@subvalue/cli 0.1.0

package/dist/packages/core/src/pricing/current.js

@@ -0,0 +1,326 @@
+                                             
+// Official standard text/code tariff snapshot, checked 2026-10-05.
+// These prices are deliberately not backdated to unverified history.
+const rows                                                                                                             =[
+  {
+    "model": "gpt-5.5",
+    "input": 5,
+    "cached": 0.5,
+    "write": null,
+    "output": 30,
+    "long": true
+  },
+  {
+    "model": "gpt-5.5-pro",
+    "input": 30,
+    "cached": null,
+    "write": null,
+    "output": 180,
+    "long": true
+  },
+  {
+    "model": "gpt-5.4",
+    "input": 2.5,
+    "cached": 0.25,
+    "write": null,
+    "output": 15,
+    "long": true
+  },
+  {
+    "model": "gpt-5.4-mini",
+    "input": 0.75,
+    "cached": 0.075,
+    "write": null,
+    "output": 4.5,
+    "long": false
+  },
+  {
+    "model": "gpt-5.4-nano",
+    "input": 0.2,
+    "cached": 0.02,
+    "write": null,
+    "output": 1.25,
+    "long": false
+  },
+  {
+    "model": "gpt-5.4-pro",
+    "input": 30,
+    "cached": null,
+    "write": null,
+    "output": 180,
+    "long": true
+  },
+  {
+    "model": "gpt-5.2",
+    "input": 1.75,
+    "cached": 0.175,
+    "write": null,
+    "output": 14,
+    "long": false
+  },
+  {
+    "model": "gpt-5.2-pro",
+    "input": 21,
+    "cached": null,
+    "write": null,
+    "output": 168,
+    "long": false
+  },
+  {
+    "model": "gpt-5.1",
+    "input": 1.25,
+    "cached": 0.125,
+    "write": null,
+    "output": 10,
+    "long": false
+  },
+  {
+    "model": "gpt-5",
+    "input": 1.25,
+    "cached": 0.125,
+    "write": null,
+    "output": 10,
+    "long": false
+  },
+  {
+    "model": "gpt-5-mini",
+    "input": 0.25,
+    "cached": 0.025,
+    "write": null,
+    "output": 2,
+    "long": false
+  },
+  {
+    "model": "gpt-5-nano",
+    "input": 0.05,
+    "cached": 0.005,
+    "write": null,
+    "output": 0.4,
+    "long": false
+  },
+  {
+    "model": "gpt-5-pro",
+    "input": 15,
+    "cached": null,
+    "write": null,
+    "output": 120,
+    "long": false
+  },
+  {
+    "model": "gpt-4.1",
+    "input": 2,
+    "cached": 0.5,
+    "write": null,
+    "output": 8,
+    "long": false
+  },
+  {
+    "model": "gpt-4.1-mini",
+    "input": 0.4,
+    "cached": 0.1,
+    "write": null,
+    "output": 1.6,
+    "long": false
+  },
+  {
+    "model": "gpt-4.1-nano",
+    "input": 0.1,
+    "cached": 0.025,
+    "write": null,
+    "output": 0.4,
+    "long": false
+  },
+  {
+    "model": "gpt-4o",
+    "input": 2.5,
+    "cached": 1.25,
+    "write": null,
+    "output": 10,
+    "long": false
+  },
+  {
+    "model": "gpt-4o-2024-05-13",
+    "input": 5,
+    "cached": null,
+    "write": null,
+    "output": 15,
+    "long": false
+  },
+  {
+    "model": "gpt-4o-mini",
+    "input": 0.15,
+    "cached": 0.075,
+    "write": null,
+    "output": 0.6,
+    "long": false
+  },
+  {
+    "model": "o1",
+    "input": 15,
+    "cached": 7.5,
+    "write": null,
+    "output": 60,
+    "long": false
+  },
+  {
+    "model": "o1-pro",
+    "input": 150,
+    "cached": null,
+    "write": null,
+    "output": 600,
+    "long": false
+  },
+  {
+    "model": "o3-pro",
+    "input": 20,
+    "cached": null,
+    "write": null,
+    "output": 80,
+    "long": false
+  },
+  {
+    "model": "o3",
+    "input": 2,
+    "cached": 0.5,
+    "write": null,
+    "output": 8,
+    "long": false
+  },
+  {
+    "model": "o4-mini",
+    "input": 1.1,
+    "cached": 0.275,
+    "write": null,
+    "output": 4.4,
+    "long": false
+  },
+  {
+    "model": "o3-mini",
+    "input": 1.1,
+    "cached": 0.55,
+    "write": null,
+    "output": 4.4,
+    "long": false
+  },
+  {
+    "model": "gpt-4-turbo-2024-04-09",
+    "input": 10,
+    "cached": null,
+    "write": null,
+    "output": 30,
+    "long": false
+  },
+  {
+    "model": "gpt-4-0613",
+    "input": 30,
+    "cached": null,
+    "write": null,
+    "output": 60,
+    "long": false
+  },
+  {
+    "model": "gpt-3.5-turbo",
+    "input": 0.5,
+    "cached": null,
+    "write": null,
+    "output": 1.5,
+    "long": false
+  },
+  {
+    "model": "gpt-3.5-turbo-0125",
+    "input": 0.5,
+    "cached": null,
+    "write": null,
+    "output": 1.5,
+    "long": false
+  },
+  {
+    "model": "gpt-3.5-turbo-1106",
+    "input": 1,
+    "cached": null,
+    "write": null,
+    "output": 2,
+    "long": false
+  },
+  {
+    "model": "gpt-3.5-turbo-instruct",
+    "input": 1.5,
+    "cached": null,
+    "write": null,
+    "output": 2,
+    "long": false
+  },
+  {
+    "model": "davinci-002",
+    "input": 2,
+    "cached": null,
+    "write": null,
+    "output": 2,
+    "long": false
+  },
+  {
+    "model": "babbage-002",
+    "input": 0.4,
+    "cached": null,
+    "write": null,
+    "output": 0.4,
+    "long": false
+  },
+  {
+    "model": "gpt-5-codex",
+    "input": 1.25,
+    "cached": 0.125,
+    "output": 10,
+    "write": null,
+    "long": false,
+    "source": "https://developers.openai.com/api/docs/models/gpt-5-codex"
+  },
+  {
+    "model": "gpt-5.1-codex",
+    "input": 1.25,
+    "cached": 0.125,
+    "output": 10,
+    "write": null,
+    "long": false,
+    "source": "https://developers.openai.com/api/docs/models/gpt-5.1-codex"
+  },
+  {
+    "model": "gpt-5.1-codex-max",
+    "input": 1.25,
+    "cached": 0.125,
+    "output": 10,
+    "write": null,
+    "long": false,
+    "source": "https://developers.openai.com/api/docs/models/gpt-5.1-codex-max"
+  },
+  {
+    "model": "gpt-5.1-codex-mini",
+    "input": 0.25,
+    "cached": 0.025,
+    "output": 2,
+    "write": null,
+    "long": false,
+    "source": "https://developers.openai.com/api/docs/models/gpt-5.1-codex-mini"
+  },
+  {
+    "model": "gpt-5.2-codex",
+    "input": 1.75,
+    "cached": 0.175,
+    "output": 14,
+    "write": null,
+    "long": false,
+    "source": "https://developers.openai.com/api/docs/models/gpt-5.2-codex"
+  },
+  {
+    "model": "codex-mini-latest",
+    "input": 1.5,
+    "cached": 0.375,
+    "output": 6,
+    "write": null,
+    "long": false,
+    "source": "https://developers.openai.com/api/docs/models/codex-mini-latest"
+  },
+  {"model":"gpt-5.6-cyber","input":12.5,"cached":1.25,"write":15.625,"output":75,"long":false,"source":"https://developers.openai.com/api/docs/pricing"},
+  {"model":"chat-latest","input":5,"cached":0.5,"write":null,"output":30,"long":false,"source":"https://developers.openai.com/api/docs/pricing"}
+];
+export const currentPrices               =rows.map(r=>({provider:'codex',model:r.model,effective_from:'2026-10-05T00:00:00.000Z',effective_until:null,input:r.input,cached_input:r.cached,cache_write:r.write,cache_write_5m:null,cache_write_1h:null,output:r.output,source:r.source??'https://developers.openai.com/api/docs/pricing',verified_at:'2026-10-05T00:00:00.000Z',...(r.model==='gpt-5.6-cyber'?{max_verified_context:272000}:{}),...(r.long?{context_threshold:272000,long_context:{input:r.input*2,cached_input:r.cached===null?null:r.cached*2,cache_write:null,output:r.output*1.5}}:{})}));

package/dist/packages/core/src/pricing/index.js

@@ -0,0 +1,84 @@
+                                                      
+import {currentPrices} from './current.js';
+                               
+                                                                                      
+                                                                                                                                         
+                                                                    
+                                                                                              
+                                                                            
+ 
+                                                                                                       
+                                                                                                                       
+const verified='2026-10-05T00:00:00.000Z';
+const openai='https://developers.openai.com/api/docs/pricing',anthropic='https://platform.claude.com/docs/en/about-claude/pricing';
+const date=(day       )=>day+'T00:00:00.000Z';
+const changes='https://developers.openai.com/api/docs/changelog';
+const claudeChanges='https://platform.claude.com/docs/en/release-notes/overview';
+function claude(model       ,start       ,input       ,output       ,until            =null,max        ,transition=false)             {return {provider:'claude',model,effective_from:date(start),effective_until:until?date(until):null,input,cached_input:input/10,cache_write:null,cache_write_5m:input*1.25,cache_write_1h:input*2,output,source:anthropic,sources:[anthropic,claudeChanges],verified_at:verified,uncertain_days:[...(transition?[start]:[]),...(until?[until]:[])],max_verified_context:max};}
+function codex(model       ,start       ,input       ,cached       ,output       ,until            =null,transition=false)             {return {provider:'codex',model,effective_from:date(start),effective_until:until?date(until):null,input,cached_input:cached,cache_write:input*1.25,cache_write_5m:null,cache_write_1h:null,output,source:openai,sources:[openai,changes,`https://developers.openai.com/api/docs/models/${model}`],verified_at:verified,context_threshold:272000,long_context:{input:input*2,cached_input:cached*2,cache_write:input*2.5,output:output*1.5},uncertain_days:[...(transition?[start]:[]),...(until?[until]:[])]};}
+const codexModels=['gpt-6-astra','gpt-6-sol','gpt-6.1-sol','gpt-6-luna','gpt-5.6-sol','gpt-5.6-terra','gpt-5.6-luna','gpt-5.3-codex'];
+const claudeModels=['claude-fable-5','claude-fable-5-1','claude-mythos-5','claude-mythos-5-1','claude-mythos-preview','claude-opus-5-5','claude-opus-5','claude-opus-4-8','claude-opus-4-7','claude-opus-4-6','claude-opus-4-5-20251101','claude-opus-4-1-20250805','claude-opus-4-20250514','claude-sonnet-5','claude-sonnet-5-5','claude-sonnet-4-5-20250929','claude-sonnet-4-6','claude-sonnet-4-20250514','claude-3-7-sonnet-20250219','claude-haiku-4-5-20251001'];
+const mappings=(models         ,source       )=>Object.fromEntries(models.map(canonical=>[canonical,{canonical,confidence:'HIGH'         ,source,verified_at:verified}]));
+// A newly launched model has one documented initial rate: use it for API-equivalent
+// estimates on its launch day. Actual changes between rates remain uncertain that day.
+export const catalog        ={version:'2026-10-05.2',mappings:{codex:{...mappings(codexModels,changes),...Object.fromEntries(currentPrices.map(p=>[p.model,{canonical:p.model,confidence:'HIGH'         ,source:p.source,verified_at:verified}]))},claude:mappings(claudeModels,claudeChanges)},prices:[
+  codex('gpt-5.6-sol','2026-07-09',5,.5,30,'2026-08-21'),
+  codex('gpt-5.6-sol','2026-08-21',4,.4,20,'2026-11-22',true), // Promotion confirmed at least through Nov 21. No invented post-promotion rate.
+  codex('gpt-5.6-luna','2026-07-09',1,.1,6,'2026-07-30'),codex('gpt-5.6-luna','2026-07-30',.2,.02,1.2,null,true),
+  codex('gpt-5.6-terra','2026-07-09',2.5,.25,15,'2026-07-30'),codex('gpt-5.6-terra','2026-07-30',2,.2,12,null,true),
+  codex('gpt-6-astra','2026-09-03',10,1,50),codex('gpt-6-sol','2026-09-22',2,.2,10),codex('gpt-6-luna','2026-09-22',.1,.01,.5),codex('gpt-6.1-sol','2026-09-29',2,.1,10),
+  {provider:'codex',model:'gpt-5.3-codex',effective_from:verified,effective_until:null,input:1.75,cached_input:.175,cache_write:null,cache_write_5m:null,cache_write_1h:null,output:14,source:openai,verified_at:verified},
+  ...currentPrices,
+  claude('claude-fable-5','2026-06-09',10,50,'2026-06-12'),claude('claude-fable-5','2026-07-01',10,50),claude('claude-opus-5','2026-07-24',5,25),claude('claude-opus-4-8','2026-05-28',5,25),claude('claude-opus-4-7','2026-04-16',5,25),
+  // Long-context premium removal is dated March 13; preceding >200k requests
+  // stay unavailable until their historical premium can be verified.
+  claude('claude-opus-4-6','2026-02-05',5,25,'2026-03-13',200000),claude('claude-opus-4-6','2026-03-13',5,25,null,undefined,true),
+  claude('claude-opus-4-5-20251101','2025-11-24',5,25,null,200000),claude('claude-sonnet-4-5-20250929','2025-09-29',3,15,null,200000),
+  claude('claude-sonnet-4-6','2026-02-17',3,15,'2026-03-13',200000),claude('claude-sonnet-4-6','2026-03-13',3,15,null,undefined,true),
+  claude('claude-sonnet-5','2026-06-30',2,10),claude('claude-sonnet-5-5','2026-09-28',2,10),
+  {...claude('claude-opus-5-5','2026-09-22',4,20),cached_input:.2},
+  {...claude('claude-fable-5-1','2026-09-01',10,50),cached_input:.25},
+  {...claude('claude-mythos-5-1','2026-09-01',10,50),cached_input:.25},
+  claude('claude-mythos-5','2026-06-09',10,50,'2026-06-12'),claude('claude-mythos-5','2026-07-01',10,50),
+  claude('claude-haiku-4-5-20251001','2025-10-15',1,5,null,200000),
+  {...claude('claude-opus-4-1-20250805','2025-08-05',15,75,'2026-08-05',200000),sources:[anthropic,'https://www.anthropic.com/news/claude-opus-4-1','https://platform.claude.com/docs/en/about-claude/model-deprecations']},
+  {...claude('claude-opus-4-20250514','2025-05-22',15,75,'2026-06-15',200000),sources:[anthropic,'https://www.anthropic.com/news/claude-4','https://platform.claude.com/docs/en/about-claude/model-deprecations']},
+  {...claude('claude-sonnet-4-20250514','2025-05-22',3,15,'2026-06-15',200000),sources:[anthropic,'https://www.anthropic.com/news/claude-4','https://platform.claude.com/docs/en/about-claude/model-deprecations']},
+  {...claude('claude-3-7-sonnet-20250219','2025-02-24',3,15,'2026-02-19',200000),sources:[anthropic,'https://www.anthropic.com/news/claude-3-7-sonnet','https://platform.claude.com/docs/en/about-claude/model-deprecations']},
+  // Published input/output tariff; cache rates and earlier billing start unverified.
+  {provider:'claude',model:'claude-mythos-preview',effective_from:verified,effective_until:null,input:25,cached_input:null,cache_write:null,cache_write_5m:null,cache_write_1h:null,output:125,source:'https://www.anthropic.com/glasswing',verified_at:verified}
+]};
+// Explicit officially documented aliases only. No prefix matching or internal-model guesses.
+for(const [raw,canonical] of Object.entries({'claude-opus-4-5':'claude-opus-4-5-20251101','claude-sonnet-4-5':'claude-sonnet-4-5-20250929','claude-haiku-4-5':'claude-haiku-4-5-20251001'}))catalog.mappings.claude[raw]={canonical,confidence:'HIGH',source:'https://platform.claude.com/docs/en/about-claude/models/model-ids-and-versions',verified_at:verified};
+catalog.mappings.codex['gpt-5.6']={canonical:'gpt-5.6-sol',confidence:'HIGH',source:changes,verified_at:verified};
+// The retired Haiku tariff is still published, but its historical reduction date
+// is not established. Recognize the exact identity without backdating $0.80/$4.
+catalog.mappings.claude['claude-3-5-haiku-20241022']={canonical:'claude-3-5-haiku-20241022',confidence:'HIGH',source:'https://platform.claude.com/docs/en/about-claude/model-deprecations',verified_at:verified};
+                                                                                                                                                            
+export function priceRecord(r            ,c        =catalog)       {
+  const mapped=r.model_raw?c.mappings[r.provider][r.model_raw]:undefined;const mapping=typeof mapped==='object'?mapped:undefined;const canonical=typeof mapped==='string'?mapped:mapping?.canonical??null;const fail=(reason       )       =>({usd:null,canonical,reason,version:null,mapping});
+  if(!canonical)return fail('unresolved-model');if(!r.timestamp)return fail('timestamp-missing');
+  const candidates=c.prices.filter(p=>p.provider===r.provider&&p.model===canonical&&r.timestamp >=p.effective_from&&(!p.effective_until||r.timestamp <p.effective_until));
+  if(candidates.length!==1)return fail(candidates.length?'ambiguous-price-version':'historical-price-unavailable');let p=candidates[0];
+  if(p.uncertain_days?.includes(r.timestamp.slice(0,10)))return fail('price-transition-day-uncertain');
+  if(r.quality==='INCOMPLETE'||r.unallocated_total_tokens!==null)return fail('incomplete-token-components');
+  if(r.input_tokens===null||r.cached_input_tokens===null||r.output_tokens===null||r.cache_creation_tokens===null)return fail('token-components-missing');
+  if(r.service_tier&&!['standard','default'].includes(r.service_tier))return fail('service-tier-unavailable');
+  if(r.speed&&r.speed!=='standard')return fail('speed-pricing-unavailable');
+  if((r.web_search_requests??0)>0||(r.web_fetch_requests??0)>0)return fail('tool-pricing-unavailable');
+  const context=r.provider==='claude'?r.input_tokens+r.cached_input_tokens+r.cache_creation_tokens:r.input_tokens;
+  if(p.max_verified_context!==undefined&&context>p.max_verified_context)return fail('historical-context-price-unavailable');
+  if(p.long_context){if(p.context_threshold==null)return fail('context-band-unverified');if(r.notes.includes('last-delta-disagreement'))return fail('request-context-ambiguous');if(context>p.context_threshold)p={...p,...p.long_context};}
+  const cached=r.cached_input_tokens;if(cached>0&&p.cached_input===null)return fail('cache-read-price-unavailable');
+  let input=r.input_tokens;
+  // OpenAI reports cache reads and writes as mutually exclusive input subsets.
+  // A cache write replaces ordinary input pricing; it is not an additive fee.
+  if(r.provider==='codex'){input-=cached+r.cache_creation_tokens;if(input<0)return fail('invalid-cache-subset');}
+  let usd=(input*p.input+cached*(p.cached_input??0)+r.output_tokens*p.output)/1e6;
+  if(r.cache_creation_tokens>0){if(r.provider==='claude'){
+    if(r.cache_creation_5m_tokens===null||r.cache_creation_1h_tokens===null||r.cache_creation_5m_tokens+r.cache_creation_1h_tokens!==r.cache_creation_tokens||p.cache_write_5m===null||p.cache_write_1h===null)return fail('cache-duration-price-unavailable');
+    usd+=(r.cache_creation_5m_tokens*p.cache_write_5m+r.cache_creation_1h_tokens*p.cache_write_1h)/1e6;
+  }else{if(p.cache_write===null)return fail('cache-write-price-unavailable');usd+=r.cache_creation_tokens*p.cache_write/1e6;}}
+  // Reasoning is an output breakdown; never charge it a second time.
+  return {usd,canonical,reason:null,version:c.version,mapping,source:p.source,effectiveFrom:p.effective_from};
+}

package/dist/packages/core/src/providers/claude/index.js

@@ -0,0 +1,24 @@
+import {baseRecord,hash,identifier,modelId,timestamp,token,track} from '../../metadata.js';
+import {emptyDiagnostics,                                 } from '../../types.js';
+                                                      
+export const claudeState=()            =>({diagnostics:emptyDiagnostics()});
+export function parseClaude(o    ,s            ,ref       ,lineNumber       )                  {
+  if(!o||o.type!=='assistant')return null;const m=o.message,u=m?.usage;
+  if(!u||typeof u!=='object')return null;
+  const msg=identifier(m.id),req=identifier(o.requestId),sid=identifier(o.sessionId);
+  // Response blocks repeat the whole message usage. Never sum usage.iterations.
+  const event=hash(sid,msg??req??[ref,lineNumber],msg?null:req);
+  const r=baseRecord('claude',ref,event);r.timestamp=timestamp(o.timestamp);r.session_id=sid;r.request_id=req;r.source_schema='claude.message.usage.v1';r.model_raw=modelId(m.model);
+  if(typeof o.cwd==='string')r.project_identifier_hash=hash('project',o.cwd);
+  r.input_tokens=token(u.input_tokens);r.cached_input_tokens=token(u.cache_read_input_tokens);r.cache_creation_tokens=token(u.cache_creation_input_tokens);r.output_tokens=token(u.output_tokens);
+  r.cache_creation_5m_tokens=token(u.cache_creation?.ephemeral_5m_input_tokens);r.cache_creation_1h_tokens=token(u.cache_creation?.ephemeral_1h_input_tokens);
+  r.service_tier=modelId(u.service_tier);r.speed=modelId(u.speed);r.web_search_requests=token(u.server_tool_use?.web_search_requests);r.web_fetch_requests=token(u.server_tool_use?.web_fetch_requests);
+  if([r.input_tokens,r.cached_input_tokens,r.cache_creation_tokens,r.output_tokens].every(n=>n!==null))r.total_tokens=r.input_tokens +r.cached_input_tokens +r.cache_creation_tokens +r.output_tokens ;
+  if(!msg||!req){r.quality='MEDIUM';r.notes.push('weak-request-identity');}
+  if([r.input_tokens,r.cached_input_tokens,r.cache_creation_tokens,r.output_tokens].some(n=>n===null)||!r.timestamp||!r.model_raw)r.quality='INCOMPLETE';
+  if(r.cache_creation_tokens!==null&&r.cache_creation_tokens>0){
+    if(r.cache_creation_5m_tokens===null||r.cache_creation_1h_tokens===null){r.quality='INCOMPLETE';r.notes.push('cache-duration-missing');}
+    else if(r.cache_creation_5m_tokens+r.cache_creation_1h_tokens!==r.cache_creation_tokens){r.quality='INCOMPLETE';r.notes.push('cache-duration-disagreement');}
+  }
+  track(s.diagnostics,r);return r;
+}

package/dist/packages/core/src/providers/codex/index.js

@@ -0,0 +1,51 @@
+import {baseRecord,hash,identifier,modelId,timestamp,token,track} from '../../metadata.js';
+import {emptyDiagnostics,                                 } from '../../types.js';
+                                              
+                                                                                                                                                                                                                
+export const codexState = ()             => ({thread:null,session:null,model:null,project:null,boundary:null,previous:null,turn:null,segment:0,diagnostics:emptyDiagnostics()});
+const keys = ['input_tokens','cached_input_tokens','cache_write_input_tokens','output_tokens','reasoning_output_tokens','total_tokens'];
+const counters = (v     )                  => v && typeof v==='object' ? Object.fromEntries(keys.map(k=>[k,token(v[k])])) : null;
+export function parseCodex(o     , s            , ref        , lineNumber        )                     {
+  if(!o || typeof o!=='object')return null;const p=o.payload;
+  if(!p || typeof p!=='object')return null;
+  // Inherited metadata must not overwrite the child's identity or model either.
+  if(s.boundary!==null&&token(o.ordinal)!==null&&o.ordinal<s.boundary){if(o.type==='event_msg'&&p.type==='token_count')s.diagnostics.inherited++;return null;}
+  if(o.type==='session_meta'){
+    const thread=identifier(p.id);if(thread&&s.thread&&thread!==s.thread){s.previous=null;s.boundary=null;s.model=null;s.project=null;s.turn=null;s.segment++;}
+    s.thread=thread??s.thread;s.session=identifier(p.session_id)??s.thread;
+    if(typeof p.cwd==='string')s.project=hash('project',p.cwd);
+    s.boundary=token(p.subagent_history_start_ordinal)??s.boundary;
+    s.model=modelId(p.model)??s.model;return null;
+  }
+  if(o.type==='turn_context') {s.model=modelId(p.model)??s.model;s.turn=identifier(p.turn_id)??s.turn;if(typeof p.cwd==='string')s.project=hash('project',p.cwd);return null;}
+  if(o.type!=='event_msg'||p.type!=='token_count')return null;
+  if(s.boundary!==null){if(token(o.ordinal)===null){s.diagnostics.unsupported++;return null;}if(o.ordinal<s.boundary){s.diagnostics.inherited++;return null;}}
+  const info=p.info;if(!info || typeof info!=='object'){s.diagnostics.unsupported++;return null;}
+  const total=counters(info.total_token_usage),last=counters(info.last_token_usage);let usage              =null;let method='last';const notes         =[];
+  if(total&&s.previous){
+    const comparable=keys.filter(k=>total[k]!==null&&s.previous [k]!==null);
+    if(comparable.length&&comparable.every(k=>total[k]===s.previous [k])){s.diagnostics.repeated++;return null;}
+    if(comparable.some(k=>total[k] <s.previous [k] )){
+      s.segment++;s.diagnostics.resets++;notes.push('counter-reset');usage=last;method='reset-last';
+      if(!usage){usage={...total};notes.push('reset-without-last');}
+    }else{
+      usage=Object.fromEntries(keys.map(k=>[k,total[k]!==null&&s.previous [k]!==null?total[k] -s.previous [k] :null]));method='cumulative-delta';
+      if(last&&keys.some(k=>usage [k]!==null&&last[k]!==null&&usage [k]!==last[k]))notes.push('last-delta-disagreement');
+    }
+  }else if(last){usage=last;if(total&&keys.some(k=>last[k]!==null&&total[k]!==null&&last[k]!==total[k]))notes.push('nonzero-starting-baseline');}
+  else if(total){usage=total;method='initial-cumulative';notes.push('initial-cumulative-only');}
+  if(total)s.previous=total;
+  if(!usage){s.diagnostics.unsupported++;return null;}
+  const event=hash(s.thread??ref,token(o.ordinal)??lineNumber,timestamp(o.timestamp),s.segment,usage);
+  const r=baseRecord('codex',ref,event);r.timestamp=timestamp(o.timestamp);r.thread_id=s.thread;r.session_id=s.session;r.request_id=null;r.model_raw=s.model;r.project_identifier_hash=s.project;r.source_schema=`codex.token_count.v1/${method}`;r.notes=notes;
+  r.input_tokens=usage.input_tokens;r.cached_input_tokens=usage.cached_input_tokens;r.cache_creation_tokens=usage.cache_write_input_tokens;r.output_tokens=usage.output_tokens;r.reasoning_tokens=usage.reasoning_output_tokens;r.total_tokens=usage.total_tokens;
+  // A positive total with zero components is not a zero-token request.
+  if(r.total_tokens!==null&&r.input_tokens!==null&&r.output_tokens!==null&&r.total_tokens!==r.input_tokens+r.output_tokens){
+    r.unallocated_total_tokens=Math.max(0,r.total_tokens-r.input_tokens-r.output_tokens);r.notes.push('unallocated-total');r.quality='INCOMPLETE';
+    if(r.input_tokens===0&&r.output_tokens===0&&r.total_tokens>0){r.input_tokens=null;r.output_tokens=null;r.cached_input_tokens=null;r.reasoning_tokens=null;r.cache_creation_tokens=null;}
+  }
+  if(r.input_tokens===null||r.cached_input_tokens===null||r.cache_creation_tokens===null||r.output_tokens===null||!r.timestamp||!r.model_raw)r.quality='INCOMPLETE';
+  if(r.cached_input_tokens!==null&&r.input_tokens!==null&&r.cached_input_tokens>r.input_tokens){r.quality='INCOMPLETE';r.notes.push('invalid-cache-subset');}
+  if(notes.includes('initial-cumulative-only')||notes.includes('reset-without-last'))r.quality='INCOMPLETE';
+  if(r.quality==='HIGH'&&notes.length)r.quality='MEDIUM';track(s.diagnostics,r);return r;
+}

package/dist/packages/core/src/scanner.js

@@ -0,0 +1,48 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import {createHash} from 'node:crypto';
+import {sourceRoots,detectedProviders,enumerate,openAllowedFile} from './security.js';
+import {hash} from './metadata.js';
+                                                   
+import {codexState,parseCodex,               } from './providers/codex/index.js';
+import {claudeState,parseClaude,                } from './providers/claude/index.js';
+import {emptyDiagnostics,                                                } from './types.js';
+export const PARSER_VERSION='2';
+const MAX_LINE=16*1024*1024;
+function fingerprint(fd       ,start       ,len       )       {const b=Buffer.alloc(Math.max(0,len));const n=fs.readSync(fd,b,0,b.length,start);return createHash('sha256').update(b.subarray(0,n)).digest('hex');}
+function combine(to            ,from            ){for(const k of ['malformed','inherited','repeated','resets','oversize','unsupported','records']         )to[k]+=from[k];to.partialTail ||= from.partialTail;if(from.first)to.first=!to.first||from.first<to.first?from.first:to.first;if(from.last)to.last=!to.last||from.last>to.last?from.last:to.last;}
+                                                                                                                    
+export async function scan(store      ,options                                                  ={})                        {
+  const home=options.home??os.homedir(),detected=detectedProviders(home);const statuses               =(['codex','claude']              ).map(provider=>({provider,detected:detected[provider],files:0,scanned:0,cached:0,errors:0,skippedLinks:0,missingFiles:0,diagnostics:emptyDiagnostics()}));
+  const seen=new Set        ();let bytes=0;
+  for(const root of sourceRoots(home)){const status=statuses.find(s=>s.provider===root.provider) ;const found=enumerate(root);status.files+=found.files.length;status.errors+=found.errors;status.skippedLinks+=found.skippedLinks;
+    for(const file of found.files){const ref=hash(root.safeLabel,path.relative(root.directory,file));seen.add(ref);let fd                 ;let transaction=false;
+      try{fd=openAllowedFile(root,file);const stat=fs.fstatSync(fd);let cp=store.checkpoint(ref);const identity=`${stat.dev}:${stat.ino}:${PARSER_VERSION}`;
+        if(cp&&cp.size===stat.size&&cp.mtime===stat.mtimeMs&&cp.identity===identity&&fingerprint(fd,0,Math.min(4096,cp.offset))===cp.head&&fingerprint(fd,Math.max(0,cp.offset-4096),Math.min(4096,cp.offset))===cp.tail){status.cached++;combine(status.diagnostics,cp.state.diagnostics);continue;}
+        if(cp){const headLen=Math.min(4096,cp.offset);const tailStart=Math.max(0,cp.offset-4096);const appendSafe=stat.size>cp.size&&identity===cp.identity&&fingerprint(fd,0,headLen)===cp.head&&fingerprint(fd,tailStart,cp.offset-tailStart)===cp.tail;if(!appendSafe)cp=null;}
+        const state                       =cp?cp.state:root.provider==='codex'?codexState():claudeState();state.diagnostics.partialTail=false;
+        let offset=cp?.offset??0,lineNumber=cp?.line??0;let carry       =Buffer.alloc(0),dropping=false,consumed=0;const start=offset;store.db.exec('BEGIN IMMEDIATE');transaction=true;if(!cp){store.clearSource(ref);store.collectOrphans();}
+        // The stream owns only the already validated read-only file descriptor.
+        if(stat.size>start)for await(const chunk of fs.createReadStream(file,{fd,autoClose:false,start,end:stat.size-1,highWaterMark:256*1024})){bytes+=chunk.length;let cursor=0;while(cursor<chunk.length){const newline=chunk.indexOf(10,cursor);const end=newline<0?chunk.length:newline;const part=chunk.subarray(cursor,end);if(!dropping){if(carry.length+part.length>MAX_LINE){carry=Buffer.alloc(0);dropping=true;state.diagnostics.oversize++;}else carry=Buffer.concat([carry,part]);}
+            if(newline<0)break;lineNumber++;
+            const absoluteEnd=start+consumed+newline+1;offset=absoluteEnd;
+            if(!dropping&&carry.length){const line=carry.toString('utf8').replace(/\r$/,'');let o    =null;
+              // Codex conversation records are never deserialized. Claude records are
+              // projected immediately; no raw object is allowed into storage/state.
+              const relevant=root.provider==='claude'||/"type"\s*:\s*"(?:session_meta|turn_context)"/.test(line)||line.includes('"token_count"');
+              if(relevant){try{o=JSON.parse(line);}catch{state.diagnostics.malformed++;}
+                if(o){const r=root.provider==='codex'?parseCodex(o,state              ,ref,lineNumber):parseClaude(o,state               ,ref,lineNumber);if(r){const result=store.put(r,ref);if(result!=='new')state.diagnostics.repeated++;}}}
+            }carry=Buffer.alloc(0);dropping=false;cursor=newline+1;
+          }consumed+=chunk.length;options.onProgress?.({provider:root.provider,files:status.scanned+status.cached,total:status.files,bytes,phase:'scanning'});
+        }
+        if(carry.length||dropping)state.diagnostics.partialTail=true;
+        const checkpoint           ={ref,size:stat.size,mtime:stat.mtimeMs,offset,line:lineNumber,head:fingerprint(fd,0,Math.min(4096,offset)),tail:fingerprint(fd,Math.max(0,offset-4096),Math.min(4096,offset)),state,identity};
+        store.saveCheckpoint(checkpoint);store.collectOrphans();store.db.exec('COMMIT');transaction=false;status.scanned++;combine(status.diagnostics,state.diagnostics);
+      }catch{if(transaction)store.db.exec('ROLLBACK');status.errors++;const previous=store.checkpoint(ref);if(previous)combine(status.diagnostics,previous.state.diagnostics);}finally{if(fd!==undefined)fs.closeSync(fd);}
+    }
+  }
+  // Missing sources are retained as cached history, never silently treated as zero.
+  for(const cp of store.allCheckpoints())if(!seen.has(cp.ref)){const provider=(cp.state              ).thread!==undefined?'codex':'claude';statuses.find(s=>s.provider===provider) .missingFiles++;}
+  store.save('sources',statuses);store.save('lastScan',new Date().toISOString());options.onProgress?.({provider:'codex',files:statuses.reduce((n,s)=>n+s.scanned+s.cached,0),total:statuses.reduce((n,s)=>n+s.files,0),bytes,phase:'complete'});return statuses;
+}

package/dist/packages/core/src/security.js

@@ -0,0 +1,41 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+                                         
+                                                                                   
+export function sourceRoots(home=os.homedir())             {return [
+  {provider:'codex',directory:path.join(home,'.codex','sessions'),safeLabel:'~/.codex/sessions/**/*.jsonl'},
+  {provider:'codex',directory:path.join(home,'.codex','archived_sessions'),safeLabel:'~/.codex/archived_sessions/*.jsonl'},
+  {provider:'claude',directory:path.join(home,'.claude','projects'),safeLabel:'~/.claude/projects/**/*.jsonl'}
+];}
+export function inside(root       ,target       )        {const r=path.relative(root,target);return r===''||(!r.startsWith('..'+path.sep)&&r!=='..'&&!path.isAbsolute(r));}
+export function safeDirectory(directory       )        {
+  let p=path.resolve(directory);
+  while(true){try{const s=fs.lstatSync(p);if(s.isSymbolicLink())return false;}catch{return false;}const up=path.dirname(p);if(up===p)break;p=up;}return true;
+}
+export function detectedProviders(home=os.homedir())                         {return {codex:safeDirectory(path.join(home,'.codex')),claude:safeDirectory(path.join(home,'.claude'))};}
+export function enumerate(root           )                                                   {
+  const result={files:[]            ,skippedLinks:0,errors:0};
+  if(!fs.existsSync(root.directory))return result;
+  if(!safeDirectory(root.directory)){result.skippedLinks++;return result;}
+  const canonical=fs.realpathSync(root.directory);
+  function visit(dir       ){let entries            ;try{entries=fs.readdirSync(dir,{withFileTypes:true});}catch{result.errors++;return;}
+    for(const e of entries){const p=path.join(dir,e.name);try{
+      const st=fs.lstatSync(p);if(st.isSymbolicLink()){result.skippedLinks++;continue;}
+      if(!inside(canonical,fs.realpathSync(p))){result.skippedLinks++;continue;}
+      if(st.isDirectory()){if(root.safeLabel.includes('**'))visit(p);}
+      else if(st.isFile()&&e.name.endsWith('.jsonl'))result.files.push(p);
+    }catch{result.errors++;}}
+  }visit(root.directory);return result;
+}
+export function openAllowedFile(root           ,file       )       {
+  if(!inside(path.resolve(root.directory),path.resolve(file))||!file.endsWith('.jsonl')||!safeDirectory(path.dirname(file)))throw new Error('Source access denied');
+  const before=fs.lstatSync(file);if(!before.isFile()||before.isSymbolicLink()||!inside(fs.realpathSync(root.directory),fs.realpathSync(file)))throw new Error('Source access denied');
+  const fd=fs.openSync(file,fs.constants.O_RDONLY|(fs.constants.O_NOFOLLOW??0));const after=fs.fstatSync(fd);
+  if(before.ino!==after.ino||before.dev!==after.dev){fs.closeSync(fd);throw new Error('Source changed while opening');}return fd;
+}
+export function applicationDirectory(directory       ,home=os.homedir())       {
+  const resolved=path.resolve(directory);for(const name of ['.codex','.claude']){const source=path.join(home,name);if(inside(source,resolved)||inside(resolved,source))throw new Error('Application data must be separate from provider data');}
+  let ancestor=resolved;while(!fs.existsSync(ancestor)){const up=path.dirname(ancestor);if(up===ancestor)throw new Error('Invalid data directory');ancestor=up;}
+  if(!safeDirectory(ancestor))throw new Error('Application data directory must not use links');return resolved;
+}