ccusage-tracker 0.1.7 → 0.2.0

package/README.md

@@ -1,23 +1,52 @@
 # ccusage-tracker
 
-CLI for [ccusage-tracker](https://github.com/ericcai0814/ccusage-tracker) — a self-hosted Claude Code usage tracker for teams.
+CLI for [ccusage-tracker](https://github.com/ericcai0814/ccusage-tracker), a self-hosted Claude Code and Codex usage tracker for teams.
 
-Install Claude Code SessionStart/SessionEnd/Stop hooks that report token usage to a self-hosted tracker server. Runs on macOS, Linux, and Windows.
+Reports usage from local subscription/OAuth logs. No model API key is needed, and reporting does not upload prompts, responses, or tool results. The tracker team key is a separate server access credential.
 
 ## Quick start
 
 ```bash
-npx ccusage-tracker setup
+npx ccusage-tracker@latest setup
 ```
 
 You'll be asked for your name, the team's server URL, and a team key (ask your admin).
 
+Setup detects which supported tools exist on this machine and wires automatic reporting for each of them: Claude Code hooks in `~/.claude/settings.json`, Codex hooks in `$CODEX_HOME/hooks.json`. It installs the verified collector when missing, and never modifies `$CODEX_HOME/config.toml`.
+
+Codex needs one extra, platform-mandated step: **open Codex and run `/hooks` once to trust the ccusage-tracker hooks.** Codex silently skips hooks it has not been told to trust. Codex can run independently without Claude Code installed.
+
+## Updating an existing installation
+
+```bash
+npx ccusage-tracker@latest update
+```
+
+`update` asks no questions and reuses the existing configuration, running the same detection, hook installation and collector step as `setup`. It preserves the exact config bytes, buffered usage, session data, and unrelated settings/hooks in both files. All required scripts are downloaded and syntax-checked before installation; `settings.json` and `hooks.json` are written in one transaction, so a failure in either leaves both untouched. Changed files are backed up. Repeated updates do not duplicate tracker hooks and leave both files byte-identical.
+
+Third-party Codex hook groups keep their exact bytes and their position: the tracker group is only appended at the end of the event array, or replaced in place at its own index. Codex trust keys are built from group indexes, so reordering would invalidate the trust of every hook after the moved one.
+
+Missing/invalid configuration, download failures, or installation failures return a nonzero exit status; run `setup` if configuration is missing. When neither Claude Code nor Codex is detected, `update` returns nonzero and tells you to install one first (`setup` still saves the configuration and exits 0).
+
+`@latest` runs the latest **published CLI**. It does not refresh server-downloaded hooks by itself: `update` downloads those scripts, and new hook features require the corresponding server deployment. A server returning 404/410 for the optional Codex script keeps the Claude installation working, leaves `$CODEX_HOME/hooks.json` untouched (a hook pointing at a missing script is worse than no hook), and prints a compatibility message. Other failures abort the update.
+
+For a global installation, update the CLI package and hooks separately:
+
+```bash
+npm install -g ccusage-tracker@latest
+tracker update
+```
+
+There is no universal `npx update` command.
+
 ## Commands
 
 ```
 ccusage-tracker setup    Install hooks and configure server connection
+ccusage-tracker update   Refresh scripts/hooks using existing configuration
+ccusage-tracker sync codex  Report Codex usage now (manual fallback / debugging)
 ccusage-tracker report   View team token usage report
-ccusage-tracker status   Check current configuration status
+ccusage-tracker status   Check configuration and each source's upload status
 ```
 
 After installation, the binary is also available as `tracker` (if installed globally with `npm i -g ccusage-tracker`).
@@ -30,11 +59,79 @@ After installation, the binary is also available as `tracker` (if installed glob
 - **Stop** — primary reporting path: POSTs token usage + session metrics after each assistant turn, throttled to once per 5 minutes
 - **SessionEnd** — backup path: same payload at session exit, in case Stop missed the last window
 
-Hook scripts are downloaded from your tracker server, so they always match the server version. Re-running `setup` migrates old (no `--mode`) commands and unquoted tracker hook paths in-place — no manual cleanup needed.
+For Codex it appends two groups to `$CODEX_HOME/hooks.json` (default `~/.codex/hooks.json`), each a single `node "<path>/codex-sync.mjs" --hook` command with a 45 second timeout and no `matcher` key:
+
+- **Stop** — reports after each turn, throttled to once per 5 minutes
+- **SessionEnd** — backup path at session exit
+
+The hook process only reads `hook_event_name` from the event on stdin and hands the work to a detached background worker; it never blocks Codex and never forwards payload content. The command string is byte-identical across updates, so refreshing the scripts does not require re-trusting the hooks.
+
+Hook scripts come from your configured tracker server. Setup/update migrate old tracker commands and quote paths containing spaces. Existing shell/PowerShell installers remain Claude-only; they do not install Codex reporting.
+
+When `settings.json` or `hooks.json` is a symbolic link (dotfiles setups), the CLI writes through to the real file and leaves the link in place; the `.backup` is written next to the real file. A link that dangles or resolves to anything other than a regular file is refused, and the whole transaction is rolled back.
+
+### Collector
+
+Setup and update run the same collector step, and only when at least one supported tool is detected. When `ccusage` is missing, the CLI prints and runs `npm install -g ccusage@20.0.20`. That is a global npm install: it downloads the package from the registry and runs its install-time (lifecycle) scripts. If you would rather install the collector yourself, set `CCUSAGE_TRACKER_SKIP_COLLECTOR_INSTALL=1` before running setup or update — the CLI then only prints the command. When a different major version is installed, it warns that Claude reporting works but Codex requires 20.0.20, and does not replace it; the same check applies to the version probed right after an automatic install, since another `ccusage` earlier on PATH may win. A failed install never changes the exit status of setup or update — `status` reports what is missing.
+
+## Codex usage
+
+Keep your existing ChatGPT subscription/OAuth login. Make sure `ccusage` is on both your terminal's and Codex's PATH — setup installs it for you when it is missing.
+
+```bash
+# First installation; existing users run update instead.
+npx ccusage-tracker@latest setup
+
+# Then, inside Codex, trust the hooks once:
+/hooks
+
+npx ccusage-tracker@latest status
+npx ccusage-tracker@latest report --period today --json
+```
+
+### Trust the hooks once
+
+Codex **silently skips** hooks it has not been told to trust, so "installed but never runs" is the most likely way this fails. After setup or update, run `/hooks` inside Codex and trust the ccusage-tracker entries. Codex records that in its own `config.toml`.
+
+`status` prints one `Codex hooks:` line:
+
+| Output | Meaning |
+|---|---|
+| `installed, trust recorded` | Hooks are installed and a matching trust record exists |
+| `installed, awaiting trust (open /hooks in Codex)` | Installed, but Codex will not run them yet |
+| `installed, disabled in Codex` | You disabled them inside Codex |
+| `not installed` | Not wired yet — run `update` |
+
+The CLI only reads `config.toml` to see whether a trust record exists. It never validates the hash (Codex's algorithm is internal, hence "trust recorded" rather than "trusted") and never writes `hooks.state` on your behalf.
+
+### Manual fallback
+
+`sync codex` remains available for manual reporting and debugging; normal operation does not depend on it. It waits for the result, returns nonzero on failure, and ignores the five-minute throttle, so it is the way to confirm the final usage right now.
+
+```bash
+npx ccusage-tracker@latest sync codex
+```
+
+Status shows the Codex script/collector, hook trust state, pending buffer, last error, and last successful upload. No readable usage means “no data,” without a fabricated zero snapshot.
+
+### The old notify entry (deprecated)
+
+Earlier versions asked you to add `notify = [... "--notify"]` to `$CODEX_HOME/config.toml` by hand. Hooks now handle automatic reporting and that path is kept only for compatibility. If you configured it, remove the tracker entry yourself to avoid triggering twice — setup/update warn when they see it but **never edit the TOML**. Leaving it in place cannot corrupt the data: same-day snapshots are idempotent, the lock is exclusive, and both trigger paths share the same five-minute throttle. Remove the tracker group from `hooks.json` (and the notify entry, if any) before uninstalling tracker; the uninstall script edits neither file.
+
+### Accounting and limits
+
+- The verified `ccusage 20.0.20 codex daily --json` output is `{daily, totals}` with `costUSD` and a `models` object. Its input already excludes cache reads. Raw input 1000, cached input 400, output 200, and reasoning 50 become **600 + 400 + 200 = 1200** tokens. Reasoning is already in output; cache creation is zero.
+- Claude retains `daily`; Codex uses `codex-daily`. Each is an idempotent member/date snapshot, so repeats update rather than duplicate usage. Reports add the two sources once. Costs are API-equivalent estimates, not subscription invoices.
+- Verified published collectors are Claude `18.0.9`/`18.0.10` and Claude/Codex `20.0.20`; these are evidence, not an exact patch whitelist. The legacy family (major <=19) retains `daily --json --since`; major 20 requires explicit `claude daily` or `codex daily`, with day/timezone flags and schema validation on every result. Unknown majors (such as 99), unsupported commands, and invalid schemas fail visibly without falling back to unified daily. `20.0.21` is a synthetic compatibility fixture, not a tested published release; untested versions are not guaranteed. The separate `@ccusage/codex 19.0.0`/`ccusage-codex` package is not used.
+- Sync collects the current local day only, with no historical backfill. Keep original compact Codex JSONL: the tested native collector can skip reformatted logs. The server's Today filter uses UTC; use `--period month` or the daily API when local and UTC dates differ.
+- Codex has its own lock, buffer, and error/success markers in `~/.config/ccusage-tracker/`. Failed snapshots remain until delivered; newer same-day snapshots replace stale ones before retry. Claude keeps its separate buffer and five-minute Stop throttle. Codex hook and legacy notify triggers share their own five-minute throttle recorded in `codex-last-flush.txt` and skip overlapping syncs; manual sync ignores the throttle and can confirm the final usage.
+- An interrupted stale-lock recovery can leave `codex-worker.lock.reclaim` or `worker.lock.reclaim`. If the reported recovery error persists, stop the corresponding workers before removing only that marker and retrying.
+- Codex session behavior analytics are outside this feature.
 
 ## Requirements
 
-- Node.js 18+
+- Tracker CLI/scripts: Node.js 18+; macOS, Linux, and Windows paths are supported. Runtime verification used Node 24 and Node 18.20.8 on macOS, including paths with spaces; other operating systems were not executed. Node 18 fixtures declare ES modules explicitly, matching the CLI package metadata.
+- Collector: `ccusage@20.0.20` is the verified Codex installation choice, using its platform-specific native package (verified on macOS arm64). Compatible major-20 patches are not rejected solely for their patch number. Claude-only `ccusage@18.0.9`/`18.0.10` require Node >=20.19.4 independently of tracker's engine. The unused standalone `@ccusage/codex@19.0.0` requires Node >=22.
 - A running ccusage-tracker server (see [main repo](https://github.com/ericcai0814/ccusage-tracker) for self-hosting)
 
 ## License

package/dist/index.js

@@ -2,7 +2,6 @@
 
 // src/commands/setup.ts
 import { createInterface } from "node:readline";
-import { spawnSync } from "node:child_process";
 
 // src/config.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
@@ -19,11 +18,25 @@ function readConfig() {
   if (!existsSync(path))
     return null;
   try {
-    return JSON.parse(readFileSync(path, "utf-8"));
+    const value = JSON.parse(readFileSync(path, "utf-8"));
+    return isTrackerConfig(value) ? value : null;
   } catch {
     return null;
   }
 }
+function isTrackerConfig(value) {
+  if (!value || typeof value !== "object")
+    return false;
+  const config = value;
+  if (![config.server_url, config.team_key, config.member_name].every((field) => typeof field === "string" && field.trim().length > 0))
+    return false;
+  try {
+    const url = new URL(config.server_url);
+    return (url.protocol === "https:" || url.protocol === "http:") && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
 function writeConfig(config) {
   const dir = getConfigDir();
   if (!existsSync(dir)) {
@@ -34,15 +47,191 @@ function writeConfig(config) {
 }
 
 // src/hooks.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, copyFileSync, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join2 } from "node:path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, lstatSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { join as join3, dirname } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { randomUUID } from "node:crypto";
+
+// src/scripts.ts
+import { spawnSync } from "node:child_process";
+async function fetchHookScript(serverUrl, scriptName) {
+  const response = await fetch(`${serverUrl.replace(/\/+$/, "")}/scripts/${scriptName}`, {
+    signal: AbortSignal.timeout(1e4)
+  });
+  if (scriptName === "codex-sync.mjs" && [404, 410].includes(response.status))
+    return null;
+  if (!response.ok)
+    throw new Error(`Could not download ${scriptName} (HTTP ${response.status}).`);
+  return response.text();
+}
+async function downloadScripts(serverUrl, fetchScript = fetchHookScript) {
+  const [sessionEnd, sessionStart, codexSync] = await Promise.all([
+    fetchScript(serverUrl, "session-end.mjs"),
+    fetchScript(serverUrl, "session-start.mjs"),
+    fetchScript(serverUrl, "codex-sync.mjs")
+  ]);
+  if (!sessionEnd?.trim() || !sessionStart?.trim() || codexSync === "") {
+    throw new Error("Server returned an empty or missing hook script.");
+  }
+  return { sessionEnd, sessionStart, ...codexSync === null ? {} : { codexSync } };
+}
+function validateScripts(scripts) {
+  for (const [name, source] of Object.entries(scripts)) {
+    if (!source.trim())
+      throw new Error(`Server returned an empty ${name} script.`);
+    const check = spawnSync(process.execPath, ["--check", "--input-type=module"], {
+      input: source,
+      encoding: "utf8",
+      timeout: 1e4
+    });
+    if (check.status !== 0)
+      throw new Error(`Invalid JavaScript in ${name}; installation unchanged.`);
+  }
+}
+var CODEX_COMPATIBILITY_MESSAGE = "This server does not provide Codex support (404/410). Claude hooks can still be updated; any existing Codex script is preserved. Deploy a server version with Codex support, then run `tracker update`.";
+
+// src/codex-hooks.ts
+import { existsSync as existsSync2 } from "node:fs";
+import { delimiter, join as join2 } from "node:path";
 import { homedir as homedir2 } from "node:os";
+var CODEX_HOOK_TIMEOUT_SEC = 45;
+var TRUST_EVENT_KEYS = { stop: "stop", sessionEnd: "session_end" };
+var CODEX_EVENTS = { stop: "Stop", sessionEnd: "SessionEnd" };
+function getCodexHome() {
+  const configured = process.env.CODEX_HOME?.trim();
+  return configured ? configured : join2(homedir2(), ".codex");
+}
+function getCodexHooksPath() {
+  return join2(getCodexHome(), "hooks.json");
+}
+function getCodexSyncScriptPath() {
+  return join2(homedir2(), ".config", "ccusage-tracker", "codex-sync.mjs");
+}
+function getCodexHookCommand() {
+  return `node "${getCodexSyncScriptPath()}" --hook`;
+}
+function isCodexTrackerHook(command) {
+  return typeof command === "string" && /[/\\]ccusage-tracker[/\\]codex-sync\.mjs(?=["'\s]|$)/.test(command);
+}
+function isOnPath(name) {
+  const entries = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+  const suffixes = process.platform === "win32" ? (process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
+  return entries.some((dir) => suffixes.some((suffix) => existsSync2(join2(dir, name + suffix))));
+}
+function detectCodex() {
+  return existsSync2(getCodexHome()) || isOnPath("codex");
+}
+function invalid(detail) {
+  throw new Error(`Codex hooks.json ${detail}; repair it before updating.`);
+}
+function readGroups(file, event) {
+  const groups = file.hooks?.[event];
+  if (groups === undefined)
+    return [];
+  if (!Array.isArray(groups))
+    invalid(`${event} hooks must be an array`);
+  for (const group of groups) {
+    if (!group || typeof group !== "object" || Array.isArray(group))
+      invalid(`${event} hook groups must be objects`);
+    if (!Array.isArray(group.hooks) || group.hooks.some((hook) => !hook || typeof hook !== "object" || Array.isArray(hook))) {
+      invalid(`${event} hook entries are invalid`);
+    }
+  }
+  return groups;
+}
+function upsertCodexGroups(groups, command) {
+  const entry = { type: "command", command, timeout: CODEX_HOOK_TIMEOUT_SEC };
+  const index = groups.findIndex((group) => group.hooks.some((hook) => isCodexTrackerHook(hook.command)));
+  if (index === -1)
+    return { groups: [...groups, { hooks: [entry] }], changed: true };
+  const current = groups[index];
+  const onlyTracker = current.hooks.every((hook) => isCodexTrackerHook(hook.command));
+  const replacement = onlyTracker ? { hooks: [entry] } : { ...current, hooks: current.hooks.map((hook) => isCodexTrackerHook(hook.command) ? entry : hook) };
+  if (JSON.stringify(current) === JSON.stringify(replacement))
+    return { groups, changed: false };
+  return { groups: groups.map((group, at) => at === index ? replacement : group), changed: true };
+}
+function applyCodexHooks(file, command = getCodexHookCommand()) {
+  if (!file || typeof file !== "object" || Array.isArray(file))
+    invalid("must contain a JSON object");
+  if (file.hooks !== undefined && (!file.hooks || typeof file.hooks !== "object" || Array.isArray(file.hooks))) {
+    invalid("hooks must be an object");
+  }
+  const stop = upsertCodexGroups(readGroups(file, CODEX_EVENTS.stop), command);
+  const sessionEnd = upsertCodexGroups(readGroups(file, CODEX_EVENTS.sessionEnd), command);
+  const anyChanged = stop.changed || sessionEnd.changed;
+  return {
+    updated: anyChanged ? { ...file, hooks: { ...file.hooks, [CODEX_EVENTS.stop]: stop.groups, [CODEX_EVENTS.sessionEnd]: sessionEnd.groups } } : file,
+    stopChanged: stop.changed,
+    sessionEndChanged: sessionEnd.changed,
+    anyChanged
+  };
+}
+function findCodexTrackerIndexes(file) {
+  const find = (event) => {
+    const groups = file.hooks?.[event];
+    if (!Array.isArray(groups))
+      return;
+    const index = groups.findIndex((group) => Array.isArray(group?.hooks) && group.hooks.some((hook) => isCodexTrackerHook(hook?.command)));
+    return index === -1 ? undefined : index;
+  };
+  const stop = find(CODEX_EVENTS.stop);
+  const sessionEnd = find(CODEX_EVENTS.sessionEnd);
+  return { ...stop === undefined ? {} : { stop }, ...sessionEnd === undefined ? {} : { sessionEnd } };
+}
+function readCodexTrustState(configToml, hooksPath, indexes) {
+  const wanted = new Map;
+  for (const event of ["stop", "sessionEnd"]) {
+    const index = indexes[event];
+    if (index !== undefined)
+      wanted.set(`${hooksPath}:${TRUST_EVENT_KEYS[event]}:${index}:0`, event);
+  }
+  const state = {};
+  for (const event of wanted.values())
+    state[event] = "awaiting";
+  let current = null;
+  for (const line of configToml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      const header = /^\[hooks\.state\."(.*)"\]$/.exec(trimmed);
+      const key = header ? header[1].replace(/\\(["\\])/g, "$1") : null;
+      current = key !== null && wanted.has(key) ? wanted.get(key) : null;
+      continue;
+    }
+    if (!current)
+      continue;
+    if (/^enabled\s*=\s*false\b/.test(trimmed))
+      state[current] = "disabled";
+    else if (/^trusted_hash\s*=/.test(trimmed) && state[current] !== "disabled")
+      state[current] = "recorded";
+  }
+  return state;
+}
+function hasTrackerNotify(configToml) {
+  const lines = configToml.split(/\r?\n/);
+  let collected = null;
+  let depth = 0;
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (collected === null && /^\[[^\]]*\]$/.test(trimmed))
+      return false;
+    if (collected === null && !/^notify\s*=/.test(trimmed))
+      continue;
+    collected = (collected ?? "") + trimmed;
+    depth += (trimmed.match(/\[/g)?.length ?? 0) - (trimmed.match(/\]/g)?.length ?? 0);
+    if (depth <= 0)
+      break;
+  }
+  return collected !== null && /[/\\]ccusage-tracker[/\\]codex-sync\.mjs/.test(collected);
+}
+
+// src/hooks.ts
 var HOOK_TIMEOUT_SEC = 45;
 function getClaudeSettingsPath() {
-  return join2(homedir2(), ".claude", "settings.json");
+  return join3(homedir3(), ".claude", "settings.json");
 }
 function sessionEndScriptPath() {
-  return join2(homedir2(), ".config", "ccusage-tracker", "session-end.mjs");
+  return join3(homedir3(), ".config", "ccusage-tracker", "session-end.mjs");
 }
 function quoteScriptPath(path) {
   return `"${path}"`;
@@ -58,10 +247,13 @@ function getStopHookCommand() {
   return buildHookCommand(sessionEndScriptPath(), "stop");
 }
 function getStartHookCommand() {
-  return buildHookCommand(join2(homedir2(), ".config", "ccusage-tracker", "session-start.mjs"));
+  return buildHookCommand(join3(homedir3(), ".config", "ccusage-tracker", "session-start.mjs"));
 }
 function isCcusageTrackerHook(command) {
-  return !!command && command.includes("ccusage-tracker");
+  return typeof command === "string" && /[/\\]ccusage-tracker(?:[/\\](?:session-end|session-start|codex-sync)\.(?:mjs|sh|ps1)|\.(?:sh|ps1))(?=["'\s]|$)/.test(command);
+}
+function detectClaude(home = homedir3()) {
+  return existsSync3(join3(home, ".claude")) || isOnPath("claude");
 }
 function matcherEquivalent(a, b) {
   const norm = (s) => s === "" ? "*" : s;
@@ -71,11 +263,14 @@ function upsertHook(existing, command, opts = {}) {
   const newEntry = { type: "command", command };
   if (opts.timeout !== undefined)
     newEntry.timeout = opts.timeout;
-  const newMatcher = { matcher: opts.matcher ?? "*", hooks: [newEntry] };
-  const filtered = existing.map((m) => ({
-    matcher: m.matcher,
-    hooks: (m.hooks ?? []).filter((h) => !isCcusageTrackerHook(h.command))
-  })).filter((m) => m.hooks.length > 0);
+  const previous = existing.find((m) => m.hooks?.length && m.hooks.every((h) => isCcusageTrackerHook(h.command)));
+  const newMatcher = { ...previous, matcher: opts.matcher ?? "*", hooks: [newEntry] };
+  const filtered = existing.flatMap((m) => {
+    if (!m.hooks?.some((h) => isCcusageTrackerHook(h.command)))
+      return [m];
+    const hooks = m.hooks.filter((h) => !isCcusageTrackerHook(h.command));
+    return hooks.length ? [{ ...m, hooks }] : [];
+  });
   const next = [...filtered, newMatcher];
   const changed = !sameMatchers(existing, next);
   return { matchers: changed ? next : existing, changed };
@@ -86,16 +281,8 @@ function sameMatchers(a, b) {
   for (let i = 0;i < a.length; i++) {
     if (!matcherEquivalent(a[i].matcher, b[i].matcher))
       return false;
-    const ha = a[i].hooks ?? [];
-    const hb = b[i].hooks ?? [];
-    if (ha.length !== hb.length)
+    if (JSON.stringify({ ...a[i], matcher: "*" }) !== JSON.stringify({ ...b[i], matcher: "*" }))
       return false;
-    for (let j = 0;j < ha.length; j++) {
-      if (ha[j].command !== hb[j].command)
-        return false;
-      if (ha[j].timeout !== hb[j].timeout)
-        return false;
-    }
   }
   return true;
 }
@@ -121,32 +308,210 @@ function applyTrackerHooks(settings) {
     anyChanged
   };
 }
-function installHook(scripts) {
+function readCodexHooksFile(path) {
+  if (!existsSync3(path))
+    return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path, "utf-8"));
+  } catch {
+    throw new Error("Codex hooks.json is not valid JSON; repair it before updating.");
+  }
+  return parsed;
+}
+function installHook(scripts, targets = { claude: true, codex: false }) {
   const settingsPath = getClaudeSettingsPath();
   let settings = {};
-  let backedUp = false;
-  if (existsSync2(settingsPath)) {
+  if (targets.claude && existsSync3(settingsPath)) {
     const raw = readFileSync2(settingsPath, "utf-8");
     settings = JSON.parse(raw);
+    if (!settings || typeof settings !== "object" || Array.isArray(settings)) {
+      throw new Error("Claude settings.json must contain a JSON object; repair it before updating.");
+    }
+    if (settings.hooks !== undefined) {
+      if (!settings.hooks || typeof settings.hooks !== "object" || Array.isArray(settings.hooks)) {
+        throw new Error("Claude settings.json hooks must be an object; repair it before updating.");
+      }
+      for (const event of ["SessionStart", "SessionEnd", "Stop"]) {
+        const matchers = settings.hooks[event];
+        if (matchers === undefined)
+          continue;
+        if (!Array.isArray(matchers) || matchers.some((matcher) => !matcher || !Array.isArray(matcher.hooks) || matcher.hooks.some((hook) => !hook || typeof hook !== "object")))
+          throw new Error(`Claude settings.json ${event} hooks are invalid; repair them before updating.`);
+      }
+    }
   }
-  const destDir = join2(homedir2(), ".config", "ccusage-tracker");
-  mkdirSync2(destDir, { recursive: true });
-  writeFileSync2(join2(destDir, "session-end.mjs"), scripts.sessionEnd);
-  writeFileSync2(join2(destDir, "session-start.mjs"), scripts.sessionStart);
-  const { updated, sessionStartChanged, sessionEndChanged, stopChanged, anyChanged } = applyTrackerHooks(settings);
-  if (anyChanged) {
-    if (existsSync2(settingsPath)) {
-      copyFileSync(settingsPath, settingsPath + ".backup");
-      backedUp = true;
+  validateScripts(scripts);
+  const claude = applyTrackerHooks(settings);
+  const claudeChanged = targets.claude && claude.anyChanged;
+  const codexWired = targets.codex && scripts.codexSync !== undefined;
+  const codexHooksPath = getCodexHooksPath();
+  const codex = codexWired ? applyCodexHooks(readCodexHooksFile(codexHooksPath)) : { updated: {}, stopChanged: false, sessionEndChanged: false, anyChanged: false };
+  const destDir = join3(homedir3(), ".config", "ccusage-tracker");
+  const files = [
+    { path: join3(destDir, "session-end.mjs"), content: scripts.sessionEnd },
+    { path: join3(destDir, "session-start.mjs"), content: scripts.sessionStart },
+    ...scripts.codexSync === undefined ? [] : [{ path: join3(destDir, "codex-sync.mjs"), content: scripts.codexSync }],
+    ...claudeChanged ? [{ path: settingsPath, content: JSON.stringify(claude.updated, null, 2) + `
+` }] : [],
+    ...codex.anyChanged ? [{ path: codexHooksPath, content: JSON.stringify(codex.updated, null, 2) + `
+` }] : []
+  ];
+  const backedUp = installFiles(files);
+  return {
+    sessionEndChanged: targets.claude && claude.sessionEndChanged,
+    sessionStartChanged: targets.claude && claude.sessionStartChanged,
+    stopChanged: targets.claude && claude.stopChanged,
+    claudeChanged,
+    codexStopChanged: codex.stopChanged,
+    codexSessionEndChanged: codex.sessionEndChanged,
+    codexChanged: codex.anyChanged,
+    codexWired,
+    codexIndexes: codexWired ? findCodexTrackerIndexes(codex.updated) : {},
+    backedUp
+  };
+}
+var NO_TOOL_MESSAGE = "No supported tool detected (Claude Code or Codex). Install one, then run `tracker update`.";
+var CODEX_TRUST_MESSAGE = "Codex: hooks installed (Stop, SessionEnd). Open Codex and run /hooks once to trust the ccusage-tracker hooks.";
+var CODEX_DISABLED_MESSAGE = "Codex: hooks installed but disabled in Codex";
+var defaultWiringDeps = {
+  detectClaude: () => detectClaude(),
+  detectCodex,
+  installHook,
+  readCodexConfig: () => {
+    const path = join3(getCodexHome(), "config.toml");
+    try {
+      return existsSync3(path) ? readFileSync2(path, "utf-8") : null;
+    } catch {
+      return null;
     }
-    writeFileSync2(settingsPath, JSON.stringify(updated, null, 2) + `
-`);
   }
-  return { sessionEndChanged, sessionStartChanged, stopChanged, backedUp };
+};
+function wireTools(scripts, deps) {
+  const claudeDetected = deps.detectClaude();
+  const codexDetected = deps.detectCodex();
+  const result = deps.installHook(scripts, { claude: claudeDetected, codex: codexDetected });
+  if (!claudeDetected)
+    deps.log("Claude Code: not detected");
+  else if (result.claudeChanged)
+    deps.log("Claude Code: hooks installed/updated (SessionStart, SessionEnd, Stop)");
+  else
+    deps.log("Claude Code: hooks already up to date");
+  if (codexDetected && scripts.codexSync === undefined)
+    deps.warn(CODEX_COMPATIBILITY_MESSAGE);
+  const configToml = codexDetected ? deps.readCodexConfig() ?? "" : "";
+  if (!codexDetected)
+    deps.log("Codex: not detected");
+  else if (!result.codexWired)
+    deps.log("Codex: hooks not installed (this server does not provide the Codex script)");
+  else {
+    const trust = readCodexTrustState(configToml, getCodexHooksPath(), result.codexIndexes);
+    const states = Object.values(trust);
+    const recorded = states.length > 0 && states.every((state) => state === "recorded");
+    if (states.includes("disabled"))
+      deps.log(CODEX_DISABLED_MESSAGE);
+    else
+      deps.log(!result.codexChanged && recorded ? "Codex: hooks already up to date (trust recorded)" : CODEX_TRUST_MESSAGE);
+  }
+  if (hasTrackerNotify(configToml)) {
+    deps.warn("Codex hooks now handle reporting. Remove the ccusage-tracker `notify` entry from $CODEX_HOME/config.toml to avoid triggering it twice; this tool never edits that file.");
+  }
+  if (result.backedUp)
+    deps.log("Changed files backed up (.backup).");
+  if (!claudeDetected && !codexDetected)
+    deps.log(NO_TOOL_MESSAGE);
+  return { claudeDetected, codexDetected };
+}
+function nonRegularFileError(path, linkTarget) {
+  return new Error(`Refusing to replace non-regular file: ${path}` + (linkTarget === undefined ? "" : ` (symlink target: ${linkTarget})`));
+}
+function resolveWriteTarget(path) {
+  let link;
+  try {
+    link = lstatSync(path);
+  } catch {
+    return path;
+  }
+  if (!link.isSymbolicLink()) {
+    if (!link.isFile())
+      throw nonRegularFileError(path);
+    return path;
+  }
+  let real;
+  try {
+    real = realpathSync(path);
+  } catch {
+    throw nonRegularFileError(path, readlinkSync(path));
+  }
+  if (!statSync(real).isFile())
+    throw nonRegularFileError(path, real);
+  return real;
+}
+function installFiles(files) {
+  const staged = [];
+  let backedUp = false;
+  let committed = false;
+  function stage(path, content) {
+    const target = resolveWriteTarget(path);
+    mkdirSync2(dirname(target), { recursive: true });
+    const current = existsSync3(target) ? lstatSync(target) : null;
+    const entry = { path: target, staged: `${target}.${randomUUID()}.tmp`, installed: false };
+    staged.push(entry);
+    writeFileSync2(entry.staged, content, { flag: "wx", mode: current?.mode ?? 384 });
+    if (current) {
+      entry.rollback = `${target}.${randomUUID()}.rollback`;
+      writeFileSync2(entry.rollback, readFileSync2(target), { flag: "wx", mode: current.mode });
+    }
+  }
+  try {
+    for (const file of files) {
+      const next = Buffer.from(file.content);
+      const target = resolveWriteTarget(file.path);
+      if (existsSync3(target)) {
+        const previous = readFileSync2(target);
+        if (previous.equals(next))
+          continue;
+        stage(target + ".backup", previous);
+        backedUp = true;
+      }
+      stage(target, next);
+    }
+    for (const entry of staged) {
+      renameSync(entry.staged, entry.path);
+      entry.installed = true;
+    }
+    committed = true;
+  } catch (error) {
+    const failures = [];
+    for (const entry of [...staged].reverse()) {
+      if (!entry.installed)
+        continue;
+      try {
+        if (entry.rollback)
+          renameSync(entry.rollback, entry.path);
+        else
+          unlinkSync(entry.path);
+      } catch {
+        failures.push(entry.path);
+      }
+    }
+    if (failures.length)
+      throw new Error(`${error.message}; restore failed for ${failures.join(", ")}. Retained .rollback files require manual recovery.`);
+    throw error;
+  } finally {
+    for (const entry of staged) {
+      if (existsSync3(entry.staged))
+        unlinkSync(entry.staged);
+      if (entry.rollback && existsSync3(entry.rollback) && (committed || !entry.installed)) {
+        unlinkSync(entry.rollback);
+      }
+    }
+  }
+  return backedUp;
 }
 function isHookInstalled() {
   const settingsPath = getClaudeSettingsPath();
-  if (!existsSync2(settingsPath))
+  if (!existsSync3(settingsPath))
     return false;
   try {
     const settings = JSON.parse(readFileSync2(settingsPath, "utf-8"));
@@ -157,6 +522,70 @@ function isHookInstalled() {
   }
 }
 
+// src/collector.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+var COLLECTOR_VERSION = "20.0.20";
+var COLLECTOR_INSTALL_COMMAND = `npm install -g ccusage@${COLLECTOR_VERSION}`;
+var SKIP_ENV = "CCUSAGE_TRACKER_SKIP_COLLECTOR_INSTALL";
+var INSTALL_TIMEOUT_MS = 180000;
+function defaultProbe() {
+  try {
+    const result = spawnSync2("ccusage --version", { encoding: "utf8", shell: true, timeout: 1e4 });
+    if (result.status !== 0 || !result.stdout)
+      return null;
+    return result.stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function defaultInstall(command) {
+  try {
+    return spawnSync2(command, { shell: true, stdio: "inherit", timeout: INSTALL_TIMEOUT_MS }).status === 0;
+  } catch {
+    return false;
+  }
+}
+var defaultCollectorDeps = {
+  probe: defaultProbe,
+  install: defaultInstall
+};
+function displayVersion(version) {
+  return version.trim().replace(/^ccusage\s+/, "");
+}
+function majorVersion(version) {
+  const match = /^(?:ccusage\s+)?(\d+)\.\d+\.\d+/.exec(version.trim());
+  return match ? match[1] : null;
+}
+function unsupportedMajor(deps, version) {
+  deps.warn(`Collector: ccusage ${displayVersion(version)} reports usage for Claude, but Codex requires ${COLLECTOR_VERSION}. Install it yourself with: ${COLLECTOR_INSTALL_COMMAND}`);
+  return { status: "unsupported_major", version };
+}
+function ensureCollector(deps) {
+  const version = deps.probe();
+  if (version !== null) {
+    if (majorVersion(version) === "20") {
+      deps.log(`Collector: ccusage ${displayVersion(version)} (Claude and Codex ready)`);
+      return { status: "ok", version };
+    }
+    return unsupportedMajor(deps, version);
+  }
+  if (process.env[SKIP_ENV] === "1") {
+    deps.log(`Collector: not installed; skipping automatic install (${SKIP_ENV}=1). Install it with: ${COLLECTOR_INSTALL_COMMAND}`);
+    return { status: "skipped" };
+  }
+  deps.log(`Collector: ccusage not found. Running: ${COLLECTOR_INSTALL_COMMAND}`);
+  deps.install(COLLECTOR_INSTALL_COMMAND);
+  const reprobed = deps.probe();
+  if (reprobed === null) {
+    deps.warn(`Collector: automatic install did not succeed. Install it yourself with: ${COLLECTOR_INSTALL_COMMAND}`);
+    return { status: "install_failed" };
+  }
+  if (majorVersion(reprobed) !== "20")
+    return unsupportedMajor(deps, reprobed);
+  deps.log(`Collector: ccusage ${displayVersion(reprobed)} installed.`);
+  return { status: "installed", version: reprobed };
+}
+
 // src/commands/setup.ts
 var sharedRl = null;
 var lineIterator = null;
@@ -185,30 +614,17 @@ async function defaultCheckServer(serverUrl) {
     return false;
   }
 }
-function defaultCheckCcusage() {
-  try {
-    return spawnSync("ccusage --version", { encoding: "utf8", shell: true, timeout: 1e4 }).status === 0;
-  } catch {
-    return false;
-  }
-}
-async function defaultFetchHookScript(serverUrl, scriptName) {
-  try {
-    const res = await fetch(`${serverUrl}/scripts/${scriptName}`, { signal: AbortSignal.timeout(1e4) });
-    if (!res.ok)
-      return null;
-    return await res.text();
-  } catch {
-    return null;
-  }
-}
 var defaultDeps = {
   prompt: defaultPrompt,
   writeConfig,
   installHook,
-  fetchHookScript: defaultFetchHookScript,
+  fetchHookScript,
   checkServer: defaultCheckServer,
-  checkCcusage: defaultCheckCcusage,
+  detectClaude: () => detectClaude(),
+  detectCodex,
+  probeCollector: defaultCollectorDeps.probe,
+  installCollector: defaultCollectorDeps.install,
+  readCodexConfig: defaultWiringDeps.readCodexConfig,
   log: (msg) => console.log(msg),
   warn: (msg) => console.warn(msg),
   exit: (code) => process.exit(code)
@@ -247,30 +663,37 @@ async function runSetup(deps) {
     team_key: teamKey,
     member_name: name
   };
+  if (!isTrackerConfig(config)) {
+    deps.warn("Invalid configuration. Server URL must use http or https without embedded credentials.");
+    deps.exit(1);
+    return;
+  }
   deps.writeConfig(config);
   deps.log(`
 Config saved.`);
-  const [sessionEnd, sessionStart] = await Promise.all([
-    deps.fetchHookScript(config.server_url, "session-end.mjs"),
-    deps.fetchHookScript(config.server_url, "session-start.mjs")
-  ]);
-  if (sessionEnd && sessionStart) {
-    try {
-      const { sessionEndChanged, sessionStartChanged, stopChanged, backedUp } = deps.installHook({
-        sessionEnd,
-        sessionStart
-      });
-      const anyChanged = sessionEndChanged || sessionStartChanged || stopChanged;
-      if (anyChanged) {
-        deps.log("SessionStart + SessionEnd + Stop hooks installed/updated." + (backedUp ? " (settings.json backed up)" : ""));
-      } else {
-        deps.log("SessionStart + SessionEnd + Stop hooks already up to date.");
-      }
-    } catch (err) {
-      deps.warn("Warning: Could not install hooks automatically. " + err.message);
-    }
-  } else {
-    deps.warn("Warning: Could not download hook scripts from " + config.server_url);
+  let detected;
+  try {
+    const scripts = await downloadScripts(config.server_url, deps.fetchHookScript);
+    detected = wireTools(scripts, {
+      detectClaude: deps.detectClaude,
+      detectCodex: deps.detectCodex,
+      installHook: deps.installHook,
+      readCodexConfig: deps.readCodexConfig,
+      log: deps.log,
+      warn: deps.warn
+    });
+  } catch (err) {
+    deps.warn("Could not install tracker scripts. " + err.message + " Run `tracker update` after resolving the problem.");
+    deps.exit(1);
+    return;
+  }
+  if (detected.claudeDetected || detected.codexDetected) {
+    ensureCollector({
+      probe: deps.probeCollector,
+      install: deps.installCollector,
+      log: deps.log,
+      warn: deps.warn
+    });
   }
   const serverOk = await deps.checkServer(config.server_url);
   if (serverOk) {
@@ -278,12 +701,6 @@ Config saved.`);
   } else {
     deps.warn("Warning: Server is not reachable at " + config.server_url);
   }
-  const hasCcusage = deps.checkCcusage();
-  if (hasCcusage) {
-    deps.log("ccusage is installed.");
-  } else {
-    deps.warn("Warning: ccusage not found. Install with: npx ccusage@latest");
-  }
   deps.log(`
 Setup complete!`);
 }
@@ -369,15 +786,15 @@ async function reportCommand(args) {
 }
 
 // src/commands/status.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { spawnSync as spawnSync2 } from "node:child_process";
-import { join as join3, dirname } from "node:path";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { spawnSync as spawnSync3 } from "node:child_process";
+import { join as join4, dirname as dirname2 } from "node:path";
 async function statusCommand() {
   const configPath = getConfigPath();
   const config = readConfig();
   console.log(`ccusage-tracker status
 `);
-  if (existsSync3(configPath)) {
+  if (existsSync4(configPath)) {
     console.log(`Config: ${configPath} (exists)`);
   } else {
     console.log(`Config: ${configPath} (not found)`);
@@ -387,7 +804,11 @@ async function statusCommand() {
   if (config) {
     console.log(`  Member: ${config.member_name}`);
     console.log(`  Server: ${config.server_url}`);
-    console.log(`  Team Key: ${config.team_key.slice(0, 15)}...`);
+    console.log("  Team Key: configured");
+  } else {
+    console.log("Configuration is invalid. Run `tracker setup` to repair it.");
+    process.exitCode = 1;
+    return;
   }
   const hookInstalled = isHookInstalled();
   console.log(`
@@ -407,8 +828,8 @@ Hook: ${hookInstalled ? "installed" : "not installed"}`);
       console.log("Server: unreachable");
     }
   }
-  const bufferPath = join3(dirname(configPath), "buffer.jsonl");
-  if (existsSync3(bufferPath)) {
+  const bufferPath = join4(dirname2(configPath), "buffer.jsonl");
+  if (existsSync4(bufferPath)) {
     const content = readFileSync3(bufferPath, "utf-8").trim();
     const lineCount = content ? content.split(`
 `).length : 0;
@@ -416,9 +837,9 @@ Hook: ${hookInstalled ? "installed" : "not installed"}`);
   } else {
     console.log("Buffer: none");
   }
-  const configDir = dirname(configPath);
-  const lastErrorPath = join3(configDir, "last-error.txt");
-  if (existsSync3(lastErrorPath)) {
+  const configDir = dirname2(configPath);
+  const lastErrorPath = join4(configDir, "last-error.txt");
+  if (existsSync4(lastErrorPath)) {
     const reason = readFileSync3(lastErrorPath, "utf-8").trim();
     console.log(`
 Upload error: ${reason}`);
@@ -427,16 +848,16 @@ Upload error: ${reason}`);
     console.log(`
 Upload error: none recorded`);
   }
-  const lastUploadPath = join3(configDir, "last-upload.txt");
+  const lastUploadPath = join4(configDir, "last-upload.txt");
   let lastUploadTs = null;
-  if (existsSync3(lastUploadPath)) {
+  if (existsSync4(lastUploadPath)) {
     const parsed = parseInt(readFileSync3(lastUploadPath, "utf-8").trim(), 10);
     if (!isNaN(parsed))
       lastUploadTs = parsed;
   }
   console.log(uploadAgeLine(lastUploadTs, Date.now()));
-  const lastFlushPath = join3(configDir, "last-flush.txt");
-  if (existsSync3(lastFlushPath)) {
+  const lastFlushPath = join4(configDir, "last-flush.txt");
+  if (existsSync4(lastFlushPath)) {
     const ts = parseInt(readFileSync3(lastFlushPath, "utf-8").trim(), 10);
     if (!isNaN(ts)) {
       const ageMin = Math.floor((Date.now() - ts) / 60000);
@@ -444,7 +865,55 @@ Upload error: none recorded`);
     }
   }
   const probe = probeCcusage();
-  console.log(probe ? `ccusage: installed (${probe})` : "ccusage: not found (install with: npx ccusage@latest)");
+  console.log(probe ? `ccusage: installed (${probe})` : "ccusage: not found (install with: npm install -g ccusage@20.0.20)");
+  if (!detectCodex()) {
+    console.log(`
+Codex: not detected`);
+    return;
+  }
+  const codexScript = join4(configDir, "codex-sync.mjs");
+  console.log(`
+Codex script: ${existsSync4(codexScript) ? "installed" : "not installed (run tracker update with a Codex-capable server)"}`);
+  const hooksPath = getCodexHooksPath();
+  console.log(codexHooksLine(readTextFile(hooksPath), readTextFile(join4(dirname2(hooksPath), "config.toml")), hooksPath));
+  console.log(`Codex Node runtime: ${process.versions.node}`);
+  const hasCodexCollector = probe !== null && /^(?:ccusage\s+)?20\.0\.20$/.test(probe);
+  console.log(hasCodexCollector ? "Codex collector: installed (ccusage 20.0.20)" : `Codex collector: unavailable (${probe ? `unsupported version: ${probe}` : "ccusage missing"}; install with: npm install -g ccusage@20.0.20)`);
+  const codexBufferPath = join4(configDir, "codex-buffer.jsonl");
+  const codexLines = existsSync4(codexBufferPath) ? readFileSync3(codexBufferPath, "utf8").trim().split(`
+`).filter(Boolean).length : 0;
+  console.log(`Codex buffer: ${codexLines} pending entr${codexLines === 1 ? "y" : "ies"}`);
+  const codexErrorPath = join4(configDir, "codex-last-error.txt");
+  console.log(`Codex upload error: ${existsSync4(codexErrorPath) ? readFileSync3(codexErrorPath, "utf8").trim() : "none recorded"}`);
+  const codexUploadPath = join4(configDir, "codex-last-upload.txt");
+  const codexUpload = existsSync4(codexUploadPath) ? Number(readFileSync3(codexUploadPath, "utf8").trim()) : NaN;
+  console.log(`Codex last successful upload: ${Number.isFinite(codexUpload) && codexUpload > 0 && !Number.isNaN(new Date(codexUpload).getTime()) ? new Date(codexUpload).toISOString() : "none recorded (run tracker sync codex)"}`);
+}
+function readTextFile(path) {
+  try {
+    return existsSync4(path) ? readFileSync3(path, "utf8") : null;
+  } catch {
+    return null;
+  }
+}
+function codexHooksLine(hooksJson, configToml, hooksPath) {
+  let file = null;
+  if (hooksJson !== null) {
+    try {
+      const parsed = JSON.parse(hooksJson);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+        file = parsed;
+    } catch {}
+  }
+  const indexes = file ? findCodexTrackerIndexes(file) : {};
+  if (indexes.stop === undefined && indexes.sessionEnd === undefined)
+    return "Codex hooks: not installed";
+  const states = Object.values(readCodexTrustState(configToml ?? "", hooksPath, indexes));
+  if (states.includes("disabled"))
+    return "Codex hooks: installed, disabled in Codex";
+  if (states.every((state) => state === "recorded"))
+    return "Codex hooks: installed, trust recorded";
+  return "Codex hooks: installed, awaiting trust (open /hooks in Codex)";
 }
 var STALE_UPLOAD_MS = 24 * 60 * 60 * 1000;
 function uploadAgeLine(ts, now) {
@@ -475,7 +944,7 @@ function uploadFailureHint(reason) {
 }
 function probeCcusage() {
   try {
-    const r = spawnSync2("ccusage --version", { encoding: "utf8", shell: true, timeout: 1e4 });
+    const r = spawnSync3("ccusage --version", { encoding: "utf8", shell: true, timeout: 1e4 });
     if (r.status !== 0 || !r.stdout)
       return null;
     return r.stdout.trim() || "version unknown";
@@ -484,6 +953,65 @@ function probeCcusage() {
   }
 }
 
+// src/commands/update.ts
+async function updateCommand() {
+  const config = readConfig();
+  if (!config) {
+    console.error("Missing or invalid configuration. Run `tracker setup` first.");
+    process.exitCode = 1;
+    return;
+  }
+  const log = (msg) => console.log(msg);
+  const warn = (msg) => console.warn(msg);
+  let detected;
+  try {
+    const scripts = await downloadScripts(config.server_url);
+    detected = wireTools(scripts, { ...defaultWiringDeps, installHook, log, warn });
+  } catch (error) {
+    console.error("Update failed: " + error.message);
+    process.exitCode = 1;
+    return;
+  }
+  if (!detected.claudeDetected && !detected.codexDetected) {
+    process.exitCode = 1;
+    return;
+  }
+  ensureCollector({ probe: defaultCollectorDeps.probe, install: defaultCollectorDeps.install, log, warn });
+  console.log(`
+Update complete. Tracker scripts and hooks updated.`);
+}
+
+// src/commands/sync.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+async function syncCommand(args) {
+  if (args.length !== 1 || args[0] !== "codex") {
+    console.error("Usage: tracker sync codex");
+    process.exitCode = 1;
+    return;
+  }
+  if (!readConfig()) {
+    console.error("Missing or invalid configuration. Run `tracker setup` first.");
+    process.exitCode = 1;
+    return;
+  }
+  const script = join5(getConfigDir(), "codex-sync.mjs");
+  if (!existsSync5(script)) {
+    console.error("Codex script not installed. Run `tracker update` with a server that supports Codex.");
+    process.exitCode = 1;
+    return;
+  }
+  process.exitCode = await new Promise((resolve) => {
+    const child = spawn(process.execPath, [script], { stdio: "inherit" });
+    child.on("error", (error) => {
+      console.error("Could not run Codex sync: " + error.message);
+      resolve(1);
+    });
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+
 // src/index.ts
 var args = process.argv.slice(2);
 var command = args[0];
@@ -497,6 +1025,12 @@ switch (command) {
   case "status":
     await statusCommand();
     break;
+  case "update":
+    await updateCommand();
+    break;
+  case "sync":
+    await syncCommand(args.slice(1));
+    break;
   default:
     console.log(`ccusage-tracker CLI
 `);
@@ -504,6 +1038,8 @@ switch (command) {
 `);
     console.log("Commands:");
     console.log("  setup    Configure hook and server connection");
+    console.log("  update   Refresh installed scripts/hooks using existing configuration");
+    console.log("  sync codex  Report Codex usage now (manual fallback / debugging)");
     console.log("  report   View team token usage report");
     console.log("  status   Check current configuration status");
     process.exit(command ? 1 : 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccusage-tracker",
-  "version": "0.1.7",
+  "version": "0.2.0",
   "description": "CLI for ccusage-tracker — install Claude Code SessionStart/SessionEnd/Stop hooks to report token usage to a self-hosted team tracker.",
   "type": "module",
   "bin": {