ai-lens 0.8.120 → 0.8.121

package/.commithash

@@ -1 +1 @@
-bf6f7d9
+9775c12

package/CHANGELOG.md

@@ -2,6 +2,9 @@
 
 History of changes to the `ai-lens` CLI package on npm. New entries go on top. Format: `## X.Y.Z — YYYY-MM-DD`, followed by user-facing bullets.
 
+## 0.8.121 — 2026-07-21
+- fix(codex): Codex token usage no longer double-counts — some Codex versions re-emit an identical usage record without advancing their own running counter, and those duplicates were inflating token totals; they are now dropped (including duplicates that land in a later session update)
+
 ## 0.8.120 — 2026-07-03
 - fix: session events are no longer misattributed to an unrelated repository when a tool touches a file outside the project — project refinement now only follows genuine nested sub-repos, so the `projects` filter and per-project stats stay correct
 - feat(codex): Codex sessions now report per-call token usage, matching Claude Code / Cursor granularity

package/README.md

@@ -345,13 +345,15 @@ Stored in `~/.ai-lens/`:
 ## Development
 
 ```bash
-npm test               # Run all tests (vitest, 683 tests)
+npm test               # Run all tests (vitest)
 npm run test:watch     # Watch mode
 npm run dev:dashboard  # Dashboard dev server
 ```
 
 Tests require PostgreSQL — set `DATABASE_URL` or use `docker compose up postgres -d` (test DB `ailens_test` is created automatically).
 
+Test files run in parallel, each worker against its own database: `test/global-setup.js` migrates a template once and clones it into `ailens_test_w1..wN`. Set `AI_LENS_TEST_WORKERS` to change the worker count (default 6).
+
 Architecture decisions are recorded under [`docs/adr/`](docs/adr/) — e.g. [ADR 0001 — Canonical metric predicates](docs/adr/0001-canonical-metric-predicates.md).
 
 ## Deployment

package/cli/hooks.js

@@ -733,6 +733,27 @@ export function getClaudeCodeToolConfig(projectRoot, label = 'Claude Code (proje
   };
 }
 
+/**
+ * The per-machine Claude Code overlay as a tool config: same tool, but pointed at
+ * `<project>/.claude/settings.local.json`.
+ *
+ * This file is where `init` ACTUALLY writes project hooks (cli/init.js — gitignored,
+ * per-machine, HELP-1539), so anything that inspects "the project's Claude hooks" and
+ * reads only `settings.json` is looking at the wrong file. It has its own label
+ * because consumers key on `tool.name`: `status`'s capture test emits one `[<name>]`
+ * block per tested tool and the server parses those blocks into a Map — two entries
+ * sharing a name would silently overwrite each other.
+ *
+ * `Claude Code (project local overlay)` is the canonical string (already used by
+ * `cli/remove.js` and already mapped to the `claude_code` source in
+ * `server/models/client-reports.js`). Do not invent a variant.
+ */
+export function getClaudeCodeLocalToolConfig(projectRoot, label = 'Claude Code (project local overlay)', ctx = null) {
+  const base = getClaudeCodeToolConfig(projectRoot, label, ctx);
+  if (!base) return null;
+  return { ...base, configPath: claudeLocalSettingsPath(base), sharedConfig: true };
+}
+
 export function getCodexToolConfig(projectRoot, label = 'Codex (project)', ctx = null) {
   const base = TOOL_CONFIGS.find(t => t.name === 'Codex');
   if (!base) return null;
@@ -1226,9 +1247,7 @@ export function detectAiLensInstallScope(projectRoot) {
   // (per-machine, gitignored); the committed `--use-repo-path` form lands in
   // settings.json — check BOTH so neither install style is missed.
   const claudeProject = getClaudeCodeToolConfig(projectRoot);
-  const claudeProjectLocal = claudeProject
-    ? { ...claudeProject, configPath: claudeLocalSettingsPath(claudeProject) }
-    : null;
+  const claudeProjectLocal = getClaudeCodeLocalToolConfig(projectRoot);
   const projectTools = [
     claudeProject,
     claudeProjectLocal,

package/cli/status.js

@@ -7,7 +7,7 @@ import tls from 'node:tls';
 
 import { TLS_TRUST_CODES, tlsCodeOf, tlsVerdictSummary, issuerName } from '../client/tls-trust.js';
 
-import { getVersionInfo, readLensConfig, detectInstalledTools, getCursorToolConfig, getClaudeCodeToolConfig, getCodexToolConfig, analyzeToolHooks, checkHooksDisabled, verifyCodexHookTrust, CAPTURE_PATH, TOOL_CONFIGS, isClaudeProjectDirCommand, analyzeClaudeLocalOverlay, extractProjectDirRelPath, globalClaudeHooksActive, CONHOST_HEADLESS_PREFIX_RE } from './hooks.js';
+import { getVersionInfo, readLensConfig, detectInstalledTools, getCursorToolConfig, getClaudeCodeToolConfig, getCodexToolConfig, getClaudeCodeLocalToolConfig, analyzeToolHooks, checkHooksDisabled, verifyCodexHookTrust, CAPTURE_PATH, TOOL_CONFIGS, isClaudeProjectDirCommand, isWrongPlatformProjectDirCommand, analyzeClaudeLocalOverlay, extractProjectDirRelPath, globalClaudeHooksActive, CONHOST_HEADLESS_PREFIX_RE } from './hooks.js';
 import { DATA_DIR, PENDING_DIR, SENDING_DIR, SESSION_PATHS_DIR, LOG_PATH, CAPTURE_LOG_PATH, LAST_STATUS_REPORT_PATH, getGitIdentity, getMonitoredProjects } from '../client/config.js';
 import { recoverMojibake } from '../client/mojibake-fix.js';
 import { isProjectMonitored } from '../client/capture.js';
@@ -234,17 +234,49 @@ function validateHookCommandPaths(tool) {
 }
 
 /**
- * Global tools (detectInstalledTools) plus project-level tools when cwd has .cursor/hooks.json
- * or .claude/settings.json. Status is assumed to be run from the project root where hooks live.
+ * Global tools (detectInstalledTools) plus the project-level tools found under
+ * `projectRoot`. Status is assumed to be run from the project root where hooks live.
+ *
+ * Claude Code contributes up to TWO entries, and both halves matter:
+ *
+ *  - `settings.local.json` (the OVERLAY) is where `init` actually writes project
+ *    hooks — per-machine, gitignored (HELP-1539). Reading only `settings.json` is
+ *    how this check used to report `no hook command found` for a perfectly healthy
+ *    install, while the per-tool line in the SAME report said the overlay was fine.
+ *
+ *  - the committed `settings.json` is tested only when its hooks can actually fire
+ *    HERE. When `analyzeClaudeLocalOverlay` says an overlay is `applicable`, that
+ *    means by definition "this file carries the other OS's syntax and never fires on
+ *    this machine" — running such a command through the shell yields exit 127 and
+ *    would report `capture failed` for someone whose capture works via the overlay.
+ *    Testing a command the OS cannot execute proves nothing; skipping it makes this
+ *    check agree with the per-tool line instead of contradicting it.
+ *
+ * @param {string} [projectRoot] — defaults to cwd; a parameter so this is testable
+ *   without chdir (it had no coverage precisely because it took none).
+ * @param {{platform?: string, tracked?: boolean}} [opts] — overlay-analysis
+ *   overrides, forwarded to analyzeClaudeLocalOverlay (tests only).
  */
-function getToolsForCaptureTest() {
+export function getToolsForCaptureTest(projectRoot = process.cwd(), opts = {}) {
   const global = detectInstalledTools();
-  const projectRoot = process.cwd();
   const projectTools = [];
   const cursorProject = getCursorToolConfig(projectRoot);
   if (cursorProject && existsSync(cursorProject.configPath)) projectTools.push(cursorProject);
+
   const claudeProject = getClaudeCodeToolConfig(projectRoot);
-  if (claudeProject && existsSync(claudeProject.configPath)) projectTools.push(claudeProject);
+  if (claudeProject && existsSync(claudeProject.configPath)) {
+    const overlay = analyzeClaudeLocalOverlay(claudeProject, opts);
+    // `applicable` ⇔ wrong-platform syntax AND git-tracked. The untracked variant is
+    // just as unrunnable, so check the command form directly too.
+    const wrongForm = isWrongPlatformProjectDirCommand(
+      extractHookCommand(claudeProject) ?? '', opts.platform ?? process.platform,
+    );
+    if (!overlay.applicable && !wrongForm) projectTools.push(claudeProject);
+  }
+
+  const claudeLocal = getClaudeCodeLocalToolConfig(projectRoot);
+  if (claudeLocal && existsSync(claudeLocal.configPath)) projectTools.push(claudeLocal);
+
   const codexProject = getCodexToolConfig(projectRoot);
   if (codexProject && existsSync(codexProject.configPath)) projectTools.push(codexProject);
   return [...global, ...projectTools];
@@ -260,7 +292,22 @@ function checkCaptureRun(installedTools) {
   }
 
   if (toolCommands.length === 0) {
-    return { ok: null, summary: 'no hook command found', detail: 'Could not find an AI Lens hook command in any tool config' };
+    // Say WHERE we looked. Project hooks are discovered relative to cwd, so running
+    // status from outside the project produces this result on a perfectly healthy
+    // install — and the bare old wording ("no hook command found") read as "capture is
+    // dead". Three developers currently sit in exactly this state while their own
+    // report shows capture happening seconds earlier.
+    const looked = installedTools.map(t => t.configPath);
+    return {
+      ok: null,
+      summary: looked.length
+        ? `no hook command found in the configs checked here (${looked.length}) — project hooks may live in another directory`
+        : 'no tool configs found to check',
+      detail: 'Could not find an AI Lens hook command in any tool config.\n'
+        + `Checked:\n${looked.map(p => `  ${p}`).join('\n') || '  (none)'}\n\n`
+        + 'Project hooks are looked up relative to the current directory. If your hooks are\n'
+        + 'installed per-project, re-run `ai-lens status` from that project root.',
+    };
   }
 
   const defaultCaptureScript = join(homedir(), '.ai-lens', 'client', 'capture.js');

package/client/capture.js

@@ -401,9 +401,18 @@ function readNewTranscriptDelta(transcriptPath) {
   const processable = buffer.slice(0, lastNewlineIndex).toString('utf-8');
   const newOffset = startOffset + lastNewlineIndex + 1;
   const nextState = { offset: newOffset, size: currentSize, mtime_ms: currentMtime };
-  const commitOffset = () => writeTranscriptOffsetState(offsetFile, nextState);
-
-  return { lines: processable.split('\n'), commitOffset };
+  // `extra` lets a caller persist source-specific cursor state (e.g. Codex's
+  // running cumulative token total, ANL-1343) atomically WITH the byte offset —
+  // so on a crash-before-commit both roll back together and nothing drifts.
+  const commitOffset = (extra) => writeTranscriptOffsetState(
+    offsetFile,
+    extra ? { ...nextState, ...extra } : nextState,
+  );
+
+  // `savedState` is the offset state as it stood BEFORE this delta (may carry
+  // extra fields a prior commit persisted). Exposed so a source-specific
+  // extractor can seed cross-delta state without re-reading the offset file.
+  return { lines: processable.split('\n'), commitOffset, savedState };
 }
 
 /**
@@ -563,12 +572,22 @@ function extractNewClaudeApiCallsFromTranscript(transcriptPath) {
  *            commitOffset: function}}
  */
 function extractNewCodexRecordsFromTranscript(transcriptPath, fallbackModel) {
-  const { lines, commitOffset } = readNewTranscriptDelta(transcriptPath);
+  const { lines, commitOffset, savedState } = readNewTranscriptDelta(transcriptPath);
   if (!lines.length) return { calls: [], messages: [], commitOffset };
 
   const calls = [];
   const messages = [];
   let currentModel = fallbackModel || null;
+  // Highest cumulative token total already counted for this transcript, seeded
+  // from the persisted offset state so it survives across Stop deltas. Codex
+  // sometimes re-emits an identical token_count without advancing its
+  // cumulative counter (`total_token_usage.total_tokens`); the duplicate carries
+  // a fresh timestamp, so its event_id differs and the server dedup never
+  // collapses it — double-counting tokens (ANL-1343). We drop any token_count
+  // whose cumulative does not advance past this max. The cumulative is monotonic
+  // and never resets (verified across compactions on 22k+ real records), so a
+  // single running max is a complete, false-positive-free signal.
+  let maxTotal = toNumberOrNull(savedState?.codex_last_total) ?? 0;
   try {
     for (const rawLine of lines) {
       const line = rawLine && rawLine.trim();
@@ -647,6 +666,15 @@ function extractNewCodexRecordsFromTranscript(transcriptPath, fallbackModel) {
       // record and identical across two concurrent Stop hooks reading the same
       // bytes.
       const cum = toNumberOrNull(info?.total_token_usage?.total_tokens);
+      // Phantom-duplicate guard (ANL-1343): skip a token_count whose cumulative
+      // total does not advance past the max already counted for this transcript.
+      // Every such record is a byte-identical re-emission (verified: 100% literal
+      // duplicates, 0 false positives). cum-less records (older Codex without a
+      // total) fall through unchanged and rely on the existing dedup.
+      if (cum != null) {
+        if (cum <= maxTotal) continue;
+        maxTotal = cum;
+      }
       const uuid = `${ts || ''}:${cum != null ? cum : ''}`;
 
       calls.push({
@@ -663,11 +691,14 @@ function extractNewCodexRecordsFromTranscript(transcriptPath, fallbackModel) {
     }
   } catch (err) {
     captureLog({ msg: 'transcript-offset-error', stage: 'parse-codex', path: transcriptPath, error: err?.message });
-    commitOffset();
+    commitOffset({ codex_last_total: maxTotal });
     return { calls: [], messages: [], commitOffset: () => {} };
   }
 
-  return { calls, messages, commitOffset };
+  // Persist the advanced cumulative max together with the byte offset, so the
+  // next Stop delta seeds `maxTotal` correctly and cross-delta duplicates are
+  // still caught. Deferred: the caller invokes this only AFTER spooling.
+  return { calls, messages, commitOffset: () => commitOffset({ codex_last_total: maxTotal }) };
 }
 
 // =============================================================================
@@ -690,10 +721,19 @@ export function detectSource(event) {
   // Codex writes its rollout transcript as `.../sessions/.../rollout-<ts>-<id>.jsonl`
   // (codex-rs session naming); Claude Code uses `~/.claude/projects/<dir>/<uuid>.jsonl`.
   // The `rollout-*.jsonl` basename is the reliable Codex signal for SessionStart.
+  // But some Codex SessionStart events carry an EMPTY transcript_path (no rollout yet) and
+  // no turn_id, so they'd fall through to claude_code — which mislabeled the whole session
+  // downstream ([0132]). Those events carry `model: "gpt-5.x…"`; Claude Code never emits a
+  // `gpt-*` model, so it's a safe Codex tie-breaker — but ONLY for the claude-code-shaped
+  // envelope: Cursor also emits `gpt-*` models, so gate the model signal behind "no Cursor
+  // signal present" (conversation_id/cursor_version), which the Cursor branch below keys on.
   const transcriptPath = typeof event.transcript_path === 'string' ? event.transcript_path : '';
+  const model = typeof event.model === 'string' ? event.model : '';
+  const gptModelNoCursor = /^gpt[-.]/i.test(model) && !event.conversation_id && !event.cursor_version;
   if (event.codex_version || event.source === 'codex' || event.hook_source === 'codex'
     || typeof event.turn_id === 'string'
-    || /(^|[\\/])rollout-[^\\/]*\.jsonl$/.test(transcriptPath)) return 'codex';
+    || /(^|[\\/])rollout-[^\\/]*\.jsonl$/.test(transcriptPath)
+    || gptModelNoCursor) return 'codex';
   if (event.conversation_id || event.cursor_version) return 'cursor';
   if (event.session_id || event.transcript_path) return 'claude_code';
   return 'unknown';

package/client/redact.js

@@ -90,6 +90,10 @@ const PATTERNS = [
   // Meilisearch master/API key (mc_ + 32+ hex chars)
   { type: 'MEILISEARCH_KEY', re: /\bmc_[0-9a-f]{32,}\b/g },
 
+  // Cursor Admin API key (crsr_ + 64 hex chars as issued today; 32+ to stay
+  // ahead of a longer future format)
+  { type: 'CURSOR_ADMIN_KEY', re: /\bcrsr_[0-9a-f]{32,}\b/g },
+
   // Connection string password (://user:password@host) — redacts password only.
   // Tightened: exclude JSON structural chars from the user/password classes so
   // a stringified JSON payload (e.g. MCP `tool_response` kept as a single

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-lens",
-  "version": "0.8.120",
+  "version": "0.8.121",
   "type": "module",
   "description": "Centralized session analytics for AI coding tools",
   "bin": {