cdx-manager 0.19.3 → 0.20.0

package/README.md

@@ -4,7 +4,7 @@
 
 <br clear="left"/>
 
-[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.19.3-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
+[![License](https://img.shields.io/badge/license-MIT-4C8BF5)](LICENSE) ![Version](https://img.shields.io/badge/version-v0.20.0-4C8BF5) ![Python](https://img.shields.io/badge/python-3.9%2B-3776AB?logo=python&logoColor=white)
 
 **Stop guessing which AI account still has quota.** `cdx` tracks the rate-limit window of every Codex and Claude account you own, tells you which one is usable right now, and launches it with isolated auth — in one command.
 
@@ -86,7 +86,7 @@ The reason `cdx` exists: knowing, across every account you own, which one you ca
 - **Multiple providers, one tool.** Register as many Codex, Claude, Antigravity, or Ollama sessions as you need. Codex and Claude get isolated auth environments; Antigravity is launchable through `agy` with OS-keyring auth; Ollama runs local models through `ollama run`.
 - **Instant launch.** `cdx work` opens your "work" session. `cdx personal` opens another. No config files to edit mid-flow.
 - **Quick relaunch.** `cdx last` reopens the most recently launched assistant profile.
-- **Resume by identity, not by recency.** Each session records the provider's own conversation id — imposed at launch for Claude, read back from the rollout for Codex — so `cdx resume <name>` reopens *that* conversation regardless of your working directory or of which session ran last. `cdx can-resume --json` reports the strategy and where the id came from, so an automated caller can tell a named resume from a best-effort one.
+- **Resume by identity, not by recency.** Each session records the provider's own conversation id — imposed at launch for Claude, read back from the rollout for Codex — so `cdx resume <name>` reopens *that* conversation regardless of your working directory or of which session ran last. The conversation is looked up before it is named: a recorded id whose transcript the provider never wrote degrades to the provider's own fallback (`--continue`, or `resume --last`) and reports `reason: conversation_not_found`, rather than naming a conversation that does not exist and letting the provider exit with an error. `cdx can-resume --json` reports the strategy and where the id came from, so an automated caller can tell a named resume from a best-effort one.
 - **Auth guardrails.** `cdx` checks authentication before launching. If a session is not logged in, it tells you exactly what to run — no silent failures.
 - **Persistent launch settings.** Pin per-session power, permission, and fast-mode preferences once; `cdx` reapplies them on every launch until you unset them.
 - **Spend ceiling and model fallback.** `cdx set <name> --budget 5` caps what a headless run may spend, and `--fallback-model sonnet,haiku` lets a run continue on the next model when the first is overloaded. Both are Claude Code flags that the provider accepts with `--print` only, so they apply to `cdx run` and not to interactive launches; `cdx configs` says so.
@@ -537,7 +537,7 @@ cdx history --summary --from 2026-05-01 --to 2026-05-28
 | `cdx run-tail <run_id> [--lines N] --json` | Last lines of a run's own output, while it is still running or after it finished |
 | `cdx runs [--limit N] [--since 7d\|today\|DATE] --json` | List recent runs; `--since` returns every run completed after the cursor and ignores `--limit` |
 | `cdx schema --json` | Publish the enums, mutually-exclusive argument groups, and error codes programmatic callers should validate against |
-| `cdx stats [name] [--since 7d\|today\|DATE] [--from DATE] [--to DATE] [--json]` | Aggregate launch counts, duration, and known headless token usage by session |
+| `cdx stats [name] [--since 7d\|today\|DATE] [--from DATE] [--to DATE] [--json]` | Aggregate launch counts, duration, and known token usage by session, for headless and interactive runs alike |
 | `cdx status [--json] [--refresh\|--cached] [--timeout SECONDS]` | Show token usage table for all sessions; empty credits, block, and reset columns are omitted; `--cached` skips live provider probes and returns only stored status |
 | `cdx status --small [--refresh\|--cached] [--timeout SECONDS]` / `cdx status -s [--refresh\|--cached] [--timeout SECONDS]` | Show compact token usage table without provider, blocking quota, credits, and updated columns |
 | `cdx status <name> [--json] [--refresh\|--cached] [--timeout SECONDS]` | Show detailed usage breakdown for one session; `--cached` avoids live provider refreshes |
@@ -708,7 +708,49 @@ cdx run \
 
 The result includes `launcher: "cdx"`, `run_id`, selected `session`, `provider`, `exit_code`, `duration_seconds`, absolute `transcript_path`, `stdout_path`, `stderr_path`, and normalized usage token fields. Codex headless runs use `codex exec --json`; Claude headless runs use `claude --print --output-format json`. Token counts are `null` when the provider does not expose a supported JSON or JSONL usage shape.
 
-Known headless and completed interactive token usage is persisted in launch history and can be aggregated later. Interactive records are best-effort local data: Codex reads its latest cumulative rollout snapshot and Claude reads its assistant usage records. Cached input is retained separately from the provider's total, so it is never counted twice.
+Known headless and completed interactive token usage is persisted in launch history and can be aggregated later. Interactive records are best-effort local data: Codex reads its latest cumulative rollout snapshot, Claude reads its assistant usage records, and Ollama — which writes no transcript of its own — is launched with `--verbose` so its per-response token counts land in the terminal capture cdx already takes. Antigravity reports no usage: its history is schema-less binary protobuf and its logs carry no usage line, so those sessions show no tokens by nature rather than by omission.
+
+Every usage record, whichever path produced it, uses one set of definitions:
+
+| Field | Meaning |
+| --- | --- |
+| `input_tokens` | Uncached input **only**. Codex reports a cache-inclusive count natively; cdx reduces it to the remainder so the field means the same thing on every provider. |
+| `cache_creation_tokens` | Tokens written to the provider's prompt cache. |
+| `cache_read_tokens` | Tokens served from it. Kept apart from cache creation because the two cost roughly 1.25x and 0.1x of uncached input, a difference no summed figure can recover. |
+| `cached_input_tokens` | `cache_creation_tokens + cache_read_tokens`, derived. The single CACHE column in `cdx stats` shows this. |
+| `output_tokens` | Generated tokens. |
+| `reasoning_tokens` | Reasoning the provider counts separately. Codex reports one; Claude does not, because it bills thinking as output — those tokens are already inside `output_tokens`, so an empty REASON column for Claude is correct rather than missing. |
+| `total_tokens` | `input + cache_creation + cache_read + output`. Cache is typically the bulk of real consumption, so a total that left it out would not be slightly low — it would be a different quantity. |
+
+Cached input is counted once: it is excluded from `input_tokens` and reported in the cache fields, never in both. `null` means the provider did not report the figure, which is not the same as zero.
+
+`cdx stats` also shows a **`COST~`** column and ranks sessions by it. It weights each token class by what it costs relative to one uncached input token — cache read 0.1x, cache write 1.25x, output 5x — and reports the result in uncached-input-equivalent tokens. These are ratios rather than prices: across the current model lineup output is 5x input on every model and the cache multipliers do not vary by model either, so the figure needs no per-model price table and does not go stale when prices change. It is **not** a currency amount, and it is not comparable across providers whose own prices differ. The cache-write multiplier assumes the five-minute cache TTL; a one-hour TTL costs 2x and nothing in a transcript says which was used, so long-TTL writes are slightly under-weighted.
+
+Ranking on the raw total would put a session that mostly replayed a cache above one that spent far more on generation, because cache reads are typically the overwhelming majority of tokens consumed while costing a fiftieth of an output token.
+
+The **`USD~`** column turns that into money for runs whose serving model cdx recorded. It needs one number per model — the list price per million uncached input tokens — because `COST~` has already absorbed every other rate. Prices live in configuration, not in code: set `CDX_TOKEN_PRICES` to a JSON object mapping model id to dollars per million tokens to override the built-in table, whose last review date is printed with the totals. A run whose model cdx never saw stays unpriced rather than being charged at a default tier, and the totals line says how many runs were actually priced.
+
+The table carries two numbers per model — uncached input and output per million tokens — and derives the cache rates from the input rate: a cache read is 0.1x it and a cache write 1.25x, a relationship that holds on both vendors. Each token class is then priced at its own rate rather than through the weighted figure, because the weighted shortcut is only correct while every model shares one output ratio, and they do not: Anthropic bills output at 5x input, OpenAI at 6x.
+
+Three caveats stated rather than hidden. A run is priced at the model serving its most recent record, so a run that switched models mid-way is priced at the newer one. The figure is an estimate at public list prices — not an invoice. And OpenAI's long-context tier, which roughly doubles both rates above a 272K-token request, is **not** modelled: cdx records tokens per run rather than per request, so it cannot tell which requests crossed that line, and long-context Codex work is under-costed.
+
+A model absent from the table stays unpriced rather than being charged a default tier, and the totals line names it — which is exactly the key `CDX_TOKEN_PRICES` wants:
+
+```
+Totals: 26 runs, ... ; no price for gpt-6-unreleased)
+CDX_TOKEN_PRICES='{"gpt-6-unreleased": {"input": 3, "output": 18}}' cdx stats
+```
+
+**Prices are the only part of this that rots on its own.** A test fails once the table has gone 90 days without review, and `scripts/check_token_prices.py` compares it against published pricing — outside the test suite, since a check that needs the network fails for reasons nobody wants in CI. A row it cannot confirm is reported as unverified, never as passing. When it finds a difference, follow [`docs/token-prices-runbook.md`](docs/token-prices-runbook.md) — which also records where each vendor's numbers actually live, and which pages refuse to be read by a script.
+
+Runs recorded before these definitions existed carry figures that are fictitious rather than imprecise — one real session reported 206.6M cached tokens for a period in which its own conversation consumed 33,608, because the old reader picked whichever transcript had the newest modification time and re-read all of it on every launch. They cannot be recomputed: a run's true usage is the increment its transcript gained while it ran, and nothing recorded that. They are therefore excluded from every total automatically, and the totals line says how many runs that covered — so a period containing only such runs reads as absent rather than as a session that spent nothing. The records themselves are left alone, which keeps them recoverable if the marker ever proves wrong; `cdx repair` clears them from the file for anyone who would rather they were gone:
+
+```
+cdx repair --dry-run      # says how many records carry unvouched usage
+cdx repair                # drops the figures; runs, durations and timestamps stay
+```
+
+Records that *are* vouched for but predate the split — headless runs, and anything recorded between the definition landing and the model being captured — are shown as faithfully as their data allows: they carry no creation/read split and no model, so their cached tokens are read as cache reads for weighting and they stay unpriced. `cdx stats` derives each row's `TOTAL` from the columns it displays, so a row always adds up even while history spans both eras.
 
 ```bash
 cdx stats --since 7d --json

package/VERSION

@@ -1 +1 @@
-0.19.3
+0.20.0

package/changelogs/CHANGELOGS_0_20_0.md

@@ -0,0 +1,71 @@
+# CDX Manager 0.20.0
+
+## Highlights
+
+- `cdx stats` reported token figures that were wrong by up to four orders of magnitude. Every number in that table has been rebuilt on one definition, verified against an independent reader of the same transcripts.
+- Sessions are ranked by what they cost rather than by how many tokens they moved, and priced in currency where the serving model is known.
+- Ollama sessions report real token usage instead of a permanent zero.
+- `cdx resume` works again for Claude, and stops promising resumes that would fail.
+
+## Changes
+
+### One definition for token usage
+
+Three code paths read provider usage — headless stdout, an interactive transcript, and a native background close-out — and each computed the fields its own way. They disagreed in every direction at once: one dropped cache from the total, one counted it twice, one omitted the cached field entirely. All three wrote into the same launch history and the same column, so the table mixed definitions without saying so.
+
+`src/run_usage.py` now owns the definition and all three normalize to it. `input_tokens` is the uncached remainder on every provider; cache creation and cache read are separate fields because they cost 1.25x and 0.1x of uncached input and no summed figure can recover that split; the total covers all four token classes. The run registry normalizes on the way in, so `cdx run --json`, `cdx run-status` and `cdx run-report` publish the same shape.
+
+An independent reader of the same transcripts now agrees with cdx exactly, field by field.
+
+### Each run is billed for its own tokens
+
+Both interactive readers report a cumulative figure and every run stored it, so a resumed session was re-billed for its entire history on each resume — one observed session's cache read went from 2.6M to 7.6M on a single additional launch, and `cdx stats` summed that inflation again.
+
+A run now stores the increment over the previous run on the same transcript. A shrunk, rotated or replaced transcript reports absence rather than arithmetic, and the first run against a transcript that predates it leaves a baseline without claiming history it never measured.
+
+### Each billed response is counted once
+
+A Claude transcript records the same billed API response under several record ids. Counting per record inflated one real transcript by 1.55x — 2741 rows for 1765 distinct responses. De-duplication now keys on the API response itself.
+
+### The session's own transcript
+
+Usage was read from whichever transcript in the provider home had the newest modification time, so a run could be billed against an unrelated project's file — sessions reported three runs and eighteen output tokens. Resolution is now by the conversation id cdx already holds, and a scan that cannot conclude reports absence instead of whichever candidate it had reached.
+
+### Ranked by cost, and priced
+
+A raw token total ranks a cache read equal to an output token worth fifty times more, and cache reads are typically the overwhelming majority of tokens — so the old ranking was very nearly a measure of cache reads alone.
+
+`cdx stats` gains a `COST~` column and sorts on it, weighting each token class by its cost relative to an uncached input token. A `USD~` column prices runs whose serving model cdx recorded, from a table carrying two numbers per model. A model absent from that table stays unpriced rather than charged a default tier, and the totals line names it.
+
+`CDX_TOKEN_PRICES` overrides the table without a release. `scripts/check_token_prices.py` compares it against published pricing, a test fails once it has gone ninety days unreviewed, and `docs/token-prices-runbook.md` records where each vendor's numbers actually live.
+
+### Ollama token usage
+
+Ollama writes no transcript of its own, so it is now launched with `--verbose` and its per-response counts are parsed from the terminal capture cdx already takes — after the same normalization the handoff reader applies, because a real capture carries cursor sequences between individual words.
+
+The provider-flag health check now covers flags cdx passes on its own initiative, not only permission mappings.
+
+### Resume
+
+`cdx <session> --resume` minted a fresh conversation id and then asked the provider to resume it, so every Claude resume failed with `No conversation found with session ID`. A resume now carries the conversation it is resuming.
+
+Resumability is a checked fact rather than a stored string: a recorded conversation the provider never wrote degrades to `--continue` or `resume --last` and reports `conversation_not_found`, instead of being named and failing. What `cdx can-resume --json` reports and what `cdx resume` runs now read the same decision.
+
+### Dropping figures cdx cannot vouch for
+
+Launch history written before these definitions is fictitious rather than imprecise, and cannot be recomputed: a run's true usage is the increment its transcript gained while it ran, and nothing recorded that. They are excluded from every total automatically from this release, with the totals line naming how many runs that covered — no command to remember, and no upgrade that leaves the fiction on screen. The stored records are left intact so they stay recoverable; `cdx repair` clears them from the file for anyone who wants that.
+
+## Upgrading
+
+Usage records gain `cache_creation_tokens` and `cache_read_tokens`; existing fields keep their names and `cached_input_tokens` remains their sum. `cdx stats --json` gains `weighted_tokens`, `cost_usd`, `priced_runs`, `unpriced_models` and `unvouched_runs`. Nothing was removed.
+
+`cdx can-resume --json` can now report `reason: conversation_not_found`. `resumable` stays `true` in every case that used to return it; only the strategy changes.
+
+Token totals will drop, in some cases sharply — one real session fell from 206.6M to 361.3K. That is the fiction leaving, not data loss: the totals line reports how many runs were excluded, and `cdx repair --dry-run` says how many stored records carry such usage.
+
+## Known limits
+
+- Historical figures are excluded rather than corrected; recomputation is not possible, so those runs report no usage at all.
+- OpenAI's long-context tier, which roughly doubles both rates above a 272K-token request, is not modelled: cdx records tokens per run rather than per request, so long-context Codex work is under-costed.
+- A run that switched models mid-way is priced at the model serving its most recent record.
+- OpenAI prices were taken from third-party aggregators; `openai.com` refuses automated fetches. This is why the drift check exists.

package/checksums/release-archives.json

@@ -298,6 +298,17 @@
     "v0.19.2": {
       "github_tarball_sha256": "d644666c727b2a29fa022700da1c23483173a2110606b994d200f72feb959c3b",
       "github_zip_sha256": "bca42637ddab4502e2dd6d9d63239eca322d953f8d910d8ada209fcfdd2f98d4"
+    },
+    "v0.19.3": {
+      "github_tarball_sha256": "23e264e7c7f87b1da7052fa47c67e54454e4eee0a27d121565db155324845a06",
+      "github_zip_sha256": "5b6eb81fc09581ba25584ad98a99141b1e50433ad76c7261ba4696abf601f274",
+      "tray_assets": {
+        "aarch64-apple-darwin": "bf289a773c32549cd78028b57dcdfd3d60c6436b038899ce160e84e1f88e9a9d",
+        "aarch64-unknown-linux-musl": "4e29448f0acae916ce8b57132d5dfd24dd89c28184f21993bc6346a9aa82ec2f",
+        "x86_64-apple-darwin": "a3931de7c38beaba4725940c29692c975f0d078c3a1e7d0ed610061cee6cab81",
+        "x86_64-pc-windows-msvc": "c5a29140bb9d634f2533084084ca10cb90ca64d34cac1b664998d305b934a7fb",
+        "x86_64-unknown-linux-musl": "d1850f3acdede7c2cdcd31b5ca6d5e2372535a32bf75c0e6c8fd0100af7813f2"
+      }
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cdx-manager",
-  "version": "0.19.3",
+  "version": "0.20.0",
   "description": "Terminal session manager for Codex and Claude accounts.",
   "license": "MIT",
   "author": "Alexandre Agostini",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cdx-manager"
-version = "0.19.3"
+version = "0.20.0"
 description = "Terminal session manager for Codex and Claude accounts."
 readme = "README.md"
 requires-python = ">=3.9"

package/src/commands/launch.py

@@ -25,8 +25,8 @@ from ..cli_render import _dim, _info, _success, _warn
 from ..config import PROVIDER_CODEX
 from ..context_store import install_context_for_session, write_context
 from ..errors import CdxError
-from ..interactive_usage import extract_interactive_usage
-from ..provider_runtime import _ensure_session_authentication, _get_auth_home, _run_interactive_provider_command
+from ..interactive_usage import extract_interactive_usage, transcript_predates_run, usage_delta
+from ..provider_runtime import _conversation_id, _ensure_session_authentication, _get_auth_home, _run_interactive_provider_command
 
 
 def _parse_launch_args(args):
@@ -199,7 +199,7 @@ def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=No
             f"Provider {session['provider']} does not support native resume through cdx."
         )
     cwd = _launch_directory(session, ctx, directory, json_flag)
-    session = ctx["service"]["launch_session"](command)
+    session = ctx["service"]["launch_session"](command, resume=resume)
     capability = _resume_capability_for_session(session, ctx) if resume else None
     if not json_flag and not ctx["stdin_is_tty"]:
         ctx["out"](f"Using directory: {cwd}\n")
@@ -265,7 +265,9 @@ def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=No
         )
     except CdxError as error:
         run_info = getattr(error, "run_info", {}) or {}
-        _attach_interactive_usage(session, run_info)
+        run_info = _attach_interactive_usage(
+            session, run_info, ctx["service"]["get_launch_history"](session["name"], limit=50)
+        )
         if runtime_run_id:
             ctx["service"]["finish_session_runtime"](
                 session["name"],
@@ -286,7 +288,9 @@ def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=No
         "action": "resume" if resume else "launch",
         "cwd": cwd,
         "exit_code": 0,
-        **_attach_interactive_usage(session, run_info),
+        **_attach_interactive_usage(
+            session, run_info, ctx["service"]["get_launch_history"](session["name"], limit=50)
+        ),
     })
     if json_flag:
         extra = {"session": ctx["service"]["get_session"](session["name"]), "cwd": cwd}
@@ -296,18 +300,68 @@ def handle_launch(command, ctx, initial_prompt=None, resume=False, force_json=No
     return 0
 
 
-def _attach_interactive_usage(session, run_info):
-    """Attach best-effort local provider usage without affecting launch outcome."""
+def _attach_interactive_usage(session, run_info, history=None):
+    """Attach this run's own token usage without affecting launch outcome.
+
+    Both interactive readers report a cumulative figure, so what a run *stores*
+    has to be the increment over the previous run on the same transcript --
+    otherwise a resumed session re-bills its whole history on every resume, and
+    `cdx stats` sums that inflation again.
+
+    The cumulative is kept beside the delta as `usage_cumulative`: it is the
+    baseline the next run differences against, and without it a single run that
+    recorded nothing would break the chain for every run after it.
+    """
     run_info = dict(run_info or {})
-    usage, provider_transcript = extract_interactive_usage(
-        session.get("provider"), _get_auth_home(session), run_info.get("started_at")
+    started_at = run_info.get("started_at")
+    cumulative, provider_transcript, match, model = extract_interactive_usage(
+        session.get("provider"), _get_auth_home(session), started_at, _conversation_id(session),
+        # Ollama writes no provider transcript; its only record is the PTY
+        # capture this run already took.
+        run_info.get("transcript_path"),
     )
-    if usage:
-        run_info["usage"] = usage
     if provider_transcript:
         run_info["provider_transcript_path"] = provider_transcript
+        # How the transcript was found travels with the number. A recency match
+        # is a guess that happened to be the newest file; recording it the same
+        # way as an id match would let a wrong attribution read as a
+        # measurement, which is the failure this replaced.
+        run_info["provider_transcript_match"] = match
+    if not cumulative:
+        return run_info
+
+    run_info["usage_cumulative"] = cumulative
+    if model:
+        # Which model actually served the run, read from the transcript rather
+        # than inferred from the session's configured launch settings -- where
+        # `model` is optional and usually unset, because the session takes the
+        # provider's default.
+        run_info["usage_model"] = model
+    previous = _previous_cumulative(history, provider_transcript)
+    if previous is not None:
+        delta = usage_delta(cumulative, previous)
+        if delta is not None:
+            run_info["usage"] = delta
+        # A None delta means the transcript shrank, rotated, or was replaced.
+        # The baseline above still updates, so the next run recovers.
+    elif not transcript_predates_run(provider_transcript, started_at):
+        # First sighting of a transcript this run created: all of it is ours.
+        run_info["usage"] = cumulative
     return run_info
 
+
+def _previous_cumulative(history, transcript_path):
+    """The cumulative the last run on this same transcript left behind."""
+    if not history or not transcript_path:
+        return None
+    for entry in history:
+        if entry.get("provider_transcript_path") != transcript_path:
+            continue
+        cumulative = entry.get("usage_cumulative")
+        if isinstance(cumulative, dict):
+            return cumulative
+    return None
+
 def handle_handoff(rest, ctx):
     json_flag, args = _parse_json_flag(rest)
     if len(args) not in (1, 2):

package/src/commands/status.py

@@ -41,6 +41,14 @@ from ..commands.launch import handle_launch
 from ..config import PROVIDER_CLAUDE
 from ..errors import CdxError
 from ..provider_runtime import AUTH_PROBE_AUTHENTICATED, AUTH_PROBE_DEGRADED, _probe_provider_auth_status
+from ..run_usage import (
+    USAGE_KEYS,
+    estimate_cost,
+    is_vouched,
+    normalize_usage,
+    token_prices,
+    weighted_usage,
+)
 from ..status_view import _format_status_detail, _format_status_rows, format_priority_instruction, recommend_priority_rows
 
 
@@ -174,6 +182,12 @@ def _format_launch_configs(sessions, use_color=False):
     lines.append(_dim(_format_launch_settings_hint(), use_color))
     return "\n".join(lines)
 
+def _format_usd(amount):
+    if not amount:
+        return "-"
+    return f"${amount:,.2f}" if amount >= 0.01 else "<$0.01"
+
+
 def _format_duration_ms(value):
     if value is None:
         return "-"
@@ -252,8 +266,15 @@ def _summarize_stats(entries):
             "failures": 0,
             "duration_ms": 0,
             "usage_runs": 0,
+            "cost_usd": 0.0,
+            "weighted_tokens": 0,
+            "priced_runs": 0,
+            "unpriced_models": set(),
+            "unvouched_runs": 0,
             "input_tokens": 0,
             "cached_input_tokens": 0,
+            "cache_creation_tokens": 0,
+            "cache_read_tokens": 0,
             "output_tokens": 0,
             "reasoning_tokens": 0,
             "total_tokens": 0,
@@ -269,21 +290,103 @@ def _summarize_stats(entries):
         except (TypeError, ValueError):
             pass
         usage = entry.get("usage") if isinstance(entry.get("usage"), dict) else {}
+        if usage and not is_vouched(usage):
+            # Written before the definition existed, so the figures are
+            # fictitious rather than merely old. Excluded from every total and
+            # counted, so the exclusion is visible instead of silent.
+            row["unvouched_runs"] += 1
+            usage = {}
         parsed_usage = {
             key: _token_value(usage, key)
-            for key in ("input_tokens", "cached_input_tokens", "output_tokens", "reasoning_tokens", "total_tokens")
+            for key in USAGE_KEYS
         }
         if any(value is not None for value in parsed_usage.values()):
             row["usage_runs"] += 1
             for key, value in parsed_usage.items():
                 row[key] += value or 0
+            # Priced per run, against the model that served it. A run whose
+            # model cdx never saw stays unpriced rather than being charged at a
+            # default tier, and `priced_runs` says how much of the figure is
+            # actually covered.
+            # Weighted per entry, not on the summed row: the output ratio is
+            # the one multiplier that differs between vendors, and a session's
+            # runs can span models.
+            row["weighted_tokens"] += weighted_usage(
+                entry.get("usage"), entry.get("usage_model")) or 0
+            cost = estimate_cost(entry.get("usage"), entry.get("usage_model"))
+            if cost is not None:
+                row["cost_usd"] += cost
+                row["priced_runs"] += 1
+            elif entry.get("usage_model"):
+                # Named the model but could not price it. Recording which one
+                # turns an unexplained "-" into something actionable: that
+                # string is exactly what CDX_TOKEN_PRICES needs a key for.
+                row["unpriced_models"].add(entry["usage_model"])
         started = entry.get("started_at")
         if started and (not row["last_started_at"] or started > row["last_started_at"]):
             row["last_started_at"] = started
             row["provider"] = entry.get("provider") or row["provider"]
+    for row in rows.values():
+        # Derive from the summed parts rather than summing each run's stored
+        # total. Records written before the definition was settled carry a
+        # total that excluded cache, and adding those to correct ones produced
+        # a row that contradicted itself -- CACHE in the hundreds of millions
+        # beside a TOTAL in the low millions.
+        #
+        # Those records also lack the creation/read split, so the fused
+        # `cached_input_tokens` is the one field both eras share. Where the
+        # split is missing it is read as cache read: that is what the
+        # overwhelming majority of cached tokens are, and weighting the whole
+        # of it at the creation rate would overstate legacy sessions by more
+        # than reading it as reads understates them.
+        split = row["cache_creation_tokens"] + row["cache_read_tokens"]
+        legacy_cache = max(0, row["cached_input_tokens"] - split)
+        derived = normalize_usage(
+            input_tokens=row["input_tokens"],
+            cache_creation_tokens=row["cache_creation_tokens"],
+            cache_read_tokens=row["cache_read_tokens"] + legacy_cache,
+            output_tokens=row["output_tokens"],
+        )
+        row["total_tokens"] = derived["total_tokens"] or 0
+        if not row["weighted_tokens"]:
+            # Records written before the model was recorded: weigh the row as a
+            # whole, at the default ratio, rather than reporting nothing.
+            row["weighted_tokens"] = weighted_usage(derived) or 0
+        row["unpriced_models"] = sorted(row["unpriced_models"])
+    for row in rows.values():
+        # Derive from the summed parts rather than summing each run's stored
+        # total. Records written before the definition was settled carry a
+        # total that excluded cache, and adding those to correct ones produced
+        # a row that contradicted itself -- CACHE in the hundreds of millions
+        # beside a TOTAL in the low millions.
+        #
+        # Those records also lack the creation/read split, so the fused
+        # `cached_input_tokens` is the one field both eras share. Where the
+        # split is missing it is read as cache read: that is what the
+        # overwhelming majority of cached tokens are, and weighting the whole
+        # of it at the creation rate would overstate legacy sessions by more
+        # than reading it as reads understates them.
+        split = row["cache_creation_tokens"] + row["cache_read_tokens"]
+        legacy_cache = max(0, row["cached_input_tokens"] - split)
+        derived = normalize_usage(
+            input_tokens=row["input_tokens"],
+            cache_creation_tokens=row["cache_creation_tokens"],
+            cache_read_tokens=row["cache_read_tokens"] + legacy_cache,
+            output_tokens=row["output_tokens"],
+        )
+        row["total_tokens"] = derived["total_tokens"] or 0
+        if not row["weighted_tokens"]:
+            # Records written before the model was recorded: weigh the row as a
+            # whole, at the default ratio, rather than reporting nothing.
+            row["weighted_tokens"] = weighted_usage(derived) or 0
+        row["unpriced_models"] = sorted(row["unpriced_models"])
     return sorted(
         rows.values(),
-        key=lambda item: (item["total_tokens"], item["duration_ms"], item.get("last_started_at") or "", item["session_name"]),
+        # Ranked by what a session cost, not by how many tokens it moved: a
+        # cache read is 0.1x an uncached input token and an output token is 5x,
+        # so a raw total sorts a cache-heavy session above one that spent far
+        # more on generation.
+        key=lambda item: (item["weighted_tokens"], item["duration_ms"], item.get("last_started_at") or "", item["session_name"]),
         reverse=True,
     )
 
@@ -295,11 +398,12 @@ def _stats_totals(rows):
         "failures": sum(row["failures"] for row in rows),
         "duration_ms": sum(row["duration_ms"] for row in rows),
         "usage_runs": sum(row["usage_runs"] for row in rows),
-        "input_tokens": sum(row["input_tokens"] for row in rows),
-        "cached_input_tokens": sum(row["cached_input_tokens"] for row in rows),
-        "output_tokens": sum(row["output_tokens"] for row in rows),
-        "reasoning_tokens": sum(row["reasoning_tokens"] for row in rows),
-        "total_tokens": sum(row["total_tokens"] for row in rows),
+        **{key: sum(row[key] for row in rows) for key in USAGE_KEYS},
+        "weighted_tokens": sum(row["weighted_tokens"] for row in rows),
+        "cost_usd": sum(row["cost_usd"] for row in rows),
+        "priced_runs": sum(row["priced_runs"] for row in rows),
+        "unpriced_models": sorted({m for row in rows for m in row["unpriced_models"]}),
+        "unvouched_runs": sum(row["unvouched_runs"] for row in rows),
     }
 
 def _format_history_period(period):
@@ -391,7 +495,7 @@ def _format_stats(rows, totals, period=None, use_color=False, active_sessions=No
     if not rows:
         return "No launch stats for this period." if _has_history_period(period or {}) else "No launch stats."
     table = [[_style(value, "1", use_color) for value in [
-        "SESSION", "PROV.", "RUNS", "USAGE", "IN", "CACHE", "OUT", "REASON", "TOTAL", "TIME", "LAST"
+        "SESSION", "PROV.", "RUNS", "USAGE", "IN", "CACHE", "OUT", "REASON", "TOTAL", "COST~", "USD~", "TIME", "LAST"
     ]]]
     for row in rows:
         session_name = row["session_name"]
@@ -405,7 +509,10 @@ def _format_stats(rows, totals, period=None, use_color=False, active_sessions=No
             _style(_format_token_count(row["cached_input_tokens"]), "96" if row["cached_input_tokens"] else "2", use_color),
             _style(_format_token_count(row["output_tokens"]), "96" if row["output_tokens"] else "2", use_color),
             _style(_format_token_count(row["reasoning_tokens"]), "95" if row["reasoning_tokens"] else "2", use_color),
-            _style(_format_token_count(row["total_tokens"]), "1;96" if row["total_tokens"] else "2", use_color),
+            _style(_format_token_count(row["total_tokens"]), "96" if row["total_tokens"] else "2", use_color),
+            _style(_format_token_count(row["weighted_tokens"]), "1;95" if row["weighted_tokens"] else "2", use_color),
+            _style(_format_usd(row["cost_usd"]) if row["priced_runs"] else "-",
+                   "1;33" if row["priced_runs"] else "2", use_color),
             _style(_format_duration_ms(row["duration_ms"]), "33" if row["duration_ms"] else "2", use_color),
             _dim(_format_relative_age(row.get("last_started_at")), use_color),
         ])
@@ -419,8 +526,18 @@ def _format_stats(rows, totals, period=None, use_color=False, active_sessions=No
         _dim(
             "Totals: "
             f"{totals['launches']} runs, {totals['usage_runs']} with usage, "
-            f"{_format_token_count(totals['total_tokens'])} tokens, "
-            f"{_format_duration_ms(totals['duration_ms'])}.",
+            f"{_format_token_count(totals['total_tokens'])} tokens "
+            f"({_format_token_count(totals['weighted_tokens'])} cost-equivalent"
+            + (f", {_format_usd(totals['cost_usd'])} at list on {totals['priced_runs']} priced run"
+               f"{'s' if totals['priced_runs'] != 1 else ''} [{token_prices()[1]}]"
+               if totals["priced_runs"] else ", no run priced")
+            + (f"; no price for {', '.join(totals['unpriced_models'])}"
+               if totals["unpriced_models"] else "") + "), "
+            + (f"{totals['unvouched_runs']} run"
+               f"{'s' if totals['unvouched_runs'] != 1 else ''} excluded "
+               f"(recorded before cdx could measure them; cdx repair clears these), "
+               if totals["unvouched_runs"] else "")
+            + f"{_format_duration_ms(totals['duration_ms'])}.",
             use_color,
         ),
     ])

package/src/health.py

@@ -12,6 +12,7 @@ from .cli_render import _pad_table, _style
 from .config import PROVIDER_ANTIGRAVITY, PROVIDER_CLAUDE, PROVIDER_CODEX, PROVIDER_OLLAMA
 from .provider_runtime import (
     HEADLESS_CODEX_PERMISSION_ARGS,
+    LAUNCH_FEATURE_ARGS,
     LAUNCH_PERMISSION_ARGS,
     codex_auth_diagnostic,
 )
@@ -173,12 +174,17 @@ def _extract_version(text):
 
 
 def _mapped_provider_flags(provider):
-    """Every distinct flag cdx would pass to this provider, by permission.
+    """Every distinct flag cdx would pass to this provider, by reason.
 
     Read off the same mappings the launch specs use, so a permission added
     there is automatically covered here rather than quietly unverified.
     Values (a sandbox name, a config expression) are not flags and are not
     checked — only the options themselves.
+
+    Covers flags cdx passes on its own initiative as well as permission
+    mappings. Issue #8 was a mapped flag the CLI never had; a flag cdx invents
+    for a feature of its own is exactly as capable of not existing, and used to
+    pass through here unverified because it belonged to no permission.
     """
     mappings = {}
     interactive = LAUNCH_PERMISSION_ARGS.get(provider)
@@ -186,6 +192,9 @@ def _mapped_provider_flags(provider):
         # No entry at all means nobody declared this provider's mapping, which
         # is different from declaring that it has none.
         return {}
+    for flag in LAUNCH_FEATURE_ARGS.get(provider, []):
+        if flag.startswith("-"):
+            mappings.setdefault("cdx feature flags", set()).add(flag)
     for permission, args in interactive.items():
         mappings.setdefault(permission, set()).update(
             arg for arg in args if arg.startswith("-")