cctally 1.77.0 → 1.79.0

package/CHANGELOG.md

@@ -5,6 +5,34 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.79.0] - 2026-07-22
+
+### Added
+- The dashboard hero modal (Current Week / Current Cycle) now navigates history: the week/cycle chip's `‹`/`›` (or `ArrowUp`/`ArrowDown`) steps between previous 7-day billing cycles and a block navigator (or `ArrowLeft`/`ArrowRight`) scrolls a selected cycle's known 5-hour blocks, for both Claude subscription weeks and Codex native quota cycles; the default view stays on the current cycle with its active block. Weeks with a re-anchoring credit render the full chronological ledger with cumulative cost restarting per segment and a credit divider between segments, and empty weeks show an explicit empty state. A new `GET /api/milestones/<source>/week/<key>` route serves each selected week's complete milestone payload on demand, while a compact navigation index rides the live envelope (built only on non-idle snapshot rebuilds). Historic weeks are read-only; the Share action is hidden while a historic week is shown.
+- Qualified Codex reasoning now uses a provider-native title/summary/body treatment instead of Claude Thinking chrome, while empty reasoning stays absent and Claude Thinking is unchanged. Evidence-preserved lifecycle fallbacks render as concise Codex task states, and recognized Git/memory harness markers become privacy-safe system actions with on-demand raw payload access; authored lookalikes remain literal prose. (#334)
+- Qualified Codex conversation detail now preserves and renders plans, web searches, MCP completions, and agent-control operations as bounded provider-native cards with honest request/result/error state, safe web links, and on-demand raw payloads. Proven spawns gain a privacy-safe link to the exact retained child conversation only when same-root parent and canonical task-path evidence is unique; ambiguous, cross-root, malformed, and future shapes stay unlinked with the generic fallback. Local or placeholder Markdown image targets degrade to an explicit unavailable badge without a browser request or rendered path disclosure. (#332)
+- Qualified Codex conversation detail now exposes bounded native terminal, output, and patch cards, and the dashboard renders supported `exec` calls as clean terminals plus `apply_patch`/patch-completion records as faithful diff cards. Provider names remain visible, diff-less events stay honest, raw payloads remain available on demand, and unsupported future wrappers keep the generic fallback. (#331)
+- Beta release channel. Every release now ships to a beta channel first (npm `beta` dist-tag, GitHub prerelease); the maintainer later promotes chosen releases to stable (npm `latest`, GitHub "Latest", the Homebrew tap). Opt in with `cctally config set update.channel beta`: `cctally update` then tracks SemVer-max(beta, latest) and installs the exact resolved version (never a bare `@beta`), a `(beta)` marker appears on the CLI banner and the dashboard update badge/modal, the dashboard settings gain an Update-channel toggle, and `cctally doctor` reports the configured channel (warning on beta + Homebrew, which tracks stable only). Stable stays the default and flipping back to it never silently downgrades.
+
+### Fixed
+- The compact qualified conversation reader now keeps provider notification labels intact and the complete Codex input/output/cached-input/reasoning-output subtitle visible without clipping or horizontal overflow. Retained Codex world-state, inter-agent metadata, turn-context control fields, and unknown future record families stay replay-safe but no longer risk becoming fabricated transcript noise or exposing private harness state. (#335)
+- The dashboard's qualified conversation reader now keeps Codex reasoning, tool calls/results, injected metadata labels, and lifecycle events in their native semantic roles instead of collapsing them into generic background rows. Skill-invocation titles no longer expose local `SKILL.md` paths, the outline prioritizes real prompts, logical assistant responses, and compactions while retaining full detail payload, token, model, and cost data, and an overflow menu opened immediately after reader mount is no longer closed by delayed initialization. (#330)
+
+## [1.78.0] - 2026-07-21
+
+### Changed
+- Dashboard Codex Daily, Weekly, and Monthly details now retain native Input, Cached input, Output, Reasoning, and Total counters; Codex Weekly uses reset-cycle vocabulary, All Weekly uses neutral provider-period wording, and partial-metadata projects with the same basename remain collision-safe without exposing identities. (#329)
+- Dashboard Codex session, project, and quota-block details now use bounded native hierarchies, localized timestamps, retained quota progression, and accessible prompt expansion across desktop and mobile. (#325)
+- Dashboard All-mode Claude project and session rows now open the same useful detail hierarchy and cross-navigation as the canonical Claude views while keeping native session IDs and source paths private. (#325)
+- Dashboard All-mode Forecast and Cache Report cards and details now compose separate, provider-labelled Claude and Codex reports with provider-local values, confidence, and degraded or unavailable reasons instead of presenting Codex-only data under an All heading. (#324)
+- Dashboard All-mode Weekly and `$ / 1% Trend` views now keep Claude and Codex quota histories in separate provider-labelled sections and series, while explicitly combining only compatible cost totals. (#324)
+
+### Fixed
+- Dashboard narrow layouts now keep degraded source status readable, hide the optional Codex five-hour slot when no native 300-minute window is reported, label real All-mode five-hour rows by provider, and bound unavailable combined-total warnings without losing their accessible detail. (#329)
+- Dashboard source-wide freshness and read-model warnings now reach Daily and Projects without hiding the fixed ten-card board; Current Usage and Share stay bound to the source that opened them, and All shows separate Claude and Codex current-cycle sections instead of silently falling back to Claude. (#328)
+- Dashboard HTTP and live-event JSON now convert non-finite numeric values to `null` at one strict outbound boundary, so missing Doctor freshness markers no longer emit browser-invalid `Infinity` tokens and the full Doctor report opens normally. (#327)
+- Claude 5-hour and 7-day usage now receive one account-wide authoritative OAuth confirmation per 30-second status-line cycle, so a stale Claude Code `rate_limits` payload can no longer leave dashboard milestones behind for up to five minutes. The confirmation is detached from rendering, shares the existing hook throttle lock, and preserves `Retry-After` plus exponential `429` backoff.
+
 ## [1.77.0] - 2026-07-21
 
 ### Added

package/README.md

@@ -49,6 +49,8 @@ cctally dashboard          # opens http://127.0.0.1:8789
 
 For status-line integration and tuning, see [docs/installation.md](docs/installation.md) and [docs/configuration.md](docs/configuration.md).
 
+**Beta channel (opt-in).** Every release ships to a beta channel first; the maintainer promotes the ones that prove out to stable, which is the default. To ride along with the newest builds as they land, opt in with `cctally config set update.channel beta` (npm or source installs — Homebrew tracks stable). `cctally update` then installs the exact latest beta version, and `cctally config set update.channel stable` flips you back cleanly with no silent downgrade. See [docs/commands/update.md](docs/commands/update.md#beta-channel).
+
 ## The live dashboard
 
 `cctally dashboard` serves a web app at `localhost:8789` that updates live as you work - no refresh, no polling. Eleven panels cover the whole picture: **current week**, **forecast**, **$/1% trend**, **recent sessions**, **weekly**, **monthly**, **5-hour blocks**, **daily heatmap**, **projects**, **cache report**, and **recent alerts**. Any panel expands into a focused view, sessions are filterable and searchable, and a settings drawer tunes alerts and display options on the fly. It runs only on your own machine by default; one flag opens it to the other devices on your network when you want that.

package/bin/_cctally_cache.py

@@ -1044,6 +1044,52 @@ def _replay_codex_normalization(conn: sqlite3.Connection) -> None:
     _recompute_codex_rollups(conn, affected)
 
 
+def _repair_codex_turn_ids_for_source(
+    conn: sqlite3.Connection, source_path: str,
+) -> set[str]:
+    """Reconcile stored normalized rows after a late native turn anchor arrives.
+
+    Active Codex streams can emit the response before a later completion, patch,
+    or abort record exposes its turn id. Run this bounded per-file repair only
+    when such a native proof arrives; ordinary append ticks remain delta-only.
+    The physical log stays authoritative.
+    """
+    events = [
+        _lib_jsonl.CodexPhysicalEvent(*row)
+        for row in conn.execute(
+            "SELECT source_path, line_offset, source_root_key, conversation_key, "
+            "native_thread_id, root_thread_id, parent_thread_id, timestamp_utc, "
+            "record_type, event_type, turn_id, call_id, payload_json "
+            "FROM codex_conversation_events WHERE source_path=? ORDER BY line_offset",
+            (source_path,),
+        )
+    ]
+    inferred, _terminal = _lib_codex_conversation.infer_codex_event_turns(events)
+    expected = {event.line_offset: turn for event, turn in zip(events, inferred)}
+    affected = {
+        row[0]
+        for row in conn.execute(
+            "SELECT DISTINCT conversation_key FROM codex_conversation_messages "
+            "WHERE source_path=?",
+            (source_path,),
+        )
+        if row[0]
+    }
+    for line_offset, stored_turn in conn.execute(
+        "SELECT line_offset, turn_id FROM codex_conversation_messages "
+        "WHERE source_path=?",
+        (source_path,),
+    ):
+        inferred_turn = expected.get(line_offset)
+        if stored_turn != inferred_turn:
+            conn.execute(
+                "UPDATE codex_conversation_messages SET turn_id=? "
+                "WHERE source_path=? AND line_offset=?",
+                (inferred_turn, source_path, line_offset),
+            )
+    return affected
+
+
 def _collect_inactive_codex_paths_and_roots(
     conn: sqlite3.Connection,
     current_file_identities: set[tuple[str, str]],
@@ -4849,6 +4895,7 @@ def open_conversations_db(*, attach_cache: bool = True) -> sqlite3.Connection:
         cache_uri = _cctally_core.CACHE_DB_PATH.resolve().as_uri() + "?mode=ro"
         conn.execute("ATTACH DATABASE ? AS cache_db", (cache_uri,))
         _import_legacy_conversation_rows(conn)
+        _ensure_codex_conversation_contract(conn)
     _harden_conversation_sidecars()
     return conn
 
@@ -4900,6 +4947,68 @@ def _import_legacy_conversation_rows(conn: sqlite3.Connection) -> None:
         conn.commit()
 
 
+def _ensure_codex_conversation_contract(conn: sqlite3.Connection) -> bool:
+    """Converge retained Codex events on first read after a contract bump.
+
+    Qualified CLI reads and ``dashboard --no-sync`` intentionally do not ingest
+    JSONL. They still must remain usable after an upgrade, so replay only the
+    already-retained physical events under the provider-local conversation lock.
+    Empty stores keep their existing rebuild marker for the next real sync.
+    """
+    current = _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION
+
+    def needs_replay() -> bool:
+        version = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_conversation_contract_version'"
+        ).fetchone()
+        pending = conn.execute(
+            "SELECT 1 FROM cache_meta "
+            "WHERE key='conversation_rebuild_codex_pending'"
+        ).fetchone() is not None
+        has_events = conn.execute(
+            "SELECT 1 FROM codex_conversation_events LIMIT 1"
+        ).fetchone() is not None
+        return has_events and (pending or version is None or version[0] != current)
+
+    if not needs_replay():
+        return False
+
+    _cctally_core.CONVERSATIONS_LOCK_CODEX_PATH.touch()
+    lock_fh = open(_cctally_core.CONVERSATIONS_LOCK_CODEX_PATH, "w")
+    try:
+        if not _acquire_cache_flock(lock_fh, timeout=15.0):
+            return False
+        if not needs_replay():
+            return False
+        try:
+            conn.execute("BEGIN IMMEDIATE")
+            _codex_conversation_fts_full_clear(conn)
+            _replay_codex_normalization(conn)
+            conn.execute(
+                "INSERT OR REPLACE INTO cache_meta(key,value) VALUES(?,?)",
+                ("codex_conversation_contract_version", current),
+            )
+            conn.execute(
+                "DELETE FROM cache_meta "
+                "WHERE key='conversation_rebuild_codex_pending'"
+            )
+            conn.commit()
+            return True
+        except (sqlite3.DatabaseError, OSError, ValueError) as exc:
+            conn.rollback()
+            eprint(
+                f"[codex-conversations] retained-event contract replay failed: {exc}"
+            )
+            return False
+    finally:
+        try:
+            fcntl.flock(lock_fh, fcntl.LOCK_UN)
+        except OSError:
+            pass
+        lock_fh.close()
+
+
 def _prepare_claude_conversation_maintenance(
     conn: sqlite3.Connection,
     *,
@@ -5240,10 +5349,25 @@ def sync_codex_conversations(
             "SELECT 1 FROM cache_meta "
             "WHERE key='conversation_rebuild_codex_pending'"
         ).fetchone() is not None
-        if pending_rebuild and targeted:
+        contract_row = conn.execute(
+            "SELECT value FROM cache_meta "
+            "WHERE key='codex_conversation_contract_version'"
+        ).fetchone()
+        has_contract_state = conn.execute(
+            "SELECT 1 FROM codex_conversation_events LIMIT 1"
+        ).fetchone() is not None
+        contract_rebuild = (
+            has_contract_state
+            and (
+                contract_row is None
+                or contract_row[0]
+                != _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION
+            )
+        )
+        if (pending_rebuild or contract_rebuild) and targeted:
             stats.deferred_reason = "rebuild_pending"
             return stats
-        rebuild = rebuild or pending_rebuild
+        rebuild = rebuild or pending_rebuild or contract_rebuild
         if rebuild:
             _clear_codex_conversation_store(conn)
             conn.commit()
@@ -5464,6 +5588,13 @@ def sync_codex_conversations(
                 affected_keys.update(
                     row.conversation_key for row in normalized.rows
                 )
+                if any(
+                    _lib_codex_conversation.codex_event_is_late_turn_anchor(event)
+                    for event in events
+                ):
+                    affected_keys.update(
+                        _repair_codex_turn_ids_for_source(conn, path_str)
+                    )
                 _recompute_codex_rollups(conn, affected_keys)
                 terminal = state.thread
                 conn.execute(
@@ -5511,6 +5642,13 @@ def sync_codex_conversations(
                 stats.files_failed += 1
 
         if only_paths is None and stats.files_failed == 0:
+            conn.execute(
+                "INSERT OR REPLACE INTO cache_meta(key,value) VALUES(?,?)",
+                (
+                    "codex_conversation_contract_version",
+                    _lib_codex_conversation.CODEX_CONVERSATION_CONTRACT_VERSION,
+                ),
+            )
             conn.execute(
                 "DELETE FROM cache_meta "
                 "WHERE key='conversation_rebuild_codex_pending'"

package/bin/_cctally_config.py

@@ -309,6 +309,7 @@ ALLOWED_CONFIG_KEYS = (
     "dashboard.live_tail",
     "update.check.enabled",
     "update.check.ttl_hours",
+    "update.channel",
     "statusline.visual_burn_rate",
     "statusline.cost_source",
     "statusline.cctally_extensions",
@@ -883,6 +884,12 @@ def _config_known_value(config: dict, key: str) -> "object":
             return c._validate_update_check_ttl_hours_value(stored)
         except ValueError:
             return c.UPDATE_DEFAULT_TTL_HOURS
+    if key == "update.channel":
+        # Release channel opt-in (beta-channel, spec 2026-07-21 §3). Default
+        # "stable"; hand-edited junk surfaces the default — mirrors
+        # dashboard.bind / update.check.*. The single resolver keeps the CLI,
+        # check pipeline, doctor, and dashboard envelope in lockstep.
+        return c.resolve_update_channel(config)
     if key.startswith(_CODEX_BUDGET_LEAF_PREFIX):
         return _config_codex_leaf_value(config, key)
     if key in (
@@ -1564,6 +1571,35 @@ def _cmd_config_set(args: argparse.Namespace) -> int:
                 rendered = str(normalized)
             print(f"{key}={rendered}")
         return 0
+    if key == "update.channel":
+        # Release channel opt-in (beta-channel, spec 2026-07-21 §3). Enum
+        # {stable,beta}; validate first so rejection short-circuits before
+        # lock acquisition. Read-modify-write preserving the sibling
+        # `update.check` block (mirrors update.check.* preserving nothing it
+        # doesn't own).
+        try:
+            canonical = c._validate_update_channel_value(raw)
+        except ValueError as exc:
+            print(f"cctally config: {exc}", file=sys.stderr)
+            return 2
+        with config_writer_lock():
+            config = _load_config_unlocked()
+            existing_update = config.get("update")
+            if existing_update is not None and not isinstance(existing_update, dict):
+                print(
+                    "cctally: update config error: update must be an object",
+                    file=sys.stderr,
+                )
+                return 2
+            update_block = dict(existing_update or {})
+            update_block["channel"] = canonical
+            config["update"] = update_block
+            save_config(config)
+        if getattr(args, "emit_json", False):
+            print(json.dumps({"update": {"channel": canonical}}, indent=2))
+        else:
+            print(f"update.channel={canonical}")
+        return 0
     if key in (
         "budget.weekly_usd",
         "budget.alerts_enabled",
@@ -1990,6 +2026,20 @@ def _cmd_config_unset(args: argparse.Namespace) -> int:
                     save_config(config)
             # idempotent: silent on missing key
         return 0
+    if key == "update.channel":
+        # Drop the channel leaf; preserve a sibling update.check block, and
+        # prune an empty `update` so config.json stays tidy. Mirrors the
+        # update.check.* unset branch above.
+        with config_writer_lock():
+            config = _load_config_unlocked()
+            update_block = config.get("update")
+            if isinstance(update_block, dict) and "channel" in update_block:
+                del update_block["channel"]
+                if not update_block:
+                    config.pop("update", None)
+                save_config(config)
+            # idempotent: silent on missing key
+        return 0
     if key in (
         "budget.weekly_usd",
         "budget.alerts_enabled",

package/bin/_cctally_core.py

@@ -252,9 +252,11 @@ def _real_prod_data_dir() -> pathlib.Path:
 # Internal (no config UI — YAGNI, spec §Out of scope); test injection only.
 # Spec 2026-07-17-usage-statusline-fallback-design.
 #
-# OAUTH_BACKFILL_STALE_SECONDS: the OAuth poll only backfills once the
-#   selected-freshness marker is at least this stale. The 30-second statusline
-#   transport tick does not run OAuth.
+# STATUSLINE_OAUTH_POLL_SECONDS: the account-wide authoritative confirmation
+#   cadence driven by Claude Code's 30-second statusline timer. Keep it below
+#   the timer so scheduling jitter does not skip every other tick.
+# OAUTH_BACKFILL_STALE_SECONDS: the matching selected-freshness gate shared by
+#   statusline-driven and hook-driven automatic OAuth refreshes.
 # OAUTH_BACKOFF_BASE_SECONDS / OAUTH_BACKOFF_CAP_SECONDS: the headerless
 #   exponential 429 backoff (base * 2**consecutive_429, capped).
 STATUSLINE_CANDIDATE_TTL_SECONDS = 90
@@ -270,7 +272,8 @@ STATUSLINE_TOMBSTONE_DOCUMENT_MAX_BYTES = 1024
 # session waits on a long subagent (event-driven updates go quiet then). MUST
 # Add-when-absent only; a user-set value is never mutated.
 STATUSLINE_REFRESH_INTERVAL_DEFAULT = 30
-OAUTH_BACKFILL_STALE_SECONDS = 300.0
+STATUSLINE_OAUTH_POLL_SECONDS = 25.0
+OAUTH_BACKFILL_STALE_SECONDS = STATUSLINE_OAUTH_POLL_SECONDS
 OAUTH_BACKOFF_BASE_SECONDS = 60.0
 OAUTH_BACKOFF_CAP_SECONDS = 3600.0