@prohost/cli 0.10.1 → 0.10.2

package/CHANGELOG.md

@@ -4,6 +4,30 @@ Versions follow [semver](https://semver.org/). Publishing is automated: merging
 a version bump to `main` triggers `.github/workflows/npm-publish-cli.yml`, which
 builds via `prepack`, runs the suite, publishes, and tags `cli-v<version>`.
 
+## 0.10.2
+
+Token totals are attributed to the repository, not the directory a session ran in.
+
+- **Projects are repositories.** A session in a git worktree
+  (`.worktrees/backend-service/fix-something`, `.claude/worktrees/agent-…`) or
+  a subdirectory (`iosApp`, `Sources`) now counts toward its repository
+  (`backend-service`, `mobile`) in "By project". The repository is found from
+  the `.git` the directory sits under — a worktree's `gitdir` / `commondir`
+  lead back to the main repository — with no `git` process per line, and
+  cached per directory. A worktree that has since been removed is recognised by
+  its `…/.worktrees/<repo>/<name>` or `…/<repo>/.claude/worktrees/<name>`
+  path; anything else keeps its basename.
+- **Days are replaced whole.** Each upload now names the (day, account) pairs
+  it carries in full (`completeDays`), and the server deletes that day's other
+  rows for the account, so a renamed project never counts twice.
+- **The upgrade re-reads the last 30 days.** The local scan state is rebuilt
+  once with the new attribution and every day re-sent whole, which replaces
+  the old per-worktree rows. Those days wait until the server confirms it
+  replaces a day whole (an empty upload answered with `replacedDays`, asked at
+  most hourly), so an older server never counts them twice. A day that reads
+  back smaller than first counted (a log removed or rewritten since) is left
+  as it is on the server: per-folder, but with the right total.
+
 ## 0.10.1
 
 Safer key handling for `prohost usage connect`, and no credential ever goes to

package/README.md

@@ -24,8 +24,9 @@ npx @prohost/cli --version    # the version you're running
 Pair once, then leave the agent running:
 
 ```bash
-# 1. In ProhostAI: Hire an AI employee → Bring your own agent → copy the code.
-#    Codes are single-use and expire 15 minutes after they're generated.
+# 1. In ProhostAI: AI Employees → Computers → Pair a computer. It shows this
+#    command with your code filled in. Codes are single-use and expire 15
+#    minutes after they're generated.
 npx @prohost/cli agent pair --code <pairing-code>
 
 # 2. Point it at whatever agent you already use.
@@ -48,8 +49,9 @@ doesn't know or care which one it is.
 
 ### 1. Get a pairing code
 
-In ProhostAI: **Hire an AI employee → Bring your own agent**. You'll get a
-one-time code. It is single-use and expires 15 minutes after it's generated.
+In ProhostAI: **AI Employees → Computers → Pair a computer**. You'll get a
+one-time code, already filled into the command it shows you. It is single-use
+and expires 15 minutes after it's generated.
 
 ### 2. Pair
 
@@ -735,7 +737,7 @@ through ProhostAI's own approval path, not around it via an API key.
 
 `prohost usage` reports, for every Claude Code and Codex login on this machine,
 how much of its subscription is left (the 5-hour and weekly windows, with their
-reset times) and how many tokens it used per day, model and project folder.
+reset times) and how many tokens it used per day, model and project (repository).
 ProhostAI shows it in the workspace's Usage Monitor app. No agent pairing needed.
 
 ```bash
@@ -773,11 +775,17 @@ spends a model turn. Sign-in state comes from `claude auth status` /
 **Tokens.** Read from the session logs the CLIs already write —
 `<config dir>/projects/**/*.jsonl` for Claude Code, `sessions/**/rollout-*.jsonl`
 for Codex — and summed per local day, login, model and project, where the
-project is the **name** of the working directory (`backend-service`, never its
-path). Only usage counters are read: no prompt, reply, tool call or file content
-is kept or sent. The first run looks back 30 days; after that only what was
-appended is read, using a cursor in `$PROHOST_HOME/usage/`. A day that changes
-is re-sent whole, and the server replaces it.
+project is the **name** of the repository the working directory belongs to
+(`backend-service`, never its path). A git worktree or a subdirectory counts as
+its main repository: `.worktrees/backend-service/fix-x` and
+`backend-service/web/src` are both `backend-service`. A directory outside any
+repository is its own name; a removed worktree is recognised by its
+`…/.worktrees/<repo>/<name>` or `…/<repo>/.claude/worktrees/<name>` path. Only
+usage counters are read: no prompt, reply, tool call or file content is kept or
+sent. The first run looks back 30 days; after that only what was appended is
+read, using a cursor in `$PROHOST_HOME/usage/`. A day that changes is re-sent
+whole, marked complete, and the server replaces that day's rows for the login —
+including deleting any project the day no longer has.
 Totals for a login go only after the server has accepted a capacity report
 for it (the server ignores totals for logins it hasn't seen), so each pass
 reports first. When the server says why it skipped a login's rows, the reason

package/dist/usage/project.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The project a session's working directory belongs to: its repository's name.
+ *
+ * A session can run in the repository root, a subdirectory (`iosApp`,
+ * `Sources`) or a git worktree with a branch-like name
+ * (`.worktrees/backend-service/fix-agent-delete-memory-aware`). All of them
+ * are the one repository, so the project is the basename of the MAIN
+ * repository's root:
+ *
+ * 1. Walk up from the directory to the nearest ancestor holding `.git`.
+ * 2. A `.git` directory: that ancestor is the root.
+ * 3. A `.git` file is a linked worktree (or a submodule): its `gitdir:` names
+ *    `<repo>/.git/worktrees/<name>`, whose `commondir` leads back to
+ *    `<repo>/.git`. A submodule's gitdir has neither, so it is its own project.
+ * 4. A directory that no longer exists (a removed worktree) is recognised by
+ *    its layout — `…/.worktrees/<repo>/<name>` or `…/<repo>/.claude/worktrees/<name>`
+ *    — and is otherwise named by its basename.
+ *
+ * Only the basename ever leaves this module, never the path. Results are
+ * cached per directory: the scanner asks once per log line, and the answer is
+ * a few `stat`s the first time and a map lookup after — never a `git` child
+ * process.
+ *
+ * The walk does what `git` itself does, so a directory under a dotfiles
+ * repository at `~` is attributed to it.
+ */
+/** Forget every cached answer (tests; a long-running process never needs it). */
+export declare function clearProjectCache(): void;
+/** The repository name of a session's working directory, or `null` when it names none. */
+export declare function projectName(cwd: unknown): string | null;

package/dist/usage/project.js

@@ -0,0 +1,138 @@
+/**
+ * The project a session's working directory belongs to: its repository's name.
+ *
+ * A session can run in the repository root, a subdirectory (`iosApp`,
+ * `Sources`) or a git worktree with a branch-like name
+ * (`.worktrees/backend-service/fix-agent-delete-memory-aware`). All of them
+ * are the one repository, so the project is the basename of the MAIN
+ * repository's root:
+ *
+ * 1. Walk up from the directory to the nearest ancestor holding `.git`.
+ * 2. A `.git` directory: that ancestor is the root.
+ * 3. A `.git` file is a linked worktree (or a submodule): its `gitdir:` names
+ *    `<repo>/.git/worktrees/<name>`, whose `commondir` leads back to
+ *    `<repo>/.git`. A submodule's gitdir has neither, so it is its own project.
+ * 4. A directory that no longer exists (a removed worktree) is recognised by
+ *    its layout — `…/.worktrees/<repo>/<name>` or `…/<repo>/.claude/worktrees/<name>`
+ *    — and is otherwise named by its basename.
+ *
+ * Only the basename ever leaves this module, never the path. Results are
+ * cached per directory: the scanner asks once per log line, and the answer is
+ * a few `stat`s the first time and a map lookup after — never a `git` child
+ * process.
+ *
+ * The walk does what `git` itself does, so a directory under a dotfiles
+ * repository at `~` is attributed to it.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+const MAX_PROJECT_CHARS = 120;
+/** Directories remembered; far more than one machine's sessions ever name. */
+const MAX_CACHED = 5000;
+/** Deepest walk up from a directory looking for `.git`. */
+const MAX_ANCESTORS = 64;
+const cache = new Map();
+/** Forget every cached answer (tests; a long-running process never needs it). */
+export function clearProjectCache() {
+    cache.clear();
+}
+/** The repository name of a session's working directory, or `null` when it names none. */
+export function projectName(cwd) {
+    if (typeof cwd !== 'string' || !cwd.trim())
+        return null;
+    const dir = cwd.trim().replace(/[\\/]+$/, '');
+    if (!dir)
+        return null;
+    const cached = cache.get(dir);
+    if (cached !== undefined)
+        return cached;
+    const base = path.basename(resolveProjectRoot(dir));
+    const name = base ? base.slice(0, MAX_PROJECT_CHARS) : null;
+    if (cache.size >= MAX_CACHED)
+        cache.clear();
+    cache.set(dir, name);
+    return name;
+}
+/** The directory whose basename names the project. */
+function resolveProjectRoot(dir) {
+    if (!isDirectory(dir))
+        return removedWorktreeRepo(dir) ?? dir;
+    let current = dir;
+    for (let depth = 0; depth < MAX_ANCESTORS; depth += 1) {
+        const root = repoRootAt(current);
+        if (root)
+            return root;
+        const parent = path.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return dir;
+}
+/** The main repository root when `dir` holds a `.git`; `undefined` when it holds none. */
+function repoRootAt(dir) {
+    const dotGit = path.join(dir, '.git');
+    let stat;
+    try {
+        stat = statSync(dotGit);
+    }
+    catch {
+        return undefined;
+    }
+    if (stat.isDirectory())
+        return dir;
+    if (!stat.isFile())
+        return undefined;
+    const gitDir = readGitDir(dotGit);
+    return (gitDir && mainRepoOf(gitDir)) ?? dir;
+}
+/** The `gitdir:` a `.git` file points at, resolved against the file's directory. */
+function readGitDir(dotGitFile) {
+    try {
+        const match = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(dotGitFile, 'utf8'));
+        return match?.[1] ? path.resolve(path.dirname(dotGitFile), match[1]) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** A linked worktree's main repository root, from its gitdir; `undefined` for a submodule. */
+function mainRepoOf(gitDir) {
+    let common;
+    try {
+        const relative = readFileSync(path.join(gitDir, 'commondir'), 'utf8').trim();
+        if (relative)
+            common = path.resolve(gitDir, relative);
+    }
+    catch {
+        // No commondir: read the conventional `<repo>/.git/worktrees/<name>` layout.
+        const match = /^(.*)[\\/]\.git[\\/]worktrees[\\/][^\\/]+$/.exec(gitDir);
+        if (match?.[1])
+            return match[1];
+    }
+    if (!common)
+        return undefined;
+    // `<repo>/.git` → `<repo>`; a bare `<repo>.git` common dir names the repo itself.
+    if (path.basename(common) === '.git')
+        return path.dirname(common);
+    return common.replace(/\.git$/, '') || common;
+}
+/** The repository a removed worktree path belonged to, from the two layouts agents use. */
+function removedWorktreeRepo(dir) {
+    const sep = '[\\\\/]';
+    const claude = new RegExp(`^(.*?)${sep}\\.claude${sep}worktrees${sep}[^\\\\/]+(?:${sep}.*)?$`).exec(dir);
+    if (claude?.[1])
+        return claude[1];
+    const sibling = new RegExp(`${sep}\\.worktrees${sep}([^\\\\/]+)${sep}[^\\\\/]+(?:${sep}.*)?$`).exec(dir);
+    if (sibling?.[1])
+        return sibling[1];
+    return undefined;
+}
+function isDirectory(dir) {
+    try {
+        return statSync(dir).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}

package/dist/usage/scanner.d.ts

@@ -2,7 +2,9 @@
  * Token totals from the session logs Claude Code and Codex already write.
  *
  * Aggregates only: tokens per (local day, account, runtime, model, project),
- * where the project is the basename of the working directory the log names.
+ * where the project is the name of the repository the log's working directory
+ * belongs to — a worktree or a subdirectory counts as its repository (see
+ * `project.ts`).
  * No prompt, reply, tool call or file path ever leaves this module — lines are
  * parsed for their usage counters and nothing else is kept.
  *
@@ -21,9 +23,19 @@
  * Incremental: a cursor per file (byte offset, size, mtime) lives in the scan
  * state, so each pass reads only what was appended. The first pass looks back
  * {@link RETENTION_DAYS} days. Every (day, account) a pass changes is marked dirty and is
- * re-sent whole — the server replaces a day's rows, so a resend is harmless.
+ * re-sent whole, and the upload names it as complete: the server replaces that
+ * day's rows for the account and deletes any it no longer carries, so a resend
+ * is harmless and a renamed project leaves no stale row behind.
+ *
+ * State version 2 changed project attribution (repository, not directory). A
+ * version-1 state is discarded and every log in the window read again; its
+ * per-(day, account) totals are kept as {@link ScanState.legacy}. Those pairs'
+ * server rows still carry per-directory projects, so the uploader sends them
+ * only to a server that replaces a day whole, and only when the rebuild
+ * found at least what version 1 had counted (see `service.ts`).
  */
 import type { AccountRuntime } from '../agent/accounts.js';
+export { projectName } from './project.js';
 /** How far back the first scan looks, and how long totals are kept locally. */
 export declare const RETENTION_DAYS = 30;
 /** Most rows in one `POST /v1/usage/token-totals`. */
@@ -54,7 +66,7 @@ interface CodexCursor {
 }
 type Cursor = ClaudeCursor | CodexCursor;
 export interface ScanState {
-    version: 1;
+    version: 2;
     files: Record<string, Cursor>;
     /** Bucket key ({@link bucketKey}) → totals. */
     buckets: Record<string, Totals>;
@@ -64,11 +76,19 @@ export interface ScanState {
     dirty: string[];
     /** Pending pair → consecutive uploads the server only partly accepted. */
     strikes: Record<string, number>;
+    /**
+     * Pair → what the version-1 state had counted for it, for pairs whose
+     * server rows may still carry per-directory projects. An entry goes once
+     * the pair is replaced whole on the server, or is given up on.
+     */
+    legacy: Record<string, Totals>;
 }
 /** A dirty entry: one account's rows for one day. */
 export declare function pendingKey(day: string, accountKey: string): string;
 /** The day of a dirty entry. */
 export declare function pendingDay(entry: string): string;
+/** The account key of a dirty entry. */
+export declare function pendingAccount(entry: string): string;
 /** Days with anything pending, sorted. */
 export declare function pendingDays(state: ScanState): string[];
 export interface TokenRow {
@@ -93,14 +113,23 @@ export interface ScanSummary {
     touchedDays: string[];
 }
 export declare function emptyScanState(): ScanState;
+/**
+ * Load the scan state. A version-1 state (per-directory projects) is replaced
+ * by an empty one that re-reads every log, keeping its per-pair totals as
+ * {@link ScanState.legacy}.
+ */
 export declare function loadScanState(file: string): ScanState;
+/**
+ * Whether a re-attributed pair's rebuild counted less than version 1 had — a
+ * log rewritten or removed since, or a file that fell out of the window. Its
+ * server rows are then left as they are: mis-attributed, but the right total.
+ */
+export declare function rebuildFellShort(rebuilt: Totals, legacy: Totals): boolean;
 export declare function saveScanState(file: string, state: ScanState): void;
 /** `YYYY-MM-DD` of an instant in a time zone (the machine's by default). */
 export declare function dayKey(ms: number, timeZone?: string): string;
 /** Bucket identity. JSON so it round-trips; the day is first so it can be read cheaply. */
 export declare function bucketKey(day: string, accountKey: string, runtime: AccountRuntime, model: string, project: string | null): string;
-/** Basename of a working directory — the repo or folder name, never the path. */
-export declare function projectName(cwd: unknown): string | null;
 /**
  * One incremental pass over every account's logs. Mutates and returns
  * ``state``; the caller persists it.
@@ -110,8 +139,20 @@ export declare function scanUsage(accounts: ScanAccount[], state: ScanState, opt
 export declare function rowsForDays(state: ScanState, days: Iterable<string>): TokenRow[];
 /** The rows for the given `day|accountKey` pairs, in upload shape. */
 export declare function rowsForPending(state: ScanState, pairs: Iterable<string>): TokenRow[];
-/** Split rows into upload batches. */
-export declare function batches<T>(rows: T[], size?: number): T[][];
+/** One `POST /v1/usage/token-totals` body's rows, and what it says about each (day, account) pair. */
+export interface UploadBatch {
+    rows: TokenRow[];
+    /** Pairs whose first row is here: sent as `completeDays`, so the server replaces each one whole. */
+    complete: string[];
+    /** Pairs whose last row is here: done once this batch is taken. */
+    last: string[];
+}
+/**
+ * Split rows into upload batches without splitting a (day, account) pair,
+ * so each body carries every row of the pairs it names complete. A pair
+ * larger than a batch is sent over consecutive batches: complete in the
+ * first (the server clears its rows, then stores these), added to by the rest.
+ */
+export declare function uploadBatches(rows: TokenRow[], size?: number): UploadBatch[];
 /** Local totals per account since ``fromDay`` (inclusive), for `usage status`. */
 export declare function localTotals(state: ScanState, fromDay: string): Map<string, Totals>;
-export {};

package/dist/usage/scanner.js

@@ -2,7 +2,9 @@
  * Token totals from the session logs Claude Code and Codex already write.
  *
  * Aggregates only: tokens per (local day, account, runtime, model, project),
- * where the project is the basename of the working directory the log names.
+ * where the project is the name of the repository the log's working directory
+ * belongs to — a worktree or a subdirectory counts as its repository (see
+ * `project.ts`).
  * No prompt, reply, tool call or file path ever leaves this module — lines are
  * parsed for their usage counters and nothing else is kept.
  *
@@ -21,11 +23,22 @@
  * Incremental: a cursor per file (byte offset, size, mtime) lives in the scan
  * state, so each pass reads only what was appended. The first pass looks back
  * {@link RETENTION_DAYS} days. Every (day, account) a pass changes is marked dirty and is
- * re-sent whole — the server replaces a day's rows, so a resend is harmless.
+ * re-sent whole, and the upload names it as complete: the server replaces that
+ * day's rows for the account and deletes any it no longer carries, so a resend
+ * is harmless and a renamed project leaves no stale row behind.
+ *
+ * State version 2 changed project attribution (repository, not directory). A
+ * version-1 state is discarded and every log in the window read again; its
+ * per-(day, account) totals are kept as {@link ScanState.legacy}. Those pairs'
+ * server rows still carry per-directory projects, so the uploader sends them
+ * only to a server that replaces a day whole, and only when the rebuild
+ * found at least what version 1 had counted (see `service.ts`).
  */
 import { closeSync, fstatSync, openSync, readFileSync, readSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { writePrivateFile } from './config.js';
+import { projectName } from './project.js';
+export { projectName } from './project.js';
 /** How far back the first scan looks, and how long totals are kept locally. */
 export const RETENTION_DAYS = 30;
 /** Most rows in one `POST /v1/usage/token-totals`. */
@@ -34,7 +47,6 @@ const DAY_MS = 86_400_000;
 const READ_CHUNK_BYTES = 4 * 1024 * 1024;
 /** Deepest directory level walked under `projects/` or `sessions/`. */
 const MAX_WALK_DEPTH = 6;
-const MAX_PROJECT_CHARS = 120;
 const MAX_MODEL_CHARS = 120;
 /** A dirty entry: one account's rows for one day. */
 export function pendingKey(day, accountKey) {
@@ -44,30 +56,81 @@ export function pendingKey(day, accountKey) {
 export function pendingDay(entry) {
     return entry.slice(0, 10);
 }
+/** The account key of a dirty entry. */
+export function pendingAccount(entry) {
+    return entry.slice(11);
+}
 /** Days with anything pending, sorted. */
 export function pendingDays(state) {
     return [...new Set(state.dirty.map(pendingDay))].sort();
 }
 export function emptyScanState() {
-    return { version: 1, files: {}, buckets: {}, seen: {}, dirty: [], strikes: {} };
+    return { version: 2, files: {}, buckets: {}, seen: {}, dirty: [], strikes: {}, legacy: {} };
 }
+const pairList = (value) => Array.isArray(value) ? value.filter((d) => typeof d === 'string' && d.includes('|')) : [];
+const isTotals = (value) => Array.isArray(value) && value.length === 4 && value.every((n) => typeof n === 'number' && Number.isFinite(n));
+/** Version-1 buckets summed per (day, account) pair. */
+function legacyTotals(buckets) {
+    const out = {};
+    if (!buckets || typeof buckets !== 'object')
+        return out;
+    for (const [key, totals] of Object.entries(buckets)) {
+        if (!isTotals(totals))
+            continue;
+        let day;
+        let accountKey;
+        try {
+            [day, accountKey] = JSON.parse(key);
+        }
+        catch {
+            continue;
+        }
+        if (typeof day !== 'string' || typeof accountKey !== 'string')
+            continue;
+        const pair = pendingKey(day, accountKey);
+        const sum = out[pair] ?? [0, 0, 0, 0];
+        for (let i = 0; i < 4; i += 1)
+            sum[i] = sum[i] + totals[i];
+        out[pair] = sum;
+    }
+    return out;
+}
+/**
+ * Load the scan state. A version-1 state (per-directory projects) is replaced
+ * by an empty one that re-reads every log, keeping its per-pair totals as
+ * {@link ScanState.legacy}.
+ */
 export function loadScanState(file) {
+    let parsed;
     try {
-        const parsed = JSON.parse(readFileSync(file, 'utf8'));
-        if (parsed?.version !== 1)
-            return emptyScanState();
-        return {
-            version: 1,
-            files: parsed.files && typeof parsed.files === 'object' ? parsed.files : {},
-            buckets: parsed.buckets && typeof parsed.buckets === 'object' ? parsed.buckets : {},
-            seen: parsed.seen && typeof parsed.seen === 'object' ? parsed.seen : {},
-            dirty: Array.isArray(parsed.dirty) ? parsed.dirty.filter((d) => typeof d === 'string' && d.includes('|')) : [],
-            strikes: parsed.strikes && typeof parsed.strikes === 'object' ? parsed.strikes : {},
-        };
+        parsed = JSON.parse(readFileSync(file, 'utf8'));
     }
     catch {
         return emptyScanState();
     }
+    if (parsed?.version === 1)
+        return { ...emptyScanState(), legacy: legacyTotals(parsed.buckets) };
+    if (parsed?.version !== 2)
+        return emptyScanState();
+    return {
+        version: 2,
+        files: parsed.files && typeof parsed.files === 'object' ? parsed.files : {},
+        buckets: parsed.buckets && typeof parsed.buckets === 'object' ? parsed.buckets : {},
+        seen: parsed.seen && typeof parsed.seen === 'object' ? parsed.seen : {},
+        dirty: pairList(parsed.dirty),
+        strikes: parsed.strikes && typeof parsed.strikes === 'object' ? parsed.strikes : {},
+        legacy: parsed.legacy && typeof parsed.legacy === 'object'
+            ? Object.fromEntries(Object.entries(parsed.legacy).filter(([pair, t]) => pair.includes('|') && isTotals(t)))
+            : {},
+    };
+}
+/**
+ * Whether a re-attributed pair's rebuild counted less than version 1 had — a
+ * log rewritten or removed since, or a file that fell out of the window. Its
+ * server rows are then left as they are: mis-attributed, but the right total.
+ */
+export function rebuildFellShort(rebuilt, legacy) {
+    return rebuilt.some((n, i) => n < legacy[i]);
 }
 export function saveScanState(file, state) {
     writePrivateFile(file, JSON.stringify(state));
@@ -97,13 +160,6 @@ export function bucketKey(day, accountKey, runtime, model, project) {
 function dayOfBucket(key) {
     return key.slice(2, 12);
 }
-/** Basename of a working directory — the repo or folder name, never the path. */
-export function projectName(cwd) {
-    if (typeof cwd !== 'string' || !cwd.trim())
-        return null;
-    const base = path.basename(cwd.trim().replace(/[\\/]+$/, ''));
-    return base ? base.slice(0, MAX_PROJECT_CHARS) : null;
-}
 function asObject(value) {
     return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
 }
@@ -362,6 +418,9 @@ export function scanUsage(accounts, state, options = {}) {
     for (const pair of touchedPairs)
         delete state.strikes[pair];
     state.dirty = [...new Set([...state.dirty, ...touchedPairs])].filter((d) => pendingDay(d) >= pass.cutoffDay).sort();
+    for (const pair of Object.keys(state.legacy))
+        if (pendingDay(pair) < pass.cutoffDay)
+            delete state.legacy[pair];
     for (const pair of Object.keys(state.strikes))
         if (!state.dirty.includes(pair))
             delete state.strikes[pair];
@@ -415,11 +474,41 @@ export function rowsForPending(state, pairs) {
     const days = new Set([...wanted].map(pendingDay));
     return rowsForDays(state, days).filter((r) => wanted.has(pendingKey(r.day, r.accountKey)));
 }
-/** Split rows into upload batches. */
-export function batches(rows, size = MAX_ROWS_PER_BATCH) {
+/**
+ * Split rows into upload batches without splitting a (day, account) pair,
+ * so each body carries every row of the pairs it names complete. A pair
+ * larger than a batch is sent over consecutive batches: complete in the
+ * first (the server clears its rows, then stores these), added to by the rest.
+ */
+export function uploadBatches(rows, size = MAX_ROWS_PER_BATCH) {
+    const groups = new Map();
+    for (const row of rows) {
+        const pair = pendingKey(row.day, row.accountKey);
+        const group = groups.get(pair);
+        if (group)
+            group.push(row);
+        else
+            groups.set(pair, [row]);
+    }
     const out = [];
-    for (let i = 0; i < rows.length; i += size)
-        out.push(rows.slice(i, i + size));
+    let current;
+    for (const [pair, group] of groups) {
+        if (current && current.rows.length + group.length <= size) {
+            current.rows.push(...group);
+            current.complete.push(pair);
+            current.last.push(pair);
+            continue;
+        }
+        for (let start = 0; start < group.length; start += size) {
+            const chunk = group.slice(start, start + size);
+            current = {
+                rows: chunk,
+                complete: start === 0 ? [pair] : [],
+                last: start + size >= group.length ? [pair] : [],
+            };
+            out.push(current);
+        }
+    }
     return out;
 }
 /** Local totals per account since ``fromDay`` (inclusive), for `usage status`. */

package/dist/usage/service.d.ts

@@ -13,6 +13,8 @@ export declare const REPORTS_PATH = "/v1/usage/reports";
 export declare const TOKEN_TOTALS_PATH = "/v1/usage/token-totals";
 /** Tick cadence. */
 export declare const USAGE_INTERVAL_MS: number;
+/** How long a server that does not replace a day whole is trusted to stay that way before it is asked again. */
+export declare const REPLACE_PROBE_INTERVAL_MS: number;
 /** Partial uploads of one day's rows for one account before they are given up on. */
 export declare const MAX_PARTIAL_STRIKES = 3;
 /**
@@ -32,6 +34,12 @@ export interface Acceptance {
     keys?: Set<string>;
     /** Accounts it skipped, and why (newer servers). */
     skipped?: Map<string, SkipReason>;
+    /**
+     * Token totals: how many `completeDays` pairs the server replaced whole.
+     * Absent from a server that ignores `completeDays` — it only upserts, and
+     * leaves rows the body no longer carries.
+     */
+    replacedDays?: number;
 }
 /** Read `{accepted, acceptedAccountKeys?, skipped?}` from a 2xx body. */
 export declare function parseAcceptance(body: string | undefined, sent: number): Acceptance;
@@ -82,6 +90,8 @@ export declare class UsageService {
     private readonly prober;
     readonly reportBackoff: Backoff;
     readonly totalsBackoff: Backoff;
+    /** The last {@link serverReplacesDays} answer, for this process only. */
+    private replaceProbe?;
     private scan;
     private status;
     private warned;
@@ -110,8 +120,27 @@ export declare class UsageService {
      * `not_reported`, costs a strike; after {@link MAX_PARTIAL_STRIKES} the pair
      * is given up on (logged once), so nothing is resent forever. Pairs whose
      * account has never been reported wait without a strike, and are not sent.
+     *
+     * Every pair goes out as `completeDays`, never split across bodies unless
+     * it alone outgrows one: a server that understands it deletes the pair's
+     * rows the body no longer carries and says so with `replacedDays`.
+     *
+     * A pair re-attributed by the version-2 upgrade (`scan.legacy`) still has
+     * per-directory rows on the server, so sending it to a server that only
+     * upserts would count it twice. It is held until a probe (an empty body)
+     * comes back with `replacedDays`, asked again at most every
+     * {@link REPLACE_PROBE_INTERVAL_MS}; other pairs go out meanwhile. A pair
+     * whose rebuild counted less than version 1 had (a log removed or rewritten
+     * since) is not sent at all: its old rows are mis-attributed but total right.
      */
     private uploadDirty;
+    /**
+     * Whether the server deletes the rows a complete day no longer carries: an
+     * empty body is answered with `replacedDays` only by one that does. A yes
+     * is kept for the process; a no (or a failed call) is asked again after
+     * {@link REPLACE_PROBE_INTERVAL_MS}.
+     */
+    private serverReplacesDays;
     private note;
     private callRecord;
 }

package/dist/usage/service.js

@@ -17,11 +17,13 @@ import { Backoff } from './backoff.js';
 import { resolveUsageKey, usageStateDir, writePrivateFile } from './config.js';
 import { accountConfigDir } from './discovery.js';
 import { buildReportFrame, defaultProber, probeAccounts } from './quota.js';
-import { batches, loadScanState, pendingKey, rowsForPending, saveScanState, scanUsage } from './scanner.js';
+import { loadScanState, pendingAccount, pendingDay, pendingKey, rebuildFellShort, rowsForPending, saveScanState, scanUsage, uploadBatches, } from './scanner.js';
 export const REPORTS_PATH = '/v1/usage/reports';
 export const TOKEN_TOTALS_PATH = '/v1/usage/token-totals';
 /** Tick cadence. */
 export const USAGE_INTERVAL_MS = 5 * 60_000;
+/** How long a server that does not replace a day whole is trusted to stay that way before it is asked again. */
+export const REPLACE_PROBE_INTERVAL_MS = 60 * 60_000;
 /** Partial uploads of one day's rows for one account before they are given up on. */
 export const MAX_PARTIAL_STRIKES = 3;
 /** Skips that will never turn into an acceptance from this machine. */
@@ -49,7 +51,13 @@ export function parseAcceptance(body, sent) {
             }
         }
     }
-    return { accepted, ...(keys ? { keys } : {}), ...(skipped ? { skipped } : {}) };
+    const replacedDays = typeof parsed?.replacedDays === 'number' && Number.isFinite(parsed.replacedDays) ? parsed.replacedDays : undefined;
+    return {
+        accepted,
+        ...(keys ? { keys } : {}),
+        ...(skipped ? { skipped } : {}),
+        ...(replacedDays !== undefined ? { replacedDays } : {}),
+    };
 }
 export function scanStatePath(env = process.env) {
     return path.join(usageStateDir(env), 'scan.json');
@@ -82,6 +90,8 @@ export class UsageService {
     prober;
     reportBackoff;
     totalsBackoff;
+    /** The last {@link serverReplacesDays} answer, for this process only. */
+    replaceProbe;
     scan;
     status;
     warned = new Set();
@@ -214,35 +224,89 @@ export class UsageService {
      * `not_reported`, costs a strike; after {@link MAX_PARTIAL_STRIKES} the pair
      * is given up on (logged once), so nothing is resent forever. Pairs whose
      * account has never been reported wait without a strike, and are not sent.
+     *
+     * Every pair goes out as `completeDays`, never split across bodies unless
+     * it alone outgrows one: a server that understands it deletes the pair's
+     * rows the body no longer carries and says so with `replacedDays`.
+     *
+     * A pair re-attributed by the version-2 upgrade (`scan.legacy`) still has
+     * per-directory rows on the server, so sending it to a server that only
+     * upserts would count it twice. It is held until a probe (an empty body)
+     * comes back with `replacedDays`, asked again at most every
+     * {@link REPLACE_PROBE_INTERVAL_MS}; other pairs go out meanwhile. A pair
+     * whose rebuild counted less than version 1 had (a log removed or rewritten
+     * since) is not sent at all: its old rows are mis-attributed but total right.
      */
     async uploadDirty(api, machineId, machine) {
         const scan = this.scan;
         const rows = rowsForPending(scan, scan.dirty);
-        const ready = rows.filter((r) => this.reportedKeys.has(r.accountKey));
+        let ready = rows.filter((r) => this.reportedKeys.has(r.accountKey));
         const done = new Set();
         const pendingWithRows = new Set(rows.map((r) => pendingKey(r.day, r.accountKey)));
         // Pending pairs with nothing to send (all-zero) are simply done.
         for (const pair of scan.dirty)
             if (!pendingWithRows.has(pair))
                 done.add(pair);
+        const legacyReady = new Set(ready.map((r) => pendingKey(r.day, r.accountKey)).filter((pair) => scan.legacy[pair] !== undefined));
+        if (legacyReady.size > 0) {
+            if (!(await this.serverReplacesDays(api, machineId, machine))) {
+                ready = ready.filter((r) => !legacyReady.has(pendingKey(r.day, r.accountKey)));
+            }
+            else {
+                const rebuilt = new Map();
+                for (const r of ready) {
+                    const pair = pendingKey(r.day, r.accountKey);
+                    if (!legacyReady.has(pair))
+                        continue;
+                    const sum = rebuilt.get(pair) ?? [0, 0, 0, 0];
+                    rebuilt.set(pair, [
+                        sum[0] + r.inputTokens,
+                        sum[1] + r.cachedInputTokens,
+                        sum[2] + r.cacheWriteTokens,
+                        sum[3] + r.outputTokens,
+                    ]);
+                }
+                const short = new Set([...rebuilt].filter(([pair, t]) => rebuildFellShort(t, scan.legacy[pair])).map(([p]) => p));
+                for (const pair of short) {
+                    done.add(pair);
+                    delete scan.legacy[pair];
+                }
+                if (short.size > 0) {
+                    ready = ready.filter((r) => !short.has(pendingKey(r.day, r.accountKey)));
+                    this.warnOnce('legacy_short', `token totals: ${short.size} earlier day(s) read back smaller than first counted (logs removed or ` +
+                        'rewritten since); they keep their per-folder projects on the server so their totals stay right.');
+                }
+            }
+        }
         let sent = 0;
         let gaveUp = 0;
-        for (const batch of batches(ready)) {
-            const response = await postJson(api, TOKEN_TOTALS_PATH, { machineId, machine, days: batch }, undefined, true);
+        for (const batch of uploadBatches(ready)) {
+            const body = {
+                machineId,
+                machine,
+                days: batch.rows,
+                completeDays: batch.complete.map((pair) => ({ day: pendingDay(pair), accountKey: pendingAccount(pair) })),
+            };
+            const response = await postJson(api, TOKEN_TOTALS_PATH, body, undefined, true);
             this.note(this.totalsBackoff, response);
-            const acceptance = response.ok ? parseAcceptance(response.body, batch.length) : { accepted: 0 };
-            this.status.lastTotals = { ...this.callRecord(response, batch.length), accepted: acceptance.accepted };
+            const acceptance = response.ok ? parseAcceptance(response.body, batch.rows.length) : { accepted: 0 };
+            this.status.lastTotals = { ...this.callRecord(response, batch.rows.length), accepted: acceptance.accepted };
             if (!response.ok)
                 break;
             sent += acceptance.accepted;
+            const lastHere = new Set(batch.last);
             const pairs = new Map(); // pair → accountKey
-            for (const row of batch)
+            for (const row of batch.rows)
                 pairs.set(pendingKey(row.day, row.accountKey), row.accountKey);
             for (const [pair, accountKey] of pairs) {
-                const taken = acceptance.keys ? acceptance.keys.has(accountKey) : acceptance.accepted >= batch.length;
+                const taken = acceptance.keys ? acceptance.keys.has(accountKey) : acceptance.accepted >= batch.rows.length;
                 if (taken) {
+                    // A pair spread over several bodies is done with its last one.
+                    if (!lastHere.has(pair))
+                        continue;
                     done.add(pair);
                     delete scan.strikes[pair];
+                    delete scan.legacy[pair];
                     continue;
                 }
                 const reason = acceptance.skipped?.get(accountKey);
@@ -251,6 +315,7 @@ export class UsageService {
                 if (reason && PERMANENT_SKIPS.has(reason)) {
                     done.add(pair);
                     delete scan.strikes[pair];
+                    delete scan.legacy[pair];
                     this.warnOnce(`totals_skip:${accountKey}:${reason}`, `token totals: account ${accountKey.slice(0, 8)}… skipped (${reason}); those rows will not be resent.`);
                     continue;
                 }
@@ -260,6 +325,7 @@ export class UsageService {
                 if (strikes >= MAX_PARTIAL_STRIKES) {
                     done.add(pair);
                     delete scan.strikes[pair];
+                    delete scan.legacy[pair];
                     gaveUp += 1;
                 }
                 else {
@@ -275,6 +341,27 @@ export class UsageService {
         saveScanState(scanStatePath(this.env), scan);
         return sent;
     }
+    /**
+     * Whether the server deletes the rows a complete day no longer carries: an
+     * empty body is answered with `replacedDays` only by one that does. A yes
+     * is kept for the process; a no (or a failed call) is asked again after
+     * {@link REPLACE_PROBE_INTERVAL_MS}.
+     */
+    async serverReplacesDays(api, machineId, machine) {
+        if (this.replaceProbe?.supported)
+            return true;
+        if (this.replaceProbe && this.now() - this.replaceProbe.at < REPLACE_PROBE_INTERVAL_MS)
+            return false;
+        const response = await postJson(api, TOKEN_TOTALS_PATH, { machineId, machine, days: [], completeDays: [] }, undefined, true);
+        this.note(this.totalsBackoff, response);
+        const supported = response.ok && parseAcceptance(response.body, 0).replacedDays !== undefined;
+        this.replaceProbe = { supported, at: this.now() };
+        if (!supported && response.ok) {
+            this.warnOnce('replace_unsupported', 'token totals: the server does not replace a day whole yet; days counted under per-folder projects ' +
+                'wait until it does, so nothing is counted twice.');
+        }
+        return supported;
+    }
     note(backoff, response) {
         const line = backoff.record(response);
         if (line)

package/dist/version.d.ts

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export declare const CLI_VERSION = "0.10.1";
+export declare const CLI_VERSION = "0.10.2";
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
-export declare const USER_AGENT = "prohost-cli/0.10.1";
+export declare const USER_AGENT = "prohost-cli/0.10.2";

package/dist/version.js

@@ -7,6 +7,6 @@
  * `package.json`, so a release bump that forgets this file fails the suite
  * instead of shipping a `User-Agent` that lies about which build is calling.
  */
-export const CLI_VERSION = '0.10.1';
+export const CLI_VERSION = '0.10.2';
 /** Sent on every HTTP request the CLI makes back into ProhostAI. */
 export const USER_AGENT = `prohost-cli/${CLI_VERSION}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prohost/cli",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Run your own AI agent as a ProhostAI teammate, and stream your account's webhooks to your laptop.",
   "type": "module",
   "license": "MIT",