@optimuslabs/harness-map-staging 1.5.16

package/dist/endpoint_client/startup_api.js

@@ -0,0 +1,44 @@
+import { executeBody } from './http_transport.js';
+import { gzipPayload } from './compress_payload.js';
+export const postStartupPayload = async (endpointUrl, body, timeoutMs = 5000) => {
+    const payload = gzipPayload(JSON.stringify(body));
+    const { statusCode, statusMessage, body: responseBody } = await executeBody(endpointUrl, 'POST', payload, timeoutMs);
+    if (statusCode >= 400) {
+        const msg = statusCode === 413
+            ? `413 Request Entity Too Large: ${responseBody.substring(0, 200)}`
+            : `HTTP ${statusCode} ${statusMessage}: ${responseBody.substring(0, 200)}`;
+        throw new Error(msg);
+    }
+    if (!responseBody)
+        return { status: 'error', message: 'Empty response from endpoint' };
+    try {
+        return JSON.parse(responseBody);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse endpoint response (${error.message}): ${responseBody}`);
+    }
+};
+export const patchPayload = async (endpointUrl, body, timeoutMs = 10000) => {
+    const payload = gzipPayload(JSON.stringify(body));
+    const { body: responseBody } = await executeBody(endpointUrl, 'PATCH', payload, timeoutMs);
+    if (!responseBody)
+        return { status: 'error', error: 'empty_response' };
+    try {
+        return JSON.parse(responseBody);
+    }
+    catch {
+        throw new Error(`Invalid JSON: ${responseBody.slice(0, 200)}`);
+    }
+};
+export const classifyEndpointResponse = (response) => {
+    if (response.status === 'key_issued' && response.key) {
+        return { branch: 'key_issued', message: 'Server issued a new symmetric key; store it for future signatures.', key: response.key, keyId: response.key_id };
+    }
+    if (response.status === 'accepted' && response.signature_valid) {
+        return { branch: 'accepted', message: 'Startup payload accepted and signature verified.' };
+    }
+    if (response.status === 'error' && response.error) {
+        return { branch: 'error', message: response.error };
+    }
+    return { branch: 'error', message: response.message || 'Endpoint returned an unexpected response.' };
+};

package/dist/endpoint_client/types.js

@@ -0,0 +1,4 @@
+/** Path suffix for file collection patterns (backend: api/file-path-registry/file-patterns/). */
+export const FILE_PATH_REGISTRY_FILE_PATTERNS_PATH = '/api/file-path-registry/file-patterns/';
+/** Path suffix for sensitive paths audit candidates (backend: api/file-path-registry/sensitive-paths-audit-candidates/). */
+export const FILE_PATH_REGISTRY_SENSITIVE_PATHS_PATH = '/api/file-path-registry/sensitive-paths-audit-candidates/';

package/dist/execute_trusted_restarts.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+/**
+ * CLI: read one JSON line from stdin (same shape as compliance_prompt_gate stdout for __optimus_autofix),
+ * parse restart_commands[], allowlist each in TS, spawn detached. Invoked by optimus-compliance-check.sh only.
+ * stderr stays quiet; failures logged via hookRunLog.
+ */
+import { readFileSync } from 'node:fs';
+import { isThisCliModule } from './cli_invocation_match.js';
+import { appendComplianceRunnerLine, hookRunLog } from './log_config_files/runtime/hook_logger.js';
+import { setActiveComplianceLogPath } from './log_config_files/runtime/compliance_session_log.js';
+import { executeTrustedRestartCommands } from './log_config_files/runtime/trusted_restarts.js';
+/** Invoked by dist entrypoint or by `npx --package=@optimuslabs/harness-map-staging@latest execute-trusted-restarts-staging` (cli.js dispatches here). */
+export function runExecuteTrustedRestartsFromStdin() {
+    const complianceLogPath = process.env.OPTIMUS_COMPLIANCE_LOG?.trim();
+    if (complianceLogPath) {
+        setActiveComplianceLogPath(complianceLogPath);
+    }
+    let raw;
+    try {
+        raw = readFileSync(0, 'utf8');
+    }
+    catch {
+        const msg = 'execute_trusted_restarts: could not read stdin';
+        hookRunLog(msg);
+        appendComplianceRunnerLine('RESTART', msg);
+        return;
+    }
+    const first = raw.trim().split(/\r?\n/)[0]?.trim() ?? '';
+    if (!first) {
+        appendComplianceRunnerLine('RESTART', 'empty stdin — no restart_commands');
+        return;
+    }
+    let j;
+    try {
+        j = JSON.parse(first);
+    }
+    catch {
+        const msg = 'execute_trusted_restarts: stdin is not valid JSON';
+        hookRunLog(msg);
+        appendComplianceRunnerLine('RESTART', msg);
+        return;
+    }
+    const cmds = j.restart_commands;
+    if (!Array.isArray(cmds)) {
+        appendComplianceRunnerLine('RESTART', 'JSON missing restart_commands array — nothing to run');
+        return;
+    }
+    const strings = cmds.filter((c) => typeof c === 'string');
+    appendComplianceRunnerLine('RESTART', `stdin ok restart_commands=${strings.length}`);
+    executeTrustedRestartCommands(strings);
+}
+if (isThisCliModule(process.argv[1], import.meta.url)) {
+    try {
+        runExecuteTrustedRestartsFromStdin();
+    }
+    catch (e) {
+        hookRunLog(`execute_trusted_restarts: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    process.exit(0);
+}

package/dist/log_config_files/auth/auth_flow.js

@@ -0,0 +1,22 @@
+import path from 'node:path';
+import { postStartupPayload } from '../../endpoint_client/index.js';
+import { ensureAuthentication as ensureTofuAuthentication } from '../../tofu.js';
+import { loadEndpointBase } from '../sender/endpoint_config.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { hookRunLog } from '../runtime/hook_logger.js';
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+/** Ensure authentication — verify stored key or request new one via handshake. */
+async function ensureAuthentication(hardwareUuid, endpointBase) {
+    const key = await ensureTofuAuthentication({
+        hardwareUuid,
+        endpointBase: endpointBase ?? loadEndpointBase(),
+        authRelativePath: AUTH_KEY_RELATIVE_PATH,
+        postJson: (endpointUrl, body) => postStartupPayload(endpointUrl, body),
+        onLog: (message) => {
+            if (message.startsWith('auth:'))
+                hookRunLog(message);
+        },
+    });
+    return key;
+}
+export { ensureAuthentication };

package/dist/log_config_files/auth/auth_key_store.js

@@ -0,0 +1,14 @@
+import path from 'node:path';
+import { getAuthKeyPath as getSharedAuthKeyPath, readStoredAuthKey as readSharedStoredAuthKey, } from '../../tofu.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+const AUTH_KEY_OPTIONS = { authRelativePath: AUTH_KEY_RELATIVE_PATH };
+/** Return absolute path to auth_key.txt, or null if home dir is unavailable. */
+function getAuthKeyPath() {
+    return getSharedAuthKeyPath(AUTH_KEY_OPTIONS);
+}
+/** Read and parse the stored auth key, or return null if absent/unreadable. */
+function readStoredAuthKey() {
+    return readSharedStoredAuthKey(AUTH_KEY_OPTIONS);
+}
+export { getAuthKeyPath, readStoredAuthKey };

package/dist/log_config_files/collection/claude_desktop_extensions_collector.js

@@ -0,0 +1,248 @@
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+function claudeAppSupportDir(home) {
+    if (process.platform === 'win32') {
+        const appData = process.env.APPDATA?.trim();
+        if (!appData)
+            return '';
+        return join(appData, 'Claude');
+    }
+    return join(home, 'Library', 'Application Support', 'Claude');
+}
+function claudeDesktopExtensionsDir(home) {
+    const base = claudeAppSupportDir(home);
+    return base ? join(base, 'Claude Extensions') : '';
+}
+function extensionsInstallationsPath(home) {
+    const base = claudeAppSupportDir(home);
+    return base ? join(base, 'extensions-installations.json') : '';
+}
+function claudeExtensionSettingsDir(home) {
+    const base = claudeAppSupportDir(home);
+    return base ? join(base, 'Claude Extensions Settings') : '';
+}
+/** Per-connector toggle: Claude Extensions Settings/<extension-id>.json → { isEnabled: boolean }. */
+function readClaudeDesktopExtensionEnableSettings(home) {
+    const settingsDir = claudeExtensionSettingsDir(home);
+    if (!settingsDir || !existsSync(settingsDir))
+        return new Map();
+    const out = new Map();
+    let entries;
+    try {
+        entries = readdirSync(settingsDir, { withFileTypes: true }).filter((d) => d.isFile());
+    }
+    catch {
+        return out;
+    }
+    for (const dirent of entries) {
+        if (!dirent.name.endsWith('.json'))
+            continue;
+        const extId = dirent.name.slice(0, -'.json'.length);
+        if (!extId)
+            continue;
+        const raw = readJSONFile(join(settingsDir, dirent.name));
+        if (!raw || typeof raw !== 'object')
+            continue;
+        const isEnabled = raw.isEnabled;
+        if (typeof isEnabled === 'boolean') {
+            out.set(extId, isEnabled);
+        }
+    }
+    return out;
+}
+function applyExtensionEnableSettingsToRawContent(rawContent, settings) {
+    if (settings.size === 0)
+        return 0;
+    const extensions = rawContent.extensions;
+    if (!extensions || typeof extensions !== 'object')
+        return 0;
+    let applied = 0;
+    for (const [extId, enabled] of settings) {
+        const ext = extensions[extId];
+        if (!ext || typeof ext !== 'object')
+            continue;
+        ext.isEnabled = enabled;
+        applied += 1;
+    }
+    return applied;
+}
+/**
+ * Upload each Claude Extensions Settings/*.json as its own config file (raw on-disk JSON).
+ * Do not merge isEnabled into extensions-installations.json — that mutates the payload
+ * vs the source file and creates spurious inventory audit diffs.
+ */
+function collectClaudeDesktopExtensionSettingsFiles(home = homedir()) {
+    const settingsDir = claudeExtensionSettingsDir(home);
+    if (!settingsDir || !existsSync(settingsDir))
+        return [];
+    let entries;
+    try {
+        entries = readdirSync(settingsDir, { withFileTypes: true }).filter((d) => d.isFile());
+    }
+    catch {
+        return [];
+    }
+    const results = [];
+    for (const dirent of entries) {
+        if (!dirent.name.endsWith('.json'))
+            continue;
+        const filePath = join(settingsDir, dirent.name);
+        const raw = readJSONFile(filePath);
+        if (!raw || typeof raw !== 'object')
+            continue;
+        results.push({
+            file_type: 'claude_extension_settings',
+            file_path: filePath,
+            raw_content: raw,
+        });
+    }
+    return results;
+}
+/**
+ * @deprecated Do not call during collection — mutates extensions-installations upload payloads.
+ * isEnabled is resolved server-side from claude_extension_settings uploads.
+ */
+function mergeClaudeDesktopExtensionEnableSettings(configFiles, home = homedir()) {
+    const settings = readClaudeDesktopExtensionEnableSettings(home);
+    if (settings.size === 0) {
+        return { applied: 0, settingsCount: 0 };
+    }
+    let applied = 0;
+    for (const entry of configFiles) {
+        if (entry.file_type !== 'claude_extensions_installations')
+            continue;
+        if (!entry.raw_content || typeof entry.raw_content !== 'object')
+            continue;
+        const extensions = entry.raw_content.extensions;
+        if (!extensions || typeof extensions !== 'object')
+            continue;
+        applied += applyExtensionEnableSettingsToRawContent(entry.raw_content, settings);
+    }
+    return { applied, settingsCount: settings.size };
+}
+function normalizePathForMatch(path) {
+    return path.replace(/\\/g, '/');
+}
+function isExtensionsInstallationsUpload(entry) {
+    if (entry.file_type !== 'claude_extensions_installations')
+        return false;
+    return normalizePathForMatch(entry.file_path).includes('extensions-installations.json');
+}
+function registryExtensionIds(home) {
+    const path = extensionsInstallationsPath(home);
+    if (!path || !existsSync(path))
+        return new Set();
+    const raw = readJSONFile(path);
+    if (!raw || typeof raw !== 'object')
+        return new Set();
+    const extensions = raw.extensions;
+    if (!extensions || typeof extensions !== 'object')
+        return new Set();
+    return new Set(Object.keys(extensions));
+}
+function manifestHasMcpConfig(manifest) {
+    const server = manifest.server;
+    if (!server || typeof server !== 'object')
+        return false;
+    const mcpConfig = server.mcp_config;
+    return mcpConfig !== null && typeof mcpConfig === 'object';
+}
+function collectDiskOnlyClaudeDesktopExtensions(home, skipIds) {
+    const extensionsDir = claudeDesktopExtensionsDir(home);
+    if (!extensionsDir || !existsSync(extensionsDir))
+        return {};
+    const out = {};
+    let dirs;
+    try {
+        dirs = readdirSync(extensionsDir, { withFileTypes: true }).filter((d) => d.isDirectory());
+    }
+    catch {
+        return out;
+    }
+    for (const dirent of dirs) {
+        const extId = dirent.name;
+        if (skipIds.has(extId))
+            continue;
+        const manifestPath = join(extensionsDir, extId, 'manifest.json');
+        if (!existsSync(manifestPath))
+            continue;
+        const manifest = readJSONFile(manifestPath);
+        if (!manifest || typeof manifest !== 'object')
+            continue;
+        const manifestObj = manifest;
+        if (!manifestHasMcpConfig(manifestObj))
+            continue;
+        const version = typeof manifestObj.version === 'string' || typeof manifestObj.version === 'number'
+            ? String(manifestObj.version)
+            : undefined;
+        out[extId] = {
+            id: extId,
+            version,
+            manifest: manifestObj,
+            source: 'claude_extensions_directory',
+        };
+    }
+    return out;
+}
+/**
+ * Merge disk-only Desktop extensions into the extensions-installations.json upload
+ * so MCP inventory uses the same ingest path as registry-listed extensions (e.g. iMessage).
+ */
+function enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, home = homedir()) {
+    const skipIds = new Set();
+    for (const id of registryExtensionIds(home))
+        skipIds.add(id);
+    const registryUpload = configFiles.find(isExtensionsInstallationsUpload);
+    if (registryUpload?.raw_content && typeof registryUpload.raw_content === 'object') {
+        const extensions = registryUpload.raw_content.extensions;
+        if (extensions && typeof extensions === 'object') {
+            for (const id of Object.keys(extensions))
+                skipIds.add(id);
+        }
+    }
+    const diskOnly = collectDiskOnlyClaudeDesktopExtensions(home, skipIds);
+    const diskOnlyIds = Object.keys(diskOnly);
+    if (diskOnlyIds.length === 0) {
+        return { mergedCount: 0, hadRegistryUpload: Boolean(registryUpload) };
+    }
+    if (registryUpload) {
+        const raw = registryUpload.raw_content;
+        if (!raw.extensions || typeof raw.extensions !== 'object')
+            raw.extensions = {};
+        Object.assign(raw.extensions, diskOnly);
+        return { mergedCount: diskOnlyIds.length, hadRegistryUpload: true };
+    }
+    const registryPath = extensionsInstallationsPath(home);
+    if (!registryPath)
+        return { mergedCount: 0, hadRegistryUpload: false };
+    configFiles.push({
+        file_type: 'claude_extensions_installations',
+        file_path: registryPath,
+        raw_content: { extensions: diskOnly },
+    });
+    return { mergedCount: diskOnlyIds.length, hadRegistryUpload: false };
+}
+/**
+ * Fallback when extensions-installations.json is not part of the upload batch: one synthetic
+ * claude_extensions_installations payload per disk-only manifest path.
+ */
+function collectClaudeDesktopExtensionManifests(home = homedir()) {
+    const extensionsDir = claudeDesktopExtensionsDir(home);
+    if (!extensionsDir || !existsSync(extensionsDir))
+        return [];
+    const inRegistry = registryExtensionIds(home);
+    const results = [];
+    const diskOnly = collectDiskOnlyClaudeDesktopExtensions(home, inRegistry);
+    for (const [extId, entry] of Object.entries(diskOnly)) {
+        const manifestPath = join(extensionsDir, extId, 'manifest.json');
+        results.push({
+            file_type: 'claude_extensions_installations',
+            file_path: manifestPath,
+            raw_content: { extensions: { [extId]: entry } },
+        });
+    }
+    return results;
+}
+export { claudeAppSupportDir, claudeDesktopExtensionsDir, claudeExtensionSettingsDir, collectClaudeDesktopExtensionSettingsFiles, collectClaudeDesktopExtensionManifests, collectDiskOnlyClaudeDesktopExtensions, enrichClaudeDesktopExtensionsInstallationsUpload, mergeClaudeDesktopExtensionEnableSettings, readClaudeDesktopExtensionEnableSettings, };

package/dist/log_config_files/collection/claude_known_projects_collector.js

@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { readJSONFile } from '../readers/file_readers.js';
+/**
+ * Collect project-level `.mcp.json` for each path listed under `projects` in ~/.claude.json.
+ * Claude Code records known project directories there; MCP config lives at `<project>/.mcp.json`.
+ */
+function collectMcpFromClaudeJsonProjects(home = homedir()) {
+    const claudeJsonPath = join(home, '.claude.json');
+    if (!existsSync(claudeJsonPath))
+        return [];
+    const raw = readJSONFile(claudeJsonPath);
+    if (!raw || typeof raw !== 'object')
+        return [];
+    const projects = raw.projects;
+    if (!projects || typeof projects !== 'object')
+        return [];
+    const seenPaths = new Set();
+    const results = [];
+    for (const projectPath of Object.keys(projects)) {
+        if (!projectPath || typeof projectPath !== 'string')
+            continue;
+        const trimmed = projectPath.trim();
+        if (!trimmed)
+            continue;
+        const mcpPath = join(trimmed, '.mcp.json');
+        if (seenPaths.has(mcpPath) || !existsSync(mcpPath))
+            continue;
+        const content = readJSONFile(mcpPath);
+        if (content === null)
+            continue;
+        seenPaths.add(mcpPath);
+        results.push({
+            file_type: 'claude_plugin_mcp',
+            file_path: mcpPath,
+            raw_content: typeof content === 'object' ? content : { content, source: 'file' },
+        });
+    }
+    return results;
+}
+export { collectMcpFromClaudeJsonProjects };

package/dist/log_config_files/collection/claude_token_usage_collector.js

@@ -0,0 +1,203 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Token-usage / session / CLI-version aggregator for Claude Code.
+ *
+ * Claude Code writes one JSONL transcript per session under ~/.claude/projects/**. Each
+ * assistant line carries a `message.usage` block ({input,output,cache_*}_tokens), and every
+ * line carries the CLI `version` and `sessionId`. We aggregate the *numbers* (and version /
+ * model ids) on the endpoint and emit only those — never transcript content — so the backend
+ * gets token usage, session count, and a reliable CLI version without ingesting prompts.
+ *
+ * Bounded by mtime recency so a large transcript history (can be hundreds of MB) does not get
+ * fully re-parsed on every hook run; this yields "recent activity" usage and the current version.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'claude_token_usage';
+function emptyTotals() {
+    return {
+        input_tokens: 0,
+        output_tokens: 0,
+        cache_creation_input_tokens: 0,
+        cache_read_input_tokens: 0,
+    };
+}
+function addUsage(totals, usage) {
+    for (const key of Object.keys(totals)) {
+        const value = readTokenField(usage, key);
+        if (value > 0)
+            totals[key] += value;
+    }
+}
+/** Read one token field, preferring the nested 5m+1h cache-creation sum over the flat field. */
+function readTokenField(usage, key) {
+    if (key === 'cache_creation_input_tokens') {
+        const nested = usage.cache_creation;
+        if (nested && typeof nested === 'object') {
+            const n = nested;
+            const has5m = typeof n.ephemeral_5m_input_tokens === 'number' && Number.isFinite(n.ephemeral_5m_input_tokens);
+            const has1h = typeof n.ephemeral_1h_input_tokens === 'number' && Number.isFinite(n.ephemeral_1h_input_tokens);
+            // Fall back to the flat field only when the nested block is truly absent — a
+            // legitimately-zero nested sum (both fields present as 0) must not be overridden by it.
+            if (has5m || has1h) {
+                return (has5m ? n.ephemeral_5m_input_tokens : 0) + (has1h ? n.ephemeral_1h_input_tokens : 0);
+            }
+        }
+    }
+    const value = usage[key];
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+/** Sum the token fields of one usage block (used for per-model attribution and dedup tiebreaks). */
+function usageSum(usage) {
+    let sum = 0;
+    for (const key of ['input_tokens', 'output_tokens', 'cache_creation_input_tokens', 'cache_read_input_tokens']) {
+        sum += readTokenField(usage, key);
+    }
+    return sum;
+}
+/** Recursively collect *.jsonl files under a directory whose mtime is within the recency window. */
+function recentJsonlFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentJsonlFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable file — skip */
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Aggregate token usage / session count / version across recent Claude session transcripts.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
+ */
+function collectClaudeTokenUsage(home = homedir()) {
+    const projectsDir = join(home, '.claude', 'projects');
+    if (!existsSync(projectsDir))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = recentJsonlFiles(projectsDir, cutoffMs);
+    if (files.length === 0)
+        return [];
+    const totals = emptyTotals();
+    const sessions = new Set();
+    const models = new Set();
+    const modelTokenSplit = {};
+    let version = '';
+    let versionAt = '';
+    let sawData = false;
+    // Claude Code writes one JSONL line per streaming snapshot of the same assistant message,
+    // so message.id/requestId repeat with a growing usage total; only the final snapshot is
+    // the true total. Dedup by (message.id, requestId), taking the per-field max across all
+    // snapshots for that key (order-independent — robust to out-of-order lines, and safe even
+    // if a snapshot has a genuinely-lower or reset value in one field while another snapshot in
+    // the same group peaks a different field). Entries without a message.id can't be deduped and
+    // are accumulated directly.
+    const dedupedUsage = new Map();
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            sawData = true;
+            const sessionId = entry.sessionId;
+            if (typeof sessionId === 'string' && sessionId)
+                sessions.add(sessionId);
+            // Keep the version from the most recent line (timestamps are ISO-8601, sort lexically).
+            const lineVersion = entry.version;
+            const lineAt = typeof entry.timestamp === 'string' ? entry.timestamp : '';
+            if (typeof lineVersion === 'string' && lineVersion && lineAt >= versionAt) {
+                version = lineVersion;
+                versionAt = lineAt;
+            }
+            const message = entry.message;
+            if (message && typeof message === 'object') {
+                const msg = message;
+                // Skip Claude Code's internal placeholder model ids (e.g. "<synthetic>").
+                const model = typeof msg.model === 'string' && msg.model && !msg.model.startsWith('<') ? msg.model : '';
+                if (model)
+                    models.add(model);
+                if (msg.usage && typeof msg.usage === 'object') {
+                    const usage = msg.usage;
+                    const messageId = typeof msg.id === 'string' ? msg.id : '';
+                    if (messageId) {
+                        const requestId = typeof entry.requestId === 'string' ? entry.requestId : '';
+                        const dedupeKey = `${messageId} ${requestId}`;
+                        const existing = dedupedUsage.get(dedupeKey) ?? { totals: emptyTotals(), model: '' };
+                        for (const key of Object.keys(existing.totals)) {
+                            const value = readTokenField(usage, key);
+                            if (value > existing.totals[key])
+                                existing.totals[key] = value;
+                        }
+                        if (model)
+                            existing.model = model;
+                        dedupedUsage.set(dedupeKey, existing);
+                    }
+                    else {
+                        addUsage(totals, usage);
+                        const sum = usageSum(usage);
+                        if (model && sum > 0)
+                            modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+                    }
+                }
+            }
+        }
+    }
+    for (const { totals: merged, model } of dedupedUsage.values()) {
+        let sum = 0;
+        for (const key of Object.keys(totals)) {
+            totals[key] += merged[key];
+            sum += merged[key];
+        }
+        if (model && sum > 0)
+            modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+    }
+    if (!sawData)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            // Stable synthetic path → one aggregate row per machine.
+            file_path: projectsDir,
+            raw_content: {
+                version,
+                session_count: sessions.size,
+                models: [...models].sort(),
+                model_token_split: modelTokenSplit,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+            },
+        },
+    ];
+}
+export { collectClaudeTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };