codehere 0.7.1 → 1.0.1

package/dist/infrastructure/context/adapters/figma-source.js

@@ -95,7 +95,7 @@ export const figmaSource = {
             if (!node)
                 throw new ContextSourceError('figma', 'not_found', `node ${nodeId} not in response`);
             text = renderNodeAsTree(node, fileKey, nodeId);
-            metadata = { fileKey, nodeId, type: node.type, name: node.name };
+            metadata = { fileKey, nodeId, type: node.type, name: node.name, frames: collectFrames(node) };
         }
         else {
             const parsed = JSON.parse(res.body);
@@ -104,7 +104,12 @@ export const figmaSource = {
             if (!parsed.document)
                 throw new ContextSourceError('figma', 'parse', 'Figma response missing document');
             text = renderFile(parsed, fileKey);
-            metadata = { fileKey, name: parsed.name ?? null, lastModified: parsed.lastModified ?? null };
+            metadata = {
+                fileKey,
+                name: parsed.name ?? null,
+                lastModified: parsed.lastModified ?? null,
+                frames: collectFrames(parsed.document),
+            };
         }
         return {
             url: url.toString(),
@@ -116,6 +121,36 @@ export const figmaSource = {
         };
     },
 };
+function collectFrames(root, limit = 12) {
+    const frames = [];
+    const visit = (node) => {
+        if (frames.length >= limit)
+            return;
+        if (node.type === 'FRAME') {
+            const bb = node.absoluteBoundingBox;
+            frames.push({
+                name: node.name,
+                width: bb ? Math.round(bb.width) : null,
+                height: bb ? Math.round(bb.height) : null,
+                text: firstText(node),
+            });
+        }
+        for (const child of node.children ?? [])
+            visit(child);
+    };
+    visit(root);
+    return frames;
+}
+function firstText(node) {
+    if (node.characters)
+        return node.characters.replace(/\s+/g, ' ').slice(0, MAX_TEXT_PER_NODE);
+    for (const child of node.children ?? []) {
+        const t = firstText(child);
+        if (t)
+            return t;
+    }
+    return null;
+}
 function renderFile(file, fileKey) {
     const lines = [];
     lines.push(`Figma file · ${file.name ?? '(unnamed)'}`);

package/dist/infrastructure/context/adapters/github-issue-source.js

@@ -61,8 +61,9 @@ export const githubIssueSource = {
             'X-GitHub-Api-Version': '2022-11-28',
             'User-Agent': 'codehere/0.8',
         };
-        if (cfg.token)
-            headers['Authorization'] = `Bearer ${cfg.token}`;
+        const bearer = cfg.token ?? cfg.oauth?.accessToken;
+        if (bearer)
+            headers['Authorization'] = `Bearer ${bearer}`;
         const issueRes = await ctx.httpGet(`${endpoint}/repos/${ref.owner}/${ref.repo}/issues/${ref.number}`, headers);
         if (issueRes.status === 404) {
             throw new ContextSourceError('github', 'not_found', `${ref.owner}/${ref.repo}#${ref.number} not found`);

package/dist/infrastructure/context/github-api.js

@@ -0,0 +1,110 @@
+/**
+ * Minimal GitHub REST layer for the integration — reads an issue and turns it
+ * into a task prompt. Uses the OAuth token persisted by github-device-flow via
+ * oauth-store ('github'). HTTP is injectable so tests run without network.
+ *
+ * This is the "issues -> tasks" piece of Track 2: fetch the issue, format a
+ * prompt; the existing POST /api/task does the actual spawn (one proven path).
+ */
+const defaultGet = async (url, headers) => {
+    const res = await fetch(url, { headers });
+    return { status: res.status, json: () => res.json() };
+};
+/** Accepts an issue URL, "owner/repo#123", or "owner/repo" (number then optional). */
+export function parseRepoRef(input) {
+    const s = (input || '').trim();
+    const url = s.match(/github\.com\/([^/]+)\/([^/]+)\/issues\/(\d+)/i);
+    if (url)
+        return { owner: url[1], repo: url[2], number: Number(url[3]) };
+    const hash = s.match(/^([^/\s]+)\/([^/\s#]+)#(\d+)$/);
+    if (hash)
+        return { owner: hash[1], repo: hash[2], number: Number(hash[3]) };
+    const plain = s.match(/^([^/\s]+)\/([^/\s#]+)$/);
+    if (plain)
+        return { owner: plain[1], repo: plain[2] };
+    return undefined;
+}
+export async function fetchIssue(token, owner, repo, number, http = defaultGet) {
+    const res = await http(`https://api.github.com/repos/${owner}/${repo}/issues/${number}`, {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'codehere',
+    });
+    if (res.status === 404)
+        throw new Error(`github issue not found: ${owner}/${repo}#${number}`);
+    if (res.status === 401 || res.status === 403)
+        throw new Error('github auth failed or token lacks repo scope');
+    if (res.status >= 400)
+        throw new Error(`github api error ${res.status}`);
+    const d = (await res.json());
+    return {
+        number: Number(d.number ?? number),
+        title: String(d.title ?? ''),
+        body: typeof d.body === 'string' ? d.body : '',
+        htmlUrl: String(d.html_url ?? ''),
+        state: String(d.state ?? 'open'),
+    };
+}
+/** List open issues for a repo so the user can PICK one instead of typing
+ *  "owner/repo#123" from memory. Filters out pull requests (the issues endpoint
+ *  returns PRs too — they carry a `pull_request` field). */
+export async function listIssues(token, owner, repo, http = defaultGet) {
+    const res = await http(`https://api.github.com/repos/${owner}/${repo}/issues?state=open&per_page=50`, {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'codehere',
+    });
+    if (res.status === 404)
+        throw new Error(`github repo not found: ${owner}/${repo}`);
+    if (res.status === 401 || res.status === 403)
+        throw new Error('github auth failed or token lacks repo scope');
+    if (res.status >= 400)
+        throw new Error(`github api error ${res.status}`);
+    const arr = (await res.json());
+    return (Array.isArray(arr) ? arr : [])
+        .filter((d) => !d.pull_request)
+        .map((d) => ({
+        number: Number(d.number ?? 0),
+        title: String(d.title ?? ''),
+        body: typeof d.body === 'string' ? d.body : '',
+        htmlUrl: String(d.html_url ?? ''),
+        state: String(d.state ?? 'open'),
+    }));
+}
+/** Format an issue as a task prompt an agent can act on. */
+export function issueToTaskPrompt(issue) {
+    const body = issue.body && issue.body.trim() ? `\n\n${issue.body.trim()}` : '';
+    return `Work on GitHub issue #${issue.number}: ${issue.title}${body}\n\nIssue: ${issue.htmlUrl}`;
+}
+/** Pull the issue ref out of a task prompt built by issueToTaskPrompt (the
+ *  "Issue: <url>" line), so a finished task knows which issue to report back to. */
+export function issueRefFromText(text) {
+    const m = (text || '').match(/github\.com\/[^\s)]+\/issues\/\d+/i);
+    if (!m)
+        return undefined;
+    const ref = parseRepoRef(m[0]);
+    return ref && ref.number !== undefined ? { owner: ref.owner, repo: ref.repo, number: ref.number } : undefined;
+}
+const defaultSend = async (url, method, headers, body) => {
+    const res = await fetch(url, { method, headers, body });
+    return { status: res.status, json: () => res.json() };
+};
+/** Post the agent's result back onto the issue as a comment. Non-destructive —
+ *  closes the issue -> task -> result loop without touching any branches. */
+export async function commentOnIssue(token, owner, repo, number, body, http = defaultSend) {
+    const res = await http(`https://api.github.com/repos/${owner}/${repo}/issues/${number}/comments`, 'POST', {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/vnd.github+json',
+        'Content-Type': 'application/json',
+        'User-Agent': 'codehere',
+    }, JSON.stringify({ body }));
+    if (res.status === 401 || res.status === 403)
+        throw new Error('github auth failed or token lacks repo scope');
+    if (res.status === 404)
+        throw new Error('github issue not found (or no access)');
+    if (res.status >= 400)
+        throw new Error(`github comment failed: ${res.status}`);
+    const d = (await res.json());
+    return { htmlUrl: String(d.html_url ?? '') };
+}
+//# sourceMappingURL=github-api.js.map

package/dist/infrastructure/context/github-device-flow.js

@@ -0,0 +1,65 @@
+const DEVICE_CODE_URL = 'https://github.com/login/device/code';
+const TOKEN_URL = 'https://github.com/login/oauth/access_token';
+const DEFAULT_SCOPE = 'repo read:org';
+const GRANT = 'urn:ietf:params:oauth:grant-type:device_code';
+/** The public client_id of codehere's registered GitHub OAuth App. This is a
+ *  PUBLIC value (device flow needs no secret), so it ships as the default — the
+ *  same way the `gh` CLI bundles its own. Set this once the OAuth App with Device
+ *  Flow enabled is registered; until then GitHub connect stays inert and the UI
+ *  shows the "configure your own" fallback. CODEHERE_GITHUB_CLIENT_ID overrides
+ *  it (for users who prefer their own app). */
+const BUNDLED_GITHUB_CLIENT_ID = '';
+export function githubClientId() {
+    const env = (process.env.CODEHERE_GITHUB_CLIENT_ID || '').trim();
+    if (env)
+        return env;
+    const bundled = BUNDLED_GITHUB_CLIENT_ID.trim();
+    return bundled || undefined;
+}
+const defaultHttp = async (url, body) => {
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+    });
+    return (await res.json());
+};
+/** Step 1: ask GitHub for a device + user code. The user enters userCode at
+ *  verificationUri to approve; we then poll for the token. */
+export async function requestDeviceCode(clientId, scope = DEFAULT_SCOPE, http = defaultHttp) {
+    const d = await http(DEVICE_CODE_URL, { client_id: clientId, scope });
+    if (!d.device_code) {
+        throw new Error('github device-code request failed' + (d.error ? `: ${String(d.error)}` : ''));
+    }
+    return {
+        deviceCode: String(d.device_code),
+        userCode: String(d.user_code ?? ''),
+        verificationUri: String(d.verification_uri ?? 'https://github.com/login/device'),
+        intervalSec: Number(d.interval ?? 5),
+        expiresInSec: Number(d.expires_in ?? 900),
+    };
+}
+/** Step 2: poll once for the token. Caller repeats at `intervalSec` until it
+ *  resolves to connected or error (RFC 8628: authorization_pending = keep going,
+ *  slow_down = back off). */
+export async function pollForToken(clientId, deviceCode, http = defaultHttp) {
+    const d = await http(TOKEN_URL, { client_id: clientId, device_code: deviceCode, grant_type: GRANT });
+    if (d.access_token) {
+        return {
+            status: 'connected',
+            token: {
+                provider: 'github',
+                accessToken: String(d.access_token),
+                expiresAt: null, // GitHub OAuth App tokens don't expire unless revoked
+                scope: d.scope ? String(d.scope) : null,
+            },
+        };
+    }
+    const err = String(d.error ?? 'unknown');
+    if (err === 'authorization_pending')
+        return { status: 'pending' };
+    if (err === 'slow_down')
+        return { status: 'slow_down', intervalSec: Number(d.interval ?? 10) };
+    return { status: 'error', error: err };
+}
+//# sourceMappingURL=github-device-flow.js.map

package/dist/infrastructure/context/oauth-store.js

@@ -27,7 +27,8 @@
  * File permissions · 0600 on write so a multi-user machine can't read each
  * other's tokens.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { chmodSync, existsSync, mkdirSync, readFileSync } from 'fs';
+import { writeFileAtomic } from '../storage/atomic-write.js';
 import { homedir } from 'os';
 import { dirname, join } from 'path';
 function configPath() {
@@ -52,7 +53,9 @@ export function readAllConfig(path) {
 function writeAllConfig(cfg, path) {
     const target = path ?? configPath();
     mkdirSync(dirname(target), { recursive: true });
-    writeFileSync(target, JSON.stringify(cfg, null, 2) + '\n', 'utf-8');
+    // mode on the TEMP file, so the credentials are never briefly world-readable
+    // the way write-then-chmod leaves them. The chmod below stays as belt-and-braces.
+    writeFileAtomic(target, JSON.stringify(cfg, null, 2) + '\n', { mode: 0o600 });
     try {
         chmodSync(target, 0o600);
     }

package/dist/infrastructure/context/registry-bootstrap.js

@@ -32,10 +32,6 @@ export function getDefaultRegistry() {
     cached = reg;
     return reg;
 }
-/** Forget the cached registry · used by tests + future `codehere context-source reload`. */
-export function resetDefaultRegistry() {
-    cached = null;
-}
 /**
  * Resolve config path · respects CODEHERE_HOME env so tests can isolate.
  * File format: a JSON object keyed by adapter id, e.g.

package/dist/infrastructure/cost/budget-config.js

@@ -1,3 +1,4 @@
+import { writeFileAtomic } from '../storage/atomic-write.js';
 /**
  * v0.6 S3 slice 2 — daily spend budget config.
  *
@@ -21,7 +22,7 @@
  * the budget is a USER ceiling, not a codehere guarantee — we can't
  * see the actual provider invoice in real time.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { existsSync, mkdirSync, readFileSync } from 'fs';
 import { dirname, join } from 'path';
 import { homedir } from 'os';
 const DEFAULT_CONFIG = {
@@ -29,7 +30,7 @@ const DEFAULT_CONFIG = {
     warnAtPct: 70,
 };
 function configFile() {
-    return join(homedir(), '.codehere', 'budget.yaml');
+    return join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'budget.yaml');
 }
 /** Parse a tiny subset of YAML — `key: value` pairs, # comments, blank lines.
  *  No nesting, no lists, no multi-line. Same approach as permissions-config:
@@ -95,7 +96,7 @@ export function saveBudget(cfg) {
     }
     lines.push(`warn_at_pct: ${cfg.warnAtPct}`);
     lines.push('');
-    writeFileSync(path, lines.join('\n'), 'utf-8');
+    writeFileAtomic(path, lines.join('\n'));
 }
 /** True when today's estimated spend has hit or exceeded the daily ceiling.
  *  Returns false when no budget is set (no enforcement). */

package/dist/infrastructure/cost/cost-router.js

@@ -6,9 +6,10 @@
  * routing decisions have real financial impact at scale.
  *
  * Model tiers (approximate $/M output tokens, 2026):
- *   fast tier    (e.g. claude-haiku-4-5)    $1.25    — cheap, good for simple tasks
- *   balanced tier (e.g. claude-sonnet-4-6)  $15.00   — good for most tasks
- *   max tier     (e.g. claude-opus-4-6)     $75.00   — strongest, use sparingly
+ *   fast tier    (claude-haiku-4-5)   $1.25   — cheap, good for simple tasks
+ *   balanced tier (claude-sonnet-4-6) $15.00  — good for most tasks
+ *   max tier     (claude-fable-5)     $50.00  — strongest (Anthropic's current flagship,
+ *                                              Mythos-class; 1M ctx); use sparingly
  *
  * Routing logic:
  *   trust >= 90, simple task  → fast tier      (60x cheaper than max tier)
@@ -16,15 +17,20 @@
  *   trust < 75, or critical   → balanced tier with human review flag
  *   critical findings present → block before reaching model
  */
-const MODEL_COSTS = {
+export const MODEL_COSTS = {
     haiku: 1.25,
     sonnet: 15.0,
-    opus: 75.0,
+    opus: 50.0,
 };
+// NB: the `opus` key is the internal name for the MAX / strongest tier. Its model
+// is now Claude Fable 5 (Anthropic's current flagship, released 2026-06-09 —
+// stronger than Opus 4.8, which it falls back to on high-risk queries). User-facing
+// surfaces show the tier label ("max tier") + this modelId, so the key name is
+// internal-only.
 const MODEL_IDS = {
     haiku: 'claude-haiku-4-5-20251001',
     sonnet: 'claude-sonnet-4-6',
-    opus: 'claude-opus-4-6',
+    opus: 'claude-fable-5',
 };
 const TIER_LABELS = {
     haiku: 'fast tier',
@@ -84,21 +90,8 @@ export function recommendModel(trustScore, complexity = 'standard', criticalFind
         humanReview: true,
     };
 }
-/**
- * Estimate monthly savings from routing decisions.
- * @param avgTokensPerTask Average output tokens per AI task
- * @param tasksPerMonth Monthly task volume
- * @param distribution Fraction of tasks at each tier
- */
-export function estimateMonthlySavings(avgTokensPerTask = 2000, tasksPerMonth = 500, distribution = { haiku: 0.4, sonnet: 0.55, opus: 0.05 }) {
-    const tokensMillion = avgTokensPerTask / 1_000_000;
-    let routedCost = 0;
-    for (const [tier, fraction] of Object.entries(distribution)) {
-        routedCost += fraction * tasksPerMonth * tokensMillion * MODEL_COSTS[tier];
-    }
-    const opusCost = tasksPerMonth * tokensMillion * MODEL_COSTS.opus;
-    const saving = opusCost - routedCost;
-    const savingPct = (saving / opusCost) * 100;
-    return { routedCost, opusCost, saving, savingPct };
-}
+// MED #29 (atomic audit) · estimateMonthlySavings deleted: a pure projection
+// with zero production callers whose output ("~83% savings") had been quoted
+// as a shipped outcome. The honest claim now lives in PRODUCT_STATE (🟡,
+// projection); the budget gate carries the cost-bounded pillar.
 //# sourceMappingURL=cost-router.js.map

package/dist/infrastructure/cost/spend-aggregator.js

@@ -21,11 +21,11 @@
  */
 import { existsSync, readFileSync } from 'fs';
 import { homedir } from 'os';
-import { join } from 'path';
+import { basename, join } from 'path';
 /** Resolved at call time, not module load, so test setups that swap $HOME
  *  after import still get a fresh path on each invocation. */
 function sessionsFile() {
-    return join(homedir(), '.codehere', 'sessions.jsonl');
+    return join(process.env.CODEHERE_HOME || homedir(), '.codehere', 'sessions.jsonl');
 }
 /** USD per million OUTPUT tokens at the agent's typical 2026 tier. Input is
  *  estimated at 1/5 of output rate (Anthropic + OpenAI both publish ~5x
@@ -34,7 +34,7 @@ function sessionsFile() {
  *
  *  Conservative-ceiling philosophy: better to over-estimate spend than
  *  under-promise and miss a real bill. */
-const COST_PER_M_OUTPUT_TOKENS_USD = {
+export const COST_PER_M_OUTPUT_TOKENS_USD = {
     'claude-code': 15.0, // Sonnet 4.6 baseline
     codex: 10.0, // GPT-5 / codex baseline
     aider: 15.0, // typically Sonnet
@@ -44,28 +44,69 @@ const COST_PER_M_OUTPUT_TOKENS_USD = {
 };
 const INPUT_RATE_RATIO = 0.2; // input ≈ 1/5 of output
 const CACHE_READ_RATIO = 0.1; // cache reads ≈ 1/10 of input (so 1/50 output)
+/** Per-MODEL published rates (USD per million tokens), 2026. Matched by substring
+ *  so version suffixes resolve (claude-opus-4-x, gpt-5-codex, gemini-2.5-pro).
+ *  This is what makes an Opus run cost more than a Haiku run instead of one flat
+ *  per-agent tier, and prices a paid model even when the agent's default is free.
+ *  Still an estimate, not an invoice — see the file header. */
+const MODEL_RATES = [
+    // Anthropic — verified against platform.claude.com rate card (2026-07). Standard
+    // (post-introductory) rates; Sonnet 5's Aug-2026 intro price is lower, so the
+    // standard rate keeps the estimate conservative rather than under-billing.
+    { match: /fable|mythos/i, inputUsd: 10, outputUsd: 50 }, // Claude 5 flagship tier
+    { match: /opus/i, inputUsd: 5, outputUsd: 25 },
+    { match: /sonnet/i, inputUsd: 3, outputUsd: 15 },
+    { match: /haiku/i, inputUsd: 1, outputUsd: 5 },
+    { match: /gpt-5|codex/i, inputUsd: 1.25, outputUsd: 10 },
+    { match: /gemini.*(2\.5.*pro|1\.5.*pro|-pro)/i, inputUsd: 1.25, outputUsd: 10 }, // paid Gemini Pro tiers
+];
+/** Self-hosted / local backends cost nothing per token — never bill them at a
+ *  cloud tier just because the agent (e.g. aider) usually runs on a paid model. */
+const LOCAL_MODEL = /(?:^|[/:])(?:ollama(?:_chat)?|lmstudio|lm-studio|llama[._-]?cpp|local)\b/i;
+export function modelRate(model) {
+    if (!model)
+        return undefined;
+    for (const r of MODEL_RATES)
+        if (r.match.test(model))
+            return { inputUsd: r.inputUsd, outputUsd: r.outputUsd };
+    return undefined;
+}
 /**
- * Estimate dollar cost for one session's token usage at one agent's typical tier.
- * Returns 0 for free-tier agents and unknown agents (no mapping → no estimate).
+ * Estimate dollar cost for one session's token usage. Per-model rates when the
+ * adapter surfaced the real model (accurate input AND output); otherwise the
+ * agent's typical output tier (input ≈ 1/5). Returns 0 when neither is priced.
  */
 export function estimateCostUsd(agent, usage) {
     if (!usage)
         return 0;
-    const outputRate = COST_PER_M_OUTPUT_TOKENS_USD[agent];
-    if (outputRate === undefined || outputRate === 0)
-        return 0;
-    const inputRate = outputRate * INPUT_RATE_RATIO;
-    const cacheReadRate = inputRate * CACHE_READ_RATIO;
-    // Cache CREATION is billed at input rate (Anthropic). Use same default.
     const tokens = {
         input: Math.max(0, usage.inputTokens || 0),
         output: Math.max(0, usage.outputTokens || 0),
         cacheRead: Math.max(0, usage.cacheReadTokens || 0),
         cacheCreate: Math.max(0, usage.cacheCreationTokens || 0),
     };
+    // Local/self-hosted models are free to call — don't bill them at cloud rates.
+    // EXCEPT ollama's `:cloud`-tagged models: no local weights, proxied to Ollama's
+    // billed cloud — "ollama/glm-5.2:cloud" must NOT be recorded as $0.
+    if (usage.model && LOCAL_MODEL.test(usage.model) && !/:cloud$/i.test(usage.model))
+        return 0;
+    // Per-model when the real model is known — also prices a paid model whose agent
+    // default tier is 0 (closes the gemini/opencode $0-on-a-paid-backend hole).
+    const mr = modelRate(usage.model);
+    if (mr) {
+        return ((tokens.input / 1_000_000) * mr.inputUsd +
+            (tokens.output / 1_000_000) * mr.outputUsd +
+            (tokens.cacheRead / 1_000_000) * (mr.inputUsd * CACHE_READ_RATIO) +
+            (tokens.cacheCreate / 1_000_000) * mr.inputUsd);
+    }
+    // Fallback: the agent's typical tier. No regression for sessions without a model.
+    const outputRate = COST_PER_M_OUTPUT_TOKENS_USD[agent];
+    if (outputRate === undefined || outputRate === 0)
+        return 0;
+    const inputRate = outputRate * INPUT_RATE_RATIO;
     return ((tokens.input / 1_000_000) * inputRate +
         (tokens.output / 1_000_000) * outputRate +
-        (tokens.cacheRead / 1_000_000) * cacheReadRate +
+        (tokens.cacheRead / 1_000_000) * (inputRate * CACHE_READ_RATIO) +
         (tokens.cacheCreate / 1_000_000) * inputRate);
 }
 /** Return the millisecond timestamp for the start of "today" in local time. */
@@ -87,6 +128,8 @@ export function computeSpendToday(now = new Date()) {
         tokens: { input: 0, output: 0, cache: 0 },
         sessionCount: 0,
         byAgent: {},
+        byProject: {},
+        practice: { usd: 0, sessions: 0 },
         windowStartedAt: cutoff,
     };
     if (!existsSync(sessionsFile()))
@@ -98,9 +141,12 @@ export function computeSpendToday(now = new Date()) {
     catch {
         return empty;
     }
-    // Pair spawned (carries agent) with completed (carries usage + completedAt).
+    // Pair spawned (carries agent + cwd + mockRun) with completed (carries usage + completedAt).
     const spawnedAgent = new Map();
-    const report = { ...empty, byAgent: {} };
+    const spawnedProject = new Map();
+    const spawnedMock = new Set();
+    const completedById = new Map();
+    const report = { ...empty, byAgent: {}, byProject: {}, practice: { usd: 0, sessions: 0 } };
     for (const line of content.split('\n')) {
         const trimmed = line.trim();
         if (!trimmed)
@@ -114,17 +160,37 @@ export function computeSpendToday(now = new Date()) {
         }
         if (rec.t === 'spawned' && rec.id && rec.agent) {
             spawnedAgent.set(rec.id, rec.agent);
+            if (rec.cwd)
+                spawnedProject.set(rec.id, basename(rec.cwd));
+            if (rec.mockRun === true)
+                spawnedMock.add(rec.id);
             continue;
         }
         if (rec.t !== 'completed' || !rec.id)
             continue;
         if (typeof rec.completedAt !== 'number' || rec.completedAt < cutoff)
             continue;
-        const agent = spawnedAgent.get(rec.id);
-        if (!agent)
+        if (!spawnedAgent.has(rec.id))
             continue;
+        // ONE session = ONE count: a session legitimately carries MULTIPLE
+        // completed rows (the exit handler writes one, the async test-observation
+        // re-persists a corrected one — loadRecent dedups by id, later wins).
+        // Summing every row DOUBLED cost + session counts on the team record
+        // (found live 2026-07-07: 2 real runs read as 4 sessions / 2x spend).
+        // Same semantics as the reader: keep the LAST row per id.
+        completedById.set(rec.id, rec);
+    }
+    for (const [id, rec] of completedById) {
+        const agent = spawnedAgent.get(id);
         const usage = rec.artifacts?.usage;
         const usd = estimateCostUsd(agent, usage);
+        // Practice runs divert to their own bucket — a mock's fabricated "cost"
+        // never joins the real totals, the by-* breakdowns, or the budget's view.
+        if (spawnedMock.has(id)) {
+            report.practice.usd += usd;
+            report.practice.sessions += 1;
+            continue;
+        }
         report.sessionCount += 1;
         if (usage) {
             report.tokens.input += usage.inputTokens || 0;
@@ -136,12 +202,21 @@ export function computeSpendToday(now = new Date()) {
         cur.usd += usd;
         cur.sessions += 1;
         report.byAgent[agent] = cur;
+        const project = spawnedProject.get(id) || 'unknown';
+        const pcur = report.byProject[project] || { usd: 0, sessions: 0 };
+        pcur.usd += usd;
+        pcur.sessions += 1;
+        report.byProject[project] = pcur;
     }
     // Round totals to 4 decimals (1/100 of a cent) — final display rounds to 2.
     report.totalUsd = Math.round(report.totalUsd * 10_000) / 10_000;
     for (const k of Object.keys(report.byAgent)) {
         report.byAgent[k].usd = Math.round(report.byAgent[k].usd * 10_000) / 10_000;
     }
+    for (const k of Object.keys(report.byProject)) {
+        report.byProject[k].usd = Math.round(report.byProject[k].usd * 10_000) / 10_000;
+    }
+    report.practice.usd = Math.round(report.practice.usd * 10_000) / 10_000;
     return report;
 }
 //# sourceMappingURL=spend-aggregator.js.map