cctally 1.80.4 → 1.82.0

package/CHANGELOG.md

@@ -5,6 +5,38 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.82.0] - 2026-07-24
+
+### Added
+- Embedded pricing for Claude Opus 5 (`claude-opus-5`) so Opus 5 sessions are costed correctly instead of contributing $0 as an unrecognized model. Anthropic ships it at the standard Opus rate — $5 / MTok input, $25 / MTok output, $6.25 / MTok 5-minute cache write, $0.50 / MTok cache read — with the full 1M-token context window at standard pricing (no long-context premium), verified against Anthropic's published pricing table; the pricing snapshot date moves to 2026-07-24. LiteLLM carries no Opus 5 entry yet, so the embedded table is simply ahead of it and `pricing-check` does not report drift.
+
+### Fixed
+- `cctally statusline`'s 🧠 context segment now measures a `claude-opus-5[1m]` session against its real 1,000,000-token window instead of silently falling back to the 200K family default, which inflated the reported context percentage roughly fivefold.
+
+## [1.81.0] - 2026-07-24
+
+### Added
+- cctally now tracks usage per account for each provider: if you use more than one Claude or Codex account on this machine, each account's percent, 5-hour, and quota milestones — and their alerts — are recorded and fire independently instead of silently colliding. (#341)
+- New `cctally account list|show|label` subcommand shows every observed account (provider, label, email, plan, first/last seen, and which is currently active) and lets you set a durable friendly label that survives a stats rebuild. (#341)
+- Optional per-account weekly budgets via `config set budget.accounts` (Claude) and `config set budget.codex.accounts` (Codex); a budget targets an immutable account even after you rename its label, and a Codex per-account budget works without a vendor-wide amount. (#341)
+- `cctally doctor` gains an Accounts section reporting whether the active identity is readable, the registry is consistent, and whether usage is landing under the correct account. (#341)
+- New `--account <ref>` filter scopes a command's output to one account (by label, email, or account-key prefix). It works on the Claude usage/analytics commands — `report`, `forecast`, `weekly`, `percent-breakdown`, `five-hour-blocks`, `five-hour-breakdown`, `daily`, `monthly`, `session`, `project`, `diff`, `range-cost`, `cache-report` — and the `codex quota` views; `--json` output gains `accountKey`/`accountLabel` when an account is selected. (#341)
+- The dashboard gains a multi-account view: when a provider has more than one real account, an account chip row appears under the source switcher (keyboard `a` cycles), the "All accounts" view shows a per-account hero card (weekly/5-hour bars, plan, weekly spend, reset countdown), and selecting a chip focuses that account. Single-account dashboards are pixel-identical. (#341)
+
+### Changed
+- Multi-account is byte-stable: if you use a single account per provider (the common case), every report, alert, and status line is unchanged. Account labels and columns appear only once a provider has more than one real account. (#341)
+- Alert notifications gain a `[label]` prefix only when a provider has more than one real account, and `alerts.log` now records the account on every line. (#341)
+- `record-credit` records the credit under the currently active account (and asks you to retry if that identity can't be read mid-write); `sync-week` attributes its cost snapshot to the active account. (#341)
+
+### Fixed
+- Concurrent Claude and Codex hook syncs now serialize every `cache.db` write and WAL checkpoint through one global-first lock order. Forced writer death resumes from truthful per-file cursors, and quota-journal and migration writers use the same discipline, closing the cross-provider write/checkpoint overlap consistent with the recurring page-one corruption. (#344)
+- Corrupt `cache.db` rebuilds now recover without manual file surgery, including
+  corruption discovered after open and repairs interrupted at any phase.
+  Dead, malformed, or PID-reused repair owners self-clear safely, `doctor`
+  reports live versus stale maintenance, and the dashboard distinguishes
+  actionable server cache failures from disconnects and failed manual sync
+  requests. (#344)
+
 ## [1.80.4] - 2026-07-23
 
 ### Fixed

package/bin/_cctally_account.py

@@ -0,0 +1,397 @@
+"""``cctally account`` subcommand + the account-decoration helpers (#341, spec §3).
+
+Read surface over the ``accounts`` registry (derived from the journal by the
+Task-1 rebuild appliers) plus the providers' own on-disk active-account state:
+
+  * ``list [--json]``  — every observed account with label / provider / email /
+    plan / first-last-seen and a live ``active`` marker per provider.
+  * ``show <ref> [--json]`` — one account's identity + a small attribution
+    summary (usage-snapshot / percent-milestone counts scoped to the key).
+  * ``label <ref> <name>`` — append an ``account_label`` op (user provenance,
+    top of the ``user > switcher > auto`` precedence) and run an authoritative
+    ingest so the rename folds durably (survives ``db rebuild --db stats``).
+
+Ref resolution is the pure ``_lib_accounts.resolve_account_ref`` (case-insensitive
+label -> email -> unique key prefix; literal ``unattributed`` accepted); an
+ambiguous/unknown ref raises ``AccountRefError`` -> exit 2 with candidates on
+stderr (native-usage error per ``docs/cli-contract.md``).
+
+This module is ALSO the single home for the R8 decoration gate + label helpers
+consumed by the alerts log/label prefix, the ``--account`` render decoration,
+the doctor ``accounts.*`` legs, and (Task 4) the dashboard read model:
+``real_account_count`` / ``provider_is_decorated`` / ``account_label`` /
+``resolve_active_account_keys``. Keeping them here means the ">1 real account"
+trigger and the key->label map have exactly one definition.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sqlite3
+
+import _cctally_core
+import _lib_accounts
+
+
+def _cctally():
+    import sys
+    return sys.modules["cctally"]
+
+
+def eprint(*args, **kwargs):
+    import sys
+    print(*args, file=sys.stderr, **kwargs)
+
+
+# --------------------------------------------------------------------------
+# registry read helpers (shared decoration surface)
+# --------------------------------------------------------------------------
+
+_ACCOUNT_COLUMNS = (
+    "account_key", "provider", "natural_id", "email", "label", "plan_type",
+    "label_source", "first_seen_utc", "last_seen_utc",
+)
+
+
+def load_accounts(conn, provider: "str | None" = None) -> "list[dict]":
+    """Every registry row (optionally one provider), deterministically ordered
+    by ``(provider, first_seen_utc, account_key)`` so renders are stable."""
+    sql = (
+        "SELECT account_key, provider, natural_id, email, label, plan_type, "
+        "label_source, first_seen_utc, last_seen_utc FROM accounts"
+    )
+    params: tuple = ()
+    if provider is not None:
+        sql += " WHERE provider = ?"
+        params = (provider,)
+    sql += " ORDER BY provider, first_seen_utc, account_key"
+    return [
+        {col: row[i] for i, col in enumerate(_ACCOUNT_COLUMNS)}
+        for row in conn.execute(sql, params).fetchall()
+    ]
+
+
+def real_account_count(conn, provider: str) -> int:
+    """Number of REAL accounts for one provider (excludes the ``unattributed``
+    sentinel). The R8 decoration trigger: ``> 1`` means the provider decorates."""
+    row = conn.execute(
+        "SELECT COUNT(*) FROM accounts WHERE provider = ? AND account_key != ?",
+        (provider, _lib_accounts.UNATTRIBUTED),
+    ).fetchone()
+    return int(row[0]) if row else 0
+
+
+def provider_is_decorated(conn, provider: str) -> bool:
+    """R8 gate: does this provider render account decoration? True iff it holds
+    more than one REAL account (a lone ``unattributed`` bucket never triggers)."""
+    return real_account_count(conn, provider) > 1
+
+
+def account_label(conn, account_key: str) -> str:
+    """A human label for ``account_key``: the registry label, else the email,
+    else an 8-char key prefix. The reserved sentinels render as words so alert
+    prefixes / renders read cleanly."""
+    if account_key == _lib_accounts.UNATTRIBUTED:
+        return "Unattributed"
+    if account_key == _lib_accounts.VENDOR_WIDE:
+        return "All accounts"
+    row = conn.execute(
+        "SELECT label, email FROM accounts WHERE account_key = ?", (account_key,)
+    ).fetchone()
+    if row is not None:
+        if row[0]:
+            return row[0]
+        if row[1]:
+            return row[1]
+    return account_key[:8]
+
+
+def resolve_account_filter(args, provider: str = "claude", *,
+                           needs_cache: bool = False) -> "tuple[str | None, int | None]":
+    """Resolve the ``--account <ref>`` render filter (#341, spec §3) to an
+    ``account_key``.
+
+    Returns ``(account_key | None, exit_code | None)``:
+      * no ``--account`` flag        -> ``(None, None)`` (merged view, today's
+        byte-identical output — R8);
+      * resolved ref                 -> ``(key, None)``;
+      * ambiguous/unknown ref        -> ``(None, 2)`` (candidates on stderr, a
+        native-usage error per ``docs/cli-contract.md``);
+      * ``needs_cache`` + cache down -> ``(None, 3)`` — the stamped-entry family
+        (``daily``/``session``/…) fails closed when the entry cache is
+        unavailable, because the direct-JSONL fallback carries NO account
+        identity and must never be stamped with the current login at read time.
+
+    ``provider`` scopes ref resolution to one provider's registry (``claude`` for
+    the Claude usage/analytics family, ``codex`` for ``codex quota``)."""
+    ref = getattr(args, "account", None)
+    if ref is None:
+        return (None, None)
+    conn = _cctally_core.open_db()
+    try:
+        try:
+            key = _lib_accounts.resolve_account_ref(conn, ref, provider)
+        except _lib_accounts.AccountRefError as exc:
+            eprint(f"account: --account {ref!r} is ambiguous or unknown")
+            if exc.candidates:
+                eprint("candidates:")
+                for cand in exc.candidates:
+                    eprint(f"  {cand}")
+            return (None, 2)
+    finally:
+        conn.close()
+    if needs_cache:
+        try:
+            import _cctally_cache
+            _cctally_cache.open_cache_db().close()
+        except Exception:
+            eprint("account attribution unavailable (cache required)")
+            return (None, 3)
+    return (key, None)
+
+
+def account_json_fields(account_key: "str | None") -> dict:
+    """R8 JSON decoration for an account-aware invocation (#341, spec §3).
+
+    Returns ``{"accountKey": <key>, "accountLabel": <label>}`` for a resolved
+    ``--account`` key, else ``{}``. Emitted only under an explicitly account-aware
+    invocation (``--account`` set), so a default (no-flag) render stays
+    byte-identical (R8). camelCase + additive; no ``schemaVersion`` bump."""
+    if account_key is None:
+        return {}
+    conn = _cctally_core.open_db()
+    try:
+        label = account_label(conn, account_key)
+    finally:
+        conn.close()
+    return {"accountKey": account_key, "accountLabel": label}
+
+
+def resolve_active_account_keys() -> "set[str]":
+    """The set of account keys that are CURRENTLY active per the providers' own
+    on-disk credential state (never guessed). Claude from ``~/.claude.json``;
+    Codex from each provider root's ``auth.json``. Absent / api-key / torn reads
+    contribute nothing. Read-only, best-effort — any failure yields an empty
+    contribution rather than raising into a render path."""
+    active: "set[str]" = set()
+    try:
+        claude = _cctally_core._resolve_active_claude_account()
+        if claude and claude != _lib_accounts.UNATTRIBUTED:
+            active.add(claude)
+    except Exception:
+        pass
+    try:
+        import _cctally_cache
+        for root in _cctally_cache._codex_provider_roots():
+            res = _cctally_cache._resolve_codex_account_for_root(root.provider_root)
+            if getattr(res, "status", None) == "identified" and res.account_key:
+                active.add(res.account_key)
+    except Exception:
+        pass
+    return active
+
+
+# --------------------------------------------------------------------------
+# small deterministic table renderer (content-sized columns)
+# --------------------------------------------------------------------------
+
+def _render_table(headers: "list[str]", rows: "list[list[str]]") -> str:
+    widths = [len(h) for h in headers]
+    for row in rows:
+        for i, cell in enumerate(row):
+            widths[i] = max(widths[i], len(cell))
+    def _fmt(cells):
+        return "  ".join(c.ljust(widths[i]) for i, c in enumerate(cells)).rstrip()
+    out = [_fmt(headers)]
+    for row in rows:
+        out.append(_fmt(row))
+    return "\n".join(out)
+
+
+def _dash(value: "str | None") -> str:
+    return value if value else "-"
+
+
+def _date_only(iso: "str | None") -> str:
+    if not iso:
+        return "-"
+    return iso[:10]
+
+
+# --------------------------------------------------------------------------
+# command dispatch
+# --------------------------------------------------------------------------
+
+def cmd_account(args: argparse.Namespace) -> int:
+    action = getattr(args, "account_action", None)
+    if action == "list":
+        return _cmd_account_list(args)
+    if action == "show":
+        return _cmd_account_show(args)
+    if action == "label":
+        return _cmd_account_label(args)
+    eprint("account: unknown action")
+    return 2
+
+
+def _cmd_account_list(args: argparse.Namespace) -> int:
+    conn = _cctally_core.open_db()
+    try:
+        accounts = load_accounts(conn)
+    finally:
+        conn.close()
+    active = resolve_active_account_keys()
+    if getattr(args, "emit_json", False):
+        payload = {
+            "accounts": [
+                {
+                    "accountKey": a["account_key"],
+                    "provider": a["provider"],
+                    "label": a["label"],
+                    "email": a["email"],
+                    "planType": a["plan_type"],
+                    "labelSource": a["label_source"],
+                    "firstSeenUtc": a["first_seen_utc"],
+                    "lastSeenUtc": a["last_seen_utc"],
+                    "active": a["account_key"] in active,
+                }
+                for a in accounts
+            ]
+        }
+        print(json.dumps(_cctally().stamp_schema_version(payload)))
+        return 0
+
+    if not accounts:
+        print("No accounts observed yet.")
+        return 0
+    headers = ["PROVIDER", "LABEL", "EMAIL", "PLAN", "FIRST SEEN",
+               "LAST SEEN", "ACTIVE"]
+    rows = []
+    for a in accounts:
+        rows.append([
+            a["provider"] or "-",
+            account_label_from_row(a),
+            _dash(a["email"]),
+            _dash(a["plan_type"]),
+            _date_only(a["first_seen_utc"]),
+            _date_only(a["last_seen_utc"]),
+            "*" if a["account_key"] in active else "",
+        ])
+    print(_render_table(headers, rows))
+    return 0
+
+
+def account_label_from_row(a: dict) -> str:
+    """Label for a loaded registry row without a second DB round-trip."""
+    if a["label"]:
+        return a["label"]
+    if a["email"]:
+        return a["email"]
+    return (a["account_key"] or "")[:8] or "-"
+
+
+def _resolve_ref_or_exit(conn, ref: str) -> "str | None":
+    """Resolve a ref, printing candidates + returning None on error (exit 2)."""
+    try:
+        return _lib_accounts.resolve_account_ref(conn, ref)
+    except _lib_accounts.AccountRefError as exc:
+        eprint(f"account: ref {ref!r} is ambiguous or unknown")
+        if exc.candidates:
+            eprint("candidates:")
+            for cand in exc.candidates:
+                eprint(f"  {cand}")
+        return None
+
+
+def _cmd_account_show(args: argparse.Namespace) -> int:
+    ref = getattr(args, "ref", None)
+    conn = _cctally_core.open_db()
+    try:
+        key = _resolve_ref_or_exit(conn, ref)
+        if key is None:
+            return 2
+        row = conn.execute(
+            "SELECT account_key, provider, natural_id, email, label, plan_type, "
+            "label_source, first_seen_utc, last_seen_utc FROM accounts "
+            "WHERE account_key = ?", (key,)
+        ).fetchone()
+        a = ({col: row[i] for i, col in enumerate(_ACCOUNT_COLUMNS)}
+             if row is not None else None)
+        snap_count = _count_scoped(conn, "weekly_usage_snapshots", key)
+        milestone_count = _count_scoped(conn, "percent_milestones", key)
+    finally:
+        conn.close()
+    active = resolve_active_account_keys()
+    is_active = key in active
+    if getattr(args, "emit_json", False):
+        payload = {
+            "accountKey": key,
+            "provider": (a["provider"] if a else None),
+            "label": (a["label"] if a else None),
+            "email": (a["email"] if a else None),
+            "planType": (a["plan_type"] if a else None),
+            "labelSource": (a["label_source"] if a else None),
+            "firstSeenUtc": (a["first_seen_utc"] if a else None),
+            "lastSeenUtc": (a["last_seen_utc"] if a else None),
+            "active": is_active,
+            "attribution": {
+                "usageSnapshots": snap_count,
+                "percentMilestones": milestone_count,
+            },
+        }
+        print(json.dumps(_cctally().stamp_schema_version(payload)))
+        return 0
+
+    label = (account_label_from_row(a) if a else
+             ("Unattributed" if key == _lib_accounts.UNATTRIBUTED else key[:8]))
+    lines = [
+        f"Account:    {label}",
+        f"Key:        {key}",
+        f"Provider:   {_dash(a['provider'] if a else None)}",
+        f"Email:      {_dash(a['email'] if a else None)}",
+        f"Plan:       {_dash(a['plan_type'] if a else None)}",
+        f"Label from: {_dash(a['label_source'] if a else None)}",
+        f"First seen: {_dash(a['first_seen_utc'] if a else None)}",
+        f"Last seen:  {_dash(a['last_seen_utc'] if a else None)}",
+        f"Active:     {'yes' if is_active else 'no'}",
+        f"Attribution: {snap_count} usage snapshot(s), "
+        f"{milestone_count} percent milestone(s)",
+    ]
+    print("\n".join(lines))
+    return 0
+
+
+def _count_scoped(conn, table: str, account_key: str) -> int:
+    try:
+        row = conn.execute(
+            f"SELECT COUNT(*) FROM {table} WHERE account_key = ?", (account_key,)
+        ).fetchone()
+        return int(row[0]) if row else 0
+    except sqlite3.DatabaseError:
+        return 0
+
+
+def _cmd_account_label(args: argparse.Namespace) -> int:
+    ref = getattr(args, "ref", None)
+    label = getattr(args, "label", None)
+    conn = _cctally_core.open_db()
+    try:
+        key = _resolve_ref_or_exit(conn, ref)
+        if key is None:
+            return 2
+        provider_row = conn.execute(
+            "SELECT provider FROM accounts WHERE account_key = ?", (key,)
+        ).fetchone()
+        provider = provider_row[0] if provider_row is not None else None
+    finally:
+        conn.close()
+
+    import _cctally_journal as _jr
+    import _lib_journal as _lj
+    at = (_cctally_core._command_as_of()
+          .isoformat(timespec="seconds").replace("+00:00", "Z"))
+    _jr.append_record(_lj.make_account_label(
+        at=at, account_key=key, label=label, provider=provider))
+    _jr.run_stats_ingest(mode="authoritative")
+    print(f"Labeled {key[:8]} -> {label}")
+    return 0

package/bin/_cctally_alerts.py

@@ -68,6 +68,7 @@ def _load_lib(name: str):
     return mod
 
 
+_lib_accounts = _load_lib("_lib_accounts")
 _lib_alerts_payload = _load_lib("_lib_alerts_payload")
 _alert_text_weekly = _lib_alerts_payload._alert_text_weekly
 _alert_text_five_hour = _lib_alerts_payload._alert_text_five_hour
@@ -89,8 +90,10 @@ def _build_alert_payload_quota(
     observed_slot: str, window_minutes: int, resets_at_utc: str,
     threshold: int, kind: str, crossed_at_utc: str,
     qualifying_percent: float | None, projected_percent: float | None,
+    account_key: str = _lib_accounts.UNATTRIBUTED,
 ) -> dict:
-    """Build the provider-neutral durable quota alert payload."""
+    """Build the provider-neutral durable quota alert payload. ``account_key``
+    (#341) is the observation's account (per-account family)."""
     context = {
         "source": str(source), "source_root_key": str(source_root_key),
         "logical_limit_key": str(logical_limit_key), "observed_slot": str(observed_slot),
@@ -111,6 +114,7 @@ def _build_alert_payload_quota(
         ),
         "axis": "quota", "threshold": int(threshold), "kind": str(kind),
         "crossed_at": crossed_at_utc, "alerted_at": crossed_at_utc,
+        "account_key": str(account_key),
         **context, "context": context,
     }
 
@@ -158,6 +162,48 @@ def load_config(*args, **kwargs):
 from _cctally_core import now_utc_iso
 
 
+# Axis -> the provider whose account registry drives the R8 `[label]` prefix.
+# projected weekly_pct is Claude; its `*`-scoped vendor-budget metrics never take
+# a prefix (account_key stays `*`), so mapping the whole axis to claude is safe.
+_AXIS_VENDOR = {
+    "weekly": "claude", "five_hour": "claude", "budget": "claude",
+    "projected": "claude", "project_budget": "claude",
+    "codex_budget": "codex", "quota": "codex",
+}
+
+
+def _alert_label_prefix(axis: str, account_key: "str | None") -> str:
+    """Return ``"[<label>] "`` for an account-specific crossing when the vendor
+    has >1 real account (R8), else ``""``. Best-effort + never-raise: a missing
+    DB / read error / vendor-wide (`*`) row yields no prefix, so a ≤1-real-account
+    install's alert text stays byte-identical to today.
+
+    Delegates the R8 gate + label precedence to the single-definition helpers
+    ``_cctally_account.real_account_count`` / ``account_label`` (P2-CQ1) so the
+    ">1 real account" trigger and the key->label map have exactly one home; this
+    wrapper only opens the RO connection and stays best-effort/never-raise."""
+    if not account_key or account_key == _lib_accounts.VENDOR_WIDE:
+        return ""
+    vendor = _AXIS_VENDOR.get(axis)
+    if vendor is None:
+        return ""
+    try:
+        import sqlite3 as _sq
+        import _cctally_account
+        db_path = _cctally_core.DB_PATH
+        if not db_path.exists():
+            return ""
+        conn = _sq.connect(f"file:{db_path}?mode=ro", uri=True)
+        try:
+            if _cctally_account.real_account_count(conn, vendor) <= 1:
+                return ""
+            return f"[{_cctally_account.account_label(conn, account_key)}] "
+        finally:
+            conn.close()
+    except Exception:
+        return ""
+
+
 def _alerts_log_path() -> "pathlib.Path":
     """Return ``~/.local/share/cctally/logs/alerts.log`` (parent dirs created).
 
@@ -240,6 +286,12 @@ def _dispatch_alert_notification(
             f"axis={axis} threshold={payload.get('threshold')}",
         )
 
+    # R8 label prefix (#341): an account-specific crossing gains a `[<label>] `
+    # title prefix ONLY when the vendor has >1 real account. Byte-identical at
+    # <=1 real account (empty prefix). Applied to the notification title only.
+    account_key = payload.get("account_key")
+    title = _alert_label_prefix(axis, account_key) + title
+
     # Severity (3-tier) drives both the notify-send urgency token and the
     # trailing log column. A missing threshold (defensive — shouldn't happen for
     # a real crossing) floors at "info".
@@ -308,9 +360,13 @@ def _dispatch_alert_notification(
             or ctx.get("period_start_at")
             or ""
         )
+        # 8th tab field (#341, spec §6): the account_key the crossing wrote
+        # under (`*` for vendor-wide rows). UNCONDITIONAL — the log is runtime
+        # state, exempt from the R8 byte-stability contract.
+        log_account_key = account_key or _lib_accounts.VENDOR_WIDE
         line = (
             f"{now_utc_iso()}\t{axis}\t{payload.get('threshold')}\t{window_key}"
-            f"\t{mode}\t{status}\t{severity}\n"
+            f"\t{mode}\t{status}\t{severity}\t{log_account_key}\n"
         )
         with open(log_path, "a") as f:
             f.write(line)