cctally 1.90.1 → 1.92.0

package/bin/_cctally_dashboard_conversation.py

@@ -45,6 +45,7 @@ import sys
 
 from _cctally_cache import (
     open_cache_db,
+    scope_conversations_db_to_account,
     sync_codex_cache,
     sync_claude_conversations,
     sync_codex_conversations,
@@ -222,13 +223,15 @@ def _conversation_query_impl():
 # are deliberately absent — they are meaningless on a collection route, so they
 # fall to "genuinely unknown → ignored".
 _RECOGNIZED_CONVERSATION_PARAMS = (
-    "source", "project_key", "model", "limit", "cursor", "q", "kind",
+    "source", "account", "project_key", "model", "limit", "cursor", "q", "kind",
     "sort", "offset", "date_from", "date_to", "projects",
     "cost_min", "cost_max", "rebuild_min", "models",
 )
-_QUALIFIED_BROWSE_ACCEPTED = ("source", "project_key", "model", "limit", "cursor")
-_QUALIFIED_SEARCH_ACCEPTED = ("source", "q", "kind", "limit", "cursor")
-_QUALIFIED_FACETS_ACCEPTED = ("source",)
+_QUALIFIED_BROWSE_ACCEPTED = (
+    "source", "account", "project_key", "model", "limit", "cursor")
+_QUALIFIED_SEARCH_ACCEPTED = (
+    "source", "account", "q", "kind", "limit", "cursor")
+_QUALIFIED_FACETS_ACCEPTED = ("source", "account")
 # A raw browse cursor is a conversation key — printable + URL-safe by construction
 # (§2.2). Syntactic-only validation: reject whitespace/control/empty; echo raw.
 _BROWSE_CURSOR_RE = re.compile(r"\A[!-~]+\Z")
@@ -321,8 +324,12 @@ def _respond_qualified_json(handler, env):
     ``ok`` / ``normalization_pending`` → 200; ``gone`` → 410; ``validation_error``
     → 400; anything else (``not_found`` + unknown) → 404. Body is the envelope."""
     status = (env or {}).get("status")
-    if status in ("ok", "normalization_pending"):
+    if status in ("ok", "normalization_pending", "ready", "indexing"):
         handler._respond_json(200, env)
+    elif status == "invalid_find_cursor":
+        handler._respond_json(400, {"error": "invalid find cursor"})
+    elif status == "stale_find_cursor":
+        handler._respond_json(409, {"error": "stale find cursor"})
     elif status == "gone":
         handler._respond_json(410, env)
     elif status == "validation_error":
@@ -378,7 +385,7 @@ def _handle_qualified_facets(handler, qs_raw, source):
     speed = _resolve_effective_speed()
     disp = _conversation_dispatch()
     ok, body = handler._run_conversation_query(
-        lambda conn: disp.neutral_browse(
+        lambda conn: disp.neutral_facets(
             conn, source=source, effective_speed=speed),
         "/api/conversations/facets")
     if not ok:
@@ -469,6 +476,15 @@ def _run_conversation_query_impl(handler, kernel_call, log_label):
         )
         return False, None
     try:
+        import urllib.parse as _u
+        account_vals = _u.parse_qs(
+            handler.path.partition("?")[2], keep_blank_values=True
+        ).get("account")
+        if account_vals is not None:
+            if len(account_vals) != 1 or not account_vals[0]:
+                handler._respond_json(400, {"error": "invalid account"})
+                return False, None
+            scope_conversations_db_to_account(conn, account_vals[0])
         body = kernel_call(conn)
     except Exception as exc:  # noqa: BLE001
         handler.log_error("%s failed: %r", log_label, exc)
@@ -794,25 +810,59 @@ def _run_conversation_events_stream(
                     idle = 0.0
 
 
-def _bare_conversation_events(handler, session_id: str) -> None:
+def _bare_conversation_events(
+    handler, session_id: str, account_key: str | None = None,
+) -> None:
     """Bare legacy Claude live-tail — today's no-preflight, ``sessionId``-framed
     behavior, byte-identical (spec §5.2 reserves this for bare streams)."""
     cq = handler._conversation_query()
-    _send_sse_headers(handler)
     passive = bool(type(handler).no_sync)
     try:
         conn = sys.modules["_cctally_dashboard"].open_conversations_db()
     except (sqlite3.DatabaseError, OSError):
-        # Cache unavailable — degrade to keep-alive only; client backstop
-        # tick still surfaces turns. (Headers already sent; can't 500.)
+        if account_key is not None:
+            # A qualified account boundary must be established before any SSE
+            # bytes.  If it cannot be proven, fail closed as JSON.
+            handler._respond_json(500, {"error": "internal error"})
+            return
+        # Unqualified legacy behavior: degrade to keep-alive only; the client
+        # backstop tick still surfaces turns.
         passive = True
         conn = None
+    if conn is not None and account_key is not None:
+        scope_conversations_db_to_account(conn, account_key)
+        if conn.execute(
+            "SELECT 1 FROM conversation_messages WHERE session_id=? LIMIT 1",
+            (session_id,),
+        ).fetchone() is None:
+            conn.close()
+            handler._respond_json(404, {"error": "conversation not found"})
+            return
+    _send_sse_headers(handler)
 
     def _resolve():
         return cq.session_source_paths(conn, session_id) if conn else []
 
     def _ingest(changed):
-        return sync_claude_conversations(conn, only_paths=set(changed))
+        if account_key is None:
+            return sync_claude_conversations(conn, only_paths=set(changed))
+        before = conn.execute(
+            "SELECT COUNT(*),MAX(id) FROM conversation_messages "
+            "WHERE session_id=?",
+            (session_id,),
+        ).fetchone()
+        writer = sys.modules["_cctally_dashboard"].open_conversations_db()
+        try:
+            stats = sync_claude_conversations(writer, only_paths=set(changed))
+        finally:
+            writer.close()
+        after = conn.execute(
+            "SELECT COUNT(*),MAX(id) FROM conversation_messages "
+            "WHERE session_id=?",
+            (session_id,),
+        ).fetchone()
+        stats.targeted_visible = after != before
+        return stats
 
     try:
         _run_conversation_events_stream(
@@ -895,7 +945,9 @@ def _make_codex_discovery_step(handler, conn, conversation_key, cq_codex):
     return _discovery
 
 
-def _qualified_conversation_events(handler, key: str) -> None:
+def _qualified_conversation_events(
+    handler, key: str, account_key: str | None = None,
+) -> None:
     """Qualified (``v1.``) live-tail (spec §5.2): a neutral preflight — resolve →
     normalization authority (Codex) → existence — answered as plain JSON per
     §2.3 BEFORE any SSE bytes; only on ``ok`` are SSE headers committed and the
@@ -924,6 +976,8 @@ def _qualified_conversation_events(handler, key: str) -> None:
         except Exception as exc:  # noqa: BLE001
             handler.log_error("api/conversation/events stream failed: %r", exc)
         return
+    if account_key is not None:
+        scope_conversations_db_to_account(conn, account_key)
 
     try:
         preflight = disp.neutral_events_preflight(conn, key)
@@ -959,10 +1013,43 @@ def _qualified_conversation_events(handler, key: str) -> None:
             return cq_codex.codex_conversation_source_paths(conn, key)
 
         def _ingest(changed):
-            return sync_codex_conversations(conn, only_paths=set(changed))
+            if account_key is None:
+                return sync_codex_conversations(conn, only_paths=set(changed))
+            before = conn.execute(
+                "SELECT COUNT(*),MAX(id) FROM codex_conversation_messages "
+                "WHERE conversation_key=?",
+                (key,),
+            ).fetchone()
+            # The accounting cache owns the durable physical account-range
+            # decision. Advance it first so transcript ingest never treats the
+            # previous range as open-ended across an account switch.
+            accounting = open_cache_db()
+            try:
+                accounting_stats = sync_codex_cache(
+                    accounting, only_paths=set(changed)
+                )
+            finally:
+                accounting.close()
+            if not accounting_stats.targeted_clean:
+                return accounting_stats
+            writer = sys.modules["_cctally_dashboard"].open_conversations_db()
+            try:
+                stats = sync_codex_conversations(writer, only_paths=set(changed))
+            finally:
+                writer.close()
+            after = conn.execute(
+                "SELECT COUNT(*),MAX(id) FROM codex_conversation_messages "
+                "WHERE conversation_key=?",
+                (key,),
+            ).fetchone()
+            stats.targeted_visible = after != before
+            return stats
 
         cached = lambda paths: _codex_cached_file_sigs(conn, paths)
-        discovery = _make_codex_discovery_step(handler, conn, key, cq_codex)
+        discovery = (
+            None if account_key is not None
+            else _make_codex_discovery_step(handler, conn, key, cq_codex)
+        )
     else:  # claude — reuse the Claude mechanics, speak qualified frames.
         cq = handler._conversation_query()
 
@@ -970,7 +1057,25 @@ def _qualified_conversation_events(handler, key: str) -> None:
             return cq.session_source_paths(conn, native)
 
         def _ingest(changed):
-            return sync_claude_conversations(conn, only_paths=set(changed))
+            if account_key is None:
+                return sync_claude_conversations(conn, only_paths=set(changed))
+            before = conn.execute(
+                "SELECT COUNT(*),MAX(id) FROM conversation_messages "
+                "WHERE session_id=?",
+                (native,),
+            ).fetchone()
+            writer = sys.modules["_cctally_dashboard"].open_conversations_db()
+            try:
+                stats = sync_claude_conversations(writer, only_paths=set(changed))
+            finally:
+                writer.close()
+            after = conn.execute(
+                "SELECT COUNT(*),MAX(id) FROM conversation_messages "
+                "WHERE session_id=?",
+                (native,),
+            ).fetchone()
+            stats.targeted_visible = after != before
+            return stats
 
         cached = lambda paths: _cached_file_sigs(conn, paths)
         discovery = None
@@ -999,14 +1104,23 @@ def _handle_get_conversation_events_impl(handler, path: str) -> None:
     if not handler._require_transcripts_allowed():
         return
     import urllib.parse as _u
+    account_vals = _u.parse_qs(
+        handler.path.partition("?")[2], keep_blank_values=True
+    ).get("account")
+    if account_vals is not None and (
+        len(account_vals) != 1 or not account_vals[0]
+    ):
+        handler._respond_json(400, {"error": "invalid account"})
+        return
+    account_key = account_vals[0] if account_vals else None
     key = _u.unquote(path[len("/api/conversation/"):-len("/events")])
     if not key:
         handler.send_error(404, "conversation not found")
         return
     if key.startswith("v1."):
-        _qualified_conversation_events(handler, key)
+        _qualified_conversation_events(handler, key, account_key)
     else:
-        _bare_conversation_events(handler, key)
+        _bare_conversation_events(handler, key, account_key)
 
 
 def _handle_get_conversation_search_impl(handler) -> None:
@@ -1407,10 +1521,42 @@ def _handle_get_conversation_find_impl(handler, path: str) -> None:
             return
     if session_id.startswith("v1."):
         disp = _conversation_dispatch()
+        cref = disp.resolve_conversation_ref(session_id)
+        paging = {}
+        if cref is not None and cref.source == "codex":
+            raw_limit = _qs_str(q, "limit", None)
+            if raw_limit is None:
+                limit = 100
+            else:
+                try:
+                    limit = int(raw_limit)
+                except (TypeError, ValueError):
+                    handler._respond_json(400, {"error": "invalid find limit"})
+                    return
+                if not 1 <= limit <= 200:
+                    handler._respond_json(400, {"error": "invalid find limit"})
+                    return
+            cursor = _qs_str(q, "cursor", None)
+            around = _qs_str(q, "around", None)
+            direction = _qs_str(q, "direction", "next")
+            if direction not in ("next", "previous"):
+                handler._respond_json(400, {"error": "invalid find direction"})
+                return
+            if cursor is not None and around is not None:
+                handler._respond_json(
+                    400, {"error": "find cursor and around are mutually exclusive"})
+                return
+            paging = {
+                "limit": limit,
+                "cursor": cursor,
+                "direction": direction,
+                "around": around,
+            }
         _serve_qualified_entity(
             handler,
             lambda conn: disp.neutral_find(
-                conn, session_id, query, kind=kind, regex=regex, case=case),
+                conn, session_id, query, kind=kind, regex=regex, case=case,
+                **paging),
             "/api/conversation/find")
         return
     ok, body = handler._run_conversation_query(

package/bin/_cctally_dashboard_envelope.py

@@ -41,6 +41,7 @@ import bisect
 import datetime as dt
 import importlib.util as _ilu
 import os
+import sqlite3
 import sys
 from collections.abc import Mapping
 from zoneinfo import ZoneInfo
@@ -329,7 +330,40 @@ def _select_current_block_for_envelope(
 # ``FROM`` clause so the table name lives in the registry, not inlined here.
 
 
-def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
+def _alert_account_resolver(conn: sqlite3.Connection):
+    """Build one snapshot-scoped #345 resolver without per-row DB reads."""
+    import _cctally_account
+
+    decorated = {
+        provider: _cctally_account.provider_is_decorated(conn, provider)
+        for provider in ("claude", "codex")
+    }
+    labels = {
+        provider: _cctally_account.display_label_map(conn, provider)
+        for provider, enabled in decorated.items()
+        if enabled
+    }
+    for provider_labels in labels.values():
+        provider_labels.update({"*": "All accounts", "unattributed": "Unattributed"})
+
+    def fields(provider: str, account_key: object) -> dict[str, str]:
+        if not decorated.get(provider, False):
+            return {}
+        key = str(account_key or "*")
+        label = labels[provider].get(key)
+        if label is None:
+            label = _cctally_account.account_label(conn, key)
+        return {
+            "accountKey": key,
+            "accountLabel": label,
+        }
+
+    return fields
+
+
+def _envelope_rows_weekly(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # ``reset_event_id`` (v1.7.2) segments the same (week, threshold)
     # across pre-credit (0) and post-credit (event.id) cohorts, both
     # of which can be alerted. The envelope id must include the
@@ -340,7 +374,7 @@ def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
     rows = conn.execute(
         f"""
         SELECT week_start_date, percent_threshold, captured_at_utc,
-               alerted_at, cumulative_cost_usd, reset_event_id
+               alerted_at, cumulative_cost_usd, reset_event_id, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -360,6 +394,7 @@ def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
             "severity": severity_for(threshold),
             "crossed_at": r["captured_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields("claude", r["account_key"]),
             "context": {
                 "week_start_date":     r["week_start_date"],
                 "cumulative_cost_usd": cumulative,
@@ -377,7 +412,9 @@ def _envelope_rows_weekly(conn, descriptor, limit, severity_for) -> list[dict]:
     return out
 
 
-def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_five_hour(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Site F (spec §3.2 bucket C / §3.3): widen the row identity to
     # include ``reset_event_id`` so post-credit (seg=event.id) crossings
     # of the same (window_key, threshold) don't collide with pre-credit
@@ -387,10 +424,12 @@ def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict
     rows = conn.execute(
         f"""
         SELECT m.five_hour_window_key, m.percent_threshold, m.captured_at_utc,
-               m.alerted_at, m.block_cost_usd, m.reset_event_id,
+               m.alerted_at, m.block_cost_usd, m.reset_event_id, m.account_key,
                b.block_start_at
         FROM {descriptor.milestone_table} m
-        LEFT JOIN five_hour_blocks b ON b.five_hour_window_key = m.five_hour_window_key
+        LEFT JOIN five_hour_blocks b
+          ON b.five_hour_window_key = m.five_hour_window_key
+         AND b.account_key = m.account_key
         WHERE m.alerted_at IS NOT NULL
         ORDER BY m.alerted_at DESC
         LIMIT ?
@@ -410,6 +449,7 @@ def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict
             "severity":    severity_for(threshold),
             "crossed_at":  r["captured_at_utc"],
             "alerted_at":  r["alerted_at"],
+            **account_fields("claude", r["account_key"]),
             "context": {
                 "five_hour_window_key": int(r["five_hour_window_key"]),
                 "block_start_at":       r["block_start_at"] or "",
@@ -420,7 +460,9 @@ def _envelope_rows_five_hour(conn, descriptor, limit, severity_for) -> list[dict
     return out
 
 
-def _envelope_rows_budget_family(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_budget_family(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Unified vendor-tagged budget axis (#143). ONE mapper backs BOTH the
     # ``budget`` (``vendor='claude'``, issue #19) and ``codex_budget``
     # (``vendor='codex'``, calendar-period-codex-budgets spec §6) axes —
@@ -461,7 +503,7 @@ def _envelope_rows_budget_family(conn, descriptor, limit, severity_for) -> list[
         SELECT period_start_at,
                COALESCE(period, ?) AS period,
                threshold, crossed_at_utc, alerted_at,
-               budget_usd, spent_usd, consumption_pct
+               budget_usd, spent_usd, consumption_pct, account_key
         FROM {descriptor.milestone_table}
         WHERE vendor = ? AND alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -498,12 +540,15 @@ def _envelope_rows_budget_family(conn, descriptor, limit, severity_for) -> list[
             "severity":   severity_for(threshold),
             "crossed_at": r["crossed_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields(str(vendor), r["account_key"]),
             "context":    ctx,
         })
     return out
 
 
-def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_projected(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Fourth axis (issue #121): projected-pace threshold crossings. Like
     # budget, projected alerts re-anchor ``week_start_at`` on a mid-week
     # reset, so there is NO ``reset_event_id`` segment — the new window gets
@@ -524,7 +569,7 @@ def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict
         SELECT week_start_at,
                COALESCE(period, 'subscription-week') AS period,
                metric, threshold, projected_value,
-               denominator, crossed_at_utc, alerted_at
+               denominator, crossed_at_utc, alerted_at, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -547,6 +592,10 @@ def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict
             "severity":   severity_for(threshold),
             "crossed_at": r["crossed_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields(
+                "codex" if metric == "codex_budget_usd" else "claude",
+                r["account_key"],
+            ),
             "context": {
                 "week_start_at":   r["week_start_at"],
                 "metric":          metric,
@@ -557,7 +606,9 @@ def _envelope_rows_projected(conn, descriptor, limit, severity_for) -> list[dict
     return out
 
 
-def _envelope_rows_project_budget(conn, descriptor, limit, severity_for) -> list[dict]:
+def _envelope_rows_project_budget(
+    conn, descriptor, limit, severity_for, account_fields,
+) -> list[dict]:
     # Fifth axis (issue #19 / #121): PER-PROJECT equiv-$ budget threshold
     # crossings. Like the global budget axis, project-budget alerts re-anchor
     # ``week_start_at`` on a mid-week reset, so there is NO ``reset_event_id``
@@ -575,7 +626,7 @@ def _envelope_rows_project_budget(conn, descriptor, limit, severity_for) -> list
     rows = conn.execute(
         f"""
         SELECT week_start_at, project_key, threshold, budget_usd, spent_usd,
-               consumption_pct, crossed_at_utc, alerted_at
+               consumption_pct, crossed_at_utc, alerted_at, account_key
         FROM {descriptor.milestone_table}
         WHERE alerted_at IS NOT NULL
         ORDER BY alerted_at DESC
@@ -605,6 +656,7 @@ def _envelope_rows_project_budget(conn, descriptor, limit, severity_for) -> list
             "severity":   severity_for(threshold),
             "crossed_at": r["crossed_at_utc"],
             "alerted_at": r["alerted_at"],
+            **account_fields("claude", r["account_key"]),
             "context": {
                 "week_start_at":   r["week_start_at"],
                 "project":         label_by_key.get(project_key, project_key),
@@ -795,12 +847,15 @@ def _build_alerts_envelope_array(
     c = sys.modules["cctally"]
     registry = c.AXIS_REGISTRY
     severity_for = c.severity_for
+    account_fields = _alert_account_resolver(conn)
     out: list[dict] = []
     for descriptor in registry:
         mapper = _ENVELOPE_AXIS_MAPPERS.get(descriptor.id)
         if mapper is None:  # pragma: no cover - registry/mapper drift guard
             continue
-        out.extend(mapper(conn, descriptor, limit, severity_for))
+        out.extend(mapper(
+            conn, descriptor, limit, severity_for, account_fields,
+        ))
 
     # Python's list.sort is stable. When two alerts share the same
     # `alerted_at` ISO string (rare; multiple axes firing within the same
@@ -1363,9 +1418,11 @@ def snapshot_to_envelope(snap: "DataSnapshot", *,
         _cfg_for_alerts.get("dashboard"), dict) else {}
     _cfm = _dash_cfg.get("cache_failure_markers", True)
     _lt = _dash_cfg.get("live_tail", True)
+    _lan_auth = _dash_cfg.get("lan_auth", True)
     dashboard_prefs = {
         "cache_failure_markers": _cfm if isinstance(_cfm, bool) else True,
         "live_tail": _lt if isinstance(_lt, bool) else True,
+        "lan_auth": _lan_auth if isinstance(_lan_auth, bool) else True,
     }
 
     # Mirror update-state.json + update-suppress.json into the envelope

package/bin/_cctally_dashboard_sources.py

@@ -2422,9 +2422,29 @@ def _alerts_wire(
     so it stays visible under focus and the client labels it as vendor-wide.
     """
     rows: list[dict[str, object]] = []
+    if decorated:
+        import _cctally_account
+
+        account_labels = _cctally_account.display_label_map(stats_conn, "codex")
+        account_labels.update({"*": "All accounts", "unattributed": "Unattributed"})
+    else:
+        account_labels = {}
 
     def _account(value: object) -> dict[str, object]:
-        return {"account_key": str(value or _CODEX_VENDOR_WIDE_ACCOUNT)} if decorated else {}
+        if not decorated:
+            return {}
+
+        key = str(value or _CODEX_VENDOR_WIDE_ACCOUNT)
+        label = account_labels.get(key)
+        if label is None:
+            label = _cctally_account.account_label(stats_conn, key)
+        return {
+            # Retained as the internal account-scope selector used by the
+            # source-state builder; the camel fields are the public #345 wire.
+            "account_key": key,
+            "accountKey": key,
+            "accountLabel": label,
+        }
 
     try:
         for period, threshold, consumption_pct, crossed_at, account_key in stats_conn.execute(
@@ -2880,6 +2900,12 @@ def _codex_accounts_wire(
         }
         if is_unattributed:
             card["unattributed"] = True
+        elif cyc is not None and cyc.evidence_stale:
+            # #360 / #416 closeout: freshness belongs to the account whose
+            # resolved cycle supplied the card. The aggregate hero marker
+            # cannot speak for a fresh sibling, and staleness is disclosure
+            # only — the retained percentage, reset and spend remain useful.
+            card["cycleFreshness"] = "stale"
         accounts_wire.append(card)
         if cyc is not None and not is_unattributed:
             hero_cycles_wire.append({