agent-devkit 0.3.2 → 0.3.4

package/runtime/vendor/plugins/ruflo/ruflo-cost-tracker/commands/ruflo-cost.md

@@ -1,162 +0,0 @@
----
-name: ruflo-cost
-description: Cost tracking operations — generate reports, view breakdowns, set budgets, and get optimization recommendations
----
-
-Cost tracking commands:
-
-**`cost report [--period today|week|month]`** -- Generate a cost report for the specified period.
-1. Recall token usage records from `cost-tracking` namespace for the period
-2. Compute costs by model using current pricing (haiku/sonnet/opus input/output rates)
-3. Aggregate by agent, task, and model
-4. Show budget utilization percentage if a budget is configured
-5. Display: total cost, breakdown by model, breakdown by agent, budget status
-
-**`cost breakdown [--by agent|model|task]`** -- Detailed cost breakdown by dimension.
-1. Recall all usage records from `cost-tracking` namespace
-2. Group by the specified dimension (agent, model, or task)
-3. For each group: total tokens (input/output/cache), total cost, percentage of total
-4. Sort by cost descending
-5. Display: dimension value, input tokens, output tokens, cache tokens, total cost, share %
-
-**`cost budget set <amount>`** -- Set a budget limit in USD (real implementation, persisted to `cost-tracking:budget-config`).
-1. Run `node plugins/ruflo-cost-tracker/scripts/budget.mjs set <amount>` to write the config to the cost-tracking namespace
-2. Thresholds default to: info 50% · warning 75% · critical 90% · hard_stop 100%
-3. Report: confirmed amount + namespace key
-
-**`cost budget get`** -- Show the current budget config.
-1. Run `node plugins/ruflo-cost-tracker/scripts/budget.mjs get`
-2. Report: amount, when set, threshold ladder
-
-**`cost budget check [--period today|week|month|all]`** -- Compute utilization + alert level (50/75/90/100% ladder).
-1. Run `node plugins/ruflo-cost-tracker/scripts/budget.mjs check`
-2. Filter by `BUDGET_PERIOD=today|week|month|all` (default `all`)
-3. Sum `total_cost_usd` across all `session-*` records in cost-tracking
-4. Compute utilization vs. budget; emit 🟢 OK / 🟡 INFO / 🟠 WARNING / 🔴 CRITICAL / 🛑 HARD_STOP
-5. Exit code 1 on HARD_STOP — wrap agent spawns in `budget check && spawn ...` to fail closed
-
-**`cost optimize`** -- Analyze usage and suggest cost optimizations.
-1. Recall recent usage data from `cost-tracking` namespace
-2. For each agent, analyze: average task complexity, model used, token efficiency
-3. Identify agents using expensive models for low-complexity tasks
-4. Check cache hit rates and suggest caching improvements
-5. Look for redundant agent spawns or duplicate work
-6. Calculate estimated savings for each recommendation
-7. Display: recommendation, current cost, projected cost, savings, impact assessment
-
-**`cost track`** -- Auto-capture token usage for the active Claude Code session and persist to the `cost-tracking` namespace. Run after significant work or at session end so `cost report` has real data.
-1. Invoke `node plugins/ruflo-cost-tracker/scripts/track.mjs` (no flags = current cwd's most-recent session)
-2. Print: total cost, per-model and per-tier breakdown, persisted memory key
-3. Sets the `cost-tracking` namespace record at key `session-<sessionId>` (consumed by `cost-report` step 1)
-
-**`cost outcome <task> <model> <outcome>`** -- Emit a `hooks_model-outcome` event so the router learns from applied recommendations. Auto-wired into `cost-optimize` step 8.
-1. Validates `outcome ∈ {success, escalated, failure}`
-2. Runs `node plugins/ruflo-cost-tracker/scripts/outcome.mjs "<task>" <model> <outcome>`
-3. The script wraps `npx @claude-flow/cli hooks model-outcome -t ... -m ... -o ...` with explicit-argv spawnSync so quoting is safe
-4. Without this, the router doesn't learn from cost-optimize recommendations and the Tier 1 bypass rate doesn't tighten over time
-
-**`cost summary [--format json|markdown]`** -- Single-shot programmatic dump of all cost data. Other plugins/scripts can shell out and parse the JSON.
-1. Run `node plugins/ruflo-cost-tracker/scripts/summary.mjs --format json`
-2. Output: total_cost_usd, sessionCount, byTier, byModel, topSession, budget, federation aggregate
-3. Default `--format markdown`; JSON contract is stable for programmatic consumers
-4. ADR-0002 considered an MCP-tool form but deferred (requires v3 source change); this is the plugin-local equivalent
-
-**`cost federation`** -- Consumer-side wiring for ADR-097 Phase 3 federation_spend events. Aggregates per-peer 1h/24h/7d rolling windows and flags peers exceeding the suspension threshold (default $5/24h).
-1. Run `node plugins/ruflo-cost-tracker/scripts/federation.mjs`
-2. Optional: `FED_FORMAT=json`, `FED_NAMESPACE=federation-spend`, `FED_SUSPEND_THRESHOLD_USD=5.0`
-3. Reports gracefully when no events present (Phase 3 not yet landed upstream)
-4. Activates automatically when upstream publishes `{peerId, taskId, tokensUsed, usdSpent, ts}` to the `federation-spend` namespace
-
-**`cost export [--prometheus <path>] [--webhook <url>]`** -- Export cost-tracking telemetry to external observability systems.
-1. `--prometheus <path>` writes the node_exporter textfile-collector format (gauges + counters with session labels)
-2. `--webhook <url>` POSTs JSON; auth via `EXPORT_WEBHOOK_HEADER='K: V'`
-3. No flag → stdout JSON
-4. Metrics emitted: `cost_tracker_total_usd`, `cost_tracker_tier_total_usd{tier=...}`, `cost_tracker_session_total_usd{session=...}`, `cost_tracker_session_messages{session=...}`, `cost_tracker_budget_usd`, `cost_tracker_budget_utilization`
-
-**`cost conversation`** -- Per-conversation cost view: list every session in `cost-tracking` with started-at, message count, top model, total cost. Different lens from `cost report` (which is per-agent/per-model).
-1. Run `node plugins/ruflo-cost-tracker/scripts/conversation.mjs`
-2. Optional `CONV_FORMAT=json`, `CONV_LIMIT=N`, `CONV_NAMESPACE=...`
-3. Reports: total across conversations, per-tier rollup, per-session table
-
-**`cost trend`** -- Read all docs/benchmarks/runs/*.json and surface drift in the gate metrics — win rate, avg latency, p99, escalation rate, speedup vs LLM. Flags regressions the binary smoke gate misses.
-1. Run `node plugins/ruflo-cost-tracker/scripts/trend.mjs`
-2. Optional `TREND_FORMAT=json` for machine-readable output, `TREND_LIMIT=N` to truncate
-3. Reports: first→last deltas + per-run series + regression flags (win rate drop or ≥1.5× latency rise)
-
-**`cost projection [--window 7d] [--horizons 7d,30d,90d,365d] [--format table|json]`** -- Forward-looking spend extrapolation. Predictive counterpart to `cost budget check` (reactive).
-1. Run `node plugins/ruflo-cost-tracker/scripts/projection.mjs`
-2. Compute USD-per-day from sessions in the measurement window (default last 7d)
-3. Linear-extrapolate to 7d/30d/90d/365d horizons (configurable via `--horizons`)
-4. If `cost budget set` has run: surface "days until 75%/90%/100% consumed" tables
-5. JSON output for dashboards / CI gates (e.g. `jq '.budget.exhaustion[2].daysUntilReached < 7'` to fail builds when 100% exhaustion is < 1 week away)
-6. Env: `PROJECTION_NAMESPACE`, `PROJECTION_QUIET=1`
-
-**`cost counterfactual [--since 7d] [--baseline always-haiku|always-sonnet|always-opus|all] [--format table|json]`** -- Multi-baseline counterfactual cost analysis. Comparative counterpart to budget-check (reactive) and projection (predictive): answers "is the routing earning its keep?".
-1. Run `node plugins/ruflo-cost-tracker/scripts/counterfactual.mjs`
-2. Sum tokens across all sessions in window (default all-time)
-3. For each baseline tier, compute hypothetical cost if every token had run at that tier's pricing
-4. Surface savings $ + % across all three baselines (default `--baseline all`)
-5. Negative `always-haiku` savings = over-escalation signal (router picked sonnet/opus when haiku could have done it). Positive `always-sonnet` quantifies the router's win against the "safe default" baseline.
-6. JSON output for CI gates: `jq '.baselines[1].savingsPct > 30'` to flag workload shifts where routing isn't saving ≥30% vs sonnet
-
-**`cost burn [--bucket 1d] [--lookback 14d] [--alert-on-acceleration-pct N] [--format table|json]`** -- Burn-rate trend over time with optional drift-alert exit code. Trend counterpart to reactive/predictive/comparative: answers "is daily burn accelerating?".
-1. Run `node plugins/ruflo-cost-tracker/scripts/burn.mjs`
-2. Bin sessions into `--bucket` duration windows (default 1d) over `--lookback` (default 14d)
-3. Compute delta: latest bucket vs mean of prior non-empty buckets
-4. With `--alert-on-acceleration-pct N`: exit 1 when latest exceeds prior mean by N%+. Independent of budget — catches "hot loop burning 10× normal" before budget alarm fires
-5. Distinct from `cost trend` (which surfaces BENCHMARK drift across `docs/benchmarks/runs/*.json`); this tracks PRODUCTION spend.
-6. Edge cases: no prior data → alert SKIPPED (no spurious cold-start alerts). `--bucket` > `--lookback` → exit 2 (config error).
-
-**`cost anomaly [--since 7d] [--threshold 3.5] [--alert-on-outliers N] [--format table|json]`** -- MAD-based outlier detection on session spend. Point-anomaly counterpart to cost-burn's aggregate-trend signal: answers "which specific session is the outlier?".
-1. Run `node plugins/ruflo-cost-tracker/scripts/anomaly.mjs`
-2. Compute `median(total_cost_usd)` and `MAD = median(|x - median|)` over the filtered window
-3. Per-session modified z-score `z = 0.6745 × (x - median) / MAD` (Iglewicz-Hoaglin 1993)
-4. Flag sessions with `|z| > --threshold` (default 3.5)
-5. With `--alert-on-outliers N`: exit 1 when ≥N outliers found
-6. MAD beats mean+sigma because outliers themselves can't inflate it — robust on n=10. Sessions table labels `high` (over-spending) vs `low` (crash/drop) direction.
-7. Edge cases: n<3 → "insufficient data" exit 0. MAD=0 (half the sessions share exact spend) → explainer exit 0.
-
-**`cost session [--session-id <id>] [--top 20] [--since <iso-ts>] [--format table|json]`** -- Per-message cost breakdown within ONE session. Drill-down companion to cost-anomaly.
-1. Run `node plugins/ruflo-cost-tracker/scripts/session.mjs`
-2. Resolves session jsonl via `--session-id` (scans `~/.claude/projects/*/`) or `--latest` (default)
-3. Lists top-N most expensive messages with full token breakdown (input / output / cache_write / cache_read)
-4. Surfaces p50/p90/p99 message-cost percentiles so operators can judge "is this top message a 2× or 380× outlier?"
-5. Flags the top message as in-session outlier when cost > 2× the p99
-6. The Cache W column is critical: a 569-token output message at $16 looks insane until you see "881898 cache writes" beside it.
-
-**`cost diff --baseline <path> --current <path> [--alert-on-pct N] [--alert-on-usd N] [--alert-on-class-pct <class>:N[,<class>:N]] [--format table|json]`** -- Snapshot delta between two cost-summary JSON outputs. PR-level regression detection.
-1. Run `node plugins/ruflo-cost-tracker/scripts/diff.mjs --baseline <path> --current <path>`
-2. Both files must be cost-summary JSON shape (validated: total_cost_usd + sessionCount required)
-3. Computes total delta + per-tier + per-model breakdowns; entries tagged added / removed / changed
-4. Tables sorted by `|delta|` descending so biggest movers bubble to the top
-5. `--alert-on-pct N` exits 1 when total grew >N%; `--alert-on-usd N` exits 1 when total grew >$N; both can be set, first to trigger wins
-6. Composes with `cost summary --format json` — the stable JSON contract is the protocol between snapshot capture and snapshot diffing
-
-**`cost health [--alert-acceleration 100] [--alert-outliers 1] [--alert-days-to-exhaust 14] [--skip burn,anomaly] [--format table|json]`** -- Composite CI gate. Runs all four alert ladders (budget / burn / anomaly / projection) in parallel and returns `max(exit_codes)`. One shell-out replaces four separate CI steps.
-1. Run `node plugins/ruflo-cost-tracker/scripts/health.mjs`
-2. Spawn budget-check, burn, anomaly, projection subchecks via `Promise.all`
-3. Each subcheck runs `--format json`; parse exit codes
-4. Projection synthesizes exit code from `daysUntilReached[100%] < --alert-days-to-exhaust`
-5. Final exit = `max(subcheck exits)` — any failure fails the gate
-6. Print one-line summary per check + overall HEALTHY/UNHEALTHY badge
-7. `--skip <list>` to disable specific subchecks (e.g. `--skip burn` for fast-feedback smoke runs).
-
-**`cost benchmark [--llm] [--anthropic]`** -- Run the corpus benchmark to verify booster claims with measured numbers.
-1. Without flags: booster-only (free, ~85 ms wall-time, no API keys needed)
-2. `--llm`: also run Gemini 2.0 Flash baseline (uses GCP `GOOGLE_AI_API_KEY` secret)
-3. `--anthropic`: also run Claude Sonnet 4.6 + Opus 4.7 (uses GCP `ANTHROPIC_API_KEY` secret)
-4. Writes results to `docs/benchmarks/runs/latest.json` and timestamped sibling
-5. Print: win rate (Tier 1 cases), escalation rate (adversarial cases), per-endpoint avg latency, cost/edit, measured speedup
-6. Smoke step 23 fails the build if `winRate < 0.80`. See `cost-benchmark` skill for env-var overrides.
-
-**`cost workers`** -- Inspect the `optimize` and `benchmark` background workers consumed from ruflo-loop-workers.
-1. Call `mcp__claude-flow__hooks_worker-status --worker optimize` -- report last-run timestamp, outcome, and any pending recommendations
-2. Call `mcp__claude-flow__hooks_worker-status --worker benchmark` -- report last-run timestamp, outcome, and any pending benchmark deltas
-3. Cross-link [ruflo-loop-workers ADR-0001 §"12-worker trigger map"](../../ruflo-loop-workers/docs/adrs/0001-loop-workers-contract.md) — the contract this command honors
-4. Display: worker name, status, last-run timestamp, outcome, last-summary
-
-**`cost history`** -- Show cost tracking history over time.
-1. Recall all cost reports from `cost-tracking` namespace
-2. Show daily/weekly totals with trend direction
-3. Highlight days with unusual spending (>2x average)
-4. Display: date, total cost, top agent, top model, budget status

package/runtime/vendor/plugins/ruflo/ruflo-cost-tracker/hooks/hooks.json

@@ -1,17 +0,0 @@
-{
-  "_note": "Stop hook auto-runs cost-track at session end so the cost-tracking namespace stays populated without users remembering to run `/cost-track` manually. TRACK_QUIET=1 suppresses the markdown summary (avoid spamming on every Stop). `|| true` ensures a track failure NEVER blocks session end — analytics data is best-effort, not load-bearing.",
-  "_platform": "posix",
-  "_platform_note": "POSIX hooks (bash + node). Windows users continue to invoke `cost-track` manually via the slash command (the Stop hook silently no-ops on a non-bash shell).",
-  "hooks": {
-    "Stop": [
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "/bin/bash -c 'TRACK_QUIET=1 node \"${CLAUDE_PLUGIN_ROOT}/scripts/track.mjs\" >/dev/null 2>&1 || true'"
-          }
-        ]
-      }
-    ]
-  }
-}

package/runtime/vendor/plugins/ruflo/ruflo-cost-tracker/scripts/_prices.mjs

@@ -1,58 +0,0 @@
-// _prices.mjs — single source of truth for cost-tracker model pricing.
-//
-// Iter 31 of ADR-149 router work consolidated 5 scripts' worth of pricing
-// into one module. This is the cost-tracker plugin equivalent: track.mjs
-// and counterfactual.mjs both maintained identical PRICING tables, and
-// bench.mjs has its own ANTHROPIC_PRICING. When pricing changes, drift
-// across scripts is the failure mode. One module prevents that.
-//
-// Underscore-prefix filename signals "library, not a CLI entry" — smoke.sh
-// uses `scripts/*.mjs` for the CLI surface check, but reaches this file
-// only through the `parses cleanly` step (still valid).
-
-// USD per 1M tokens. Kept in sync with REFERENCE.md "Model pricing" table.
-// Source of truth for: track.mjs (session cost computation),
-// counterfactual.mjs (multi-baseline analysis), bench.mjs (anthropic baseline).
-export const PRICING = {
-  haiku:  { input: 0.25,  output: 1.25,  cache_write: 0.30,  cache_read: 0.03 },
-  sonnet: { input: 3.00,  output: 15.00, cache_write: 3.75,  cache_read: 0.30 },
-  opus:   { input: 15.00, output: 75.00, cache_write: 18.75, cache_read: 1.50 },
-};
-
-/** Map a model id to one of `haiku | sonnet | opus | unknown`. */
-export function modelTier(model) {
-  if (!model) return 'unknown';
-  const m = String(model).toLowerCase();
-  if (m.includes('haiku')) return 'haiku';
-  if (m.includes('sonnet')) return 'sonnet';
-  if (m.includes('opus')) return 'opus';
-  return 'unknown';
-}
-
-/**
- * Compute USD cost for a usage record at a given tier.
- * usage: { input_tokens, output_tokens, cache_creation_input_tokens, cache_read_input_tokens }
- */
-export function costForUsage(tier, usage) {
-  const p = PRICING[tier];
-  if (!p || !usage) return 0;
-  return (usage.input_tokens || 0) / 1e6 * p.input
-       + (usage.output_tokens || 0) / 1e6 * p.output
-       + (usage.cache_creation_input_tokens || 0) / 1e6 * p.cache_write
-       + (usage.cache_read_input_tokens || 0) / 1e6 * p.cache_read;
-}
-
-/**
- * Compute USD cost for a tokens-bundle (totals already summed) at a given tier.
- * tokens: { input, output, cache_write, cache_read }
- * Used by counterfactual analysis where tokens are aggregated across models
- * before applying a single baseline tier's pricing.
- */
-export function costAtTier(tokens, tier) {
-  const p = PRICING[tier];
-  if (!p) return 0;
-  return (tokens.input / 1e6) * p.input
-       + (tokens.output / 1e6) * p.output
-       + (tokens.cache_write / 1e6) * p.cache_write
-       + (tokens.cache_read / 1e6) * p.cache_read;
-}

package/runtime/vendor/plugins/ruflo/ruflo-cost-tracker/scripts/_sessions.mjs

@@ -1,74 +0,0 @@
-// _sessions.mjs — shared session-loader for the cost-tracking namespace.
-//
-// Iter 73 consolidation. Six analytics scripts (anomaly, burn, conversation,
-// counterfactual, projection, budget) previously duplicated identical
-// boilerplate for reading sessions from the `cost-tracking` namespace.
-// This module is the single source of truth. Math is byte-identical to
-// the per-script copies it replaces.
-//
-// CONTRACT
-//   - `memoryListSessionKeys(ns)`      → keys starting with `session-` only
-//   - `memoryListAllKeys(ns)`          → ALL keys in namespace (for non-session lookups)
-//   - `memoryRetrieve(ns, key)`        → parsed JSON value, or null on failure
-//   - `loadSessions(ns)`               → array of session records (filters out nulls)
-//   - `sessionTs(rec)`                 → ms-since-epoch from capturedAt|endedAt|startedAt
-//   - `parseDurationMs(spec)`          → ms for "Nh"/"Nd"/"Nw"/"Nm"; null on parse fail
-
-import { spawnSync } from 'node:child_process';
-
-const CLI_PKG = process.env.CLI_CORE === '1'
-  ? '@claude-flow/cli-core@alpha'
-  : '@claude-flow/cli@latest';
-
-export function memoryListAllKeys(namespace) {
-  const r = spawnSync('npx', [
-    CLI_PKG, 'memory', 'list',
-    '--namespace', namespace, '--format', 'json',
-  ], { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf-8', shell: process.platform === 'win32' });
-  if (r.status !== 0) return [];
-  const m = /\[[\s\S]*\]/.exec(r.stdout || '');
-  if (!m) return [];
-  let entries;
-  try { entries = JSON.parse(m[0]); } catch { return []; }
-  return entries
-    .map((e) => e.key)
-    .filter((k) => typeof k === 'string');
-}
-
-export function memoryListSessionKeys(namespace) {
-  return memoryListAllKeys(namespace).filter((k) => k.startsWith('session-'));
-}
-
-export function memoryRetrieve(namespace, key) {
-  const r = spawnSync('npx', [
-    CLI_PKG, 'memory', 'retrieve',
-    '--namespace', namespace, '--key', key,
-  ], { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf-8', shell: process.platform === 'win32' });
-  if (r.status !== 0) return null;
-  const m = /\{[\s\S]*\}/.exec(r.stdout || '');
-  if (!m) return null;
-  try { return JSON.parse(m[0]); } catch { return null; }
-}
-
-export function loadSessions(namespace) {
-  const keys = memoryListSessionKeys(namespace);
-  const records = [];
-  for (const k of keys) {
-    const rec = memoryRetrieve(namespace, k);
-    if (rec) records.push(rec);
-  }
-  return records;
-}
-
-export function sessionTs(rec) {
-  const t = rec.capturedAt || rec.endedAt || rec.startedAt;
-  return t ? new Date(t).getTime() : 0;
-}
-
-export function parseDurationMs(spec) {
-  const m = /^(\d+)([hdwm])$/.exec(spec);
-  if (!m) return null;
-  const n = parseInt(m[1], 10);
-  const unit = { h: 3600_000, d: 86400_000, w: 7 * 86400_000, m: 30 * 86400_000 }[m[2]];
-  return unit ? n * unit : null;
-}

package/runtime/vendor/plugins/ruflo/ruflo-cost-tracker/scripts/anomaly.mjs

@@ -1,224 +0,0 @@
-#!/usr/bin/env node
-// cost-anomaly — MAD-based outlier detection on session spend.
-//
-// cost-burn answers "is the LATEST BUCKET accelerating?" — a question about
-// AGGREGATE trend. This script answers "which SPECIFIC SESSIONS are
-// anomalous outliers?" — a question about INDIVIDUAL data points.
-//
-// METHOD
-//   1. Read all `session-*` records from `cost-tracking` namespace.
-//   2. Filter to `--since` window (default: all-time).
-//   3. Compute median(total_cost_usd) and MAD = median(|x - median|).
-//   4. Per-session modified z-score (Iglewicz-Hoaglin):
-//        z = 0.6745 * (x - median) / MAD
-//   5. Flag sessions with |z| > `--threshold` (default 3.5).
-//
-// Why MAD (median absolute deviation) and not mean+sigma:
-//   - Robust to the very outliers we're hunting (a single $50 session
-//     would inflate mean+sigma so badly that subsequent outliers hide).
-//   - Works on small samples (n=10 is fine; mean+sigma needs n=30+).
-//   - Iglewicz-Hoaglin (1993): |modified z| > 3.5 is the canonical cutoff.
-//
-// Pairs with:
-//   - cost-burn          → "did the AGGREGATE rate spike?"
-//   - cost-anomaly       → "which INDIVIDUAL sessions are outliers?" ← this
-//   - cost-counterfactual → "could routing have been cheaper?"
-//   - cost-projection    → "when will we hit budget?"
-//
-// USAGE
-//   node scripts/anomaly.mjs                                # default 3.5 threshold, all-time
-//   node scripts/anomaly.mjs --since 7d                     # last week only
-//   node scripts/anomaly.mjs --threshold 3.0                # stricter (more outliers)
-//   node scripts/anomaly.mjs --threshold 5.0                # looser (only egregious)
-//   node scripts/anomaly.mjs --alert-on-outliers 1          # exit 1 if ≥1 outlier found
-//   node scripts/anomaly.mjs --format json
-//
-// Env: ANOMALY_NAMESPACE (default cost-tracking), ANOMALY_QUIET=1.
-
-// iter 73 — shared session-loader (was duplicated across 6 scripts).
-import { loadSessions, sessionTs, parseDurationMs } from './_sessions.mjs';
-
-const NS = process.env.ANOMALY_NAMESPACE || 'cost-tracking';
-
-const ARGS = (() => {
-  const a = { since: null, threshold: 3.5, alertOnOutliers: null, format: 'table' };
-  if (process.env.ANOMALY_QUIET === '1') a.format = 'json';
-  for (let i = 2; i < process.argv.length; i++) {
-    const v = process.argv[i];
-    if (v === '--since') a.since = process.argv[++i];
-    else if (v === '--threshold') a.threshold = parseFloat(process.argv[++i]);
-    else if (v === '--alert-on-outliers') a.alertOnOutliers = parseInt(process.argv[++i], 10);
-    else if (v === '--format') a.format = process.argv[++i];
-  }
-  return a;
-})();
-
-function median(sorted) {
-  const n = sorted.length;
-  if (n === 0) return 0;
-  return n % 2 === 0
-    ? (sorted[n / 2 - 1] + sorted[n / 2]) / 2
-    : sorted[(n - 1) / 2];
-}
-
-function main() {
-  if (!isFinite(ARGS.threshold) || ARGS.threshold <= 0) {
-    console.error(`anomaly: --threshold must be > 0; got ${ARGS.threshold}`);
-    process.exit(2);
-  }
-  if (ARGS.alertOnOutliers !== null && (!Number.isInteger(ARGS.alertOnOutliers) || ARGS.alertOnOutliers < 1)) {
-    console.error(`anomaly: --alert-on-outliers must be a positive integer; got ${ARGS.alertOnOutliers}`);
-    process.exit(2);
-  }
-
-  // Read + filter sessions (shared loader, iter 73).
-  const records = loadSessions(NS);
-
-  let cutoffMs = null;
-  if (ARGS.since) {
-    const ms = parseDurationMs(ARGS.since);
-    if (!ms) {
-      console.error(`anomaly: --since must be N(h|d|w|m); got "${ARGS.since}"`);
-      process.exit(2);
-    }
-    cutoffMs = Date.now() - ms;
-  }
-  const filtered = cutoffMs === null
-    ? records
-    : records.filter((r) => sessionTs(r) >= cutoffMs);
-
-  // Insufficient-data guard. MAD is meaningful only with ≥3 samples.
-  if (filtered.length < 3) {
-    const payload = {
-      namespace: NS,
-      filters: { since: ARGS.since, threshold: ARGS.threshold },
-      sessionsConsidered: filtered.length,
-      sufficient: false,
-      reason: `need ≥3 sessions for MAD-based outlier detection; got ${filtered.length}`,
-      outliers: [],
-      stats: null,
-      generatedAt: new Date().toISOString(),
-    };
-    if (ARGS.format === 'json') {
-      console.log(JSON.stringify(payload, null, 2));
-    } else {
-      console.log(`# cost-anomaly${ARGS.since ? ` (since ${ARGS.since})` : ' (all-time)'}`);
-      console.log('');
-      console.log(`_Insufficient data: need ≥3 sessions for MAD-based outlier detection; got ${filtered.length}._`);
-      console.log('');
-    }
-    return;
-  }
-
-  // Compute median + MAD over total_cost_usd.
-  const spends = filtered.map((r) => r.total_cost_usd || 0).sort((a, b) => a - b);
-  const med = median(spends);
-  const absDeviations = spends.map((x) => Math.abs(x - med)).sort((a, b) => a - b);
-  const mad = median(absDeviations);
-
-  // MAD=0 means ≥50% of sessions share the exact same spend — z-score
-  // collapses. Report the explainer instead of dividing by zero.
-  let outliers = [];
-  let madZero = false;
-  if (mad === 0) {
-    madZero = true;
-  } else {
-    for (const rec of filtered) {
-      const x = rec.total_cost_usd || 0;
-      const z = 0.6745 * (x - med) / mad;
-      if (Math.abs(z) > ARGS.threshold) {
-        outliers.push({
-          sessionId: rec.sessionId || 'unknown',
-          spendUsd: Math.round(x * 1e6) / 1e6,
-          deviationUsd: Math.round((x - med) * 1e6) / 1e6,
-          modifiedZ: Math.round(z * 1000) / 1000,
-          capturedAt: rec.capturedAt || rec.endedAt || rec.startedAt || null,
-          messageCount: rec.messageCount || 0,
-          direction: x > med ? 'high' : 'low',
-        });
-      }
-    }
-    outliers.sort((a, b) => Math.abs(b.modifiedZ) - Math.abs(a.modifiedZ));
-  }
-
-  // Alert check.
-  let alertTriggered = false;
-  let alertReason = null;
-  if (ARGS.alertOnOutliers !== null) {
-    if (outliers.length >= ARGS.alertOnOutliers) {
-      alertTriggered = true;
-      alertReason = `found ${outliers.length} outlier session(s) (|modified z| > ${ARGS.threshold}); threshold was ≥${ARGS.alertOnOutliers}`;
-    } else {
-      alertReason = `found ${outliers.length} outlier session(s); under threshold ≥${ARGS.alertOnOutliers} — OK`;
-    }
-  }
-
-  const payload = {
-    namespace: NS,
-    filters: { since: ARGS.since, threshold: ARGS.threshold, alertOnOutliers: ARGS.alertOnOutliers },
-    sessionsConsidered: filtered.length,
-    sufficient: !madZero,
-    stats: {
-      medianUsd: Math.round(med * 1e6) / 1e6,
-      madUsd: Math.round(mad * 1e6) / 1e6,
-      minUsd: Math.round(spends[0] * 1e6) / 1e6,
-      maxUsd: Math.round(spends[spends.length - 1] * 1e6) / 1e6,
-    },
-    outliers,
-    alert: ARGS.alertOnOutliers !== null ? {
-      triggered: alertTriggered,
-      reason: alertReason,
-      thresholdOutlierCount: ARGS.alertOnOutliers,
-    } : null,
-    generatedAt: new Date().toISOString(),
-  };
-
-  if (ARGS.format === 'json') {
-    console.log(JSON.stringify(payload, null, 2));
-  } else {
-    console.log(`# cost-anomaly${ARGS.since ? ` (since ${ARGS.since})` : ' (all-time)'}`);
-    console.log('');
-    console.log(`| Metric | Value |`);
-    console.log(`|---|---:|`);
-    console.log(`| Sessions considered | ${filtered.length} |`);
-    console.log(`| Threshold (|modified z|) | ${ARGS.threshold} (Iglewicz-Hoaglin default 3.5) |`);
-    console.log(`| Median spend | $${med.toFixed(6)} |`);
-    console.log(`| MAD | $${mad.toFixed(6)} |`);
-    console.log(`| Min / Max | $${spends[0].toFixed(6)} / $${spends[spends.length - 1].toFixed(6)} |`);
-    console.log(`| **Outliers found** | **${outliers.length}** |`);
-    console.log('');
-    if (madZero) {
-      console.log(`_MAD is $0 — ≥50% of sessions share the exact same spend. No outliers can be computed; investigate if this is expected (e.g. all sessions captured during a dry-run)._`);
-      console.log('');
-    } else if (outliers.length === 0) {
-      console.log(`✓ No outliers found within the |modified z| > ${ARGS.threshold} band.`);
-      console.log('');
-    } else {
-      console.log('## Outlier sessions (sorted by |modified z| descending)');
-      console.log('');
-      console.log('| Session | Spend | Deviation | Modified z | Direction | Messages | Captured |');
-      console.log('|---|---:|---:|---:|:---:|---:|---|');
-      for (const o of outliers) {
-        const sid = o.sessionId.slice(0, 8);
-        const devStr = o.deviationUsd >= 0 ? `+$${o.deviationUsd.toFixed(6)}` : `-$${Math.abs(o.deviationUsd).toFixed(6)}`;
-        console.log(`| \`${sid}\` | $${o.spendUsd.toFixed(6)} | ${devStr} | ${o.modifiedZ.toFixed(3)} | ${o.direction} | ${o.messageCount} | ${o.capturedAt || '—'} |`);
-      }
-      console.log('');
-      console.log('_High-direction outliers are usually long sessions or sessions stuck in expensive tiers — investigate via `cost report` / `cost conversation`._');
-      console.log('_Low-direction outliers may indicate dropped sessions, crashes, or unfinished work — verify the session completed normally._');
-      console.log('');
-    }
-    if (alertReason !== null) {
-      if (alertTriggered) {
-        console.log(`⚠ **ALERT**: ${alertReason}`);
-      } else {
-        console.log(`✓ ${alertReason}`);
-      }
-      console.log('');
-    }
-  }
-
-  if (alertTriggered) process.exit(1);
-}
-
-main();