@vibe-cafe/vibe-usage 0.10.13 → 0.10.15

package/README.md

@@ -8,10 +8,10 @@ Track your AI coding tool token usage and sync to [vibecafe.ai](https://vibecafe
 npx @vibe-cafe/vibe-usage
 ```
 
-That's it. The CLI opens [vibecafe.ai/usage/device](https://vibecafe.ai/usage/device) in your browser; sign in, confirm the verification code shown in your terminal, click 「确认链接」, and the CLI receives an API key automatically.
+That's it. On first setup, the CLI asks whether project names and the device name may leave the machine (both default to **No**), then opens [vibecafe.ai/usage/device](https://vibecafe.ai/usage/device) in your browser. Sign in, confirm the verification code shown in your terminal, click 「确认链接」, and the CLI receives an API key automatically.
 
 After approval, it will:
-1. Save your API key to `~/.vibe-usage/config.json`
+1. Save your API key and local privacy choices to `~/.vibe-usage/config.json`
 2. Detect installed AI coding tools
 3. Run an initial sync of your usage data
 4. Prompt you to enable the background daemon for continuous syncing (recommended)
@@ -32,6 +32,8 @@ npx @vibe-cafe/vibe-usage init         # Re-run setup via browser login
 npx @vibe-cafe/vibe-usage init --manual-key <vbu_...>   # Skip browser, use pre-issued key (CI/headless)
 npx @vibe-cafe/vibe-usage sync         # Manual sync
 npx @vibe-cafe/vibe-usage sync --extra-codex-home /path/to/.codex  # Add another Codex Home for this run only
+npx @vibe-cafe/vibe-usage config set uploadProject false   # Never upload project names
+npx @vibe-cafe/vibe-usage config set uploadHostname false  # Use an opaque per-install device id
 npx @vibe-cafe/vibe-usage summary       # Print last 7 days as markdown (cost / tokens / by model / by project)
 npx @vibe-cafe/vibe-usage summary --days N  # Same, over the last N days (1-90)
 npx @vibe-cafe/vibe-usage daemon       # Continuous sync (every 30m, foreground)
@@ -53,6 +55,7 @@ npx @vibe-cafe/vibe-usage status       # Show config & detected tools
 |------|---------------|
 | Alma | Electron app-data `alma/chat_threads.db` (macOS: `~/Library/Application Support/alma/chat_threads.db`; fixture/relocation override: `VIBE_USAGE_ALMA_DB`). Reads the `usage_records` ledger plus workspace names without selecting chat bodies, message metadata, provider credentials, or full workspace paths. Provider-prefixed model identifiers are normalized to their final model segment. Cache writes are included in input usage. The ledger contains assistant responses only, so Alma emits token buckets without session timing. |
 | Claude Code + Claude Desktop Code/Cowork | Claude Code data in `~/.claude/projects/` (tokens + sessions) and `~/.claude/transcripts/` (sessions only), plus Claude Desktop Cowork's per-session `.claude/projects/` directories. Also scans `$CLAUDE_CONFIG_DIR` and data-bearing `~/.claude-*` profiles. All variants use the existing `claude-code` source; the parser selects the most complete copy of each session so shared/copied transcripts are not counted twice. Logs are streamed and cache creation tokens are included in input usage. |
+| Cindy | Per-owner SQLite ledgers in the two regional Electron user-data roots: macOS `~/Library/Application Support/{CindyGlobal,Cindy}/cindy-*.db`, Windows `%APPDATA%\{CindyGlobal,Cindy}\cindy-*.db`, Linux `${XDG_CONFIG_HOME:-~/.config}/{CindyGlobal,Cindy}/cindy-*.db` (fixture/relocation override: `VIBE_USAGE_CINDY_DIRS`). Cindy-launched Claude Code already writes ordinary `~/.claude` transcripts, so it remains attributed to **Claude Code** and is not read again. Cindy's otherwise-private Codex and Pi daily/model ledger rows augment the existing **Codex** and **pi** sources. Currency rows are summed and cache creation joins input; chat messages, credentials, costs, and owner ids are never selected. The ledger adds token buckets only, without project or session timing. |
 | Codex CLI | `$CODEX_HOME/sessions/` and `$CODEX_HOME/archived_sessions/` (default `~/.codex`), plus an optional temporary `--extra-codex-home` or manually persisted `codexExtraHome`; a versioned local index avoids re-reading unchanged rollouts and reads only safe append tails for ordinary sessions, while fork/sub-agent replay matching, duplicate suppression, and live/archive/cross-root deduplication retain their existing semantics |
 | Grok | `$GROK_HOME/sessions/<encoded-cwd>/<session-id>/` (default `~/.grok`); token usage from `updates.jsonl` `turn_completed.usage` (per-model `modelUsage`, cache reads, reasoning); project from `summary.json` cwd; honors `GROK_HOME` |
 | GitHub Copilot CLI | `~/.copilot/session-state/*/events.jsonl` |
@@ -74,8 +77,8 @@ npx @vibe-cafe/vibe-usage status       # Show config & detected tools
 | Kiro | Kiro CLI native event streams `~/.kiro/sessions/cli/*.jsonl` (estimated tokens from message text: input = prompt + tool results, output = reply + tool calls, reasoning = thinking, cacheRead = re-sent context; thinking-block signatures excluded). Falls back to `~/Library/Application Support/kiro-cli/data.sqlite3` / `~/.local/share/kiro-cli/data.sqlite3` + optional `~/.kiro_sessions/*.json` archives, then IDE `q-client.log` whole-credit deltas as `kiro-credits` (floored cumulative diff — the server stores token counts as bigint); legacy IDE `dev_data/devdata.sqlite` token telemetry is opt-in with `VIBE_USAGE_KIRO_LEGACY_TOKENS=1` |
 | Cline | Standalone `~/.cline/` plus `<host>/User/globalStorage/saoudrizwan.claude-dev/` across VSCode-fork hosts; migrated copies are deduplicated and empty leftover extension stores no longer count as installed |
 | Roo Code | `<host>/User/globalStorage/rooveterinaryinc.roo-cline/{tasks/_index.json,tasks/<id>/{history_item,ui_messages}.json}` (walks all VSCode-fork hosts) |
-| Trae CLI | macOS: `~/Library/Caches/trae-cli/sessions/`; Windows: `%LOCALAPPDATA%/trae-cli/cache/sessions/`; Linux: `~/.cache/trae-cli/sessions/` (CLI telemetry only; Trae IDE/Trae Work chats are not supported) |
-| Antigravity | App 2.0 `~/.gemini/antigravity/conversations/*.db` and `agy` CLI `~/.gemini/antigravity-cli/conversations/*.db` are parsed offline (tokens, real model display name, project, sessions); legacy App `.pb` history falls back to Connect RPC while the language server is running |
+| Trae CLI | macOS: `~/Library/Caches/trae-cli/sessions/`; Windows: `%LOCALAPPDATA%/trae-cli/cache/sessions/`; Linux: `~/.cache/trae-cli/sessions/` (CLI telemetry only; Trae IDE/Trae Work chats are not supported). Token usage is summed per unique LLM call (`model.stream.eino`, plus `model.generate` failovers); nested duplicate spans that share a session `traceID` are not max-merged. `traces.jsonl` / `events.jsonl` are streamed line-by-line so a multi-hundred-MB events file cannot hit Node's string-length limit. |
+| Antigravity | App 2.0 `~/.gemini/antigravity/conversations/*.db` and `agy` CLI `~/.gemini/antigravity-cli/conversations/*.db` are parsed offline (tokens, real model display name when present, project, sessions). Gemini 3.7 CLI blobs omit `chatStartMetadata.createdAt` and `modelDisplayName`; usage still comes from `gen_metadata`, timestamps fall back to `steps.metadata` at the same idx, and the model name falls back to `responseModel`. Legacy App `.pb` history falls back to Connect RPC while the language server is running |
 | WorkBuddy | Current releases: `~/.workbuddy-ai/projects/**/*.jsonl`; legacy releases: `~/.workbuddy/projects/**/*.jsonl` (fixture/relocation override: `VIBE_USAGE_WORKBUDDY_DIRS`). Reads usage-bearing completed assistant and `function_call` records, using the routed model identifier exposed as `providerData.requestModelId`. Splits cache reads and reasoning from inclusive input/output totals, deduplicates copied record IDs, and extracts local session timing without uploading message content. |
 | ZCode | `~/.zcode/cli/db/db.sqlite` (SQLite; reads the `message` table for per-message tokens, model, and project `cwd`/`root`, joined to `session.directory`) |
 
@@ -83,7 +86,7 @@ npx @vibe-cafe/vibe-usage status       # Show config & detected tools
 
 - Parses local session logs from each AI coding tool
 - Aggregates token usage into 30-minute buckets
-- Extracts session metadata where the source safely exposes user/assistant timing: active time (AI generation time, excluding queue/TTFT wait), total duration, and message counts. Alma intentionally emits buckets only because its usage ledger contains assistant responses and the parser does not read chat records.
+- Extracts session metadata where the source safely exposes user/assistant timing: active time (AI generation time, excluding queue/TTFT wait), total duration, and message counts. Alma intentionally emits buckets only; Cindy's daily-ledger augmentation adds no timing data to the native Codex/pi sessions because doing so would require reading Cindy chat records.
 - Uploads buckets + sessions to your vibecafe.ai dashboard (always gzip-compressed, ~94% smaller)
 - Incremental upload: every parser emits a complete local snapshot, then only buckets/sessions that are new or changed since the last successful upload are sent — a quiet machine uploads nothing. Upload state remains in `~/.vibe-usage/state.json`; failed or still-indexing parsers retain their prior state, while deleted local logs are pruned. Deleting the state file triggers a one-time full re-upload, and `reset` clears it automatically after deleting cloud data
 - Incremental Codex parsing: a versioned, disposable cache under `~/.vibe-usage/cache/codex/` stores per-rollout aggregate results and parser continuation state. Unchanged rollouts require no raw-log reads; an ordinary append reads only the new tail; forks, sub-agents, replacements, truncations, and failed safety checks fall back to the full correctness path. A bounded rolling audit occasionally re-reads one historical file. Very large first-time indexes checkpoint before the Mac app timeout and resume on the next sync instead of restarting
@@ -154,10 +157,40 @@ Config stored at `~/.vibe-usage/config.json` (dev: `config.dev.json`).
 |-----|-------------|
 | `apiKey` | Your API key (starts with `vbu_`) |
 | `apiUrl` | Server URL (default: `https://vibecafe.ai`) |
-| `hostname` | Stable device name for usage tracking (set at init, reused across syncs) |
+| `hostname` | Stable device name or user-chosen alias; stays local when `uploadHostname=false` |
+| `uploadProject` | Local project-name control. `false` always wins over the Web setting |
+| `uploadHostname` | Local device-name control. `false` replaces the name at the final network boundary |
+| `deviceId` | Generated opaque per-install identity used when `uploadHostname=false` |
 | `codexExtraHome` | Optional additional Codex Home scanned together with `$CODEX_HOME` / `~/.codex` |
 
-The `hostname` is captured once during `init` and reused for all future syncs. This prevents macOS mDNS hostname changes (e.g., `MacBook-Pro` → `MacBook-Pro-2`) from creating duplicate device entries. To change it manually:
+New setups default both local upload controls to `false`. Existing configs without
+these keys retain their previous behavior until you choose a value: the Web
+project-name setting remains authoritative, and the configured device name is
+uploaded.
+
+```bash
+# Local false cannot be overridden by a later Web setting.
+npx @vibe-cafe/vibe-usage config set uploadProject false
+
+# Replaces the device name in buckets, sessions, and sync metadata with a
+# persistent random id such as device-0011223344556677.
+npx @vibe-cafe/vibe-usage config set uploadHostname false
+```
+
+The sanitization happens after every parser and before hashing or HTTP
+serialization. `cursor-cloud` remains a fixed, non-identifying sentinel so
+Cursor account exports still deduplicate across computers.
+
+These controls prevent future transmissions; they do not silently delete data
+already stored in the cloud. To remove previously uploaded identifiers, run
+`vibe-usage reset` after enabling both controls. A full reset deletes the
+account's existing usage before re-uploading the logs available on this
+computer, so coordinate first if the account syncs multiple computers.
+
+When device-name upload is enabled, `hostname` is captured once during `init`
+and reused for all future syncs. This prevents macOS mDNS hostname changes
+(for example, `MacBook-Pro` → `MacBook-Pro-2`) from creating duplicate device
+entries. It can also be set to a non-identifying alias:
 
 ```bash
 npx @vibe-cafe/vibe-usage config set hostname my-device-name

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-cafe/vibe-usage",
-  "version": "0.10.13",
+  "version": "0.10.15",
   "description": "Track your AI coding tool token usage and sync to vibecafe.ai",
   "type": "module",
   "scripts": {

package/src/cindy-roots.js

@@ -0,0 +1,85 @@
+import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { delimiter, dirname, join, posix, resolve, win32 } from 'node:path';
+import { homedir } from 'node:os';
+
+function unique(values) {
+  return [...new Set(values)];
+}
+
+/**
+ * Cindy keeps Mainland China and Global installs in separate Electron user-data
+ * roots. Scan both because the two editions can be installed side by side.
+ */
+export function getCindyDataRoots(
+  env = process.env,
+  platform = process.platform,
+  home = homedir(),
+) {
+  const override = env.VIBE_USAGE_CINDY_DIRS?.trim();
+  if (override) {
+    return unique(
+      override
+        .split(delimiter)
+        .map((value) => value.trim())
+        .filter(Boolean)
+        .map((value) => resolve(value)),
+    );
+  }
+
+  const pathImpl = platform === 'win32' ? win32 : posix;
+  let base;
+  if (platform === 'darwin') {
+    base = pathImpl.join(home, 'Library', 'Application Support');
+  } else if (platform === 'win32') {
+    base = env.APPDATA?.trim() || pathImpl.join(home, 'AppData', 'Roaming');
+  } else {
+    base = env.XDG_CONFIG_HOME?.trim() || pathImpl.join(home, '.config');
+  }
+  return [pathImpl.join(base, 'CindyGlobal'), pathImpl.join(base, 'Cindy')];
+}
+
+function canonicalPath(value) {
+  try {
+    return realpathSync(value);
+  } catch {
+    return value;
+  }
+}
+
+/** Find every active per-owner `cindy-<owner>.db` database. */
+export function findCindyDbPaths(options = {}) {
+  const roots = getCindyDataRoots(options.env, options.platform, options.home);
+  const paths = [];
+
+  for (const root of roots) {
+    let stat;
+    try {
+      stat = statSync(root);
+    } catch {
+      continue;
+    }
+
+    if (stat.isFile()) {
+      if (root.endsWith('.db')) paths.push(canonicalPath(root));
+      continue;
+    }
+    if (!stat.isDirectory()) continue;
+
+    let entries;
+    try {
+      entries = readdirSync(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const entry of entries) {
+      if (!entry.isFile() || !/^cindy-.+\.db$/.test(entry.name)) continue;
+      paths.push(canonicalPath(join(root, entry.name)));
+    }
+  }
+
+  return unique(paths).sort();
+}
+
+export function findCindyDataDirs(options = {}) {
+  return unique(findCindyDbPaths(options).map(dirname)).filter(existsSync);
+}

package/src/index.js

@@ -24,6 +24,8 @@ async function showStatus() {
     if (config.codexExtraHome) {
       console.log(`  Extra Codex Home: ${config.codexExtraHome}`);
     }
+    console.log(`  Project names: ${config.uploadProject === false ? 'hidden locally' : 'server setting'}`);
+    console.log(`  Device name: ${config.uploadHostname === false ? 'anonymous device id' : 'uploaded'}`);
   }
 
   console.log('\n  Detected tools:');
@@ -48,7 +50,15 @@ async function showStatus() {
   console.log();
 }
 
-const VALID_CONFIG_KEYS = ['apiKey', 'apiUrl', 'hostname', 'codexExtraHome'];
+const BOOLEAN_CONFIG_KEYS = new Set(['uploadProject', 'uploadHostname']);
+const VALID_CONFIG_KEYS = [
+  'apiKey',
+  'apiUrl',
+  'hostname',
+  'uploadProject',
+  'uploadHostname',
+  'codexExtraHome',
+];
 
 function handleConfig(args) {
   const sub = args[0];
@@ -81,6 +91,14 @@ function handleConfig(args) {
         console.error(`Valid keys: ${VALID_CONFIG_KEYS.join(', ')}`);
         process.exit(1);
       }
+      if (BOOLEAN_CONFIG_KEYS.has(key)) {
+        const normalized = value.toLowerCase();
+        if (normalized !== 'true' && normalized !== 'false') {
+          console.error(`${key} must be true or false.`);
+          process.exit(1);
+        }
+        value = normalized === 'true';
+      }
       if (key === 'codexExtraHome' && value !== '') {
         const validation = validateExtraCodexHome(value);
         if (!validation.ok) {
@@ -233,6 +251,8 @@ export async function run(rawArgs) {
     npx @vibe-cafe/vibe-usage config get <key>   Get a config value
     npx @vibe-cafe/vibe-usage config set <key> <value>  Set a config value
     npx @vibe-cafe/vibe-usage config set codexExtraHome <path>  Persist another Codex Home
+    npx @vibe-cafe/vibe-usage config set uploadProject false  Never upload project names
+    npx @vibe-cafe/vibe-usage config set uploadHostname false  Replace the device name with an anonymous id
     npx @vibe-cafe/vibe-usage help         Show this help
 `);
       break;

package/src/init.js

@@ -1,9 +1,9 @@
 import { createInterface } from 'node:readline';
 import { execFile } from 'node:child_process';
-import { hostname as osHostname, platform } from 'node:os';
+import { platform } from 'node:os';
 import { loadConfig, saveConfig } from './config.js';
 import { ingest, requestDeviceCode, pollDeviceCode } from './api.js';
-import { runSync } from './sync.js';
+import { resolveOptionalBoolean, resolveSyncHostname, runSync } from './sync.js';
 import { detectInstalledTools } from './tools.js';
 import { bigHeader, success, failure, warn, arrow, link, dim, divider } from './output.js';
 
@@ -30,6 +30,14 @@ function isDaemonPlatform() {
   return process.platform === 'linux' || process.platform === 'darwin';
 }
 
+async function resolvePrivacyChoice(existingValue, key, question) {
+  const configured = resolveOptionalBoolean(existingValue, key);
+  if (configured !== undefined) return configured;
+  if (!process.stdin.isTTY) return false;
+  const answer = (await prompt(question)).toLowerCase();
+  return answer === 'y' || answer === 'yes';
+}
+
 export async function runInit(options = {}) {
   const { apiKey: providedKey, codexExtraHome } = options;
 
@@ -51,7 +59,31 @@ export async function runInit(options = {}) {
   }
 
   const apiUrl = process.env.VIBE_USAGE_API_URL || 'https://vibecafe.ai';
-  const host = existing?.hostname || osHostname().replace(/\.local$/, '');
+  let uploadProject;
+  let uploadHostname;
+  let draftConfig;
+  let host;
+  try {
+    uploadProject = await resolvePrivacyChoice(
+      existing?.uploadProject,
+      'uploadProject',
+      '上传项目名以查看按项目统计？项目名可能包含客户或内部代号。 [y/N] ',
+    );
+    uploadHostname = await resolvePrivacyChoice(
+      existing?.uploadHostname,
+      'uploadHostname',
+      '上传设备名以区分电脑？选择否将使用匿名设备 ID。 [y/N] ',
+    );
+    draftConfig = {
+      ...(existing || {}),
+      uploadProject,
+      uploadHostname,
+    };
+    host = resolveSyncHostname(draftConfig).hostname;
+  } catch (err) {
+    console.error(failure(err.message));
+    process.exit(1);
+  }
 
   let apiKey;
   if (providedKey) {
@@ -77,10 +109,9 @@ export async function runInit(options = {}) {
   }
 
   const config = {
+    ...draftConfig,
     apiKey,
     apiUrl,
-    hostname: host,
-    ...(existing?.codexExtraHome ? { codexExtraHome: existing.codexExtraHome } : {}),
   };
   saveConfig(config);
 

package/src/parsers/antigravity-db.js

@@ -26,6 +26,10 @@ import { queryDbJsonSnapshotOnLock, sqliteUnavailableError, isSqliteUnavailableE
  *       createdAt (Timestamp) = 9.4  → seconds = 9.4.1
  *     responseModel      = field 19  ("gemini-3-flash-a" / "gemini-default")
  *     modelDisplayName   = field 21  ("Gemini 3.5 Flash (High/Medium/Low)")
+ *
+ * Gemini 3.7 CLI blobs still have usage (4) and responseModel (19) but omit
+ * 9.4 and 21. Timestamps are recovered from steps.metadata field 1.1 at the
+ * same gen_metadata.idx; the model name falls back to responseModel.
  */
 
 // ── Minimal protobuf wire-format decoder (no dependency) ──────────────
@@ -146,6 +150,40 @@ export function parseGenMetadataBlob(buf) {
   };
 }
 
+/**
+ * Extract createdAt seconds from a steps.metadata blob, regardless of step
+ * source. Gemini 3.7 CLI gen_metadata blobs no longer carry chatStartMetadata
+ * (field 9.4); the step timestamp at field 1.1 is the remaining clock.
+ *
+ * @param {Buffer} buf
+ * @returns {Date|null}
+ */
+export function parseStepTimestamp(buf) {
+  const meta = decodeMessage(buf);
+  const createdAt = firstMessage(meta, 1);
+  const seconds = createdAt ? firstVarint(createdAt, 1) : undefined;
+  if (!seconds) return null;
+  const timestamp = new Date(seconds * 1000);
+  return Number.isNaN(timestamp.getTime()) ? null : timestamp;
+}
+
+/**
+ * Prefer the blob's own createdAt; if Gemini 3.7 omitted it, use the step
+ * with the same idx. idx-join is exact on current CLI stores (every
+ * gen_metadata idx exists in steps).
+ *
+ * @param {{timestamp: Date|null, idx?: number}} rec
+ * @param {Map<number, Date>} stepTimestampsByIdx
+ * @returns {Date|null}
+ */
+export function resolveUsageTimestamp(rec, stepTimestampsByIdx) {
+  if (rec?.timestamp && !Number.isNaN(rec.timestamp.getTime())) return rec.timestamp;
+  if (rec?.idx == null || !stepTimestampsByIdx) return null;
+  const stepTs = stepTimestampsByIdx.get(rec.idx);
+  if (stepTs && !Number.isNaN(stepTs.getTime())) return stepTs;
+  return null;
+}
+
 // ── SQLite store reading ──────────────────────────────────────────────
 
 function queryCascadeDb(conversationsDir, cascadeId, sql) {
@@ -182,7 +220,7 @@ export function listDbCascades(conversationsDir) {
 export function readDbUsageRecords(conversationsDir, cascadeId) {
   let rows;
   try {
-    rows = queryCascadeDb(conversationsDir, cascadeId, 'SELECT hex(data) AS h FROM gen_metadata ORDER BY idx');
+    rows = queryCascadeDb(conversationsDir, cascadeId, 'SELECT idx, hex(data) AS h FROM gen_metadata ORDER BY idx');
   } catch (err) {
     if (isSqliteUnavailableError(err)) throw err;
     return [];
@@ -196,11 +234,47 @@ export function readDbUsageRecords(conversationsDir, cascadeId) {
     } catch {
       continue; // one malformed blob must not kill the rest
     }
-    if (rec) records.push(rec);
+    if (rec) {
+      rec.idx = Number.isFinite(Number(row.idx)) ? Number(row.idx) : null;
+      records.push(rec);
+    }
   }
   return records;
 }
 
+/**
+ * Map steps.idx → createdAt for every step that has a timestamp, including
+ * system/tool steps that parseStepMetadata skips. Used to timestamp 3.7
+ * gen_metadata rows that no longer embed chatStartMetadata.
+ */
+export function readDbStepTimestamps(conversationsDir, cascadeId) {
+  let rows;
+  try {
+    rows = queryCascadeDb(
+      conversationsDir,
+      cascadeId,
+      'SELECT idx, hex(metadata) AS h FROM steps WHERE metadata IS NOT NULL ORDER BY idx',
+    );
+  } catch (err) {
+    if (isSqliteUnavailableError(err)) throw err;
+    return new Map();
+  }
+  const byIdx = new Map();
+  for (const row of rows) {
+    if (!row.h) continue;
+    let ts;
+    try {
+      ts = parseStepTimestamp(Buffer.from(row.h, 'hex'));
+    } catch {
+      continue;
+    }
+    if (!ts) continue;
+    const idx = Number(row.idx);
+    if (Number.isFinite(idx)) byIdx.set(idx, ts);
+  }
+  return byIdx;
+}
+
 /**
  * Read the workspace URI for a cascade from trajectory_metadata_blob.
  * Structure: field 1 = workspaces[0], 1.1 = workspaceFolderAbsoluteUri.

package/src/parsers/antigravity.js

@@ -3,7 +3,7 @@ import { readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { aggregateToBuckets, extractSessions } from './aggregate.js';
-import { listDbCascades, readDbUsageRecords, readDbWorkspaceUri, readDbSessionEvents } from './antigravity-db.js';
+import { listDbCascades, readDbUsageRecords, readDbWorkspaceUri, readDbSessionEvents, readDbStepTimestamps, resolveUsageTimestamp } from './antigravity-db.js';
 
 
 
@@ -327,18 +327,25 @@ export async function parse() {
     for (const cascadeId of listDbCascades(dir)) {
       const records = readDbUsageRecords(dir, cascadeId);
       const project = projectFromUri(readDbWorkspaceUri(dir, cascadeId)) || 'unknown';
+      const stepTimestampsByIdx = records.some((rec) => !rec.timestamp || isNaN(rec.timestamp.getTime()))
+        ? readDbStepTimestamps(dir, cascadeId)
+        : new Map();
 
       if (records.length > 0) {
         dbHandled.add(cascadeId);
         for (const rec of records) {
           if (rec.responseId && seenResponseIds.has(rec.responseId)) continue;
           if (rec.responseId) seenResponseIds.add(rec.responseId);
-          if (!rec.timestamp || isNaN(rec.timestamp.getTime())) continue;
+          // Gemini 3.7 CLI blobs dropped chatStartMetadata.createdAt (9.4.1)
+          // and modelDisplayName (21). Usage is still in field 4; clock is
+          // recovered from steps.metadata at the same idx.
+          const timestamp = resolveUsageTimestamp(rec, stepTimestampsByIdx);
+          if (!timestamp || isNaN(timestamp.getTime())) continue;
           entries.push({
             source: SOURCE,
             model: modelFromRecord(rec),
             project,
-            timestamp: rec.timestamp,
+            timestamp,
             inputTokens: toSafeNumber(rec.inputTokens),
             outputTokens: toSafeNumber(rec.outputTokens),
             cachedInputTokens: toSafeNumber(rec.cacheReadTokens),

package/src/parsers/cindy-ledger.js

@@ -0,0 +1,156 @@
+import { findCindyDbPaths } from '../cindy-roots.js';
+import { aggregateToBuckets } from './aggregate.js';
+import { toCount } from './fs-utils.js';
+import {
+  isSqliteUnavailableError,
+  queryDbJsonSnapshot,
+  sqliteUnavailableError,
+} from './sqlite.js';
+
+const CINDY_USAGE_SQL = `
+  SELECT
+    day,
+    agent_kind AS agentKind,
+    model,
+    SUM(input_tokens) AS inputTokens,
+    SUM(output_tokens) AS outputTokens,
+    SUM(cache_read_tokens) AS cacheReadTokens,
+    SUM(cache_create_tokens) AS cacheCreateTokens
+  FROM daily_model_usage
+  GROUP BY day, agent_kind, model
+  ORDER BY day, agent_kind, model
+`;
+
+/** Cindy stores its ledger day as local-time YYYY-MM-DD. */
+export function dateFromCindyDay(value) {
+  if (typeof value !== 'string') return null;
+  const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(value);
+  if (!match) return null;
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const date = new Date(year, month - 1, day);
+  if (
+    date.getFullYear() !== year
+    || date.getMonth() !== month - 1
+    || date.getDate() !== day
+  ) {
+    return null;
+  }
+  return date;
+}
+
+function skippedResult(error) {
+  const message = error?.message || String(error);
+  let reason = 'read failed';
+  if (/database is locked/i.test(message)) reason = 'database is locked';
+  else if (/no such column/i.test(message)) reason = 'incompatible database schema';
+  else if (/unable to open|SQLITE_CANTOPEN/i.test(message)) reason = 'database unavailable';
+  return {
+    buckets: [],
+    sessions: [],
+    skipped: true,
+    warnings: [`cindy: cannot read usage database (${reason})`],
+  };
+}
+
+const CINDY_HARNESS_SOURCES = {
+  codex: 'codex',
+  pi: 'pi-coding-agent',
+};
+
+/**
+ * Read Cindy's daily ledger for a harness that does not already expose the
+ * same raw logs to Vibe Usage. Cindy's Claude Code SDK writes ordinary
+ * ~/.claude transcripts, so Claude stays owned by the claude-code parser and
+ * is deliberately absent from this map.
+ */
+export function readCindyHarnessUsage(agentKind) {
+  const source = CINDY_HARNESS_SOURCES[agentKind];
+  if (!source) throw new TypeError(`Unsupported Cindy harness: ${agentKind}`);
+
+  const dbPaths = findCindyDbPaths();
+  if (dbPaths.length === 0) return { buckets: [], sessions: [] };
+
+  const rows = [];
+  for (const dbPath of dbPaths) {
+    try {
+      rows.push(...queryDbJsonSnapshot(dbPath, CINDY_USAGE_SQL, {
+        tempPrefix: 'vibe-usage-cindy-',
+      }));
+    } catch (error) {
+      if (isSqliteUnavailableError(error)) throw sqliteUnavailableError('Cindy');
+      // Cindy versions before the daily ledger was introduced have no usage
+      // rows to import. A second, current regional/account database may still
+      // be readable, so skip only this legacy database.
+      if (/no such table:\s*daily_model_usage/i.test(error?.message || '')) continue;
+      return skippedResult(error);
+    }
+  }
+
+  const entries = [];
+  for (const row of rows) {
+    if (row.agentKind !== agentKind) continue;
+    const timestamp = dateFromCindyDay(row.day);
+    if (!timestamp) continue;
+    const inputTokens = toCount(row.inputTokens) + toCount(row.cacheCreateTokens);
+    const outputTokens = toCount(row.outputTokens);
+    const cachedInputTokens = toCount(row.cacheReadTokens);
+    if (inputTokens + outputTokens + cachedInputTokens === 0) continue;
+
+    entries.push({
+      source,
+      model: typeof row.model === 'string' && row.model.trim()
+        ? row.model.trim()
+        : `${source}-unknown`,
+      project: 'unknown',
+      timestamp,
+      inputTokens,
+      outputTokens,
+      cachedInputTokens,
+      reasoningOutputTokens: 0,
+    });
+  }
+
+  return {
+    buckets: aggregateToBuckets(entries),
+    sessions: [],
+  };
+}
+
+/**
+ * Merge the optional Cindy ledger into the native harness snapshot. A failed
+ * Cindy read marks the whole source skipped so its previously uploaded rows
+ * are not pruned from incremental state.
+ */
+export function mergeCindyHarnessUsage(nativeResult, cindyResult) {
+  const warnings = [
+    ...(nativeResult.warnings || []),
+    ...(cindyResult.warnings || []),
+  ];
+  if (nativeResult.skipped || cindyResult.skipped) {
+    return {
+      ...nativeResult,
+      buckets: [],
+      sessions: [],
+      skipped: true,
+      warnings,
+    };
+  }
+
+  const entries = [];
+  for (const bucket of [...nativeResult.buckets, ...cindyResult.buckets]) {
+    const timestamp = new Date(bucket.bucketStart);
+    if (Number.isNaN(timestamp.getTime())) continue;
+    entries.push({
+      ...bucket,
+      timestamp,
+    });
+  }
+  return {
+    ...nativeResult,
+    buckets: aggregateToBuckets(entries),
+    sessions: nativeResult.sessions || [],
+    warnings,
+  };
+}

package/src/parsers/codex.js

@@ -11,6 +11,7 @@ import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { createHash } from 'node:crypto';
 import { aggregateToBuckets } from './aggregate.js';
+import { mergeCindyHarnessUsage, readCindyHarnessUsage } from './cindy-ledger.js';
 import {
   codexSessionDirs,
   resolveCodexHomes,
@@ -796,7 +797,7 @@ function mergeFileResults(results) {
   return { buckets: aggregateToBuckets(entries), sessions };
 }
 
-export async function parse({ codexExtraHome } = {}) {
+async function parseNativeCodex({ codexExtraHome } = {}) {
   if (codexExtraHome?.trim()) {
     const validation = validateExtraCodexHome(codexExtraHome);
     if (!validation.ok) {
@@ -1019,3 +1020,8 @@ export async function parse({ codexExtraHome } = {}) {
 
   return { ...mergeFileResults(results), cache: cacheStats };
 }
+
+export async function parse(options = {}) {
+  const nativeResult = await parseNativeCodex(options);
+  return mergeCindyHarnessUsage(nativeResult, readCindyHarnessUsage('codex'));
+}

package/src/parsers/pi-coding-agent.js

@@ -1,10 +1,12 @@
 import { getPiSessionDirs } from '../pi-roots.js';
+import { mergeCindyHarnessUsage, readCindyHarnessUsage } from './cindy-ledger.js';
 import { parsePiSessionJsonl } from './pi-session-jsonl.js';
 
 /** Parse the official Pi agent's Pi-compatible JSONL sessions. */
 export async function parse() {
-  return parsePiSessionJsonl({
+  const nativeResult = await parsePiSessionJsonl({
     source: 'pi-coding-agent',
     sessionsDirs: getPiSessionDirs(),
   });
+  return mergeCindyHarnessUsage(nativeResult, readCindyHarnessUsage('pi'));
 }

package/src/parsers/sqlite.js

@@ -17,8 +17,12 @@ const require = createRequire(import.meta.url);
  * If neither is available, throws an Error whose message contains "ENOENT" so
  * callers can surface an "Install sqlite3" hint, matching the previous behavior.
  */
-export function queryDbJson(dbPath, sql, { timeout = 30000, maxBuffer = 100 * 1024 * 1024 } = {}) {
-  const db = openNodeSqlite(dbPath);
+export function queryDbJson(
+  dbPath,
+  sql,
+  { timeout = 30000, maxBuffer = 100 * 1024 * 1024, readOnly = true } = {},
+) {
+  const db = openNodeSqlite(dbPath, readOnly);
   if (db) {
     try {
       return db.prepare(sql).all();
@@ -55,12 +59,22 @@ function getNodeSqlite() {
   return nodeSqlite;
 }
 
-function openNodeSqlite(dbPath) {
+function openNodeSqlite(dbPath, readOnly = true) {
   const mod = getNodeSqlite();
   if (!mod || !mod.DatabaseSync) return null;
+  let db;
   try {
-    return new mod.DatabaseSync(dbPath, { readOnly: true });
+    db = new mod.DatabaseSync(dbPath, { readOnly });
+    // Writable access is used only for disposable snapshots whose WAL metadata
+    // may need initialization. Keep the SQL connection itself read-only.
+    if (!readOnly) db.exec('PRAGMA query_only = ON');
+    return db;
   } catch {
+    try {
+      db?.close();
+    } catch {
+      // Ignore cleanup failure while falling back to the sqlite3 CLI.
+    }
     return null;
   }
 }
@@ -94,6 +108,31 @@ export function isLockError(err) {
   return !!err && typeof err.message === 'string' && /database is locked/i.test(err.message);
 }
 
+function querySnapshot(dbPath, sql, { tempPrefix, opts } = {}) {
+  const snapshotDir = mkdtempSync(join(tmpdir(), tempPrefix || 'vibe-usage-sqlite-'));
+  const queryPath = join(snapshotDir, basename(dbPath));
+  try {
+    copyFileSync(dbPath, queryPath);
+    for (const suffix of ['-shm', '-wal']) {
+      const companion = `${dbPath}${suffix}`;
+      if (existsSync(companion)) copyFileSync(companion, `${queryPath}${suffix}`);
+    }
+    return queryDbJson(queryPath, sql, { ...opts, readOnly: false });
+  } finally {
+    rmSync(snapshotDir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Query a disposable writable snapshot. Some WAL-mode databases cannot be
+ * opened read-only until SQLite has initialized their shared-memory metadata;
+ * doing that only in the temp copy keeps the source application database
+ * untouched and works without a sqlite3 binary on Node >= 22.5.
+ */
+export function queryDbJsonSnapshot(dbPath, sql, options = {}) {
+  return querySnapshot(dbPath, sql, options);
+}
+
 /**
  * Run a query, and if the source app holds a write lock on the database, copy
  * the DB (plus its -wal/-shm companions) to a temp dir and re-query the
@@ -104,17 +143,6 @@ export function queryDbJsonSnapshotOnLock(dbPath, sql, { tempPrefix = 'vibe-usag
     return queryDbJson(dbPath, sql, opts);
   } catch (err) {
     if (!isLockError(err)) throw err;
-    const snapshotDir = mkdtempSync(join(tmpdir(), tempPrefix));
-    const queryPath = join(snapshotDir, basename(dbPath));
-    try {
-      copyFileSync(dbPath, queryPath);
-      for (const suffix of ['-shm', '-wal']) {
-        const companion = `${dbPath}${suffix}`;
-        if (existsSync(companion)) copyFileSync(companion, `${queryPath}${suffix}`);
-      }
-      return queryDbJson(queryPath, sql, opts);
-    } finally {
-      rmSync(snapshotDir, { recursive: true, force: true });
-    }
+    return querySnapshot(dbPath, sql, { tempPrefix, opts });
   }
 }

package/src/parsers/trae-cli.js

@@ -1,22 +1,86 @@
-import { readFileSync, readdirSync } from 'node:fs';
+import { createReadStream, existsSync, readdirSync } from 'node:fs';
+import { createInterface } from 'node:readline';
 import { join } from 'node:path';
 import { findTraeCliDataDirs } from '../tools.js';
 import { aggregateToBuckets, extractSessions } from './aggregate.js';
 import { readJsonSafe, projectFromPath } from './fs-utils.js';
 
-function parseJsonlSafe(path) {
+// Trae writes each LLM call as several nested spans that share one session-level
+// traceID and copy the same usage onto every layer:
+//   model.stream.eino  (authoritative: includes reasoning tokens)
+//   model.real_call    (duplicate)
+//   model.call         (duplicate)
+// model.generate is a separate failover call (different model), not a duplicate.
+// Counting every layer would 3x; merging by traceID with max() collapses a
+// whole session of sequential calls into a single request. Keep one unique
+// layer per call, then SUM.
+const PRIMARY_LLM_CATEGORY = 'model.stream.eino';
+const FAILOVER_LLM_CATEGORY = 'model.generate';
+const FALLBACK_LLM_CATEGORIES = ['model.real_call', 'model.call'];
+
+function tagMapFrom(tags) {
+  const tagMap = {};
+  if (!Array.isArray(tags)) return tagMap;
+  for (const t of tags) {
+    if (t && typeof t === 'object' && t.key) tagMap[t.key] = t.value;
+  }
+  return tagMap;
+}
+
+function spanCategory(tagMap) {
+  return typeof tagMap['span.category'] === 'string' ? tagMap['span.category'] : '';
+}
+
+function usageFromTagMap(tagMap) {
+  const inputTokens = Math.max(0, Number(tagMap['usage.input_tokens']) || 0);
+  const outputTokens = Math.max(0, Number(tagMap['usage.output_tokens']) || 0);
+  const cacheReadTokens = Math.max(0, Number(tagMap['usage.cache_read_tokens']) || 0);
+  const reasoningTokens = Math.max(0, Number(tagMap['usage.reasoning_tokens']) || 0);
+  return { inputTokens, outputTokens, cacheReadTokens, reasoningTokens };
+}
+
+function hasUsage(usage) {
+  return usage.inputTokens + usage.outputTokens + usage.cacheReadTokens + usage.reasoningTokens > 0;
+}
+
+/**
+ * Pick the unique LLM-call spans from a session's traces.
+ * Prefer model.stream.eino (+ model.generate failovers). If a session has no
+ * primary layer (older traces), fall back to model.real_call, then model.call.
+ * @param {{category: string, usage: object, model: string|null, startTime: number}[]} spans
+ */
+export function selectTraeUsageSpans(spans) {
+  const withUsage = spans.filter((s) => hasUsage(s.usage));
+  const primary = withUsage.filter((s) => s.category === PRIMARY_LLM_CATEGORY);
+  const failover = withUsage.filter((s) => s.category === FAILOVER_LLM_CATEGORY);
+  if (primary.length > 0 || failover.length > 0) return primary.concat(failover);
+  for (const cat of FALLBACK_LLM_CATEGORIES) {
+    const subset = withUsage.filter((s) => s.category === cat);
+    if (subset.length > 0) return subset;
+  }
+  return withUsage;
+}
+
+/** Stream a JSONL file line by line. Skips missing files and malformed lines. */
+export async function forEachJsonl(path, onObj) {
+  if (!existsSync(path)) return;
+  const stream = createReadStream(path, { encoding: 'utf8' });
+  const lines = createInterface({ input: stream, crlfDelay: Infinity });
   try {
-    const content = readFileSync(path, 'utf-8');
-    return content
-      .split('\n')
-      .map(line => line.trim())
-      .filter(line => line.length > 0)
-      .map(line => {
-        try { return JSON.parse(line); } catch { return null; }
-      })
-      .filter(Boolean);
-  } catch {
-    return [];
+    for await (const line of lines) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      let obj;
+      try {
+        obj = JSON.parse(trimmed);
+      } catch {
+        continue;
+      }
+      if (obj && typeof obj === 'object') onObj(obj);
+    }
+  } finally {
+    lines.close();
+    stream.destroy();
   }
 }
 
@@ -43,79 +107,41 @@ export async function parse() {
       const project = projectFromPath(sessionJson.metadata?.cwd);
       const fallbackModel = sessionJson.metadata?.model_name || 'trae-unknown';
 
-      // 1. Parse traces.jsonl for token usage
-      const traceLines = parseJsonlSafe(join(sessionPath, 'traces.jsonl'));
-      const tracesMap = new Map();
-
-      for (const line of traceLines) {
-        if (!line.traceID) continue;
-        const tags = Array.isArray(line.tags) ? line.tags : [];
-        const tagMap = {};
-        for (const t of tags) {
-          if (t && typeof t === 'object' && t.key) {
-            tagMap[t.key] = t.value;
-          }
-        }
-
-        const model = tagMap['model.name'] || tagMap['semantic.name'] || null;
-        const inputTokens = Math.max(0, Number(tagMap['usage.input_tokens']) || 0);
-        const outputTokens = Math.max(0, Number(tagMap['usage.output_tokens']) || 0);
-        const cacheReadTokens = Math.max(0, Number(tagMap['usage.cache_read_tokens']) || 0);
-        const reasoningTokens = Math.max(0, Number(tagMap['usage.reasoning_tokens']) || 0);
-
-        if (inputTokens + outputTokens + cacheReadTokens + reasoningTokens === 0) {
-          continue;
-        }
-
-        if (!tracesMap.has(line.traceID)) {
-          tracesMap.set(line.traceID, {
-            model,
-            inputTokens,
-            outputTokens,
-            cacheReadTokens,
-            reasoningTokens,
-            startTime: Number(line.startTime) || 0,
-          });
-        } else {
-          // Merge spans under the same traceID by selecting the max values
-          const existing = tracesMap.get(line.traceID);
-          if (model) {
-            existing.model = model;
-          }
-          existing.inputTokens = Math.max(existing.inputTokens, inputTokens);
-          existing.outputTokens = Math.max(existing.outputTokens, outputTokens);
-          existing.cacheReadTokens = Math.max(existing.cacheReadTokens, cacheReadTokens);
-          existing.reasoningTokens = Math.max(existing.reasoningTokens, reasoningTokens);
-          if (line.startTime) {
-            existing.startTime = existing.startTime ? Math.min(existing.startTime, Number(line.startTime)) : Number(line.startTime);
-          }
-        }
-      }
+      const spans = [];
+      await forEachJsonl(join(sessionPath, 'traces.jsonl'), (line) => {
+        const tagMap = tagMapFrom(line.tags);
+        const usage = usageFromTagMap(tagMap);
+        if (!hasUsage(usage)) return;
+        const startTime = Number(line.startTime);
+        if (!Number.isFinite(startTime) || startTime <= 0) return;
+        spans.push({
+          category: spanCategory(tagMap),
+          model: tagMap['model.name'] || tagMap['semantic.name'] || null,
+          startTime,
+          usage,
+        });
+      });
 
-      // Convert trace map to vibe-usage entries
-      for (const trace of tracesMap.values()) {
-        // Convert microsecond startTime to milliseconds for Date constructor
-        const startTime = Number(trace.startTime);
-        if (!Number.isFinite(startTime) || startTime <= 0) continue;
-        const timestamp = new Date(startTime / 1000);
+      for (const span of selectTraeUsageSpans(spans)) {
+        // Trae startTime is microseconds; Date expects milliseconds.
+        const timestamp = new Date(span.startTime / 1000);
+        if (Number.isNaN(timestamp.getTime())) continue;
         entries.push({
           source: 'trae-cli',
-          model: trace.model || fallbackModel,
+          model: span.model || fallbackModel,
           project,
           timestamp,
-          inputTokens: trace.inputTokens,
-          outputTokens: trace.outputTokens,
-          cachedInputTokens: trace.cacheReadTokens,
-          reasoningOutputTokens: trace.reasoningTokens,
+          inputTokens: span.usage.inputTokens,
+          outputTokens: span.usage.outputTokens,
+          cachedInputTokens: span.usage.cacheReadTokens,
+          reasoningOutputTokens: span.usage.reasoningTokens,
         });
       }
 
-      // 2. Parse events.jsonl for user and assistant timings
-      const eventLines = parseJsonlSafe(join(sessionPath, 'events.jsonl'));
-      for (const line of eventLines) {
-        if (!line.created_at) continue;
+      await forEachJsonl(join(sessionPath, 'events.jsonl'), (line) => {
+        if (!line.created_at) return;
         const timestamp = new Date(line.created_at);
-        if (Number.isNaN(timestamp.getTime())) continue;
+        if (Number.isNaN(timestamp.getTime())) return;
 
         if (line.agent_start) {
           events.push({
@@ -134,7 +160,7 @@ export async function parse() {
             role: 'assistant',
           });
         }
-      }
+      });
     }
   }
 

package/src/reset.js

@@ -1,8 +1,7 @@
 import { createInterface } from 'node:readline';
-import { hostname as getHostname } from 'node:os';
-import { loadConfig } from './config.js';
+import { loadConfig, saveConfig } from './config.js';
 import { deleteAllData } from './api.js';
-import { runSync } from './sync.js';
+import { resolveSyncHostname, runSync } from './sync.js';
 import { clearState } from './state.js';
 import { success, failure, arrow, link, dim } from './output.js';
 
@@ -34,10 +33,18 @@ export async function runReset(args = [], deps = {}) {
     process.exit(1);
   }
 
-  // Target the hostname persisted at init — the same one sync.js uploads
-  // under. A fresh os.hostname() can have drifted since (macOS mDNS adds -2
-  // suffixes), which would delete zero rows, or another machine's rows.
-  const currentHost = config.hostname || getHostname().replace(/\.local$/, '');
+  // Target the exact privacy-safe identity sync.js uploads under. This keeps
+  // `reset --local` aligned with both the stable configured hostname and the
+  // anonymous per-install device id used when hostname upload is disabled.
+  let hostIdentity;
+  try {
+    hostIdentity = resolveSyncHostname(config);
+    if (hostIdentity.changed) saveConfig(config);
+  } catch (err) {
+    console.error(failure(err.message));
+    process.exit(1);
+  }
+  const currentHost = hostIdentity.hostname;
   const apiUrl = config.apiUrl || 'https://vibecafe.ai';
 
   if (hostOnly) {

package/src/sync.js

@@ -1,4 +1,5 @@
 import { hostname as osHostname } from 'node:os';
+import { randomBytes } from 'node:crypto';
 import { loadConfig, saveConfig } from './config.js';
 import {
   loadState, saveState, pruneState,
@@ -14,13 +15,83 @@ import { success, failure, warn, arrow, link, dim } from './output.js';
 const BATCH_SIZE = 100;
 const SESSION_BATCH_SIZE = 500;
 
+const ANONYMOUS_DEVICE_ID_PATTERN = /^device-[0-9a-f]{16}$/;
+const SHARED_HOSTNAME_SENTINELS = new Set(['cursor-cloud']);
+
+export function resolveOptionalBoolean(value, key) {
+  if (value === undefined) return undefined;
+  if (typeof value === 'boolean') return value;
+  const error = new Error(`配置 ${key} 必须是 true 或 false。`);
+  error.code = 'INVALID_CONFIG';
+  throw error;
+}
+
+export function resolveSyncHostname(config, {
+  systemHostname = () => osHostname().replace(/\.local$/, ''),
+  createDeviceId = () => `device-${randomBytes(8).toString('hex')}`,
+} = {}) {
+  const uploadHostname = resolveOptionalBoolean(config.uploadHostname, 'uploadHostname') ?? true;
+  const previousHostname = typeof config.hostname === 'string' && config.hostname.trim()
+    ? config.hostname.trim()
+    : undefined;
+
+  if (!uploadHostname) {
+    const existingDeviceId = typeof config.deviceId === 'string'
+      ? config.deviceId.trim().toLowerCase()
+      : '';
+    const hostname = ANONYMOUS_DEVICE_ID_PATTERN.test(existingDeviceId)
+      ? existingDeviceId
+      : createDeviceId();
+    const changed = config.deviceId !== hostname;
+    if (changed) config.deviceId = hostname;
+    return { hostname, previousHostname, uploadHostname, changed };
+  }
+
+  const hostname = previousHostname || systemHostname();
+  const changed = config.hostname !== hostname;
+  if (changed) config.hostname = hostname;
+  return { hostname, previousHostname, uploadHostname, changed };
+}
+
+export function applyHostnamePrivacy(records, hostname, uploadHostname) {
+  for (const record of records) {
+    if (uploadHostname) {
+      if (!record.hostname) record.hostname = hostname;
+    } else if (!SHARED_HOSTNAME_SENTINELS.has(record.hostname)) {
+      record.hostname = hostname;
+    }
+  }
+}
+
+// A hostname privacy toggle changes the server bucket key. Carry unchanged
+// local state across that key change so enabling privacy does not re-upload
+// all historical buckets beside their older server rows. Changed buckets still
+// upload under the anonymous id; `reset` remains the explicit way to remove
+// identifiers that were uploaded before the local control was enabled.
+export function migrateHiddenHostnameState(state, buckets, previousHostname, hostname) {
+  if (!previousHostname || previousHostname === hostname) return false;
+  let changed = false;
+  for (const bucket of buckets) {
+    if (bucket.hostname !== hostname) continue;
+    const oldKey = bucketKey({ ...bucket, hostname: previousHostname });
+    const newKey = bucketKey(bucket);
+    const currentHash = bucketHash(bucket);
+    if (state.buckets[oldKey] !== currentHash) continue;
+    if (!(newKey in state.buckets)) state.buckets[newKey] = currentHash;
+    delete state.buckets[oldKey];
+    changed = true;
+  }
+  return changed;
+}
+
 function formatBytes(bytes) {
   if (bytes < 1024) return `${bytes}B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
 
-export function resolveUploadProjectSetting(settings) {
+export function resolveUploadProjectSetting(settings, localSetting) {
+  if (localSetting === false) return false;
   if (typeof settings?.uploadProject !== 'boolean') {
     const error = new Error('SETTINGS_UNAVAILABLE');
     error.code = 'SETTINGS_UNAVAILABLE';
@@ -90,6 +161,18 @@ export async function runSync({
     saveConfig(config);
   }
 
+  let localUploadProject;
+  let hostIdentity;
+  try {
+    localUploadProject = resolveOptionalBoolean(config.uploadProject, 'uploadProject');
+    hostIdentity = resolveSyncHostname(config);
+    if (hostIdentity.changed) saveConfig(config);
+  } catch (err) {
+    console.error(failure(err.message));
+    if (throws) throw err;
+    process.exit(1);
+  }
+
   // Privacy is a required input, not an optional hint. If the settings API is
   // unavailable, treating it as `false` changes every project-bearing item's
   // incremental identity to `unknown` and can trigger a full-history upload.
@@ -97,36 +180,45 @@ export async function runSync({
   // no-op: no data upload and no state mutation.
   const apiUrl = config.apiUrl || 'https://vibecafe.ai';
   let uploadProject;
-  try {
-    const settings = await fetchSettings(apiUrl, config.apiKey);
-    uploadProject = resolveUploadProjectSetting(settings);
-    // Scope the cached privacy choice to the server that returned it. Reusing
-    // the value after `apiUrl` changes could expose project names to a
-    // different server during its first settings outage.
-    if (
-      config.lastUploadProject !== uploadProject
-      || config.lastUploadProjectApiUrl !== apiUrl
-    ) {
-      config.lastUploadProject = uploadProject;
-      config.lastUploadProjectApiUrl = apiUrl;
-      saveConfig(config);
-    }
-  } catch (err) {
-    if (err.message === 'UNAUTHORIZED') {
-      console.error(failure('API Key 无效，请运行 `npx @vibe-cafe/vibe-usage init` 重新配置。'));
-      if (throws) throw err;
-      process.exit(1);
-    }
-    // Settings endpoint unreachable (not auth): degrade to the last confirmed
-    // choice for this same server rather than hard-aborting every upload.
-    const cachedUploadProject = resolveCachedUploadProjectSetting(config, apiUrl);
-    if (typeof cachedUploadProject === 'boolean') {
-      uploadProject = cachedUploadProject;
-      if (!quiet) console.log(warn('设置接口不可用，沿用上次的项目名设置。'));
-    } else {
-      console.error(failure('暂时无法读取上传设置，本次同步已安全取消（未上传数据）。请稍后重试。'));
-      if (throws) throw err;
-      process.exit(1);
+  if (localUploadProject === false) {
+    // A local deny is authoritative and needs no server round trip. This is
+    // both fail-closed and usable when the settings endpoint is unavailable.
+    uploadProject = false;
+  } else {
+    try {
+      const settings = await fetchSettings(apiUrl, config.apiKey);
+      uploadProject = resolveUploadProjectSetting(settings, localUploadProject);
+      // Scope the cached privacy choice to the server that returned it. Reusing
+      // the value after `apiUrl` changes could expose project names to a
+      // different server during its first settings outage.
+      if (
+        config.lastUploadProject !== uploadProject
+        || config.lastUploadProjectApiUrl !== apiUrl
+      ) {
+        config.lastUploadProject = uploadProject;
+        config.lastUploadProjectApiUrl = apiUrl;
+        saveConfig(config);
+      }
+    } catch (err) {
+      if (err.message === 'UNAUTHORIZED') {
+        console.error(failure('API Key 无效，请运行 `npx @vibe-cafe/vibe-usage init` 重新配置。'));
+        if (throws) throw err;
+        process.exit(1);
+      }
+      // Settings endpoint unreachable (not auth): degrade to the last confirmed
+      // choice for this same server rather than hard-aborting every upload.
+      const cachedUploadProject = resolveCachedUploadProjectSetting(config, apiUrl);
+      if (typeof cachedUploadProject === 'boolean') {
+        uploadProject = resolveUploadProjectSetting(
+          { uploadProject: cachedUploadProject },
+          localUploadProject,
+        );
+        if (!quiet) console.log(warn('设置接口不可用，沿用上次的项目名设置。'));
+      } else {
+        console.error(failure('暂时无法读取上传设置，本次同步已安全取消（未上传数据）。请稍后重试。'));
+        if (throws) throw err;
+        process.exit(1);
+      }
     }
   }
 
@@ -221,23 +313,24 @@ export async function runSync({
     }
   }
 
-  let host = config.hostname;
-  if (!host) {
-    host = osHostname().replace(/\.local$/, '');
-    config.hostname = host;
-    saveConfig(config);
-  }
-  // Cloud-sourced parsers (e.g. cursor) pre-set their own hostname sentinel so
-  // the same account data isn't stored as separate rows per machine.
-  for (const b of allBuckets) if (!b.hostname) b.hostname = host;
-  for (const s of allSessions) if (!s.hostname) s.hostname = host;
+  const host = hostIdentity.hostname;
+  // Cloud-backed parsers use explicit non-identifying sentinels (currently
+  // `cursor-cloud`) so the same account data deduplicates across computers.
+  // Every other hostname is assigned here, at the final network boundary.
+  applyHostnamePrivacy(allBuckets, host, hostIdentity.uploadHostname);
+  applyHostnamePrivacy(allSessions, host, hostIdentity.uploadHostname);
 
   if (!quiet) {
     if (uploadProject) {
-      console.log(dim('  项目名: 上传（可在 Web 设置中关闭）'));
+      console.log(dim('  项目名: 上传（本机或 Web 设置均可关闭）'));
     } else {
       console.log(dim('  项目名: 已隐藏'));
     }
+    console.log(dim(
+      hostIdentity.uploadHostname
+        ? '  设备名: 上传'
+        : `  设备名: 已替换为匿名 ID (${host})`,
+    ));
   }
   if (!uploadProject) {
     for (const b of allBuckets) b.project = 'unknown';
@@ -253,6 +346,13 @@ export async function runSync({
   // Missing/corrupt state.json => empty maps => one-time full upload, then
   // incremental forever after.
   const state = loadState();
+  const migratedHostnameState = !hostIdentity.uploadHostname
+    && migrateHiddenHostnameState(
+      state,
+      allBuckets,
+      hostIdentity.previousHostname,
+      host,
+    );
   const changedBuckets = [];
   const changedSessions = [];
   const liveBucketKeys = new Set();
@@ -290,7 +390,7 @@ export async function runSync({
   const before = Object.keys(state.buckets).length + Object.keys(state.sessions).length;
   pruneState(state, liveBucketKeys, liveSessionKeys, okSources);
   const pruned = before - (Object.keys(state.buckets).length + Object.keys(state.sessions).length);
-  if (pruned > 0) saveState(state);
+  if (pruned > 0 || migratedHostnameState) saveState(state);
 
   if (changedBuckets.length === 0 && changedSessions.length === 0) {
     if (!quiet) console.log(dim('无新增数据。'));

package/src/tools.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, statSync } from 'node:fs';
 import { isAbsolute, join, posix, resolve, win32 } from 'node:path';
 import { homedir } from 'node:os';
 import { findClaudeCodeDataDirs } from './claude-roots.js';
+import { findCindyDataDirs, getCindyDataRoots } from './cindy-roots.js';
 import { codexSessionDirs, resolveCodexHomes } from './codex-roots.js';
 import { findClineDataDirs } from './cline-roots.js';
 import { findCraftDataDirs } from './craft-roots.js';
@@ -223,6 +224,12 @@ export const TOOLS = [
     dataDir: getAlmaDbPath(),
     detectDataDirs: () => [getAlmaDbPath()].filter(existsSync),
   },
+  {
+    name: 'Cindy',
+    id: 'cindy',
+    dataDir: getCindyDataRoots()[0],
+    detectDataDirs: findCindyDataDirs,
+  },
   {
     name: 'Claude Code',
     id: 'claude-code',