log-llm-config 1.5.10 → 1.5.14

package/dist/log_config_files/collection/claude_token_usage_collector.js

@@ -25,18 +25,34 @@ function emptyTotals() {
 }
 function addUsage(totals, usage) {
     for (const key of Object.keys(totals)) {
-        const value = usage[key];
-        if (typeof value === 'number' && Number.isFinite(value))
+        const value = readTokenField(usage, key);
+        if (value > 0)
             totals[key] += value;
     }
 }
-/** Sum the token fields of one usage block (used for per-model attribution). */
+/** Read one token field, preferring the nested 5m+1h cache-creation sum over the flat field. */
+function readTokenField(usage, key) {
+    if (key === 'cache_creation_input_tokens') {
+        const nested = usage.cache_creation;
+        if (nested && typeof nested === 'object') {
+            const n = nested;
+            const has5m = typeof n.ephemeral_5m_input_tokens === 'number' && Number.isFinite(n.ephemeral_5m_input_tokens);
+            const has1h = typeof n.ephemeral_1h_input_tokens === 'number' && Number.isFinite(n.ephemeral_1h_input_tokens);
+            // Fall back to the flat field only when the nested block is truly absent — a
+            // legitimately-zero nested sum (both fields present as 0) must not be overridden by it.
+            if (has5m || has1h) {
+                return (has5m ? n.ephemeral_5m_input_tokens : 0) + (has1h ? n.ephemeral_1h_input_tokens : 0);
+            }
+        }
+    }
+    const value = usage[key];
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+/** Sum the token fields of one usage block (used for per-model attribution and dedup tiebreaks). */
 function usageSum(usage) {
     let sum = 0;
     for (const key of ['input_tokens', 'output_tokens', 'cache_creation_input_tokens', 'cache_read_input_tokens']) {
-        const value = usage[key];
-        if (typeof value === 'number' && Number.isFinite(value))
-            sum += value;
+        sum += readTokenField(usage, key);
     }
     return sum;
 }
@@ -86,6 +102,14 @@ function collectClaudeTokenUsage(home = homedir()) {
     let version = '';
     let versionAt = '';
     let sawData = false;
+    // Claude Code writes one JSONL line per streaming snapshot of the same assistant message,
+    // so message.id/requestId repeat with a growing usage total; only the final snapshot is
+    // the true total. Dedup by (message.id, requestId), taking the per-field max across all
+    // snapshots for that key (order-independent — robust to out-of-order lines, and safe even
+    // if a snapshot has a genuinely-lower or reset value in one field while another snapshot in
+    // the same group peaks a different field). Entries without a message.id can't be deduped and
+    // are accumulated directly.
+    const dedupedUsage = new Map();
     for (const file of files) {
         let content;
         try {
@@ -125,16 +149,39 @@ function collectClaudeTokenUsage(home = homedir()) {
                     models.add(model);
                 if (msg.usage && typeof msg.usage === 'object') {
                     const usage = msg.usage;
-                    addUsage(totals, usage);
-                    if (model) {
+                    const messageId = typeof msg.id === 'string' ? msg.id : '';
+                    if (messageId) {
+                        const requestId = typeof entry.requestId === 'string' ? entry.requestId : '';
+                        const dedupeKey = `${messageId} ${requestId}`;
+                        const existing = dedupedUsage.get(dedupeKey) ?? { totals: emptyTotals(), model: '' };
+                        for (const key of Object.keys(existing.totals)) {
+                            const value = readTokenField(usage, key);
+                            if (value > existing.totals[key])
+                                existing.totals[key] = value;
+                        }
+                        if (model)
+                            existing.model = model;
+                        dedupedUsage.set(dedupeKey, existing);
+                    }
+                    else {
+                        addUsage(totals, usage);
                         const sum = usageSum(usage);
-                        if (sum > 0)
+                        if (model && sum > 0)
                             modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
                     }
                 }
             }
         }
     }
+    for (const { totals: merged, model } of dedupedUsage.values()) {
+        let sum = 0;
+        for (const key of Object.keys(totals)) {
+            totals[key] += merged[key];
+            sum += merged[key];
+        }
+        if (model && sum > 0)
+            modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+    }
     if (!sawData)
         return [];
     return [

package/dist/log_config_files/collection/codex_token_usage_collector.js

@@ -14,6 +14,13 @@ import { homedir } from 'node:os';
  * ONLY those (email, name, plan, account) — never the token, access_token, or API key. Configured
  * model is read from ~/.codex/config.toml. Numbers + identity claims only — no transcript content.
  *
+ * Routing config also comes from a scoped, section-aware line scan of config.toml (see
+ * readCodexRoutingConfig): top-level `model_provider`/`openai_base_url`/`oss_provider`, and each
+ * `[model_providers.<id>]` table's `base_url`/`wire_api` keys only — never `env_key`,
+ * `experimental_bearer_token`, `auth.*`, or any other key that can carry credential material or
+ * a command string. `[model_providers.amazon-bedrock(.aws)]`'s mere presence is recorded (not its
+ * region/profile values) since selecting that built-in provider id is itself the Bedrock signal.
+ *
  * Bounded by rollout-file mtime recency so a long session history isn't fully re-parsed each run.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -117,6 +124,90 @@ function readConfiguredModel(home) {
         return '';
     }
 }
+function emptyCodexRoutingConfig() {
+    return {
+        modelProvider: '',
+        openaiBaseUrl: '',
+        ossProvider: '',
+        hasBedrockConfig: false,
+        customProviders: {},
+    };
+}
+/** Strip quotes from a TOML string value and any trailing inline comment. */
+function stripTomlString(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('"')) {
+        const end = trimmed.indexOf('"', 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    if (trimmed.startsWith("'")) {
+        const end = trimmed.indexOf("'", 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    const commentIdx = trimmed.indexOf('#');
+    return (commentIdx === -1 ? trimmed : trimmed.slice(0, commentIdx)).trim();
+}
+/**
+ * Scoped, section-aware scan of config.toml for routing-relevant keys ONLY:
+ *   - top-level `model_provider` / `openai_base_url` / `oss_provider`
+ *   - each `[model_providers.<id>]` table's `base_url` / `wire_api` keys
+ *   - `[model_providers.amazon-bedrock]` (or its `.aws` sub-table) presence only — never its
+ *     region/profile values
+ * Deliberately not a full TOML parse: every other key in every other section (MCP servers,
+ * hooks, marketplaces, `model_providers.<id>.env_key`/`auth.*`/`experimental_bearer_token`, ...)
+ * is never read, since some of those can carry credential material or shell commands.
+ */
+function readCodexRoutingConfig(home) {
+    const result = emptyCodexRoutingConfig();
+    let text;
+    try {
+        text = readFileSync(join(home, '.codex', 'config.toml'), 'utf8');
+    }
+    catch {
+        return result;
+    }
+    let currentProviderId = '';
+    for (const rawLine of text.split('\n')) {
+        const line = rawLine.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+        if (sectionMatch) {
+            const section = sectionMatch[1].trim();
+            currentProviderId = '';
+            if (/^model_providers\.amazon-bedrock(\.aws)?$/.test(section)) {
+                result.hasBedrockConfig = true;
+                continue;
+            }
+            const providerMatch = section.match(/^model_providers\.([^.]+)$/);
+            if (providerMatch)
+                currentProviderId = providerMatch[1].replace(/^["']|["']$/g, '');
+            continue;
+        }
+        const kv = line.match(/^([A-Za-z_][A-Za-z0-9_-]*)\s*=\s*(.*)$/);
+        if (!kv)
+            continue;
+        const [, key, rawValue] = kv;
+        if (!currentProviderId) {
+            if (key === 'model_provider')
+                result.modelProvider = stripTomlString(rawValue);
+            else if (key === 'openai_base_url')
+                result.openaiBaseUrl = stripTomlString(rawValue);
+            else if (key === 'oss_provider')
+                result.ossProvider = stripTomlString(rawValue);
+            continue;
+        }
+        if (key === 'base_url' || key === 'wire_api') {
+            const entry = result.customProviders[currentProviderId] ?? { baseUrl: '', wireApi: '' };
+            if (key === 'base_url')
+                entry.baseUrl = stripTomlString(rawValue);
+            else
+                entry.wireApi = stripTomlString(rawValue);
+            result.customProviders[currentProviderId] = entry;
+        }
+    }
+    return result;
+}
 /**
  * Aggregate Codex token usage / sessions / version across recent rollout transcripts + identity.
  * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
@@ -221,6 +312,7 @@ function collectCodexTokenUsage(home = homedir()) {
     }
     const identity = readCodexIdentity(home);
     const configuredModel = readConfiguredModel(home);
+    const routingConfig = readCodexRoutingConfig(home);
     const sawUsage = files.length > 0;
     if (!sawUsage && !identity.email)
         return [];
@@ -237,6 +329,11 @@ function collectCodexTokenUsage(home = homedir()) {
                 configured_model: configuredModel,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                model_provider: routingConfig.modelProvider,
+                openai_base_url: routingConfig.openaiBaseUrl,
+                oss_provider: routingConfig.ossProvider,
+                has_bedrock_config: routingConfig.hasBedrockConfig,
+                custom_model_providers: routingConfig.customProviders,
                 ...identity, // auth_mode, email, name, plan, account_id, org_name (claims only)
             },
         },

package/dist/log_config_files/collection/config_collector.js

@@ -236,6 +236,7 @@ export { collectHermesTokenUsage } from './hermes_token_usage_collector.js';
 export { collectOpenclawTokenUsage } from './openclaw_token_usage_collector.js';
 export { collectPiTokenUsage } from './pi_token_usage_collector.js';
 export { collectCoworkDesktopVersion } from './cowork_desktop_version_collector.js';
+export { collectGrokCliVersion } from './grok_cli_version_collector.js';
 export { collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, mergeClaudeDesktopExtensionEnableSettings, } from './claude_desktop_extensions_collector.js';
 export { collectCursorProjectWorkspaceMcpConfigs } from './cursor_project_mcp_collector.js';
 export { determineFileTypeFromPath } from './file_type_rules.js';

package/dist/log_config_files/collection/copilot_token_usage_collector.js

@@ -10,6 +10,15 @@ import { homedir } from 'node:os';
  * `totalPremiumRequests`, and per-model `modelMetrics`. We aggregate the *numbers* (and version /
  * model ids) on the endpoint and emit only those — never transcript content.
  *
+ * Per-model split uses each model's `modelMetrics.<model>.tokenDetails` — NOT its sibling
+ * `modelMetrics.<model>.usage` — because `usage.{input,output,cacheRead}Tokens` counts a larger,
+ * differently-scoped quantity (confirmed on a real transcript: usage.inputTokens was ~25x the
+ * session's own top-level tokenDetails.input.tokenCount for the same shutdown event, apparently
+ * including reprocessed/cumulative context rather than the exchange delta). Each model's nested
+ * `tokenDetails` mirrors the top-level `tokenDetails` shape and, for a single-model session,
+ * its exact values — so summing nested tokenDetails per model stays consistent with the
+ * top-level `totals` this same function computes, unlike `usage`.
+ *
  * Bounded by mtime recency so a large session history is not fully re-parsed on every hook run.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -123,8 +132,12 @@ function collectCopilotTokenUsage(home = homedir()) {
                 const modelMetrics = asObject(data.modelMetrics);
                 for (const [model, metrics] of Object.entries(modelMetrics)) {
                     models.add(model);
-                    const usage = asObject(asObject(metrics).usage);
-                    const sum = num(usage.inputTokens) + num(usage.outputTokens) + num(usage.cacheReadTokens);
+                    // tokenDetails, not usage — see the module docstring's note on why usage.* isn't
+                    // comparable to the top-level tokenDetails-derived `totals`.
+                    const modelTokenDetails = asObject(asObject(metrics).tokenDetails);
+                    const sum = num(asObject(modelTokenDetails.input).tokenCount) +
+                        num(asObject(modelTokenDetails.output).tokenCount) +
+                        num(asObject(modelTokenDetails.cache_read).tokenCount);
                     if (sum > 0)
                         modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
                 }

package/dist/log_config_files/collection/cursor_project_mcp_collector.js

@@ -188,6 +188,9 @@ function collectCursorProjectWorkspaceMcpConfigs(pathSkipPrefixes = [], constant
                         cursor_source: 'mcps',
                         server_identifier: serverDir.name,
                     };
+                    if (metaObj) {
+                        entry.cursor_server_metadata = metaObj;
+                    }
                     const cacheTools = cursorMcpCacheToolsForServer(mcpToolCache, label, serverDir.name);
                     if (cacheTools !== undefined) {
                         entry.cursor_mcp_cache_tools = cacheTools;

package/dist/log_config_files/collection/cursor_token_usage_collector.js

@@ -1,8 +1,7 @@
-import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 /**
  * Session / version / identity aggregator for Cursor.
  *
@@ -15,7 +14,9 @@ import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
  *
  * We read identity (email, plan, version) from ItemTable and aggregate session counts +
  * model names from composerData entries in cursorDiskKV, bounded to the last 30 days.
- * Token counts are no longer written by Cursor 3.8+ so totals are always 0.
+ * Token counts are no longer written by Cursor 3.8+ so totals are always 0 — `model_token_split`
+ * therefore carries per-model composer COUNTs, not tokens (same convention as Cowork's
+ * session-count split), so the Agent Profile can still surface a "Most used model".
  * No message content is read — only model names and timestamps.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -36,11 +37,7 @@ function vscdbPath(home) {
 }
 function querySqlite(sqlite3, dbPath, sql) {
     try {
-        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
-            input: `.timeout 5000\n${sql}\n`,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
     }
     catch {
         return null;
@@ -145,6 +142,11 @@ function collectCursorTokenUsage(home = homedir()) {
      GROUP BY json_extract(value, '$.modelConfig.modelName');`);
     const models = new Set();
     let sessionCount = 0;
+    // Cursor 3.8+ doesn't write token counts, so there's no real per-model token weighting — the
+    // per-model composer COUNT from the query above is the only usage-weight signal available.
+    // Mirrors Cowork's session-count convention (see cowork_extract.py): "Most used model" is
+    // derived from whichever model has the most composers, not the most tokens.
+    const modelComposerCounts = {};
     if (usageRaw) {
         for (const row of usageRaw.split(ROW_SEP)) {
             const trimmed = row.trim();
@@ -156,8 +158,10 @@ function collectCursorTokenUsage(home = homedir()) {
             const model = trimmed.slice(0, sep).trim();
             const cnt = num(trimmed.slice(sep + 1));
             sessionCount += cnt;
-            if (model)
+            if (model) {
                 models.add(model);
+                modelComposerCounts[model] = (modelComposerCounts[model] ?? 0) + cnt;
+            }
         }
     }
     if (sessionCount === 0 && !email && !version)
@@ -170,7 +174,7 @@ function collectCursorTokenUsage(home = homedir()) {
                 version,
                 session_count: sessionCount,
                 models: [...models].sort(),
-                model_token_split: {},
+                model_token_split: modelComposerCounts,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals: {
                     input_tokens: 0,

package/dist/log_config_files/collection/grok_cli_version_collector.js

@@ -0,0 +1,53 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Grok CLI version, read directly from the installed binary.
+ *
+ * Grok ships as a standalone native binary (not an npm/pip package, no manifest to read a
+ * version out of), installed at ~/.grok/bin/grok and typically symlinked onto PATH. The only
+ * way to get its version is to run it: `grok --version` prints e.g. "grok 0.2.114 (0c785038798)".
+ */
+const FILE_TYPE = 'grok_cli_version';
+const VERSION_RE = /^grok\s+(\d+\.\d+\.\d+)(?:\s+\(([0-9a-f]+)\))?/i;
+function grokBinPath(home) {
+    return join(home, '.grok', 'bin', 'grok');
+}
+/** `<binPath> --version`, parsed into {version, build, raw}, or null if unavailable/unparsable. */
+function readGrokVersion(binPath) {
+    let stdout;
+    try {
+        stdout = execFileSync(binPath, ['--version'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 5000,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+    const match = VERSION_RE.exec(stdout);
+    if (!match)
+        return null;
+    return { version: match[1], build: match[2] ?? '', raw: stdout };
+}
+/**
+ * Emit the Grok CLI version as a single-element aggregate, or [] when Grok isn't installed
+ * or its version can't be determined.
+ */
+function collectGrokCliVersion(home = homedir(), binPath = grokBinPath(home)) {
+    if (!existsSync(binPath))
+        return [];
+    const parsed = readGrokVersion(binPath);
+    if (!parsed)
+        return [];
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: binPath,
+            raw_content: parsed,
+        },
+    ];
+}
+export { collectGrokCliVersion, FILE_TYPE as GROK_CLI_VERSION_FILE_TYPE };

package/dist/log_config_files/collection/hermes_token_usage_collector.js

@@ -1,19 +1,23 @@
-import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 /**
  * Session / token usage / model / version aggregator for Hermes Agent (Nous Research).
  *
  * Hermes keeps all state under ~/.hermes/. Three sources feed this aggregate, each read
  * narrowly to avoid ever touching credential material:
  *   - state.db (SQLite) `sessions` table — real per-session model + token columns
- *     (input_tokens, output_tokens, reasoning_tokens, cache_read_tokens). started_at is a
- *     Unix epoch *seconds* REAL column, bounded to the last 30 days.
- *   - config.yaml — only the top-level `model` key (string, or a block with a `default`
- *     sub-key) is extracted; config.yaml can hold literal provider API keys under
- *     `providers:`, so this is a scoped line-scan, never a full YAML parse.
+ *     (input_tokens, output_tokens, reasoning_tokens, cache_read_tokens) plus real USD cost
+ *     columns (actual_cost_usd, falling back to estimated_cost_usd — Hermes computes this
+ *     itself via a provider pricing-table lookup, cost_source="provider_models_api" on a real
+ *     install). started_at is a Unix epoch *seconds* REAL column, bounded to the last 30 days.
+ *   - config.yaml — only the top-level `model` key is extracted: the plain-string form
+ *     (`model: "name"`), or the block form's `default`/`provider`/`base_url` sub-keys
+ *     (`model:\n  default: "name"\n  provider: openrouter\n  base_url: ''`). config.yaml can
+ *     hold literal provider API keys under `providers:`, so this is a scoped line-scan, never a
+ *     full YAML parse — `provider`/`base_url` live directly under `model:`, not `providers:`,
+ *     so reading them carries no credential risk.
  *   - auth.json — only the top-level `active_provider` key (e.g. "nous") is read; the
  *     per-provider blocks under `providers:` hold OAuth/API-key secrets and are never
  *     touched. "nous" is Nous Portal OAuth; anything else is a traditional API-key
@@ -45,11 +49,7 @@ function num(value) {
 }
 function querySqlite(sqlite3, dbPath, sql) {
     try {
-        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
-            input: `.timeout 5000\n${sql}\n`,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
     }
     catch {
         return null;
@@ -75,19 +75,21 @@ function stripYamlScalar(value) {
     const commentIdx = trimmed.search(/(?:^|\s)#/);
     return (commentIdx === -1 ? trimmed : trimmed.slice(0, commentIdx)).trim();
 }
+const EMPTY_MODEL_CONFIG = { model: '', provider: '', baseUrl: '' };
 /**
  * Scoped read of config.yaml's top-level `model` key only. Handles both the plain-string
- * form (`model: "name"`) and the block form (`model:\n  default: "name"\n  provider: ...`).
- * Never parses or returns any other key — config.yaml's `providers:` block can carry
- * literal API keys, so this deliberately avoids a full YAML parse.
+ * form (`model: "name"`, which carries no provider/base_url) and the block form
+ * (`model:\n  default: "name"\n  provider: openrouter\n  base_url: ''`). Never parses or
+ * returns any other key — config.yaml's `providers:` block can carry literal API keys, so this
+ * deliberately avoids a full YAML parse.
  */
-function readConfiguredModel(home) {
+function readModelConfig(home) {
     let text;
     try {
         text = readFileSync(join(home, '.hermes', 'config.yaml'), 'utf8');
     }
     catch {
-        return '';
+        return EMPTY_MODEL_CONFIG;
     }
     const lines = text.split('\n');
     for (let i = 0; i < lines.length; i++) {
@@ -96,8 +98,11 @@ function readConfiguredModel(home) {
             continue;
         const inline = stripYamlScalar(m[1]);
         if (inline)
-            return inline;
-        // Block form: scan indented lines immediately below for `default:`.
+            return { ...EMPTY_MODEL_CONFIG, model: inline };
+        // Block form: scan indented lines immediately below for default/provider/base_url —
+        // order isn't fixed, so keep scanning until the block dedents rather than stopping at the
+        // first match.
+        const result = { ...EMPTY_MODEL_CONFIG };
         for (let j = i + 1; j < lines.length; j++) {
             const next = lines[j];
             if (next.trim() === '')
@@ -105,12 +110,23 @@ function readConfiguredModel(home) {
             if (/^\S/.test(next))
                 break; // dedented — end of the `model:` block
             const dm = next.match(/^\s+default:\s*(.*)$/);
-            if (dm)
-                return stripYamlScalar(dm[1]);
+            if (dm) {
+                result.model = stripYamlScalar(dm[1]);
+                continue;
+            }
+            const pm = next.match(/^\s+provider:\s*(.*)$/);
+            if (pm) {
+                result.provider = stripYamlScalar(pm[1]);
+                continue;
+            }
+            const bm = next.match(/^\s+base_url:\s*(.*)$/);
+            if (bm) {
+                result.baseUrl = stripYamlScalar(bm[1]);
+            }
         }
-        break; // found the top-level `model:` key; stop (avoid nested `model:` keys elsewhere)
+        return result;
     }
-    return '';
+    return EMPTY_MODEL_CONFIG;
 }
 /** Scoped read of auth.json's top-level `active_provider` key only — never the `providers` block. */
 function readActiveProvider(home) {
@@ -152,7 +168,8 @@ function collectHermesTokenUsage(home = homedir()) {
        COALESCE(SUM(input_tokens), 0) || char(31) ||
        COALESCE(SUM(output_tokens), 0) || char(31) ||
        COALESCE(SUM(reasoning_tokens), 0) || char(31) ||
-       COALESCE(SUM(cache_read_tokens), 0) || char(30)
+       COALESCE(SUM(cache_read_tokens), 0) || char(31) ||
+       COALESCE(SUM(COALESCE(actual_cost_usd, estimated_cost_usd, 0)), 0) || char(30)
      FROM sessions
      WHERE started_at >= ${cutoffSeconds}
      GROUP BY model;`);
@@ -160,15 +177,16 @@ function collectHermesTokenUsage(home = homedir()) {
     const totals = emptyTotals();
     const modelTokenSplit = {};
     let sessionCount = 0;
+    let cost = 0;
     if (usageRaw) {
         for (const row of usageRaw.split(ROW_SEP)) {
             const trimmed = row.trim();
             if (!trimmed)
                 continue;
             const fields = trimmed.split(FIELD_SEP);
-            if (fields.length < 6)
+            if (fields.length < 7)
                 continue;
-            const [model, count, input, output, reasoning, cacheRead] = fields;
+            const [model, count, input, output, reasoning, cacheRead, modelCost] = fields;
             const cnt = num(count);
             sessionCount += cnt;
             if (model)
@@ -182,13 +200,14 @@ function collectHermesTokenUsage(home = homedir()) {
             totals.input_tokens += modelInput;
             totals.output_tokens += modelOutput;
             totals.cache_read_input_tokens += modelCacheRead;
+            cost += num(modelCost);
             const modelSum = modelInput + modelOutput + modelCacheRead;
             if (model && modelSum > 0) {
                 modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + modelSum;
             }
         }
     }
-    const configuredModel = readConfiguredModel(home);
+    const modelConfig = readModelConfig(home);
     const activeProvider = readActiveProvider(home);
     const version = readHermesVersion(home);
     const authMethod = activeProvider
@@ -196,7 +215,7 @@ function collectHermesTokenUsage(home = homedir()) {
             ? AUTH_NOUS_OAUTH
             : AUTH_API_KEY
         : '';
-    if (sessionCount === 0 && !configuredModel && !activeProvider)
+    if (sessionCount === 0 && !modelConfig.model && !activeProvider)
         return [];
     return [
         {
@@ -207,9 +226,12 @@ function collectHermesTokenUsage(home = homedir()) {
                 session_count: sessionCount,
                 models: [...models].sort(),
                 model_token_split: modelTokenSplit,
-                configured_model: configuredModel,
+                configured_model: modelConfig.model,
+                configured_model_provider: modelConfig.provider,
+                configured_model_base_url: modelConfig.baseUrl,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                cost,
                 active_provider: activeProvider,
                 auth_method: authMethod,
             },

package/dist/log_config_files/collection/openclaw_token_usage_collector.js

@@ -27,6 +27,13 @@ import { homedir } from 'node:os';
  * begin with). Exposed per-provider so the extractor can match it against the provider actually
  * observed in session usage.
  *
+ * Routing config comes from two more scoped reads of openclaw.json:
+ *   - `agents.defaults.model.primary` (format `"provider/model"`) — the configured provider id,
+ *     same precedence convention as other agents' `"provider/model"` pinning.
+ *   - `models.providers.<id>` tables — `baseUrl`/`auth` (a strategy string like `"aws-sdk"`)
+ *     only, never `apiKey`, `headers`, or the `models` catalog (this is a DIFFERENT top-level
+ *     key than `auth.profiles` above; a real install can have one without the other).
+ *
  * Only checks ~/.openclaw (the canonical root); the moltbot/clawdbot compatible-fork roots
  * tracked by the presence/log file types are not covered here.
  */
@@ -106,46 +113,69 @@ function readSessionsStore(storePath, cutoffMs, acc) {
         }
     }
 }
-/** Scoped read of openclaw.json's top-level `meta.lastTouchedVersion` key only. */
-function readVersion(openclawDir) {
+/** Parses openclaw.json once; both readVersion and readAuthModesByProvider derive from this. */
+function parseOpenclawJson(openclawDir) {
     try {
-        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
-        const meta = raw.meta;
-        return meta && typeof meta === 'object'
-            ? str(meta.lastTouchedVersion)
-            : '';
+        return JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
     }
     catch {
-        return '';
+        return null;
     }
 }
+/** Scoped read of openclaw.json's top-level `meta.lastTouchedVersion` key only. */
+function readVersion(raw) {
+    const meta = raw?.meta;
+    return meta && typeof meta === 'object'
+        ? str(meta.lastTouchedVersion)
+        : '';
+}
 /**
  * Scoped read of openclaw.json's `auth.profiles` — provider + mode only, never credentials
  * (the profiles carry no token/key fields). Returns a provider -> mode map (e.g.
  * `{"anthropic": "api_key"}`); a provider with multiple profiles keeps the last one read.
  */
-function readAuthModesByProvider(openclawDir) {
-    try {
-        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
-        const auth = raw.auth;
-        const profiles = auth && typeof auth === 'object' ? auth.profiles : undefined;
-        const out = {};
-        if (profiles && typeof profiles === 'object') {
-            for (const value of Object.values(profiles)) {
-                if (!value || typeof value !== 'object')
-                    continue;
-                const entry = value;
-                const provider = str(entry.provider);
-                const mode = str(entry.mode);
-                if (provider && mode)
-                    out[provider] = mode;
-            }
+function readAuthModesByProvider(raw) {
+    const auth = raw?.auth;
+    const profiles = auth && typeof auth === 'object' ? auth.profiles : undefined;
+    const out = {};
+    if (profiles && typeof profiles === 'object') {
+        for (const value of Object.values(profiles)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const entry = value;
+            const provider = str(entry.provider);
+            const mode = str(entry.mode);
+            if (provider && mode)
+                out[provider] = mode;
         }
-        return out;
     }
-    catch {
-        return {};
+    return out;
+}
+/** Scoped read of openclaw.json's `agents.defaults.model.primary` key only (format "provider/model"). */
+function readPrimaryModelProvider(raw) {
+    const agents = raw?.agents;
+    const defaults = agents && typeof agents === 'object' ? agents.defaults : undefined;
+    const model = defaults && typeof defaults === 'object' ? defaults.model : undefined;
+    const primary = model && typeof model === 'object' ? str(model.primary) : '';
+    return primary.includes('/') ? primary.split('/', 1)[0] : '';
+}
+/**
+ * Scoped read of openclaw.json's top-level `models.providers.<id>` tables — `baseUrl`/`auth`
+ * (a strategy string, e.g. `"aws-sdk"`) only, never `apiKey`, `headers`, or the `models` catalog.
+ */
+function readModelProviders(raw) {
+    const models = raw?.models;
+    const providers = models && typeof models === 'object' ? models.providers : undefined;
+    const out = {};
+    if (providers && typeof providers === 'object') {
+        for (const [id, cfg] of Object.entries(providers)) {
+            if (!cfg || typeof cfg !== 'object')
+                continue;
+            const entry = cfg;
+            out[id] = { baseUrl: str(entry.baseUrl), auth: str(entry.auth) };
+        }
     }
+    return out;
 }
 /**
  * Aggregate OpenClaw session count / token usage / models / providers / version across every
@@ -170,19 +200,22 @@ function collectOpenclawTokenUsage(home = homedir()) {
     }
     if (acc.sessionIds.size === 0)
         return [];
+    const openclawJson = parseOpenclawJson(openclawDir);
     return [
         {
             file_type: TOKEN_USAGE_FILE_TYPE,
             file_path: openclawDir,
             raw_content: {
-                version: readVersion(openclawDir),
+                version: readVersion(openclawJson),
                 session_count: acc.sessionIds.size,
                 models: [...acc.models].sort(),
                 providers: [...acc.providers].sort(),
                 model_token_split: acc.modelTokenSplit,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals: acc.totals,
-                auth_modes_by_provider: readAuthModesByProvider(openclawDir),
+                auth_modes_by_provider: readAuthModesByProvider(openclawJson),
+                primary_model_provider: readPrimaryModelProvider(openclawJson),
+                model_providers: readModelProviders(openclawJson),
             },
         },
     ];

package/dist/log_config_files/collection/opencode_token_usage_collector.js

@@ -1,8 +1,7 @@
-import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 /**
  * Token-usage / cost / session / version / identity aggregator for OpenCode.
  *
@@ -40,11 +39,7 @@ function asObject(value) {
 /** Run a read-only query and return raw stdout, or null when sqlite3/DB is unavailable. */
 function querySqlite(sqlite3, dbPath, sql) {
     try {
-        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
-            input: `.timeout 5000\n${sql}\n`,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        return execSqlite3(sqlite3, ['-readonly', '-noheader', dbPath], `.timeout 5000\n${sql}\n`);
     }
     catch {
         return null;

package/dist/log_config_files/collection/pi_token_usage_collector.js

@@ -8,10 +8,12 @@ import { homedir } from 'node:os';
  * ~/.pi/agent/sessions/<sanitized-cwd>/<timestamp>_<uuid>.jsonl. The first line is a
  * `type: "session"` header carrying the session `id`; assistant turns are `type: "message"`
  * lines whose `message.usage` block carries `{input, output, cacheRead, cacheWrite,
- * totalTokens, reasoning?}` alongside `message.model` / `message.provider`. We aggregate the
- * *numbers* (and model/provider ids) on the endpoint and emit only those — never
- * `message.content` (the actual prompt/response text) — so the backend gets token usage,
- * session count, and models/providers used without ingesting transcript content.
+ * totalTokens, reasoning?, cost?}` alongside `message.model` / `message.provider`. `usage.cost`
+ * (confirmed on a real install) is `{input, output, cacheRead, cacheWrite, total}` in USD, computed
+ * by Pi itself per message — we sum only `cost.total`. We aggregate the *numbers* (and model/
+ * provider ids) on the endpoint and emit only those — never `message.content` (the actual
+ * prompt/response text) — so the backend gets token usage, cost, session count, and models/
+ * providers used without ingesting transcript content.
  *
  * Configured defaults come from a scoped read of settings.json's `defaultProvider` /
  * `defaultModel` / `lastChangelogVersion` keys only — never any other key.
@@ -27,6 +29,14 @@ import { homedir } from 'node:os';
  * `version` field is a JSONL schema version (small int, e.g. `3`), not the CLI version, and is
  * not used here.
  *
+ * `~/.pi/agent/models.json` handles custom providers (Ollama, LM Studio, vLLM, or any OpenAI/
+ * Anthropic-compatible API per Pi's own docs) — but no official doc example shows its actual key
+ * shape (unlike auth.json/settings.json above, which have confirmed real examples). We read only
+ * a best-effort guessed `{ "<id>": { "baseURL": "..." } }` shape (mirroring the `baseUrl`/
+ * `baseURL` convention every other agent's custom-provider config uses) and treat anything else
+ * in the file as unknown; this is explicitly unconfirmed and may need correcting against a real
+ * install with the file actually populated.
+ *
  * Bounded by mtime recency so a large session history is not fully re-parsed on every run.
  */
 const TOKEN_USAGE_RECENCY_DAYS = 30;
@@ -105,6 +115,28 @@ function readAuthTypesByProvider(home) {
         return {};
     }
 }
+/**
+ * Best-effort, UNCONFIRMED scoped read of models.json's custom-provider `baseURL` values —
+ * see the module docstring's caveat. Returns a provider id -> base URL map.
+ */
+function readCustomProviderBaseUrls(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.pi', 'agent', 'models.json'), 'utf8'));
+        const out = {};
+        for (const [providerId, value] of Object.entries(raw)) {
+            if (!value || typeof value !== 'object')
+                continue;
+            const entry = value;
+            const baseUrl = str(entry.baseURL) || str(entry.baseUrl);
+            if (baseUrl)
+                out[providerId] = baseUrl;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
 /**
  * Aggregate Pi session count / token usage / models / providers across recent session
  * transcripts. Returns a single-element array (one per-machine aggregate) or [] when there is
@@ -123,6 +155,7 @@ function collectPiTokenUsage(home = homedir()) {
     const models = new Set();
     const providers = new Set();
     const modelTokenSplit = {};
+    let cost = 0;
     let sawData = false;
     for (const file of files) {
         let content;
@@ -171,6 +204,7 @@ function collectPiTokenUsage(home = homedir()) {
             totals.input_tokens += input;
             totals.output_tokens += output;
             totals.cache_read_input_tokens += cacheRead;
+            cost += num(asObject(usage.cost).total);
             const sum = input + output + cacheRead;
             if (model && sum > 0) {
                 modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
@@ -195,7 +229,9 @@ function collectPiTokenUsage(home = homedir()) {
                 configured_provider: defaults.provider,
                 window_days: TOKEN_USAGE_RECENCY_DAYS,
                 totals,
+                cost,
                 auth_types_by_provider: readAuthTypesByProvider(home),
+                custom_provider_base_urls: readCustomProviderBaseUrls(home),
             },
         },
     ];

package/dist/log_config_files/readers/composer_shadow_merge.js

@@ -1,4 +1,4 @@
-import { CURSOR_SHADOW_KEYS_NESTED_WINS, coalesceCursorEnabledShadowValue, stripShadowKeysFromReactiveBlobUpload, } from './cursor_shadow_merge_policy.js';
+import { CURSOR_SHADOW_KEYS_NESTED_WINS, coalesceCursorEnabledShadowValue, stripShadowKeysFromReactiveBlobUpload, } from './cursor_shadow_merge_ruleset.js';
 const CURSOR_SHADOW_KEYS_MERGE_ENABLED_OR = new Set([
     'isWebSearchToolEnabled',
     'isWebSearchToolEnabled2',

package/dist/log_config_files/readers/{cursor_shadow_merge_policy.js → cursor_shadow_merge_ruleset.js}

@@ -35,7 +35,7 @@ export function coalesceCursorEnabledShadowValue(root, nested) {
     return nested;
 }
 /**
- * After merge, policy and uploads use composerState.<key> only — drop stale blob-root copies.
+ * After merge, ruleset scanning and uploads use composerState.<key> only — drop stale blob-root copies.
  */
 export function stripShadowKeysFromReactiveBlobUpload(stateData) {
     if (!('composerState' in stateData))

package/dist/log_config_files/readers/file_readers.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import { parse as parseToml, stringify as stringifyTomlValue } from 'smol-toml';
 function stripJsoncComments(input) {
     let out = '';
     let inString = false;
@@ -176,4 +177,20 @@ function readInstalledExtensions(extensionsCachePath) {
     }
     return extensions;
 }
-export { readMCPConfig, readJSONFile, readMarkdownFile, readInstalledExtensions, parseJsonWithJsoncFallback, };
+/** Parse TOML text into a nested object. Returns null on parse failure. */
+function parseTomlText(raw) {
+    try {
+        const parsed = parseToml(raw);
+        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Serialize a nested object to TOML (used when writing remediated .toml configs). */
+function stringifyToml(value) {
+    return stringifyTomlValue(value);
+}
+export { readMCPConfig, readJSONFile, readMarkdownFile, readInstalledExtensions, parseJsonWithJsoncFallback, parseTomlText, stringifyToml, };

package/dist/log_config_files/readers/vscdb_reactive_storage.js

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { readFileCollectionVscdbContract } from '../runtime/management_storage.js';
 import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
-import { CURSOR_COMPOSER_SHADOW_KEYS } from './cursor_shadow_merge_policy.js';
+import { CURSOR_COMPOSER_SHADOW_KEYS } from './cursor_shadow_merge_ruleset.js';
 /** Suffix shared by Cursor reactive-storage ItemTable keys (see file_path_registry cursor agent). */
 export const REACTIVE_STORAGE_ITEM_KEY_SUFFIX = 'reactiveStorageServiceImpl.persistentStorage.applicationUser';
 function querySqliteValue(dbPath, key) {

package/dist/log_config_files/readers/vscdb_reader.js

@@ -1,6 +1,5 @@
 import { existsSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
-import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+import { execSqlite3, resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
 import { mergeCursorShadowKeyValue, mergeShadowKeysIntoComposerState, shadowKeysFromReadQueries, } from './composer_shadow_merge.js';
 import { composerShadowKeysFromContract, reactiveStorageItemKeyForVscdb, } from './vscdb_reactive_storage.js';
 import { readFileCollectionVscdbContract, sanitizeFileCollectionVscdbContract, writeFileCollectionVscdbContract, } from '../runtime/management_storage.js';
@@ -19,11 +18,7 @@ function querySqlite(dbPath, key) {
         throw new Error('sqlite3 not found');
     const safe = key.replace(/'/g, "''");
     const script = `.timeout 60000\nSELECT value FROM ItemTable WHERE key='${safe}';\n`;
-    return execFileSync(bin, ['-noheader', dbPath], {
-        input: script,
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe'],
-    }).trim();
+    return execSqlite3(bin, ['-noheader', dbPath], script).trim();
 }
 /**
  * Cursor keeps live agent settings (e.g. yoloCommandAllowlist) on nested composerState inside

package/dist/log_config_files/runtime/compliance_check.js

@@ -13,7 +13,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
-import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
+import { parseJsonWithJsoncFallback, parseTomlText } from '../readers/file_readers.js';
 import { mergeComposerShadowKeysFromReactiveBlob, readVscdbItemTableJson, } from '../readers/vscdb_reader.js';
 import { readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { resolveRemediationConfigPath, resolveRemediationUploadFileType } from './remediation_config_path.js';
@@ -280,7 +280,7 @@ function shouldMergeComposerShadowKeys(itemKeyFromPath, checkSettingPaths) {
 }
 /** @deprecated Import from vscdb_reader — re-export for existing tests. */
 export { mergeComposerShadowKeysFromReactiveBlob } from '../readers/vscdb_reader.js';
-/** Plain JSON file or virtual `…/state.vscdb#itemKey` path for ItemTable-backed settings. */
+/** Plain JSON/TOML file or virtual `…/state.vscdb#itemKey` path for ItemTable-backed settings. */
 function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
     const resolvedPath = resolveRemediationConfigPath(configFilePath);
     const hashIdx = resolvedPath.indexOf('#');
@@ -306,13 +306,23 @@ function loadRemediationConfigJson(configFilePath, checkSettingPaths = []) {
     }
     if (!existsSync(resolvedPath))
         return { ok: false, reason: 'file_not_found' };
+    const rawText = readFileSync(resolvedPath, 'utf8');
+    if (resolvedPath.toLowerCase().endsWith('.toml')) {
+        const parsedToml = parseTomlText(rawText);
+        if (parsedToml === null)
+            return { ok: false, reason: 'parse_error' };
+        return { ok: true, json: parsedToml };
+    }
     // OpenCode configs are JSONC (comments / trailing commas); parse strict JSON first, then
     // fall back to JSONC sanitization so comment-bearing files are not skipped as parse_error.
-    const parsed = parseJsonWithJsoncFallback(readFileSync(resolvedPath, 'utf8'));
+    const parsed = parseJsonWithJsoncFallback(rawText);
     if (parsed === null)
         return { ok: false, reason: 'parse_error' };
     return { ok: true, json: parsed };
 }
+function isSupportedTextConfigFormat(fileFormat) {
+    return fileFormat === 'json' || fileFormat === 'toml';
+}
 /**
  * Evaluate all checks in a secondary group against the group's config file.
  * Returns true only if every check passes (ops-based). Non-ops checks are treated as failing.
@@ -354,7 +364,7 @@ function violationFromCheck(entry, compliance, check, expected) {
 /** Evaluate one manifest row against on-disk config (used by gate + post-restart verify). */
 export function evaluateManifestEntryCompliance(entry) {
     const compliance = entry.fix ?? entry.compliance;
-    if (!compliance || compliance.file_format !== 'json')
+    if (!compliance || !isSupportedTextConfigFormat(compliance.file_format))
         return { violations: [] };
     const checks = compliance.checks ?? [];
     if (checks.length === 0)
@@ -463,9 +473,9 @@ export function runLocalRemediationComplianceCheck(agent = 'cursor') {
                 skippedNoCompliance++;
                 continue;
             }
-            if (compliance.file_format !== 'json') {
+            if (!isSupportedTextConfigFormat(compliance.file_format)) {
                 skippedNonJson++;
-                hookRunLog(`compliance_check: skipping non-json entry uuid=${entry.uuid}`);
+                hookRunLog(`compliance_check: skipping unsupported file_format=${compliance.file_format} uuid=${entry.uuid}`);
                 continue;
             }
             if ((compliance.checks ?? []).length === 0) {
@@ -795,7 +805,7 @@ export function pruneSatisfiedOneTimeRemediations(agent = 'cursor') {
             continue;
         }
         const spec = remediationFixSpec(inst);
-        const checks = spec?.file_format === 'json' ? (spec.checks ?? []) : [];
+        const checks = isSupportedTextConfigFormat(spec?.file_format) ? (spec?.checks ?? []) : [];
         if (checks.length === 0) {
             remaining.push(raw);
             continue;

package/dist/log_config_files/runtime/main_runner.js

@@ -14,7 +14,7 @@ import { ensureAuthentication } from '../auth/auth_flow.js';
 import { readJSONFile, readMarkdownFile } from '../readers/file_readers.js';
 import { isVscdbVirtualPath, tryReadVscdbVirtualFile, summarizeComposerPayloadForDiagnostics, } from '../readers/vscdb_config_builder.js';
 import { persistVscdbComposerContractFromPatternsResponse } from '../readers/vscdb_reader.js';
-import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
+import { collectConfigFilesFromPatterns, collectMcpToolFiles, collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles, collectMcpFromClaudeJsonProjects, collectClaudeTokenUsage, collectCopilotTokenUsage, collectOpencodeTokenUsage, collectCodexTokenUsage, collectCursorTokenUsage, collectHermesTokenUsage, collectOpenclawTokenUsage, collectPiTokenUsage, collectCoworkDesktopVersion, collectGrokCliVersion, collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, determineFileTypeFromPath, } from '../collection/config_collector.js';
 import { ensureCursorUserSettingsSnapshotInBatch } from '../collection/ensure_cursor_user_settings_snapshot.js';
 import { collectSkillsCliInstalled } from '../collection/skills_cli_collector.js';
 import { collectWorkspaceVscdbs } from '../collection/mcp_tool_collector.js';
@@ -170,6 +170,14 @@ async function collectAllConfigFiles(endpointBase) {
             configFiles.push(entry);
         }
     }
+    hookRunLog(`reading Grok CLI version`);
+    for (const entry of collectGrokCliVersion(HOME_DIR)) {
+        const key = `${entry.file_type}\t${entry.file_path}`;
+        if (!existingPaths.has(key)) {
+            existingPaths.add(key);
+            configFiles.push(entry);
+        }
+    }
     hookRunLog(`merging disk-only Claude Desktop extensions into extensions-installations.json`);
     const diskExtMerge = enrichClaudeDesktopExtensionsInstallationsUpload(configFiles, HOME_DIR);
     hookRunLog(`claude desktop extensions: merged=${diskExtMerge.mergedCount} had_registry_upload=${diskExtMerge.hadRegistryUpload}`);

package/dist/log_config_files/runtime/remediation_apply_tracking.js

@@ -5,7 +5,7 @@
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { atomicWriteJson, getRemediationStateDir } from './management_storage.js';
+import { atomicWriteJson, getDeferredVscdbApplyPath, getRemediationStateDir, } from './management_storage.js';
 import { hookRunLog } from './hook_logger.js';
 export const REMEDIATION_APPLY_TRACKING_BASENAME = 'remediation_apply_tracking.json';
 /** Consecutive post-restart verification failures before we stop autofix for a UUID. */
@@ -116,6 +116,9 @@ export function recordRemediationVerificationFailure(uuid, reason) {
  * supported for unit tests only — do not use a global violation list from compliance_check
  * in production: shadow-key merge bugs once made that list empty while the setting was still
  * wrong, which incorrectly marked remediations verified.
+ *
+ * If the deferred vscdb queue file is still on disk, Cursor restart / apply_deferred_vscdb has
+ * not completed — leave pending and do not quarantine (setting unchanged is expected).
  */
 export function processPendingPostRestartVerifications(violationProbe) {
     const isStillViolating = typeof violationProbe === 'function'
@@ -123,6 +126,7 @@ export function processPendingPostRestartVerifications(violationProbe) {
         : (uuid) => violationProbe.has(uuid);
     const file = readRemediationApplyTrackingFile();
     const outcomes = [];
+    const deferredQueuePending = existsSync(getDeferredVscdbApplyPath());
     for (const [uuid, entry] of Object.entries(file.entries)) {
         if (!entry.pending_post_restart_verify)
             continue;
@@ -131,6 +135,10 @@ export function processPendingPostRestartVerifications(violationProbe) {
             outcomes.push({ uuid, status: 'verified', consecutive_failures: 0 });
             continue;
         }
+        if (deferredQueuePending) {
+            hookRunLog(`remediation_tracking: defer verify uuid=${uuid} — deferred vscdb queue still pending (restart/apply not done yet)`);
+            continue;
+        }
         const reason = 'Setting unchanged after apply — the agent may have changed its config format and auto-fix cannot apply this policy.';
         const { entry: updated, newlyQuarantined } = recordRemediationVerificationFailure(uuid, reason);
         outcomes.push({

package/dist/log_config_files/runtime/remediation_sync.js

@@ -1,9 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, renameSync, unlinkSync } from 'node:fs';
 import { delimiter, dirname, join } from 'node:path';
 import { homedir } from 'node:os';
-import { execFileSync } from 'node:child_process';
 import { executeBody } from '../../endpoint_client/http_transport.js';
-import { parseJsonWithJsoncFallback } from '../readers/file_readers.js';
+import { parseJsonWithJsoncFallback, parseTomlText, stringifyToml } from '../readers/file_readers.js';
 import { complianceRunnerDiag, hookRunLog, logRemediationApplyFailure } from './hook_logger.js';
 import { atomicWriteJson, getDeferredVscdbApplyPath, getFileCollectionVscdbContractPath, getRemediationInstructionsPath, readRemediationInstructionsFile, writeRemediationInstructionsFile, } from './management_storage.js';
 import { readStoredAuthKey } from '../auth/auth_key_store.js';
@@ -19,8 +18,8 @@ import { reportAbsentWorktrees } from './worktree_absent.js';
 import { buildApiUrl, getFileCollectionPatterns } from '../../endpoint_client/registry_api.js';
 import { resolveRemediationConfigPath } from './remediation_config_path.js';
 import { resolveOpsTargetPath } from './ops_target_path.js';
-import { resolveSqlite3Binary } from './sqlite_binary.js';
-import { CURSOR_COMPOSER_SHADOW_KEYS } from '../readers/cursor_shadow_merge_policy.js';
+import { execSqlite3, resolveSqlite3Binary } from './sqlite_binary.js';
+import { CURSOR_COMPOSER_SHADOW_KEYS } from '../readers/cursor_shadow_merge_ruleset.js';
 import { REACTIVE_STORAGE_ITEM_KEY_SUFFIX, composerShadowKeysFromContract, reactiveStorageItemKeyForVscdb, } from '../readers/vscdb_reactive_storage.js';
 /** Best-effort detail from execFileSync failures (stderr, exit code, errno). */
 function formatNodeChildException(err) {
@@ -936,11 +935,7 @@ function sqliteSelectValueCell(dbPath, table, key_column, value_column, target_k
     const safeName = target_key.replace(/'/g, "''");
     const script = `.timeout 60000\nSELECT ${value_column} FROM ${table} WHERE ${key_column}='${safeName}';\n`;
     try {
-        return execFileSync(sqlite3, ['-noheader', dbPath], {
-            input: script,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        return execSqlite3(sqlite3, ['-noheader', dbPath], script).trim();
     }
     catch (err) {
         const { short, long } = formatNodeChildException(err);
@@ -955,11 +950,7 @@ function sqliteExecWithTimeout(dbPath, sqlBody) {
         throw new Error('sqlite3 not found');
     const script = `.timeout 60000\n${sqlBody}\n`;
     try {
-        execFileSync(sqlite3, [dbPath], {
-            input: script,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        execSqlite3(sqlite3, [dbPath], script);
     }
     catch (err) {
         const { long } = formatNodeChildException(err);
@@ -976,11 +967,7 @@ function sqliteRunUpdateReturningChanges(dbPath, updateSql) {
     const script = `.timeout 60000\n${updateSql}\nSELECT changes();\n`;
     let out;
     try {
-        out = execFileSync(sqlite3, [dbPath], {
-            input: script,
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
+        out = execSqlite3(sqlite3, [dbPath], script).trim();
     }
     catch (err) {
         const { long } = formatNodeChildException(err);
@@ -1044,10 +1031,15 @@ export async function applyDeferredVscdbFromDisk() {
         return true;
     }
     try {
+        let applied = 0;
+        let skippedMissing = 0;
         for (const it of payload.items) {
+            // Workspace storage can disappear between queue and restart (Cursor GC). Skip those
+            // items instead of aborting the whole batch — other workspaces still need the write.
             if (!existsSync(it.dbPath)) {
-                hookRunLog(`deferred_vscdb: database missing ${it.dbPath}`);
-                return false;
+                hookRunLog(`deferred_vscdb: database missing — skipping ${it.dbPath}`);
+                skippedMissing++;
+                continue;
             }
             if (!assertSafeSqliteIdentifiersForItemTable(it.table, it.key_column, it.value_column)) {
                 return false;
@@ -1060,8 +1052,9 @@ export async function applyDeferredVscdbFromDisk() {
                 hookRunLog(`deferred_vscdb: INSERT OR REPLACE changed 0 rows key=${it.target_key} db=${it.dbPath} — keeping queue file`);
                 return false;
             }
+            applied++;
         }
-        hookRunLog(`deferred_vscdb: applied ${payload.items.length} queued update(s)`);
+        hookRunLog(`deferred_vscdb: applied ${applied} queued update(s) skipped_missing=${skippedMissing}`);
         const authKey = readStoredAuthKey();
         for (const u of postApplyUploads) {
             if (!authKey) {
@@ -1435,7 +1428,7 @@ export function enforceRemediation(instruction) {
             }
             return { ok: true, deferredSqlite: false };
         }
-        if (fixSpec?.file_format !== 'json') {
+        if (fixSpec?.file_format !== 'json' && fixSpec?.file_format !== 'toml') {
             return fail(`unsupported file format: ${String(fixSpec?.file_format ?? 'undefined')}`);
         }
         const worktreeRoot = parseWorktreeRootFromPath(inst.config_file_path);
@@ -1458,26 +1451,39 @@ export function enforceRemediation(instruction) {
         else if (!existsSync(dir)) {
             mkdirSync(dir, { recursive: true, mode: 0o700 });
         }
-        let configJson = {};
+        const isToml = fixSpec?.file_format === 'toml';
+        let configObj = {};
         if (existsSync(inst.config_file_path)) {
-            // OpenCode configs are JSONC; parse strict JSON first, then JSONC fallback so a
-            // comment-bearing opencode.json(c) keeps its existing settings instead of being reset to
-            // {} on a parse failure. NOTE: the write-back below is JSON.stringify, so comments and
-            // trailing commas in the original file are not preserved (same as every other agent's
-            // JSON config) — only the key/value settings are retained and patched.
-            const parsed = parseJsonWithJsoncFallback(readFileSync(inst.config_file_path, 'utf8'));
-            if (parsed !== null) {
-                configJson = parsed;
+            const rawText = readFileSync(inst.config_file_path, 'utf8');
+            if (isToml) {
+                const parsed = parseTomlText(rawText);
+                if (parsed !== null) {
+                    configObj = parsed;
+                }
+                else {
+                    hookRunLog(`remediation_enforce: could not parse existing TOML file, starting fresh uuid=${inst.uuid}`);
+                }
             }
             else {
-                hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${inst.uuid}`);
+                // OpenCode configs are JSONC; parse strict JSON first, then JSONC fallback so a
+                // comment-bearing opencode.json(c) keeps its existing settings instead of being reset to
+                // {} on a parse failure. NOTE: the write-back below is JSON.stringify, so comments and
+                // trailing commas in the original file are not preserved (same as every other agent's
+                // JSON config) — only the key/value settings are retained and patched.
+                const parsed = parseJsonWithJsoncFallback(rawText);
+                if (parsed !== null) {
+                    configObj = parsed;
+                }
+                else {
+                    hookRunLog(`remediation_enforce: could not parse existing file, starting fresh uuid=${inst.uuid}`);
+                }
             }
         }
         for (const check of checks) {
-            applyCheck(configJson, check);
+            applyCheck(configObj, check);
         }
-        syncFlatGlobalCursorIgnoreListKey(configJson);
-        const content = JSON.stringify(configJson, null, 2);
+        syncFlatGlobalCursorIgnoreListKey(configObj);
+        const content = isToml ? stringifyToml(configObj) : JSON.stringify(configObj, null, 2);
         const tmp = `${inst.config_file_path}.tmp`;
         writeFileSync(tmp, content, 'utf8');
         renameSync(tmp, inst.config_file_path);

package/dist/log_config_files/runtime/sqlite_binary.js

@@ -90,3 +90,35 @@ export function resolveSqlite3Binary() {
 export function clearSqlite3BinaryCacheForTests() {
     cached = undefined;
 }
+/**
+ * Run the sqlite3 CLI with `-escape off` inserted before the trailing dbPath argument, so raw
+ * control-byte output (our char(30)/char(31) row/field separators, or any control byte in a
+ * stored value) survives instead of being rendered as printable caret-notation text — the
+ * default in sqlite3 CLI builds that support `-escape` (added alongside the `-escape symbol`
+ * default; confirmed present in a macOS-bundled 3.51.0 from 2025-06).
+ *
+ * Falls back to the same call without `-escape off` if the flag itself isn't recognized (an
+ * older CLI predating the flag also predates the `-escape symbol` default that motivates it, so
+ * dropping the flag there is safe, not a silent behavior change). `argsWithDbPathLast`'s last
+ * element must be the database path.
+ */
+export function execSqlite3(sqlite3, argsWithDbPathLast, input) {
+    const dbPath = argsWithDbPathLast[argsWithDbPathLast.length - 1];
+    const leadingArgs = argsWithDbPathLast.slice(0, -1);
+    const options = {
+        input,
+        encoding: 'utf8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    };
+    try {
+        return execFileSync(sqlite3, [...leadingArgs, '-escape', 'off', dbPath], options);
+    }
+    catch (err) {
+        try {
+            return execFileSync(sqlite3, argsWithDbPathLast, options);
+        }
+        catch {
+            throw err;
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "log-llm-config",
-  "version": "1.5.10",
+  "version": "1.5.14",
   "description": "CLI helpers for logging hardware UUIDs and posting startup payloads to Optimus Security.",
   "type": "module",
   "bin": {
@@ -56,8 +56,9 @@
     "vitest": "^4.1.8"
   },
   "dependencies": {
-    "axios": "^1.15.2",
+    "axios": "^1.18.1",
     "canonicalize": "^2.1.0",
-    "optimus-tofu": "^0.1.18"
+    "optimus-tofu": "^0.1.18",
+    "smol-toml": "^1.7.1"
   }
 }