npm - @ipv9/tokentracker-cli - Versions diffs - 0.39.38 → 0.39.39 - Mend

@ipv9/tokentracker-cli 0.39.38 → 0.39.39

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (79) hide show

package/README.md +41 -9
package/dashboard/dist/assets/{Card-DD4s0V6T.js → Card-BbRYRVXf.js} +1 -1
package/dashboard/dist/assets/DashboardPage-DYKHv0m3.js +60 -0
package/dashboard/dist/assets/{FadeIn-CUSBK0jm.js → FadeIn-CjAacJ5t.js} +1 -1
package/dashboard/dist/assets/{IpCheckPage-PHF4lPax.js → IpCheckPage-BGALK8Vy.js} +1 -1
package/dashboard/dist/assets/{LimitsPage-dS9C9Vdt.js → LimitsPage-LkZGPYvg.js} +2 -2
package/dashboard/dist/assets/{LocalOnlyNotice-DCmtS_j5.js → LocalOnlyNotice-Dxo2vFMQ.js} +1 -1
package/dashboard/dist/assets/PopoverPopup-DP9fwdtl.js +1 -0
package/dashboard/dist/assets/Select-DPE53NmM.js +1 -0
package/dashboard/dist/assets/SelectItemText-D69v77is.js +12 -0
package/dashboard/dist/assets/SettingsPage-Dxzqpi02.js +1 -0
package/dashboard/dist/assets/SkillsPage-Bo7e39AB.js +1 -0
package/dashboard/dist/assets/WidgetsPage-HHcIr_Eq.js +1 -0
package/dashboard/dist/assets/WrappedPage-C-_jLXXU.js +1 -0
package/dashboard/dist/assets/{arrow-up-right-CjaBQnwI.js → arrow-up-right-BJvJHUGj.js} +1 -1
package/dashboard/dist/assets/{download-DLBqkSwp.js → download-CnzY_EgN.js} +1 -1
package/dashboard/dist/assets/format-1w-q5n2f.js +1 -0
package/dashboard/dist/assets/main-1kxAVM3m.css +1 -0
package/dashboard/dist/assets/main-3gBEI6Jl.js +694 -0
package/dashboard/dist/assets/mock-data-CJOMGcL9.js +1 -0
package/dashboard/dist/assets/use-limits-display-prefs-D1nT9-mr.js +1 -0
package/dashboard/dist/assets/use-native-settings-Dh6NzqjY.js +1 -0
package/dashboard/dist/assets/use-usage-limits-BXR6lzGf.js +1 -0
package/dashboard/dist/assets/useCurrency-Hhs5jbWw.js +1 -0
package/dashboard/dist/index.html +15 -27
package/dashboard/dist/llms.txt +0 -2
package/dashboard/dist/sitemap.xml +0 -12
package/package.json +7 -4
package/src/cli.js +4 -13
package/src/commands/doctor.js +1 -3
package/src/commands/init.js +63 -53
package/src/commands/serve.js +2 -50
package/src/commands/status.js +1 -55
package/src/commands/sync.js +134 -227
package/src/lib/{browser-auth.js → browser-open.js} +3 -149
package/src/lib/claude-categorizer.js +204 -32
package/src/lib/codex-context-breakdown.js +83 -7
package/src/lib/codex-rollout-parser.js +52 -10
package/src/lib/diagnostics.js +1 -49
package/src/lib/doctor.js +12 -87
package/src/lib/file-identity.js +69 -0
package/src/lib/init-flow.js +6 -3
package/src/lib/local-api.js +6 -364
package/src/lib/pricing/curated-overrides.json +1 -1
package/src/lib/pricing/seed-snapshot.json +1 -1
package/src/lib/rollout.js +392 -144
package/src/lib/runtime-config.js +0 -32
package/src/lib/sqlite-reader.js +83 -8
package/dashboard/dist/assets/ActivityHeatmap-BrehqUIb.js +0 -42
package/dashboard/dist/assets/DashboardPage-CyUShBRJ.js +0 -19
package/dashboard/dist/assets/DevicePage-BA74Su1l.js +0 -1
package/dashboard/dist/assets/DialogTitle-DoKsz5wi.js +0 -1
package/dashboard/dist/assets/InsforgeUserHeaderControls-Bk_U2dHr.js +0 -1
package/dashboard/dist/assets/LandingPage-Bbeu84Iu.js +0 -4356
package/dashboard/dist/assets/LeaderboardAvatar-ByqeB6bM.js +0 -1
package/dashboard/dist/assets/LeaderboardPage-BeWXF00S.js +0 -6
package/dashboard/dist/assets/LeaderboardProfileModal-C4yvbZd_.js +0 -72
package/dashboard/dist/assets/LeaderboardProfilePage-D3cbSh5o.js +0 -1
package/dashboard/dist/assets/LoginPage-Ch3UQoWj.js +0 -1
package/dashboard/dist/assets/PopoverPopup-DjG0gjlA.js +0 -1
package/dashboard/dist/assets/Select-HzIjWJpE.js +0 -1
package/dashboard/dist/assets/SelectItemText-f0tCwtvZ.js +0 -1
package/dashboard/dist/assets/SettingsPage-DJOZAlZy.js +0 -1
package/dashboard/dist/assets/SkillsPage-BQcyJIdx.js +0 -1
package/dashboard/dist/assets/WidgetsPage-B_vxuV09.js +0 -1
package/dashboard/dist/assets/WrappedPage-CZN9Y3Vz.js +0 -1
package/dashboard/dist/assets/index-BeoRn2gJ.js +0 -2
package/dashboard/dist/assets/info-BAIxlHIB.js +0 -1
package/dashboard/dist/assets/main-DAcSUW2t.css +0 -1
package/dashboard/dist/assets/main-pi07CfeC.js +0 -1004
package/dashboard/dist/assets/use-limits-display-prefs-CMfASZsh.js +0 -1
package/dashboard/dist/assets/use-native-settings-CfPik-Ao.js +0 -1
package/dashboard/dist/assets/use-spring-wsmJQRqb.js +0 -1
package/dashboard/dist/assets/use-usage-limits-Bt0Dp6kx.js +0 -1
package/dashboard/dist/assets/useCurrency-CsaAMc3j.js +0 -1
package/dashboard/dist/assets/useOpenInteractionType-CPzi5Z8M.js +0 -12
package/dashboard/dist/share.html +0 -140
package/src/commands/device-login.js +0 -161
package/src/lib/upload-throttle.js +0 -148

package/src/lib/{browser-auth.js → browser-open.js} RENAMED Viewed

@@ -1,138 +1,8 @@
-const http = require("node:http");
-const crypto = require("node:crypto");
+// Opens a URL in the user's browser. This module used to also run the cloud
+// sign-in flow (a local callback server plus a redirect dance); that went away
+// with the cloud, and the file was renamed so its name stops implying auth.
 const cp = require("node:child_process");
-const { DEFAULT_BASE_URL } = require("./runtime-config");
-async function beginBrowserAuth({ baseUrl, dashboardUrl, timeoutMs, open }) {
-  const nonce = crypto.randomBytes(16).toString("hex");
-  const callbackPath = `/tokentracker/callback/${nonce}`;
-  const authUrl = dashboardUrl ? new URL("/", dashboardUrl) : new URL("/auth/sign-up", baseUrl);
-  const postAuthRedirect = resolvePostAuthRedirect({ dashboardUrl, authUrl });
-  const { callbackUrl, waitForCallback } = await startLocalCallbackServer({
-    callbackPath,
-    timeoutMs,
-    redirectUrl: postAuthRedirect,
-  });
-  authUrl.searchParams.set("redirect", callbackUrl);
-  if (dashboardUrl && baseUrl && baseUrl !== DEFAULT_BASE_URL) {
-    authUrl.searchParams.set("base_url", baseUrl);
-  }
-  if (open !== false) openInBrowser(authUrl.toString());
-  return { authUrl: authUrl.toString(), waitForCallback };
-}
-async function startLocalCallbackServer({ callbackPath, timeoutMs, redirectUrl }) {
-  let resolved = false;
-  let resolveResult;
-  let rejectResult;
-  const resultPromise = new Promise((resolve, reject) => {
-    resolveResult = resolve;
-    rejectResult = reject;
-  });
-  const server = http.createServer((req, res) => {
-    if (resolved) {
-      res.writeHead(409, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Already authenticated.\n");
-      return;
-    }
-    const method = req.method || "GET";
-    if (method !== "GET") {
-      res.writeHead(405, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Method not allowed.\n");
-      return;
-    }
-    const url = new URL(req.url || "/", "http://127.0.0.1");
-    if (url.pathname !== callbackPath) {
-      res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Not found.\n");
-      return;
-    }
-    const accessToken = url.searchParams.get("access_token") || "";
-    if (!accessToken) {
-      res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Missing access_token.\n");
-      return;
-    }
-    resolved = true;
-    if (redirectUrl) {
-      res.writeHead(302, {
-        Location: redirectUrl,
-        "Content-Type": "text/html; charset=utf-8",
-      });
-      res.end(
-        [
-          "<!doctype html>",
-          '<html><head><meta charset="utf-8"><title>TokenTracker</title></head>',
-          "<body>",
-          "<h2>Login succeeded</h2>",
-          `<p>Redirecting to <a href="${redirectUrl}">dashboard</a>...</p>`,
-          "</body></html>",
-        ].join(""),
-      );
-    } else {
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(
-        [
-          "<!doctype html>",
-          '<html><head><meta charset="utf-8"><title>TokenTracker</title></head>',
-          "<body>",
-          "<h2>Login succeeded</h2>",
-          "<p>You can close this tab and return to the CLI.</p>",
-          "</body></html>",
-        ].join(""),
-      );
-    }
-    resolveResult({
-      accessToken,
-      userId: url.searchParams.get("user_id") || null,
-      email: url.searchParams.get("email") || null,
-      name: url.searchParams.get("name") || null,
-    });
-  });
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve);
-  });
-  const addr = server.address();
-  const port = typeof addr === "object" && addr ? addr.port : null;
-  if (!port) {
-    server.close();
-    throw new Error("Failed to bind local callback server");
-  }
-  const callbackUrl = `http://127.0.0.1:${port}${callbackPath}`;
-  const timer = setTimeout(() => {
-    if (resolved) return;
-    resolved = true;
-    rejectResult(new Error("Authentication timed out"));
-    server.close();
-  }, timeoutMs);
-  async function waitForCallback() {
-    try {
-      return await resultPromise;
-    } finally {
-      clearTimeout(timer);
-      server.close();
-    }
-  }
-  return { callbackUrl, waitForCallback };
-}
 function detectDefaultBrowser() {
   try {
     const raw = cp.execFileSync("defaults", [
@@ -285,23 +155,7 @@ end if
   spawnBrowserCommand(cmd, args, { url, platform, stderr });
 }
-function resolvePostAuthRedirect({ dashboardUrl, authUrl }) {
-  try {
-    if (dashboardUrl) {
-      const target = new URL("/", dashboardUrl);
-      if (target.protocol === "http:" || target.protocol === "https:") {
-        return target.toString();
-      }
-      return null;
-    }
-  } catch (_e) {
-    return null;
-  }
-  return null;
-}
 module.exports = {
-  beginBrowserAuth,
   openInBrowser,
   buildBrowserOpenErrorMessage,
   spawnBrowserCommand,

package/src/lib/claude-categorizer.js CHANGED Viewed

@@ -28,6 +28,7 @@ const {
   allocateByLargestRemainder,
 } = require("./categorizer-utils");
 const { claudeMessageDedupKey } = require("./rollout");
+const { fileIdentity, isUnchanged } = require("./file-identity");
 const CATEGORY_KEYS = [
   "system_prefix",
@@ -494,12 +495,40 @@ function classifyOneMessage(obj, sessionState, breakdown, toolLedger = null, ski
 }
 // Read one session jsonl streaming, in timestamp range, dedup by msgId+reqId.
-async function categorizeSessionFile(filePath, { fromIso, toIso, seenHashes }, breakdown, toolLedger = null, skillLedger = null, execLedger = null) {
+// Parses one file into its OWN accumulators and returns them, rather than
+// mutating shared ones. That is what makes a per-file cache possible: the
+// result depends only on (file contents, fromIso, toIso), so it can be reused
+// whenever the file has not changed.
+//
+// The dedup set is now file-local. Cross-file duplicates are handled by the
+// caller, which detects them and falls back to a full scan — see
+// mergeFileResult. Intra-file dedup, including the deferred-add behavior
+// below, is unchanged and must stay that way.
+// `sharedSeen` is used only by the collision fallback, which needs the old
+// cross-file dedup semantics. When it is passed, the returned `hashes` list is
+// empty because dedup has already been applied globally.
+async function categorizeSessionFile(filePath, { fromIso, toIso, sharedSeen = null }) {
+  const breakdown = emptyCategoryMap();
+  const toolLedger = {
+    tool_calls: { total_calls: 0, by_name: new Map() },
+    subagents: { total_calls: 0, by_name: new Map() },
+  };
+  const skillLedger = { total_calls: 0, by_name: new Map() };
+  const execLedger = {
+    total_calls: 0,
+    by_type: new Map(),
+    by_executable: new Map(),
+    by_command: new Map(),
+    by_exit: new Map(),
+  };
+  const seenHashes = sharedSeen || new Set();
+  const empty = () => ({ breakdown, toolLedger, skillLedger, execLedger, counted: 0, hashes: [] });
   let stream;
   try {
     stream = fssync.createReadStream(filePath, { encoding: "utf8" });
   } catch (_e) {
-    return 0;
+    return empty();
   }
   const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
   const sessionState = { systemPrefixSeen: false };
@@ -538,7 +567,14 @@ async function categorizeSessionFile(filePath, { fromIso, toIso, seenHashes }, b
   }
   rl.close();
   stream.close?.();
-  return counted;
+  return {
+    breakdown,
+    toolLedger,
+    skillLedger,
+    execLedger,
+    counted,
+    hashes: sharedSeen ? [] : [...seenHashes],
+  };
 }
 // Convert a YYYY-MM-DD day key (already in the user's tz from the API call)
@@ -624,6 +660,99 @@ function maxMtimeMs(files) {
   return max;
 }
+// Per-file parse cache. See the equivalent in codex-context-breakdown.js —
+// same problem (#62), same two-layer shape: the aggregate cache above stays
+// the fast path, and this only decides how expensive a MISS is.
+const FILE_CACHE = new Map();
+const FILE_CACHE_SCHEMA_VERSION = "claude-category-file-v1";
+const FILE_CACHE_MAX_ENTRIES = 8_000;
+// Instrumentation is opt-in: without it a long-running server would grow one
+// Map entry per session file forever, purely to serve tests.
+let trackParses = false;
+const parseCounts = new Map();
+function fileCacheKey(fromIso, toIso, filePath) {
+  return `${FILE_CACHE_SCHEMA_VERSION}|${fromIso || ""}|${toIso || ""}|${filePath}`;
+}
+function pruneFileCache() {
+  if (FILE_CACHE.size <= FILE_CACHE_MAX_ENTRIES) return;
+  let excess = FILE_CACHE.size - FILE_CACHE_MAX_ENTRIES;
+  for (const key of FILE_CACHE.keys()) {
+    FILE_CACHE.delete(key);
+    if (--excess <= 0) break;
+  }
+}
+// These fields are high-water marks, not running sums. Adding them would
+// silently inflate the reported worst case.
+const MAX_MERGE_FIELDS = new Set(["max_duration_ms"]);
+// Folds one cached row into an accumulator map. Always builds a fresh target
+// object on first insert: putting a cached row in by reference would let a
+// later merge mutate the cache in place, which is the aliasing hazard that
+// per-file caching introduces.
+function mergeRowInto(targetMap, key, row) {
+  const existing = targetMap.get(key);
+  if (!existing) {
+    targetMap.set(key, { ...row, totals: { ...row.totals } });
+    return;
+  }
+  for (const [field, value] of Object.entries(row)) {
+    if (field === "totals") {
+      addInto(existing.totals, value);
+    } else if (typeof value === "number") {
+      existing[field] = MAX_MERGE_FIELDS.has(field)
+        ? Math.max(existing[field] || 0, value)
+        : (existing[field] || 0) + value;
+    } else if (existing[field] === undefined) {
+      existing[field] = value;
+    }
+  }
+}
+function mergeNamedLedger(target, source) {
+  target.total_calls += source.total_calls || 0;
+  for (const [name, row] of source.by_name) mergeRowInto(target.by_name, name, row);
+}
+// Returns false when this file shares a dedup hash with one already merged.
+// Such a collision cannot be repaired from aggregates: the deduped message's
+// tokens are missing, and worse, systemPrefixSeen may have latched onto a
+// different message, invalidating the whole per-file result rather than one
+// row. The caller re-runs a full sequential scan instead of patching.
+function mergeFileResult(acc, result, globalHashes) {
+  for (const hash of result.hashes) {
+    if (globalHashes.has(hash)) return false;
+    globalHashes.add(hash);
+  }
+  for (const key of CATEGORY_KEYS) addInto(acc.breakdown[key], result.breakdown[key]);
+  mergeNamedLedger(acc.toolLedger.tool_calls, result.toolLedger.tool_calls);
+  mergeNamedLedger(acc.toolLedger.subagents, result.toolLedger.subagents);
+  mergeNamedLedger(acc.skillLedger, result.skillLedger);
+  acc.execLedger.total_calls += result.execLedger.total_calls || 0;
+  for (const bucket of ["by_type", "by_executable", "by_command", "by_exit"]) {
+    for (const [name, row] of result.execLedger[bucket]) {
+      mergeRowInto(acc.execLedger[bucket], name, row);
+    }
+  }
+  acc.messageCount += result.counted;
+  if (result.counted > 0) acc.sessionCount += 1;
+  return true;
+}
+function __resetCategoryCachesForTests() {
+  trackParses = true;
+  CACHE.clear();
+  FILE_CACHE.clear();
+  parseCounts.clear();
+}
+function __getCategoryParseCountsForTests() {
+  return new Map(parseCounts);
+}
 async function computeClaudeCategoryBreakdown({ from = null, to = null, rootDir = null, projectDir = null } = {}) {
   const root = rootDir || defaultClaudeProjectsDir();
   let files = [];
@@ -656,49 +785,90 @@ async function computeClaudeCategoryBreakdown({ from = null, to = null, rootDir
   }
   const { fromIso, toIso } = dayKeyToIsoBounds(from, to);
-  const breakdown = emptyCategoryMap();
-  const seenHashes = new Set();
-  let messageCount = 0;
-  let sessionCount = 0;
-  const toolLedger = {
-    tool_calls: { total_calls: 0, by_name: new Map() },
-    subagents: { total_calls: 0, by_name: new Map() },
-  };
-  const skillLedger = { total_calls: 0, by_name: new Map() };
-  const execLedger = {
-    total_calls: 0,
-    by_type: new Map(),
-    by_executable: new Map(),
-    by_command: new Map(),
-    by_exit: new Map(),
-  };
+  function newAccumulator() {
+    return {
+      breakdown: emptyCategoryMap(),
+      toolLedger: {
+        tool_calls: { total_calls: 0, by_name: new Map() },
+        subagents: { total_calls: 0, by_name: new Map() },
+      },
+      skillLedger: { total_calls: 0, by_name: new Map() },
+      execLedger: {
+        total_calls: 0,
+        by_type: new Map(),
+        by_executable: new Map(),
+        by_command: new Map(),
+        by_exit: new Map(),
+      },
+      messageCount: 0,
+      sessionCount: 0,
+    };
+  }
   // Process files with bounded parallelism. CPU-bound (JSON.parse per line)
   // limits the win, but overlapping the per-file fs.open + first-block read
   // I/O behind the previous file's parsing still shaves ~15% off cold scans.
-  // `seenHashes`/`breakdown`/ledgers are mutated only inside synchronous
-  // sections of `classifyOneMessage`; `for await` in `categorizeSessionFile`
-  // only yields between lines, so workers can't tear shared state.
+  // Each parse now owns its accumulators, so there is no shared state to tear
+  // — and an unchanged file skips the parse entirely (#62).
   const SCAN_CONCURRENCY = 4;
+  const results = new Array(files.length);
   let cursor = 0;
   async function worker() {
     while (cursor < files.length) {
       const idx = cursor++;
       if (idx >= files.length) return;
-      const counted = await categorizeSessionFile(
-        files[idx],
-        { fromIso, toIso, seenHashes },
-        breakdown,
-        toolLedger,
-        skillLedger,
-        execLedger,
-      );
-      if (counted > 0) sessionCount += 1;
-      messageCount += counted;
+      const filePath = files[idx];
+      const key = fileCacheKey(fromIso, toIso, filePath);
+      const identity = fileIdentity(filePath);
+      const hit = FILE_CACHE.get(key);
+      if (hit && isUnchanged(hit.identity, identity)) {
+        results[idx] = hit.result;
+        continue;
+      }
+      if (trackParses) parseCounts.set(filePath, (parseCounts.get(filePath) || 0) + 1);
+      const result = await categorizeSessionFile(filePath, { fromIso, toIso });
+      results[idx] = result;
+      if (identity) {
+        FILE_CACHE.set(key, { identity, result });
+        pruneFileCache();
+      }
     }
   }
   await Promise.all(Array.from({ length: SCAN_CONCURRENCY }, () => worker()));
+  // Merge in `files` order rather than completion order, so the result no
+  // longer depends on how the four workers happened to interleave.
+  let acc = newAccumulator();
+  const globalHashes = new Set();
+  let composable = true;
+  for (const result of results) {
+    if (!result) continue;
+    if (!mergeFileResult(acc, result, globalHashes)) {
+      composable = false;
+      break;
+    }
+  }
+  if (!composable) {
+    // Two files claimed the same dedup hash, so per-file results overlap and
+    // cannot be summed. Redo the scan sequentially with one shared dedup set,
+    // which is exactly the pre-cache behavior. Expected never to happen: a
+    // scan of 6,529 real session files found 0 cross-file duplicates. Kept so
+    // correctness does not rest on that measurement.
+    acc = newAccumulator();
+    const sharedSeen = new Set();
+    const fallbackHashes = new Set();
+    for (const filePath of files) {
+      const result = await categorizeSessionFile(filePath, { fromIso, toIso, sharedSeen });
+      if (trackParses) parseCounts.set(filePath, (parseCounts.get(filePath) || 0) + 1);
+      mergeFileResult(acc, result, fallbackHashes);
+    }
+  }
+  const { breakdown, toolLedger, skillLedger, execLedger } = acc;
+  const messageCount = acc.messageCount;
+  const sessionCount = acc.sessionCount;
   const totals = emptyTotals();
   for (const key of CATEGORY_KEYS) addInto(totals, breakdown[key]);
@@ -1306,6 +1476,8 @@ async function computeClaudeGroundTruthBuckets({ rootDir = null } = {}) {
 }
 module.exports = {
+  __resetCategoryCachesForTests,
+  __getCategoryParseCountsForTests,
   CATEGORY_KEYS,
   computeClaudeCategoryBreakdown,
   computeClaudeGroundTruthBuckets,

package/src/lib/codex-context-breakdown.js CHANGED Viewed

@@ -14,6 +14,8 @@ const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
+const { fileIdentity, isUnchanged } = require("./file-identity");
 const {
   emptyTotals,
   addInto,
@@ -139,6 +141,59 @@ function cacheTimeZoneKey(timeZoneContext) {
   return `${timeZoneContext.timeZone || ""}|${Number.isFinite(timeZoneContext.offsetMinutes) ? timeZoneContext.offsetMinutes : ""}`;
 }
+// Per-file parse cache.
+//
+// The aggregate cache above keys on the GLOBAL maximum mtime, so appending to
+// the one session that is currently active invalidates the aggregate for every
+// unchanged historical file and forces a full rescan (issue #62). This layer
+// makes that miss cost one file instead of all of them.
+//
+// `top` is deliberately absent from the key: truncation to the top N happens
+// at merge time, so a single cached per-file parse serves every `top` value.
+const FILE_CACHE = new Map();
+const FILE_CACHE_SCHEMA_VERSION = "codex-context-file-v1";
+// Roughly one entry per session file per (range, timezone) combination the
+// dashboard asks for. Entries are small — one parsed rollup, no line data.
+const FILE_CACHE_MAX_ENTRIES = 8_000;
+// Counts parses per file so tests can assert an unchanged file was NOT
+// reparsed. Observing the actual claim beats spying on the filesystem, which
+// would also catch the identity check's own 256-byte read.
+let trackParses = false;
+const parseCounts = new Map();
+function fileCacheKey({ fromKey, toKey, timeZoneContext, filePath }) {
+  return [
+    FILE_CACHE_SCHEMA_VERSION,
+    fromKey || "",
+    toKey || "",
+    cacheTimeZoneKey(timeZoneContext),
+    filePath,
+  ].join("|");
+}
+function pruneFileCache() {
+  if (FILE_CACHE.size <= FILE_CACHE_MAX_ENTRIES) return;
+  const excess = FILE_CACHE.size - FILE_CACHE_MAX_ENTRIES;
+  let removed = 0;
+  // Map iterates in insertion order, so this drops the least recently stored.
+  for (const key of FILE_CACHE.keys()) {
+    FILE_CACHE.delete(key);
+    if (++removed >= excess) break;
+  }
+}
+function __resetContextCachesForTests() {
+  trackParses = true;
+  CACHE.clear();
+  FILE_CACHE.clear();
+  parseCounts.clear();
+}
+function __getParseCountsForTests() {
+  return new Map(parseCounts);
+}
 // ---------------------------------------------------------------------------
 // Main entry
 // ---------------------------------------------------------------------------
@@ -182,13 +237,32 @@ async function computeCodexContextBreakdown({
   const sessions = [];
   for (const filePath of files) {
-    const parsed = await parseCodexRolloutFile(filePath, {
-      fromIso,
-      toIso,
-      from: fromKey,
-      to: toKey,
-      timeZoneContext,
-    });
+    const key = fileCacheKey({ fromKey, toKey, timeZoneContext, filePath });
+    const identity = fileIdentity(filePath);
+    const hit = FILE_CACHE.get(key);
+    let parsed;
+    if (hit && isUnchanged(hit.identity, identity)) {
+      parsed = hit.parsed;
+    } else {
+      if (trackParses) parseCounts.set(filePath, (parseCounts.get(filePath) || 0) + 1);
+      parsed = await parseCodexRolloutFile(filePath, {
+        fromIso,
+        toIso,
+        from: fromKey,
+        to: toKey,
+        timeZoneContext,
+      });
+      // A null identity means the path is not a readable regular file right
+      // now; caching against it could never be invalidated correctly.
+      if (identity) {
+        FILE_CACHE.set(key, { identity, parsed });
+        pruneFileCache();
+      }
+    }
+    // Re-applied on every pass rather than baked into the cached entry, so a
+    // zero-token file has one representation instead of two.
     if (!parsed || !parsed.totals || !parsed.totals.total_tokens) continue;
     sessions.push(parsed);
   }
@@ -397,4 +471,6 @@ async function computeCodexContextBreakdown({
 module.exports = {
   computeCodexContextBreakdown,
+  __resetContextCachesForTests,
+  __getParseCountsForTests,
 };

package/src/lib/codex-rollout-parser.js CHANGED Viewed

@@ -349,6 +349,15 @@ async function parseCodexRolloutFile(filePath, { fromIso, toIso, from = null, to
   let pendingSkills = [];
   let pendingExecEnds = []; // exec_command_end payloads since last token_count
+  // Codex subagent-fork replay handling (issue #75). A rollout spawned via
+  // session_meta.source.subagent.thread_spawn replays the parent thread's
+  // history before an "inter_agent_communication_metadata" boundary. While in
+  // replay we advance the delta baseline but do not attribute anything, so the
+  // context breakdown reflects only the genuine child turns. Whole-file read,
+  // so no cross-call cursor is needed — a boundary-less (partial) fork simply
+  // stays in replay and contributes nothing.
+  let accounting = true;
   const totals = emptyTotals();
   const byTool = new Map(); // tool_name -> {name,calls,totals}
   const bySkill = new Map(); // skill_name -> {name,calls,totals}
@@ -525,20 +534,36 @@ async function parseCodexRolloutFile(filePath, { fromIso, toIso, from = null, to
     } catch {
       continue;
     }
-    const ts = typeof obj?.timestamp === "string" ? obj.timestamp : null;
-    if (!ts) continue;
-    if (fromIso && ts < fromIso) continue;
-    if (toIso && ts > toIso) continue;
-    if (!isTimestampInRequestedDayRange(ts, { from, to, timeZoneContext })) continue;
+    // Stateful fork-control records are handled BEFORE any timestamp/date
+    // filtering. They must never be dropped by a query window: if a date filter
+    // removed the boundary while keeping replay records on one side of it, the
+    // replayed parent history would leak back into the child's totals (the exact
+    // #75 overcount). This mirrors the pre-gate ordering in rollout.js.
     if (obj.type === "session_meta") {
       const p = obj.payload || {};
       sessionId = p.id || sessionId;
       cwd = p.cwd || cwd;
       cliVersion = p.cli_version || cliVersion;
       provider = p.model_provider || provider;
+      if (p.source?.subagent?.thread_spawn) accounting = false;
+      continue;
+    }
+    // Boundary between replayed parent history and genuine child turns.
+    if (obj.type === "inter_agent_communication_metadata") {
+      accounting = true;
+      pendingCalls = [];
+      pendingSkills = [];
+      pendingExecEnds = [];
+      continue;
     }
+    const ts = typeof obj?.timestamp === "string" ? obj.timestamp : null;
+    if (!ts) continue;
+    if (fromIso && ts < fromIso) continue;
+    if (toIso && ts > toIso) continue;
+    if (!isTimestampInRequestedDayRange(ts, { from, to, timeZoneContext })) continue;
     if (obj.type === "turn_context") {
       const p = obj.payload || {};
       if (typeof p.cwd === "string") cwd = p.cwd;
@@ -547,14 +572,17 @@ async function parseCodexRolloutFile(filePath, { fromIso, toIso, from = null, to
     }
     if (obj.type === "response_item" && obj.payload?.type === "function_call") {
-      pendingCalls.push(obj.payload);
-      const skill = extractSkillNameFromFunctionCall(obj.payload);
-      if (skill) pendingSkills.push(skill);
+      // Skip replayed parent tool calls; only child turns are attributed.
+      if (accounting) {
+        pendingCalls.push(obj.payload);
+        const skill = extractSkillNameFromFunctionCall(obj.payload);
+        if (skill) pendingSkills.push(skill);
+      }
       continue;
     }
     if (obj.type === "event_msg" && obj.payload?.type === "exec_command_end") {
-      pendingExecEnds.push(obj.payload);
+      if (accounting) pendingExecEnds.push(obj.payload);
       continue;
     }
@@ -564,7 +592,11 @@ async function parseCodexRolloutFile(filePath, { fromIso, toIso, from = null, to
       const lastUsage = info?.last_token_usage;
       const totalUsage = info?.total_token_usage;
       const delta = pickDelta(lastUsage, totalUsage, prevTotals);
+      // Advance the delta baseline through replay so the first child delta is
+      // measured from the last replayed cumulative, but do not attribute the
+      // replayed parent history to this child.
       if (totalUsage && typeof totalUsage === "object") prevTotals = totalUsage;
+      if (!accounting) continue;
       if (delta) attributeTurn(delta);
       continue;
     }
@@ -573,6 +605,16 @@ async function parseCodexRolloutFile(filePath, { fromIso, toIso, from = null, to
   rl.close();
   stream.close?.();
+  // Saw a subagent fork but never its boundary: the whole file was treated as
+  // replay and contributes nothing. Safe (never over-count) but silent —
+  // surface it under debug so a malformed/renamed boundary is diagnosable.
+  if (!accounting && process.env.TOKENTRACKER_DEBUG) {
+    process.stderr.write(
+      `[codex-fork] ${filePath}: subagent fork with no ` +
+        `inter_agent_communication_metadata boundary; context breakdown empty\n`,
+    );
+  }
   return {
     sessionId,
     cwd,