@vibe-cafe/vibe-usage 0.12.0 → 0.12.1

package/README.md

@@ -62,7 +62,7 @@ npx @vibe-cafe/vibe-usage help --all   # Full help (plain `help` shows the short
 
 The versioned `quota` JSON contract is designed for local desktop clients. `discover` only checks ordinary app, config-directory, and executable presence signals: it does not open credentials or use the network. `fetch` invokes only products explicitly named with `--product`, and one provider failure does not prevent results for the others.
 
-- **Kimi Code** reads the official Kimi CLI OAuth file (`$KIMI_SHARE_DIR/credentials/kimi-code.json`, otherwise `~/.kimi/credentials/kimi-code.json`) and calls `https://api.kimi.com/coding/v1/usages`. When the short-lived access token is close to expiry, it uses Kimi's standard OAuth refresh flow and atomically rotates the official credential with owner-only permissions. Refreshes are serialized across Vibe Usage processes and re-check the file before writing so a concurrent Kimi CLI refresh wins safely.
+- **Kimi Code** reads the official Kimi CLI OAuth file — `$KIMI_SHARE_DIR/credentials/kimi-code.json` when configured, otherwise the current CLI home (`$KIMI_CODE_HOME`, else `~/.kimi-code`) and then the legacy `~/.kimi` home, whichever holds a login — and calls `https://api.kimi.com/coding/v1/usages`. When the short-lived access token is close to expiry, it uses Kimi's standard OAuth refresh flow and atomically rotates the official credential with owner-only permissions. Refreshes are serialized across Vibe Usage processes and re-check the file before writing so a concurrent Kimi CLI refresh wins safely.
 - **ZCode / GLM Coding Plan** accepts only a caller-supplied regional key: `BIGMODEL_API_KEY` calls the domestic `https://open.bigmodel.cn/api/monitor/usage/quota/limit`, while the existing `Z_AI_API_KEY` keeps using `https://api.z.ai/api/monitor/usage/quota/limit`. If both are present, the explicitly named BigModel key wins. It does not read ZCode's private OAuth state.
 - **Grok** reads at most the final 2 MiB of the official CLI's ordinary `$GROK_HOME/logs/unified.jsonl` (default `~/.grok/logs/unified.jsonl`). It accepts only the structured `billing: fetched credits config` event and projects the current utilization, period bounds, subscription tier, and event timestamp. It performs no network request, reads no credentials, and never returns or retains other log fields.
 - **Cursor** is detected independently but remains non-fetchable until an official or stable quota protocol is available. Quota monitoring does not read Cursor's login token/database, browser cookies, another app's Keychain, network traffic, or UI.
@@ -85,7 +85,7 @@ Quota results are never uploaded or added to incremental sync state. Credential-
 | Cursor | `state.vscdb` (SQLite, reads `cursorAuth/accessToken`, fetches CSV from `cursor.com`); cloud data is stamped with a fixed `cursor-cloud` hostname so multi-machine setups don't double-count |
 | DimAgent | `$DIMCODE_HOME/dimcode.sqlite` (default `~/.dimcode/v2/dimcode.sqlite`); exact usage from `usage_ledger`, with forked ledger/history copies deduplicated |
 | Gemini CLI | `~/.gemini/tmp/<project_hash>/chats/session-*.jsonl` (current line-delimited format) and legacy `session-*.json`; recurses into nested subagent sessions |
-| OpenCode | `~/.local/share/opencode/opencode.db` (SQLite), with `storage/message/` as the legacy alternative; supports explicitly added data roots |
+| OpenCode | `~/.local/share/opencode/opencode.db` (SQLite) — both the legacy `message` table and the 2.x `session_message` projection are read, merged by message id — with `storage/message/` as the legacy alternative; cache writes are counted as 5m cache creation; supports explicitly added data roots |
 | OpenClaw | `~/.openclaw/agents/`, `~/.openclaw-<profile>/agents/` (profile deployments); cache-creation/cache-write tokens are included in input usage |
 | Oh My Pi | `~/.omp/agent/sessions/`, `~/.omp/profiles/*/agent/sessions/`, and `$XDG_DATA_HOME/omp/{sessions,profiles/*/sessions}`; recognizes OMP's `$PI_CODING_AGENT_DIR`, current v3 title slots and path/hashed session directories, deduplicates copied records, includes cache writes in input, and splits reasoning from OMP's inclusive output count |
 | pi | `~/.pi/agent/sessions/` or `$PI_CODING_AGENT_DIR/sessions/`, plus the session directory Pi itself was pointed at via `PI_CODING_AGENT_SESSION_DIR` or `sessionDir` in `~/.pi/agent/settings.json`, plus explicitly added `pi-coding-agent` roots for stores only reachable through `pi --session <file>` (fixture/relocation override: `VIBE_USAGE_PI_SESSION_DIRS`). Cache writes are included in input usage; reasoning is read from Pi's `usage.reasoning` (legacy `usage.reasoningTokens` still accepted) and split out of the inclusive output total |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-cafe/vibe-usage",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "Track your AI coding tool token usage and sync to vibecafe.ai",
   "type": "module",
   "scripts": {

package/src/daemon-service.js

@@ -114,19 +114,40 @@ function escapeXml(value) {
 
 // Variables that relocate a tool's on-disk store. The service runs from a
 // launchd/systemd unit that inherits nothing, so anything the parsers read for
-// discovery has to be captured into the unit at install time.
+// discovery has to be captured into the unit at install time. Keep this list in
+// sync with the store-locating variables the parsers and roots modules read
+// (`grep -rho 'process\.env\.[A-Z_]*' src/parsers src/*-roots.js`): a variable
+// missing here makes the background service sync a different store than the
+// foreground CLI (issue #112). Test-only overrides (`VIBE_USAGE_*`) and
+// accounting knobs are deliberately absent -- they do not relocate a store.
 const PRESERVED_SERVICE_ENV = [
+  'AMP_DATA_DIR',
   'CLINE_DIR',
   'CLINE_DATA_DIR',
   'CLINE_SESSION_DATA_DIR',
+  'CODEBUDDY_CONFIG_DIR',
+  'CODEX_HOME',
   'COLA_DATA_DIR',
+  'CRAFT_AGENT_DIR',
+  'CRAFTAGENT_DIR',
+  'CURSOR_CONFIG_DIR',
+  'DIMCODE_HOME',
+  'DSH_HOME',
+  'GROK_HOME',
   'HERMES_HOME',
+  'KIMI_CODE_HOME',
+  'KIRO_BASE_PATH',
+  'KIRO_CLI_DB_PATH',
+  'KIRO_CLI_SESSIONS_DIR',
+  'KIRO_SESSIONS_DIR',
+  'KIRO_USER_PATH',
   'MCODE_HOME',
   'MIMOCODE_HOME',
   'MIMOCODE_DB',
-  'XDG_DATA_HOME',
+  'PI_CONFIG_DIR',
   'PI_CODING_AGENT_DIR',
   'PI_CODING_AGENT_SESSION_DIR',
+  'XDG_DATA_HOME',
 ];
 
 function serviceEnvironment(claudeConfigDir, env) {

package/src/parsers/opencode.js

@@ -4,18 +4,57 @@ import { aggregateToBuckets, extractSessions } from './aggregate.js';
 import { queryDbJson, sqliteUnavailableError, isSqliteUnavailableError } from './sqlite.js';
 import { getOpenCodeStores } from '../opencode-roots.js';
 
-function readSqlite(path) {
-  // Select only accounting/timing metadata, never message text or tool inputs.
-  // Keep the existing top-level model/project precedence for old uploads.
-  const query = `SELECT id, session_id AS sessionID,
+// Select only accounting/timing metadata, never message text or tool inputs.
+// Keep the existing top-level model/project precedence for old uploads.
+const V1_QUERY = `SELECT id, session_id AS sessionID,
     json_extract(data, '$.role') AS role,
     json_extract(data, '$.time.created') AS created,
     coalesce(json_extract(data, '$.modelID'), json_extract(data, '$.model.modelID')) AS modelID,
     json_extract(data, '$.tokens') AS tokens,
     json_extract(data, '$.path.root') AS rootPath
     FROM message ORDER BY id`;
-  try { return queryDbJson(path, query); }
-  catch (err) {
+
+// OpenCode 2.x stores the same accounting in the event-sourced projection
+// `session_message`: the row's `type` is the role, `data.model.id` the model,
+// `data.tokens` the counters. Message data carries no `path`, so the project
+// comes from the session row's `directory`; the session table is `session_v2`
+// in 2.x and `session` before that (both names in the wild, issue #114). Only
+// column/JSON expressions are selected -- never message text, tool payloads,
+// or costs.
+function v2Query(sessionTable) {
+  return `SELECT m.id AS id, m.session_id AS sessionID,
+    m.type AS role,
+    coalesce(json_extract(m.data, '$.time.created'), m.time_created) AS created,
+    coalesce(json_extract(m.data, '$.model.id'), json_extract(m.data, '$.modelID')) AS modelID,
+    json_extract(m.data, '$.tokens') AS tokens,
+    s.directory AS directory
+    FROM session_message m
+    ${sessionTable ? `LEFT JOIN ${sessionTable} s ON s.id = m.session_id` : ''}
+    WHERE m.type IN ('user', 'assistant')
+    ORDER BY m.id`;
+}
+
+function readSqlite(path) {
+  try {
+    const tables = new Set(queryDbJson(path,
+      `SELECT name FROM sqlite_master WHERE type = 'table'
+       AND name IN ('message', 'session_message', 'session', 'session_v2')`)
+      .map(row => row.name));
+    if (!tables.has('message') && !tables.has('session_message')) {
+      throw new Error(`不认识的表结构（没有 message / session_message 表）: ${path}`);
+    }
+    // Read both shapes when a migrated store keeps both: copies are merged by
+    // (session, message id), and the legacy row is seen first so an equal copy
+    // never renames a project that earlier uploads already used.
+    const rows = [];
+    if (tables.has('message')) rows.push(...queryDbJson(path, V1_QUERY));
+    if (tables.has('session_message')) {
+      const sessionTable = tables.has('session_v2') ? 'session_v2'
+        : (tables.has('session') ? 'session' : null);
+      rows.push(...queryDbJson(path, v2Query(sessionTable)));
+    }
+    return rows;
+  } catch (err) {
     if (isSqliteUnavailableError(err)) throw sqliteUnavailableError('OpenCode');
     throw err;
   }
@@ -71,14 +110,24 @@ export async function parse({ extraRoots = [] } = {}) {
   for (const row of records.values()) {
     // Keep the existing project derivation and token semantics. Additional roots
     // must not rename previously uploaded projects/models or alter their counts.
-    const project = row.rootPath ? basename(row.rootPath) : 'unknown';
+    // V2 message rows carry no `path`, so they fall back to the session
+    // directory; they come from a store the parser could not read before, so
+    // nothing previously uploaded is relabelled by that fallback.
+    const project = row.rootPath ? basename(row.rootPath)
+      : (row.directory ? basename(row.directory) : 'unknown');
     const base = { source: 'opencode', project, timestamp: row.timestamp };
     events.push({ ...base, sessionId: row.sessionId, role: row.role === 'user' ? 'user' : 'assistant' });
     const tokens = row.tokens;
     if (!row.modelID || !tokens || (!tokens.input && !tokens.output)) continue;
     entries.push({ ...base, model: row.modelID,
       inputTokens: tokens.input || 0, outputTokens: tokens.output || 0,
-      cachedInputTokens: tokens.cache?.read || 0, reasoningOutputTokens: tokens.reasoning || 0 });
+      cachedInputTokens: tokens.cache?.read || 0, reasoningOutputTokens: tokens.reasoning || 0,
+      // The store writes one cache-write total with no per-TTL breakdown and no
+      // separate `tokens.total` column to reconcile against, so it goes to the
+      // cheaper 5m cache-creation bucket -- the same rule as CodeArts Agent,
+      // which reads this exact layout. Dropping it (the behaviour until
+      // 2026-09-26) under-billed every Claude/Anthropic run through OpenCode.
+      cacheCreation5mTokens: tokens.cache?.write || 0 });
   }
   return { buckets: aggregateToBuckets(entries), sessions: extractSessions(events) };
 }

package/src/quotas/providers/kimi-code.js

@@ -2,6 +2,7 @@ import {
   accessSync,
   closeSync,
   constants as fsConstants,
+  existsSync,
   fsyncSync,
   mkdirSync,
   openSync,
@@ -134,9 +135,35 @@ export function parseKimiUsage(payload, now = new Date()) {
   });
 }
 
+// Kimi Code has two credential locations in the wild. kimi-cli (1.x) keeps
+// `$KIMI_SHARE_DIR/credentials/kimi-code.json`, defaulting to `~/.kimi`, while
+// the current CLI (2.x) writes `$KIMI_CODE_HOME/credentials/kimi-code.json`,
+// defaulting to `~/.kimi-code` -- the same home the session parser already
+// resolves. Reading only the legacy path reported `missing_credentials` for
+// every 2.x user whose login sits in the new home (issue #112), while their
+// usage parsed fine, so the quota card contradicted the token tables.
+export function kimiCredentialPaths(environment = process.env, home = homedir()) {
+  const directories = [
+    environment.KIMI_SHARE_DIR?.trim(),
+    environment.KIMI_CODE_HOME?.trim(),
+    join(home, '.kimi-code'),
+    join(home, '.kimi'),
+  ];
+  return directories.filter(Boolean).map(directory => join(directory, 'credentials', 'kimi-code.json'));
+}
+
+/**
+ * The credential file to read and, on refresh, to rotate atomically.
+ *
+ * A login that exists wins over one that does not, in the order above: an
+ * explicitly configured home outranks the CLI default, and the current CLI
+ * home outranks the legacy one. With no login anywhere the current CLI's path
+ * is returned so `missing_credentials` (and any rotation that follows a later
+ * login) names the file the installed CLI actually writes.
+ */
 export function kimiCredentialPath(environment = process.env, home = homedir()) {
-  const shareDirectory = environment.KIMI_SHARE_DIR?.trim() || join(home, '.kimi');
-  return join(shareDirectory, 'credentials', 'kimi-code.json');
+  const paths = kimiCredentialPaths(environment, home);
+  return paths.find(path => existsSync(path)) || paths[0];
 }
 
 function readCredentials(path) {