@vibe-cafe/vibe-usage 0.11.0 → 0.11.1

package/README.md

@@ -249,6 +249,10 @@ For OpenCode, each root uses its SQLite database when present; only roots withou
 
 The first `npx @vibe-cafe/vibe-usage` run installs a user-level service (systemd on Linux, launchd on macOS, Task Scheduler on Windows — no admin rights needed) that syncs every 30 minutes and starts automatically on login. Nothing else to do.
 
+Switching the CLI to a different account (running `init` again, or `config set apiKey`) rebinds the upload state, so the next sync re-uploads your full local history to the new account instead of treating it as already sent.
+
+换绑账号后（重新 `init` 或 `config set apiKey`），下一次同步会自动全量重传本地历史，不会因为旧账号的同步记录而漏传。
+
 <details>
 <summary>Managing the service, and how it is launched</summary>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-cafe/vibe-usage",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "Track your AI coding tool token usage and sync to vibecafe.ai",
   "type": "module",
   "scripts": {

package/src/state.js

@@ -8,6 +8,8 @@ import { createHash, randomBytes } from 'node:crypto';
 // already uploaded successfully. Lets each sync skip re-sending unchanged
 // history: parsers stay stateless (still parse everything from disk every run),
 // but only new/changed items hit the network.
+// The file also records the upload target it belongs to (`identity`), so state
+// left by a previous account can never suppress that account's history.
 // VIBE_USAGE_STATE_DIR overrides the dir (test hook).
 const STATE_DIR = process.env.VIBE_USAGE_STATE_DIR?.trim() || join(homedir(), '.vibe-usage');
 const isDev = process.env.VIBE_USAGE_DEV === '1';
@@ -17,14 +19,57 @@ export function getStatePath() {
   return STATE_FILE;
 }
 
-export function loadState() {
+// The upload target this state belongs to: which server, and which account on
+// it. state.json only records what was already uploaded *to that target*, so
+// after a re-bind (`init` again, `config set apiKey`, or a desktop app
+// rewriting config.json) the old hashes must not make sync skip history the new
+// account has never received.
+//
+// The key is stored only as a fingerprint. The raw apiKey must never appear in
+// state.json — it is an ordinary-permission file next to the parser state, not
+// a credential store; config.json (mode 0600) remains the only place it lives.
+export function stateIdentity({ apiUrl, apiKey } = {}) {
+  return {
+    apiUrl: apiUrl || '',
+    keyFingerprint: apiKey
+      ? createHash('sha256').update(String(apiKey)).digest('hex').slice(0, 16)
+      : '',
+  };
+}
+
+function isIdentity(value) {
+  return !!value
+    && typeof value === 'object'
+    && typeof value.apiUrl === 'string'
+    && typeof value.keyFingerprint === 'string';
+}
+
+function sameIdentity(a, b) {
+  return a.apiUrl === b.apiUrl && a.keyFingerprint === b.keyFingerprint;
+}
+
+// `identity` is optional: callers that only read the recorded counts (e.g.
+// `status`) pass nothing and keep the pre-0.11.1 behaviour of taking the file
+// at face value.
+export function loadState(identity) {
   if (!existsSync(STATE_FILE)) return { buckets: {}, sessions: {} };
   try {
     const parsed = JSON.parse(readFileSync(STATE_FILE, 'utf-8'));
-    return {
-      buckets: parsed.buckets ?? {},
-      sessions: parsed.sessions ?? {},
-    };
+    const buckets = parsed.buckets ?? {};
+    const sessions = parsed.sessions ?? {};
+    if (!isIdentity(identity) || !isIdentity(parsed.identity)) {
+      // No identity recorded — written by a CLI older than 0.11.1. Adopt the
+      // entries as-is rather than forcing a re-upload: on upgrade day that
+      // would make every installed client re-send its whole history at once.
+      // The next saveState() stamps the current identity, so any later re-bind
+      // is caught.
+      return { buckets, sessions };
+    }
+    if (sameIdentity(parsed.identity, identity)) return { buckets, sessions };
+    // Bound to a different account or server: nothing recorded here was ever
+    // uploaded to the current target, so start empty and re-send local history.
+    // `identityChanged` is a runtime signal for the caller, never persisted.
+    return { buckets: {}, sessions: {}, identityChanged: true };
   } catch {
     // Corrupt/unreadable state must not lose data — treat as empty, which
     // triggers a one-time full re-upload (same as a fresh install).
@@ -32,14 +77,28 @@ export function loadState() {
   }
 }
 
-export function saveState(state) {
+export function saveState(state, identity) {
   mkdirSync(STATE_DIR, { recursive: true });
+  // Only the durable fields are written: `identityChanged` is loadState()'s
+  // one-run signal, not state. A CLI older than 0.11.1 reads just
+  // buckets/sessions, so the extra top-level `identity` key is ignored there —
+  // a file written by this version stays readable by older clients.
+  const payload = {
+    buckets: state.buckets ?? {},
+    sessions: state.sessions ?? {},
+  };
+  if (isIdentity(identity)) {
+    payload.identity = {
+      apiUrl: identity.apiUrl,
+      keyFingerprint: identity.keyFingerprint,
+    };
+  }
   // Atomic replace: write to a unique temp file then rename over the target.
   // A crash mid-write can no longer truncate state.json into an unreadable
   // file that loadState() would treat as empty (triggering a full re-upload).
   const tempPath = `${STATE_FILE}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`;
   try {
-    writeFileSync(tempPath, JSON.stringify(state) + '\n', 'utf-8');
+    writeFileSync(tempPath, JSON.stringify(payload) + '\n', 'utf-8');
     renameSync(tempPath, STATE_FILE);
   } finally {
     // No-op after a successful rename (the temp file is already gone); cleans

package/src/sync.js

@@ -1,7 +1,7 @@
 import { hostname as osHostname } from 'node:os';
 import { loadConfig, saveConfig } from './config.js';
 import {
-  loadState, saveState, pruneState,
+  loadState, saveState, pruneState, stateIdentity,
   bucketKey, bucketHash, sessionKey, sessionHash,
 } from './state.js';
 import { ingest, fetchSettings } from './api.js';
@@ -119,6 +119,13 @@ export async function runSync({
   // Resolve it before parsing or loading upload state so failure is a true
   // no-op: no data upload and no state mutation.
   const apiUrl = config.apiUrl || 'https://vibecafe.ai';
+  // state.json records what was already uploaded to *this* account on *this*
+  // server. Passing the identity into loadState() makes state left by a
+  // previous account fall away, so a re-bind re-uploads the local history
+  // instead of diffing it against uploads the new account never received.
+  // Built from the same `apiUrl` the ingest calls below use, so the recorded
+  // target and the actual target can never drift apart.
+  const identity = stateIdentity({ apiUrl, apiKey: config.apiKey });
   let uploadProject;
   try {
     const settings = await fetchSettings(apiUrl, config.apiKey);
@@ -223,11 +230,14 @@ export async function runSync({
     // Successful parsers emitted no live items. Prune their old keys even on
     // this fast path; otherwise deleting the final local log would leave dead
     // state entries forever. Failed-parser sources remain protected.
-    const state = loadState();
+    const state = loadState(identity);
+    if (state.identityChanged && !quiet) {
+      console.log(dim('检测到上传账号已更换，本次全量重传本地历史'));
+    }
     const before = Object.keys(state.buckets).length + Object.keys(state.sessions).length;
     pruneState(state, new Set(), new Set(), okSources);
     const pruned = before - (Object.keys(state.buckets).length + Object.keys(state.sessions).length);
-    if (pruned > 0) saveState(state);
+    if (pruned > 0) saveState(state, identity);
     if (!quiet && parserProgress.length > 0) {
       for (const p of parserProgress) {
         console.log(dim(`  ${p.source}: 正在建立本地索引 ${p.completed}/${p.total}（下次同步继续）`));
@@ -283,7 +293,10 @@ export async function runSync({
   // an active one sends just the current 30-min bucket.
   // Missing/corrupt state.json => empty maps => one-time full upload, then
   // incremental forever after.
-  const state = loadState();
+  const state = loadState(identity);
+  if (state.identityChanged && !quiet) {
+    console.log(dim('检测到上传账号已更换，本次全量重传本地历史'));
+  }
   const changedBuckets = [];
   const changedSessions = [];
   const liveBucketKeys = new Set();
@@ -321,7 +334,7 @@ export async function runSync({
   const before = Object.keys(state.buckets).length + Object.keys(state.sessions).length;
   pruneState(state, liveBucketKeys, liveSessionKeys, okSources);
   const pruned = before - (Object.keys(state.buckets).length + Object.keys(state.sessions).length);
-  if (pruned > 0) saveState(state);
+  if (pruned > 0) saveState(state, identity);
 
   if (changedBuckets.length === 0 && changedSessions.length === 0) {
     if (!quiet) console.log(dim('无新增数据。'));
@@ -422,7 +435,7 @@ export async function runSync({
           batchStateChanged = true;
         }
       }
-      if (batchStateChanged) saveState(state);
+      if (batchStateChanged) saveState(state, identity);
     }
 
     if (totalBatches > 1 || allBucketsToSend.length > 0) {