codex-token-tracker 0.1.1 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,110 @@
+# Changelog
+
+All notable changes to `codex-token-tracker`. This project follows [Semantic Versioning](https://semver.org/).
+
+## 0.2.1 — 2026-09-01
+
+A manual **Sync** button that recalibrates this device's numbers on the dashboard.
+
+### Added
+
+- **Full sync.** The popover header gets a **⟳** button (also *Sync now* in the Account card and the tray
+  menu, and `codex-token-tracker sync` on the CLI). Unlike the background upload — which every 60 s pushes
+  only the hour buckets and sessions that changed — a full sync throws away every cache on the way:
+  1. re-reads the config, so agents enabled since start-up are picked up;
+  2. re-discovers every session directory and re-parses every transcript from scratch — Codex plus the
+     coding agents running on your Codex subscription (pi, OpenCode, Cline / Roo / Kilo, Hermes) and any
+     configured `extraSessionDirs` — instead of skipping files whose size and mtime are unchanged;
+  3. recomputes the aggregates with the current pricing table;
+  4. re-uploads **everything**, so the dashboard's totals for this device are replaced by the freshly
+     computed ones;
+  5. pulls the other devices' rows and the live rate limits back down.
+
+  Use it when a machine's numbers look wrong, after installing a new agent, or after an update that
+  changes the pricing table. It is manual only — never on a timer — because it re-sends the whole history.
+- A banner in the popover reports the phase while a sync runs (*Rescanning every agent's transcripts…*,
+  *Re-uploading this device's history…*) and then the result, e.g. `Synced codex, pi · 75 files ·
+  75 sessions · 70 hours re-uploaded`. Signed out, the rescan still runs and nothing leaves the machine.
+- `codex-token-tracker sync` prints the same summary and exits non-zero if the sync failed.
+
+- **Dev builds target the dev environment.** A build now carries its channel, stamped by
+  `scripts/build.mjs`: only `--release` (what `prepack` runs) produces a production build, so every
+  published tarball is prod and every local `pnpm build` / `pnpm dev` is dev. A dev build
+  - defaults to the local dashboard `http://localhost:3000` instead of `https://codex.chenli.dev`, and
+    therefore uploads to whatever Convex deployment that dashboard advertises — the dev one;
+  - keeps its config, device token and upload state in `~/.codex-tracker-dev`, so a local run can
+    never overwrite the production token or the record of what was already pushed to production;
+  - defaults `checkUpdates` to `false` and refuses `codex-token-tracker update`, which would otherwise
+    install the published package over the checkout;
+  - runs as `Codex Tracker (dev)` with its own Electron userData directory and macOS LaunchAgent, so it
+    can run **beside** an installed copy instead of fighting it for the single-instance lock;
+  - shows an orange **DEV** badge in the popover header and names its dashboard and config directory in
+    `--version`, `status` and `paths`.
+
+  `--dashboard <url>`, `config set dashboardUrl` and `CODEX_TRACKER_HOME` still override all of it.
+
+### Changed
+
+- `Uploader.pushAll()` takes a `{ full }` option that clears the pushed-buckets/pushed-sessions record
+  before building the payload, and waits for an in-flight incremental push instead of skipping the call.
+- `SessionStore.reset()` drops the parsed-file index so a following deep refresh re-reads everything.
+- Packaging scripts: `build:release` builds with the prod channel; `prepack` runs it (so `npm pack` and
+  `npm publish` always ship a prod build) and `postpack` restores the dev build in `dist/`.
+  `prepublishOnly` now only typechecks.
+- `app.setName()` moved ahead of `requestSingleInstanceLock()` — the lock is keyed on the userData
+  directory, which is derived from the name.
+
+## 0.2.0 — 2026-09-01
+
+Pricing accuracy, an honest tokens/s number, and self-update.
+
+### Added
+
+- **`codex-token-tracker` command.** Installing globally now puts **two** equivalent executables on your
+  PATH — `codex-token-tracker` (matching the package name) and the existing `codex-tracker` alias. Both
+  run the same CLI; nothing you already scripted breaks.
+- **Self-update.** `codex-token-tracker update` checks the npm registry and installs the newest release
+  with the package manager this copy came from (npm / pnpm / yarn / bun). `--check` reports without
+  installing. The menu bar app shows an **Update** banner and a *Check for updates* item in the tray
+  menu; installing from there asks you to restart to apply.
+  - Checks are cached for 6 h in `~/.codex-tracker/update.json` and send no usage data or identifiers.
+  - Disable with `config set checkUpdates false`; point at a mirror with `CODEX_TRACKER_REGISTRY`.
+  - `codex-tracker status` prints a one-line notice when a newer version exists.
+- **Long-context pricing tiers.** Models that OpenAI bills at a higher rate above 272K input tokens
+  (`gpt-5.4`, `gpt-5.5`, the `gpt-5.6-*` family and their `-pro` variants) are now priced per request at
+  the correct tier instead of always at the standard rate.
+- New config key `checkUpdates` (default `true`).
+
+### Changed
+
+- **Pricing table rebuilt** from <https://developers.openai.com/api/docs/pricing>. Adds `gpt-5.6-sol`,
+  `gpt-5.6-terra`, `gpt-5.6-luna`, `gpt-5.6-cyber`, `gpt-5.5`, `gpt-5.5-pro`, `gpt-5.5-cyber`, `gpt-5.4`,
+  `gpt-5.4-mini`, `gpt-5.4-nano`, `gpt-5.4-pro`, `gpt-5.3-codex`, `gpt-5-search-api` and `chat-latest`,
+  plus explicit `-codex` entries so Codex CLI model ids resolve exactly rather than through the family
+  fallback. Models in current use — `gpt-5.6-sol` above all — are now exact matches and lose the *est.*
+  badge. The catch-all fallback moved from `gpt-5.2` to `gpt-5.3-codex`.
+- **Codex-only accounting.** Usage on non-OpenAI models is dropped from totals, cost, the model mix, the
+  heatmap and uploads. Sources such as Cline/Roo/Kilo and OpenCode can drive Anthropic, Google or local
+  models; costing those against an OpenAI price table produced meaningless dollars. The dashboard also
+  filters rows and sessions uploaded by older clients.
+
+### Fixed
+
+- **Live tokens/s was wildly overstated** (6,000+ tok/s where the real rate is tens). Each request's
+  `input` counts the *entire prompt re-sent for that turn* — hundreds of thousands of context tokens —
+  so summing `total` over a 60 s window measured context replay, not generation. The rate is now
+  **output tokens only**, and the divisor is clamped to the part of the window the session has actually
+  existed for, so a session seconds old is not diluted by time that never happened. The 10 s burst
+  figure is computed the same way.
+
+## 0.1.1 — 2026-08-31
+
+### Fixed
+
+- Self-install the Electron runtime on first run when npm ≥ 11 / pnpm ≥ 10 skipped its install script.
+
+## 0.1.0 — 2026-08-31
+
+First public release: macOS menu bar app, Windows tray app, headless `agent` mode, Codex/pi/OpenCode/
+Cline/Roo/Kilo/Hermes session readers, live rate limits, activity heatmap, device-code login and
+dashboard sync.

package/README.md

@@ -3,9 +3,10 @@
 Menu bar / system tray app **and** headless agent that tracks your [OpenAI Codex](https://github.com/openai/codex) usage — tokens, cache hit rate, model mix, tokens per second of the running session, subscription rate limits and the **API-equivalent cost in dollars** — and syncs it to your team's Codex Tracker dashboard (Next.js + Clerk + Convex).
 
 - macOS menu bar app and native Windows tray app (Electron)
-- `codex-tracker agent` headless mode for **WSL2**, Linux and servers
+- `codex-token-tracker agent` headless mode for **WSL2**, Linux and servers
+- Self-update: `codex-token-tracker update`, plus an in-app "Update" button when a newer version is published
 - Reads Codex CLI / Codex Desktop rollout logs (`~/.codex/sessions`) locally — no API keys, no proxies
-- Real-time: today's totals, current session tokens/sec, context window use, weekly / 5-hour rate limits
+- Real-time: today's totals, the live session's generation speed (tokens/s), context window use, weekly / 5-hour rate limits
 - Activity heatmap merged from **local data + your other devices** (realtime database)
 - English / 中文, follows your OS language and can be switched and persisted
 - Light / dark follows the system theme
@@ -20,6 +21,12 @@ npm install -g codex-token-tracker
 npx codex-token-tracker
 ```
 
+This installs two equivalent commands on your PATH: **`codex-token-tracker`** and the shorter alias
+`codex-tracker`. Every example below works with either name.
+
+Already installed? `codex-token-tracker update` fetches the newest published version and installs it
+with whichever package manager you used (npm / pnpm / yarn / bun).
+
 > **npm 11+ / pnpm 10+ block Electron's install script by default.** That's fine: the first `codex-tracker` run downloads the Electron runtime itself (~100 MB, once). To do it during install instead: `npm install -g codex-token-tracker --allow-scripts=electron`.
 
 Node.js 20+ is required. Electron is an *optional* dependency: if its binary cannot be downloaded (locked-down servers, WSL without a desktop), the package still installs and runs in agent mode.
@@ -54,18 +61,46 @@ The tracker discovers the Convex deployment through `<dashboard>/api/config`.
 | `codex-tracker login [--dashboard <url>]` | Device-code login |
 | `codex-tracker logout` | Forget the device token (local data stays) |
 | `codex-tracker status [--json]` | Today / 7d / 30d usage, live session, rate limits, models |
+| `codex-tracker sync` | Full sync: rescan every agent and re-upload this device's whole history |
 | `codex-tracker paths` | Detected Codex session directories |
 | `codex-tracker config get [key]` / `config set <key> <value>` | Settings (see below) |
 | `codex-tracker lang <en\|zh\|auto>` | Display language |
+| `codex-tracker update [--check]` | Install the newest published version; `--check` only reports it |
 | `codex-tracker --version` / `--help` | |
 
 ## Menu bar app
 
 - Tray title shows today's tokens (`12.4k`) — `config set trayTitle tokens|cost|none`
 - Click: popover with Today, Live session (tokens/s, context window, rate limits), Activity heatmap, Models, Account
-- Right-click: Open dashboard, Sign in/out, Language, Launch at login, Refresh, Quit
+- Right-click: Open dashboard, Sign in/out, Language, Launch at login, Refresh, **Sync now**, Check for updates, Quit
+- A banner appears at the top of the popover when a newer version is published; **Update** installs it and the app asks you to restart
 - Launch at login uses a LaunchAgent on macOS and the registry run key on Windows
 
+## Sync
+
+The tracker uploads continuously in the background: every 60 s it sends the hour buckets and sessions
+that *changed* since the last push. **Sync** does the full version instead — use it when the dashboard's
+numbers for this machine look wrong, after you install a new agent, or after an update that changes the
+pricing table.
+
+Press the **⟳** button in the popover header (or *Sync now* in the Account card and the tray menu, or run
+`codex-tracker sync`). It:
+
+1. re-reads the config, so agents enabled since the app started are picked up;
+2. re-discovers **every** session directory and re-parses **every** transcript from scratch — Codex plus
+   the coding agents running on your Codex subscription (pi, OpenCode, Cline / Roo / Kilo, Hermes) and any
+   `extraSessionDirs` you configured — instead of skipping files whose size and mtime are unchanged;
+3. recomputes all aggregates with the current pricing table;
+4. re-uploads **everything**, not just what changed, so the dashboard's totals for this device are
+   replaced by the freshly computed ones — this is the calibration step;
+5. pulls the other devices' rows and the live rate limits back down.
+
+A banner reports the phase while it runs and then what it found (`Synced codex, pi · 75 files ·
+75 sessions · 70 hours re-uploaded`). Signed out, steps 1-3 still run and nothing leaves the machine.
+
+A full sync re-sends your whole history, so it costs more bandwidth than a normal push — it is a manual
+action, never on a timer.
+
 ## Windows and WSL2
 
 **Native Windows**: `npm i -g codex-token-tracker` in PowerShell, then `codex-tracker`. The tray app also scans every WSL distro (`\\wsl$\<distro>\home\*\.codex\sessions`) so sessions run inside WSL are counted.
@@ -102,16 +137,38 @@ Config lives in `~/.codex-tracker/` (override with `CODEX_TRACKER_HOME`):
 | `extraSessionDirs` | `[]` | Extra session folders (comma-separated in `config set`) |
 | `launchAtLogin` | `false` | macOS / Windows |
 | `trayTitle` | `tokens` | `tokens`, `cost` or `none` |
+| `checkUpdates` | `true` | Ask the npm registry (once per 6 h) whether a newer version exists |
 
 `CODEX_HOME` is honoured when locating `sessions/` and `archived_sessions/`.
 
-### Pricing overrides
+### Updates
+
+`checkUpdates` (default on) asks `registry.npmjs.org` for the package's `latest` dist-tag at most once
+every 6 hours and caches the answer in `~/.codex-tracker/update.json`. Nothing else is sent — the request
+carries no usage data and no identifiers. Turn it off with `codex-tracker config set checkUpdates false`;
+`codex-tracker update` still works on demand. Set `CODEX_TRACKER_REGISTRY` (or `npm_config_registry`) to use
+a mirror.
+
+Global installs can fail for reasons the app cannot fix — a root-owned npm prefix, a proxy, a read-only
+volume. When that happens the exact command is shown so you can run it yourself.
+
+### Pricing
+
+Costs are "API-equivalent" — [standard OpenAI list prices](https://developers.openai.com/api/docs/pricing)
+per 1M tokens (input, cached input, output; reasoning tokens are billed as output). Models with a
+long-context tier are billed at the higher rate for requests whose prompt exceeds 272K tokens. `-codex`
+variants are priced at their base model's rate.
 
-Costs are "API-equivalent" — standard OpenAI list prices per 1M tokens (input, cached input, output; reasoning tokens are billed as output). Models missing from the built-in table are priced by family and marked **est.** Override or add prices in `~/.codex-tracker/pricing.json`:
+**Codex only.** Some supported sources (Cline/Roo/Kilo, OpenCode) can also drive Anthropic, Google or local
+models. That usage is *not* counted: this tool reports Codex consumption, and pricing a Claude request
+against an OpenAI table would be meaningless.
+
+Models missing from the built-in table are priced by family and marked **est.** Override or add prices in
+`~/.codex-tracker/pricing.json`:
 
 ```json
 {
-  "gpt-5.6-sol": { "input": 1.75, "cachedInput": 0.175, "output": 14 }
+  "gpt-5.7-nova": { "input": 1.75, "cachedInput": 0.175, "output": 14 }
 }
 ```
 
@@ -120,7 +177,7 @@ Costs are "API-equivalent" — standard OpenAI list prices per 1M tokens (input,
 The tracker reads the local transcripts of every agent that can use a Codex subscription (ChatGPT login) and
 attributes usage to an **agent** (shown as "Sources" chips in the popover, a `Sources` line in `codex-tracker status`,
 and as a tag on live sessions / model rows). Only Codex-subscription providers are counted unless
-`trackAllProviders` is `true`.
+`trackAllProviders` is `true`, and **only OpenAI models are counted at all** — see [Pricing](#pricing).
 
 | Source | Where it looks | Notes |
 |---|---|---|
@@ -168,7 +225,42 @@ CODEX_TRACKER_DEVTOOLS=1 ...                                                # op
 pnpm --filter codex-token-tracker build:icons                               # regenerate tray icons
 ```
 
-Publishing (from the repo root): `pnpm release:menubar` — `prepublishOnly` rebuilds and typechecks first.
+### Dev builds vs published builds
+
+A build knows which environment it belongs to, so a local test run can never write into production.
+`scripts/build.mjs` stamps the channel at bundle time: **only `--release` produces a prod build**, which
+is what `prepack` runs — so every tarball and every `npm publish` is prod, and every `pnpm build`,
+`pnpm dev` and watch-mode rebuild is dev.
+
+| | dev build (`pnpm build`) | published build (`npm i -g codex-token-tracker`) |
+| --- | --- | --- |
+| Dashboard default | `http://localhost:3000` | `https://codex.chenli.dev` |
+| Convex deployment | whatever the local dashboard's `/api/config` advertises — the **dev** one | production |
+| Config, device token, upload state | `~/.codex-tracker-dev` | `~/.codex-tracker` |
+| `checkUpdates` default | `false` (`update` refuses to run) | `true` |
+| App name / Electron userData | `Codex Tracker (dev)` | `Codex Tracker` |
+| macOS LaunchAgent | `dev.codex-tracker.menubar.dev` | `dev.codex-tracker.menubar` |
+| Popover | orange **DEV** badge in the header | — |
+
+Because the two differ in app name and config directory, **a dev build and an installed one can run at
+the same time**, each with its own tray icon, device token and upload state.
+
+To test against a dev environment, start the dashboard and Convex, then run the local build:
+
+```bash
+cd apps/dashboard && npx convex dev            # terminal 1
+pnpm dev                                        # terminal 2 — http://localhost:3000
+pnpm --filter codex-token-tracker build         # terminal 3
+node packages/menubar/bin/codex-tracker.js login   # → localhost:3000, no --dashboard needed
+node packages/menubar/bin/codex-tracker.js menubar
+```
+
+Both defaults are only *defaults*: `--dashboard <url>` and `config set dashboardUrl <url>` still point
+either build anywhere, and `CODEX_TRACKER_HOME` still overrides the config directory.
+
+Publishing (from the repo root): `pnpm release:menubar` — `prepublishOnly` typechecks and `prepack`
+makes the release build, so a published tarball is never accidentally a dev build. `postpack` restores
+the dev build in `dist/` afterwards, so your working copy keeps pointing at localhost.
 
 ## License