@outputai/cli 0.3.3-next.e8eff63.0 → 0.4.1-dev.06c2b50.0

package/dist/api/generated/api.d.ts

@@ -146,6 +146,58 @@ export interface TraceLogLocalResponse {
     /** Absolute path to local trace file */
     localPath: string;
 }
+export interface TraceAttributesCostComponent {
+    /** Canonical cost event name (e.g. `cost:llm:request`, `cost:http:request`, `other`). */
+    name: string;
+    /** Summed USD cost for this component bucket. */
+    value: number;
+}
+export type TraceAttributesResponseAttributesCost = {
+    /** USD; equal to the sum of `components[].value` */
+    total: number;
+    /** Cost contributions bucketed by canonical event name (llm / http / other). */
+    components: TraceAttributesCostComponent[];
+};
+export type TraceAttributesResponseAttributesTokenUsage = {
+    inputTokens: number;
+    outputTokens: number;
+    cachedInputTokens: number;
+    totalTokens: number;
+};
+export type TraceAttributesResponseAttributes = {
+    cost: TraceAttributesResponseAttributesCost;
+    tokenUsage: TraceAttributesResponseAttributesTokenUsage;
+};
+/**
+ * Aggregated cost, token usage, and runtime computed by walking the trace tree of a completed workflow run.
+Component breakdowns under `attributes.cost.components` are grouped by the canonical event name that
+emitted them (inferred from node kind: llm/http/other). Values sum to `attributes.cost.total`.
+
+ */
+export interface TraceAttributesResponse {
+    /** The workflow execution id */
+    workflowId: string;
+    /** The specific run id this aggregation belongs to */
+    runId: string;
+    /**
+       * ms epoch of the root trace node's start
+       * @nullable
+       */
+    startTime: number | null;
+    /**
+       * ms epoch of the root trace node's end
+       * @nullable
+       */
+    finishTime: number | null;
+    /**
+       * ms between finishTime and startTime, null if either timestamp is missing
+       * @nullable
+       */
+    runtime: number | null;
+    attributes: TraceAttributesResponseAttributes;
+    /** S3 URL of the underlying trace file (same value `/trace-log` returns under `data` for remote traces). */
+    traceUrl: string;
+}
 /**
  * Current run status
  */
@@ -950,6 +1002,74 @@ export type getWorkflowIdRunsRidTraceLogResponseError = (getWorkflowIdRunsRidTra
 export type getWorkflowIdRunsRidTraceLogResponse = (getWorkflowIdRunsRidTraceLogResponseSuccess | getWorkflowIdRunsRidTraceLogResponseError);
 export declare const getGetWorkflowIdRunsRidTraceLogUrl: (id: string, rid: string) => string;
 export declare const getWorkflowIdRunsRidTraceLog: (id: string, rid: string, options?: ApiRequestOptions) => Promise<getWorkflowIdRunsRidTraceLogResponse>;
+/**
+ * Returns runtime, cost rolled up by event-name bucket, token-usage totals, and the trace S3 URL
+for the latest run of the given workflow. Completion-only — returns 424 while the workflow is
+still running, mirroring `/result` and `/trace-log`. To pin a specific run, use
+`/workflow/{id}/runs/{rid}/trace-attributes`.
+
+ * @summary Get aggregated trace attributes for a completed workflow (latest run)
+ */
+export type getWorkflowIdTraceAttributesResponse200 = {
+    data: TraceAttributesResponse;
+    status: 200;
+};
+export type getWorkflowIdTraceAttributesResponse404 = {
+    data: NotFoundResponse;
+    status: 404;
+};
+export type getWorkflowIdTraceAttributesResponse424 = {
+    data: FailedDependencyResponse;
+    status: 424;
+};
+export type getWorkflowIdTraceAttributesResponse500 = {
+    data: InternalServerErrorResponse;
+    status: 500;
+};
+export type getWorkflowIdTraceAttributesResponseSuccess = (getWorkflowIdTraceAttributesResponse200) & {
+    headers: Headers;
+};
+export type getWorkflowIdTraceAttributesResponseError = (getWorkflowIdTraceAttributesResponse404 | getWorkflowIdTraceAttributesResponse424 | getWorkflowIdTraceAttributesResponse500) & {
+    headers: Headers;
+};
+export type getWorkflowIdTraceAttributesResponse = (getWorkflowIdTraceAttributesResponseSuccess | getWorkflowIdTraceAttributesResponseError);
+export declare const getGetWorkflowIdTraceAttributesUrl: (id: string) => string;
+export declare const getWorkflowIdTraceAttributes: (id: string, options?: ApiRequestOptions) => Promise<getWorkflowIdTraceAttributesResponse>;
+/**
+ * Returns runtime, cost rolled up by event-name bucket, token-usage totals, and the trace S3 URL
+for the pinned workflow run. Completion-only — returns 424 while the run is still in progress.
+
+ * @summary Get aggregated trace attributes for a specific completed workflow run
+ */
+export type getWorkflowIdRunsRidTraceAttributesResponse200 = {
+    data: TraceAttributesResponse;
+    status: 200;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponse400 = {
+    data: BadRequestResponse;
+    status: 400;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponse404 = {
+    data: NotFoundResponse;
+    status: 404;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponse424 = {
+    data: FailedDependencyResponse;
+    status: 424;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponse500 = {
+    data: InternalServerErrorResponse;
+    status: 500;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponseSuccess = (getWorkflowIdRunsRidTraceAttributesResponse200) & {
+    headers: Headers;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponseError = (getWorkflowIdRunsRidTraceAttributesResponse400 | getWorkflowIdRunsRidTraceAttributesResponse404 | getWorkflowIdRunsRidTraceAttributesResponse424 | getWorkflowIdRunsRidTraceAttributesResponse500) & {
+    headers: Headers;
+};
+export type getWorkflowIdRunsRidTraceAttributesResponse = (getWorkflowIdRunsRidTraceAttributesResponseSuccess | getWorkflowIdRunsRidTraceAttributesResponseError);
+export declare const getGetWorkflowIdRunsRidTraceAttributesUrl: (id: string, rid: string) => string;
+export declare const getWorkflowIdRunsRidTraceAttributes: (id: string, rid: string, options?: ApiRequestOptions) => Promise<getWorkflowIdRunsRidTraceAttributesResponse>;
 /**
  * Returns decoded Temporal history events with optional payload inclusion. First page includes workflow metadata; subsequent pages return events only.
  * @summary Get paginated workflow execution history

package/dist/api/generated/api.js

@@ -194,6 +194,24 @@ export const getWorkflowIdRunsRidTraceLog = async (id, rid, options) => {
         method: 'GET'
     });
 };
+export const getGetWorkflowIdTraceAttributesUrl = (id) => {
+    return `/workflow/${id}/trace-attributes`;
+};
+export const getWorkflowIdTraceAttributes = async (id, options) => {
+    return customFetchInstance(getGetWorkflowIdTraceAttributesUrl(id), {
+        ...options,
+        method: 'GET'
+    });
+};
+export const getGetWorkflowIdRunsRidTraceAttributesUrl = (id, rid) => {
+    return `/workflow/${id}/runs/${rid}/trace-attributes`;
+};
+export const getWorkflowIdRunsRidTraceAttributes = async (id, rid, options) => {
+    return customFetchInstance(getGetWorkflowIdRunsRidTraceAttributesUrl(id, rid), {
+        ...options,
+        method: 'GET'
+    });
+};
 export const getGetWorkflowIdHistoryUrl = (id, params) => {
     const normalizedParams = new URLSearchParams();
     Object.entries(params || {}).forEach(([key, value]) => {

package/dist/assets/docker/docker-compose-dev.yml

@@ -77,7 +77,7 @@ services:
         condition: service_healthy
       worker:
         condition: service_healthy
-    image: outputai/api:${OUTPUT_API_VERSION:-0.3.3-next.e8eff63.0}
+    image: outputai/api:${OUTPUT_API_VERSION:-0.4.1-dev.06c2b50.0}
     init: true
     networks:
       - main

package/dist/commands/credentials/edit.js

@@ -48,6 +48,13 @@ export default class CredentialsEdit extends Command {
             const edited = fs.readFileSync(tmpFile, 'utf8');
             // Validate YAML before saving
             parseYaml(edited);
+            // AES-GCM uses a fresh nonce per encrypt, so re-encrypting unchanged
+            // plaintext produces a new ciphertext. Skip the write when nothing
+            // changed to avoid leaving the file dirty in git.
+            if (edited === plaintext) {
+                this.log('No changes detected. Credentials unchanged.');
+                return;
+            }
             writeEncrypted(environment, edited, workflow);
             this.log('Credentials saved successfully.');
         }

package/dist/commands/credentials/edit.spec.js

@@ -1,5 +1,6 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import fs from 'node:fs';
 import * as credentialsService from '#services/credentials_service.js';
 import CredentialsEdit from './edit.js';
 vi.mock('#services/credentials_service.js');
@@ -70,4 +71,26 @@ describe('credentials edit command', () => {
             await expect(cmd.run()).rejects.toThrow('No credentials file found');
         });
     });
+    // Regression: OUT-441 — editing without making changes must not re-encrypt
+    // the file. AES-GCM uses a fresh nonce per encrypt, so an unconditional
+    // re-write produces a new ciphertext and leaves the file dirty in git.
+    describe('no-op edit (OUT-441)', () => {
+        it('should NOT call writeEncrypted when the editor returns unchanged plaintext', async () => {
+            const original = 'anthropic:\n  api_key: sk-test\n';
+            vi.mocked(credentialsService.decryptCredentials).mockReturnValue(original);
+            vi.mocked(fs.readFileSync).mockReturnValue(original);
+            const cmd = createTestCommand();
+            await cmd.run();
+            expect(credentialsService.writeEncrypted).not.toHaveBeenCalled();
+        });
+        it('should still call writeEncrypted when the editor returns modified plaintext', async () => {
+            const original = 'anthropic:\n  api_key: sk-test\n';
+            const modified = 'anthropic:\n  api_key: sk-NEW\n';
+            vi.mocked(credentialsService.decryptCredentials).mockReturnValue(original);
+            vi.mocked(fs.readFileSync).mockReturnValue(modified);
+            const cmd = createTestCommand();
+            await cmd.run();
+            expect(credentialsService.writeEncrypted).toHaveBeenCalledWith(undefined, modified, undefined);
+        });
+    });
 });

package/dist/generated/framework_version.json

@@ -1,3 +1,3 @@
 {
-    "framework": "0.3.3-next.e8eff63.0"
+    "framework": "0.4.1-dev.06c2b50.0"
 }

package/dist/services/cost_calculator.js

@@ -5,6 +5,9 @@ const ARRAY_ACCESS_PATTERN = /^(\w+)\[(\d+)\]$/;
 function tokenCost(tokens, pricePerMillion) {
     return (tokens / 1_000_000) * pricePerMillion;
 }
+function isFiniteNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value);
+}
 export function extractValue(obj, path) {
     if (!path || !obj) {
         return obj;
@@ -69,20 +72,25 @@ function findCalls(node, match, extract, parentStepName = null, seenIds = new Se
     }
     return calls;
 }
+function readAttributeCost(node) {
+    const total = node.attributes?.cost?.total;
+    return isFiniteNumber(total) ? total : undefined;
+}
 export function findLLMCalls(node, parentStepName = null, seenIds = new Set()) {
-    return findCalls(node, n => n.kind === 'llm' && !!n.output?.usage, (n, stepName) => {
+    return findCalls(node, n => n.kind === 'llm' && !!n.attributes?.token_usage, (n, stepName) => {
         const loadedPrompt = n.input?.loadedPrompt;
-        const outputRecord = n.output;
-        const inputRecord = n.input;
+        const outputRecord = (n.output ?? {});
+        const inputRecord = (n.input ?? {});
         const model = loadedPrompt?.config?.model ||
-            outputRecord?.model ||
-            inputRecord?.model ||
+            outputRecord.model ||
+            inputRecord.model ||
             'unknown';
         return {
             stepName: stepName || n.name || 'unknown',
             llmName: n.name || 'llm',
             model,
-            usage: n.output.usage
+            usage: n.attributes.token_usage,
+            attributeCost: readAttributeCost(n)
         };
     }, parentStepName, seenIds);
 }
@@ -93,7 +101,8 @@ export function findHTTPCalls(node, parentStepName = null, seenIds = new Set())
         method: n.input?.method || 'GET',
         input: n.input || {},
         output: n.output || {},
-        status: n.output?.status
+        status: n.output?.status,
+        attributeCost: readAttributeCost(n)
     }), parentStepName, seenIds);
 }
 export function calculateLLMCallCost(usage, modelPricing) {
@@ -277,11 +286,14 @@ function aggregateLLMCosts(llmCalls, config) {
     const totals = { inputTokens: 0, outputTokens: 0, cachedTokens: 0, reasoningTokens: 0, cost: 0 };
     for (const call of llmCalls) {
         const { pricing, matchedKey } = findModelPricing(call.model, config.models ?? {});
-        const { cost, warning } = calculateLLMCallCost(call.usage, pricing);
+        const { cost: yamlCost, warning } = calculateLLMCallCost(call.usage, pricing);
+        // Prefer the cost emitted by the LLM provider on the trace node; fall back to
+        // yaml pricing so unknown-model warnings still surface for breakdown display.
+        const cost = call.attributeCost ?? yamlCost;
         const prefixWarning = (pricing && matchedKey !== call.model) ?
             `priced as ${matchedKey}` :
             undefined;
-        if (!pricing) {
+        if (!pricing && call.attributeCost === undefined) {
             unknownModels.add(call.model);
         }
         results.push({
@@ -319,27 +331,51 @@ export function calculateCost(trace, config, traceFile = '') {
             continue;
         }
         const serviceInfo = identifyService(call, config.services);
-        if (!serviceInfo) {
-            continue;
-        }
-        if (serviceInfo.config.type === 'response_cost') {
-            const hasCostData = extractValue(call, serviceInfo.config.cost_path);
-            const isBillableMethod = serviceInfo.config.billable_method &&
-                call.method === serviceInfo.config.billable_method;
-            if (!hasCostData && !isBillableMethod) {
+        if (serviceInfo) {
+            // attributes.cost on the HTTP node is authoritative when present —
+            // addRequestCost() writes the real billed amount there. Fall back to
+            // the yaml service classifier for legacy callers that don't emit it.
+            const result = call.attributeCost !== undefined ?
+                { step: call.stepName, cost: call.attributeCost, usage: '1 request' } :
+                (() => {
+                    if (serviceInfo.config.type === 'response_cost') {
+                        const hasCostData = extractValue(call, serviceInfo.config.cost_path);
+                        const isBillableMethod = serviceInfo.config.billable_method &&
+                            call.method === serviceInfo.config.billable_method;
+                        if (!hasCostData && !isBillableMethod) {
+                            return null;
+                        }
+                    }
+                    return calculateServiceCost(call, serviceInfo);
+                })();
+            if (!result) {
                 continue;
             }
+            if (!serviceResults[serviceInfo.serviceName]) {
+                serviceResults[serviceInfo.serviceName] = {
+                    serviceName: serviceInfo.serviceName,
+                    calls: [],
+                    totalCost: 0
+                };
+            }
+            serviceResults[serviceInfo.serviceName].calls.push(result);
+            serviceResults[serviceInfo.serviceName].totalCost += result.cost;
+            continue;
         }
-        const result = calculateServiceCost(call, serviceInfo);
-        if (!serviceResults[serviceInfo.serviceName]) {
-            serviceResults[serviceInfo.serviceName] = {
-                serviceName: serviceInfo.serviceName,
-                calls: [],
-                totalCost: 0
-            };
+        // Unclassified HTTP node — still surface its cost if addRequestCost was called.
+        if (call.attributeCost !== undefined && call.attributeCost > 0) {
+            const bucket = 'http';
+            if (!serviceResults[bucket]) {
+                serviceResults[bucket] = { serviceName: bucket, calls: [], totalCost: 0 };
+            }
+            serviceResults[bucket].calls.push({
+                step: call.stepName,
+                cost: call.attributeCost,
+                usage: '1 request',
+                endpoint: call.url
+            });
+            serviceResults[bucket].totalCost += call.attributeCost;
         }
-        serviceResults[serviceInfo.serviceName].calls.push(result);
-        serviceResults[serviceInfo.serviceName].totalCost += result.cost;
     }
     const { results: llmResults, totalInputTokens, totalOutputTokens, totalCachedTokens, totalReasoningTokens, llmTotalCost, unknownModels } = aggregateLLMCosts(llmCalls, config);
     const serviceTotalCost = Object.values(serviceResults).reduce((sum, s) => sum + s.totalCost, 0);

package/dist/services/cost_calculator.spec.js

@@ -27,7 +27,9 @@ const llmTrace = {
                     kind: 'llm',
                     name: 'generate_summary',
                     input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
-                    output: { usage: { inputTokens: 1000, outputTokens: 500 } }
+                    attributes: {
+                        token_usage: { inputTokens: 1000, outputTokens: 500 }
+                    }
                 }
             ]
         },
@@ -41,7 +43,9 @@ const llmTrace = {
                     kind: 'llm',
                     name: 'analyze_data',
                     input: { loadedPrompt: { config: { model: 'claude-haiku-4-5' } } },
-                    output: { usage: { inputTokens: 2000, outputTokens: 1000, cachedInputTokens: 500 } }
+                    attributes: {
+                        token_usage: { inputTokens: 2000, outputTokens: 1000, cachedInputTokens: 500 }
+                    }
                 }
             ]
         }
@@ -107,7 +111,9 @@ const duplicateTrace = {
                     kind: 'llm',
                     name: 'generate',
                     input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
-                    output: { usage: { inputTokens: 1000, outputTokens: 500 } }
+                    attributes: {
+                        token_usage: { inputTokens: 1000, outputTokens: 500 }
+                    }
                 }
             ]
         },
@@ -121,7 +127,9 @@ const duplicateTrace = {
                     kind: 'llm',
                     name: 'generate',
                     input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
-                    output: { usage: { inputTokens: 1000, outputTokens: 500 } }
+                    attributes: {
+                        token_usage: { inputTokens: 1000, outputTokens: 500 }
+                    }
                 }
             ]
         }
@@ -181,12 +189,43 @@ describe('findLLMCalls', () => {
         expect(calls[0].model).toBe('claude-sonnet-4-5');
         expect(calls[1].model).toBe('claude-haiku-4-5');
     });
-    it('extracts token usage', () => {
+    it('extracts token usage from attributes.token_usage', () => {
         const calls = findLLMCalls(llmTrace);
         expect(calls[0].usage.inputTokens).toBe(1000);
         expect(calls[0].usage.outputTokens).toBe(500);
         expect(calls[1].usage.cachedInputTokens).toBe(500);
     });
+    it('ignores llm nodes that only have legacy output.usage (no attributes.token_usage)', () => {
+        const legacyOnlyTrace = {
+            kind: 'workflow',
+            name: 'wf',
+            children: [{
+                    id: 'llm-legacy',
+                    kind: 'llm',
+                    name: 'gen',
+                    output: { usage: { inputTokens: 999, outputTokens: 999 } }
+                }]
+        };
+        expect(findLLMCalls(legacyOnlyTrace)).toHaveLength(0);
+    });
+    it('picks up attributeCost from attributes.cost.total', () => {
+        const trace = {
+            kind: 'workflow',
+            name: 'wf',
+            children: [{
+                    id: 'llm-1',
+                    kind: 'llm',
+                    name: 'gen',
+                    input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
+                    attributes: {
+                        token_usage: { inputTokens: 100, outputTokens: 50 },
+                        cost: { total: 0.0042 }
+                    }
+                }]
+        };
+        const calls = findLLMCalls(trace);
+        expect(calls[0].attributeCost).toBeCloseTo(0.0042, 10);
+    });
     it('deduplicates by ID', () => {
         const calls = findLLMCalls(duplicateTrace);
         expect(calls).toHaveLength(1);
@@ -207,6 +246,22 @@ describe('findHTTPCalls', () => {
         expect(calls[0].stepName).toBe('fetch_content');
         expect(calls[1].stepName).toBe('search');
     });
+    it('reads attributeCost from attributes.cost.total', () => {
+        const trace = {
+            kind: 'workflow',
+            name: 'wf',
+            children: [{
+                    id: 'http-1',
+                    kind: 'http',
+                    name: 'scrape',
+                    input: { url: 'https://api.gx-scraper.test/scrape', method: 'POST' },
+                    output: { status: 200 },
+                    attributes: { cost: { total: 0.5 } }
+                }]
+        };
+        const calls = findHTTPCalls(trace);
+        expect(calls[0].attributeCost).toBe(0.5);
+    });
 });
 describe('calculateLLMCallCost', () => {
     it('calculates cost for known model', () => {
@@ -421,7 +476,7 @@ describe('calculateCost', () => {
                             kind: 'llm',
                             name: 'gen',
                             input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5-20250514' } } },
-                            output: { usage: { inputTokens: 1000, outputTokens: 500 } }
+                            attributes: { token_usage: { inputTokens: 1000, outputTokens: 500 } }
                         }]
                 }]
         };
@@ -430,7 +485,7 @@ describe('calculateCost', () => {
         expect(report.unknownModels).toHaveLength(0);
         expect(report.llmCalls[0].warning).toBe('priced as claude-sonnet-4-5');
     });
-    it('reports unknown model when no prefix match exists', () => {
+    it('reports unknown model when no prefix match exists and no attribute cost is present', () => {
         const trace = {
             kind: 'workflow',
             name: 'test',
@@ -443,7 +498,7 @@ describe('calculateCost', () => {
                             kind: 'llm',
                             name: 'gen',
                             input: { loadedPrompt: { config: { model: 'totally-unknown-model' } } },
-                            output: { usage: { inputTokens: 1000, outputTokens: 500 } }
+                            attributes: { token_usage: { inputTokens: 1000, outputTokens: 500 } }
                         }]
                 }]
         };
@@ -465,13 +520,160 @@ describe('calculateCost', () => {
                             kind: 'llm',
                             name: 'gen',
                             input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
-                            output: { usage: { inputTokens: 1000, outputTokens: 500 } }
+                            attributes: { token_usage: { inputTokens: 1000, outputTokens: 500 } }
                         }]
                 }]
         };
         const report = calculateCost(trace, testConfig, 'test.json');
         expect(report.llmCalls[0].warning).toBeUndefined();
     });
+    it('prefers attributes.cost.total over yaml-computed LLM cost when present', () => {
+        const trace = {
+            kind: 'workflow',
+            name: 'test',
+            children: [{
+                    id: 'step-1',
+                    kind: 'step',
+                    name: 'test#gen',
+                    children: [{
+                            id: 'llm-1',
+                            kind: 'llm',
+                            name: 'gen',
+                            input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
+                            attributes: {
+                                token_usage: { inputTokens: 1000, outputTokens: 500 },
+                                // Authoritative: this is what the provider reported, not what yaml infers.
+                                cost: { total: 0.99 }
+                            }
+                        }]
+                }]
+        };
+        const report = calculateCost(trace, testConfig, 'test.json');
+        expect(report.llmCalls[0].cost).toBe(0.99);
+        expect(report.llmTotalCost).toBe(0.99);
+    });
+    it('still surfaces an attribute LLM cost for unknown models without warning', () => {
+        const trace = {
+            kind: 'workflow',
+            name: 'test',
+            children: [{
+                    id: 'step-1',
+                    kind: 'step',
+                    name: 'test#gen',
+                    children: [{
+                            id: 'llm-1',
+                            kind: 'llm',
+                            name: 'gen',
+                            input: { loadedPrompt: { config: { model: 'brand-new-model' } } },
+                            attributes: {
+                                token_usage: { inputTokens: 100, outputTokens: 20 },
+                                cost: { total: 0.0123 }
+                            }
+                        }]
+                }]
+        };
+        const report = calculateCost(trace, testConfig, 'test.json');
+        expect(report.llmTotalCost).toBeCloseTo(0.0123, 10);
+        expect(report.unknownModels).toEqual([]);
+    });
+    it('includes HTTP request cost from attributes.cost.total for unclassified hosts', () => {
+        // gx-scraper-style: not declared in yaml services, but addRequestCost ran
+        // and put $0.50 on the HTTP node's attributes.cost.total.
+        const trace = {
+            kind: 'workflow',
+            name: 'scraper_workflow',
+            startedAt: 1700000000000,
+            endedAt: 1700000100000,
+            children: [{
+                    id: 'step-1',
+                    kind: 'step',
+                    name: 'scraper_workflow#scrape',
+                    children: [{
+                            id: 'http-1',
+                            kind: 'http',
+                            name: 'scrape_request',
+                            input: { url: 'https://api.gx-scraper.test/v1/scrape', method: 'POST' },
+                            output: { status: 200, body: {} },
+                            attributes: { cost: { total: 0.5 } }
+                        }]
+                }]
+        };
+        const report = calculateCost(trace, testConfig, 'test.json');
+        expect(report.serviceTotalCost).toBe(0.5);
+        expect(report.totalCost).toBe(0.5);
+        expect(report.services).toHaveLength(1);
+        expect(report.services[0].calls[0].cost).toBe(0.5);
+    });
+    it('prefers attributes.cost.total over yaml service classifier for classified HTTP nodes', () => {
+        // Exa with both a yaml `response_cost` rule AND an attribute cost — the
+        // attribute is authoritative.
+        const trace = {
+            kind: 'workflow',
+            name: 'test_workflow',
+            children: [{
+                    id: 'step-exa',
+                    kind: 'step',
+                    name: 'test_workflow#search',
+                    children: [{
+                            id: 'http-exa',
+                            kind: 'http',
+                            name: 'exa_request',
+                            input: { url: 'https://api.exa.ai/research', method: 'POST' },
+                            output: {
+                                status: 200,
+                                body: { model: 'exa-research', costDollars: { total: 0.15, numSearches: 1, numPages: 5 } }
+                            },
+                            attributes: { cost: { total: 0.22 } }
+                        }]
+                }]
+        };
+        const report = calculateCost(trace, testConfig, 'test.json');
+        expect(report.services).toHaveLength(1);
+        expect(report.services[0].serviceName).toBe('exa');
+        expect(report.services[0].totalCost).toBe(0.22);
+    });
+    it('combines LLM and HTTP attribute costs into a single trace total', () => {
+        const trace = {
+            kind: 'workflow',
+            name: 'mixed_workflow',
+            startedAt: 1700000000000,
+            endedAt: 1700000100000,
+            children: [
+                {
+                    id: 'step-llm',
+                    kind: 'step',
+                    name: 'mixed_workflow#draft',
+                    children: [{
+                            id: 'llm-1',
+                            kind: 'llm',
+                            name: 'draft',
+                            input: { loadedPrompt: { config: { model: 'claude-sonnet-4-5' } } },
+                            attributes: {
+                                token_usage: { inputTokens: 100, outputTokens: 50 },
+                                cost: { total: 0.01 }
+                            }
+                        }]
+                },
+                {
+                    id: 'step-http',
+                    kind: 'step',
+                    name: 'mixed_workflow#scrape',
+                    children: [{
+                            id: 'http-1',
+                            kind: 'http',
+                            name: 'scrape',
+                            input: { url: 'https://api.gx-scraper.test/v1/scrape', method: 'POST' },
+                            output: { status: 200, body: {} },
+                            attributes: { cost: { total: 0.5 } }
+                        }]
+                }
+            ]
+        };
+        const report = calculateCost(trace, testConfig, 'test.json');
+        expect(report.llmTotalCost).toBeCloseTo(0.01, 10);
+        expect(report.serviceTotalCost).toBeCloseTo(0.5, 10);
+        expect(report.totalCost).toBeCloseTo(0.51, 10);
+    });
 });
 describe('loadPricingConfig', () => {
     beforeEach(() => {

package/dist/services/credentials_service.integration.test.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { load as parseYaml } from 'js-yaml';
 import { encrypt, decrypt, generateKey } from '@outputai/credentials';
+import { initCredentials, decryptCredentials, writeEncrypted } from './credentials_service.js';
 describe('credentials service integration', () => {
     const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'output-creds-'));
     afterAll(() => {
@@ -63,4 +64,63 @@ describe('credentials service integration', () => {
             expect(parsed.openai.api_key).toBe('sk-openai-789');
         });
     });
+    // Reproduction: editing the dev credential must not touch the production
+    // credential. Reported as a partial bug report — these tests pin the
+    // cross-environment isolation invariant.
+    describe('multi-environment isolation', () => {
+        const withIsolatedProject = (body) => {
+            const originalCwd = process.cwd();
+            const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'output-creds-multi-env-'));
+            process.chdir(projectDir);
+            try {
+                body();
+            }
+            finally {
+                process.chdir(originalCwd);
+                fs.rmSync(projectDir, { recursive: true, force: true });
+            }
+        };
+        it('editing the development credential does not modify the production credential', () => withIsolatedProject(() => {
+            const prod = initCredentials('production');
+            const dev = initCredentials('development');
+            const prodKeyBefore = fs.readFileSync(prod.keyPath);
+            const prodCredBefore = fs.readFileSync(prod.credPath);
+            const devKeyBefore = fs.readFileSync(dev.keyPath);
+            writeEncrypted('development', 'anthropic:\n  api_key: sk-DEV-EDITED\nopenai:\n  api_key: sk-DEV-EDITED-2\n');
+            // Production must be byte-for-byte identical
+            expect(fs.readFileSync(prod.keyPath).equals(prodKeyBefore)).toBe(true);
+            expect(fs.readFileSync(prod.credPath).equals(prodCredBefore)).toBe(true);
+            // Dev key must not have been regenerated
+            expect(fs.readFileSync(dev.keyPath).equals(devKeyBefore)).toBe(true);
+            // Dev credential should now contain the edited plaintext
+            expect(decryptCredentials('development')).toContain('sk-DEV-EDITED');
+            // Production credential should still be the original template (empty values)
+            const prodPlain = decryptCredentials('production');
+            const prodParsed = parseYaml(prodPlain);
+            expect(prodParsed.anthropic.api_key).toBe('');
+            expect(prodParsed.openai.api_key).toBe('');
+        }));
+        it('editing production does not bleed into development', () => withIsolatedProject(() => {
+            const prod = initCredentials('production');
+            const dev = initCredentials('development');
+            const devKeyBefore = fs.readFileSync(dev.keyPath);
+            const devCredBefore = fs.readFileSync(dev.credPath);
+            writeEncrypted('production', 'anthropic:\n  api_key: sk-PROD-EDITED\nopenai:\n  api_key: sk-PROD-EDITED-2\n');
+            expect(fs.readFileSync(dev.keyPath).equals(devKeyBefore)).toBe(true);
+            expect(fs.readFileSync(dev.credPath).equals(devCredBefore)).toBe(true);
+            expect(decryptCredentials('production')).toContain('sk-PROD-EDITED');
+            expect(decryptCredentials('development')).not.toContain('sk-PROD-EDITED');
+            // Sanity: prod and dev still resolved to different paths/keys
+            expect(prod.keyPath).not.toBe(dev.keyPath);
+            expect(prod.credPath).not.toBe(dev.credPath);
+        }));
+        it('initializing a second environment does not mutate the first', () => withIsolatedProject(() => {
+            const prod = initCredentials('production');
+            const prodKeyBytes = fs.readFileSync(prod.keyPath);
+            const prodCredBytes = fs.readFileSync(prod.credPath);
+            initCredentials('development');
+            expect(fs.readFileSync(prod.keyPath).equals(prodKeyBytes)).toBe(true);
+            expect(fs.readFileSync(prod.credPath).equals(prodCredBytes)).toBe(true);
+        }));
+    });
 });

package/dist/templates/project/package.json.template

@@ -23,7 +23,7 @@
   "engines": {
     "node": ">=24.3.0"
   },
-  "output": {
+  "outputai": {
     "hookFiles": ["node_modules/@outputai/credentials/dist/hooks.js"]
   }
 }

package/dist/types/cost.d.ts

@@ -8,6 +8,18 @@ export interface TokenUsage {
     outputTokens?: number;
     cachedInputTokens?: number;
     reasoningTokens?: number;
+    totalTokens?: number;
+}
+export interface TraceCostAttribute {
+    total: number;
+    components?: Array<{
+        name: string;
+        value: number;
+    }>;
+}
+export interface TraceAttributes {
+    cost?: TraceCostAttribute;
+    token_usage?: TokenUsage;
 }
 export interface TraceNode {
     id?: string;
@@ -17,15 +29,15 @@ export interface TraceNode {
     endedAt?: number;
     children?: TraceNode[];
     input?: Record<string, unknown>;
-    output?: Record<string, unknown> & {
-        usage?: TokenUsage;
-    };
+    output?: Record<string, unknown>;
+    attributes?: TraceAttributes;
 }
 export interface LLMCall {
     stepName: string;
     llmName: string;
     model: string;
     usage: TokenUsage;
+    attributeCost?: number;
 }
 export interface HTTPCall {
     stepName: string;
@@ -34,6 +46,7 @@ export interface HTTPCall {
     input: Record<string, unknown>;
     output: Record<string, unknown>;
     status?: number;
+    attributeCost?: number;
 }
 export interface ModelPricing {
     provider: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@outputai/cli",
-  "version": "0.3.3-next.e8eff63.0",
+  "version": "0.4.1-dev.06c2b50.0",
   "description": "CLI for Output.ai workflow generation",
   "type": "module",
   "main": "dist/index.js",
@@ -36,9 +36,9 @@
     "semver": "7.7.4",
     "undici": "8.1.0",
     "yaml": "^2.8.3",
-    "@outputai/credentials": "0.3.3-next.e8eff63.0",
-    "@outputai/evals": "0.3.3-next.e8eff63.0",
-    "@outputai/llm": "0.3.3-next.e8eff63.0"
+    "@outputai/credentials": "0.4.1-dev.06c2b50.0",
+    "@outputai/llm": "0.4.1-dev.06c2b50.0",
+    "@outputai/evals": "0.4.1-dev.06c2b50.0"
   },
   "devDependencies": {
     "@types/cli-progress": "3.11.6",