@cspeach/cli 1.1.33 → 1.1.35

package/dist/ui/widgets/confirm-card.js

@@ -19,79 +19,78 @@ import stringWidth from 'string-width';
 import { roleProps, selectedProps } from '../role-props.js';
 import { getBoxChars } from '../ascii-chars.js';
 import { getGlyphs } from '../../renderer/glyphs.js';
-import { truncateToWidth } from '../../renderer/ui-width.js';
+import { truncateToWidth, uiWidth } from '../../renderer/ui-width.js';
+import { wrapRows } from '../../renderer/wrap-rows.js';
 import { sanitizeControlChars } from '../../renderer/sanitize.js';
 // Q1b's shared hook — the one raw-stdin reclaim for every card (no second copy).
 import { useReclaimRawStdin } from './reclaim-raw-stdin.js';
 export const CONFIRM_INPUT_GUARD_MS = 150;
+/** Facts wrap onto this many rows unless the request says otherwise (fix batch 2026-10-12). */
+export const DEFAULT_WRAP_FACTS = 3;
+/** A title wraps onto at most this many rows. */
+export const TITLE_MAX_ROWS = 2;
+/** A choice label wraps onto at most this many rows. */
+export const LABEL_MAX_ROWS = 2;
+/** `${cursor} ${n}. ` — the same width whether the cursor is on the row or not. */
+const choicePrefixWidth = (i) => 2 + `${i + 1}. `.length;
 /**
- * The card's full rendered height for the live-area budget (F3 liveBudget
- * `cardRows`): top edge + title + one row per fact + the gap above the
- * choices + one row per choice + the hint + bottom edge. Every row is
- * truncate-end, so nothing wraps into extra rows — except the facts of a
- * card that asks for `wrapFacts`: with `width` given, each counts the rows
- * it is drawn on.
+ * A choice's rows. The label wraps under its own text (continuation rows are
+ * indented past the number). The dim hint stays beside the last label row
+ * when it fits; otherwise it gets a row of its own — a hint such as "DEV
+ * systems only" is a safety cue and is never dropped.
  */
-export function estimateConfirmCardRows(req, width, maxRows) {
-    const facts = req.facts ?? [];
-    const wrap = width === undefined ? 1 : fittedWrap(req, width, maxRows);
-    const factRowCount = width !== undefined && wrap > 1
-        ? facts.reduce((n, f) => n + factRows(f, Math.max(1, width - 4), wrap).length, 0)
-        : facts.length;
-    return 5 + factRowCount + req.choices.length;
+export function choiceRows(label, hint, i, inner, labelRows) {
+    const p = choicePrefixWidth(i);
+    const rows = wrapRows(label, Math.max(1, inner - p), labelRows);
+    if (!hint)
+        return { label: rows, hint: '', hintOwnRow: false };
+    const room = inner - p - stringWidth(rows[rows.length - 1]);
+    const beside = `  ${sanitizeControlChars(hint)}`;
+    if (stringWidth(beside) <= room)
+        return { label: rows, hint: beside, hintOwnRow: false };
+    return { label: rows, hint: truncateToWidth(sanitizeControlChars(hint), Math.max(1, inner - p)), hintOwnRow: true };
+}
+function rowsFor(req, inner, l) {
+    const title = wrapRows(req.title, inner, l.titleRows).length;
+    const facts = (req.facts ?? []).reduce((n, f) => n + wrapRows(f, inner, l.wrap).length, 0);
+    const choices = req.choices.reduce((n, c, i) => {
+        const r = choiceRows(c.label, c.hint, i, inner, l.labelRows);
+        return n + r.label.length + (r.hintOwnRow ? 1 : 0);
+    }, 0);
+    // top edge + title + facts + gap + choices + hint + bottom edge
+    return 4 + title + facts + choices;
 }
 /**
- * The rows a long fact may wrap onto so the whole card stays within
- * `maxRows` (App: rows − 6, so Ink never reaches its full-clear path): the
- * card's own `wrapFacts`, one less each time it would not fit, down to one
- * row (every fact cut with …, as on any card).
+ * The layout that keeps the whole card within `maxRows` (App: rows − 6, so
+ * Ink never reaches its full-clear path). Card content wraps; when it would
+ * not fit, the facts give up rows first (one less each time, down to one
+ * row cut with …), then the title, then the choice labels.
  */
-export function fittedWrap(req, width, maxRows) {
-    let wrap = Math.max(1, req.wrapFacts ?? 1);
+export function confirmLayout(req, width, maxRows) {
+    const l = { wrap: Math.max(1, req.wrapFacts ?? DEFAULT_WRAP_FACTS), titleRows: TITLE_MAX_ROWS, labelRows: LABEL_MAX_ROWS };
     if (maxRows === undefined)
-        return wrap;
-    const cells = Math.max(1, width - 4);
-    const rowsAt = (w) => 5 + req.choices.length + (req.facts ?? []).reduce((n, f) => n + factRows(f, cells, w).length, 0);
-    while (wrap > 1 && rowsAt(wrap) > maxRows)
-        wrap -= 1;
-    return wrap;
+        return l;
+    const inner = Math.max(1, width - 4);
+    while (l.wrap > 1 && rowsFor(req, inner, l) > maxRows)
+        l.wrap -= 1;
+    if (rowsFor(req, inner, l) > maxRows)
+        l.titleRows = 1;
+    if (rowsFor(req, inner, l) > maxRows)
+        l.labelRows = 1;
+    return l;
 }
-const graphemes = new Intl.Segmenter(undefined, { granularity: 'grapheme' });
 /**
- * One fact as the rows it is drawn on. `rows` 1 (the default): one row, cut
- * with … — how every card looks. More: wrapped at spaces (a word wider than
- * the row is cut where it must be) onto at most `rows` rows, the last one cut
- * with … when there is still more. Control characters are neutralised first.
+ * The card's full rendered height for the live-area budget (F3 liveBudget
+ * `cardRows`): top edge + title rows + every fact row + the gap above the
+ * choices + every choice row + the hint + bottom edge. Every wrapped row is
+ * counted; `width` defaults to uiWidth().
  */
-export function factRows(text, cells, rows = 1) {
-    const flat = sanitizeControlChars(text).replace(/\t/g, '  ').replace(/\r?\n/g, ' ');
-    if (rows <= 1 || stringWidth(flat) <= cells)
-        return [truncateToWidth(flat, cells)];
-    const out = [];
-    let rest = flat;
-    while (out.length < rows - 1 && stringWidth(rest) > cells) {
-        let used = 0;
-        let space = -1;
-        let end = rest.length;
-        for (const { segment, index } of graphemes.segment(rest)) {
-            const w = stringWidth(segment);
-            if (used + w > cells) {
-                end = index;
-                if (segment === ' ')
-                    space = index;
-                break;
-            }
-            used += w;
-            if (segment === ' ')
-                space = index;
-        }
-        const at = space > 0 ? space : Math.max(1, end);
-        out.push(rest.slice(0, at).trimEnd());
-        rest = rest.slice(at).trimStart();
-    }
-    if (rest)
-        out.push(truncateToWidth(rest, cells));
-    return out;
+export function estimateConfirmCardRows(req, width = uiWidth(), maxRows) {
+    return rowsFor(req, Math.max(1, width - 4), confirmLayout(req, width, maxRows));
+}
+/** The rows a long fact may wrap onto so the whole card stays within `maxRows`. */
+export function fittedWrap(req, width, maxRows) {
+    return confirmLayout(req, width, maxRows).wrap;
 }
 /**
  * Owner decision (fix-round-3 deferred M1): a digit PICKS only on ordinary
@@ -155,17 +154,43 @@ export function matchAlias(aliases, input, word) {
 function fit(text, cells) {
     return truncateToWidth(sanitizeControlChars(text), cells);
 }
-const inkBorder = (b) => ({
-    topLeft: b.tl, top: b.h, topRight: b.tr, right: b.v,
-    bottomRight: b.br, bottom: b.h, bottomLeft: b.bl, left: b.v,
-});
-/** The frame every card in the slot shares: tag chip top edge, footnote bottom edge. */
-export function CardFrame({ tag, footnote, width, children }) {
+/**
+ * One border object per box-character set, reused on every render. Ink diffs
+ * style props by identity: a new borderStyle object on a re-render is sent
+ * alone, without borderTop/borderBottom false, and Ink then gives the box a
+ * top and bottom border again (two blank rows inside the frame after the
+ * first key press). Task 4 found it when AskCard moved into this frame.
+ */
+const borderCache = new Map();
+function makeInkBorder(b) {
+    return {
+        topLeft: b.tl, top: b.h, topRight: b.tr, right: b.v,
+        bottomRight: b.br, bottom: b.h, bottomLeft: b.bl, left: b.v,
+    };
+}
+const inkBorder = (b) => {
+    let out = borderCache.get(b);
+    if (!out) {
+        out = makeInkBorder(b);
+        borderCache.set(b, out);
+    }
+    return out;
+};
+/**
+ * The frame every card in the slot shares: tag chip top edge, footnote bottom
+ * edge. `header` (Task 4, e.g. "Blocker 2 of 4") follows the tag on the top
+ * edge, dim: "╭─ QUESTION · Blocker 2 of 4 ───╮"; it is cut first when narrow.
+ */
+export function CardFrame({ tag, header, footnote, width, children }) {
     const box = getBoxChars();
     const frame = roleProps('frame');
-    const top = edgeSegments([box.tl, box.tr], box.h, tag, width);
+    const extra = header ? ` · ${sanitizeControlChars(header).replace(/[\t\n]+/g, ' ')}` : '';
+    const top = edgeSegments([box.tl, box.tr], box.h, `${tag}${extra}`, width);
+    // The shown label is cut from the end, so the tag (if whole) leads it.
+    const tagShown = top.label.startsWith(tag) ? tag : top.label;
+    const headerShown = top.label.slice(tagShown.length);
     const bottom = edgeSegments([box.bl, box.br], box.h, footnote, width);
-    return (_jsxs(Box, { flexDirection: "column", flexShrink: 0, width: width, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...frame, children: top.lead }), _jsx(Text, { ...roleProps(TAG_ROLE[tag], { bold: true }), children: top.label }), _jsx(Text, { ...frame, children: top.tail })] }), _jsx(Box, { flexDirection: "column", width: width, paddingX: 1, borderStyle: inkBorder(box), borderTop: false, borderBottom: false, borderColor: frame.color, children: children }), _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...frame, children: bottom.lead }), _jsx(Text, { ...roleProps('dim'), children: bottom.label }), _jsx(Text, { ...frame, children: bottom.tail })] })] }));
+    return (_jsxs(Box, { flexDirection: "column", flexShrink: 0, width: width, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...frame, children: top.lead }), _jsx(Text, { ...roleProps(TAG_ROLE[tag], { bold: true }), children: tagShown }), headerShown ? _jsx(Text, { ...roleProps('dim'), children: headerShown }) : null, _jsx(Text, { ...frame, children: top.tail })] }), _jsx(Box, { flexDirection: "column", width: width, paddingX: 1, borderStyle: inkBorder(box), borderTop: false, borderBottom: false, borderColor: frame.color, children: children }), _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...frame, children: bottom.lead }), _jsx(Text, { ...roleProps('dim'), children: bottom.label }), _jsx(Text, { ...frame, children: bottom.tail })] })] }));
 }
 export function ConfirmCard({ request, width, maxRows, onResolve, onInterruptTurn }) {
     // Re-assert raw stdin on mount: an earlier inquirer prompt can leave Ink's
@@ -235,7 +260,7 @@ export function ConfirmCard({ request, width, maxRows, onResolve, onInterruptTur
             finish({ value: hit });
     });
     const inner = Math.max(1, width - 4);
-    const wrap = fittedWrap(request, width, maxRows);
+    const layout = confirmLayout(request, width, maxRows);
     const dim = roleProps('dim');
     const titleProps = request.tag === 'CANNOT BE UNDONE' ? roleProps('bad', { bold: true }) : { bold: true };
     const letters = Object.keys(request.aliases ?? {}).filter((k) => k.length === 1);
@@ -244,13 +269,14 @@ export function ConfirmCard({ request, width, maxRows, onResolve, onInterruptTur
         ? `1-${digits} picks · ↑↓ move · Enter chooses · Esc cancels`
         : `Enter chooses · Esc cancels · ↑↓ or 1-${digits} move`)
         + (letters.length > 0 ? ` · keys ${letters.join('/')}` : '');
-    return (_jsxs(CardFrame, { tag: request.tag, footnote: request.footnote, width: width, children: [_jsx(Text, { wrap: "truncate-end", ...titleProps, children: fit(request.title, inner) }), (request.facts ?? []).flatMap((f, i) => (wrap > 1
-                ? factRows(f, inner, wrap).map((row, j) => (_jsx(Text, { wrap: "truncate-end", ...dim, children: row }, `fact-${i}-${j}`)))
-                : [_jsx(Text, { wrap: "truncate-end", ...dim, children: fit(f, inner) }, `fact-${i}`)])), _jsx(Box, { flexDirection: "column", marginTop: 1, children: request.choices.map((c, i) => {
+    return (_jsxs(CardFrame, { tag: request.tag, footnote: request.footnote, width: width, children: [wrapRows(request.title, inner, layout.titleRows).map((row, j) => (_jsx(Text, { wrap: "truncate-end", ...titleProps, children: row }, `title-${j}`))), (request.facts ?? []).flatMap((f, i) => wrapRows(f, inner, layout.wrap).map((row, j) => (_jsx(Text, { wrap: "truncate-end", ...dim, children: row }, `fact-${i}-${j}`)))), _jsx(Box, { flexDirection: "column", marginTop: 1, children: request.choices.flatMap((c, i) => {
                     const on = i === cursor;
-                    const main = fit(`${on ? g.cursor : ' '} ${i + 1}. ${c.label}`, inner);
-                    const room = inner - stringWidth(main);
-                    const hintText = c.hint && room > 2 ? fit(`  ${c.hint}`, room) : '';
-                    return (_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...(on ? selectedProps() : {}), children: main }), hintText ? _jsx(Text, { ...dim, children: hintText }) : null] }, c.value));
+                    const r = choiceRows(c.label, c.hint, i, inner, layout.labelRows);
+                    const pad = ' '.repeat(choicePrefixWidth(i));
+                    const sel = on ? selectedProps() : {};
+                    const out = r.label.map((row, j) => (_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Text, { ...sel, children: j === 0 ? `${on ? g.cursor : ' '} ${i + 1}. ${row}` : `${pad}${row}` }), j === r.label.length - 1 && r.hint && !r.hintOwnRow ? _jsx(Text, { ...dim, children: r.hint }) : null] }, `${c.value}-${j}`)));
+                    if (r.hintOwnRow)
+                        out.push(_jsx(Text, { wrap: "truncate-end", ...dim, children: `${pad}${r.hint}` }, `${c.value}-hint`));
+                    return out;
                 }) }), _jsx(Text, { wrap: "truncate-end", ...dim, children: fit(hint, inner) })] }));
 }

package/dist/usage/usage-queue.js

@@ -0,0 +1,323 @@
+/**
+ * Security batch item 3 — <CSPeach home>/usage-queue.jsonl: usage counts
+ * waiting to be sent. Capped at 1,000 lines or 1 MB (oldest dropped).
+ *
+ * Safe with several cspeach processes: every read-modify-write holds an
+ * exclusive lock file (O_EXCL create). The holder writes "<pid> <ms> <host>
+ * <token>"; a contender clears the lock at once when that pid is gone on this
+ * host, or when the lock is older than 10 s. A contender waits longer than
+ * the stale age, so an orphaned lock never drops a record (F5).
+ *
+ * The network send happens OUTSIDE the lock as a lease (F1): leaseBatch
+ * returns the oldest records WITHOUT removing them; ackBatch removes exactly
+ * those request ids once the proxy answered. A crash mid-send therefore
+ * resends the batch next time, and the proxy drops the repeat by request id.
+ *
+ * Each line carries a local-only `keyPrefix` (a short sha256 fingerprint of
+ * the seat's key, never the key or a piece of it). leaseBatch keeps only the
+ * current seat's lines, drops the rest, and strips the tag: it is never sent
+ * (F10).
+ */
+import { promises as fs } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { cspeachRoot } from '../config/paths.js';
+import { countedTokens } from '../connection/local-usage.js';
+/** The exact fields sent; anything else on a queue line stays on disk. */
+const RECORD_KEYS = [
+    'request_id', 'mode', 'skill', 'model', 'input_tokens', 'output_tokens',
+    'cache_read_tokens', 'cache_write_tokens', 'cli_version', 'session_id', 'at',
+];
+export const QUEUE_MAX_LINES = 1000;
+export const QUEUE_MAX_BYTES = 1_000_000;
+const LOCK_STALE_MS = 10_000;
+/** Longer than LOCK_STALE_MS: a holder that died is always outwaited (F5). */
+const LOCK_WAIT_MS = 15_000;
+/**
+ * Final review finding 6 — the rename retry runs while the lock is held, so it
+ * must give up before a contender may judge that lock stale (LOCK_STALE_MS):
+ * otherwise two writers are possible in the last seconds.
+ */
+const RENAME_WAIT_MS = 8_000;
+/** A queue temp file older than this is a crash leftover (a live write renames within ms). */
+const STALE_TMP_MS = 60_000;
+/** Pinned by tests: RENAME_WAIT_MS < LOCK_STALE_MS < LOCK_WAIT_MS. */
+export const QUEUE_TIMINGS = { LOCK_STALE_MS, LOCK_WAIT_MS, RENAME_WAIT_MS };
+const LOCK_CODES = new Set(['EPERM', 'EACCES', 'EBUSY']);
+export function usageQueuePath() {
+    return path.join(cspeachRoot(), 'usage-queue.jsonl');
+}
+const lockPath = () => `${usageQueuePath()}.lock`;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** The seat tag on a queue line: a fingerprint of the key, never the key. */
+export function keyPrefixFor(key) {
+    return createHash('sha256').update(`cspeach-usage-seat:${key}`).digest('hex').slice(0, 16);
+}
+/** True only when the lock's holder is provably gone (same host, pid not running). */
+function holderIsDead(content) {
+    const [pidText, , host] = content.trim().split(' ');
+    const pid = Number(pidText);
+    if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
+        return false;
+    if (host !== os.hostname())
+        return false;
+    try {
+        process.kill(pid, 0);
+        return false;
+    }
+    catch (err) {
+        return err.code === 'ESRCH';
+    }
+}
+/**
+ * Remove a lock judged dead or stale. Renamed to a unique name first (only one
+ * contender can win the rename); if what was renamed is not the lock that was
+ * judged (a fresh holder took over in between), it is put back.
+ */
+async function clearLock(lp, judged) {
+    const aside = `${lp}.${process.pid}.${randomUUID()}.stale`;
+    try {
+        await fs.rename(lp, aside);
+    }
+    catch {
+        return;
+    }
+    const got = await fs.readFile(aside, 'utf-8').catch(() => judged);
+    if (got !== judged)
+        await fs.link(aside, lp).catch(() => { });
+    await fs.rm(aside, { force: true }).catch(() => { });
+}
+async function withQueueLock(fn) {
+    const lp = lockPath();
+    await fs.mkdir(path.dirname(lp), { recursive: true });
+    const token = `${process.pid} ${Date.now()} ${os.hostname()} ${randomUUID()}`;
+    const deadline = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            const h = await fs.open(lp, 'wx');
+            try {
+                await h.writeFile(token);
+            }
+            finally {
+                await h.close();
+            }
+            break;
+        }
+        catch (err) {
+            const code = err.code ?? '';
+            // F14 — on Windows a lock file being created or deleted by another
+            // process answers EPERM / EACCES / EBUSY instead of EEXIST: that is
+            // contention too, so wait and retry (never drop the record).
+            if (code === 'EEXIST') {
+                try {
+                    const [content, st] = await Promise.all([fs.readFile(lp, 'utf-8'), fs.stat(lp)]);
+                    if (holderIsDead(content) || Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+                        await clearLock(lp, content);
+                        continue;
+                    }
+                }
+                catch { /* gone or busy: retry after the pause */ }
+            }
+            else if (!LOCK_CODES.has(code)) {
+                return undefined;
+            }
+            if (Date.now() > deadline)
+                return undefined;
+            await sleep(10 + Math.floor(Math.random() * 20));
+        }
+    }
+    await sweepStaleTemps();
+    try {
+        return await fn();
+    }
+    finally {
+        // Release only our own lock (it may have been cleared as stale meanwhile).
+        const now = await fs.readFile(lp, 'utf-8').catch(() => '');
+        if (now === token)
+            await fs.unlink(lp).catch(() => { });
+    }
+}
+/**
+ * Task 9 I3 — remove usage-queue.jsonl.<pid>.tmp files left by a crash.
+ * Runs under the queue lock; only our own temp names, only when older than
+ * STALE_TMP_MS (same rule as the skills cache). Never throws.
+ */
+async function sweepStaleTemps() {
+    const p = usageQueuePath();
+    const dir = path.dirname(p);
+    const prefix = `${path.basename(p)}.`;
+    try {
+        for (const f of await fs.readdir(dir)) {
+            if (!f.startsWith(prefix) || !/^\d+\.tmp$/.test(f.slice(prefix.length)))
+                continue;
+            const full = path.join(dir, f);
+            const st = await fs.stat(full).catch(() => null);
+            if (st && Date.now() - st.mtimeMs > STALE_TMP_MS)
+                await fs.rm(full, { force: true }).catch(() => { });
+        }
+    }
+    catch { /* no directory yet */ }
+}
+async function readLines() {
+    try {
+        return (await fs.readFile(usageQueuePath(), 'utf-8')).split('\n').filter((l) => l.trim().length > 0);
+    }
+    catch {
+        return [];
+    }
+}
+async function writeLines(lines) {
+    const p = usageQueuePath();
+    if (lines.length === 0) {
+        await fs.rm(p, { force: true });
+        return;
+    }
+    const tmp = `${p}.${process.pid}.tmp`;
+    await fs.writeFile(tmp, lines.join('\n') + '\n', 'utf-8');
+    // F14 — a reader outside the lock (queueStats, doctor) can hold the file
+    // open on Windows for a moment: EPERM / EACCES / EBUSY is retried until a
+    // deadline, never treated as a lost write.
+    const deadline = Date.now() + RENAME_WAIT_MS;
+    for (let attempt = 0;; attempt++) {
+        try {
+            await fs.rename(tmp, p);
+            return;
+        }
+        catch (err) {
+            if (!LOCK_CODES.has(err.code ?? '') || Date.now() > deadline) {
+                await fs.rm(tmp, { force: true }).catch(() => { });
+                throw err;
+            }
+            await sleep(Math.min(20 * (attempt + 1), 200));
+        }
+    }
+}
+/** Newest lines kept: at most QUEUE_MAX_LINES and QUEUE_MAX_BYTES (newline included). */
+export function capLines(lines) {
+    let out = lines.slice(-QUEUE_MAX_LINES);
+    let bytes = out.reduce((n, l) => n + Buffer.byteLength(l) + 1, 0);
+    while (out.length > 0 && bytes > QUEUE_MAX_BYTES) {
+        bytes -= Buffer.byteLength(out[0]) + 1;
+        out = out.slice(1);
+    }
+    return out;
+}
+/** A line → the record (exactly RECORD_KEYS) and its seat tag; null when unreadable. */
+function parseLine(l) {
+    try {
+        const o = JSON.parse(l);
+        if (!o || typeof o !== 'object' || Array.isArray(o) || typeof o.request_id !== 'string')
+            return null;
+        const rec = Object.fromEntries(RECORD_KEYS.map((k) => [k, o[k]]));
+        return { rec, keyPrefix: typeof o.keyPrefix === 'string' ? o.keyPrefix : '' };
+    }
+    catch {
+        return null;
+    }
+}
+/** True when the record is in the queue, tagged with its seat. Never throws. */
+export async function enqueueUsage(rec, keyPrefix) {
+    try {
+        const line = JSON.stringify({ ...rec, keyPrefix });
+        return (await withQueueLock(async () => { await writeLines(capLines([...(await readLines()), line])); return true; })) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Up to `max` of the oldest records of this seat, NOT removed (F1). Lines
+ * that cannot be read and lines of another seat are dropped here (F10); the
+ * returned records never carry the seat tag. Never throws.
+ */
+export async function leaseBatch(max, keyPrefix) {
+    try {
+        return (await withQueueLock(async () => {
+            const lines = await readLines();
+            const keep = [];
+            const out = [];
+            for (const l of lines) {
+                const q = parseLine(l);
+                if (!q || q.keyPrefix !== keyPrefix)
+                    continue;
+                keep.push(l);
+                if (out.length < max)
+                    out.push(q.rec);
+            }
+            if (keep.length !== lines.length)
+                await writeLines(keep);
+            return out;
+        })) ?? [];
+    }
+    catch {
+        return [];
+    }
+}
+/** Remove the records with these request ids (the proxy answered for them). False when the queue could not be changed. */
+export async function ackBatch(requestIds) {
+    if (requestIds.length === 0)
+        return true;
+    const done = new Set(requestIds);
+    try {
+        return (await withQueueLock(async () => {
+            const lines = await readLines();
+            const keep = lines.filter((l) => { const q = parseLine(l); return q !== null && !done.has(q.rec.request_id); });
+            if (keep.length !== lines.length)
+                await writeLines(keep);
+            return true;
+        })) === true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function queueStats() {
+    try {
+        const text = await fs.readFile(usageQueuePath(), 'utf-8');
+        return { lines: text.split('\n').filter((l) => l.trim().length > 0).length, bytes: Buffer.byteLength(text) };
+    }
+    catch {
+        return { lines: 0, bytes: 0 };
+    }
+}
+/**
+ * Azure limit (D6) — the counted tokens (input + output + cache-write; cache
+ * reads excluded) of THIS seat's records still waiting in the queue: exactly
+ * the tokens the server's `used` does not hold yet. Only azure records count,
+ * as the server's `used` counts azure usage only. Reads without the lock,
+ * as queueStats does. No file → 0; any other read error throws, so the caller
+ * keeps its count. Unreadable lines, other seats' lines and other modes are skipped.
+ */
+export async function queuedTokens(keyPrefix) {
+    let text;
+    try {
+        text = await fs.readFile(usageQueuePath(), 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return 0;
+        throw err;
+    }
+    const n = (v) => (typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : 0);
+    let sum = 0;
+    for (const l of text.split('\n')) {
+        if (l.trim().length === 0)
+            continue;
+        const q = parseLine(l);
+        if (!q || q.keyPrefix !== keyPrefix || q.rec.mode !== 'azure')
+            continue;
+        sum += countedTokens({ input_tokens: n(q.rec.input_tokens), output_tokens: n(q.rec.output_tokens), cache_write_tokens: n(q.rec.cache_write_tokens) });
+    }
+    return sum;
+}
+/** Cheap when there is nothing to delete (no lock taken): called on every call while reporting is off. */
+export async function deleteUsageQueue() {
+    try {
+        await fs.access(usageQueuePath());
+    }
+    catch {
+        return;
+    }
+    await withQueueLock(async () => { await fs.rm(usageQueuePath(), { force: true }); }).catch(() => { });
+}