log-llm-config 1.5.10 → 1.5.11

package/dist/log_config_files/collection/codex_token_usage_collector.js

@@ -14,6 +14,13 @@ import { homedir } from 'node:os';
  * ONLY those (email, name, plan, account) — never the token, access_token, or API key. Configured
  * model is read from ~/.codex/config.toml. Numbers + identity claims only — no transcript content.
  *
+ * Routing config also comes from a scoped, section-aware line scan of config.toml (see
+ * readCodexRoutingConfig): top-level `model_provider`/`openai_base_url`/`oss_provider`, and each
+ * `[model_providers.<id>]` table's `base_url`/`wire_api` keys only — never `env_key`,
+ * `experimental_bearer_token`, `auth.*`, or any other key that can carry credential material or
+ * a command string. `[model_providers.amazon-bedrock(.aws)]`'s mere presence is recorded (not its
+ * region/profile values) since selecting that built-in provider id is itself the Bedrock signal.
+ *
  * Bounded by rollout-file mtime recency so a long session history isn't fully re-parsed each run.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -117,6 +124,90 @@ function readConfiguredModel(home) {
         return '';
     }
 }
+function emptyCodexRoutingConfig() {
+    return {
+        modelProvider: '',
+        openaiBaseUrl: '',
+        ossProvider: '',
+        hasBedrockConfig: false,
+        customProviders: {},
+    };
+}
+/** Strip quotes from a TOML string value and any trailing inline comment. */
+function stripTomlString(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('"')) {
+        const end = trimmed.indexOf('"', 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    if (trimmed.startsWith("'")) {
+        const end = trimmed.indexOf("'", 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    const commentIdx = trimmed.indexOf('#');
+    return (commentIdx === -1 ? trimmed : trimmed.slice(0, commentIdx)).trim();
+}
+/**
+ * Scoped, section-aware scan of config.toml for routing-relevant keys ONLY:
+ *   - top-level `model_provider` / `openai_base_url` / `oss_provider`
+ *   - each `[model_providers.<id>]` table's `base_url` / `wire_api` keys
+ *   - `[model_providers.amazon-bedrock]` (or its `.aws` sub-table) presence only — never its
+ *     region/profile values
+ * Deliberately not a full TOML parse: every other key in every other section (MCP servers,
+ * hooks, marketplaces, `model_providers.<id>.env_key`/`auth.*`/`experimental_bearer_token`, ...)
+ * is never read, since some of those can carry credential material or shell commands.
+ */
+function readCodexRoutingConfig(home) {
+    const result = emptyCodexRoutingConfig();
+    let text;
+    try {
+        text = readFileSync(join(home, '.codex', 'config.toml'), 'utf8');
+    }
+    catch {
+        return result;
+    }
+    let currentProviderId = '';
+    for (const rawLine of text.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+        if (sectionMatch) {
+            const section = sectionMatch[1].trim();
+            currentProviderId = '';
+            if (/^model_providers\.amazon-bedrock(\.aws)?$/.test(section)) {
+                result.hasBedrockConfig = true;
+                continue;
+            }
+            const providerMatch = section.match(/^model_providers\.([^.]+)$/);
+            if (providerMatch)
+                currentProviderId = providerMatch[1].replace(/^["']|["']$/g, '');
+            continue;
+        }
+        const kv = line.match(/^([A-Za-z_][A-Za-z0-9_-]*)\s*=\s*(.*)$/);
+        if (!kv)
+            continue;
+        const [, key, rawValue] = kv;
+        if (!currentProviderId) {
+            if (key === 'model_provider')
+                result.modelProvider = stripTomlString(rawValue);
+            else if (key === 'openai_base_url')
+                result.openaiBaseUrl = stripTomlString(rawValue);
+            else if (key === 'oss_provider')
+                result.ossProvider = stripTomlString(rawValue);
+            continue;
+        }
+        if (key === 'base_url' || key === 'wire_api') {
+            const entry = result.customProviders[currentProviderId] ?? { baseUrl: '', wireApi: '' };
+            if (key === 'base_url')
+                entry.baseUrl = stripTomlString(rawValue);
+            else
+                entry.wireApi = stripTomlString(rawValue);
+            result.customProviders[currentProviderId] = entry;
+        }
+    }
+    return result;
+}
 /**
  * Aggregate Codex token usage / sessions / version across recent rollout transcripts + identity.
  * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
@@ -221,6 +312,7 @@ function collectCodexTokenUsage(home = homedir()) {
     }
     const identity = readCodexIdentity(home);
     const configuredModel = readConfiguredModel(home);
+    const routingConfig = readCodexRoutingConfig(home);
     const sawUsage = files.length > 0;
     if (!sawUsage && !identity.email)
         return [];
@@ -237,6 +329,11 @@ function collectCodexTokenUsage(home = homedir()) {
                 configured_model: configuredModel,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                model_provider: routingConfig.modelProvider,
+                openai_base_url: routingConfig.openaiBaseUrl,
+                oss_provider: routingConfig.ossProvider,
+                has_bedrock_config: routingConfig.hasBedrockConfig,
+                custom_model_providers: routingConfig.customProviders,
                 ...identity, // auth_mode, email, name, plan, account_id, org_name (claims only)
             },
         },

package/dist/log_config_files/collection/copilot_token_usage_collector.js

@@ -10,6 +10,15 @@ import { homedir } from 'node:os';
  * `totalPremiumRequests`, and per-model `modelMetrics`. We aggregate the *numbers* (and version /
  * model ids) on the endpoint and emit only those — never transcript content.
  *
+ * Per-model split uses each model's `modelMetrics.<model>.tokenDetails` — NOT its sibling
+ * `modelMetrics.<model>.usage` — because `usage.{input,output,cacheRead}Tokens` counts a larger,
+ * differently-scoped quantity (confirmed on a real transcript: usage.inputTokens was ~25x the
+ * session's own top-level tokenDetails.input.tokenCount for the same shutdown event, apparently
+ * including reprocessed/cumulative context rather than the exchange delta). Each model's nested
+ * `tokenDetails` mirrors the top-level `tokenDetails` shape and, for a single-model session,
+ * its exact values — so summing nested tokenDetails per model stays consistent with the
+ * top-level `totals` this same function computes, unlike `usage`.
+ *
  * Bounded by mtime recency so a large session history is not fully re-parsed on every hook run.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -123,8 +132,12 @@ function collectCopilotTokenUsage(home = homedir()) {
                 const modelMetrics = asObject(data.modelMetrics);
                 for (const [model, metrics] of Object.entries(modelMetrics)) {
                     models.add(model);
-                    const usage = asObject(asObject(metrics).usage);
-                    const sum = num(usage.inputTokens) + num(usage.outputTokens) + num(usage.cacheReadTokens);
+                    // tokenDetails, not usage — see the module docstring's note on why usage.* isn't
+                    // comparable to the top-level tokenDetails-derived `totals`.
+                    const modelTokenDetails = asObject(asObject(metrics).tokenDetails);
+                    const sum = num(asObject(modelTokenDetails.input).tokenCount) +
+                        num(asObject(modelTokenDetails.output).tokenCount) +
+                        num(asObject(modelTokenDetails.cache_read).tokenCount);
                     if (sum > 0)
                         modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
                 }

package/dist/log_config_files/collection/cursor_token_usage_collector.js

@@ -1,8 +1,7 @@
-import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 /**
  * Session / version / identity aggregator for Cursor.
  *
@@ -15,7 +14,9 @@ import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
  *
  * We read identity (email, plan, version) from ItemTable and aggregate session counts +
  * model names from composerData entries in cursorDiskKV, bounded to the last 30 days.
- * Token counts are no longer written by Cursor 3.8+ so totals are always 0.
+ * Token counts are no longer written by Cursor 3.8+ so totals are always 0 — `model_token_split`
+ * therefore carries per-model composer COUNTs, not tokens (same convention as Cowork's
+ * session-count split), so the Agent Profile can still surface a "Most used model".
  * No message content is read — only model names and timestamps.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -36,11 +37,7 @@ function vscdbPath(home) {
 }
 function querySqlite(sqlite3, dbPath, sql) {
     try {
-        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
-            input: `.timeout 5000\n${sql}\n`,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
     }
     catch {
         return null;
@@ -145,6 +142,11 @@ function collectCursorTokenUsage(home = homedir()) {
      GROUP BY json_extract(value, '$.modelConfig.modelName');`);
     const models = new Set();
     let sessionCount = 0;
+    // Cursor 3.8+ doesn't write token counts, so there's no real per-model token weighting — the
+    // per-model composer COUNT from the query above is the only usage-weight signal available.
+    // Mirrors Cowork's session-count convention (see cowork_extract.py): "Most used model" is
+    // derived from whichever model has the most composers, not the most tokens.
+    const modelComposerCounts = {};
     if (usageRaw) {
         for (const row of usageRaw.split(ROW_SEP)) {
             const trimmed = row.trim();
@@ -156,8 +158,10 @@ function collectCursorTokenUsage(home = homedir()) {
             const model = trimmed.slice(0, sep).trim();
             const cnt = num(trimmed.slice(sep + 1));
             sessionCount += cnt;
-            if (model)
+            if (model) {
                 models.add(model);
+                modelComposerCounts[model] = (modelComposerCounts[model] ?? 0) + cnt;
+            }
         }
     }
     if (sessionCount === 0 && !email && !version)
@@ -170,7 +174,7 @@ function collectCursorTokenUsage(home = homedir()) {
                 version,
                 session_count: sessionCount,
                 models: [...models].sort(),
-                model_token_split: {},
+                model_token_split: modelComposerCounts,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals: {
                     input_tokens: 0,

package/dist/log_config_files/collection/hermes_token_usage_collector.js

@@ -1,19 +1,23 @@
-import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 /**
  * Session / token usage / model / version aggregator for Hermes Agent (Nous Research).
  *
  * Hermes keeps all state under ~/.hermes/. Three sources feed this aggregate, each read
  * narrowly to avoid ever touching credential material:
  *   - state.db (SQLite) `sessions` table — real per-session model + token columns
- *     (input_tokens, output_tokens, reasoning_tokens, cache_read_tokens). started_at is a
- *     Unix epoch *seconds* REAL column, bounded to the last 30 days.
- *   - config.yaml — only the top-level `model` key (string, or a block with a `default`
- *     sub-key) is extracted; config.yaml can hold literal provider API keys under
- *     `providers:`, so this is a scoped line-scan, never a full YAML parse.
+ *     (input_tokens, output_tokens, reasoning_tokens, cache_read_tokens) plus real USD cost
+ *     columns (actual_cost_usd, falling back to estimated_cost_usd — Hermes computes this
+ *     itself via a provider pricing-table lookup, cost_source="provider_models_api" on a real
+ *     install). started_at is a Unix epoch *seconds* REAL column, bounded to the last 30 days.
+ *   - config.yaml — only the top-level `model` key is extracted: the plain-string form
+ *     (`model: "name"`), or the block form's `default`/`provider`/`base_url` sub-keys
+ *     (`model:\n  default: "name"\n  provider: openrouter\n  base_url: ''`). config.yaml can
+ *     hold literal provider API keys under `providers:`, so this is a scoped line-scan, never a
+ *     full YAML parse — `provider`/`base_url` live directly under `model:`, not `providers:`,
+ *     so reading them carries no credential risk.
  *   - auth.json — only the top-level `active_provider` key (e.g. "nous") is read; the
  *     per-provider blocks under `providers:` hold OAuth/API-key secrets and are never
  *     touched. "nous" is Nous Portal OAuth; anything else is a traditional API-key
@@ -45,11 +49,7 @@ function num(value) {
 }
 function querySqlite(sqlite3, dbPath, sql) {
     try {
-        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
-            input: `.timeout 5000\n${sql}\n`,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
     }
     catch {
         return null;
@@ -75,19 +75,21 @@ function stripYamlScalar(value) {
     const commentIdx = trimmed.search(/(?:^|\s)#/);
     return (commentIdx === -1 ? trimmed : trimmed.slice(0, commentIdx)).trim();
 }
+const EMPTY_MODEL_CONFIG = { model: '', provider: '', baseUrl: '' };
 /**
  * Scoped read of config.yaml's top-level `model` key only. Handles both the plain-string
- * form (`model: "name"`) and the block form (`model:\n  default: "name"\n  provider: ...`).
- * Never parses or returns any other key — config.yaml's `providers:` block can carry
- * literal API keys, so this deliberately avoids a full YAML parse.
+ * form (`model: "name"`, which carries no provider/base_url) and the block form
+ * (`model:\n  default: "name"\n  provider: openrouter\n  base_url: ''`). Never parses or
+ * returns any other key — config.yaml's `providers:` block can carry literal API keys, so this
+ * deliberately avoids a full YAML parse.
  */
-function readConfiguredModel(home) {
+function readModelConfig(home) {
     let text;
     try {
         text = readFileSync(join(home, '.hermes', 'config.yaml'), 'utf8');
     }
     catch {
-        return '';
+        return EMPTY_MODEL_CONFIG;
     }
     const lines = text.split('\n');
     for (let i = 0; i < lines.length; i++) {
@@ -96,8 +98,11 @@ function readConfiguredModel(home) {
             continue;
         const inline = stripYamlScalar(m[1]);
         if (inline)
-            return inline;
-        // Block form: scan indented lines immediately below for `default:`.
+            return { ...EMPTY_MODEL_CONFIG, model: inline };
+        // Block form: scan indented lines immediately below for default/provider/base_url —
+        // order isn't fixed, so keep scanning until the block dedents rather than stopping at the
+        // first match.
+        const result = { ...EMPTY_MODEL_CONFIG };
         for (let j = i + 1; j < lines.length; j++) {
             const next = lines[j];
             if (next.trim() === '')
@@ -105,12 +110,23 @@ function readConfiguredModel(home) {
             if (/^\S/.test(next))
                 break; // dedented — end of the `model:` block
             const dm = next.match(/^\s+default:\s*(.*)$/);
-            if (dm)
-                return stripYamlScalar(dm[1]);
+            if (dm) {
+                result.model = stripYamlScalar(dm[1]);
+                continue;
+            }
+            const pm = next.match(/^\s+provider:\s*(.*)$/);
+            if (pm) {
+                result.provider = stripYamlScalar(pm[1]);
+                continue;
+            }
+            const bm = next.match(/^\s+base_url:\s*(.*)$/);
+            if (bm) {
+                result.baseUrl = stripYamlScalar(bm[1]);
+            }
         }
-        break; // found the top-level `model:` key; stop (avoid nested `model:` keys elsewhere)
+        return result;
     }
-    return '';
+    return EMPTY_MODEL_CONFIG;
 }
 /** Scoped read of auth.json's top-level `active_provider` key only — never the `providers` block. */
 function readActiveProvider(home) {
@@ -152,7 +168,8 @@ function collectHermesTokenUsage(home = homedir()) {
        COALESCE(SUM(input_tokens), 0) || char(31) ||
        COALESCE(SUM(output_tokens), 0) || char(31) ||
        COALESCE(SUM(reasoning_tokens), 0) || char(31) ||
-       COALESCE(SUM(cache_read_tokens), 0) || char(30)
+       COALESCE(SUM(cache_read_tokens), 0) || char(31) ||
+       COALESCE(SUM(COALESCE(actual_cost_usd, estimated_cost_usd, 0)), 0) || char(30)
      FROM sessions
      WHERE started_at >= ${cutoffSeconds}
      GROUP BY model;`);
@@ -160,15 +177,16 @@ function collectHermesTokenUsage(home = homedir()) {
     const totals = emptyTotals();
     const modelTokenSplit = {};
     let sessionCount = 0;
+    let cost = 0;
     if (usageRaw) {
         for (const row of usageRaw.split(ROW_SEP)) {
             const trimmed = row.trim();
             if (!trimmed)
                 continue;
             const fields = trimmed.split(FIELD_SEP);
-            if (fields.length < 6)
+            if (fields.length < 7)
                 continue;
-            const [model, count, input, output, reasoning, cacheRead] = fields;
+            const [model, count, input, output, reasoning, cacheRead, modelCost] = fields;
             const cnt = num(count);
             sessionCount += cnt;
             if (model)
@@ -182,13 +200,14 @@ function collectHermesTokenUsage(home = homedir()) {
             totals.input_tokens += modelInput;
             totals.output_tokens += modelOutput;
             totals.cache_read_input_tokens += modelCacheRead;
+            cost += num(modelCost);
             const modelSum = modelInput + modelOutput + modelCacheRead;
             if (model && modelSum > 0) {
                 modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + modelSum;
             }
         }
     }
-    const configuredModel = readConfiguredModel(home);
+    const modelConfig = readModelConfig(home);
     const activeProvider = readActiveProvider(home);
     const version = readHermesVersion(home);
     const authMethod = activeProvider
@@ -196,7 +215,7 @@ function collectHermesTokenUsage(home = homedir()) {
             ? AUTH_NOUS_OAUTH
             : AUTH_API_KEY
         : '';
-    if (sessionCount === 0 && !configuredModel && !activeProvider)
+    if (sessionCount === 0 && !modelConfig.model && !activeProvider)
         return [];
     return [
         {
@@ -207,9 +226,12 @@ function collectHermesTokenUsage(home = homedir()) {
                 session_count: sessionCount,
                 models: [...models].sort(),
                 model_token_split: modelTokenSplit,
-                configured_model: configuredModel,
+                configured_model: modelConfig.model,
+                configured_model_provider: modelConfig.provider,
+                configured_model_base_url: modelConfig.baseUrl,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                cost,
                 active_provider: activeProvider,
                 auth_method: authMethod,
             },

package/dist/log_config_files/collection/openclaw_token_usage_collector.js

@@ -27,6 +27,13 @@ import { homedir } from 'node:os';
  * begin with). Exposed per-provider so the extractor can match it against the provider actually
  * observed in session usage.
  *
+ * Routing config comes from two more scoped reads of openclaw.json:
+ *   - `agents.defaults.model.primary` (format `"provider/model"`) — the configured provider id,
+ *     same precedence convention as other agents' `"provider/model"` pinning.
+ *   - `models.providers.<id>` tables — `baseUrl`/`auth` (a strategy string like `"aws-sdk"`)
+ *     only, never `apiKey`, `headers`, or the `models` catalog (this is a DIFFERENT top-level
+ *     key than `auth.profiles` above; a real install can have one without the other).
+ *
  * Only checks ~/.openclaw (the canonical root); the moltbot/clawdbot compatible-fork roots
  * tracked by the presence/log file types are not covered here.
  */
@@ -106,46 +113,69 @@ function readSessionsStore(storePath, cutoffMs, acc) {
         }
     }
 }
-/** Scoped read of openclaw.json's top-level `meta.lastTouchedVersion` key only. */
-function readVersion(openclawDir) {
+/** Parses openclaw.json once; both readVersion and readAuthModesByProvider derive from this. */
+function parseOpenclawJson(openclawDir) {
     try {
-        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
-        const meta = raw.meta;
-        return meta && typeof meta === 'object'
-            ? str(meta.lastTouchedVersion)
-            : '';
+        return JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
     }
     catch {
-        return '';
+        return null;
     }
 }
+/** Scoped read of openclaw.json's top-level `meta.lastTouchedVersion` key only. */
+function readVersion(raw) {
+    const meta = raw?.meta;
+    return meta && typeof meta === 'object'
+        ? str(meta.lastTouchedVersion)
+        : '';
+}
 /**
  * Scoped read of openclaw.json's `auth.profiles` — provider + mode only, never credentials
  * (the profiles carry no token/key fields). Returns a provider -> mode map (e.g.
  * `{"anthropic": "api_key"}`); a provider with multiple profiles keeps the last one read.
  */
-function readAuthModesByProvider(openclawDir) {
-    try {
-        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
-        const auth = raw.auth;
-        const profiles = auth && typeof auth === 'object' ? auth.profiles : undefined;
-        const out = {};
-        if (profiles && typeof profiles === 'object') {
-            for (const value of Object.values(profiles)) {
-                if (!value || typeof value !== 'object')
-                    continue;
-                const entry = value;
-                const provider = str(entry.provider);
-                const mode = str(entry.mode);
-                if (provider && mode)
-                    out[provider] = mode;
-            }
+function readAuthModesByProvider(raw) {
+    const auth = raw?.auth;
+    const profiles = auth && typeof auth === 'object' ? auth.profiles : undefined;
+    const out = {};
+    if (profiles && typeof profiles === 'object') {
+        for (const value of Object.values(profiles)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const entry = value;
+            const provider = str(entry.provider);
+            const mode = str(entry.mode);
+            if (provider && mode)
+                out[provider] = mode;
         }
-        return out;
     }
-    catch {
-        return {};
+    return out;
+}
+/** Scoped read of openclaw.json's `agents.defaults.model.primary` key only (format "provider/model"). */
+function readPrimaryModelProvider(raw) {
+    const agents = raw?.agents;
+    const defaults = agents && typeof agents === 'object' ? agents.defaults : undefined;
+    const model = defaults && typeof defaults === 'object' ? defaults.model : undefined;
+    const primary = model && typeof model === 'object' ? str(model.primary) : '';
+    return primary.includes('/') ? primary.split('/', 1)[0] : '';
+}
+/**
+ * Scoped read of openclaw.json's top-level `models.providers.<id>` tables — `baseUrl`/`auth`
+ * (a strategy string, e.g. `"aws-sdk"`) only, never `apiKey`, `headers`, or the `models` catalog.
+ */
+function readModelProviders(raw) {
+    const models = raw?.models;
+    const providers = models && typeof models === 'object' ? models.providers : undefined;
+    const out = {};
+    if (providers && typeof providers === 'object') {
+        for (const [id, cfg] of Object.entries(providers)) {
+            if (!cfg || typeof cfg !== 'object')
+                continue;
+            const entry = cfg;
+            out[id] = { baseUrl: str(entry.baseUrl), auth: str(entry.auth) };
+        }
     }
+    return out;
 }
 /**
  * Aggregate OpenClaw session count / token usage / models / providers / version across every
@@ -170,19 +200,22 @@ function collectOpenclawTokenUsage(home = homedir()) {
     }
     if (acc.sessionIds.size === 0)
         return [];
+    const openclawJson = parseOpenclawJson(openclawDir);
     return [
         {
             file_type: TOKEN_USAGE_FILE_TYPE,
             file_path: openclawDir,
             raw_content: {
-                version: readVersion(openclawDir),
+                version: readVersion(openclawJson),
                 session_count: acc.sessionIds.size,
                 models: [...acc.models].sort(),
                 providers: [...acc.providers].sort(),
                 model_token_split: acc.modelTokenSplit,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals: acc.totals,
-                auth_modes_by_provider: readAuthModesByProvider(openclawDir),
+                auth_modes_by_provider: readAuthModesByProvider(openclawJson),
+                primary_model_provider: readPrimaryModelProvider(openclawJson),
+                model_providers: readModelProviders(openclawJson),
             },
         },
     ];

package/dist/log_config_files/collection/opencode_token_usage_collector.js

@@ -1,8 +1,7 @@
-import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 /**
  * Token-usage / cost / session / version / identity aggregator for OpenCode.
  *
@@ -40,11 +39,7 @@ function asObject(value) {
 /** Run a read-only query and return raw stdout, or null when sqlite3/DB is unavailable. */
 function querySqlite(sqlite3, dbPath, sql) {
     try {
-        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
-            input: `.timeout 5000\n${sql}\n`,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
     }
     catch {
         return null;

package/dist/log_config_files/collection/pi_token_usage_collector.js

@@ -8,10 +8,12 @@ import { homedir } from 'node:os';
  * ~/.pi/agent/sessions/<sanitized-cwd>/<timestamp>_<uuid>.jsonl. The first line is a
  * `type: "session"` header carrying the session `id`; assistant turns are `type: "message"`
  * lines whose `message.usage` block carries `{input, output, cacheRead, cacheWrite,
- * totalTokens, reasoning?}` alongside `message.model` / `message.provider`. We aggregate the
- * *numbers* (and model/provider ids) on the endpoint and emit only those — never
- * `message.content` (the actual prompt/response text) — so the backend gets token usage,
- * session count, and models/providers used without ingesting transcript content.
+ * totalTokens, reasoning?, cost?}` alongside `message.model` / `message.provider`. `usage.cost`
+ * (confirmed on a real install) is `{input, output, cacheRead, cacheWrite, total}` in USD, computed
+ * by Pi itself per message — we sum only `cost.total`. We aggregate the *numbers* (and model/
+ * provider ids) on the endpoint and emit only those — never `message.content` (the actual
+ * prompt/response text) — so the backend gets token usage, cost, session count, and models/
+ * providers used without ingesting transcript content.
  *
  * Configured defaults come from a scoped read of settings.json's `defaultProvider` /
  * `defaultModel` / `lastChangelogVersion` keys only — never any other key.
@@ -27,6 +29,14 @@ import { homedir } from 'node:os';
  * `version` field is a JSONL schema version (small int, e.g. `3`), not the CLI version, and is
  * not used here.
  *
+ * `~/.pi/agent/models.json` handles custom providers (Ollama, LM Studio, vLLM, or any OpenAI/
+ * Anthropic-compatible API per Pi's own docs) — but no official doc example shows its actual key
+ * shape (unlike auth.json/settings.json above, which have confirmed real examples). We read only
+ * a best-effort guessed `{ "<id>": { "baseURL": "..." } }` shape (mirroring the `baseUrl`/
+ * `baseURL` convention every other agent's custom-provider config uses) and treat anything else
+ * in the file as unknown; this is explicitly unconfirmed and may need correcting against a real
+ * install with the file actually populated.
+ *
  * Bounded by mtime recency so a large session history is not fully re-parsed on every run.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -105,6 +115,28 @@ function readAuthTypesByProvider(home) {
         return {};
     }
 }
+/**
+ * Best-effort, UNCONFIRMED scoped read of models.json's custom-provider `baseURL` values —
+ * see the module docstring's caveat. Returns a provider id -> base URL map.
+ */
+function readCustomProviderBaseUrls(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.pi', 'agent', 'models.json'), 'utf8'));
+        const out = {};
+        for (const [providerId, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const entry = value;
+            const baseUrl = str(entry.baseURL) || str(entry.baseUrl);
+            if (baseUrl)
+                out[providerId] = baseUrl;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Aggregate Pi session count / token usage / models / providers across recent session
  * transcripts. Returns a single-element array (one per-machine aggregate) or [] when there is
@@ -123,6 +155,7 @@ function collectPiTokenUsage(home = homedir()) {
     const models = new Set();
     const providers = new Set();
     const modelTokenSplit = {};
+    let cost = 0;
     let sawData = false;
     for (const file of files) {
         let content;
@@ -171,6 +204,7 @@ function collectPiTokenUsage(home = homedir()) {
             totals.input_tokens += input;
             totals.output_tokens += output;
             totals.cache_read_input_tokens += cacheRead;
+            cost += num(asObject(usage.cost).total);
             const sum = input + output + cacheRead;
             if (model && sum > 0) {
                 modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
@@ -195,7 +229,9 @@ function collectPiTokenUsage(home = homedir()) {
                 configured_provider: defaults.provider,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                cost,
                 auth_types_by_provider: readAuthTypesByProvider(home),
+                custom_provider_base_urls: readCustomProviderBaseUrls(home),
             },
         },
     ];

package/dist/log_config_files/readers/composer_shadow_merge.js

@@ -1,4 +1,4 @@
-import { CURSOR_SHADOW_KEYS_NESTED_WINS, coalesceCursorEnabledShadowValue, stripShadowKeysFromReactiveBlobUpload, } from './cursor_shadow_merge_policy.js';
+import { CURSOR_SHADOW_KEYS_NESTED_WINS, coalesceCursorEnabledShadowValue, stripShadowKeysFromReactiveBlobUpload, } from './cursor_shadow_merge_ruleset.js';
 const CURSOR_SHADOW_KEYS_MERGE_ENABLED_OR = new Set([
     'isWebSearchToolEnabled',
     'isWebSearchToolEnabled2',

package/dist/log_config_files/readers/{cursor_shadow_merge_policy.js → cursor_shadow_merge_ruleset.js}

@@ -35,7 +35,7 @@ export function coalesceCursorEnabledShadowValue(root, nested) {
     return nested;
 }
 /**
- * After merge, policy and uploads use composerState.<key> only — drop stale blob-root copies.
+ * After merge, ruleset scanning and uploads use composerState.<key> only — drop stale blob-root copies.
  */
 export function stripShadowKeysFromReactiveBlobUpload(stateData) {
     if (!('composerState' in stateData))

package/dist/log_config_files/readers/vscdb_reactive_storage.js

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { readFileCollectionVscdbContract } from '../runtime/management_storage.js';
 import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
-import { CURSOR_COMPOSER_SHADOW_KEYS } from './cursor_shadow_merge_policy.js';
+import { CURSOR_COMPOSER_SHADOW_KEYS } from './cursor_shadow_merge_ruleset.js';
 /** Suffix shared by Cursor reactive-storage ItemTable keys (see file_path_registry cursor agent). */
 export const REACTIVE_STORAGE_ITEM_KEY_SUFFIX = 'reactiveStorageServiceImpl.persistentStorage.applicationUser';
 function querySqliteValue(dbPath, key) {

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,6 +1,5 @@
 import { existsSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 import { mergeCursorShadowKeyValue, mergeShadowKeysIntoComposerState, shadowKeysFromReadQueries, } from './composer_shadow_merge.js';
 import { composerShadowKeysFromContract, reactiveStorageItemKeyForVscdb, } from './vscdb_reactive_storage.js';
 import { readFileCollectionVscdbContract, sanitizeFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
@@ -19,11 +18,7 @@ function querySqlite(dbPath, key) {
         throw new Error('sqlite3 not found');
     const safe = key.replace(/'/g, "''");
     const script = `.timeout 60000\nSELECT value FROM ItemTable WHERE key='${safe}';\n`;
-    return execFileSync(bin, ['-noheader', dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    return execSqlite3(bin, ['-noheader', dbPath], script).trim();
 }
 /**
  * Cursor keeps live agent settings (e.g. yoloCommandAllowlist) on nested composerState inside

package/dist/log_config_files/runtime/remediation_sync.js

@@ -1,7 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
-import { execFileSync } from 'node:child_process';
 import { executeBody } from '../../endpoint_client/http_transport.js';
 import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
@@ -19,8 +18,8 @@ import { reportAbsentWorktrees } from './worktree_absent.js';
 import { buildApiUrl, getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
 import { resolveOpsTargetPath } from './ops_target_path.js';
-import { resolveSqlite3Binary } from './sqlite_binary.js';
-import { CURSOR_COMPOSER_SHADOW_KEYS } from '../readers/cursor_shadow_merge_policy.js';
+import { execSqlite3, resolveSqlite3Binary } from './sqlite_binary.js';
+import { CURSOR_COMPOSER_SHADOW_KEYS } from '../readers/cursor_shadow_merge_ruleset.js';
 import { REACTIVE_STORAGE_ITEM_KEY_SUFFIX, composerShadowKeysFromContract, reactiveStorageItemKeyForVscdb, } from '../readers/vscdb_reactive_storage.js';
 /** Best-effort detail from execFileSync failures (stderr, exit code, errno). */
 function formatNodeChildException(err) {
@@ -936,11 +935,7 @@ function sqliteSelectValueCell(dbPath, table, key_column, value_column, target_k
     const safeName = target_key.replace(/'/g, "''");
     const script = `.timeout 60000\nSELECT ${value_column} FROM ${table} WHERE ${key_column}='${safeName}';\n`;
     try {
-        return execFileSync(sqlite3, ['-noheader', dbPath], {
-            input: script,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        return execSqlite3(sqlite3, ['-noheader', dbPath], script).trim();
     }
     catch (err) {
         const { short, long } = formatNodeChildException(err);
@@ -955,11 +950,7 @@ function sqliteExecWithTimeout(dbPath, sqlBody) {
         throw new Error('sqlite3 not found');
     const script = `.timeout 60000\n${sqlBody}\n`;
     try {
-        execFileSync(sqlite3, [dbPath], {
-            input: script,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        execSqlite3(sqlite3, [dbPath], script);
     }
     catch (err) {
         const { long } = formatNodeChildException(err);
@@ -976,11 +967,7 @@ function sqliteRunUpdateReturningChanges(dbPath, updateSql) {
     const script = `.timeout 60000\n${updateSql}\nSELECT changes();\n`;
     let out;
     try {
-        out = execFileSync(sqlite3, [dbPath], {
-            input: script,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        out = execSqlite3(sqlite3, [dbPath], script).trim();
     }
     catch (err) {
         const { long } = formatNodeChildException(err);

package/dist/log_config_files/runtime/sqlite_binary.js

@@ -90,3 +90,35 @@ export function resolveSqlite3Binary() {
 export function clearSqlite3BinaryCacheForTests() {
     cached = undefined;
 }
+/**
+ * Run the sqlite3 CLI with `-escape off` inserted before the trailing dbPath argument, so raw
+ * control-byte output (our char(30)/char(31) row/field separators, or any control byte in a
+ * stored value) survives instead of being rendered as printable caret-notation text — the
+ * default in sqlite3 CLI builds that support `-escape` (added alongside the `-escape symbol`
+ * default; confirmed present in a macOS-bundled 3.51.0 from 2025-06).
+ *
+ * Falls back to the same call without `-escape off` if the flag itself isn't recognized (an
+ * older CLI predating the flag also predates the `-escape symbol` default that motivates it, so
+ * dropping the flag there is safe, not a silent behavior change). `argsWithDbPathLast`'s last
+ * element must be the database path.
+ */
+export function execSqlite3(sqlite3, argsWithDbPathLast, input) {
+    const dbPath = argsWithDbPathLast[argsWithDbPathLast.length - 1];
+    const leadingArgs = argsWithDbPathLast.slice(0, -1);
+    const options = {
+        input,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    };
+    try {
+        return execFileSync(sqlite3, [...leadingArgs, '-escape', 'off', dbPath], options);
+    }
+    catch (err) {
+        try {
+            return execFileSync(sqlite3, argsWithDbPathLast, options);
+        }
+        catch {
+            throw err;
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.5.10",
+  "version": "1.5.11",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {