@timo972/cc-router 0.13.0-rc.1 → 0.13.0-rc.3

package/CHANGELOG.md

@@ -38,6 +38,8 @@ This project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ### Fixed
 
+- Escape or Ctrl-C at any prompt of the dashboard's `n` / `l` flows returns
+  to the dashboard with a quiet "Cancelled." instead of a red failure line.
 - Pressing `n` (and now `l`) in the dashboard no longer kills the process
   before the sign-in prompt can take input. Ink unrefs stdin when it
   unmounts and nothing ref'd it again, so with no other work pending the

package/README.md

@@ -109,6 +109,24 @@ it later. Adding more accounts is `cc-router accounts login`, re-signing one in
 Per-platform token extraction, Codex CLI, Docker and everything else lives in
 [the docs](docs/).
 
+## Usage history and savings
+
+Run `cc-router usage` for persistent token history, provider/model stacked bars,
+and a daily activity grid. Switch between day, week, month and year; history
+survives service restarts. Configure your monthly subscription costs to compare
+them with the estimated standard API token value:
+
+```bash
+cc-router usage subscription set personal --monthly-usd 100 --from 2026-09-01
+cc-router usage
+cc-router usage --period month --provider claude --json
+```
+
+Use your actual monthly USD cost and account name in place of the example.
+Missing prices or costs are explicitly marked incomplete. See the
+[usage reference](docs/cli-reference.md#persistent-token-usage-and-savings) for
+configuration, keyboard controls, estimation limits and offline/remote access.
+
 ## Documentation
 
 | Guide | What's in it |

package/dist/cli/account-flows.js

@@ -59,7 +59,7 @@ export async function collectClaudeAccount(options) {
     const method = options.method ?? await select({
         message: "How do you want to add the account?",
         choices: claudeMethodChoices(options.offer ?? "all"),
-    });
+    }, { signal: options.signal });
     const attempt = createSetupAttempt({ provider: "anthropic", method: CLAUDE_METHOD_TELEMETRY[method] });
     attempt.stageCompleted("credential_source_selection");
     // Shared by reference: the file-extraction fallback swaps in a manual-token attempt.
@@ -106,12 +106,12 @@ async function collectAnthropicAccount(options, method, current, reached) {
                 message: "Paste the token (sk-ant-oat01-...):",
                 mask: "•",
                 validate: v => v.startsWith("sk-ant-oat01-") || "Must start with sk-ant-oat01-",
-            });
+            }, { signal: options.signal });
         }
-        const useDefaultExpiry = await confirm({ message: "Token valid for 1 year (default)?", default: true });
+        const useDefaultExpiry = await confirm({ message: "Token valid for 1 year (default)?", default: true }, { signal: options.signal });
         const expiresAt = useDefaultExpiry
             ? Date.now() + LONG_LIVED_TOKEN_TTL_MS
-            : await promptExpiry();
+            : await promptExpiry(options.signal);
         tokens = { accessToken, refreshToken: undefined, expiresAt, scopes: ["user:inference"] };
         console.log(chalk.gray("  This token has no refresh token and the inference scope only: usage and identity metadata are unavailable for it."));
     }
@@ -129,7 +129,7 @@ async function collectAnthropicAccount(options, method, current, reached) {
             console.log(chalk.yellow("  Could not find credentials in Keychain."));
             console.log(chalk.gray("  Make sure Claude Code is logged in: run `claude login` first."));
             printDiagnosticId(attempt.stageFailed(extraction.error, "credential_read"));
-            const retry = await confirm({ message: "Try another extraction method?", default: true });
+            const retry = await confirm({ message: "Try another extraction method?", default: true }, { signal: options.signal });
             attempt.cancelled();
             if (!retry)
                 return { account: null, attempt };
@@ -147,7 +147,7 @@ async function collectAnthropicAccount(options, method, current, reached) {
         else {
             console.log(chalk.red("  ✗ ~/.claude/.credentials.json not found or unreadable."));
             console.log(chalk.gray("  Make sure Claude Code is installed and you've run `claude login`."));
-            const retry = await confirm({ message: "Paste tokens manually instead?", default: true });
+            const retry = await confirm({ message: "Paste tokens manually instead?", default: true }, { signal: options.signal });
             if (!retry) {
                 printDiagnosticId(attempt.stageFailed(extraction.error, "credential_read"));
                 attempt.cancelled();
@@ -158,11 +158,11 @@ async function collectAnthropicAccount(options, method, current, reached) {
             attempt = createSetupAttempt({ provider: "anthropic", method: "manual_token" });
             current.attempt = attempt;
             attempt.stageCompleted("credential_source_selection");
-            tokens = await promptManualTokens();
+            tokens = await promptManualTokens(options.signal);
         }
     }
     if (method === "manual") {
-        tokens = await promptManualTokens();
+        tokens = await promptManualTokens(options.signal);
     }
     if (!tokens) {
         attempt.cancelled();
@@ -175,7 +175,7 @@ async function collectAnthropicAccount(options, method, current, reached) {
         message: "Account ID (press Enter to accept default):",
         default: `max-account-${options.index}`,
         validate: v => /^[a-zA-Z0-9_-]+$/.test(v) || "Only letters, numbers, _ and - allowed",
-    });
+    }, { signal: options.signal });
     process.stdout.write(chalk.gray("  Validating tokens against Anthropic... "));
     const validation = await validateToken(tokens.accessToken);
     if (validation.valid) {
@@ -187,7 +187,7 @@ async function collectAnthropicAccount(options, method, current, reached) {
         console.log(chalk.yellow(`  Reason: ${validation.reason}`));
         printDiagnosticId(attempt.stageFailed(validation.diagnostic, "token_validation"));
         console.log(chalk.gray("  The token will be saved but may not work until refreshed."));
-        const keepAnyway = await confirm({ message: "Save this account anyway?", default: false });
+        const keepAnyway = await confirm({ message: "Save this account anyway?", default: false }, { signal: options.signal });
         if (!keepAnyway) {
             attempt.cancelled();
             return { account: null, attempt };
@@ -215,7 +215,7 @@ async function collectAnthropicAccount(options, method, current, reached) {
  * The refresh token stays required here: a pasted long-lived `setup-token`
  * credential has none, and it has its own method rather than this one.
  */
-async function promptManualTokens() {
+async function promptManualTokens(signal) {
     console.log(chalk.gray("\n  You can find your tokens by running:\n" +
         "    macOS:         security find-generic-password -s 'Claude Code-credentials' -w\n" +
         "    Linux/Windows: cat ~/.claude/.credentials.json\n"));
@@ -225,21 +225,21 @@ async function promptManualTokens() {
         validate: (v) => v.startsWith("sk-ant-oat01-") || v.startsWith("sk-ant-")
             ? true
             : "Must start with sk-ant-oat01-",
-    });
+    }, { signal });
     const refreshToken = await password({
         message: "Paste refreshToken (sk-ant-ort01-...):",
         mask: "•",
         validate: (v) => v.startsWith("sk-ant-ort01-") || v.startsWith("sk-ant-")
             ? true
             : "Must start with sk-ant-ort01-",
-    });
+    }, { signal });
     const useDefaultExpiry = await confirm({
         message: "Use default expiry (8 hours from now)?",
         default: true,
-    });
+    }, { signal });
     const expiresAt = useDefaultExpiry
         ? Date.now() + 8 * 60 * 60 * 1000
-        : await promptExpiry();
+        : await promptExpiry(signal);
     return {
         accessToken,
         refreshToken,
@@ -383,15 +383,16 @@ export async function collectReauthRecord(target, options = {}) {
         ...(target.email ? { email: target.email } : {}),
         offer: "login",
         ...(options.longLived ? { method: "setup_token" } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
     });
     return account ? { record: credentialsOnly(accountToRecord(account)), attempt } : null;
 }
 /** An explicit expiry: ISO date or Unix milliseconds, validated as typed. */
-async function promptExpiry() {
+async function promptExpiry(signal) {
     const raw = await input({
         message: "Paste expiresAt (ISO date or ms timestamp):",
         validate: v => parseExpiryInput(v) !== null || "Enter an ISO date (2027-01-01) or a Unix timestamp in milliseconds",
-    });
+    }, { signal });
     return parseExpiryInput(raw);
 }
 /**

package/dist/cli/cmd-accounts.js

@@ -191,9 +191,9 @@ export function registerAccounts(program) {
             return;
         }
         const record = await flows.loginGrokAccount({ accountId: opts.id });
-        upsertAccountRecord(record);
+        const { mode } = await addAccountRuntimeAware(record);
         console.log(chalk.green(`\n✓ Grok account "${record.id}" saved via device login.\n`));
-        printAddOutcome("stored");
+        printAddOutcome(mode);
     }));
     // ── accounts add ─────────────────────────────────────────────────────────
     accounts
@@ -222,9 +222,9 @@ export function registerAccounts(program) {
             return;
         }
         const record = await flows.importGrokAccount({ accountId: opts.id });
-        upsertAccountRecord(record);
+        const { mode } = await addAccountRuntimeAware(record);
         console.log(chalk.green(`\n✓ Grok account "${record.id}" imported from ~/.grok.\n`));
-        printAddOutcome("stored");
+        printAddOutcome(mode);
     }));
     // ── accounts reauth ──────────────────────────────────────────────────────
     accounts
@@ -623,6 +623,25 @@ export async function removeAccountRuntimeAware(id, dependencies = {
         throw new Error(`Account "${id}" disappeared before it could be removed`);
     return { mode: "stored", removed };
 }
+/** Read-only probe for commands that cannot be represented as a live mutation. */
+export async function isAccountApiReachable(options = {}) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const baseUrl = (options.baseUrl ?? `http://localhost:${PROXY_PORT}`).replace(/\/+$/, "");
+    const authToken = options.authToken ?? readConfig().proxySecret;
+    let response;
+    try {
+        response = await fetchImpl(`${baseUrl}/cc-router/accounts`, {
+            headers: authToken ? { authorization: `Bearer ${authToken}` } : {},
+            signal: AbortSignal.timeout(3_000),
+        });
+    }
+    catch {
+        return false;
+    }
+    if (!response.ok)
+        throw new Error(`HTTP ${response.status} while checking the running proxy`);
+    return true;
+}
 /**
  * Add an account to a running proxy so it becomes routable without a restart.
  * Returns false only when no running proxy can be reached (the caller then

package/dist/cli/cmd-setup.js

@@ -9,6 +9,8 @@ import { existsSync } from "fs";
 import { checkMitmproxyInstalled, isCaCertInstalled, generateCaCert, installCaCert, writeAddonScript, getNetworkExtensionStatus, openNetworkExtensionSettings, } from "../interceptor/mitmproxy-manager.js";
 import { printDesktopSupportExplainer, printNetworkExtensionInstructions } from "./cmd-client.js";
 import { collectClaudeAccount } from "./account-flows.js";
+import { accountToRecord } from "./account-flows.js";
+import { addAccountRuntimeAware, isAccountApiReachable, tryAddAccountToRunningProxy } from "./cmd-accounts.js";
 import { withSetupTelemetryFlush, } from "../telemetry/setup-diagnostics.js";
 // ─── Public registration ──────────────────────────────────────────────────────
 export function registerSetup(program) {
@@ -56,6 +58,8 @@ export async function runSetupWizard({ addMode }) {
             return;
         }
     }
+    let replaceExisting = false;
+    let includeExisting = addMode;
     if (hasExisting && !addMode) {
         const existing = loadAccounts();
         console.log(chalk.yellow(`  Found ${existing.length} existing account(s).\n`));
@@ -80,6 +84,10 @@ export async function runSetupWizard({ addMode }) {
                 console.log(chalk.gray("\nCancelled.\n"));
                 return;
             }
+            replaceExisting = true;
+        }
+        else {
+            includeExisting = true;
         }
     }
     let numAccounts = 1;
@@ -114,14 +122,19 @@ export async function runSetupWizard({ addMode }) {
         return;
     }
     // Merge: existing accounts minus any overwritten by ID, plus new ones
-    const existingAccounts = (hasExisting && !addMode) ? [] : (hasExisting ? loadAccounts() : []);
+    const existingAccounts = hasExisting && includeExisting ? loadAccounts() : [];
     const merged = [
         ...existingAccounts.filter(a => !newAccounts.some(n => n.id === a.id)),
         ...newAccounts,
     ];
     console.log(chalk.bold(`\n${"━".repeat(40)}\n  Saving\n${"━".repeat(40)}\n`));
+    let persistenceMode;
     try {
-        saveAccounts(merged);
+        persistenceMode = await persistSetupAccountsRuntimeAware({
+            newAccounts,
+            merged,
+            replaceExisting,
+        });
     }
     catch (error) {
         const outcomes = savedAttempts.map(attempt => attempt.failed(error, "persistence"));
@@ -130,6 +143,9 @@ export async function runSetupWizard({ addMode }) {
         throw error;
     }
     console.log(chalk.green(`  ✓ ${merged.length} account(s) saved to ~/.cc-router/accounts.json`));
+    if (persistenceMode === "live") {
+        console.log(chalk.gray("  Loaded into the running proxy — available now, no restart needed."));
+    }
     for (const attempt of savedAttempts) {
         attempt.stageCompleted("persistence");
         attempt.succeeded();
@@ -137,6 +153,31 @@ export async function runSetupWizard({ addMode }) {
     // ─── Post-setup interactive flow ─────────────────────────────────────────
     await runPostSetupFlow(merged.length);
 }
+export async function persistSetupAccountsRuntimeAware(input, dependencies = {
+    isLive: isAccountApiReachable,
+    // The wizard merges by id, so a re-collected account must upsert live the
+    // way `saveAccounts(merged)` upserts on disk; without `replace` the daemon
+    // answers 409 and discards the login the operator just completed.
+    tryAddLive: live => tryAddAccountToRunningProxy(live, { replace: true }),
+    saveStored: saveAccounts,
+}) {
+    if (input.replaceExisting) {
+        if (await dependencies.isLive()) {
+            throw new Error("Cannot replace all accounts while the proxy is running. Stop it first: cc-router stop --keep-config");
+        }
+        dependencies.saveStored(input.merged);
+        return "stored";
+    }
+    for (const account of input.newAccounts) {
+        const { mode } = await addAccountRuntimeAware(accountToRecord(account), {
+            tryAddLive: dependencies.tryAddLive,
+            addStored: () => dependencies.saveStored(input.merged),
+        });
+        if (mode === "stored")
+            return "stored";
+    }
+    return "live";
+}
 // ─── Post-setup interactive flow ─────────────────────────────────────────────
 async function runPostSetupFlow(accountCount) {
     console.log(chalk.bold(`\n${"━".repeat(40)}\n  Configure this machine\n${"━".repeat(40)}\n`));

package/dist/cli/cmd-status.js

@@ -1,7 +1,8 @@
 import chalk from "chalk";
 import { PROXY_PORT } from "../config/paths.js";
 import { readConfig } from "../config/manager.js";
-import { classifyHttpSetupFailure, failAttemptFromError, } from "../telemetry/setup-diagnostics.js";
+import { classifyHttpSetupFailure, failAttemptFromError, isPromptCancellation, } from "../telemetry/setup-diagnostics.js";
+import { withEscapeCancel } from "./prompt-cancel.js";
 export function resolveStatusTarget(port) {
     const cfg = readConfig();
     if (cfg.client) {
@@ -169,11 +170,12 @@ async function runReauthFlow(target, intent) {
     let attempt;
     try {
         const { collectReauthRecord } = await import("./account-flows.js");
-        const result = await collectReauthRecord({
+        console.log(chalk.gray("  Esc or Ctrl-C returns to the dashboard.\n"));
+        const result = await withEscapeCancel(signal => collectReauthRecord({
             id: intent.id,
             provider: intent.provider,
             ...(intent.email ? { email: intent.email } : {}),
-        });
+        }, { signal }));
         if (!result)
             return null;
         attempt = result.attempt;
@@ -201,6 +203,10 @@ async function runReauthFlow(target, intent) {
         return result.record.id;
     }
     catch (err) {
+        if (isPromptCancellation(err)) {
+            console.log(chalk.gray("\n  Cancelled."));
+            return null;
+        }
         console.error(chalk.red(`\n✗ Re-authentication failed: ${err.message}`));
         if (attempt) {
             const outcome = failAttemptFromError(attempt, err, "persistence");
@@ -219,8 +225,9 @@ async function runAddAccountFlow(target) {
     let attempt;
     try {
         const { collectClaudeAccount, accountToRecord } = await import("./account-flows.js");
+        console.log(chalk.gray("  Esc or Ctrl-C returns to the dashboard.\n"));
         // The index shown in the flow is just for display, pick something neutral.
-        const setup = await collectClaudeAccount({ index: 1 });
+        const setup = await withEscapeCancel(signal => collectClaudeAccount({ index: 1, signal }));
         attempt = setup.attempt;
         const account = setup.account;
         if (!account)
@@ -250,6 +257,10 @@ async function runAddAccountFlow(target) {
         return account.id;
     }
     catch (err) {
+        if (isPromptCancellation(err)) {
+            console.log(chalk.gray("\n  Cancelled."));
+            return null;
+        }
         console.error(chalk.red(`\n✗ Failed to add account: ${err.message}`));
         if (attempt) {
             const outcome = failAttemptFromError(attempt, err, "persistence");

package/dist/cli/cmd-usage.js

@@ -0,0 +1,124 @@
+import { InvalidArgumentError } from "commander";
+import { USAGE_DIR, PROXY_PORT } from "../config/paths.js";
+import { readAccountsRaw, readConfig } from "../config/manager.js";
+import { resolveStatusTarget } from "./cmd-status.js";
+import { createUsageClient } from "../usage/client.js";
+import { recoverAccountTransition, reconcileUsageAccounts } from "../usage/account-lifecycle.js";
+import { totalTokens, utcTimestamp, usageProvider } from "../usage/types.js";
+const aliases = { claude: "anthropic_subscription", anthropic: "anthropic_subscription", openai: "openai_subscription", grok: "xai_subscription", xai: "xai_subscription" };
+export function parseUsageOptions(options) {
+    const period = options.period ?? "month";
+    if (!["day", "week", "month", "year"].includes(period))
+        throw new InvalidArgumentError("Period must be day, week, month or year");
+    if (options.date) {
+        if (!/^\d{4}-\d\d-\d\d$/.test(options.date))
+            throw new InvalidArgumentError("Date must be YYYY-MM-DD (UTC)");
+        utcTimestamp(options.date);
+    }
+    const providers = options.provider?.map(p => usageProvider(aliases[p] ?? p));
+    return { period: period, ...(options.date ? { date: options.date } : {}), ...(providers ? { providers: [...new Set(providers)] } : {}) };
+}
+function client(portText) {
+    const port = Number(portText ?? PROXY_PORT);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new InvalidArgumentError("Port must be 1..65535");
+    const target = resolveStatusTarget(port);
+    return createUsageClient({ baseUrl: target.baseUrl, headers: target.headers, remote: Boolean(readConfig().client), directory: USAGE_DIR,
+        initializeOffline: store => {
+            const aliases = [];
+            for (const raw of readAccountsRaw()) {
+                if (!raw || typeof raw !== "object")
+                    continue;
+                const record = raw;
+                if (typeof record.id !== "string")
+                    continue;
+                const provider = record.provider ?? "anthropic_subscription";
+                if (typeof provider === "string" && ["anthropic_subscription", "openai_subscription", "xai_subscription"].includes(provider))
+                    aliases.push({ id: record.id, provider: provider });
+            }
+            recoverAccountTransition(store, USAGE_DIR, aliases);
+            reconcileUsageAccounts(store, aliases);
+        },
+    });
+}
+export function formatUsageText(report) {
+    const { totals: t, costs: c } = report;
+    const money = (n) => n === null ? "unavailable" : `${n < 0 ? "-" : ""}$${Math.abs(n).toFixed(2)}`;
+    return [
+        `Usage ${report.period}: ${report.start.slice(0, 10)} — ${report.end.slice(0, 10)} (UTC, end exclusive)`,
+        `Tokens: ${totalTokens(t).toLocaleString("en-US")} | input ${t.input} | output ${t.output} | cache read ${t.cacheRead} | cache write ${t.cacheWrite}`,
+        `API equivalent: ${money(c.pricedApiUsd)}${c.coverage.pricingComplete ? "" : " (partial; unpriced tokens excluded)"}`,
+        `Subscription: ${money(c.subscriptionUsd)}${c.coverage.subscriptionComplete ? "" : " (partial; configure missing costs)"}`,
+        `Net savings: ${money(c.savingsUsd)}${c.savingsPercent === null ? "" : ` (${c.savingsPercent.toFixed(1)}%)`}`,
+        ...report.warnings.map(w => `Warning: ${w}`),
+    ].join("\n");
+}
+export function registerUsage(program) {
+    const usage = program.command("usage").description("Persistent token usage and API-equivalent subscription savings")
+        .option("--period <period>", "day, week, month or year", "month")
+        .option("--date <date>", "Date within the selected period (YYYY-MM-DD, UTC)")
+        .option("--provider <provider>", "Filter Claude, OpenAI or Grok (repeatable)", (value, previous = []) => [...previous, value])
+        .option("--port <port>", "Proxy port", String(PROXY_PORT))
+        .option("--json", "Output JSON without initializing the terminal UI")
+        .action(async (options) => {
+        try {
+            const query = parseUsageOptions(options);
+            const api = client(options.port);
+            if (options.json || !process.stdout.isTTY || !process.stdin.isTTY) {
+                const report = await api.query(query);
+                console.log(options.json ? JSON.stringify(report, null, 2) : formatUsageText(report));
+                return;
+            }
+            const [{ render }, { createElement }, { UsageDashboard }] = await Promise.all([import("ink"), import("react"), import("../ui/UsageDashboard.js")]);
+            const instance = render(createElement(UsageDashboard, { load: api.query, initialQuery: query }), { exitOnCtrlC: true });
+            try {
+                await instance.waitUntilExit();
+            }
+            finally {
+                if (process.stdin.isTTY)
+                    process.stdin.setRawMode(false);
+            }
+        }
+        catch (error) {
+            program.error(error instanceof Error ? error.message : "Usage query failed");
+        }
+    });
+    const subscriptions = usage.command("subscription").description("Configure effective-dated monthly USD subscription costs");
+    const guarded = (command, action) => command.action(async (...args) => {
+        try {
+            await action(...args);
+        }
+        catch (error) {
+            program.error(error instanceof Error ? error.message : "Subscription update failed");
+        }
+    });
+    const set = subscriptions.command("set <account>").description("Start a monthly USD rate; closes the previous open interval")
+        .requiredOption("--monthly-usd <amount>", "Monthly subscription cost in USD")
+        .requiredOption("--from <date>", "Effective date, YYYY-MM-DD (UTC)");
+    guarded(set, async (account, opts) => {
+        if (!/^\d+(?:\.\d+)?$/.test(opts.monthlyUsd) || !Number.isFinite(Number(opts.monthlyUsd)))
+            throw new InvalidArgumentError("Monthly USD must be a finite nonnegative amount");
+        parseUsageOptions({ date: opts.from });
+        await client(usage.opts().port).setSubscription(account, Number(opts.monthlyUsd), opts.from);
+        console.log(`Subscription cost saved for ${account}.`);
+    });
+    const end = subscriptions.command("end <account>").description("End a subscription cost interval")
+        .requiredOption("--on <date>", "Exclusive end date, YYYY-MM-DD (UTC)");
+    guarded(end, async (account, opts) => { parseUsageOptions({ date: opts.on }); await client(usage.opts().port).endSubscription(account, opts.on); console.log(`Subscription interval ended for ${account}.`); });
+    const list = subscriptions.command("list").description("List historical subscription costs").option("--json", "Output JSON");
+    guarded(list, async (opts) => {
+        const result = await client(usage.opts().port).subscriptions();
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (!result.subscriptions.length) {
+            console.log("No subscription costs configured. Use: cc-router usage subscription set <account> --monthly-usd <amount> --from YYYY-MM-DD");
+            return;
+        }
+        for (const sub of result.subscriptions) {
+            const account = result.accounts.find(a => a.key === sub.accountKey);
+            console.log(`${account?.alias ?? sub.accountKey}${account?.retired ? " (retired)" : ""} | $${sub.monthlyUsd.toFixed(2)}/month | ${sub.from.slice(0, 10)} → ${sub.to?.slice(0, 10) ?? "ongoing"} | ${sub.accountKey}`);
+        }
+    });
+}

package/dist/cli/index.js

@@ -3,6 +3,7 @@ import { Command } from "commander";
 import { registerSetup } from "./cmd-setup.js";
 import { registerStart } from "./cmd-start.js";
 import { registerStop, registerRevert } from "./cmd-stop.js";
+import { registerUsage } from "./cmd-usage.js";
 import { registerStatus } from "./cmd-status.js";
 import { registerAccounts } from "./cmd-accounts.js";
 import { registerConfigure } from "./cmd-configure.js";
@@ -30,6 +31,7 @@ Examples:
   $ cc-router start --reconfigure# Re-ask run preferences
   $ cc-router stop               # Stop proxy (offers to remove auto-start / config)
   $ cc-router status             # Live dashboard with account stats
+  $ cc-router usage              # Persistent token usage and subscription savings
   $ cc-router models list        # List dynamically discovered provider models
   $ cc-router logs               # View proxy logs (background mode)
   $ cc-router accounts list      # Show Claude, ChatGPT, and Grok accounts
@@ -48,6 +50,7 @@ registerStart(program);
 registerStop(program);
 registerRevert(program);
 registerStatus(program);
+registerUsage(program);
 registerModels(program);
 registerAccounts(program);
 registerConfigure(program);

package/dist/cli/prompt-cancel.js

@@ -0,0 +1,21 @@
+import * as readline from "node:readline";
+/** The Escape key itself — not an escape sequence and not an Alt-chord. */
+export function isEscapeKey(key) {
+    return key?.name === "escape" && key.sequence === "\x1b";
+}
+export async function withEscapeCancel(flow, stdin = process.stdin) {
+    // Idempotent: the prompt's own readline interface installs the same decoder.
+    readline.emitKeypressEvents(stdin);
+    const controller = new AbortController();
+    const onKeypress = (_input, key) => {
+        if (isEscapeKey(key))
+            controller.abort();
+    };
+    stdin.on("keypress", onKeypress);
+    try {
+        return await flow(controller.signal);
+    }
+    finally {
+        stdin.off("keypress", onKeypress);
+    }
+}

package/dist/config/manager.js

@@ -1,4 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync } from "fs";
+import { coordinateAccountWrite, withUsageRename } from "../usage/account-lifecycle.js";
+import { dirname } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, copyFileSync, chmodSync, openSync, fsyncSync, closeSync } from "fs";
 import { randomBytes } from "crypto";
 import { CONFIG_DIR, ACCOUNTS_PATH, CONFIG_PATH } from "./paths.js";
 import { DEFAULT_RATE_LIMITS, ACCOUNT_USER_DEFAULTS, clampPercent, withInheritedSettings } from "../proxy/types.js";
@@ -31,12 +33,30 @@ function writeFileSecureSync(path, data) {
         chmodSync(tmp, SECRET_FILE_MODE);
     }
     catch { /* best effort */ }
+    const fd = openSync(tmp, "r");
+    try {
+        fsyncFileBestEffort(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
     renameSync(tmp, path);
     try {
         chmodSync(path, SECRET_FILE_MODE);
     }
     catch { /* best effort */ }
 }
+export function fsyncFileBestEffort(fd, sync = fsyncSync) {
+    try {
+        sync(fd);
+    }
+    catch (error) {
+        const code = error.code;
+        if (process.platform === "win32" && (code === "EPERM" || code === "EINVAL"))
+            return;
+        throw error;
+    }
+}
 export function accountsFileExists(path) {
     return existsSync(path ?? ACCOUNTS_PATH);
 }
@@ -63,8 +83,7 @@ export function writeAccountsAtomic(data) {
     writeAccountsAtomicToPath(ACCOUNTS_PATH, data);
 }
 function writeAccountsAtomicToPath(path, data) {
-    // accounts.json holds plaintext OAuth access + refresh tokens — owner-only.
-    writeFileSecureSync(path, JSON.stringify(data, null, 2));
+    coordinateAccountWrite(path, readRawFromPath(path), data, () => writeFileSecureSync(path, JSON.stringify(data, null, 2)));
 }
 /**
  * Replace the Anthropic records in an accounts file, leaving every other
@@ -77,16 +96,16 @@ function writeAccountsAtomicToPath(path, data) {
  * `saveOpenAIAccountsToPath`, which has always taken the path.
  */
 export function writeAnthropicAccountsPreservingOtherProviders(data, path = ACCOUNTS_PATH) {
-    ensureConfigDir();
+    mkdirSync(dirname(path), { recursive: true, mode: SECRET_DIR_MODE });
     // Read from the same file being written, or the merge would carry another
     // file's non-Anthropic records into this one.
     const existing = readRawFromPath(path);
     const nonAnthropic = existing.filter(a => a.provider !== undefined && a.provider !== "anthropic_subscription");
     writeAccountsAtomicToPath(path, [...data, ...nonAnthropic]);
 }
-export function upsertAccountRecord(record) {
-    ensureConfigDir();
-    const existing = readAccountsRaw();
+export function upsertAccountRecord(record, path = ACCOUNTS_PATH) {
+    mkdirSync(dirname(path), { recursive: true, mode: SECRET_DIR_MODE });
+    const existing = readRawFromPath(path);
     // Compare normalised providers: a Claude record written before provider
     // tags existed has none, and a strict comparison appended a tagged
     // duplicate next to it instead of replacing it.
@@ -97,15 +116,15 @@ export function upsertAccountRecord(record) {
         // A re-authentication replaces credentials, not the operator's settings.
         previous ? withInheritedSettings(record, previous) : record,
     ];
-    writeAccountsAtomicToPath(ACCOUNTS_PATH, next);
+    writeAccountsAtomicToPath(path, next);
 }
-export function removeAccountRecordById(id) {
-    ensureConfigDir();
-    const existing = readAccountsRaw();
+export function removeAccountRecordById(id, path = ACCOUNTS_PATH) {
+    mkdirSync(dirname(path), { recursive: true, mode: SECRET_DIR_MODE });
+    const existing = readRawFromPath(path);
     const removed = existing.find(a => a.id === id) ?? null;
     if (!removed)
         return null;
-    writeAccountsAtomicToPath(ACCOUNTS_PATH, existing.filter(a => a.id !== id));
+    writeAccountsAtomicToPath(path, existing.filter(a => a.id !== id));
     return removed;
 }
 /**
@@ -124,7 +143,7 @@ export function renameAccountRecordById(oldId, newId) {
         throw new Error(`An account named "${newId}" already exists`);
     }
     target.id = newId;
-    writeAccountsAtomicToPath(ACCOUNTS_PATH, existing);
+    withUsageRename(ACCOUNTS_PATH, oldId, newId, () => writeAccountsAtomicToPath(ACCOUNTS_PATH, existing));
     return target;
 }
 function normalizeAccountProvider(record) {

package/dist/config/paths.js

@@ -20,3 +20,5 @@ export const TELEMETRY_PATH = process.env["TELEMETRY_PATH"] ??
 export const PID_PATH = path.join(CONFIG_DIR, "cc-router.pid");
 // Log file — daemon stdout/stderr redirect here
 export const LOG_PATH = path.join(CONFIG_DIR, "cc-router.log");
+/** Durable usage history follows an explicit accounts file unless overridden. */
+export const USAGE_DIR = process.env["USAGE_DIR"] ?? path.join(path.dirname(ACCOUNTS_PATH), "usage");