@node9/proxy 1.32.0 → 1.34.0

package/dist/dashboard.mjs

@@ -244,6 +244,8 @@ function normalizeCommandForPolicyImpl(command) {
   if (f === PARSE_FAIL) return command;
   try {
     const strips = [];
+    const rewrites = [];
+    const msgSpans = /* @__PURE__ */ new Set();
     syntax.Walk(f, (node) => {
       if (!node) return false;
       const n = node;
@@ -259,25 +261,46 @@ function normalizeCommandForPolicyImpl(command) {
         if (nextParts.length !== 1) continue;
         const quotedNode = nextParts[0];
         const nt = syntax.NodeType(quotedNode);
+        const markStrip = () => {
+          const s = next.Pos().Offset();
+          const e = next.End().Offset();
+          strips.push([s, e]);
+          msgSpans.add(`${s}:${e}`);
+        };
         if (nt === "SglQuoted") {
-          strips.push([next.Pos().Offset(), next.End().Offset()]);
+          markStrip();
         } else if (nt === "DblQuoted") {
           const innerParts = quotedNode.Parts || [];
           const allLit = innerParts.length === 0 || innerParts.every((p) => syntax.NodeType(p) === "Lit");
           if (allLit) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           } else if (innerParts.every((p) => isCatHeredocOrLit(p))) {
-            strips.push([next.Pos().Offset(), next.End().Offset()]);
+            markStrip();
           }
         }
       }
+      for (const arg of args) {
+        const s = arg.Pos().Offset();
+        const e = arg.End().Offset();
+        if (msgSpans.has(`${s}:${e}`)) continue;
+        const resolved = resolveWordLiteral(arg);
+        if (resolved === null) continue;
+        const source = command.slice(s, e);
+        if (resolved === source) continue;
+        if (resolved === "" || /\s/.test(resolved)) continue;
+        rewrites.push([s, e, resolved]);
+      }
       return true;
     });
-    if (strips.length === 0) return command;
-    strips.sort((a, b) => b[0] - a[0]);
+    const edits = [
+      ...strips.map(([s, e]) => [s, e, '""']),
+      ...rewrites
+    ];
+    if (edits.length === 0) return command;
+    edits.sort((a, b) => b[0] - a[0]);
     let result = command;
-    for (const [start, end] of strips) {
-      result = result.slice(0, start) + '""' + result.slice(end);
+    for (const [s, e, rep] of edits) {
+      result = result.slice(0, s) + rep + result.slice(e);
     }
     return result;
   } catch {
@@ -386,20 +409,38 @@ function extractLiteralArgs(callExpr) {
   }
   return { name, flags, paths };
 }
+function resolveWordLiteral(w) {
+  const parts = w?.Parts || [];
+  let s = "";
+  for (const p of parts) {
+    const t = syntax.NodeType(p);
+    if (t === "Lit") s += (p.Value ?? "").replace(/\\(.)/g, "$1");
+    else if (t === "SglQuoted") s += p.Value ?? "";
+    else if (t === "DblQuoted") {
+      const inner = p.Parts || [];
+      if (!inner.every((ip) => syntax.NodeType(ip) === "Lit")) return null;
+      s += inner.map((ip) => ip.Value ?? "").join("");
+    } else {
+      return null;
+    }
+  }
+  return s;
+}
 function analyzeFsOperation(command) {
-  if (!FS_OP_PRESCREEN_RE.test(command)) return null;
-  if (fsOpCache.has(command)) {
-    const hit = fsOpCache.get(command) ?? null;
-    fsOpCache.delete(command);
-    fsOpCache.set(command, hit);
+  const normalized = normalizeCommandForPolicy(command);
+  if (!FS_OP_PRESCREEN_RE.test(normalized)) return null;
+  if (fsOpCache.has(normalized)) {
+    const hit = fsOpCache.get(normalized) ?? null;
+    fsOpCache.delete(normalized);
+    fsOpCache.set(normalized, hit);
     return hit;
   }
-  const computed = analyzeFsOperationImpl(command);
+  const computed = analyzeFsOperationImpl(normalized);
   if (fsOpCache.size >= FS_OP_CACHE_MAX) {
     const oldest = fsOpCache.keys().next().value;
     if (oldest !== void 0) fsOpCache.delete(oldest);
   }
-  fsOpCache.set(command, computed);
+  fsOpCache.set(normalized, computed);
   return computed;
 }
 function analyzeFsOperationImpl(command) {
@@ -506,9 +547,9 @@ function matchesPattern(text, patterns) {
   const withoutDotSlash = text.replace(/^\.\//, "");
   return isMatch(withoutDotSlash) || isMatch(`./${withoutDotSlash}`);
 }
-function getNestedValue(obj, path9) {
+function getNestedValue(obj, path10) {
   if (!obj || typeof obj !== "object") return null;
-  const segments = path9.split(".");
+  const segments = path10.split(".");
   for (const seg of segments) {
     if (FORBIDDEN_PATH_SEGMENTS.has(seg)) return null;
   }
@@ -1219,7 +1260,11 @@ var init_dist = __esm({
       "shield:project-jail:block-read-ssh",
       "shield:project-jail:block-read-aws",
       "shield:project-jail:block-read-env",
-      "shield:project-jail:review-read-credentials"
+      "shield:project-jail:review-read-credentials",
+      // SQL-DDL is now owned by the AST detector (analyzeSqlDestructive) so the
+      // raw-regex smart rule is suppressed for bash — its cond1 read a grep
+      // alternation's `|` as a shell pipe (`grep "…|mysql…"` → false positive).
+      "review-drop-truncate-shell"
     ]);
     FS_OP_CACHE_MAX = 5e3;
     fsOpCache = /* @__PURE__ */ new Map();
@@ -2585,13 +2630,116 @@ var init_audit = __esm({
 });
 
 // src/pricing/litellm.ts
+import fs4 from "fs";
+import path5 from "path";
+import os5 from "os";
 function normalizeModel(raw) {
   return raw.replace(/-\d{8}$/, "").toLowerCase();
 }
+function readCache() {
+  try {
+    const raw = JSON.parse(fs4.readFileSync(CACHE_FILE(), "utf-8"));
+    if (typeof raw.fetchedAt !== "string" || typeof raw.prices !== "object" || raw.prices === null) {
+      return null;
+    }
+    const ageMs = Date.now() - new Date(raw.fetchedAt).getTime();
+    if (ageMs < 0 || ageMs > TTL_MS) return null;
+    return raw.prices;
+  } catch {
+    return null;
+  }
+}
+function writeCache(prices) {
+  try {
+    const target = CACHE_FILE();
+    const dir = path5.dirname(target);
+    if (!fs4.existsSync(dir)) fs4.mkdirSync(dir, { recursive: true });
+    const tmp = target + ".tmp";
+    const body = {
+      fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      prices
+    };
+    fs4.writeFileSync(tmp, JSON.stringify(body) + "\n", "utf-8");
+    fs4.renameSync(tmp, target);
+  } catch (err) {
+    try {
+      fs4.appendFileSync(
+        HOOK_DEBUG_LOG,
+        `[pricing] cache write failed: ${err.message}
+`
+      );
+    } catch {
+    }
+  }
+}
+function tupleFromLiteLLM(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  const e = entry;
+  const num2 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0;
+  const inCost = num2(e.input_cost_per_token);
+  const outCost = num2(e.output_cost_per_token);
+  if (inCost === 0 && outCost === 0) return null;
+  return [
+    inCost,
+    outCost,
+    num2(e.cache_creation_input_token_cost),
+    num2(e.cache_read_input_token_cost)
+  ];
+}
+async function fetchLiteLLMPricing() {
+  try {
+    const res = await fetch(LITELLM_URL, {
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!res.ok) return null;
+    const json = await res.json();
+    if (!json || typeof json !== "object") return null;
+    const out = {};
+    for (const [key, value] of Object.entries(json)) {
+      const tuple = tupleFromLiteLLM(value);
+      if (tuple) out[key.toLowerCase()] = tuple;
+    }
+    if (Object.keys(out).length < 10) {
+      return null;
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+async function ensurePricingLoaded() {
+  if (memCache !== null && Date.now() - memCacheAt < TTL_MS) return;
+  const fromDisk = readCache();
+  if (fromDisk && Object.keys(fromDisk).length > 0) {
+    memCache = fromDisk;
+    memCacheAt = Date.now();
+    lookupCache.clear();
+    return;
+  }
+  const fetched = await fetchLiteLLMPricing();
+  if (fetched && Object.keys(fetched).length > 0) {
+    memCache = fetched;
+    memCacheAt = Date.now();
+    writeCache(fetched);
+    lookupCache.clear();
+    return;
+  }
+  memCache = { ...BUNDLED_PRICING };
+  memCacheAt = Date.now();
+  lookupCache.clear();
+}
 function pricingFor(model) {
   const norm = normalizeModel(model);
   const cached = lookupCache.get(norm);
   if (cached !== void 0) return cached;
+  if (memCache === null && !diskChecked) {
+    diskChecked = true;
+    const disk = readCache();
+    if (disk && Object.keys(disk).length > 0) {
+      memCache = disk;
+      memCacheAt = Date.now();
+    }
+  }
   const sources = [];
   if (memCache) sources.push(memCache);
   sources.push(BUNDLED_PRICING);
@@ -2616,11 +2764,12 @@ function pricingFor(model) {
   lookupCache.set(norm, resolved);
   return resolved;
 }
-var BUNDLED_PRICING, TTL_MS, memCache, lookupCache;
+var LITELLM_URL, BUNDLED_PRICING, CACHE_FILE, TTL_MS, memCache, memCacheAt, diskChecked, lookupCache;
 var init_litellm = __esm({
   "src/pricing/litellm.ts"() {
     "use strict";
     init_audit();
+    LITELLM_URL = "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json";
     BUNDLED_PRICING = {
       // Anthropic
       "claude-opus-4": [5e-6, 25e-6, 625e-8, 5e-7],
@@ -2637,25 +2786,80 @@ var init_litellm = __esm({
       "claude-3-5-sonnet": [3e-6, 15e-6, 375e-8, 3e-7],
       "claude-3-5-haiku": [8e-7, 4e-6, 1e-6, 8e-8],
       "claude-3-haiku": [25e-8, 125e-8, 3e-7, 3e-8],
-      // OpenAI
+      // OpenAI. gpt-5 family + o-series copied from the live LiteLLM table
+      // (verified 2026-06-14) — the bundled gpt-5 was stale at $10/$30 vs the real
+      // $1.25/$10, and Codex models (gpt-5-codex etc.) were absent, so the offline
+      // fallback mispriced every Codex session. See cost-codex.codexPriceFor.
       "gpt-4o": [5e-6, 15e-6, 0, 25e-7],
       "gpt-4o-mini": [15e-8, 6e-7, 0, 75e-9],
-      "gpt-5": [1e-5, 3e-5, 0, 5e-6],
-      // Google
+      "gpt-5": [125e-8, 1e-5, 0, 125e-9],
+      "gpt-5-codex": [125e-8, 1e-5, 0, 125e-9],
+      "gpt-5-mini": [25e-8, 2e-6, 0, 25e-9],
+      o3: [2e-6, 8e-6, 0, 5e-7],
+      "o4-mini": [11e-7, 44e-7, 0, 275e-9],
+      // Google. Values copied from the live LiteLLM table (verified 2026-06-14)
+      // so the bundled fallback prices the current Gemini tiers correctly offline
+      // — the local cost readers were carrying a stale hardcoded copy where
+      // gemini-2.5-flash read $0.15/$0.60 vs the real $0.30/$2.50 (~4× under on
+      // output). See cost-gemini.geminiPriceFor (the single Gemini price source).
+      "gemini-2.5-pro": [125e-8, 1e-5, 0, 125e-9],
+      "gemini-2.5-flash": [3e-7, 25e-7, 0, 3e-8],
       "gemini-2.0-flash": [75e-9, 3e-7, 0, 0],
       "gemini-1.5-pro": [125e-8, 5e-6, 0, 0]
     };
+    CACHE_FILE = () => path5.join(os5.homedir(), ".node9", "model-pricing.json");
     TTL_MS = 24 * 60 * 60 * 1e3;
     memCache = null;
+    memCacheAt = 0;
+    diskChecked = false;
     lookupCache = /* @__PURE__ */ new Map();
   }
 });
 
 // src/cost-codex.ts
+function codexPriceFor(model) {
+  return pricingFor(model) ?? CODEX_FALLBACK;
+}
+function codexSessionCost(model, tokens) {
+  const nonCached = Math.max(0, tokens.input - tokens.cached);
+  const [pin, pout, , pcr] = codexPriceFor(model || "gpt-5");
+  return nonCached * pin + tokens.cached * pcr + tokens.output * pout;
+}
+var CODEX_FALLBACK;
 var init_cost_codex = __esm({
   "src/cost-codex.ts"() {
     "use strict";
     init_litellm();
+    CODEX_FALLBACK = [5e-6, 15e-6, 0, 25e-7];
+  }
+});
+
+// src/cost-gemini.ts
+function geminiPriceFor(model) {
+  let tuple = pricingFor(model);
+  if (!tuple && /^gemini-/i.test(model)) {
+    for (const proxy of GEMINI_FALLBACK_MODELS) {
+      tuple = pricingFor(proxy);
+      if (tuple) break;
+    }
+  }
+  if (!tuple) return null;
+  return { input: tuple[0], output: tuple[1], cacheRead: tuple[3] || tuple[0] };
+}
+var GEMINI_FALLBACK_MODELS;
+var init_cost_gemini = __esm({
+  "src/cost-gemini.ts"() {
+    "use strict";
+    init_litellm();
+    GEMINI_FALLBACK_MODELS = ["gemini-2.5-flash", "gemini-2.0-flash"];
+  }
+});
+
+// src/cost-copilot.ts
+var init_cost_copilot = __esm({
+  "src/cost-copilot.ts"() {
+    "use strict";
+    init_litellm();
   }
 });
 
@@ -2671,6 +2875,8 @@ var init_costSync = __esm({
     init_audit();
     init_litellm();
     init_cost_codex();
+    init_cost_gemini();
+    init_cost_copilot();
     SYNC_INTERVAL_MS = 10 * 60 * 1e3;
   }
 });
@@ -2687,9 +2893,9 @@ var init_scan_watermark = __esm({
 });
 
 // src/cli/aggregate/report-audit.ts
-import fs4 from "fs";
-import os5 from "os";
-import path5 from "path";
+import fs5 from "fs";
+import os6 from "os";
+import path6 from "path";
 function buildTestTimestamps(allEntries) {
   const testTs = /* @__PURE__ */ new Set();
   for (const e of allEntries) {
@@ -2770,8 +2976,8 @@ function getDateRange(period, now) {
   }
 }
 function parseAuditLog(logPath) {
-  if (!fs4.existsSync(logPath)) return [];
-  const raw = fs4.readFileSync(logPath, "utf-8");
+  if (!fs5.existsSync(logPath)) return [];
+  const raw = fs5.readFileSync(logPath, "utf-8");
   return raw.split("\n").flatMap((line) => {
     if (!line.trim()) return [];
     try {
@@ -2788,11 +2994,10 @@ function isDlp(checkedBy) {
   return !!checkedBy?.includes("dlp");
 }
 function claudeModelPrice(model) {
-  const base = model.replace(/@.*$/, "").replace(/-\d{8}$/, "");
-  for (const [key, p] of Object.entries(CLAUDE_PRICING)) {
-    if (base === key || base.startsWith(key + "-") || base.startsWith(key)) return p;
-  }
-  return null;
+  const t = pricingFor(model);
+  if (!t) return null;
+  const [i, o, cw, cr] = t;
+  return { i, o, cw, cr };
 }
 function emptyClaudeCostAccumulator() {
   return {
@@ -2819,25 +3024,25 @@ function freezeClaudeCost(acc) {
   };
 }
 function processClaudeCostProject(proj, projectsDir, start, end, acc) {
-  const projPath = path5.join(projectsDir, proj);
+  const projPath = path6.join(projectsDir, proj);
   let files;
   try {
-    const stat = fs4.statSync(projPath);
+    const stat = fs5.statSync(projPath);
     if (!stat.isDirectory()) return;
-    files = fs4.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
+    files = fs5.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
   } catch {
     return;
   }
   const startMs = start.getTime();
   for (const file of files) {
-    const filePath = path5.join(projPath, file);
+    const filePath = path6.join(projPath, file);
     try {
-      if (fs4.statSync(filePath).mtimeMs < startMs) continue;
+      if (fs5.statSync(filePath).mtimeMs < startMs) continue;
     } catch {
       continue;
     }
     try {
-      const raw = fs4.readFileSync(filePath, "utf-8");
+      const raw = fs5.readFileSync(filePath, "utf-8");
       for (const line of raw.split("\n")) {
         if (!line.trim()) continue;
         let entry;
@@ -2887,10 +3092,10 @@ function processClaudeCostProject(proj, projectsDir, start, end, acc) {
 }
 function loadClaudeCost(start, end, projectsDir) {
   const acc = emptyClaudeCostAccumulator();
-  if (!fs4.existsSync(projectsDir)) return freezeClaudeCost(acc);
+  if (!fs5.existsSync(projectsDir)) return freezeClaudeCost(acc);
   let dirs;
   try {
-    dirs = fs4.readdirSync(projectsDir);
+    dirs = fs5.readdirSync(projectsDir);
   } catch {
     return freezeClaudeCost(acc);
   }
@@ -2901,10 +3106,10 @@ function loadClaudeCost(start, end, projectsDir) {
 }
 async function loadClaudeCostAsync(start, end, projectsDir) {
   const acc = emptyClaudeCostAccumulator();
-  if (!fs4.existsSync(projectsDir)) return freezeClaudeCost(acc);
+  if (!fs5.existsSync(projectsDir)) return freezeClaudeCost(acc);
   let dirs;
   try {
-    dirs = fs4.readdirSync(projectsDir);
+    dirs = fs5.readdirSync(projectsDir);
   } catch {
     return freezeClaudeCost(acc);
   }
@@ -2917,11 +3122,12 @@ async function loadClaudeCostAsync(start, end, projectsDir) {
 function processCodexCostFile(filePath, start, end, acc) {
   let lines;
   try {
-    lines = fs4.readFileSync(filePath, "utf-8").split("\n");
+    lines = fs5.readFileSync(filePath, "utf-8").split("\n");
   } catch {
     return;
   }
   let sessionStart = "";
+  let model = "";
   let lastTotalInput = 0;
   let lastTotalCached = 0;
   let lastTotalOutput = 0;
@@ -2939,6 +3145,10 @@ function processCodexCostFile(filePath, start, end, acc) {
       sessionStart = String(p["timestamp"] ?? "");
       continue;
     }
+    if (entry.type === "turn_context" && typeof p["model"] === "string") {
+      model = p["model"];
+      continue;
+    }
     if (entry.type === "event_msg" && p["type"] === "token_count") {
       const info = p["info"] ?? {};
       const usage = info["total_token_usage"] ?? {};
@@ -2953,40 +3163,45 @@ function processCodexCostFile(filePath, start, end, acc) {
   if (!sessionStart) return;
   const ts = new Date(sessionStart);
   if (ts < start || ts > end) return;
-  const nonCached = Math.max(0, lastTotalInput - lastTotalCached);
-  const cost = nonCached * 5e-6 + lastTotalCached * 25e-7 + lastTotalOutput * 15e-6;
+  const cost = codexSessionCost(model, {
+    input: lastTotalInput,
+    cached: lastTotalCached,
+    output: lastTotalOutput
+  });
   acc.total += cost;
   acc.toolCalls += sessionToolCalls;
   const dateKey = sessionStart.slice(0, 10);
   acc.byDay.set(dateKey, (acc.byDay.get(dateKey) ?? 0) + cost);
+  const normModel = normalizeModel(model || "gpt-5");
+  acc.byModel.set(normModel, (acc.byModel.get(normModel) ?? 0) + cost);
 }
 function listCodexSessionFiles(sessionsBase) {
   const jsonlFiles = [];
-  if (!fs4.existsSync(sessionsBase)) return jsonlFiles;
+  if (!fs5.existsSync(sessionsBase)) return jsonlFiles;
   try {
-    for (const year of fs4.readdirSync(sessionsBase)) {
-      const yearPath = path5.join(sessionsBase, year);
+    for (const year of fs5.readdirSync(sessionsBase)) {
+      const yearPath = path6.join(sessionsBase, year);
       try {
-        if (!fs4.statSync(yearPath).isDirectory()) continue;
+        if (!fs5.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
-      for (const month of fs4.readdirSync(yearPath)) {
-        const monthPath = path5.join(yearPath, month);
+      for (const month of fs5.readdirSync(yearPath)) {
+        const monthPath = path6.join(yearPath, month);
         try {
-          if (!fs4.statSync(monthPath).isDirectory()) continue;
+          if (!fs5.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        for (const day of fs4.readdirSync(monthPath)) {
-          const dayPath = path5.join(monthPath, day);
+        for (const day of fs5.readdirSync(monthPath)) {
+          const dayPath = path6.join(monthPath, day);
           try {
-            if (!fs4.statSync(dayPath).isDirectory()) continue;
+            if (!fs5.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
-          for (const file of fs4.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path5.join(dayPath, file));
+          for (const file of fs5.readdirSync(dayPath)) {
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path6.join(dayPath, file));
           }
         }
       }
@@ -2996,16 +3211,33 @@ function listCodexSessionFiles(sessionsBase) {
   }
   return jsonlFiles;
 }
+function mergeByModel(...maps) {
+  const out = /* @__PURE__ */ new Map();
+  for (const m of maps) {
+    for (const [k, v] of m) out.set(k, (out.get(k) ?? 0) + v);
+  }
+  return out;
+}
 function loadCodexCost(start, end, sessionsBase) {
-  const acc = { total: 0, toolCalls: 0, byDay: /* @__PURE__ */ new Map() };
+  const acc = {
+    total: 0,
+    toolCalls: 0,
+    byDay: /* @__PURE__ */ new Map(),
+    byModel: /* @__PURE__ */ new Map()
+  };
   const files = listCodexSessionFiles(sessionsBase);
   for (const filePath of files) {
     processCodexCostFile(filePath, start, end, acc);
   }
-  return { total: acc.total, byDay: acc.byDay, toolCalls: acc.toolCalls };
+  return { total: acc.total, byDay: acc.byDay, byModel: acc.byModel, toolCalls: acc.toolCalls };
 }
 async function loadCodexCostAsync(start, end, sessionsBase) {
-  const acc = { total: 0, toolCalls: 0, byDay: /* @__PURE__ */ new Map() };
+  const acc = {
+    total: 0,
+    toolCalls: 0,
+    byDay: /* @__PURE__ */ new Map(),
+    byModel: /* @__PURE__ */ new Map()
+  };
   const files = listCodexSessionFiles(sessionsBase);
   const CHUNK_SIZE = 5;
   for (let i = 0; i < files.length; i++) {
@@ -3014,12 +3246,12 @@ async function loadCodexCostAsync(start, end, sessionsBase) {
       await new Promise((resolve) => setImmediate(resolve));
     }
   }
-  return { total: acc.total, byDay: acc.byDay, toolCalls: acc.toolCalls };
+  return { total: acc.total, byDay: acc.byDay, byModel: acc.byModel, toolCalls: acc.toolCalls };
 }
-function geminiPriceFor(model) {
+function geminiPriceFor2(model) {
   let tuple = pricingFor(model);
   if (!tuple && /^gemini-/i.test(model)) {
-    for (const proxy of GEMINI_FALLBACK_MODELS) {
+    for (const proxy of GEMINI_FALLBACK_MODELS2) {
       tuple = pricingFor(proxy);
       if (tuple) break;
     }
@@ -3050,13 +3282,13 @@ function freezeGeminiCost(acc) {
 function processGeminiCostFile(filePath, projectKey, start, end, acc) {
   const startMs = start.getTime();
   try {
-    if (fs4.statSync(filePath).mtimeMs < startMs) return;
+    if (fs5.statSync(filePath).mtimeMs < startMs) return;
   } catch {
     return;
   }
   let raw;
   try {
-    raw = fs4.readFileSync(filePath, "utf-8");
+    raw = fs5.readFileSync(filePath, "utf-8");
   } catch {
     return;
   }
@@ -3077,7 +3309,7 @@ function processGeminiCostFile(filePath, projectKey, start, end, acc) {
     }
     const ts = new Date(entry.timestamp);
     if (ts < start || ts > end) continue;
-    const price = geminiPriceFor(entry.model);
+    const price = geminiPriceFor2(entry.model);
     if (!price) continue;
     const inp = entry.tokens.input ?? 0;
     const out = entry.tokens.output ?? 0;
@@ -3105,30 +3337,30 @@ function listGeminiSessionFiles(geminiTmpDir) {
   const out = [];
   let dirs;
   try {
-    if (!fs4.statSync(geminiTmpDir).isDirectory()) return out;
-    dirs = fs4.readdirSync(geminiTmpDir);
+    if (!fs5.statSync(geminiTmpDir).isDirectory()) return out;
+    dirs = fs5.readdirSync(geminiTmpDir);
   } catch {
     return out;
   }
   for (const proj of dirs) {
-    const chatsDir = path5.join(geminiTmpDir, proj, "chats");
+    const chatsDir = path6.join(geminiTmpDir, proj, "chats");
     let files;
     try {
-      if (!fs4.statSync(chatsDir).isDirectory()) continue;
-      files = fs4.readdirSync(chatsDir);
+      if (!fs5.statSync(chatsDir).isDirectory()) continue;
+      files = fs5.readdirSync(chatsDir);
     } catch {
       continue;
     }
     for (const f of files) {
       if (!f.endsWith(".jsonl")) continue;
-      out.push({ projectKey: proj, file: path5.join(chatsDir, f) });
+      out.push({ projectKey: proj, file: path6.join(chatsDir, f) });
     }
   }
   return out;
 }
 function loadGeminiCost(start, end, geminiTmpDir) {
   const acc = emptyGeminiAccumulator();
-  if (!fs4.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
+  if (!fs5.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
   for (const { projectKey, file } of listGeminiSessionFiles(geminiTmpDir)) {
     processGeminiCostFile(file, projectKey, start, end, acc);
   }
@@ -3136,7 +3368,7 @@ function loadGeminiCost(start, end, geminiTmpDir) {
 }
 async function loadGeminiCostAsync(start, end, geminiTmpDir) {
   const acc = emptyGeminiAccumulator();
-  if (!fs4.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
+  if (!fs5.existsSync(geminiTmpDir)) return freezeGeminiCost(acc);
   const files = listGeminiSessionFiles(geminiTmpDir);
   const CHUNK_SIZE = 5;
   for (let i = 0; i < files.length; i++) {
@@ -3149,11 +3381,11 @@ async function loadGeminiCostAsync(start, end, geminiTmpDir) {
 }
 function aggregateReportFromAudit(period, opts = {}) {
   const now = opts.now ?? /* @__PURE__ */ new Date();
-  const auditLogPath2 = opts.auditLogPath ?? path5.join(os5.homedir(), ".node9", "audit.log");
-  const claudeProjectsDir = opts.claudeProjectsDir ?? path5.join(os5.homedir(), ".claude", "projects");
-  const codexSessionsDir = opts.codexSessionsDir ?? path5.join(os5.homedir(), ".codex", "sessions");
-  const geminiTmpDir = opts.geminiTmpDir ?? path5.join(os5.homedir(), ".gemini", "tmp");
-  const hasAuditFile = fs4.existsSync(auditLogPath2);
+  const auditLogPath2 = opts.auditLogPath ?? path6.join(os6.homedir(), ".node9", "audit.log");
+  const claudeProjectsDir = opts.claudeProjectsDir ?? path6.join(os6.homedir(), ".claude", "projects");
+  const codexSessionsDir = opts.codexSessionsDir ?? path6.join(os6.homedir(), ".codex", "sessions");
+  const geminiTmpDir = opts.geminiTmpDir ?? path6.join(os6.homedir(), ".gemini", "tmp");
+  const hasAuditFile = fs5.existsSync(auditLogPath2);
   const allEntries = opts.preloadedAuditEntries ?? parseAuditLog(auditLogPath2);
   const unackedDlp = allEntries.filter((e) => e.source === "response-dlp");
   const { start, end } = getDateRange(period, now);
@@ -3315,7 +3547,7 @@ function aggregateReportFromAudit(period, opts = {}) {
       cacheWriteTokens: claudeCost.cacheWriteTokens,
       cacheReadTokens: claudeCost.cacheReadTokens + geminiCost.cacheReadTokens,
       byDay: claudeCost.byDay,
-      byModel: claudeCost.byModel,
+      byModel: mergeByModel(claudeCost.byModel, codexCost.byModel),
       byProject: claudeCost.byProject
     },
     toolMap,
@@ -3329,43 +3561,32 @@ function aggregateReportFromAudit(period, opts = {}) {
   };
   return { data, hasAuditFile, responseDlpEntries };
 }
-var TEST_COMMAND_RE, SUPERSEDE_WINDOW_MS, CLAUDE_PRICING, GEMINI_FALLBACK_MODELS;
+var TEST_COMMAND_RE, SUPERSEDE_WINDOW_MS, GEMINI_FALLBACK_MODELS2;
 var init_report_audit = __esm({
   "src/cli/aggregate/report-audit.ts"() {
     "use strict";
     init_costSync();
     init_litellm();
+    init_cost_codex();
     TEST_COMMAND_RE = /(?:^|\s)(npm\s+(?:run\s+)?test|npx\s+(?:vitest|jest|mocha)|yarn\s+(?:run\s+)?test|pnpm\s+(?:run\s+)?test|vitest|jest|mocha|pytest|py\.test|cargo\s+test|go\s+test|bundle\s+exec\s+rspec|rspec|phpunit|dotnet\s+test)\b/i;
     SUPERSEDE_WINDOW_MS = 6e4;
-    CLAUDE_PRICING = {
-      "claude-opus-4-6": { i: 5e-6, o: 25e-6, cw: 625e-8, cr: 5e-7 },
-      "claude-opus-4-5": { i: 5e-6, o: 25e-6, cw: 625e-8, cr: 5e-7 },
-      "claude-opus-4": { i: 15e-6, o: 75e-6, cw: 1875e-8, cr: 15e-7 },
-      "claude-sonnet-4-6": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-sonnet-4-5": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-sonnet-4": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-3-7-sonnet": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-3-5-sonnet": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-haiku-4-5": { i: 1e-6, o: 5e-6, cw: 125e-8, cr: 1e-7 },
-      "claude-3-5-haiku": { i: 8e-7, o: 4e-6, cw: 1e-6, cr: 8e-8 }
-    };
-    GEMINI_FALLBACK_MODELS = ["gemini-2.5-flash", "gemini-2.0-flash"];
+    GEMINI_FALLBACK_MODELS2 = ["gemini-2.5-flash", "gemini-2.0-flash"];
   }
 });
 
 // src/utils/provenance.ts
-import path6 from "path";
-import os6 from "os";
+import path7 from "path";
+import os7 from "os";
 var USER_PREFIXES;
 var init_provenance = __esm({
   "src/utils/provenance.ts"() {
     "use strict";
     USER_PREFIXES = [
-      path6.join(os6.homedir(), "bin"),
-      path6.join(os6.homedir(), ".local", "bin"),
-      path6.join(os6.homedir(), ".cargo", "bin"),
-      path6.join(os6.homedir(), ".npm-global", "bin"),
-      path6.join(os6.homedir(), ".volta", "bin")
+      path7.join(os7.homedir(), "bin"),
+      path7.join(os7.homedir(), ".local", "bin"),
+      path7.join(os7.homedir(), ".cargo", "bin"),
+      path7.join(os7.homedir(), ".npm-global", "bin"),
+      path7.join(os7.homedir(), ".volta", "bin")
     ];
   }
 });
@@ -3469,24 +3690,20 @@ var init_scan_history = __esm({
 
 // src/cli/commands/scan.ts
 import chalk4 from "chalk";
-import fs5 from "fs";
-import path7 from "path";
-import os7 from "os";
+import fs6 from "fs";
+import path8 from "path";
+import os8 from "os";
 import stringWidth2 from "string-width";
 function claudeModelPrice2(model) {
-  const base = model.replace(/@.*$/, "").replace(/-\d{8}$/, "");
-  for (const [key, p] of Object.entries(CLAUDE_PRICING2)) {
-    if (base === key || base.startsWith(key)) return p;
-  }
-  return null;
+  const t = pricingFor(model);
+  if (!t) return null;
+  const [i, o, cw, cr] = t;
+  return { i, o, cw, cr };
 }
 function geminiModelPrice(model) {
-  const base = model.replace(/-preview$/, "").replace(/-exp$/, "").replace(/-\d{4}-\d{2}-\d{2}$/, "");
-  for (const [key, p] of Object.entries(GEMINI_PRICING)) {
-    if (base === key || base.startsWith(key)) return p;
-  }
-  if (base.includes("flash")) return GEMINI_PRICING["gemini-2.0-flash"];
-  return null;
+  const p = geminiPriceFor(model);
+  if (!p) return null;
+  return { i: p.input, o: p.output, cr: p.cacheRead };
 }
 function isNode9SelfOutput(text) {
   let hits = 0;
@@ -3624,7 +3841,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   const sessionId = file.replace(/\.jsonl$/, "");
   let raw;
   try {
-    raw = fs5.readFileSync(path7.join(projPath, file), "utf-8");
+    raw = fs6.readFileSync(path8.join(projPath, file), "utf-8");
   } catch {
     return;
   }
@@ -3676,7 +3893,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
           if (block.type !== "tool_result") continue;
           const filePath = block.tool_use_id ? toolUseFilePaths.get(block.tool_use_id) : void 0;
           if (filePath) {
-            const ext = path7.extname(filePath).toLowerCase();
+            const ext = path8.extname(filePath).toLowerCase();
             if (CODE_EXTENSIONS.has(ext)) continue;
           }
           const resultText = typeof block.content === "string" ? block.content : Array.isArray(block.content) ? block.content.map((c) => c.text ?? "").join("\n") : null;
@@ -3733,7 +3950,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
       const rawCmd = String(input.command ?? "").trimStart();
       if (/^node9\s+(scan|explain|report|tail|dlp|status|sessions|audit)\b/.test(rawCmd)) continue;
       const inputFilePath = typeof input.file_path === "string" ? input.file_path : "";
-      const inputFileExt = inputFilePath ? path7.extname(inputFilePath).toLowerCase() : "";
+      const inputFileExt = inputFilePath ? path8.extname(inputFilePath).toLowerCase() : "";
       if (CODE_EXTENSIONS.has(inputFileExt)) continue;
       const dlpMatch = scanArgs(input);
       if (dlpMatch) {
@@ -3830,19 +4047,19 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   }
 }
 async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDate, result, dedup, onProgress, onLine) {
-  const projPath = path7.join(projectsDir, proj);
+  const projPath = path8.join(projectsDir, proj);
   try {
-    if (!fs5.statSync(projPath).isDirectory()) return;
+    if (!fs6.statSync(projPath).isDirectory()) return;
   } catch {
     return;
   }
-  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os7.homedir(), "~")).slice(
+  const projLabel = stripTerminalEscapes(decodeURIComponent(proj).replace(os8.homedir(), "~")).slice(
     0,
     40
   );
   let files;
   try {
-    files = fs5.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
+    files = fs6.readdirSync(projPath).filter((f) => f.endsWith(".jsonl") && !f.startsWith("agent-"));
   } catch {
     return;
   }
@@ -3880,12 +4097,12 @@ function emptyClaudeScan() {
   };
 }
 async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
-  const projectsDir = path7.join(os7.homedir(), ".claude", "projects");
+  const projectsDir = path8.join(os8.homedir(), ".claude", "projects");
   const result = emptyClaudeScan();
-  if (!fs5.existsSync(projectsDir)) return result;
+  if (!fs6.existsSync(projectsDir)) return result;
   let projDirs;
   try {
-    projDirs = fs5.readdirSync(projectsDir);
+    projDirs = fs6.readdirSync(projectsDir);
   } catch {
     return result;
   }
@@ -3906,7 +4123,7 @@ async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
   return result;
 }
 function scanGeminiHistory(startDate, onProgress, onLine) {
-  const tmpDir = path7.join(os7.homedir(), ".gemini", "tmp");
+  const tmpDir = path8.join(os8.homedir(), ".gemini", "tmp");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -3921,50 +4138,64 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     sessionsWithEarlySecrets: 0
   };
   const dedup = emptyScanDedup();
-  if (!fs5.existsSync(tmpDir)) return result;
+  if (!fs6.existsSync(tmpDir)) return result;
   let slugDirs;
   try {
-    slugDirs = fs5.readdirSync(tmpDir);
+    slugDirs = fs6.readdirSync(tmpDir);
   } catch {
     return result;
   }
   const ruleSources = buildRuleSources();
   for (const slug of slugDirs) {
-    const slugPath = path7.join(tmpDir, slug);
+    const slugPath = path8.join(tmpDir, slug);
     try {
-      if (!fs5.statSync(slugPath).isDirectory()) continue;
+      if (!fs6.statSync(slugPath).isDirectory()) continue;
     } catch {
       continue;
     }
     let projLabel = stripTerminalEscapes(slug).slice(0, 40);
     try {
       projLabel = stripTerminalEscapes(
-        fs5.readFileSync(path7.join(slugPath, ".project_root"), "utf-8").trim()
-      ).replace(os7.homedir(), "~").slice(0, 40);
+        fs6.readFileSync(path8.join(slugPath, ".project_root"), "utf-8").trim()
+      ).replace(os8.homedir(), "~").slice(0, 40);
     } catch {
     }
-    const chatsDir = path7.join(slugPath, "chats");
-    if (!fs5.existsSync(chatsDir)) continue;
+    const chatsDir = path8.join(slugPath, "chats");
+    if (!fs6.existsSync(chatsDir)) continue;
     let chatFiles;
     try {
-      chatFiles = fs5.readdirSync(chatsDir).filter((f) => f.endsWith(".json"));
+      chatFiles = fs6.readdirSync(chatsDir).filter((f) => f.endsWith(".json") || f.endsWith(".jsonl")).sort((a, b) => Number(b.endsWith(".jsonl")) - Number(a.endsWith(".jsonl")));
     } catch {
       continue;
     }
+    const seenSessions = /* @__PURE__ */ new Set();
     for (const chatFile of chatFiles) {
+      const sessionId = chatFile.replace(/\.jsonl?$/, "");
+      if (seenSessions.has(sessionId)) continue;
+      seenSessions.add(sessionId);
       result.filesScanned++;
       onProgress?.(result.filesScanned);
-      const sessionId = chatFile.replace(/\.json$/, "");
       let raw;
       try {
-        raw = fs5.readFileSync(path7.join(chatsDir, chatFile), "utf-8");
+        raw = fs6.readFileSync(path8.join(chatsDir, chatFile), "utf-8");
       } catch {
         continue;
       }
       const sessionCalls = [];
       let session;
       try {
-        session = JSON.parse(raw);
+        if (chatFile.endsWith(".jsonl")) {
+          const messages = raw.split("\n").filter((l) => l.trim()).map((l) => {
+            try {
+              return JSON.parse(l);
+            } catch {
+              return null;
+            }
+          }).filter((m) => m !== null);
+          session = { messages };
+        } else {
+          session = JSON.parse(raw);
+        }
       } catch {
         continue;
       }
@@ -4119,7 +4350,7 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
   return result;
 }
 function scanCodexHistory(startDate, onProgress, onLine) {
-  const sessionsBase = path7.join(os7.homedir(), ".codex", "sessions");
+  const sessionsBase = path8.join(os8.homedir(), ".codex", "sessions");
   const result = {
     filesScanned: 0,
     sessions: 0,
@@ -4134,32 +4365,32 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     sessionsWithEarlySecrets: 0
   };
   const dedup = emptyScanDedup();
-  if (!fs5.existsSync(sessionsBase)) return result;
+  if (!fs6.existsSync(sessionsBase)) return result;
   const jsonlFiles = [];
   try {
-    for (const year of fs5.readdirSync(sessionsBase)) {
-      const yearPath = path7.join(sessionsBase, year);
+    for (const year of fs6.readdirSync(sessionsBase)) {
+      const yearPath = path8.join(sessionsBase, year);
       try {
-        if (!fs5.statSync(yearPath).isDirectory()) continue;
+        if (!fs6.statSync(yearPath).isDirectory()) continue;
       } catch {
         continue;
       }
-      for (const month of fs5.readdirSync(yearPath)) {
-        const monthPath = path7.join(yearPath, month);
+      for (const month of fs6.readdirSync(yearPath)) {
+        const monthPath = path8.join(yearPath, month);
         try {
-          if (!fs5.statSync(monthPath).isDirectory()) continue;
+          if (!fs6.statSync(monthPath).isDirectory()) continue;
         } catch {
           continue;
         }
-        for (const day of fs5.readdirSync(monthPath)) {
-          const dayPath = path7.join(monthPath, day);
+        for (const day of fs6.readdirSync(monthPath)) {
+          const dayPath = path8.join(monthPath, day);
           try {
-            if (!fs5.statSync(dayPath).isDirectory()) continue;
+            if (!fs6.statSync(dayPath).isDirectory()) continue;
           } catch {
             continue;
           }
-          for (const file of fs5.readdirSync(dayPath)) {
-            if (file.endsWith(".jsonl")) jsonlFiles.push(path7.join(dayPath, file));
+          for (const file of fs6.readdirSync(dayPath)) {
+            if (file.endsWith(".jsonl")) jsonlFiles.push(path8.join(dayPath, file));
           }
         }
       }
@@ -4173,7 +4404,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     onProgress?.(result.filesScanned);
     let lines;
     try {
-      lines = fs5.readFileSync(filePath, "utf-8").split("\n");
+      lines = fs6.readFileSync(filePath, "utf-8").split("\n");
     } catch {
       continue;
     }
@@ -4185,6 +4416,7 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     let lastTotalInput = 0;
     let lastTotalCached = 0;
     let lastTotalOutput = 0;
+    let model = "";
     for (const line of lines) {
       if (!line.trim()) continue;
       onLine?.();
@@ -4199,7 +4431,11 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         sessionId = String(payload["id"] ?? filePath);
         startTime = String(payload["timestamp"] ?? "");
         const cwd = String(payload["cwd"] ?? "");
-        projLabel = stripTerminalEscapes(cwd.replace(os7.homedir(), "~")).slice(0, 40);
+        projLabel = stripTerminalEscapes(cwd.replace(os8.homedir(), "~")).slice(0, 40);
+        continue;
+      }
+      if (entry.type === "turn_context" && typeof payload["model"] === "string") {
+        model = payload["model"];
         continue;
       }
       if (entry.type === "event_msg" && payload["type"] === "token_count") {
@@ -4345,13 +4581,16 @@ function scanCodexHistory(startDate, onProgress, onLine) {
         }
       }
     }
-    const nonCached = Math.max(0, lastTotalInput - lastTotalCached);
-    result.totalCostUSD += nonCached * 5e-6 + lastTotalCached * 25e-7 + lastTotalOutput * 15e-6;
+    result.totalCostUSD += codexSessionCost(model, {
+      input: lastTotalInput,
+      cached: lastTotalCached,
+      output: lastTotalOutput
+    });
     result.loopFindings.push(...detectLoops(sessionCalls, projLabel, sessionId, "codex"));
   }
   return result;
 }
-var CLAUDE_PRICING2, GEMINI_PRICING, CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, FIXTURE_TOKEN_PATTERNS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
+var CODE_EXTENSIONS, SELF_OUTPUT_MARKERS, FIXTURE_TOKEN_PATTERNS, TERMINAL_ESCAPE_RE, LOOP_TOOLS, LOOP_THRESHOLD, LOOP_TIMESPAN_THRESHOLD_MS;
 var init_scan = __esm({
   "src/cli/commands/scan.ts"() {
     "use strict";
@@ -4360,6 +4599,9 @@ var init_scan = __esm({
     init_policy();
     init_dist();
     init_dlp();
+    init_litellm();
+    init_cost_gemini();
+    init_cost_codex();
     init_hook_payload();
     init_dist();
     init_scan_summary();
@@ -4369,26 +4611,6 @@ var init_scan = __esm({
     init_protection();
     init_scan_json();
     init_scan_history();
-    CLAUDE_PRICING2 = {
-      "claude-opus-4-6": { i: 5e-6, o: 25e-6, cw: 625e-8, cr: 5e-7 },
-      "claude-opus-4-5": { i: 5e-6, o: 25e-6, cw: 625e-8, cr: 5e-7 },
-      "claude-opus-4": { i: 15e-6, o: 75e-6, cw: 1875e-8, cr: 15e-7 },
-      "claude-sonnet-4-6": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-sonnet-4-5": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-sonnet-4": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-3-7-sonnet": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-3-5-sonnet": { i: 3e-6, o: 15e-6, cw: 375e-8, cr: 3e-7 },
-      "claude-haiku-4-5": { i: 1e-6, o: 5e-6, cw: 125e-8, cr: 1e-7 },
-      "claude-3-5-haiku": { i: 8e-7, o: 4e-6, cw: 1e-6, cr: 8e-8 }
-    };
-    GEMINI_PRICING = {
-      "gemini-2.5-pro": { i: 125e-8, o: 1e-5, cr: 31e-8 },
-      "gemini-2.5-flash": { i: 15e-8, o: 6e-7, cr: 375e-10 },
-      "gemini-2.0-flash": { i: 1e-7, o: 4e-7, cr: 25e-9 },
-      "gemini-1.5-pro": { i: 125e-8, o: 5e-6, cr: 3125e-10 },
-      "gemini-1.5-flash": { i: 75e-9, o: 3e-7, cr: 1875e-11 },
-      "gemini-3-flash": { i: 1e-7, o: 4e-7, cr: 25e-9 }
-    };
     CODE_EXTENSIONS = /* @__PURE__ */ new Set([
       ".ts",
       ".tsx",
@@ -4451,23 +4673,23 @@ var init_scan = __esm({
 });
 
 // src/tui/dashboard/data.ts
-import fs6 from "fs";
-import os8 from "os";
-import path8 from "path";
+import fs7 from "fs";
+import os9 from "os";
+import path9 from "path";
 import http from "http";
 function auditLogPath() {
-  return path8.join(os8.homedir(), ".node9", "audit.log");
+  return path9.join(os9.homedir(), ".node9", "audit.log");
 }
 function readAuditEntriesAsync(chunkSize = 1e3, customPath) {
   return new Promise((resolve) => {
     const p = customPath ?? auditLogPath();
-    if (!fs6.existsSync(p)) {
+    if (!fs7.existsSync(p)) {
       resolve([]);
       return;
     }
     let raw;
     try {
-      raw = fs6.readFileSync(p, "utf8");
+      raw = fs7.readFileSync(p, "utf8");
     } catch {
       resolve([]);
       return;
@@ -4596,15 +4818,16 @@ function loadBlast() {
   }
 }
 function shortenPath(p) {
-  const home = os8.homedir();
+  const home = os9.homedir();
   return p.startsWith(home) ? p.replace(home, "~") : p;
 }
 async function loadReportAuditAsync(period) {
-  const claudeProjectsDir = path8.join(os8.homedir(), ".claude", "projects");
-  const codexSessionsDir = path8.join(os8.homedir(), ".codex", "sessions");
-  const geminiTmpDir = path8.join(os8.homedir(), ".gemini", "tmp");
+  const claudeProjectsDir = path9.join(os9.homedir(), ".claude", "projects");
+  const codexSessionsDir = path9.join(os9.homedir(), ".codex", "sessions");
+  const geminiTmpDir = path9.join(os9.homedir(), ".gemini", "tmp");
   const { start, end } = getDateRange(period, /* @__PURE__ */ new Date());
   const entries = await readAuditEntriesAsync();
+  void ensurePricingLoaded();
   const claudeCost = await loadClaudeCostAsync(start, end, claudeProjectsDir);
   const codexCost = await loadCodexCostAsync(start, end, codexSessionsDir);
   const geminiCost = await loadGeminiCostAsync(start, end, geminiTmpDir);
@@ -4945,6 +5168,7 @@ var init_data = __esm({
     init_shields();
     init_scan_watermark();
     init_report_audit();
+    init_litellm();
     init_scan();
     init_protection();
     TEST_TOOLS = /* @__PURE__ */ new Set(["Bash", "bash"]);
@@ -5706,8 +5930,8 @@ import { Fragment as Fragment3, jsx as jsx4, jsxs as jsxs4 } from "react/jsx-run
 function TopToolsProjects({ audit }) {
   const data = audit?.data;
   const tools = data ? [...data.toolMap.entries()].sort(([, a], [, b]) => b.calls - a.calls).slice(0, ROW_LIMIT) : [];
-  const projects = data ? [...data.cost.byProject.entries()].map(([path9, r]) => ({
-    name: basenameOf(path9),
+  const projects = data ? [...data.cost.byProject.entries()].map(([path10, r]) => ({
+    name: basenameOf(path10),
     cost: r.cost,
     tokens: r.inputTokens + r.outputTokens
   })).sort((a, b) => b.cost - a.cost).slice(0, ROW_LIMIT) : [];
@@ -6144,8 +6368,8 @@ function pickTopLoopFile(loops) {
     map.set(k, (map.get(k) ?? 0) + (l.count ?? 0));
   }
   if (map.size === 0) return void 0;
-  const [path9, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
-  return { path: path9, count };
+  const [path10, count] = [...map.entries()].sort((a, b) => b[1] - a[1])[0];
+  return { path: path10, count };
 }
 var EMPTY_FILTERED_SCAN;
 var init_derive = __esm({