claude-finops 0.13.0 → 0.15.0

package/finops/api.py

@@ -38,7 +38,7 @@ def _int(qs, key, default, lo=0, hi=1_000_000):
 
 SETTINGS_SHAPE = {
     "budgets": dict, "limits": dict, "alert_thresholds_pct": list, "waste_rules": dict,
-    "anomaly": dict, "scorecard": dict, "account": dict, "billing_period": dict,
+    "anomaly": dict, "scorecard": dict, "account": dict, "billing_period": dict, "guard": dict,
 }
 
 
@@ -62,6 +62,89 @@ def _validate_thresholds(v):
     if not all(_is_num(x) and 0 <= x <= 1000 for x in v):
         raise BadRequest("alert_thresholds_pct must be a list of numbers 0..1000")
 
+def _validate_guard(v):
+    from .guard import validate_guard
+    _, bad = validate_guard(v, {})
+    if bad:
+        raise BadRequest(f"invalid {', '.join(bad)}: session_tokens > 0 or null, warn_pct "
+                         "numbers between 0 and 100, after_approval step|once, step_pct 1..1000, "
+                         "projects {path: {session_tokens: n} | {off: true}}")
+
+class NotFound(BadRequest):
+    """A 404 raised from a helper; handled next to BadRequest."""
+
+
+def _session_transcript(sid):
+    from . import guard as G
+    from .etl import DEFAULT_SOURCE
+    if not G.SAFE_ID.match(sid or ""):
+        raise BadRequest("That is not a Claude Code session id.")
+    tp = G.find_transcript(sid, [os.environ.get("CLAUDE_PROJECTS") or DEFAULT_SOURCE])
+    if not tp:
+        raise NotFound("No Claude Code transcript found for that session.")
+    return tp
+
+
+def _session_limit_status(a, sid):
+    """GET /api/guard/session/<id>: tokens used so far (as the guard counts them),
+    this session's own limit, the budget that applies, and whether the hook is installed."""
+    from . import guard as G
+    from .integrate import guard_state
+    tp = _session_transcript(sid)
+    cwd = None
+    with open(tp, errors="replace") as fh:
+        for i, line in enumerate(fh):
+            if '"cwd"' in line:
+                try:
+                    cwd = json.loads(line).get("cwd")
+                except ValueError:
+                    pass
+            if cwd or i > 50:
+                break
+    cfg = a.settings.get("guard") or {}
+    try:
+        installed = guard_state() == "installed"
+    except Exception:
+        installed = False
+    return {"session_id": sid, "tokens": G.session_usage(tp, sid),
+            "limit": (cfg.get("sessions") or {}).get(sid), "applies": G.budget_for(cfg, cwd, sid),
+            "installed": installed}
+
+
+def _set_session_limit(sid, payload):
+    """POST /api/do/session_limit/<id>: {session_tokens: n} | {off: true} | {remove: true}."""
+    global A
+    from . import guard as G
+    import time
+    if not G.SAFE_ID.match(sid or ""):
+        raise BadRequest("That is not a Claude Code session id.")
+    if payload.get("remove"):
+        entry = None
+    elif payload.get("off") is True:
+        entry = {"off": True}
+    elif _is_num(payload.get("session_tokens")) and payload["session_tokens"] > 0:
+        entry = {"session_tokens": payload["session_tokens"]}
+    else:
+        raise BadRequest("Enter a token limit above 0, or turn the guard off for this session.")
+    local = {}
+    if os.path.exists(LOCAL_SETTINGS_PATH):
+        with open(LOCAL_SETTINGS_PATH) as fh:
+            local = json.load(fh)
+    g = local.setdefault("guard", {})
+    sessions = dict(g.get("sessions") or {})
+    if entry is None:
+        sessions.pop(sid, None)
+    else:
+        sessions[sid] = dict(entry, set_at=time.strftime("%Y-%m-%dT%H:%M:%S"))
+    g["sessions"] = G.prune_sessions(sessions)
+    with open(LOCAL_SETTINGS_PATH, "w") as fh:
+        json.dump(local, fh, indent=2)
+    cur = load_settings()
+    with _lock:
+        A.settings = cur
+    return {"ok": True, "limit": g["sessions"].get(sid)}
+
+
 MIME = {".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8",
         ".css": "text/css; charset=utf-8", ".json": "application/json",
         ".svg": "image/svg+xml", ".ico": "image/x-icon"}
@@ -111,6 +194,14 @@ def filters_from(qs):
     return f
 
 
+def _costs_by_day_model(a, f):
+    """One row per day and model: the cost export, distinct from the usage timeline."""
+    w, p = a.where(f)
+    return a.q(f"""SELECT r.day, r.model, COUNT(*) requests, SUM(r.billable_tokens) tokens,
+                   SUM(r.est_cost_usd) est_cost_usd FROM requests r
+                   WHERE {w} AND r.day <> '' GROUP BY 1, 2 ORDER BY 1, 5 DESC""", p)
+
+
 def flatten(rows):
     keys = []
     for r in rows:
@@ -218,6 +309,8 @@ class Handler(BaseHTTPRequestHandler):
                         _validate_numeric_section(section, payload[section])
                 if "alert_thresholds_pct" in payload:
                     _validate_thresholds(payload["alert_thresholds_pct"])
+                if "guard" in payload:
+                    _validate_guard(payload["guard"])
                 # UI edits go to the gitignored per-machine file, never the shared defaults
                 local = {}
                 if os.path.exists(LOCAL_SETTINGS_PATH):
@@ -225,7 +318,7 @@ class Handler(BaseHTTPRequestHandler):
                         local = json.load(fh)
                 for k, v in payload.items():
                     if k in ("budgets", "limits", "alert_thresholds_pct", "waste_rules",
-                             "anomaly", "scorecard", "account", "billing_period"):
+                             "anomaly", "scorecard", "account", "billing_period", "guard"):
                         if isinstance(v, dict) and isinstance(local.get(k), dict):
                             local[k].update(v)
                         else:
@@ -238,7 +331,7 @@ class Handler(BaseHTTPRequestHandler):
                 return self.send_json({"ok": True, "settings": cur})
             self.send_json({"error": "unknown endpoint"}, 404)
         except BadRequest as e:
-            self.send_json({"error": str(e)}, 400)
+            self.send_json({"error": str(e)}, 404 if isinstance(e, NotFound) else 400)
         except Exception:
             log.exception("POST %s failed", path)
             self.send_json({"error": "internal error; see data/server.log"}, 500)
@@ -252,10 +345,7 @@ class Handler(BaseHTTPRequestHandler):
         """POST /api/do/...: actions that change this machine. Always user-initiated."""
         from . import actions as X
         if parts == ["sync"]:
-            cur = X.JOBS.get(_SYNC["job"] or "")
-            if not cur or cur["state"] != "running":
-                _SYNC["job"] = X._job(_sync_job)["id"]
-            return self.send_json({"job": _SYNC["job"]})
+            return self.send_json({"job": _start_sync()})
         if len(parts) == 3 and parts[0] == "free_model" and parts[2] == "install":
             j = X._job(X.free_model_install, parts[1], bool(payload.get("consent")),
                        payload.get("api_key"))
@@ -273,6 +363,44 @@ class Handler(BaseHTTPRequestHandler):
         if parts == ["statusline"]:
             from .integrate import install_statusline
             return self.send_json(install_statusline())
+        if len(parts) == 2 and parts[0] == "session_limit":
+            return self.send_json(_set_session_limit(parts[1], payload))
+        if parts in (["jev", "install"], ["jev", "uninstall"]):
+            from . import jev
+            return self.send_json({"job": X._job(jev.install if parts[1] == "install" else jev.uninstall)["id"]})
+        if parts == ["jev", "key"]:
+            from . import jev
+            try:
+                if payload.get("remove"):
+                    jev.remove_key()
+                else:
+                    jev.save_key(payload.get("value") if isinstance(payload.get("value"), str) else "")
+            except ValueError as e:
+                raise BadRequest(str(e))
+            return self.send_json({"ok": True, "key": jev.key_status()})
+        if len(parts) == 2 and parts[0] == "key":
+            from .cloud import save_key, key_status
+            value = payload.get("value")
+            if not payload.get("remove") and not (isinstance(value, str) and value.strip()):
+                raise BadRequest("Paste a key, or use Remove.")
+            try:
+                save_key(parts[1], "" if payload.get("remove") else value)
+            except ValueError as e:
+                raise BadRequest(str(e))
+            return self.send_json({"ok": True, "keys": key_status()})
+        if parts == ["guard"]:
+            from .integrate import install_guard
+            return self.send_json(install_guard(remove=bool(payload.get("remove"))))
+        if parts == ["subagent_experiment"]:
+            from . import subagents as SA
+            try:
+                if payload.get("action") == "start":
+                    return self.send_json(SA.start_experiment(payload.get("model")))
+                if payload.get("action") == "stop":
+                    return self.send_json(SA.stop_experiment())
+            except (ValueError, SA.SettingsError) as e:
+                raise BadRequest(str(e))
+            raise BadRequest("action must be start or stop")
         if len(parts) == 2 and parts[0] == "mcp":
             return self.send_json(X.add_mcp(parts[1], payload))
         return self.send_json({"error": "unknown action"}, 404)
@@ -288,12 +416,12 @@ class Handler(BaseHTTPRequestHandler):
             with _lock:
                 a = A
             qs = parse_qs(urlparse(self.path).query)
-            ags = [x for x in (qs.get("agents", [""])[0]).split(",") if x]
-            return self.send_json(X.compare(a, ags or None))
+            f = filters_from(qs)
+            return self.send_json(X.compare(a, f["agents"] or None, f))
         if parts == ["suggestions"]:
             with _lock:
                 a = A
-            return self.send_json(X.suggestions(a))
+            return self.send_json(X.suggestions(a, filters_from(parse_qs(urlparse(self.path).query))))
         if parts[0] == "job" and len(parts) == 2:
             return self.send_json(X.job_status(parts[1]))
         if parts == ["sync"]:
@@ -357,7 +485,7 @@ class Handler(BaseHTTPRequestHandler):
         except BrokenPipeError:
             pass
         except BadRequest as e:
-            self.send_json({"error": str(e) or "bad request"}, 400)
+            self.send_json({"error": str(e) or "bad request"}, 404 if isinstance(e, NotFound) else 400)
         except Exception:
             log.exception("GET %s failed", path)
             self.send_json({"error": "internal error; see data/server.log"}, 500)
@@ -382,6 +510,11 @@ class Handler(BaseHTTPRequestHandler):
             from .cloud import configured
             o = a.options()
             o["cloud"] = configured()          # nav hides "Billed vs local" until a key exists
+            from .integrate import guard_state
+            try:
+                o["guard_installed"] = guard_state() == "installed"
+            except Exception:
+                o["guard_installed"] = False
             return self.send_json(o)
         if route == "by_agent":
             return self.send_json(a.by_agent(f))
@@ -457,6 +590,17 @@ class Handler(BaseHTTPRequestHandler):
                 if not want or any(x != "claude" for x in want) else []
             rows = sorted(claude + others, key=lambda x: -(x.get("context") or 0))
             return self.send_json({"sessions": rows, "actions": list(ACTIONS)})
+        if route.startswith("guard/session/"):
+            return self.send_json(_session_limit_status(a, route[len("guard/session/"):]))
+        if route == "subagents":
+            from .subagents import report
+            return self.send_json(report(a, f))
+        if route == "jev":
+            from . import jev
+            return self.send_json({"status": jev.status(), "key": jev.key_status(), "fit": jev.fit(a, f)})
+        if route == "keys":
+            from .cloud import key_status
+            return self.send_json(key_status())
         if route == "cloud":
             from .cloud import report
             return self.send_json(report(a, _int(qs, "days", 30)))
@@ -469,13 +613,15 @@ class Handler(BaseHTTPRequestHandler):
                 pid = int(route.split("/")[1])
             except ValueError:
                 raise BadRequest("id must be an integer")
-            return self.send_json(a.prompt_detail(pid))
+            d = a.prompt_detail(pid, f)
+            return self.send_json(d, 404 if isinstance(d, dict) and d.get("error") else 200)
         if route.startswith("session/"):
-            return self.send_json(a.session_detail(route.split("/", 1)[1]))
+            d = a.session_detail(route.split("/", 1)[1], f)
+            return self.send_json(d, 404 if isinstance(d, dict) and d.get("error") else 200)
         if route == "bundle":
             return self.send_json({
                 "overview": a.overview(f), "burn": a.burn(f), "timeline": a.timeline(f),
-                "models": a.models(f), "projects": a.projects(f)[:40],
+                "models": a.models(f), "projects": a.projects(f),
                 "categories": a.categories(f), "efficiency": a.efficiency(f),
                 "context": a.context_analysis(f), "waste": a.waste(f),
                 "recommendations": a.recommendations(f), "forecast": a.forecast(f),
@@ -497,8 +643,9 @@ class Handler(BaseHTTPRequestHandler):
             "usage": lambda: a.timeline(f),
             "models": lambda: a.models(f)["rows"],
             "projects": lambda: a.projects(f),
-            "costs": lambda: a.timeline(f),
-            "waste": lambda: [dict(x, evidence=len(x["evidence"])) for x in a.waste(f)["findings"]],
+            "costs": lambda: _costs_by_day_model(a, f),
+            "waste": lambda: [dict(x, evidence=x.get("count", len(x["evidence"])))
+                              for x in a.waste(f)["findings"]],
             "recommendations": lambda: a.recommendations(f)["recommendations"],
             "forecast": lambda: [dict(name=k, **v) for k, v in
                                  (a.forecast(f).get("scenarios") or {}).items()],
@@ -570,6 +717,36 @@ def _sync_job(log):
     return {"built_at": A.q("SELECT value FROM meta WHERE key='built_at'")[0]["value"]}
 
 
+def _start_sync():
+    """Start a sync unless one is already running; returns the job id."""
+    from . import actions as X
+    cur = X.JOBS.get(_SYNC["job"] or "")
+    if not cur or cur["state"] != "running":
+        _SYNC["job"] = X._job(_sync_job)["id"]
+    return _SYNC["job"]
+
+
+def _auto_sync_loop(minutes):
+    """Keep the warehouse fresh without anyone pressing Sync.
+
+    Every few minutes, if the last build is older than `minutes`, run the same sync the
+    Sync button runs. A stale warehouse is what made recent days read as idle and
+    projections read low; this keeps "today" honest on a dashboard left open.
+    """
+    import time as _t
+    from datetime import datetime as _dt, timezone as _tz
+    while True:
+        try:
+            with _lock:
+                built = A.meta.get("built_at") if A else None
+            age = (_dt.now(_tz.utc) - _dt.fromisoformat(built)).total_seconds() / 60 if built else 1e9
+            if age >= minutes:
+                _start_sync()
+        except Exception:
+            log.exception("auto-sync check failed")
+        _t.sleep(min(minutes, 15) * 60)
+
+
 def _notify_update():
     from .update import notify
     notify()
@@ -611,6 +788,12 @@ def serve(port=8787, db=DB_PATH, background=None):
     from .update import disabled
     if not disabled():
         threading.Thread(target=_notify_update, daemon=True).start()
+    try:
+        auto = float(os.environ.get("CLAUDE_FINOPS_AUTOSYNC_MINUTES", "60"))
+    except ValueError:
+        auto = 60.0
+    if auto > 0:
+        threading.Thread(target=_auto_sync_loop, args=(auto,), daemon=True).start()
     # The socket is already listening, so the page's first request just waits for
     # serve_forever. Off the main thread: some platforms block while the browser starts.
     threading.Thread(target=_open_browser, args=(f"http://127.0.0.1:{port}",), daemon=True).start()

package/finops/classify.py

@@ -13,6 +13,7 @@ CATEGORIES = [
     ("documentation", 2.3, r"\b(document|documentation|docs?|readme|changelog|comment(s)? (for|on)|docstring|write up|write-up)\b"),
     ("architecture", 2.2, r"\b(architect|architecture|design (the|a) (system|schema|api)|system design|data model|schema|scal(e|ing|ability)|trade[- ]?offs?|high level design)\b"),
     ("planning", 2.1, r"\b(plan|roadmap|break (this )?down|steps to|approach|strategy|estimate|milestone|backlog|prioriti[sz]e)\b"),
+    ("version_control", 2.0, r"\b(commit|push|merge|rebase|cherry[- ]?pick|stash|branch|git)\b"),
     ("automation", 2.0, r"\b(script|automat|cron|pipeline|ci/?cd|workflow|deploy|jenkins|github action|makefile|bash script)\b"),
     ("research", 1.9, r"\b(research|compare|find out|look up|investigate|what (is|are)|explore options|alternatives|pros and cons|benchmark|which (library|tool|framework))\b"),
     ("learning", 1.8, r"\b(explain|how does|teach me|understand|what does .* mean|walk me through|help me learn|tutorial|eli5)\b"),
@@ -42,6 +43,11 @@ def classify(text):
             scores[name] = weight * (1 + 0.25 * min(n - 1, 4))
             evidence[name] = sorted({s.lower().strip() for s in flat if s})[:5]
     if not scores:
+        # Most unmatched prompts are short steering turns inside a task ("do that",
+        # "fix all", "status?", or a reply in another language). They are not
+        # unknown work, they continue the turn before; say so rather than "other".
+        if len(text.strip()) < 160:
+            return "follow_up", 0.5, ["short instruction"]
         return "other", 0.0, []
     best = max(scores, key=scores.get)
     total = sum(scores.values())

package/finops/cloud.py

@@ -3,9 +3,10 @@
 Everything else in this dashboard reads local files. This module is the one part that
 talks to the internet, and only when you ask it to (the Refresh button / --cloud-sync).
 
-Keys are never stored by the UI. Put them in the environment, or store one with
-`claude-finops --set-key`, which writes ~/.claude-finops/secrets.local.json (0600,
-outside the install tree, never packaged):
+Keys come from the environment, or are stored with `claude-finops --set-key` or the
+API keys section on the Budgets page. Both write ~/.claude-finops/secrets.local.json
+(0600, outside the install tree, never packaged); the dashboard never sends a stored
+key back to the browser, only whether it is set and its last four characters:
 
     {"anthropic_admin_key": "sk-ant-admin...", "cursor_api_key": "key_..."}
 
@@ -65,6 +66,53 @@ def configured():
     return {k: bool(key_for(k)) for k in PROVIDERS}
 
 
+# A light shape check, to catch pasting the wrong thing: not a validity test.
+KEY_SHAPES = {
+    "anthropic": (lambda v: v.startswith("sk-ant-admin"),
+                  "An Anthropic Admin key starts with sk-ant-admin (a regular API key will not work)."),
+    "cursor": (lambda v: len(v) >= 16, "That looks too short for a Cursor Admin API key."),
+}
+
+
+def key_status():
+    """Per provider: where the key comes from and its last four characters. Never the key."""
+    stored = _secrets()
+    out = {}
+    for pid, p in PROVIDERS.items():
+        env, val = os.environ.get(p["env"]), stored.get(p["field"])
+        src = "env" if env else "stored" if val else None
+        key = env or val or ""
+        out[pid] = {"name": p["name"], "env": p["env"], "how": p["how"], "covers": p["covers"],
+                    "source": src, "last4": key[-4:] if len(key) >= 12 else None}
+    return out
+
+
+def save_key(provider, value):
+    """Store (value) or remove (empty value) one provider key in the 0600 secrets file.
+
+    Raises ValueError for an unknown provider or a value that fails the shape check.
+    """
+    if provider not in PROVIDERS:
+        raise ValueError(f"unknown provider {provider!r}")
+    value = (value or "").strip()
+    if value:
+        if any(ch.isspace() for ch in value):
+            raise ValueError("A key has no spaces or line breaks in it.")
+        ok, msg = KEY_SHAPES.get(provider, (lambda v: True, ""))
+        if not ok(value):
+            raise ValueError(msg)
+    data = _secrets()
+    if value:
+        data[PROVIDERS[provider]["field"]] = value
+    else:
+        data.pop(PROVIDERS[provider]["field"], None)
+    os.makedirs(os.path.dirname(SECRETS_PATH), exist_ok=True)
+    fd = os.open(SECRETS_PATH, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as fh:
+        json.dump(data, fh, indent=2)
+    os.chmod(SECRETS_PATH, 0o600)      # O_CREAT's mode only applies to a new file
+
+
 def _get(url, headers, data=None, method="GET"):
     req = urllib.request.Request(url, data=data, method=method,
                                  headers={"User-Agent": UA, **headers})
@@ -261,10 +309,13 @@ def report(analytics, days=30):
     cu = c.get("cursor_usage") or []
     cs = c.get("cursor_spend") or []
     since = (datetime.now(timezone.utc).date() - timedelta(days=days)).isoformat()
+    # The vendor APIs report UTC days, so this page compares on UTC days too (every
+    # other page uses your local calendar days); otherwise a late-evening session would
+    # sit on different dates on the two sides.
     local = {r["agent"]: r for r in analytics.q(
         "SELECT agent, SUM(est_cost_usd) cost, SUM(billable_tokens) tokens,"
         " COUNT(DISTINCT session_id) sessions, COUNT(*) requests"
-        " FROM requests WHERE day >= ? GROUP BY agent", (since,))}
+        " FROM requests WHERE substr(ts,1,10) >= ? GROUP BY agent", (since,))}
 
     by_day = {}
     for r in cc:
@@ -273,9 +324,9 @@ def report(analytics, days=30):
         d["billed_cost"] += r["est_cost_usd"]
         d["billed_tokens"] += r["tokens"]
         d["billed_sessions"] += r["sessions"]
-    for r in analytics.q("SELECT day, SUM(est_cost_usd) c, SUM(billable_tokens) t,"
+    for r in analytics.q("SELECT substr(ts,1,10) day, SUM(est_cost_usd) c, SUM(billable_tokens) t,"
                          " COUNT(DISTINCT session_id) s FROM requests"
-                         " WHERE agent='claude' AND day >= ? GROUP BY day", (since,)):
+                         " WHERE agent='claude' AND substr(ts,1,10) >= ? GROUP BY 1", (since,)):
         d = by_day.setdefault(r["day"], {"day": r["day"], "billed_cost": 0.0, "billed_tokens": 0,
                                          "billed_sessions": 0})
         d.update(local_cost=r["c"] or 0.0, local_tokens=r["t"] or 0, local_sessions=r["s"] or 0)
@@ -331,6 +382,7 @@ def report(analytics, days=30):
               for r in cost}.items()], key=lambda x: -x["cost_usd"])[:20],
         "note": "Billed figures come from the vendor APIs (org-wide, every machine and member). "
                 "Local figures are what this machine's transcripts recorded. A gap usually means "
-                "other machines, other members, or work outside this machine.",
+                "other machines, other members, or work outside this machine. Days on this "
+                "page are UTC days, as the vendors report them.",
         "basis": "billed",
     }

package/finops/diagnose.py

@@ -121,9 +121,13 @@ class Diagnoser:
                 "basis": "actual tokens, estimated cost"})
 
         # 4. tool output flooding context
-        tools = a.q(f"""SELECT tc.name, COUNT(*) calls, SUM(r.billable_tokens) b
-            FROM tool_calls tc JOIN requests r ON r.id=tc.request_pk WHERE {w}
-            GROUP BY tc.name ORDER BY b DESC LIMIT 6""", p)
+        # Tokens per tool count each request once: a request that made three Bash calls
+        # was still one request, and joining calls to requests counted it three times.
+        tools = a.q(f"""SELECT x.name, SUM(x.calls) calls, SUM(r.billable_tokens) b
+            FROM (SELECT tc.request_pk, tc.name, COUNT(*) calls FROM tool_calls tc
+                  GROUP BY tc.request_pk, tc.name) x
+            JOIN requests r ON r.id=x.request_pk WHERE {w}
+            GROUP BY x.name ORDER BY b DESC LIMIT 6""", p)
         if tools:
             top = tools[0]
             out.append({
@@ -585,8 +589,17 @@ class Diagnoser:
                 MAX(tc.result_chars)/{CHARS_PER_TOKEN} largest
                 FROM tool_calls tc WHERE tc.kind IN ({ph}) AND {tcw}
                 GROUP BY tc.kind, tc.server ORDER BY carried DESC""", kinds + p)
+            # Re-reads are priced at the cache-read rate of the model that made each call,
+            # not one main-model rate for everything.
+            cost_by = defaultdict(float)
+            for x in a.q(f"""SELECT tc.kind, tc.server, rq.model,
+                    SUM(tc.result_chars*1.0*tc.carry_requests)/{CHARS_PER_TOKEN} carried
+                    FROM tool_calls tc JOIN requests rq ON rq.id=tc.request_pk
+                    WHERE tc.kind IN ({ph}) AND {tcw} GROUP BY 1, 2, 3""", kinds + p):
+                r_ = (a.pricing.rates(x["model"]).get("cache_read") or 0) / 1e6
+                cost_by[(x["kind"], x["server"])] += (x["carried"] or 0) * r_
             for r in rows:
-                r["carried_cost"] = (r["carried"] or 0) * rate
+                r["carried_cost"] = cost_by.get((r["kind"], r["server"]), (r["carried"] or 0) * rate)
                 r["tools"] = a.q(f"""SELECT tc.name, COUNT(*) calls,
                     SUM(tc.result_chars)/{CHARS_PER_TOKEN} injected,
                     SUM(tc.result_chars*1.0*tc.carry_requests)/{CHARS_PER_TOKEN} carried
@@ -622,7 +635,7 @@ class Diagnoser:
             "note": "Injected = size of what came back into context (actual size, ~4 chars/token). "
                     "Carried = injected × later requests in the same session that re-read it — an "
                     "upper bound, since /compact isn't visible. Carried cost prices those re-reads at "
-                    "your main model's cache-read rate (estimated). Subagent tokens are actual. "
+                    "the cache-read rate of the model that made each call (estimated). Subagent tokens are actual. "
                     "Slash-command figures attribute the whole turn they started.",
         }