const localAgentFinancialParserVersion = 1;
+export declare const localAgentFinancialParserVersion = 3;
 /**
  * Qualitative parser contract version. Bumped to 2 with the checkpointed
  * streaming path (A4b): entries and checkpoints written by the pre-streaming
@@ -385,9 +395,15 @@ export declare const localAgentFinancialParserVersion = 1;
  * cross-file completion evidence (`subagentCompletions`, from both Task tool
  * results and background task-notifications): entries persisted by the
  * collapsing parser must re-parse rather than silently keep merging subagent
- * runs into their parent session.
+ * runs into their parent session. Bumped to 5 when Codex reducer checkpoints
+ * gained `maxTurnPromptTokens` (largest single request): a checkpoint written
+ * by v4 lacks the running per-request maximum, so restoring it could under-read
+ * the tier evidence for a cumulative session that crossed the boundary — a
+ * version mismatch discards it and re-parses from scratch instead. Bumped to 6
+ * with the user-fork inherited-baseline fix: v5 entries and checkpoints treated
+ * a fork's replayed parent history as the child's own usage and activity.
  */
-export declare const localAgentQualitativeParserVersion = 4;
+export declare const localAgentQualitativeParserVersion = 6;
 /**
  * Conservative launch defaults for action-capable qualitative evidence.
  * Callers must still inspect `qualitativeCoverage` before deriving a finding:

package/dist/localAgentLogs.js

@@ -22,7 +22,15 @@ export function latestObservedWorkingDirectory(calls) {
         .sort((left, right) => right.timestamp.localeCompare(left.timestamp))[0]
         ?.workingDirectory;
 }
-export const localAgentFinancialParserVersion = 1;
+// Bumped to 2 when session-cumulative Codex calls gained `maxRequestPromptTokens`
+// (largest single request in the session). Financial caches written by v1 lack
+// this per-request tier evidence, so a >272K-cumulative Codex session would
+// stay voided to "missing" on reuse; a version mismatch re-parses instead.
+// Bumped to 3 when user forks (`forked_from_id`) started resetting their
+// inherited baseline: v2 entries priced a fork's replayed parent history as
+// the child's own usage, so those cached amounts are overstated and must not
+// be reused.
+export const localAgentFinancialParserVersion = 3;
 /**
  * Qualitative parser contract version. Bumped to 2 with the checkpointed
  * streaming path (A4b): entries and checkpoints written by the pre-streaming
@@ -33,9 +41,15 @@ export const localAgentFinancialParserVersion = 1;
  * cross-file completion evidence (`subagentCompletions`, from both Task tool
  * results and background task-notifications): entries persisted by the
  * collapsing parser must re-parse rather than silently keep merging subagent
- * runs into their parent session.
+ * runs into their parent session. Bumped to 5 when Codex reducer checkpoints
+ * gained `maxTurnPromptTokens` (largest single request): a checkpoint written
+ * by v4 lacks the running per-request maximum, so restoring it could under-read
+ * the tier evidence for a cumulative session that crossed the boundary — a
+ * version mismatch discards it and re-parses from scratch instead. Bumped to 6
+ * with the user-fork inherited-baseline fix: v5 entries and checkpoints treated
+ * a fork's replayed parent history as the child's own usage and activity.
  */
-export const localAgentQualitativeParserVersion = 4;
+export const localAgentQualitativeParserVersion = 6;
 /**
  * Conservative launch defaults for action-capable qualitative evidence.
  * Callers must still inspect `qualitativeCoverage` before deriving a finding:
@@ -384,6 +398,42 @@ function parseCodexTurnUsage(value) {
         }
     };
 }
+/**
+ * The tier-relevant prompt size of one Codex `last_token_usage` turn: its full
+ * request input (Codex `input_tokens` already includes cached input), which is
+ * exactly `effectivePromptTokens` of the parsed turn usage. Returned only when
+ * the field parses to a non-negative number, so an unreadable turn never lowers
+ * a running maximum. Used to prove whether any single request in a cumulative
+ * session crossed a per-request tier threshold.
+ */
+function codexTurnPromptTokens(turn) {
+    const input = tokenComponentOf(turn.input_tokens);
+    return input === undefined ? undefined : input;
+}
+/**
+ * Whether a Codex rollout replays another session's history before its own
+ * work, so the cumulative counter at its first real task is an inherited
+ * baseline rather than this session's usage.
+ *
+ * TWO kinds of rollout do this, and only the first was recognized before:
+ *  - subagent rollouts (`thread_source: "subagent"`, or a `source.subagent`);
+ *  - USER FORKS (`forked_from_id`), which carry `thread_source: "user"` and
+ *    replay the parent transcript verbatim. Observed: a forked rollout whose
+ *    first 9,051 of 9,442 token_count events are byte-identical copies of the
+ *    parent's, all with earlier parent timestamps, carrying 1,204,265,192 of
+ *    its 1,256,637,395 final cumulative input tokens (95.9%) — parent usage
+ *    that was being billed again under the child, and again down each fork
+ *    chain.
+ *
+ * This is deliberately NOT folded into `isSubagent`: that flag also drives
+ * activity attribution and checkpoint identity, where a user fork is a normal
+ * user session and must not be relabelled a subagent.
+ */
+function codexHasInheritedHistory(payload) {
+    return stringOf(payload.thread_source) === "subagent" ||
+        isRecord(payload.source) && "subagent" in payload.source ||
+        stringOf(payload.forked_from_id) !== undefined;
+}
 /** Parse one Claude Code transcript (JSONL). Exported for tests. */
 export function parseClaudeCodeTranscript(content, filePath = "", sinceMs, onDiagnostic) {
     const calls = [];
@@ -634,6 +684,7 @@ function createCodexRolloutParserState() {
         fileCounts: new Map(),
         toolCallCount: 0,
         isSubagent: false,
+        hasInheritedHistory: false,
         malformedLines: 0
     };
 }
@@ -666,6 +717,7 @@ function consumeCodexRolloutLine(state, line, onEntry) {
         state.rootStartedAtMs = timestampMilliseconds(payload.timestamp ?? entry.timestamp);
         state.isSubagent = stringOf(payload.thread_source) === "subagent" ||
             isRecord(payload.source) && "subagent" in payload.source;
+        state.hasInheritedHistory = codexHasInheritedHistory(payload);
         state.parentSessionId = stringOf(payload.parent_thread_id);
     }
     if (entry.type === "turn_context" && payload) {
@@ -677,7 +729,7 @@ function consumeCodexRolloutLine(state, line, onEntry) {
             state.rootCwd = stringOf(payload.cwd);
         }
     }
-    if (state.isSubagent &&
+    if (state.hasInheritedHistory &&
         !state.rootTaskStarted &&
         payload?.type === "task_started" &&
         isRootSpecificTaskStart(payload.started_at, state.rootStartedAtMs)) {
@@ -688,6 +740,11 @@ function consumeCodexRolloutLine(state, line, onEntry) {
         // prompts/files cannot become the child's focus. Restored checkpoint
         // evidence predating the boundary is parent history too and resets with
         // it (the raw session cwd deliberately survives, exactly as rootCwd).
+        //
+        // Replayed task_started events keep the PARENT's original started_at, so
+        // `isRootSpecificTaskStart` rejects them and the first accepted task is
+        // this session's own — which is why the boundary lands exactly at the end
+        // of the replay.
         state.inheritedUsageBaseline = state.lastTotal;
         state.lastTotal = undefined;
         state.rootTaskStarted = true;
@@ -699,10 +756,11 @@ function consumeCodexRolloutLine(state, line, onEntry) {
         state.toolCallCount = 0;
         state.model = undefined;
         state.lastTurn = undefined;
+        state.maxTurnPromptTokens = undefined;
         state.lastRateLimits = undefined;
         state.lastActivityAt = toIso(stringOf(entry.timestamp)) ?? state.startedAt;
     }
-    if (payload?.type === "task_started" && (!state.isSubagent || state.rootTaskStarted)) {
+    if (payload?.type === "task_started" && (!state.hasInheritedHistory || state.rootTaskStarted)) {
         state.pendingTaskTurnId = stringOf(payload.turn_id);
         state.completedTask = undefined;
     }
@@ -757,6 +815,10 @@ function consumeCodexRolloutLine(state, line, onEntry) {
         if (turn) {
             state.lastTurn = turn;
             state.lastActivityAt = eventTimestamp;
+            const turnPrompt = codexTurnPromptTokens(turn);
+            if (turnPrompt !== undefined) {
+                state.maxTurnPromptTokens = Math.max(state.maxTurnPromptTokens ?? 0, turnPrompt);
+            }
         }
         const rateLimits = parseCodexRateLimits(payload.rate_limits, eventTimestamp);
         if (rateLimits) {
@@ -774,7 +836,7 @@ function finishCodexRolloutParse(state, onDiagnostic) {
     if (state.malformedLines > 0) {
         onDiagnostic?.({ code: "malformed_jsonl", count: state.malformedLines });
     }
-    if (!state.lastTotal || state.isSubagent && !state.rootTaskStarted)
+    if (!state.lastTotal || state.hasInheritedHistory && !state.rootTaskStarted)
         return [];
     const parsedUsage = parseCodexCumulativeUsage(state.lastTotal, state.inheritedUsageBaseline);
     const parsedTurn = state.lastTurn
@@ -834,6 +896,9 @@ function finishCodexRolloutParse(state, onDiagnostic) {
                 : {}),
             usageScope: "session_cumulative",
             usageSupport,
+            ...(usageSupport === "complete" && state.maxTurnPromptTokens !== undefined
+                ? { maxRequestPromptTokens: state.maxTurnPromptTokens }
+                : {}),
             ...(parsedUsage.reportedTotalTokens !== undefined
                 ? { reportedTotalTokens: parsedUsage.reportedTotalTokens }
                 : {}),
@@ -1999,6 +2064,7 @@ function serializeCodexReducerState(state) {
         ...(state.rootStartedAtMs !== undefined ? { rootStartedAtMs: state.rootStartedAtMs } : {}),
         rootTaskStarted: state.rootTaskStarted,
         isSubagent: state.isSubagent,
+        hasInheritedHistory: state.hasInheritedHistory,
         ...(state.parentSessionId !== undefined ? { parentSessionId: state.parentSessionId } : {}),
         ...(state.pendingTaskTurnId !== undefined ? { pendingTaskTurnId: state.pendingTaskTurnId } : {}),
         ...(state.completedTask !== undefined ? { completedTask: state.completedTask } : {}),
@@ -2006,6 +2072,9 @@ function serializeCodexReducerState(state) {
         ...(state.lastActivityAt !== undefined ? { lastActivityAt: state.lastActivityAt } : {}),
         ...(state.lastTotal !== undefined ? { lastTotal: state.lastTotal } : {}),
         ...(state.lastTurn !== undefined ? { lastTurn: state.lastTurn } : {}),
+        ...(state.maxTurnPromptTokens !== undefined
+            ? { maxTurnPromptTokens: state.maxTurnPromptTokens }
+            : {}),
         ...(state.inheritedUsageBaseline !== undefined
             ? { inheritedUsageBaseline: state.inheritedUsageBaseline }
             : {}),
@@ -2050,6 +2119,8 @@ function isPersistedCodexReducerState(value) {
     return typeof value.rootSessionMetaSeen === "boolean" &&
         typeof value.rootTaskStarted === "boolean" &&
         typeof value.isSubagent === "boolean" &&
+        (value.hasInheritedHistory === undefined ||
+            typeof value.hasInheritedHistory === "boolean") &&
         optionalString(value.model) &&
         optionalString(value.sessionId) &&
         optionalString(value.sourceVersion) &&
@@ -2062,6 +2133,7 @@ function isPersistedCodexReducerState(value) {
         optionalString(value.lastActivityAt) &&
         optionalRecord(value.lastTotal) &&
         optionalRecord(value.lastTurn) &&
+        optionalFinite(value.maxTurnPromptTokens) &&
         optionalRecord(value.inheritedUsageBaseline) &&
         validRateLimits &&
         validRootCwd &&
@@ -2084,6 +2156,10 @@ function restoreCodexReducerState(persisted) {
     state.rootStartedAtMs = persisted.rootStartedAtMs;
     state.rootTaskStarted = persisted.rootTaskStarted;
     state.isSubagent = persisted.isSubagent;
+    // Pre-fork-fix checkpoints carry no flag; fall back to the subagent bit so a
+    // restored subagent keeps its boundary (a restored user fork re-parses, its
+    // parser version having changed).
+    state.hasInheritedHistory = persisted.hasInheritedHistory ?? persisted.isSubagent;
     state.parentSessionId = persisted.parentSessionId;
     state.pendingTaskTurnId = persisted.pendingTaskTurnId;
     state.completedTask = persisted.completedTask;
@@ -2091,6 +2167,7 @@ function restoreCodexReducerState(persisted) {
     state.lastActivityAt = persisted.lastActivityAt;
     state.lastTotal = persisted.lastTotal;
     state.lastTurn = persisted.lastTurn;
+    state.maxTurnPromptTokens = persisted.maxTurnPromptTokens;
     state.inheritedUsageBaseline = persisted.inheritedUsageBaseline;
     state.lastRateLimits = persisted.lastRateLimits;
     state.restoredRootCwd = persisted.rootCwd;
@@ -2726,8 +2803,11 @@ async function readCodexFinancialFile(file) {
         const rootPayload = rootEntry?.type === "session_meta" && isRecord(rootEntry.payload)
             ? rootEntry.payload
             : undefined;
-        const isSubagent = Boolean(rootPayload) && (stringOf(rootPayload?.thread_source) === "subagent" ||
-            isRecord(rootPayload?.source) && "subagent" in rootPayload.source);
+        // A rollout that replays another session's history must be read WHOLE:
+        // its inherited-baseline boundary sits mid-file, and a proof-complete tail
+        // would never reach it. User forks need this exactly as subagents do.
+        const hasInheritedHistory = rootPayload !== undefined &&
+            codexHasInheritedHistory(rootPayload);
         const entriesReverse = [];
         let malformedLines = 0;
         let prefilteredLines = 0;
@@ -2738,7 +2818,7 @@ async function readCodexFinancialFile(file) {
         let suffixPartsReverse = [];
         let stoppedEarly = false;
         let bytesSkipped = 0;
-        const proof = createCodexReverseProof(isSubagent, !rootPayload);
+        const proof = createCodexReverseProof(hasInheritedHistory, !rootPayload);
         while (position > 0 && !stoppedEarly) {
             const chunkStart = Math.max(0, position - FINANCIAL_REVERSE_CHUNK_BYTES);
             const length = position - chunkStart;
@@ -2979,9 +3059,9 @@ function skipJsonWhitespace(input, start) {
         index += 1;
     return index;
 }
-function createCodexReverseProof(isSubagent, forceFullScan) {
+function createCodexReverseProof(hasInheritedHistory, forceFullScan) {
     return {
-        isSubagent,
+        hasInheritedHistory,
         forceFullScan,
         totalSeen: false,
         turnSeen: false,
@@ -2990,7 +3070,7 @@ function createCodexReverseProof(isSubagent, forceFullScan) {
     };
 }
 function observeCodexReverseProof(proof, entry) {
-    if (proof.forceFullScan || proof.isSubagent)
+    if (proof.forceFullScan || proof.hasInheritedHistory)
         return false;
     const payload = isRecord(entry.payload) ? entry.payload : undefined;
     const info = payload?.type === "token_count" && isRecord(payload.info)
@@ -3007,7 +3087,7 @@ function observeCodexReverseProof(proof, entry) {
     if (entry.type === "turn_context" && stringOf(payload?.model)) {
         proof.modelSeen = true;
     }
-    return !proof.isSubagent &&
+    return !proof.hasInheritedHistory &&
         proof.totalSeen &&
         proof.turnSeen &&
         proof.rateLimitsSeen &&
@@ -3112,7 +3192,8 @@ function createCodexFinancialStreamState() {
     return {
         rootSessionMetaSeen: false,
         rootTaskStarted: false,
-        isSubagent: false
+        isSubagent: false,
+        hasInheritedHistory: false
     };
 }
 function consumeCodexFinancialEntry(state, entry) {
@@ -3126,12 +3207,13 @@ function consumeCodexFinancialEntry(state, entry) {
         state.rootStartedAtMs = timestampMilliseconds(payload.timestamp ?? entry.timestamp);
         state.isSubagent = stringOf(payload.thread_source) === "subagent" ||
             isRecord(payload.source) && "subagent" in payload.source;
+        state.hasInheritedHistory = codexHasInheritedHistory(payload);
     }
     if (entry.type === "turn_context" && payload) {
         state.model = stringOf(payload.model) ?? state.model;
         state.rootCwd ??= stringOf(payload.cwd);
     }
-    if (state.isSubagent &&
+    if (state.hasInheritedHistory &&
         !state.rootTaskStarted &&
         payload?.type === "task_started" &&
         isRootSpecificTaskStart(payload.started_at, state.rootStartedAtMs)) {
@@ -3140,6 +3222,7 @@ function consumeCodexFinancialEntry(state, entry) {
         state.rootTaskStarted = true;
         state.model = undefined;
         state.lastTurn = undefined;
+        state.maxTurnPromptTokens = undefined;
         state.lastRateLimits = undefined;
         state.lastActivityAt = toIso(stringOf(entry.timestamp)) ?? state.startedAt;
     }
@@ -3162,13 +3245,17 @@ function consumeCodexFinancialEntry(state, entry) {
     if (turn) {
         state.lastTurn = turn;
         state.lastActivityAt = eventTimestamp;
+        const turnPrompt = codexTurnPromptTokens(turn);
+        if (turnPrompt !== undefined) {
+            state.maxTurnPromptTokens = Math.max(state.maxTurnPromptTokens ?? 0, turnPrompt);
+        }
     }
     const rateLimits = parseCodexRateLimits(payload.rate_limits, eventTimestamp);
     if (rateLimits)
         state.lastRateLimits = rateLimits;
 }
 function finishCodexFinancialStream(state, onDiagnostic) {
-    if (!state.lastTotal || state.isSubagent && !state.rootTaskStarted)
+    if (!state.lastTotal || state.hasInheritedHistory && !state.rootTaskStarted)
         return undefined;
     const parsedUsage = parseCodexCumulativeUsage(state.lastTotal, state.inheritedUsageBaseline);
     const parsedTurn = state.lastTurn
@@ -3196,6 +3283,9 @@ function finishCodexFinancialStream(state, onDiagnostic) {
             : {}),
         usageScope: "session_cumulative",
         usageSupport,
+        ...(usageSupport === "complete" && state.maxTurnPromptTokens !== undefined
+            ? { maxRequestPromptTokens: state.maxTurnPromptTokens }
+            : {}),
         ...(parsedUsage.reportedTotalTokens !== undefined
             ? { reportedTotalTokens: parsedUsage.reportedTotalTokens }
             : {}),
@@ -3234,10 +3324,14 @@ export function aggregateCallsForFormats(calls, descriptors) {
         const usageSupported = groupCalls.every((call) => call.usageSupport !== "unsupported_token_shape");
         const sourceVersions = [...new Set(groupCalls.flatMap((call) => call.sourceVersion ? [call.sourceVersion] : []))].sort().slice(0, 8);
         const tieredPricingEvidenceSupported = !usesPromptTieredPricing(model) ||
-            groupCalls.every((call) => canPriceTokenUsageAtScope(model, call.usage, call.usageScope === "turn" ? "request" : "aggregate") && (agent !== "gemini-cli" || hasCompleteGeminiPromptEvidence(call)));
+            groupCalls.every((call) => canPriceTokenUsageAtScope(model, call.usage, call.usageScope === "turn" ? "request" : "aggregate", call.maxRequestPromptTokens) && (agent !== "gemini-cli" || hasCompleteGeminiPromptEvidence(call)));
         const amountUsd = usageSupported && tieredPricingEvidenceSupported && format
             ? usesPromptTieredPricing(model)
-                ? estimateTokenCostsUsd(model, groupCalls.map((call) => call.usage))
+                ? estimateTokenCostsUsd(model, groupCalls.map((call) => call.usage), 
+                // Fix each cumulative slice's tier from its largest single request
+                // rather than its cache-inflated sum. Turn-scoped slices carry no
+                // such evidence and keep selecting their tier from their own prompt.
+                groupCalls.map((call) => call.maxRequestPromptTokens))
                 : estimateTokenCostUsd(model, usage)
             : undefined;
         const priced = usageSupported && typeof amountUsd === "number";

package/dist/modelPricing.d.ts

@@ -50,8 +50,17 @@ export declare function estimateTokenCostUsd(model: string, usage: TokenUsage):
  * models whose entire request moves to a higher rate above a prompt-size
  * threshold; pricing a daily token sum would incorrectly treat many small
  * requests as one large request.
+ *
+ * `tierPromptTokens[i]`, when provided, fixes the tier of `usages[i]` from
+ * request-level evidence instead of the slice's own prompt total. A
+ * session-cumulative slice is a sum of many requests whose prompt total
+ * routinely clears a per-request threshold on cache reads alone, even though no
+ * single request did; supplying the largest single request's prompt keeps such
+ * a slice on the base tier (and pricing it there is exact, since the base rate
+ * distributes over the sum). Omitting the array preserves single-request
+ * behaviour: each slice's own prompt selects its tier.
  */
-export declare function estimateTokenCostsUsd(model: string, usages: readonly TokenUsage[]): number | undefined;
+export declare function estimateTokenCostsUsd(model: string, usages: readonly TokenUsage[], tierPromptTokens?: readonly (number | undefined)[]): number | undefined;
 /** Whether this model's rate selection depends on each request's prompt size. */
 export declare function usesPromptTieredPricing(model: string): boolean;
 /** Prompt-size threshold for tiered request pricing, when one is published. */
@@ -60,9 +69,13 @@ export declare function promptTierThreshold(model: string): number | undefined;
  * Tiered prices are selected per request, never from a multi-request sum.
  * An aggregate is still unambiguous when its entire non-negative prompt-side
  * total is at or below the threshold; then no constituent request can have
- * crossed it. Larger aggregates fail closed until request-level evidence is
- * available.
+ * crossed it. It is also unambiguous when request-level evidence
+ * (`maxRequestPromptTokens`, the largest single request the aggregate contains)
+ * proves that no constituent request crossed the threshold: every request was
+ * base-tier, so the whole sum is base-tier and prices exactly at the base rate.
+ * Larger aggregates without such evidence fail closed to keep an unpriceable
+ * total honestly "missing" rather than guessing a tier.
  */
-export declare function canPriceTokenUsageAtScope(model: string, usage: TokenUsage, scope: "request" | "aggregate"): boolean;
+export declare function canPriceTokenUsageAtScope(model: string, usage: TokenUsage, scope: "request" | "aggregate", maxRequestPromptTokens?: number): boolean;
 export {};
 //# sourceMappingURL=modelPricing.d.ts.map