log-llm-config 1.5.0 → 1.5.8

package/dist/log_config_files/collection/copilot_token_usage_collector.js

@@ -0,0 +1,154 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Token-usage / session / CLI-version aggregator for GitHub Copilot CLI.
+ *
+ * Copilot CLI writes one transcript per session under ~/.copilot/session-state/<id>/events.jsonl.
+ * Each transcript's `session.start` carries `copilotVersion` + `selectedModel`; its
+ * `session.shutdown` carries `tokenDetails` ({input,output,cache_read}.tokenCount),
+ * `totalPremiumRequests`, and per-model `modelMetrics`. We aggregate the *numbers* (and version /
+ * model ids) on the endpoint and emit only those — never transcript content.
+ *
+ * Bounded by mtime recency so a large session history is not fully re-parsed on every hook run.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'copilot_token_usage';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/** session.shutdown.tokenDetails → {input,output,cache_read}.tokenCount */
+function addTokenDetails(totals, tokenDetails) {
+    totals.input_tokens += num(asObject(tokenDetails.input).tokenCount);
+    totals.output_tokens += num(asObject(tokenDetails.output).tokenCount);
+    totals.cache_read_input_tokens += num(asObject(tokenDetails.cache_read).tokenCount);
+}
+/** Recursively collect events.jsonl files whose mtime is within the recency window. */
+function recentEventFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentEventFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() && entry.name === 'events.jsonl') {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable — skip */
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Aggregate Copilot token usage / session count / version across recent session transcripts.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
+ */
+function collectCopilotTokenUsage(home = homedir()) {
+    const sessionsDir = join(home, '.copilot', 'session-state');
+    if (!existsSync(sessionsDir))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = recentEventFiles(sessionsDir, cutoffMs);
+    if (files.length === 0)
+        return [];
+    const totals = emptyTotals();
+    const sessions = new Set();
+    const models = new Set();
+    const modelTokenSplit = {};
+    let premiumRequests = 0;
+    let version = '';
+    let versionAt = -1;
+    let sawData = false;
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            sawData = true;
+            const type = entry.type;
+            const data = asObject(entry.data);
+            const sessionId = data.sessionId;
+            if (typeof sessionId === 'string' && sessionId)
+                sessions.add(sessionId);
+            if (type === 'session.start') {
+                // Keep the copilotVersion from the most recently started session.
+                const startTime = num(data.startTime);
+                const v = data.copilotVersion;
+                if (typeof v === 'string' && v && startTime >= versionAt) {
+                    version = v;
+                    versionAt = startTime;
+                }
+                if (typeof data.selectedModel === 'string' && data.selectedModel) {
+                    models.add(data.selectedModel);
+                }
+            }
+            else if (type === 'assistant.message') {
+                if (typeof data.model === 'string' && data.model)
+                    models.add(data.model);
+            }
+            else if (type === 'session.shutdown') {
+                premiumRequests += num(data.totalPremiumRequests);
+                addTokenDetails(totals, asObject(data.tokenDetails));
+                const modelMetrics = asObject(data.modelMetrics);
+                for (const [model, metrics] of Object.entries(modelMetrics)) {
+                    models.add(model);
+                    const usage = asObject(asObject(metrics).usage);
+                    const sum = num(usage.inputTokens) + num(usage.outputTokens) + num(usage.cacheReadTokens);
+                    if (sum > 0)
+                        modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+                }
+            }
+        }
+    }
+    if (!sawData)
+        return [];
+    // Sessions without a sessionId in data still count via their transcript file.
+    const sessionCount = Math.max(sessions.size, files.length);
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: sessionsDir, // stable synthetic path → one aggregate row per machine
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                premium_requests: premiumRequests,
+                model_token_split: modelTokenSplit,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+            },
+        },
+    ];
+}
+export { collectCopilotTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/cursor_token_usage_collector.js

@@ -0,0 +1,188 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+/**
+ * Session / version / identity aggregator for Cursor.
+ *
+ * Cursor stores everything in a VSCode-style SQLite state DB at
+ * ~/Library/Application Support/Cursor/User/globalStorage/state.vscdb (macOS).
+ * Two tables carry the data we need:
+ *   ItemTable       — key/value store: Cursor version, cursorAuth/* identity rows
+ *   cursorDiskKV    — key/value store: composerData:<conversationId> entries,
+ *                     each with a JSON blob carrying createdAt, modelConfig.modelName
+ *
+ * We read identity (email, plan, version) from ItemTable and aggregate session counts +
+ * model names from composerData entries in cursorDiskKV, bounded to the last 30 days.
+ * Token counts are no longer written by Cursor 3.8+ so totals are always 0.
+ * No message content is read — only model names and timestamps.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'cursor_token_usage';
+const ROW_SEP = '\x1e';
+const FIELD_SEP = '\x1f';
+/** Platform-aware path to Cursor's global state.vscdb. */
+function vscdbPath(home) {
+    if (process.platform === 'darwin') {
+        return join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+    }
+    if (process.platform === 'linux') {
+        return join(home, '.config', 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+    }
+    // Windows: AppData/Roaming/Cursor/...
+    const appdata = process.env['APPDATA'] || join(home, 'AppData', 'Roaming');
+    return join(appdata, 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+}
+function querySqlite(sqlite3, dbPath, sql) {
+    try {
+        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
+            input: `.timeout 5000\n${sql}\n`,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+function num(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const n = parseInt(value, 10);
+        return Number.isFinite(n) ? n : 0;
+    }
+    return 0;
+}
+/**
+ * Aggregate Cursor token usage / sessions / version / identity from state.vscdb.
+ * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
+ */
+function collectCursorTokenUsage(home = homedir()) {
+    const dbPath = vscdbPath(home);
+    if (!existsSync(dbPath))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    // Identity: version, email, plan, subscription status, sign-up type, display name.
+    const identityRaw = querySqlite(sqlite3, dbPath, `SELECT key || char(31) || COALESCE(value, '') || char(30)
+     FROM ItemTable
+     WHERE key IN (
+       'cursor.startupMetrics.lastVersion',
+       'cursorAuth/cachedEmail',
+       'cursorAuth/stripeMembershipType',
+       'cursorAuth/stripeSubscriptionStatus',
+       'cursorAuth/cachedSignUpType',
+       'cursorAuth/cachedScopedProfile'
+     );`);
+    let version = '';
+    let email = '';
+    let plan = '';
+    let subscriptionStatus = '';
+    let signUpType = '';
+    let displayName = '';
+    if (identityRaw) {
+        for (const row of identityRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const sep = trimmed.indexOf(FIELD_SEP);
+            if (sep === -1)
+                continue;
+            const key = trimmed.slice(0, sep);
+            const value = trimmed.slice(sep + 1);
+            switch (key) {
+                case 'cursor.startupMetrics.lastVersion':
+                    version = value;
+                    break;
+                case 'cursorAuth/cachedEmail':
+                    email = value;
+                    break;
+                case 'cursorAuth/stripeMembershipType':
+                    plan = value;
+                    break;
+                case 'cursorAuth/stripeSubscriptionStatus':
+                    subscriptionStatus = value;
+                    break;
+                case 'cursorAuth/cachedSignUpType':
+                    signUpType = value;
+                    break;
+                case 'cursorAuth/cachedScopedProfile':
+                    try {
+                        const profile = JSON.parse(value);
+                        if (typeof profile['displayName'] === 'string')
+                            displayName = profile['displayName'];
+                    }
+                    catch {
+                        /* non-JSON or missing — skip */
+                    }
+                    break;
+            }
+        }
+    }
+    // Usage: aggregate session counts and model names from composerData entries in the last 30
+    // days. composerData:<conversationId> entries carry a Unix ms timestamp in $.createdAt and
+    // the model in $.modelConfig.modelName. Token counts are not written by Cursor 3.8+.
+    // cutoffMs is a safe integer — interpolating directly avoids an extra round-trip.
+    // key range (not LIKE 'composerData:%') so the query hits the primary-key index on `key`
+    // instead of a full-table scan. SQLite's LIKE optimizer only rewrites a prefix match to an
+    // index range scan when the comparison is case-sensitive: either PRAGMA case_sensitive_like
+    // is ON (with `key`'s default BINARY collation), or the column itself uses NOCASE collation.
+    // Neither holds here, so LIKE 'composerData:%' would fall back to a full scan of cursorDiskKV.
+    // ';' is the char after ':' in ASCII, so [composerData: , composerData;) is exactly the
+    // composerData:* prefix range. Note: this also makes the match case-sensitive (BINARY
+    // collation), narrower than the old case-insensitive LIKE — safe because Cursor always
+    // writes this key prefix as the exact literal 'composerData:', never a different casing.
+    const usageRaw = querySqlite(sqlite3, dbPath, `SELECT
+       COALESCE(json_extract(value, '$.modelConfig.modelName'), 'default') || char(31) ||
+       COUNT(*) || char(30)
+     FROM cursorDiskKV
+     WHERE key >= 'composerData:' AND key < 'composerData;'
+       AND CAST(json_extract(value, '$.createdAt') AS INTEGER) >= ${cutoffMs}
+     GROUP BY json_extract(value, '$.modelConfig.modelName');`);
+    const models = new Set();
+    let sessionCount = 0;
+    if (usageRaw) {
+        for (const row of usageRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const sep = trimmed.indexOf(FIELD_SEP);
+            if (sep === -1)
+                continue;
+            const model = trimmed.slice(0, sep).trim();
+            const cnt = num(trimmed.slice(sep + 1));
+            sessionCount += cnt;
+            if (model)
+                models.add(model);
+        }
+    }
+    if (sessionCount === 0 && !email && !version)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: dbPath,
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                model_token_split: {},
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals: {
+                    input_tokens: 0,
+                    output_tokens: 0,
+                },
+                email,
+                display_name: displayName,
+                plan,
+                subscription_status: subscriptionStatus,
+                auth_method: signUpType ? 'cursor_account' : '',
+            },
+        },
+    ];
+}
+export { collectCursorTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE, vscdbPath };

package/dist/log_config_files/collection/ensure_cursor_user_settings_snapshot.js

@@ -0,0 +1,50 @@
+import { existsSync } from 'node:fs';
+import { readJSONFile } from '../readers/file_readers.js';
+import { PORTABLE_CURSOR_USER_SETTINGS, cursorUserSettingsAbsolutePaths, } from '../runtime/remediation_config_path.js';
+export function isPortableCursorUserSettingsUploadPath(filePath) {
+    const p = filePath.replace(/\\/g, '/').toLowerCase();
+    return (p === 'cursor/user/settings.json' ||
+        p.endsWith('/cursor/user/settings.json') ||
+        p.includes('application support/cursor/user/settings.json'));
+}
+function settingsPayloadHasGlobalIgnoreListKey(raw) {
+    if (!raw || typeof raw !== 'object')
+        return false;
+    const nested = raw.cursor
+        ?.general?.globalCursorIgnoreList;
+    if (Array.isArray(nested))
+        return true;
+    const flat = raw['cursor.general.globalCursorIgnoreList'];
+    return Array.isArray(flat);
+}
+/**
+ * Sensitive Directories scans need full User/settings.json (globalCursorIgnoreList).
+ * Pattern collection can omit the key or send an empty object; merge disk when the batch
+ * lacks an explicit globalCursorIgnoreList array (including []).
+ */
+export function ensureCursorUserSettingsSnapshotInBatch(configFiles) {
+    const hasIgnoreKeyInBatch = configFiles.some((c) => c.file_type === 'vscode_settings' &&
+        isPortableCursorUserSettingsUploadPath(c.file_path) &&
+        settingsPayloadHasGlobalIgnoreListKey(c.raw_content));
+    if (hasIgnoreKeyInBatch)
+        return;
+    for (const abs of cursorUserSettingsAbsolutePaths()) {
+        if (!existsSync(abs))
+            continue;
+        const raw = readJSONFile(abs);
+        if (!raw || Object.keys(raw).length === 0)
+            continue;
+        const entry = {
+            file_type: 'vscode_settings',
+            file_path: PORTABLE_CURSOR_USER_SETTINGS,
+            raw_content: raw,
+        };
+        const idx = configFiles.findIndex((c) => c.file_type === 'vscode_settings' &&
+            isPortableCursorUserSettingsUploadPath(c.file_path));
+        if (idx >= 0)
+            configFiles[idx] = entry;
+        else
+            configFiles.push(entry);
+        return;
+    }
+}

package/dist/log_config_files/collection/hermes_token_usage_collector.js

@@ -0,0 +1,219 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+/**
+ * Session / token usage / model / version aggregator for Hermes Agent (Nous Research).
+ *
+ * Hermes keeps all state under ~/.hermes/. Three sources feed this aggregate, each read
+ * narrowly to avoid ever touching credential material:
+ *   - state.db (SQLite) `sessions` table — real per-session model + token columns
+ *     (input_tokens, output_tokens, reasoning_tokens, cache_read_tokens). started_at is a
+ *     Unix epoch *seconds* REAL column, bounded to the last 30 days.
+ *   - config.yaml — only the top-level `model` key (string, or a block with a `default`
+ *     sub-key) is extracted; config.yaml can hold literal provider API keys under
+ *     `providers:`, so this is a scoped line-scan, never a full YAML parse.
+ *   - auth.json — only the top-level `active_provider` key (e.g. "nous") is read; the
+ *     per-provider blocks under `providers:` hold OAuth/API-key secrets and are never
+ *     touched. "nous" is Nous Portal OAuth; anything else is a traditional API-key
+ *     provider (see hermes_cli/auth.py's ProviderConfig registry).
+ *
+ * There is no on-disk record of email/org/plan — those only exist inside the live OAuth
+ * access_token's JWT claims (the actual bearer credential, not a side identity token like
+ * Codex's id_token), so this collector does not decode it. Version comes from the bundled
+ * source checkout's hermes_cli/__init__.py (best-effort; empty string if unavailable).
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'hermes_token_usage';
+const ROW_SEP = '\x1e';
+const FIELD_SEP = '\x1f';
+const PROVIDER_NOUS = 'nous';
+const AUTH_NOUS_OAUTH = 'nous_oauth';
+const AUTH_API_KEY = 'api_key';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const n = parseFloat(value);
+        return Number.isFinite(n) ? n : 0;
+    }
+    return 0;
+}
+function querySqlite(sqlite3, dbPath, sql) {
+    try {
+        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
+            input: `.timeout 5000\n${sql}\n`,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Extract a plain YAML scalar value, stripping quotes and a trailing inline comment.
+ * A quoted value's content ends at the matching close-quote (anything after, including a
+ * comment, is discarded). An unquoted value's comment starts at a `#` preceded by whitespace
+ * or at the start of the string (a bare `#` glued to non-space text is part of the value, per
+ * the YAML spec's plain-scalar comment rule).
+ */
+function stripYamlScalar(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('"')) {
+        const end = trimmed.indexOf('"', 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    if (trimmed.startsWith("'")) {
+        const end = trimmed.indexOf("'", 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    const commentIdx = trimmed.search(/(?:^|\s)#/);
+    return (commentIdx === -1 ? trimmed : trimmed.slice(0, commentIdx)).trim();
+}
+/**
+ * Scoped read of config.yaml's top-level `model` key only. Handles both the plain-string
+ * form (`model: "name"`) and the block form (`model:\n  default: "name"\n  provider: ...`).
+ * Never parses or returns any other key — config.yaml's `providers:` block can carry
+ * literal API keys, so this deliberately avoids a full YAML parse.
+ */
+function readConfiguredModel(home) {
+    let text;
+    try {
+        text = readFileSync(join(home, '.hermes', 'config.yaml'), 'utf8');
+    }
+    catch {
+        return '';
+    }
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(/^model:\s*(.*)$/);
+        if (!m)
+            continue;
+        const inline = stripYamlScalar(m[1]);
+        if (inline)
+            return inline;
+        // Block form: scan indented lines immediately below for `default:`.
+        for (let j = i + 1; j < lines.length; j++) {
+            const next = lines[j];
+            if (next.trim() === '')
+                continue;
+            if (/^\S/.test(next))
+                break; // dedented — end of the `model:` block
+            const dm = next.match(/^\s+default:\s*(.*)$/);
+            if (dm)
+                return stripYamlScalar(dm[1]);
+        }
+        break; // found the top-level `model:` key; stop (avoid nested `model:` keys elsewhere)
+    }
+    return '';
+}
+/** Scoped read of auth.json's top-level `active_provider` key only — never the `providers` block. */
+function readActiveProvider(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.hermes', 'auth.json'), 'utf8'));
+        return typeof raw.active_provider === 'string' ? raw.active_provider : '';
+    }
+    catch {
+        return '';
+    }
+}
+/** Best-effort CLI version from the bundled source checkout; empty string if unavailable. */
+function readHermesVersion(home) {
+    try {
+        const text = readFileSync(join(home, '.hermes', 'hermes-agent', 'hermes_cli', '__init__.py'), 'utf8');
+        const m = text.match(/^__version__\s*=\s*["']([^"']+)["']/m);
+        return m ? m[1] : '';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Aggregate Hermes session count / token usage / models / version / active provider.
+ * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
+ */
+function collectHermesTokenUsage(home = homedir()) {
+    const dbPath = join(home, '.hermes', 'state.db');
+    if (!existsSync(dbPath))
+        return [];
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    // started_at is Unix epoch *seconds* (REAL), unlike the epoch-ms convention elsewhere.
+    const cutoffSeconds = Math.floor(Date.now() / 1000) - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60;
+    const usageRaw = querySqlite(sqlite3, dbPath, `SELECT
+       COALESCE(model, 'default') || char(31) ||
+       COUNT(*) || char(31) ||
+       COALESCE(SUM(input_tokens), 0) || char(31) ||
+       COALESCE(SUM(output_tokens), 0) || char(31) ||
+       COALESCE(SUM(reasoning_tokens), 0) || char(31) ||
+       COALESCE(SUM(cache_read_tokens), 0) || char(30)
+     FROM sessions
+     WHERE started_at >= ${cutoffSeconds}
+     GROUP BY model;`);
+    const models = new Set();
+    const totals = emptyTotals();
+    const modelTokenSplit = {};
+    let sessionCount = 0;
+    if (usageRaw) {
+        for (const row of usageRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const fields = trimmed.split(FIELD_SEP);
+            if (fields.length < 6)
+                continue;
+            const [model, count, input, output, reasoning, cacheRead] = fields;
+            const cnt = num(count);
+            sessionCount += cnt;
+            if (model)
+                models.add(model);
+            const modelInput = num(input);
+            // reasoning_tokens folds into output_tokens — TokenTotals has no separate reasoning
+            // field (matches Codex's reasoning_output_tokens fold-in), so a reasoning/non-reasoning
+            // split isn't distinguishable downstream.
+            const modelOutput = num(output) + num(reasoning);
+            const modelCacheRead = num(cacheRead);
+            totals.input_tokens += modelInput;
+            totals.output_tokens += modelOutput;
+            totals.cache_read_input_tokens += modelCacheRead;
+            const modelSum = modelInput + modelOutput + modelCacheRead;
+            if (model && modelSum > 0) {
+                modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + modelSum;
+            }
+        }
+    }
+    const configuredModel = readConfiguredModel(home);
+    const activeProvider = readActiveProvider(home);
+    const version = readHermesVersion(home);
+    const authMethod = activeProvider
+        ? activeProvider === PROVIDER_NOUS
+            ? AUTH_NOUS_OAUTH
+            : AUTH_API_KEY
+        : '';
+    if (sessionCount === 0 && !configuredModel && !activeProvider)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: dbPath,
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                model_token_split: modelTokenSplit,
+                configured_model: configuredModel,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+                active_provider: activeProvider,
+                auth_method: authMethod,
+            },
+        },
+    ];
+}
+export { collectHermesTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };