claude-code-cache-fix 3.4.0 → 3.5.1

package/README.ko.md

@@ -39,7 +39,7 @@ ANTHROPIC_BASE_URL=http://127.0.0.1:9801 claude
 | `identity-normalization` | 접두사 안정성을 위해 메시지 ID 필드를 정규화합니다 |
 | `fresh-session-sort` | 첫 번째 턴의 비결정적 순서를 수정합니다 |
 | `cache-control-normalize` | 메시지 간 cache_control 마커를 정규화합니다 |
-| `cache-telemetry` | 응답 헤더에서 캐시 통계를 추출하여 `~/.claude/quota-status.json`에 기록합니다 |
+| `cache-telemetry` | 응답 헤더에서 캐시 통계를 추출하여 `~/.claude/quota-status/{account.json,sessions/<id>.json}`에 기록합니다 |
 
 확장은 핫리로드됩니다 — `proxy/extensions/`에서 `.mjs` 파일을 추가, 제거 또는 수정하면 프록시 재시작 없이 다음 요청부터 적용됩니다. 설정은 `proxy/extensions.json`에 있습니다.
 
@@ -202,7 +202,7 @@ Fixes are disabled — consider re-enabling to recover cache performance.
 
 ## 상태 표시줄 — 실시간 쿼터 경고
 
-프록시와 프리로드 모드 모두 매 API 호출마다 `~/.claude/quota-status.json`에 쿼터 상태를 기록합니다. 포함된 `tools/quota-statusline.sh` 스크립트로 실시간 상태를 표시할 수 있습니다:
+두 모드 모두 매 API 호출마다 쿼터 상태를 기록합니다. 프록시 모드(v3.5.0+)는 `~/.claude/quota-status/account.json`(계정 전역: Q5h/Q7d, 상태, 초과)과 `~/.claude/quota-status/sessions/<id>.json`(세션별: TTL 계층, 적중률)로 분리됩니다. 프리로드 모드는 기존 `~/.claude/quota-status.json`(구조상 단일 세션)을 유지합니다. 포함된 `tools/quota-statusline.sh` 스크립트로 실시간 상태를 표시할 수 있습니다:
 
 - **Q5h %** (소진율, %/분)
 - **Q7d %** (소진율, %/시간)
@@ -292,7 +292,7 @@ npm install sharp
 
 ## 모니터링 & 진단
 
-프리로드 인터셉터에는 마이크로컴팩트 열화, 가상 속도 제한기, GrowthBook 플래그 상태, 사용량 텔레메트리, 비용 리포트에 대한 모니터링이 포함됩니다. 쿼터 추적은 프록시와 프리로드 모드 모두에서 `~/.claude/quota-status.json`을 통해 동작합니다.
+프리로드 인터셉터에는 마이크로컴팩트 열화, 가상 속도 제한기, GrowthBook 플래그 상태, 사용량 텔레메트리, 비용 리포트에 대한 모니터링이 포함됩니다. 쿼터 추적은 `~/.claude/quota-status/`(프록시: 세션별 분리) 또는 `~/.claude/quota-status.json`(프리로드: 단일 세션 레거시 경로)을 통해 동작합니다.
 
 전체 상세, 디버그 모드, 접두사 비교, 환경 변수, 내장 쿼터 분석 도구는 [docs/monitoring.md](docs/monitoring.md)를 참조하십시오.
 

package/README.md

@@ -39,7 +39,7 @@ On every `/v1/messages` request, 7 extensions run in order:
 | `identity-normalization` | Normalizes message identity fields for prefix stability |
 | `fresh-session-sort` | Fixes non-deterministic ordering on first turn |
 | `cache-control-normalize` | Normalizes cache_control markers across messages |
-| `cache-telemetry` | Extracts cache stats from response headers → `~/.claude/quota-status.json` |
+| `cache-telemetry` | Extracts cache stats from response headers → `~/.claude/quota-status/{account.json,sessions/<id>.json}` |
 
 Extensions are hot-reloadable — add, remove, or modify `.mjs` files in `proxy/extensions/` and changes apply to the next request without restarting. Configuration in `proxy/extensions.json`.
 
@@ -280,7 +280,7 @@ The interceptor can only *help* or *do nothing*. It cannot make things worse.
 
 ## Status line — quota warnings in real time
 
-Both proxy and preload modes write quota state to `~/.claude/quota-status.json` on every API call. The included `tools/quota-statusline.sh` script displays a live status line showing:
+Both modes write quota state on every API call. Proxy mode (v3.5.0+) splits into `~/.claude/quota-status/account.json` (account-global fields: Q5h/Q7d, status, overage) plus `~/.claude/quota-status/sessions/<id>.json` (per-session cache fields: TTL tier, hit rate). Preload mode keeps the legacy `~/.claude/quota-status.json` (single-session by construction). The included `tools/quota-statusline.sh` script displays a live status line showing:
 
 - **Q5h %** with burn rate (%/min)
 - **Q7d %** with burn rate (%/hr)
@@ -468,7 +468,7 @@ The interceptor can rewrite Claude Code's `# Output efficiency` system-prompt se
 
 ## Monitoring & diagnostics
 
-The preload interceptor includes monitoring for microcompact degradation, false rate limiters, GrowthBook flag state, usage telemetry, and cost reporting. Quota tracking works in both proxy and preload modes via `~/.claude/quota-status.json`.
+The preload interceptor includes monitoring for microcompact degradation, false rate limiters, GrowthBook flag state, usage telemetry, and cost reporting. Quota tracking works in both proxy and preload modes via `~/.claude/quota-status/` (proxy: per-session split) or `~/.claude/quota-status.json` (preload: single-session legacy path).
 
 See [docs/monitoring.md](docs/monitoring.md) for full details, debug mode, prefix diffing, environment variables, and the bundled quota analysis tool.
 
@@ -493,6 +493,7 @@ We monitor 30+ upstream Claude Code issues related to cache, quota, and context
 ## Used in production
 
 - **[Crunchloop DAP](https://dap.crunchloop.ai)** — Agent SDK / DAP development environment. First production team to merge the interceptor to trunk for team-wide deployment (2026-04-10). Identified two distinct cache regression patterns through real-world testing — tool ordering jitter and the fresh-session sort gap — and contributed debug traces that drove the v1.5.1 and v1.6.2 fixes.
+- **[VM Farms](https://vmfarms.com)** ([@vmfarms](https://github.com/vmfarms)) — Agent development environment running concurrent multi-runner workloads with `--resume --fork-session`. Surfaced three cache-fix proxy-mode bugs: the resume-marker regex no-op (#96), TTL tier detection gap vs preload mode (#97), and image-strip stderr leak past `CACHE_FIX_DEBUG` (#98) — all addressed in the v3.4.0 release.
 
 ## Contributors
 
@@ -509,6 +510,7 @@ We monitor 30+ upstream Claude Code issues related to cache, quota, and context
 - **[@JEONG-JIWOO](https://github.com/JEONG-JIWOO)** — VS Code extension investigation: discovered `claudeCode.claudeProcessWrapper` as the working integration path, wrote the C wrapper for Windows (#16)
 - **[@X-15](https://github.com/X-15)** — VS Code extension validation, per-fix health status analysis confirming safety check behavior on v2.1.105 (#16)
 - **[@deafsquad](https://github.com/deafsquad)** — Universal smoosh_split un-smoosh fix (PR #26), source-level function attribution of resume scatter bug (anthropics/claude-code#43657), OTEL telemetry discovery, proposed and built proxy architecture for v3.0.0
+- **[@vmfarms](https://github.com/vmfarms)** — Concurrent multi-runner production validation, surfaced proxy-mode resume-marker regex no-op (#96), TTL tier detection gap (#97), and image-strip stderr leak (#98)
 
 If you contributed to the community effort on these issues and aren't listed here, please open an issue or PR — we want to credit everyone properly.
 

package/README.zh.md

@@ -39,7 +39,7 @@ ANTHROPIC_BASE_URL=http://127.0.0.1:9801 claude
 | `identity-normalization` | 规范化消息身份字段以保持前缀稳定性 |
 | `fresh-session-sort` | 修复首次轮次的非确定性排序 |
 | `cache-control-normalize` | 规范化消息间的 cache_control 标记 |
-| `cache-telemetry` | 从响应头提取缓存统计 → `~/.claude/quota-status.json` |
+| `cache-telemetry` | 从响应头提取缓存统计 → `~/.claude/quota-status/{account.json,sessions/<id>.json}` |
 
 扩展支持热重载 — 在 `proxy/extensions/` 中添加、删除或修改 `.mjs` 文件，更改将在下一次请求时生效，无需重启。配置在 `proxy/extensions.json` 中。
 
@@ -167,7 +167,7 @@ NODE_OPTIONS="--import claude-code-cache-fix" claude
 
 ## 状态栏 — 实时配额警告
 
-代理和预加载模式都会在每次 API 调用时将配额状态写入 `~/.claude/quota-status.json`。内置的 `tools/quota-statusline.sh` 脚本显示实时状态栏：
+两种模式在每次 API 调用时都会写入配额状态。代理模式（v3.5.0+）拆分为 `~/.claude/quota-status/account.json`（账户级：Q5h/Q7d、状态、超额）和 `~/.claude/quota-status/sessions/<id>.json`（每会话：TTL 层级、命中率）。预加载模式保留旧版 `~/.claude/quota-status.json`（按构造为单会话）。内置的 `tools/quota-statusline.sh` 脚本显示实时状态栏：
 
 - **Q5h %** 及消耗速率（%/分钟）
 - **Q7d %** 及消耗速率（%/小时）
@@ -200,7 +200,7 @@ export CACHE_FIX_IMAGE_KEEP_LAST=3
 
 ## 监控与诊断
 
-预加载拦截器包含对微压缩降级、虚假速率限制器、GrowthBook 标志状态、使用量遥测和成本报告的监控。配额追踪在代理和预加载模式下均通过 `~/.claude/quota-status.json` 工作。
+预加载拦截器包含对微压缩降级、虚假速率限制器、GrowthBook 标志状态、使用量遥测和成本报告的监控。配额追踪通过 `~/.claude/quota-status/`（代理：按会话拆分）或 `~/.claude/quota-status.json`（预加载：单会话旧路径）工作。
 
 完整详情、调试模式、前缀差异对比、环境变量和内置配额分析工具请参见 [docs/monitoring.md](docs/monitoring.md)。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-cache-fix",
-  "version": "3.4.0",
+  "version": "3.5.1",
   "description": "Cache optimization proxy and interceptor for Claude Code. Fixes prompt cache bugs, stabilizes prefix, reduces quota burn.",
   "type": "module",
   "exports": "./preload.mjs",

package/proxy/extensions/cache-telemetry.mjs

@@ -1,8 +1,63 @@
-import { writeFileSync, mkdirSync } from "node:fs";
+import {
+  writeFileSync,
+  renameSync,
+  unlinkSync,
+  mkdirSync,
+  readdirSync,
+  statSync,
+} from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { createHash, randomBytes } from "node:crypto";
 
-const QUOTA_PATH = join(homedir(), ".claude", "quota-status.json");
+// Paths are resolved per call (not cached at module load) so tests can swap
+// $HOME between cases. The homedir() call is essentially free.
+function paths() {
+  const home = homedir();
+  const quotaDir = join(home, ".claude", "quota-status");
+  return {
+    quotaDir,
+    accountPath: join(quotaDir, "account.json"),
+    sessionsDir: join(quotaDir, "sessions"),
+    legacyPath: join(home, ".claude", "quota-status.json"),
+  };
+}
+
+const SAFE_NAME_RE = /^[A-Za-z0-9_-]{1,128}$/;
+const SWEEP_THROTTLE_MS = 60_000;
+const DEFAULT_TTL_DAYS = 7;
+
+// --- Module-scope state ---
+let legacyCleanupDone = false;
+let lastSweepMs = 0;
+
+// Per directive `proxy-quota-status-per-session.md` — derive a filesystem-safe
+// filename from a raw session id. Both writer (this extension) and readers
+// (tools/quota-statusline.sh, etc.) must apply the same rule.
+//
+// Rules:
+//   - null/undefined/empty/whitespace → "unknown"
+//   - matches /^[A-Za-z0-9_-]{1,128}$/ → raw passthrough
+//   - else → "inv-" + sha256(raw)[:16]
+//
+// Exported for unit testing and for the directive's writer/reader contract.
+export function sessionFilename(rawId) {
+  if (rawId === null || rawId === undefined) return "unknown";
+  const s = String(rawId).trim();
+  if (s.length === 0) return "unknown";
+  if (SAFE_NAME_RE.test(s)) return s;
+  return "inv-" + createHash("sha256").update(s).digest("hex").slice(0, 16);
+}
+
+function resolveSessionId(headers) {
+  if (!headers) return null;
+  const sid =
+    headers["x-claude-code-session-id"] ||
+    headers["x-session-id"] ||
+    headers["x-anthropic-session-id"] ||
+    null;
+  return sid || null;
+}
 
 function parseHeaders(headers) {
   const get = (key) => headers[key] || "";
@@ -44,11 +99,69 @@ function parseHeaders(headers) {
   };
 }
 
+function atomicWrite(finalPath, content) {
+  const tmp = `${finalPath}.tmp.${process.pid}.${randomBytes(4).toString("hex")}`;
+  writeFileSync(tmp, content);
+  renameSync(tmp, finalPath);
+}
+
+function cleanupLegacyOnce() {
+  if (legacyCleanupDone) return;
+  legacyCleanupDone = true;
+  try {
+    unlinkSync(paths().legacyPath);
+  } catch {}
+}
+
+function sweepStaleSessions(ttlDays) {
+  const now = Date.now();
+  if (now - lastSweepMs < SWEEP_THROTTLE_MS) return;
+  lastSweepMs = now;
+
+  const cutoffMs = now - ttlDays * 86_400_000;
+  const { sessionsDir } = paths();
+  let entries;
+  try {
+    entries = readdirSync(sessionsDir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const p = join(sessionsDir, name);
+    try {
+      const st = statSync(p);
+      if (st.mtimeMs < cutoffMs) {
+        try {
+          unlinkSync(p);
+        } catch {}
+      }
+    } catch {}
+  }
+}
+
+function getTtlDays() {
+  const raw = process.env.CACHE_FIX_QUOTA_STATUS_TTL_DAYS;
+  if (raw === undefined || raw === "") return DEFAULT_TTL_DAYS;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_TTL_DAYS;
+}
+
 export default {
   name: "cache-telemetry",
-  description: "Extract cache stats from response stream, persist quota state to ~/.claude/quota-status.json",
+  description: "Extract cache stats from response stream, persist quota state to ~/.claude/quota-status/{account.json,sessions/<filename>.json}",
   order: 600,
 
+  async onRequest(ctx) {
+    // Session-id headers (x-claude-code-session-id, etc.) live on the
+    // REQUEST, not the response — Anthropic doesn't echo them back. So we
+    // capture them here, in the request-side hook, and stash on ctx.meta
+    // for onStreamEvent to use when it writes the per-session file. The
+    // proxy server passes the same `meta` object through onRequest →
+    // onResponseStart → onStreamEvent, so this works end-to-end.
+    if (!ctx.headers) return;
+    ctx.meta._sessionId = resolveSessionId(ctx.headers);
+  },
+
   async onResponseStart(ctx) {
     if (!ctx.headers) return;
 
@@ -89,24 +202,43 @@ export default {
 
       const ttl = cr > 0 ? "1h" : (cc > 0 ? "5m" : "unknown");
 
-      const output = {
-        cache: {
-          ttl_tier: ttl,
-          cache_creation: cc,
-          cache_read: cr,
-          ephemeral_1h: ephemeral1h,
-          ephemeral_5m: ephemeral5m,
-          hit_rate: hitRate,
-          timestamp: new Date().toISOString(),
+      const timestamp = new Date().toISOString();
+      const rawSid = ctx.meta._sessionId;
+      const filename = sessionFilename(rawSid);
+
+      const accountPayload = JSON.stringify({ ...quota, timestamp }, null, 2);
+      const sessionPayload = JSON.stringify(
+        {
+          cache: {
+            ttl_tier: ttl,
+            cache_creation: cc,
+            cache_read: cr,
+            ephemeral_1h: ephemeral1h,
+            ephemeral_5m: ephemeral5m,
+            hit_rate: hitRate,
+            timestamp,
+          },
+          timestamp,
+          session_id: rawSid,
         },
-        timestamp: new Date().toISOString(),
-        ...quota,
-      };
+        null,
+        2,
+      );
 
       try {
-        mkdirSync(join(homedir(), ".claude"), { recursive: true });
-        writeFileSync(QUOTA_PATH, JSON.stringify(output, null, 2));
+        cleanupLegacyOnce();
+        const { sessionsDir, accountPath } = paths();
+        mkdirSync(sessionsDir, { recursive: true });
+        atomicWrite(accountPath, accountPayload);
+        atomicWrite(join(sessionsDir, `${filename}.json`), sessionPayload);
+        sweepStaleSessions(getTtlDays());
       } catch {}
     }
   },
+
+  // Test-only: reset module state between tests.
+  __resetForTests() {
+    legacyCleanupDone = false;
+    lastSweepMs = 0;
+  },
 };

package/proxy/extensions/microcompact-stability.mjs

@@ -234,6 +234,7 @@ export function normalizeToolResultContent(messages, match, canonicalText) {
 function hashSessionId(reqCtx) {
   const sid =
     reqCtx?.meta?.session_id ||
+    reqCtx?.headers?.["x-claude-code-session-id"] ||
     reqCtx?.headers?.["x-session-id"] ||
     reqCtx?.headers?.["x-anthropic-session-id"] ||
     null;

package/tools/cache-test.sh

@@ -19,7 +19,9 @@ set -euo pipefail
 
 CLAUDE_CLI="$HOME/.npm-global/lib/node_modules/@anthropic-ai/claude-code/cli.js"
 PRELOAD="$HOME/.claude/cache-fix-preload.mjs"
-QUOTA_FILE="$HOME/.claude/quota-status.json"
+QUOTA_DIR="$HOME/.claude/quota-status"
+ACCOUNT_FILE="$QUOTA_DIR/account.json"
+SESSIONS_DIR="$QUOTA_DIR/sessions"
 USAGE_LOG="$HOME/.claude/usage.jsonl"
 DEBUG_LOG="$HOME/.claude/cache-fix-debug.log"
 REPORT_DIR="/tmp/cache-test-$(date +%Y%m%d_%H%M%S)"
@@ -54,21 +56,27 @@ echo ""
 
 mkdir -p "$REPORT_DIR"
 
-# Helper: snapshot cache state from quota-status.json
+# Helper: snapshot cache state from the most-recent per-session quota-status
+# file. Each one-shot CC invocation generates its own session, so the latest
+# sessions/<filename>.json corresponds to the call we just made.
 snapshot_cache() {
   local label="$1"
   local outfile="$REPORT_DIR/${label}.json"
-  if [ -f "$QUOTA_FILE" ]; then
-    cp "$QUOTA_FILE" "$outfile"
-    local tier=$(python3 -c "import json; d=json.load(open('$QUOTA_FILE')); print(d.get('cache',{}).get('ttl_tier','?'))" 2>/dev/null || echo "?")
-    local create=$(python3 -c "import json; d=json.load(open('$QUOTA_FILE')); print(d.get('cache',{}).get('cache_creation',0))" 2>/dev/null || echo "?")
-    local read=$(python3 -c "import json; d=json.load(open('$QUOTA_FILE')); print(d.get('cache',{}).get('cache_read',0))" 2>/dev/null || echo "?")
-    local e1h=$(python3 -c "import json; d=json.load(open('$QUOTA_FILE')); print(d.get('cache',{}).get('ephemeral_1h',0))" 2>/dev/null || echo "?")
-    local e5m=$(python3 -c "import json; d=json.load(open('$QUOTA_FILE')); print(d.get('cache',{}).get('ephemeral_5m',0))" 2>/dev/null || echo "?")
-    local hit=$(python3 -c "import json; d=json.load(open('$QUOTA_FILE')); print(d.get('cache',{}).get('hit_rate','?'))" 2>/dev/null || echo "?")
+  local sess_file=""
+  if [ -d "$SESSIONS_DIR" ]; then
+    sess_file=$(ls -t "$SESSIONS_DIR"/*.json 2>/dev/null | head -1)
+  fi
+  if [ -n "$sess_file" ] && [ -f "$sess_file" ]; then
+    cp "$sess_file" "$outfile"
+    local tier=$(python3 -c "import json; d=json.load(open('$sess_file')); print(d.get('cache',{}).get('ttl_tier','?'))" 2>/dev/null || echo "?")
+    local create=$(python3 -c "import json; d=json.load(open('$sess_file')); print(d.get('cache',{}).get('cache_creation',0))" 2>/dev/null || echo "?")
+    local read=$(python3 -c "import json; d=json.load(open('$sess_file')); print(d.get('cache',{}).get('cache_read',0))" 2>/dev/null || echo "?")
+    local e1h=$(python3 -c "import json; d=json.load(open('$sess_file')); print(d.get('cache',{}).get('ephemeral_1h',0))" 2>/dev/null || echo "?")
+    local e5m=$(python3 -c "import json; d=json.load(open('$sess_file')); print(d.get('cache',{}).get('ephemeral_5m',0))" 2>/dev/null || echo "?")
+    local hit=$(python3 -c "import json; d=json.load(open('$sess_file')); print(d.get('cache',{}).get('hit_rate','?'))" 2>/dev/null || echo "?")
     echo "  [$label] TTL=$tier  create=$create  read=$read  1h=$e1h  5m=$e5m  hit=$hit%"
   else
-    echo "  [$label] No quota-status.json found"
+    echo "  [$label] No per-session quota-status file found in $SESSIONS_DIR"
   fi
 }
 

package/tools/cross-version-cache-test.sh

@@ -101,7 +101,7 @@ done
 Q5H=$(python3 -c "
 import json
 try:
-    q = json.load(open('$HOME/.claude/quota-status.json'))
+    q = json.load(open('$HOME/.claude/quota-status/account.json'))
     print(q['five_hour']['pct'])
 except Exception:
     print(0)
@@ -116,7 +116,7 @@ echo "Preflight OK: Q5h at ${Q5H}%, 4 versions installed, launcher present." | t
 echo "" | tee -a "$SUMMARY"
 
 # Snapshot quota state at start
-cp "$HOME/.claude/quota-status.json" "$OUTPUT_DIR/raw-quota-status-start.json" 2>/dev/null || true
+cp "$HOME/.claude/quota-status/account.json" "$OUTPUT_DIR/raw-quota-status-start.json" 2>/dev/null || true
 
 # ─── Phase A: steady-state per version ─────────────────────────────────────
 
@@ -189,7 +189,7 @@ if [[ "$INCLUDE_IDLE" -eq 1 ]]; then
 fi
 
 # Snapshot quota state at end
-cp "$HOME/.claude/quota-status.json" "$OUTPUT_DIR/raw-quota-status-end.json" 2>/dev/null || true
+cp "$HOME/.claude/quota-status/account.json" "$OUTPUT_DIR/raw-quota-status-end.json" 2>/dev/null || true
 
 # ─── Analysis ──────────────────────────────────────────────────────────────
 
@@ -295,7 +295,7 @@ if [[ "$Q5H" -lt 50 ]]; then
     NEW_Q5H=$(python3 -c "
 import json
 try:
-    print(json.load(open('$HOME/.claude/quota-status.json'))['five_hour']['pct'])
+    print(json.load(open('$HOME/.claude/quota-status/account.json'))['five_hour']['pct'])
 except Exception:
     print('?')
 " 2>/dev/null)

package/tools/quota-statusline.sh

@@ -1,25 +1,82 @@
 #!/bin/bash
-# Status line: show quota % and burn rate from quota-status.json
+# Status line: show quota % and burn rate from per-session quota-status files.
 # Written by cache-fix proxy's cache-telemetry extension on every API call.
+#
+# Layout (post-v3.5.0):
+#   ~/.claude/quota-status/account.json            — global quota fields (5h/7d, status, overage)
+#   ~/.claude/quota-status/sessions/<filename>.json — per-session cache fields (ttl_tier, hit_rate)
+#
+# CC pipes hook input as JSON on stdin including `session_id`, which we map to
+# the per-session filename via the canonical rule (matches the writer in
+# proxy/extensions/cache-telemetry.mjs:sessionFilename).
 
 input=$(cat)
 
-QS="$HOME/.claude/quota-status.json"
+ACCOUNT="$HOME/.claude/quota-status/account.json"
+SESSIONS_DIR="$HOME/.claude/quota-status/sessions"
 
-if [ -f "$QS" ]; then
-  result=$(python3 -c "
-import sys, json, os
+# Show quota even if no per-session file exists yet (fresh session, first
+# request hasn't fired). Per-session block just gets blank.
+if [ ! -f "$ACCOUNT" ]; then
+  exit 0
+fi
+
+result=$(python3 -c "
+import sys, json, os, re, hashlib
 from datetime import datetime, timezone, timedelta
 
-qs = json.load(open(os.path.expanduser('~/.claude/quota-status.json')))
+home = os.path.expanduser('~')
+account_path = os.path.join(home, '.claude', 'quota-status', 'account.json')
+sessions_dir = os.path.join(home, '.claude', 'quota-status', 'sessions')
+
+# Parse stdin JSON (CC hook input) for session_id. Pass the raw value
+# (including null / "" / whitespace) through session_filename so the
+# canonical rule decides — the writer maps all those to 'unknown',
+# the reader must do the same to keep the contract identical.
+try:
+    stdin_data = json.loads('''$input''') if '''$input''' else {}
+except Exception:
+    stdin_data = {}
+sess_id_raw = stdin_data.get('session_id')
+
+# Canonical filename derivation — must match cache-telemetry.mjs:sessionFilename.
+# Allowlist: [A-Za-z0-9_-]{1,128}; else inv-<sha256(s)[:16]>; null/empty/whitespace -> 'unknown'.
+SAFE = re.compile(r'^[A-Za-z0-9_-]{1,128}\$')
+def session_filename(raw):
+    if raw is None:
+        return 'unknown'
+    s = str(raw).strip()
+    if not s:
+        return 'unknown'
+    if SAFE.match(s):
+        return s
+    return 'inv-' + hashlib.sha256(s.encode('utf-8')).hexdigest()[:16]
 
-q5h = qs.get('five_hour', {}).get('pct', 0)
-q7d = qs.get('seven_day', {}).get('pct', 0)
-q5h_reset = qs.get('five_hour', {}).get('resets_at', 0)
-q7d_reset = qs.get('seven_day', {}).get('resets_at', 0)
-status = qs.get('status', '')
-overage = qs.get('overage_status', '')
-ts = qs.get('timestamp', '')
+# Read account.json (account-global fields).
+try:
+    acc = json.load(open(account_path))
+except Exception:
+    sys.exit(0)
+
+# Read this session's per-session file (cache fields). Apply the rule
+# unconditionally — null/empty/whitespace land at sessions/unknown.json,
+# matching where the writer would have placed them. If the file doesn't
+# exist (e.g. unknown.json never written, or this is a fresh session
+# whose first request hasn't fired), statusline still shows quota % —
+# just no TTL/hit-rate block.
+sess_filename = session_filename(sess_id_raw)
+try:
+    sess = json.load(open(os.path.join(sessions_dir, sess_filename + '.json')))
+except Exception:
+    sess = {}
+
+q5h = acc.get('five_hour', {}).get('pct', 0)
+q7d = acc.get('seven_day', {}).get('pct', 0)
+q5h_reset = acc.get('five_hour', {}).get('resets_at', 0)
+q7d_reset = acc.get('seven_day', {}).get('resets_at', 0)
+status = acc.get('status', '')
+overage = acc.get('overage_status', '')
+ts = sess.get('timestamp') or acc.get('timestamp', '')
 
 now = datetime.fromisoformat(ts.replace('Z', '+00:00')) if ts else datetime.now(timezone.utc)
 
@@ -48,9 +105,9 @@ if rate7:
 if overage == 'active':
     label += ' | OVERAGE'
 
-# TTL and cache stats
-ttl = qs.get('cache', {}).get('ttl_tier', '')
-hit = qs.get('cache', {}).get('hit_rate', '')
+# Per-session TTL and cache stats
+ttl = sess.get('cache', {}).get('ttl_tier', '')
+hit = sess.get('cache', {}).get('hit_rate', '')
 if ttl:
     if ttl == '5m':
         label += ' | \033[31mTTL:5m\033[0m'
@@ -59,12 +116,11 @@ if ttl:
 if hit and hit != 'N/A':
     label += ' ' + hit + '%'
 
-peak = qs.get('peak_hour', False)
+peak = acc.get('peak_hour', False)
 if peak:
     label += ' | \033[33mPEAK\033[0m'
 
 print(label)
 " 2>/dev/null)
 
-  [ -n "$result" ] && echo "$result"
-fi
+[ -n "$result" ] && echo "$result"