ai-spend-agent 0.9.9 → 0.9.11

package/dist/index.js

@@ -1098,14 +1098,17 @@ async function workspaceCommand(args, runtime) {
                     : fail("Pairing outcome is unknown. Do not replay this response bundle; inspect and revoke the enrollment in Settings before starting another.");
         }
         if (action === "disconnect") {
-            const result = await disconnectWorkspace({ home: runtime.homeDirectory, transport: runtime.workspaceDisconnectTransport,
+            const result = await disconnectWorkspace({ home: runtime.homeDirectory, retry: args.workspaceDisconnectRetry, transport: runtime.workspaceDisconnectTransport,
                 confirm: action => consent(action === "abandon_unexchanged"
                     ? "This native request has never attempted exchange. Destroy its unused private pairing key so it can no longer complete enrollment? Cancel any browser challenge in Settings as well. [y/N] "
-                    : "Revoke this machine's Workspace grant and remove its local pairing after the accepted receipt? [y/N] ") });
-            return result.state === "revoked" ? ok("Workspace revoked this machine grant. Local pairing was removed.")
-                : result.state === "abandoned" ? ok("Unused native pairing key removed. No remote revocation was claimed. Run npx aibill workspace connect to start a new request.")
-                    : result.state === "cancelled" ? fail("Pairing kept. Disconnect was not confirmed; no request or key was removed.") : result.state === "not_paired" ? ok("No completed local pairing exists.")
-                        : fail(`Disconnect outcome is unknown. Local keys remain; no retry was sent. Reconcile this machine at ${WORKSPACE_ORIGIN}/settings/machines.`);
+                    : action === "retry_revoke"
+                        ? "Repeat the identical retained disconnect request once? If already revoked, Tilden returns that outcome; otherwise this revokes the same grant. No session facts are sent. Local pairing is removed only after a matching receipt. [y/N] "
+                        : "Revoke this machine's Workspace grant and remove its local pairing after the accepted receipt? [y/N] ") });
+            return result.state === "retry_not_pending" ? fail("No uncertain disconnect is retained. Run workspace disconnect without --retry to start a new disconnect.")
+                : result.state === "revoked" ? ok("Workspace revoked this machine grant. Local pairing was removed.")
+                    : result.state === "abandoned" ? ok("Unused native pairing key removed. No remote revocation was claimed. Run npx aibill workspace connect to start a new request.")
+                        : result.state === "cancelled" ? fail("Pairing kept. Disconnect was not confirmed; no request or key was removed.") : result.state === "not_paired" ? ok("No completed local pairing exists.")
+                            : fail(`Disconnect outcome is unknown. Local keys remain and uploads are blocked. Run npx aibill@latest workspace disconnect --retry to review and explicitly repeat the identical retained request once, or inspect this machine at ${WORKSPACE_ORIGIN}/settings/machines.`);
         }
         const status = await workspaceStatus(runtime.homeDirectory);
         if (status.state !== "connected")
@@ -1116,12 +1119,27 @@ async function workspaceCommand(args, runtime) {
             return fail("A retained batch was refused. No new envelope or nonce was created; resolve the refusal before pushing again.");
         const now = runtime.workspaceNow ?? workspaceClock.now();
         const loaded = status.pending ? undefined : runtime.workspaceLoadCalls ? await runtime.workspaceLoadCalls()
-            : await loadLocalAgentFinancialUsage({ workspaceDailyFacts: true, sinceIso: workspaceClock.daysBefore(now, 30) });
-        if (loaded?.diagnostics.some(item => item.code !== "directory_missing"))
-            return fail("Local source reading is incomplete. No facts were replaced or sent; resolve the reported source coverage before pushing.");
+            : await loadLocalAgentFinancialUsage({ workspaceDailyFacts: true, sinceIso: workspaceClock.daysBefore(now, 30),
+                untilIso: `${now.slice(0, 10)}T00:00:00.000Z` });
+        const representedUnknowns = loaded?.diagnostics.filter(item => item.code === "unsupported_token_shape"
+            && item.workspaceFactCoverage === "unknown_tokens").reduce((count, item) => count + item.count, 0) ?? 0;
+        const blockingDiagnostics = loaded?.diagnostics.filter(item => item.code !== "directory_missing"
+            && !(item.code === "unsupported_token_shape" && item.workspaceFactCoverage === "unknown_tokens")) ?? [];
+        if (blockingDiagnostics.length) {
+            const counts = new Map();
+            for (const diagnostic of blockingDiagnostics) {
+                const label = `${localAgentFormatLabel(diagnostic.agent)}: ${diagnostic.code}${diagnostic.workspaceReason ? ` (${diagnostic.workspaceReason})` : ""}`;
+                counts.set(label, (counts.get(label) ?? 0) + diagnostic.count);
+            }
+            return fail(["Local source reading is incomplete. No facts were replaced or sent.",
+                "Local scan diagnostics (counts, without paths or transcript contents):",
+                ...[...counts].sort(([left], [right]) => left.localeCompare(right)).map(([label, count]) => `${label}: ${count}`),
+                "Share these diagnostic counts for help before retrying. Do not delete logs or reconnect this machine."].join("\n"));
+        }
         const prepared = await prepareWorkspacePush({ home: runtime.homeDirectory, calls: loaded?.calls ?? [], generatedAt: now,
             confirm: (payload, coverage) => consent(["Exact outgoing local facts (no prompts, paths, session IDs, or amounts):", payload,
                 `Excluded calls: ${coverage.excludedCalls}. Missing token components: ${coverage.incompleteComponents}.`,
+                ...(representedUnknowns ? [`${representedUnknowns} incomplete local usage records are represented by unknown token values, never zero.`] : []),
                 status.pending?.state === "uncertain" ? "This retries only the identical retained signed batch with its original nonce. Send this exact batch again? [y/N] "
                     : "Machine tokens remain separate from provider-reported tokens and billed costs. Send this batch? [y/N] "].join("\n")) });
         if (prepared.state === "unchanged")
@@ -6741,8 +6759,12 @@ function parseArgs(argv) {
             parsed.workspaceRestart = true;
             rest.shift();
         }
+        if (parsed.workspaceAction === "disconnect" && rest.length === 1 && rest[0] === "--retry") {
+            parsed.workspaceDisconnectRetry = true;
+            rest.shift();
+        }
         if (rest.length)
-            parsed.parseErrors.push("workspace accepts only connect [response-bundle], connect --restart, push, status, or disconnect");
+            parsed.parseErrors.push("workspace accepts only connect [response-bundle], connect --restart, push, status, or disconnect [--retry]");
     }
     if (command === "statusline" && rest[0] && !rest[0].startsWith("--")) {
         parsed.statuslineAction = rest.shift();
@@ -7414,6 +7436,7 @@ function helpText(telemetryDisclosure) {
         "  npx aibill workspace push            Preview and send local session facts",
         "  npx aibill workspace status          Read local pairing/pending status only",
         "  npx aibill workspace disconnect      Revoke the grant or abandon an unused pairing key",
+        "  npx aibill workspace disconnect --retry  Confirm one identical uncertain disconnect attempt",
         "",
         "Add official provider-reported cost (ADMIN/owner-gated):",
         "  npx aibill connect openai            Requires an org-owner Admin credential reference",

package/dist/workspaceConnect.d.ts

@@ -227,13 +227,14 @@ export declare function finishWorkspaceEnrollment(options: {
 }): Promise<{
     state: "connected" | "cancelled" | "unconfirmed";
 }>;
-/** Revocation is one native attempt. Unknown outcomes retain keys and block further writes. */
+/** One native attempt per confirmation. Explicit recovery repeats the retained proof; unknown outcomes keep writes blocked. */
 export declare function disconnectWorkspace(options: {
     home?: string;
-    confirm: (action: "revoke" | "abandon_unexchanged") => Promise<boolean>;
+    retry?: boolean;
+    confirm: (action: "revoke" | "retry_revoke" | "abandon_unexchanged") => Promise<boolean>;
     transport?: WorkspaceDisconnectTransport;
 }): Promise<{
-    state: "revoked" | "abandoned" | "cancelled" | "unconfirmed" | "not_paired";
+    state: "revoked" | "abandoned" | "cancelled" | "unconfirmed" | "not_paired" | "retry_not_pending";
 }>;
 export {};
 //# sourceMappingURL=workspaceConnect.d.ts.map

package/dist/workspaceConnect.js

@@ -668,9 +668,11 @@ export async function finishWorkspaceEnrollment(options) {
         }
     });
 }
-/** Revocation is one native attempt. Unknown outcomes retain keys and block further writes. */
+/** One native attempt per confirmation. Explicit recovery repeats the retained proof; unknown outcomes keep writes blocked. */
 export async function disconnectWorkspace(options) {
     return withState(options.home ?? homedir(), async (state, save, path) => {
+        if (options.retry && state?.disconnect?.state !== "uncertain")
+            return { state: "retry_not_pending" };
         if (!state) {
             const enrollment = await readEnrollment(path);
             if (!enrollment)
@@ -692,14 +694,14 @@ export async function disconnectWorkspace(options) {
             }
             return { state: "abandoned" };
         }
-        if (state.disconnect?.state === "uncertain")
+        if (state.disconnect?.state === "uncertain" && !options.retry)
             return { state: "unconfirmed" };
-        if (!await options.confirm("revoke"))
+        if (!await options.confirm(state.disconnect?.state === "uncertain" ? "retry_revoke" : "revoke"))
             return { state: "cancelled" };
-        if (!state.disconnect) {
+        if (state.disconnect?.state !== "revoked") {
             const proof = { purpose: "machine_disconnect_v1", grantId: state.device.grantId,
                 grantRevision: state.device.grantRevision, connectionEpoch: state.device.connectionEpoch,
-                requestId: `oref_${randomBytes(32).toString("base64url")}` };
+                requestId: state.disconnect?.requestId ?? `oref_${randomBytes(32).toString("base64url")}` };
             const body = { ...proof, publicKey: createPublicKey(state.device.privateKeyPem).export({ format: "jwk" }).x,
                 signature: sign(null, Buffer.from(workspaceCanonicalJson(proof)), state.device.privateKeyPem).toString("base64url") };
             const uncertain = { ...state, disconnect: { state: "uncertain", requestId: proof.requestId, revokedAt: null } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-spend-agent",
-  "version": "0.9.9",
+  "version": "0.9.11",
   "funding": "https://asktilden.com",
   "description": "Local-first financial accountability CLI: Claude Code/Codex attribution, provenance, and next actions, plus experimental Gemini CLI cost evidence.",
   "type": "module",
@@ -55,8 +55,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@agent-finops/core": "0.9.9",
-    "@agent-finops/report": "0.9.9",
+    "@agent-finops/core": "0.9.11",
+    "@agent-finops/report": "0.9.11",
     "yocto-spinner": "^1.2.0"
   }
 }