@node9/proxy 2.6.2 → 2.7.0

package/dist/cli.js

@@ -2561,8 +2561,7 @@ function extractSessionLevelFindings(calls, ctx) {
       occurrenceCount: 1,
       loopCount: verdict.count,
       loopKind: "loop",
-      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN),
-      costUsd: verdict.count * COST_PER_LOOP_ITER_USD
+      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN)
     });
   }
   return out;
@@ -2632,7 +2631,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var import_safe_regex2, import_mvdan_sh, import_picomatch, import_safe_regex22, import_safe_regex23, import_crypto3, MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4439,7 +4438,6 @@ var init_dist = __esm({
       longOutputRedactions: 1
     };
     LOOP_THRESHOLD_FOR_WASTE = 3;
-    COST_PER_LOOP_ITER_USD = 6e-3;
     DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
     SENSITIVE_PATH_RE = /\.aws\/(credentials|config)\b|\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b|\.env(\.|$|\b)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
     FILE_TOOLS = /* @__PURE__ */ new Set([
@@ -11962,6 +11960,31 @@ function agentColorName(agent) {
       return "cyan";
   }
 }
+function computeLoopWaste(loops, perSession) {
+  const rate = /* @__PURE__ */ new Map();
+  for (const s of perSession) {
+    if (!(s.toolCalls > 0) || !(s.costUSD > 0)) continue;
+    const r = s.costUSD / s.toolCalls;
+    if (!Number.isFinite(r) || r <= 0 || r > MAX_PLAUSIBLE_RATE_USD) continue;
+    rate.set(s.sessionId, r);
+  }
+  let usd = 0;
+  let pricedIterations = 0;
+  let unpricedIterations = 0;
+  for (const l of loops) {
+    if (l.kind === "long-iteration") continue;
+    const wasted = Math.max(0, l.count - LOOP_THRESHOLD_FOR_WASTE);
+    if (!Number.isFinite(wasted) || wasted === 0) continue;
+    const r = rate.get(l.sessionId);
+    if (r === void 0) {
+      unpricedIterations += wasted;
+      continue;
+    }
+    usd += wasted * r;
+    pricedIterations += wasted;
+  }
+  return { usd, pricedIterations, unpricedIterations };
+}
 function buildScanSummary(agents) {
   const stats = {
     sessions: 0,
@@ -12022,8 +12045,11 @@ function buildScanSummary(agents) {
     costUSD: a.scan.totalCostUSD
   })).filter((s) => s.sessions > 0 || s.findings > 0);
   const sections = buildSections(allFindings);
-  const wastedIters = allLoops.filter((l) => l.kind !== "long-iteration").reduce((sum, l) => sum + Math.max(0, l.count - LOOP_THRESHOLD_FOR_WASTE), 0);
-  const loopWastedUSD = wastedIters * COST_PER_LOOP_ITER_USD;
+  const loopWaste = computeLoopWaste(
+    allLoops,
+    agents.flatMap((a) => a.scan.perSession)
+  );
+  const loopWastedUSD = loopWaste.usd;
   return {
     stats,
     byVerdict,
@@ -12031,7 +12057,8 @@ function buildScanSummary(agents) {
     sections,
     leaks: allLeaks,
     loops: allLoops,
-    loopWastedUSD
+    loopWastedUSD,
+    loopWaste
   };
 }
 function buildSections(findings) {
@@ -12138,7 +12165,7 @@ function fullCommandOf(input) {
   const raw = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   return String(raw).replace(/\s+/g, " ").trim();
 }
-var AGENT_SHORT, AGENT_LONG;
+var AGENT_SHORT, AGENT_LONG, MAX_PLAUSIBLE_RATE_USD;
 var init_scan_summary = __esm({
   "src/scan-summary.ts"() {
     "use strict";
@@ -12161,6 +12188,7 @@ var init_scan_summary = __esm({
       copilot: "GitHub Copilot",
       shell: "Shell"
     };
+    MAX_PLAUSIBLE_RATE_USD = 50;
   }
 });
 
@@ -12368,7 +12396,7 @@ function topRulesByVerdict(sections, verdict, n) {
   }
   return matched.sort((a, b) => b.count - a.count).slice(0, n);
 }
-function computeLoopWaste(loops, totalToolCalls) {
+function computeLoopWaste2(loops, totalToolCalls) {
   const wastedCalls = loops.reduce((s, l) => s + Math.max(0, l.count - 1), 0);
   const wastePct = totalToolCalls > 0 ? Math.round(wastedCalls / totalToolCalls * 100) : 0;
   return { wastedCalls, wastePct };
@@ -13954,6 +13982,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   result.sessions++;
   onProgress?.(result.filesScanned);
   const sessionId = file.replace(/\.jsonl$/, "");
+  const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
     raw = import_fs26.default.readFileSync(import_path28.default.join(projPath, file), "utf-8");
@@ -14041,7 +14070,9 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
     if (usage && model) {
       const p = claudeModelPrice(model);
       if (p) {
-        result.totalCostUSD += (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        const rowCost = (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        result.totalCostUSD += rowCost;
+        session.costUSD += rowCost;
       }
     }
     const content = entry.message?.content;
@@ -14049,6 +14080,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
     for (const block of content) {
       if (block.type !== "tool_use") continue;
       result.totalToolCalls++;
+      session.toolCalls++;
       const toolName = block.name ?? "";
       const toolNameLower = toolName.toLowerCase();
       const input = block.input ?? {};
@@ -14160,6 +14192,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   if (firstDlpTs !== null && (firstEditTs === null || firstDlpTs < firstEditTs)) {
     result.sessionsWithEarlySecrets++;
   }
+  result.perSession.push(session);
 }
 function processClaudeProject(proj, projectsDir, ruleSources, startDate, result, dedup, onProgress, onLine) {
   const projPath = import_path28.default.join(projectsDir, proj);
@@ -14204,7 +14237,8 @@ function emptyClaudeScan() {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
 }
 function scanClaudeHistory(startDate, onProgress, onLine) {
@@ -14246,7 +14280,8 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!import_fs26.default.existsSync(tmpDir)) return result;
@@ -14484,7 +14519,8 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
     // transcripts carry no token/model data
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   const brainDirs = antigravityBrainDirs();
@@ -14680,7 +14716,8 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
     // event logs carry no token/cost rollup
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!import_fs26.default.existsSync(sessionDir)) return result;
@@ -14862,7 +14899,8 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!import_fs26.default.existsSync(sessionsBase)) return result;
@@ -15141,7 +15179,8 @@ function mergeScans(a, b) {
     totalCostUSD: a.totalCostUSD + b.totalCostUSD,
     firstDate: dates.length ? dates.sort()[0] : null,
     lastDate: lastDates.length ? lastDates.sort().at(-1) : null,
-    sessionsWithEarlySecrets: a.sessionsWithEarlySecrets + b.sessionsWithEarlySecrets
+    sessionsWithEarlySecrets: a.sessionsWithEarlySecrets + b.sessionsWithEarlySecrets,
+    perSession: [...a.perSession, ...b.perSession]
   };
 }
 function verdictIcon(verdict) {
@@ -15225,9 +15264,9 @@ function renderCompactScorecard(input) {
   const realLoops = scan.loopFindings.filter((l) => l.kind !== "long-iteration");
   const longIterations = scan.loopFindings.filter((l) => l.kind === "long-iteration");
   if (realLoops.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(realLoops, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(realLoops, scan.totalToolCalls);
     const wasteParts = [];
-    if (wastedCalls > 0) wasteParts.push(`${wastedCalls} wasted calls (${wastePct}% of all calls)`);
+    if (wastedCalls > 0) wasteParts.push(`${wastedCalls} repeat calls (${wastePct}% of all calls)`);
     if (summary.loopWastedUSD > 0) wasteParts.push("~" + fmtCost(summary.loopWastedUSD));
     const wasteSummary = wasteParts.length ? `(${wasteParts.join("  \xB7  ")})` : "";
     console.log(
@@ -15305,10 +15344,10 @@ function renderNarrativeScorecard(input) {
     });
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
     const cost = summary.loopWastedUSD > 0 ? `, ~${fmtCost(summary.loopWastedUSD)} wasted` : "";
     medium.push({
-      label: `${scan.loopFindings.length} agent loops (${wastedCalls} wasted calls, ${wastePct}% of calls${cost})`,
+      label: `${scan.loopFindings.length} agent loops (${wastedCalls} repeat calls, ${wastePct}% of calls${cost})`,
       count: scan.loopFindings.length
     });
   }
@@ -15420,13 +15459,13 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     );
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
     const byTool = /* @__PURE__ */ new Map();
     for (const f of scan.loopFindings) {
       byTool.set(f.toolName, (byTool.get(f.toolName) ?? 0) + Math.max(0, f.count - 1));
     }
     const top = [...byTool.entries()].sort((a, b) => b[1] - a[1])[0];
-    const wasteSuffix = wastedCalls > 0 ? `, ${wastedCalls} wasted calls \xB7 ${wastePct}% of calls` : "";
+    const wasteSuffix = wastedCalls > 0 ? `, ${wastedCalls} repeat calls \xB7 ${wastePct}% of calls` : "";
     const detail = top ? `(${top[0]} dominates${wasteSuffix})` : "";
     topLines.push(
       mkLine(
@@ -15518,7 +15557,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     console.log("");
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
     const byTool = /* @__PURE__ */ new Map();
     let totalRepeats = 0;
     for (const f of scan.loopFindings) {
@@ -15548,7 +15587,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
         loopLines.push(mkLine([`\xD7${num(f.count).padEnd(4)} `, import_chalk6.default.bold], [target, import_chalk6.default.dim]));
       }
     }
-    const wasteSuffix = wastedCalls > 0 ? `  \xB7  ${wastedCalls} wasted calls (${wastePct}% of all calls)` : "";
+    const wasteSuffix = wastedCalls > 0 ? `  \xB7  ${wastedCalls} repeat calls (${wastePct}% of all calls)` : "";
     const title = `AGENT LOOPS  \xB7  ${scan.loopFindings.length} pattern${scan.loopFindings.length !== 1 ? "s" : ""}${wasteSuffix}`;
     for (const ln of boxPanel(title, loopLines)) console.log("  " + ln);
     console.log("");
@@ -15883,7 +15922,7 @@ function registerScanCommand(program2) {
           );
         }
         if (scan.loopFindings.length > 0) {
-          const { wastePct } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+          const { wastePct } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
           const wasteSuffix = wastePct > 0 ? import_chalk6.default.dim(` (${wastePct}% of calls)`) : "";
           cardParts.push(
             import_chalk6.default.yellow("\u{1F501} ") + import_chalk6.default.yellow.bold(String(scan.loopFindings.length)) + import_chalk6.default.dim(" loops") + wasteSuffix
@@ -21056,7 +21095,8 @@ data: ${JSON.stringify(item.data)}
           totalCostUSD: 0,
           firstDate: null,
           lastDate: null,
-          sessionsWithEarlySecrets: 0
+          sessionsWithEarlySecrets: 0,
+          perSession: []
         };
         let claude = EMPTY_SCAN;
         let gemini = EMPTY_SCAN;

package/dist/cli.mjs

@@ -2571,8 +2571,7 @@ function extractSessionLevelFindings(calls, ctx) {
       occurrenceCount: 1,
       loopCount: verdict.count,
       loopKind: "loop",
-      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN),
-      costUsd: verdict.count * COST_PER_LOOP_ITER_USD
+      commandPreview: previewArgs(call.args, DEDUPE_PREVIEW_LEN)
     });
   }
   return out;
@@ -2642,7 +2641,7 @@ function* stringValues(obj, depth = 0) {
   }
   for (const v of Object.values(obj)) yield* stringValues(v, depth + 1);
 }
-var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, COST_PER_LOOP_ITER_USD, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
+var MAX, UNTRUSTED_TOOLS, SIGNALS, ASSIGNMENT_CONTEXT_RE, DLP_STOPWORDS, DLP_PATTERNS, DLP_PATTERNS_GLOBAL, SENSITIVE_PATH_PATTERNS, MAX_DEPTH, MAX_STRING_BYTES, MAX_JSON_PARSE_BYTES, DLP_SCAN_LIMITS, MAX_REGEX_LENGTH, REGEX_CACHE_MAX, regexCache, FORBIDDEN_PATH_SEGMENTS, syntax, sharedParser, MESSAGE_FLAGS, SHELL_INTERPRETERS, DOWNLOAD_CMDS, NORMALIZE_CACHE_MAX, normalizeCache, AST_CACHE_MAX, astCache, PARSE_FAIL, FS_READ_TOOLS, FS_OP_PRESCREEN_RE, HOME_CACHE_ALLOWLIST, SENSITIVE_PATH_RULES, BASH_TOOL_NAMES, AST_FS_REGEX_RULES, SQL_DB_CLIS, SQL_DDL_RE, CHMOD_OPEN_PERM_TOKENS, COMMAND_WRAPPERS, INLINE_INTERPRETER, RUNNER_WRAPPERS, _redirStdinOps, _listOps, WRAPPER_TAKES_TARGET, INTERP_LEADING_TARGET, NET_BINARIES, VALUE_FLAGS, FS_OP_CACHE_MAX, fsOpCache, stripDotSlash, REDIR_TRUNCATE_OPS, REDIR_HEREDOC_OPS, DEFAULT_EGRESS_ALLOWLIST, SOURCE_COMMANDS, SINK_COMMANDS, OBFUSCATORS, SENSITIVE_PATTERNS, FLAGS_WITH_VALUES, VERDICT_RANK, SQL_DML_KEYWORDS, aws_default, bash_safe_default, docker_default, filesystem_default, github_default, k8s_default, mongodb_default, postgres_default, project_jail_default, redis_default, BUILTIN_SHIELDS, LOOP_MAX_RECORDS, FINDING_TO_SIGNAL, SCAN_SIGNAL_WEIGHTS, LOOP_THRESHOLD_FOR_WASTE, DESTRUCTIVE_OP_RE, SENSITIVE_PATH_RE, FILE_TOOLS, PII_EMAIL_RE, PII_SSN_RE, PII_PHONE_RE, PII_CC_RE, REALTIME_PII_PATTERNS, MAX_PII_SCAN_BYTES, LONG_OUTPUT_THRESHOLD_BYTES, CANONICAL_EXTRACTOR_VERSION, DEDUPE_PREVIEW_LEN, TERMINAL_ESCAPE_RE, ENGINE_VERSION;
 var init_dist = __esm({
   "packages/policy-engine/dist/index.mjs"() {
     "use strict";
@@ -4443,7 +4442,6 @@ var init_dist = __esm({
       longOutputRedactions: 1
     };
     LOOP_THRESHOLD_FOR_WASTE = 3;
-    COST_PER_LOOP_ITER_USD = 6e-3;
     DESTRUCTIVE_OP_RE = /\brm\s+-[rRf]+\b|\bDROP\s+(TABLE|DATABASE|COLLECTION|SCHEMA)\b|\bTRUNCATE\s+TABLE\b|\bgit\s+push\s+(--force|-f)\b|\bFLUSHALL\b|\bFLUSHDB\b|\bkubectl\s+delete\b|\bhelm\s+uninstall\b/i;
     SENSITIVE_PATH_RE = /\.aws\/(credentials|config)\b|\.ssh\/(id_rsa|id_ed25519|id_ecdsa|id_dsa)\b|\.env(\.|$|\b)|\.config\/gcloud\/credentials\.db\b|\.docker\/config\.json\b|\.netrc\b|\.npmrc\b|\.node9\/credentials\.json\b/i;
     FILE_TOOLS = /* @__PURE__ */ new Set([
@@ -11963,6 +11961,31 @@ function agentColorName(agent) {
       return "cyan";
   }
 }
+function computeLoopWaste(loops, perSession) {
+  const rate = /* @__PURE__ */ new Map();
+  for (const s of perSession) {
+    if (!(s.toolCalls > 0) || !(s.costUSD > 0)) continue;
+    const r = s.costUSD / s.toolCalls;
+    if (!Number.isFinite(r) || r <= 0 || r > MAX_PLAUSIBLE_RATE_USD) continue;
+    rate.set(s.sessionId, r);
+  }
+  let usd = 0;
+  let pricedIterations = 0;
+  let unpricedIterations = 0;
+  for (const l of loops) {
+    if (l.kind === "long-iteration") continue;
+    const wasted = Math.max(0, l.count - LOOP_THRESHOLD_FOR_WASTE);
+    if (!Number.isFinite(wasted) || wasted === 0) continue;
+    const r = rate.get(l.sessionId);
+    if (r === void 0) {
+      unpricedIterations += wasted;
+      continue;
+    }
+    usd += wasted * r;
+    pricedIterations += wasted;
+  }
+  return { usd, pricedIterations, unpricedIterations };
+}
 function buildScanSummary(agents) {
   const stats = {
     sessions: 0,
@@ -12023,8 +12046,11 @@ function buildScanSummary(agents) {
     costUSD: a.scan.totalCostUSD
   })).filter((s) => s.sessions > 0 || s.findings > 0);
   const sections = buildSections(allFindings);
-  const wastedIters = allLoops.filter((l) => l.kind !== "long-iteration").reduce((sum, l) => sum + Math.max(0, l.count - LOOP_THRESHOLD_FOR_WASTE), 0);
-  const loopWastedUSD = wastedIters * COST_PER_LOOP_ITER_USD;
+  const loopWaste = computeLoopWaste(
+    allLoops,
+    agents.flatMap((a) => a.scan.perSession)
+  );
+  const loopWastedUSD = loopWaste.usd;
   return {
     stats,
     byVerdict,
@@ -12032,7 +12058,8 @@ function buildScanSummary(agents) {
     sections,
     leaks: allLeaks,
     loops: allLoops,
-    loopWastedUSD
+    loopWastedUSD,
+    loopWaste
   };
 }
 function buildSections(findings) {
@@ -12139,7 +12166,7 @@ function fullCommandOf(input) {
   const raw = input.command ?? input.query ?? input.file_path ?? JSON.stringify(input);
   return String(raw).replace(/\s+/g, " ").trim();
 }
-var AGENT_SHORT, AGENT_LONG;
+var AGENT_SHORT, AGENT_LONG, MAX_PLAUSIBLE_RATE_USD;
 var init_scan_summary = __esm({
   "src/scan-summary.ts"() {
     "use strict";
@@ -12162,6 +12189,7 @@ var init_scan_summary = __esm({
       copilot: "GitHub Copilot",
       shell: "Shell"
     };
+    MAX_PLAUSIBLE_RATE_USD = 50;
   }
 });
 
@@ -12370,7 +12398,7 @@ function topRulesByVerdict(sections, verdict, n) {
   }
   return matched.sort((a, b) => b.count - a.count).slice(0, n);
 }
-function computeLoopWaste(loops, totalToolCalls) {
+function computeLoopWaste2(loops, totalToolCalls) {
   const wastedCalls = loops.reduce((s, l) => s + Math.max(0, l.count - 1), 0);
   const wastePct = totalToolCalls > 0 ? Math.round(wastedCalls / totalToolCalls * 100) : 0;
   return { wastedCalls, wastePct };
@@ -13959,6 +13987,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   result.sessions++;
   onProgress?.(result.filesScanned);
   const sessionId = file.replace(/\.jsonl$/, "");
+  const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
     raw = fs27.readFileSync(path29.join(projPath, file), "utf-8");
@@ -14046,7 +14075,9 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
     if (usage && model) {
       const p = claudeModelPrice(model);
       if (p) {
-        result.totalCostUSD += (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        const rowCost = (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        result.totalCostUSD += rowCost;
+        session.costUSD += rowCost;
       }
     }
     const content = entry.message?.content;
@@ -14054,6 +14085,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
     for (const block of content) {
       if (block.type !== "tool_use") continue;
       result.totalToolCalls++;
+      session.toolCalls++;
       const toolName = block.name ?? "";
       const toolNameLower = toolName.toLowerCase();
       const input = block.input ?? {};
@@ -14165,6 +14197,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   if (firstDlpTs !== null && (firstEditTs === null || firstDlpTs < firstEditTs)) {
     result.sessionsWithEarlySecrets++;
   }
+  result.perSession.push(session);
 }
 function processClaudeProject(proj, projectsDir, ruleSources, startDate, result, dedup, onProgress, onLine) {
   const projPath = path29.join(projectsDir, proj);
@@ -14209,7 +14242,8 @@ function emptyClaudeScan() {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
 }
 function scanClaudeHistory(startDate, onProgress, onLine) {
@@ -14251,7 +14285,8 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!fs27.existsSync(tmpDir)) return result;
@@ -14489,7 +14524,8 @@ function scanAntigravityHistory(startDate, onProgress, onLine) {
     // transcripts carry no token/model data
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   const brainDirs = antigravityBrainDirs();
@@ -14685,7 +14721,8 @@ function scanCopilotHistory(startDate, onProgress, onLine) {
     // event logs carry no token/cost rollup
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!fs27.existsSync(sessionDir)) return result;
@@ -14867,7 +14904,8 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!fs27.existsSync(sessionsBase)) return result;
@@ -15146,7 +15184,8 @@ function mergeScans(a, b) {
     totalCostUSD: a.totalCostUSD + b.totalCostUSD,
     firstDate: dates.length ? dates.sort()[0] : null,
     lastDate: lastDates.length ? lastDates.sort().at(-1) : null,
-    sessionsWithEarlySecrets: a.sessionsWithEarlySecrets + b.sessionsWithEarlySecrets
+    sessionsWithEarlySecrets: a.sessionsWithEarlySecrets + b.sessionsWithEarlySecrets,
+    perSession: [...a.perSession, ...b.perSession]
   };
 }
 function verdictIcon(verdict) {
@@ -15230,9 +15269,9 @@ function renderCompactScorecard(input) {
   const realLoops = scan.loopFindings.filter((l) => l.kind !== "long-iteration");
   const longIterations = scan.loopFindings.filter((l) => l.kind === "long-iteration");
   if (realLoops.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(realLoops, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(realLoops, scan.totalToolCalls);
     const wasteParts = [];
-    if (wastedCalls > 0) wasteParts.push(`${wastedCalls} wasted calls (${wastePct}% of all calls)`);
+    if (wastedCalls > 0) wasteParts.push(`${wastedCalls} repeat calls (${wastePct}% of all calls)`);
     if (summary.loopWastedUSD > 0) wasteParts.push("~" + fmtCost(summary.loopWastedUSD));
     const wasteSummary = wasteParts.length ? `(${wasteParts.join("  \xB7  ")})` : "";
     console.log(
@@ -15310,10 +15349,10 @@ function renderNarrativeScorecard(input) {
     });
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
     const cost = summary.loopWastedUSD > 0 ? `, ~${fmtCost(summary.loopWastedUSD)} wasted` : "";
     medium.push({
-      label: `${scan.loopFindings.length} agent loops (${wastedCalls} wasted calls, ${wastePct}% of calls${cost})`,
+      label: `${scan.loopFindings.length} agent loops (${wastedCalls} repeat calls, ${wastePct}% of calls${cost})`,
       count: scan.loopFindings.length
     });
   }
@@ -15425,13 +15464,13 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     );
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
     const byTool = /* @__PURE__ */ new Map();
     for (const f of scan.loopFindings) {
       byTool.set(f.toolName, (byTool.get(f.toolName) ?? 0) + Math.max(0, f.count - 1));
     }
     const top = [...byTool.entries()].sort((a, b) => b[1] - a[1])[0];
-    const wasteSuffix = wastedCalls > 0 ? `, ${wastedCalls} wasted calls \xB7 ${wastePct}% of calls` : "";
+    const wasteSuffix = wastedCalls > 0 ? `, ${wastedCalls} repeat calls \xB7 ${wastePct}% of calls` : "";
     const detail = top ? `(${top[0]} dominates${wasteSuffix})` : "";
     topLines.push(
       mkLine(
@@ -15523,7 +15562,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
     console.log("");
   }
   if (scan.loopFindings.length > 0) {
-    const { wastePct, wastedCalls } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+    const { wastePct, wastedCalls } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
     const byTool = /* @__PURE__ */ new Map();
     let totalRepeats = 0;
     for (const f of scan.loopFindings) {
@@ -15553,7 +15592,7 @@ function renderPanelScorecard(input, now = /* @__PURE__ */ new Date()) {
         loopLines.push(mkLine([`\xD7${num(f.count).padEnd(4)} `, chalk6.bold], [target, chalk6.dim]));
       }
     }
-    const wasteSuffix = wastedCalls > 0 ? `  \xB7  ${wastedCalls} wasted calls (${wastePct}% of all calls)` : "";
+    const wasteSuffix = wastedCalls > 0 ? `  \xB7  ${wastedCalls} repeat calls (${wastePct}% of all calls)` : "";
     const title = `AGENT LOOPS  \xB7  ${scan.loopFindings.length} pattern${scan.loopFindings.length !== 1 ? "s" : ""}${wasteSuffix}`;
     for (const ln of boxPanel(title, loopLines)) console.log("  " + ln);
     console.log("");
@@ -15888,7 +15927,7 @@ function registerScanCommand(program2) {
           );
         }
         if (scan.loopFindings.length > 0) {
-          const { wastePct } = computeLoopWaste(scan.loopFindings, scan.totalToolCalls);
+          const { wastePct } = computeLoopWaste2(scan.loopFindings, scan.totalToolCalls);
           const wasteSuffix = wastePct > 0 ? chalk6.dim(` (${wastePct}% of calls)`) : "";
           cardParts.push(
             chalk6.yellow("\u{1F501} ") + chalk6.yellow.bold(String(scan.loopFindings.length)) + chalk6.dim(" loops") + wasteSuffix
@@ -21057,7 +21096,8 @@ data: ${JSON.stringify(item.data)}
           totalCostUSD: 0,
           firstDate: null,
           lastDate: null,
-          sessionsWithEarlySecrets: 0
+          sessionsWithEarlySecrets: 0,
+          perSession: []
         };
         let claude = EMPTY_SCAN;
         let gemini = EMPTY_SCAN;

package/dist/dashboard.mjs

@@ -5047,6 +5047,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   result.sessions++;
   onProgress?.(result.filesScanned);
   const sessionId = file.replace(/\.jsonl$/, "");
+  const session = { sessionId, costUSD: 0, toolCalls: 0 };
   let raw;
   try {
     raw = fs7.readFileSync(path10.join(projPath, file), "utf-8");
@@ -5134,7 +5135,9 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
     if (usage && model) {
       const p = claudeModelPrice2(model);
       if (p) {
-        result.totalCostUSD += (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        const rowCost = (usage.input_tokens ?? 0) * p.i + (usage.output_tokens ?? 0) * p.o + (usage.cache_creation_input_tokens ?? 0) * p.cw + (usage.cache_read_input_tokens ?? 0) * p.cr;
+        result.totalCostUSD += rowCost;
+        session.costUSD += rowCost;
       }
     }
     const content = entry.message?.content;
@@ -5142,6 +5145,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
     for (const block of content) {
       if (block.type !== "tool_use") continue;
       result.totalToolCalls++;
+      session.toolCalls++;
       const toolName = block.name ?? "";
       const toolNameLower = toolName.toLowerCase();
       const input = block.input ?? {};
@@ -5253,6 +5257,7 @@ function processClaudeFile(file, projPath, projLabel, ruleSources, startDate, re
   if (firstDlpTs !== null && (firstEditTs === null || firstDlpTs < firstEditTs)) {
     result.sessionsWithEarlySecrets++;
   }
+  result.perSession.push(session);
 }
 async function processClaudeProjectAsync(proj, projectsDir, ruleSources, startDate, result, dedup, onProgress, onLine) {
   const projPath = path10.join(projectsDir, proj);
@@ -5301,7 +5306,8 @@ function emptyClaudeScan() {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
 }
 async function scanClaudeHistoryAsync(startDate, onProgress, onLine) {
@@ -5343,7 +5349,8 @@ function scanGeminiHistory(startDate, onProgress, onLine) {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!fs7.existsSync(tmpDir)) return result;
@@ -5570,7 +5577,8 @@ function scanCodexHistory(startDate, onProgress, onLine) {
     totalCostUSD: 0,
     firstDate: null,
     lastDate: null,
-    sessionsWithEarlySecrets: 0
+    sessionsWithEarlySecrets: 0,
+    perSession: []
   };
   const dedup = emptyScanDedup();
   if (!fs7.existsSync(sessionsBase)) return result;
@@ -7070,7 +7078,7 @@ function Cost({ audit }) {
       flexGrow: 1,
       flexBasis: 0,
       children: [
-        /* @__PURE__ */ jsx3(Text3, { bold: true, children: "COST" }),
+        /* @__PURE__ */ jsx3(Text3, { bold: true, children: "COST \xB7 API value" }),
         audit === null ? /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "loading\u2026" }) : /* @__PURE__ */ jsxs3(Fragment2, { children: [
           /* @__PURE__ */ jsxs3(Box3, { height: 1, children: [
             /* @__PURE__ */ jsx3(Box3, { width: LABEL_W2, children: /* @__PURE__ */ jsx3(Text3, { children: "Total" }) }),

package/dist/scan-ink.mjs

@@ -45,7 +45,7 @@ var LABEL_W = 16;
 function CostPanel({ summary, width }) {
   const total = summary.stats.totalCostUSD;
   return /* @__PURE__ */ jsxs3(Box3, { borderStyle: "round", borderColor: "gray", paddingX: 1, flexDirection: "column", width, children: [
-    /* @__PURE__ */ jsx3(Text3, { bold: true, children: "COST" }),
+    /* @__PURE__ */ jsx3(Text3, { bold: true, children: "COST \xB7 API value" }),
     /* @__PURE__ */ jsxs3(Box3, { children: [
       /* @__PURE__ */ jsx3(Box3, { width: LABEL_W, children: /* @__PURE__ */ jsx3(Text3, { children: "Total" }) }),
       /* @__PURE__ */ jsx3(Text3, { bold: true, children: formatCost(total) })
@@ -1791,7 +1791,7 @@ function StaticScorecard({ input, rangeLabel, now }) {
       if (reviewCount > 0) parts.push(`${reviewCount} op${reviewCount !== 1 ? "s" : ""} flagged`);
       if (loopCount > 0)
         parts.push(
-          `${loopCount} loop${loopCount !== 1 ? "s" : ""}${wastedCalls > 0 ? ` \xB7 ${wastedCalls} wasted calls (${wastePct}% of all calls)` : ""}`
+          `${loopCount} loop${loopCount !== 1 ? "s" : ""}${wastedCalls > 0 ? ` \xB7 ${wastedCalls} repeat calls (${wastePct}% of all calls)` : ""}`
         );
       return /* @__PURE__ */ jsxs11(Fragment2, { children: [
         /* @__PURE__ */ jsx11(SeverityBand, { label: `Medium (${parts.join(" \xB7 ")})`, width }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node9/proxy",
-  "version": "2.6.2",
+  "version": "2.7.0",
   "description": "The Sudo Command for AI Agents. Execution Security for Claude Code, Codex, Gemini, Cursor, Opencode, Pi, and any MCP server.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",