@usagefleet/cli 1.2.79 → 1.2.81

package/README.md

@@ -16,9 +16,10 @@ usagefleet login uf_xxx
 ```
 
 Same two commands on macOS, Linux and Windows (in PowerShell chain them with
-`;` — 5.1 has no `&&`). `login` pairs the device, sets the collector to start
-with your session and writes `~/.config/usagefleet/config.json` (mode `600`).
-The dashboard fills in within a minute.
+`;` — 5.1 has no `&&`). `login` stores the token (the server checks it on the
+first report, not at login), sets the collector to start with your session and
+writes `~/.config/usagefleet/config.json` (mode `600`). The dashboard fills in
+within a minute.
 
 `login` takes the token and nothing else. The collector reports to
 `usagefleet.com` and there is no way to redirect it: the request carries your
@@ -63,11 +64,11 @@ shell once. `uninstall` removes both again, and self-update keeps them current.
   is at-least-once — the server dedups on `uuid`.
 - **Your real limit %** — the collector uses the Claude login already on the
   machine (subscription OAuth from `claude`: macOS login Keychain, elsewhere
-  `<config dir>/.credentials.json`; falling back to `ANTHROPIC_API_KEY`), sends a
-  1-token ping to the Messages API, and reads Anthropic's
-  `anthropic-ratelimit-unified-5h/7d-utilization` headers. Credentials never
-  leave the machine — only the percentages do. `usagefleet status` shows which
-  login was found.
+  `<config dir>/.credentials.json`; falling back to `ANTHROPIC_API_KEY`) and
+  reads the same 5h/weekly percentages Claude's own `/usage` screen shows —
+  from the free OAuth usage endpoint for subscriptions, or a 1-token Messages
+  ping for API keys. Credentials never leave the machine — only the percentages
+  do. `usagefleet status` shows which login was found.
 
 Uploaded per record: token counts, model, session id, hostname, working
 directory, git branch. Prompts, responses and file contents are never read.
@@ -87,7 +88,9 @@ WinRT toast via `powershell.exe`.
 
 A group can be set to **refuse new prompts** once it has burned its budget slice
 (1/N of the account limit) for a window — a switch per window on the Groups
-page, both off by default. `usagefleet login` registers a Claude Code `UserPromptSubmit` hook in
+page, both off by default. Each device also has its own blocking toggle on the
+Devices page: switched off, that machine is never refused, whatever its group
+says. `usagefleet login` registers a Claude Code `UserPromptSubmit` hook in
 `~/.claude/settings.json` (removed by `uninstall`, refreshed rather than stacked
 on re-install, and skipped entirely with `USAGEFLEET_HOOK=0`):
 
@@ -127,7 +130,7 @@ Env vars override the file:
 | `USAGEFLEET_DESKTOP` | override the Claude Desktop sessions dir; `off` to skip it |
 | `USAGEFLEET_PI` | override the pi sessions dirs, comma-separated; `off` to skip |
 | `USAGEFLEET_INTERVAL` | watch poll seconds (default 15) |
-| `USAGEFLEET_LIMITS_INTERVAL` | seconds between limit pings (default 300, so the 1-token ping isn't every cycle) |
+| `USAGEFLEET_LIMITS_INTERVAL` | seconds between limit reports (default 60; 300 on API keys, where each report costs a 1-token ping) |
 | `USAGEFLEET_NOTIFY` | desktop notifications, on by default |
 | `USAGEFLEET_NOTIFY_THRESHOLDS` | utilization % that trigger an alert (default `80,95`) |
 | `USAGEFLEET_BATCH` | records per upload (default 100, server caps at 1000) |

package/dist/claude-creds.js

@@ -56,7 +56,9 @@ function persist(blob, from) {
         return;
     }
     // The password must go in argv: `security`'s stdin prompt reads at most 128
-    // bytes and would silently store a truncated (unparseable) blob.
+    // bytes and would silently store a truncated (unparseable) blob. Argv is
+    // briefly visible in the process list, but only to the same user — who can
+    // read the Keychain item anyway. Accepted.
     execFileSync('security', ['add-generic-password', '-U', '-s', KEYCHAIN_SERVICE, '-a', userInfo().username, '-w', json], { stdio: 'ignore' });
     // Trust nothing: a partial write here means a broken Claude Code login.
     const stored = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {

package/dist/claude-limits.js

@@ -21,7 +21,9 @@ export function parseReset(v) {
 /** Per-model utilization header: `anthropic-ratelimit-unified-<window>-<model>-utilization`
  *  (the account-wide headers have no `<model>` segment and don't match). */
 const MODEL_UTIL_RE = /^anthropic-ratelimit-unified-(\d+[hdwm])-([a-z0-9][a-z0-9_.-]*)-utilization$/;
-export function parseLimitsHeaders(source, get, names = []) {
+// Always reports source 'api': subscription logins never touch the header
+// path (see fetchLimits), so headers can only come from an API-key ping.
+export function parseLimitsHeaders(get, names = []) {
     const modelLimits = [];
     for (const raw of names) {
         const m = raw.toLowerCase().match(MODEL_UTIL_RE);
@@ -42,17 +44,19 @@ export function parseLimitsHeaders(source, get, names = []) {
         modelLimits,
         sevenDayPct: parsePct(get('anthropic-ratelimit-unified-7d-utilization')),
         sevenDayResetsAt: parseReset(get('anthropic-ratelimit-unified-7d-reset')),
-        source,
+        source: 'api',
     };
 }
 const OAUTH_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 /**
- * Per-model limits for subscription logins. The Messages ping only returns the
- * account-wide 5h/7d headers; the per-model caps Claude's own UI shows (e.g.
- * "Fable · 24% used") come from the OAuth usage endpoint Claude Code queries
- * for /usage. Undocumented — parse defensively and return [] on any surprise.
+ * The OAuth usage endpoint Claude Code queries for /usage — the source of both
+ * the per-model caps its UI shows ("Fable · 24% used") and the account-wide
+ * numbers, the ONLY limits source for subscription logins. Undocumented —
+ * parse defensively, but keep failure causes apart: an HTTP error names its
+ * status (401/403 reads as "token expired, open Claude Code to refresh",
+ * anything else as an outage to wait out), junk JSON returns null.
  */
-async function fetchOauthModelLimits(token) {
+async function fetchOauthUsage(token) {
     const res = await fetch(OAUTH_USAGE_URL, {
         headers: {
             'anthropic-beta': 'oauth-2025-04-20',
@@ -62,26 +66,59 @@ async function fetchOauthModelLimits(token) {
         signal: AbortSignal.timeout(15_000),
     });
     if (!res.ok) {
-        return [];
+        const hint = res.status === 401 || res.status === 403
+            ? 'Claude OAuth token expired or revoked · open Claude Code to refresh it'
+            : 'transient? retrying next cycle';
+        throw new Error(`oauth/usage HTTP ${res.status} · ${hint}`);
     }
     const body = await res.json().catch(() => null);
     if (process.env.USAGEFLEET_DEBUG_HEADERS) {
         console.error(`[debug] oauth/usage: ${JSON.stringify(body)}`);
     }
-    return parseOauthUsage(body);
+    return body;
+}
+/**
+ * Account-wide 5h/7d numbers from an oauth/usage payload: percentages
+ * (`{utilization: 14}`), exactly what Claude's /usage screen shows — unlike
+ * the `-utilization` response headers, which now carry a 0–1 fraction on sub
+ * accounts. Missing fields stay null so `oauthLimitsReport` can tell an empty
+ * payload from a real one and skip the cycle.
+ */
+export function parseOauthAccount(body) {
+    const root = (typeof body === 'object' && body !== null ? body : {});
+    const window = (key) => {
+        const raw = root[key];
+        const entry = (typeof raw === 'object' && raw !== null ? raw : {});
+        return {
+            pct: typeof entry.utilization === 'number' ? clampPct(entry.utilization) : null,
+            resetsAt: typeof entry.resets_at === 'string' ? parseReset(entry.resets_at) : null,
+        };
+    };
+    const five = window('five_hour');
+    const seven = window('seven_day');
+    return {
+        fiveHourPct: five.pct,
+        fiveHourResetsAt: five.resetsAt,
+        sevenDayPct: seven.pct,
+        sevenDayResetsAt: seven.resetsAt,
+    };
 }
 /** Both sources report 0–100 percentages: the `-utilization` headers ("37") and
  *  oauth/usage's `utilization`/`percent` fields. Clamping is all they need — a
  *  0–1 "fraction form" heuristic would read a real 1% as 100%, which reaches the
  *  headline number, the critical notification and guard's prompt block.
  *
+ *  One decimal is kept (not rounded to whole): the server multiplies the group
+ *  split by the group count, so integer quantization would amplify to whole
+ *  points on the dashboard.
+ *
  *  Non-finite in, null out: `Infinity` (a JSON `1e999`, or a junk header) would
  *  otherwise clamp to a perfectly plausible 100 and block every prompt. */
 function clampPct(n) {
     if (!Number.isFinite(n)) {
         return null;
     }
-    return Math.min(100, Math.max(0, Math.round(n)));
+    return Math.min(100, Math.max(0, Math.round(n * 10) / 10));
 }
 /** Normalize a scope's model name to a header-safe key ("Fable" → "fable"). */
 function modelKeyOf(name) {
@@ -94,7 +131,7 @@ function modelKeyOf(name) {
  * `{kind: "weekly_scoped", group: "weekly", percent, resets_at,
  * scope: {model: {display_name: "Fable"}}}`) are exactly the per-model bars
  * Claude's own UI renders. Account-wide entries have `scope: null` and are
- * skipped (the header ping covers them).
+ * skipped (`parseOauthAccount` reads those from `five_hour`/`seven_day`).
  *
  * Fallback: legacy top-level `seven_day_<model>` objects with a `utilization`
  * number (all null on current accounts, but cheap to keep).
@@ -120,7 +157,7 @@ export function parseOauthUsage(body) {
             if (!name || typeof l.percent !== 'number') {
                 continue;
             }
-            const window = l.group === 'session' ? '5h' : l.group === 'weekly' ? '7d' : '7d';
+            const window = l.group === 'session' ? '5h' : '7d';
             const key = modelKeyOf(name);
             out.push({
                 model: key,
@@ -153,23 +190,39 @@ export function parseOauthUsage(body) {
     }
     return out;
 }
+/** Assemble a full LimitsReport from an oauth/usage payload, or null when the
+ *  payload carries no account-wide percentage (endpoint down, shape changed) —
+ *  the caller then skips this cycle rather than report degraded numbers. */
+export function oauthLimitsReport(body) {
+    const account = parseOauthAccount(body);
+    if (account.fiveHourPct == null && account.sevenDayPct == null) {
+        return null;
+    }
+    return { ...account, modelLimits: parseOauthUsage(body), source: 'sub' };
+}
 /**
- * Read the account's real rate-limit utilization. Sends a 1-token ping to the
- * Messages API; Anthropic returns the unified 5h/7d utilization in response
- * headers (same approach as Claude-Usage-Tracker's OAuth path).
+ * Read the account's real rate-limit utilization.
+ *
+ * Subscription logins use the free OAuth usage endpoint, and ONLY it — the
+ * exact numbers Claude's own /usage screen shows (account-wide AND per-model),
+ * no tokens spent. When it yields nothing, this throws instead of falling back
+ * to the Messages-API ping: on sub accounts those `-utilization` headers now
+ * carry a 0–1 fraction that parsePct reads 100× low, and one such POST would
+ * overwrite the server's last-good percentages for the whole account. Skipping
+ * the cycle keeps last-good everywhere (the guard has its own staleness rule).
+ *
+ * API keys can't call oauth/usage; their headers still read 0–100, so they
+ * keep the 1-token header ping (same approach as Claude-Usage-Tracker).
  */
 export async function fetchLimits(creds) {
-    const headers = {
-        'anthropic-version': '2023-06-01',
-        'content-type': 'application/json',
-    };
     if (creds.source === 'sub') {
-        headers['authorization'] = `Bearer ${creds.token}`;
-        headers['anthropic-beta'] = 'oauth-2025-04-20';
-        headers['user-agent'] = 'claude-code/2.1.5 (usagefleet)';
-    }
-    else {
-        headers['x-api-key'] = creds.token;
+        // fetchOauthUsage already threw on an HTTP error with its status; reaching
+        // here with no report means a 200 whose body carried no percentages.
+        const report = oauthLimitsReport(await fetchOauthUsage(creds.token));
+        if (!report) {
+            throw new Error('oauth/usage answered without percentages · shape changed? keeping last-good');
+        }
+        return report;
     }
     const res = await fetch(MESSAGES_URL, {
         body: JSON.stringify({
@@ -177,13 +230,17 @@ export async function fetchLimits(creds) {
             messages: [{ role: 'user', content: 'hi' }],
             model: 'claude-haiku-4-5-20251001',
         }),
-        headers,
+        headers: {
+            'anthropic-version': '2023-06-01',
+            'content-type': 'application/json',
+            'x-api-key': creds.token,
+        },
         method: 'POST',
         signal: AbortSignal.timeout(15_000),
     });
     // The unified rate-limit headers are (historically) present on success AND
-    // error responses — this OAuth/header-scraping path against the public
-    // Messages endpoint is undocumented and may break without notice. If a
+    // error responses — this header-scraping path against the public Messages
+    // endpoint is undocumented and may break without notice. If a
     // rejected response ALSO lacks the headers, the feature is unavailable; throw
     // so the caller logs it instead of POSTing an all-null report silently.
     // Diagnostic: dump every rate-limit header so unrecognized per-model names
@@ -195,7 +252,7 @@ export async function fetchLimits(creds) {
             }
         }
     }
-    const report = parseLimitsHeaders(creds.source, n => res.headers.get(n), res.headers.keys());
+    const report = parseLimitsHeaders(n => res.headers.get(n), res.headers.keys());
     const gotHeaders = report.fiveHourPct != null ||
         report.sevenDayPct != null ||
         report.fiveHourResetsAt != null ||
@@ -204,16 +261,5 @@ export async function fetchLimits(creds) {
     if (!res.ok && !gotHeaders) {
         throw new Error(`limits unavailable: HTTP ${res.status} with no rate-limit headers`);
     }
-    // Subscription logins: merge in the per-model caps from the OAuth usage
-    // endpoint (the ping headers never include them). Best-effort — keep the
-    // header-derived report on any failure.
-    if (creds.source === 'sub' && report.modelLimits.length === 0) {
-        try {
-            report.modelLimits = await fetchOauthModelLimits(creds.token);
-        }
-        catch {
-            /* endpoint unavailable — report account-wide limits only */
-        }
-    }
     return report;
 }

package/dist/collector.js

@@ -213,9 +213,10 @@ function planWall() {
     return `device outside your plan's device limit · free a slot or upgrade at ${ENDPOINT}/devices · nothing is lost, uploads resume once it fits`;
 }
 /**
- * Auto-detect the local Claude login, read the real 5h/weekly utilization from
- * Anthropic's rate-limit headers, and report it to the server. Best-effort —
- * returns null (and logs) when no login is found or the request fails.
+ * Auto-detect the local Claude login, read the real 5h/weekly utilization
+ * (oauth/usage for subscription logins, rate-limit headers for API keys), and
+ * report it to the server. Best-effort — returns null (and logs) when no login
+ * is found or the request fails.
  */
 export async function reportLimitsOnce(cfg, log = () => {
     /* empty */

package/dist/config.js

@@ -41,8 +41,8 @@ export function resolvePiDirs(env, fromFile) {
     }
     return [...new Set(raw.map(d => d.trim()).filter(d => d.length > 0))];
 }
-/** Optional scan root (USAGEFLEET_DESKTOP / USAGEFLEET_PI): env "off"/"0"
- *  disables, env or config-file path overrides, else the auto-detected default. */
+/** Optional scan root (USAGEFLEET_DESKTOP): env "off"/"0" disables, env or
+ *  config-file path overrides, else the auto-detected default. */
 function resolveOptionalDir(env, fromFile, fallback) {
     if (env === '0' || env?.toLowerCase() === 'off') {
         return null;

package/dist/index.js

@@ -70,11 +70,14 @@ async function cmdWatch() {
     const cfg = loadConfig();
     const raw = Number(flag('interval') ?? process.env.USAGEFLEET_INTERVAL ?? 15);
     const interval = Math.max(1, Number.isFinite(raw) && raw > 0 ? raw : 15) * 1000;
-    // The limits ping hits the real Messages API (1 billable token) — don't run it
-    // every usage-scan tick. Report at most once per USAGEFLEET_LIMITS_INTERVAL
-    // seconds (default 300), decoupled from the much faster usage poll.
-    const rawLimits = Number(process.env.USAGEFLEET_LIMITS_INTERVAL ?? 300);
-    const limitsInterval = Math.max(interval / 1000, Number.isFinite(rawLimits) && rawLimits > 0 ? rawLimits : 300) * 1000;
+    // Limits reporting is decoupled from the much faster usage poll. Default
+    // interval depends on how the reading is fetched: subscription logins use the
+    // free oauth/usage endpoint (60s keeps the dashboard split fresh at zero token
+    // cost), API keys pay a 1-token Messages ping per reading (300s). An explicit
+    // USAGEFLEET_LIMITS_INTERVAL overrides both.
+    const rawLimits = Number(process.env.USAGEFLEET_LIMITS_INTERVAL);
+    const explicitLimits = Number.isFinite(rawLimits) && rawLimits > 0 ? rawLimits * 1000 : null;
+    let limitsInterval = explicitLimits ?? 60_000;
     let lastLimitsAt = 0;
     // Self-update: once at startup, then every USAGEFLEET_UPDATE_INTERVAL seconds
     // (default 6h — a release lands on a device the same day, not the next).
@@ -112,6 +115,9 @@ async function cmdWatch() {
                 if (limits) {
                     line(note, limitsSummary(limits));
                 }
+                if (explicitLimits === null) {
+                    limitsInterval = limits?.source === 'api' ? 300_000 : 60_000;
+                }
             }
         }
         catch (error) {
@@ -248,7 +254,7 @@ function cmdConfig() {
         ['USAGEFLEET_DESKTOP', 'override the Claude Desktop dir ("off" disables)'],
         ['USAGEFLEET_PI', 'override pi session dirs, comma-separated'],
         ['USAGEFLEET_INTERVAL', 'watch interval seconds (default 15)'],
-        ['USAGEFLEET_LIMITS_INTERVAL', 'seconds between limits pings (default 300)'],
+        ['USAGEFLEET_LIMITS_INTERVAL', 'seconds between limits reports (default 60; 300 on API keys)'],
         ['USAGEFLEET_BATCH', 'records per upload (default 100, max 1000)'],
         ['USAGEFLEET_NOTIFY', 'desktop notifications (0 disables)'],
         ['USAGEFLEET_NOTIFY_THRESHOLDS', 'comma list of % alerts (default 80,95)'],

package/dist/notifier.js

@@ -46,10 +46,8 @@ export function evaluateWindow(prev, pct, resetsAt, thresholds) {
     if (top > lastBucket) {
         return { fire: top, next: { lastBucket: top, resetsAt } };
     }
-    if (top < lastBucket) {
-        return { fire: null, next: { lastBucket: top, resetsAt } };
-    }
-    return { fire: null, next: { lastBucket, resetsAt } };
+    // top <= lastBucket: the mark follows pct down (or holds); nothing fires.
+    return { fire: null, next: { lastBucket: top, resetsAt } };
 }
 /** Relative "resets in 12m" / "resets in 2h" suffix, or "" if unknown/past. */
 function resetSuffix(resetsAt) {
@@ -88,13 +86,16 @@ export function maybeNotify(report, cfg = loadNotifyConfig(), log = () => {
         const state = readStore(path).notify;
         const five = evaluateWindow(state.fiveHour, report.fiveHourPct, report.fiveHourResetsAt, cfg.thresholds);
         const seven = evaluateWindow(state.sevenDay, report.sevenDayPct, report.sevenDayResetsAt, cfg.thresholds);
+        // Readings can carry a decimal; notification copy rounds to whole.
+        const fivePct = Math.round(report.fiveHourPct ?? 0);
+        const sevenPct = Math.round(report.sevenDayPct ?? 0);
         if (five.fire != null) {
-            sendNotification('Claude usage · 5-hour limit', `${report.fiveHourPct}% of your 5-hour limit used${resetSuffix(report.fiveHourResetsAt)}.`, { urgency: urgencyFor(five.fire) });
-            log('ok', `notified · 5h at ${report.fiveHourPct}% · crossed ${five.fire}%`);
+            sendNotification('Claude usage · 5-hour limit', `${fivePct}% of your 5-hour limit used${resetSuffix(report.fiveHourResetsAt)}.`, { urgency: urgencyFor(five.fire) });
+            log('ok', `notified · 5h at ${fivePct}% · crossed ${five.fire}%`);
         }
         if (seven.fire != null) {
-            sendNotification('Claude usage · weekly limit', `${report.sevenDayPct}% of your weekly limit used${resetSuffix(report.sevenDayResetsAt)}.`, { urgency: urgencyFor(seven.fire) });
-            log('ok', `notified · weekly at ${report.sevenDayPct}% · crossed ${seven.fire}%`);
+            sendNotification('Claude usage · weekly limit', `${sevenPct}% of your weekly limit used${resetSuffix(report.sevenDayResetsAt)}.`, { urgency: urgencyFor(seven.fire) });
+            log('ok', `notified · weekly at ${sevenPct}% · crossed ${seven.fire}%`);
         }
         updateStore(path, store => {
             store.notify = { fiveHour: five.next, sevenDay: seven.next };

package/dist/parser.js

@@ -9,15 +9,15 @@ function validTimestamp(v) {
     }
     return new Date().toISOString();
 }
+/** Cache-write tokens, with the per-TTL breakdown when the log carries it.
+ *  5m and 1h writes are priced differently (1.25× vs 2× input), so the server
+ *  wants the split — null means "the log predates the breakdown", not zero. */
 function cacheCreation(u) {
-    if (typeof u.cache_creation_input_tokens === 'number') {
-        return u.cache_creation_input_tokens;
-    }
     const c = u.cache_creation;
-    if (c) {
-        return (c.ephemeral_5m_input_tokens ?? 0) + (c.ephemeral_1h_input_tokens ?? 0);
-    }
-    return 0;
+    const five = typeof c?.ephemeral_5m_input_tokens === 'number' ? c.ephemeral_5m_input_tokens : null;
+    const oneHour = typeof c?.ephemeral_1h_input_tokens === 'number' ? c.ephemeral_1h_input_tokens : null;
+    const total = typeof u.cache_creation_input_tokens === 'number' ? u.cache_creation_input_tokens : (five ?? 0) + (oneHour ?? 0);
+    return { five, oneHour, total };
 }
 /** pi agent session line: `{type:"message", id, timestamp, message:{role:"assistant",
  *  provider, model, responseId, usage:{input, output, cacheRead, cacheWrite}}}`.
@@ -47,6 +47,10 @@ function parsePiLine(o, sessionCwd) {
         return null;
     }
     return {
+        // pi's usage line does not say which TTL the cache write used — leave the
+        // breakdown unknown so the server prices it by the user's TTL setting.
+        cacheCreation1h: null,
+        cacheCreation5m: null,
         cacheCreationTokens: u.cacheWrite ?? 0,
         cacheReadTokens: u.cacheRead ?? 0,
         cwd: sessionCwd,
@@ -109,8 +113,11 @@ export function parseLine(line, source = 'cli', sessionCwd = null) {
         return null;
     }
     const u = message.usage;
+    const cache = cacheCreation(u);
     return {
-        cacheCreationTokens: cacheCreation(u),
+        cacheCreation1h: cache.oneHour,
+        cacheCreation5m: cache.five,
+        cacheCreationTokens: cache.total,
         cacheReadTokens: u.cache_read_input_tokens ?? 0,
         cwd: str(o.cwd),
         gitBranch: str(o.gitBranch),

package/dist/paths.js

@@ -1,7 +1,10 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+// USAGEFLEET_PROJECTS is resolved in config.ts's precedence chain, not here —
+// a second env read (with `??` vs `||` drift) once made an empty env var
+// silently scan nothing.
 export function defaultProjectsDir() {
-    return process.env.USAGEFLEET_PROJECTS ?? join(homedir(), '.claude', 'projects');
+    return join(homedir(), '.claude', 'projects');
 }
 /** Claude Desktop's Electron userData dir, per-OS. Mirrors the app's own
  *  `app.getPath("userData")` (= platform appData + the "Claude" product name),

package/dist/release.js

@@ -1,2 +1,2 @@
 // Generated by .github/workflows/release.yml.
-export const RELEASE_VERSION = "1.2.79";
+export const RELEASE_VERSION = "1.2.81";

package/dist/service.js

@@ -309,27 +309,36 @@ ${envXml}
         catch {
             /* not loaded yet — fine */
         }
+        let loaded = false;
         try {
             execFileSync('launchctl', ['bootstrap', domain, path], {
                 stdio: 'inherit',
             });
+            loaded = true;
         }
         catch {
             try {
                 execFileSync('launchctl', ['load', path], { stdio: 'inherit' });
+                loaded = true;
             }
             catch {
                 /* report below; user can load manually */
             }
         }
-        // Force a (re)start so an update takes effect immediately, not on next respawn.
-        try {
-            execFileSync('launchctl', ['kickstart', '-k', `${domain}/${LABEL}`], {
-                stdio: 'ignore',
-            });
-        }
-        catch {
-            /* best-effort */
+        // Only when the (re)load failed — i.e. the old job is still resident, so this
+        // is the one thing that can swap it. On a job launchd just started via
+        // RunAtLoad, `kickstart -k` kills that instance and the respawn waits out
+        // ThrottleInterval: a guaranteed 30s hole where `status` right after an
+        // update reads "stopped".
+        if (!loaded) {
+            try {
+                execFileSync('launchctl', ['kickstart', '-k', `${domain}/${LABEL}`], {
+                    stdio: 'ignore',
+                });
+            }
+            catch {
+                /* best-effort */
+            }
         }
         console.log(step('service', 'launchd · starts at login'));
         console.log(row('logs', tilde(macLogDir())));

package/dist/ui.js

@@ -86,9 +86,10 @@ export function line(glyph, text) {
 }
 /** Neutral stream glyph, for messages that are neither good nor bad news. */
 export const note = dim('·');
-/** Percentage as a fixed-width string, so successive log lines line up. */
+/** Percentage as a fixed-width string, so successive log lines line up.
+ *  Readings can carry a decimal; display rounds to whole. */
 export function pct(value) {
-    return `${value ?? '?'}%`.padStart(4);
+    return `${value === null ? '?' : Math.round(value)}%`.padStart(4);
 }
 /** Usage bar, coloured by how close the window is to its limit.
  *  Unknown usage renders as an empty bar rather than a missing column. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@usagefleet/cli",
-	"version": "1.2.79",
+	"version": "1.2.81",
 	"description": "Tails Claude Code, Claude Desktop, and pi agent JSONL logs and reports token usage to a UsageFleet server.",
 	"keywords": [
 		"claude",