log-llm-config 1.5.2 → 1.5.9

package/README.md

@@ -11,7 +11,7 @@ CLI helpers for Optimus Security startup workflows.
 
 #### `log_uuid`
 
-Collects the machine hardware UUID (or uses the `OPTIMUS_HARDWARE_UUID` env variable), prints it, and POSTs a startup payload to `OPTIMUS_ENDPOINT/startup/`. If the server responds with a key, it stores it at `~/opt-ai-sec/management/auth_key.txt`.
+Collects the machine hardware UUID (or uses the `OPTIMUS_HARDWARE_UUID` env variable), prints it, and POSTs a startup payload to `OPTIMUS_ENDPOINT/startup/`. If the server responds with a key, it stores it at `~/.optimuslabs/management/auth_key.txt`.
 
 ```bash
 OPTIMUS_ENDPOINT=http://localhost:8080/endpoint_security/ \

package/dist/bootstrap_constants.js

@@ -2,14 +2,14 @@
  * Bootstrap-level path constants — known before the API response is available.
  * Used by auth, hook logging, and audit output. Do not add agent-specific paths here.
  */
-export const OPT_AI_SEC_MANAGEMENT_REL = 'opt-ai-sec/management';
+export const OPTIMUSLABS_MANAGEMENT_REL = '.optimuslabs/management';
 /**
  * All hook-written log files live under this subdirectory, grouped by type
  * (see LOG_GROUP_* below). Keeping logs in one subtree leaves the management
  * root limited to secrets/identity/state (auth_key, organization-uuid, contracts).
  */
-export const OPT_AI_SEC_LOGS_REL = `${OPT_AI_SEC_MANAGEMENT_REL}/logs`;
-/** Log group subdirectories under {@link OPT_AI_SEC_LOGS_REL}. */
+export const OPTIMUSLABS_LOGS_REL = `${OPTIMUSLABS_MANAGEMENT_REL}/logs`;
+/** Log group subdirectories under {@link OPTIMUSLABS_LOGS_REL}. */
 export const LOG_GROUP_HOOK = 'hook';
 export const LOG_GROUP_COMPLIANCE = 'compliance';
 export const LOG_GROUP_AUDIT = 'audit';

package/dist/dialog_prefs_cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * CLI for macOS non-restart autofix dialogs and dialog preferences in ~/opt-ai-sec/management.
+ * CLI for macOS non-restart autofix dialogs and dialog preferences in ~/.optimuslabs/management.
  * Invoked from optimus-compliance-check.sh hooks.
  */
 import { execFileSync } from 'node:child_process';

package/dist/log_config_files/auth/auth_flow.js

@@ -2,9 +2,9 @@ import path from 'node:path';
 import { postStartupPayload } from '../../endpoint_client/index.js';
 import { ensureAuthentication as ensureTofuAuthentication } from '../../tofu.js';
 import { loadEndpointBase } from '../sender/endpoint_config.js';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
 import { hookRunLog } from '../runtime/hook_logger.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 /** Ensure authentication — verify stored key or request new one via handshake. */
 async function ensureAuthentication(hardwareUuid, endpointBase) {
     const key = await ensureTofuAuthentication({

package/dist/log_config_files/auth/auth_key_store.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { getAuthKeyPath as getSharedAuthKeyPath, readStoredAuthKey as readSharedStoredAuthKey, } from '../../tofu.js';
-import { OPT_AI_SEC_MANAGEMENT_REL } from '../../bootstrap_constants.js';
-const AUTH_KEY_RELATIVE_PATH = path.join(OPT_AI_SEC_MANAGEMENT_REL, 'auth', 'auth_key.txt');
+import { OPTIMUSLABS_MANAGEMENT_REL } from '../../bootstrap_constants.js';
+const AUTH_KEY_RELATIVE_PATH = path.join(OPTIMUSLABS_MANAGEMENT_REL, 'auth', 'auth_key.txt');
 const AUTH_KEY_OPTIONS = { authRelativePath: AUTH_KEY_RELATIVE_PATH };
 /** Return absolute path to auth_key.txt, or null if home dir is unavailable. */
 function getAuthKeyPath() {

package/dist/log_config_files/collection/claude_token_usage_collector.js

@@ -0,0 +1,156 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Token-usage / session / CLI-version aggregator for Claude Code.
+ *
+ * Claude Code writes one JSONL transcript per session under ~/.claude/projects/**. Each
+ * assistant line carries a `message.usage` block ({input,output,cache_*}_tokens), and every
+ * line carries the CLI `version` and `sessionId`. We aggregate the *numbers* (and version /
+ * model ids) on the endpoint and emit only those — never transcript content — so the backend
+ * gets token usage, session count, and a reliable CLI version without ingesting prompts.
+ *
+ * Bounded by mtime recency so a large transcript history (can be hundreds of MB) does not get
+ * fully re-parsed on every hook run; this yields "recent activity" usage and the current version.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'claude_token_usage';
+function emptyTotals() {
+    return {
+        input_tokens: 0,
+        output_tokens: 0,
+        cache_creation_input_tokens: 0,
+        cache_read_input_tokens: 0,
+    };
+}
+function addUsage(totals, usage) {
+    for (const key of Object.keys(totals)) {
+        const value = usage[key];
+        if (typeof value === 'number' && Number.isFinite(value))
+            totals[key] += value;
+    }
+}
+/** Sum the token fields of one usage block (used for per-model attribution). */
+function usageSum(usage) {
+    let sum = 0;
+    for (const key of ['input_tokens', 'output_tokens', 'cache_creation_input_tokens', 'cache_read_input_tokens']) {
+        const value = usage[key];
+        if (typeof value === 'number' && Number.isFinite(value))
+            sum += value;
+    }
+    return sum;
+}
+/** Recursively collect *.jsonl files under a directory whose mtime is within the recency window. */
+function recentJsonlFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentJsonlFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable file — skip */
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Aggregate token usage / session count / version across recent Claude session transcripts.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
+ */
+function collectClaudeTokenUsage(home = homedir()) {
+    const projectsDir = join(home, '.claude', 'projects');
+    if (!existsSync(projectsDir))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = recentJsonlFiles(projectsDir, cutoffMs);
+    if (files.length === 0)
+        return [];
+    const totals = emptyTotals();
+    const sessions = new Set();
+    const models = new Set();
+    const modelTokenSplit = {};
+    let version = '';
+    let versionAt = '';
+    let sawData = false;
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            sawData = true;
+            const sessionId = entry.sessionId;
+            if (typeof sessionId === 'string' && sessionId)
+                sessions.add(sessionId);
+            // Keep the version from the most recent line (timestamps are ISO-8601, sort lexically).
+            const lineVersion = entry.version;
+            const lineAt = typeof entry.timestamp === 'string' ? entry.timestamp : '';
+            if (typeof lineVersion === 'string' && lineVersion && lineAt >= versionAt) {
+                version = lineVersion;
+                versionAt = lineAt;
+            }
+            const message = entry.message;
+            if (message && typeof message === 'object') {
+                const msg = message;
+                // Skip Claude Code's internal placeholder model ids (e.g. "<synthetic>").
+                const model = typeof msg.model === 'string' && msg.model && !msg.model.startsWith('<') ? msg.model : '';
+                if (model)
+                    models.add(model);
+                if (msg.usage && typeof msg.usage === 'object') {
+                    const usage = msg.usage;
+                    addUsage(totals, usage);
+                    if (model) {
+                        const sum = usageSum(usage);
+                        if (sum > 0)
+                            modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+                    }
+                }
+            }
+        }
+    }
+    if (!sawData)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            // Stable synthetic path → one aggregate row per machine.
+            file_path: projectsDir,
+            raw_content: {
+                version,
+                session_count: sessions.size,
+                models: [...models].sort(),
+                model_token_split: modelTokenSplit,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+            },
+        },
+    ];
+}
+export { collectClaudeTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/codex_token_usage_collector.js

@@ -0,0 +1,245 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Token-usage / session / version / identity aggregator for OpenAI Codex CLI.
+ *
+ * Codex writes one JSONL rollout per session under ~/.codex/sessions/<y>/<m>/<d>/rollout-*.jsonl
+ * (and ~/.codex/archived_sessions/). A `session_meta` line carries `cli_version` + `model_provider`;
+ * `token_count` lines carry a *cumulative* `total_token_usage` ({input,cached_input,output,
+ * reasoning_output}_tokens) — so the session total is its LAST token_count, summed across sessions.
+ *
+ * Identity lives in ~/.codex/auth.json as a JWT (`auth_mode` + an `id_token` whose claims hold
+ * email / name / chatgpt_plan_type / account). We decode the id_token's claims locally and emit
+ * ONLY those (email, name, plan, account) — never the token, access_token, or API key. Configured
+ * model is read from ~/.codex/config.toml. Numbers + identity claims only — no transcript content.
+ *
+ * Bounded by rollout-file mtime recency so a long session history isn't fully re-parsed each run.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'codex_token_usage';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/** Recursively collect rollout-*.jsonl files under a dir whose mtime is within the window. */
+function recentRolloutFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentRolloutFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() &&
+            entry.name.startsWith('rollout-') &&
+            entry.name.endsWith('.jsonl')) {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable — skip */
+            }
+        }
+    }
+    return out;
+}
+/** Decode a JWT's payload claims (no verification — we only read non-secret identity claims). */
+function decodeJwtClaims(jwt) {
+    const parts = jwt.split('.');
+    if (parts.length !== 3)
+        return {};
+    try {
+        let b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        b64 += '='.repeat((4 - (b64.length % 4)) % 4);
+        return JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+/** Identity from ~/.codex/auth.json: auth_mode + id_token claims (email/name/plan/account). */
+function readCodexIdentity(home) {
+    const out = {};
+    let auth;
+    try {
+        auth = JSON.parse(readFileSync(join(home, '.codex', 'auth.json'), 'utf8'));
+    }
+    catch {
+        return out;
+    }
+    if (typeof auth.auth_mode === 'string' && auth.auth_mode)
+        out.auth_mode = auth.auth_mode;
+    const idToken = asObject(auth.tokens).id_token;
+    if (typeof idToken !== 'string' || !idToken)
+        return out;
+    const claims = decodeJwtClaims(idToken);
+    if (typeof claims.email === 'string')
+        out.email = claims.email;
+    if (typeof claims.name === 'string')
+        out.name = claims.name;
+    const openaiAuth = asObject(claims['https://api.openai.com/auth']);
+    if (typeof openaiAuth.chatgpt_plan_type === 'string')
+        out.plan = openaiAuth.chatgpt_plan_type;
+    if (typeof openaiAuth.chatgpt_account_id === 'string') {
+        out.account_id = openaiAuth.chatgpt_account_id;
+    }
+    const orgs = openaiAuth.organizations;
+    if (Array.isArray(orgs) && orgs.length > 0) {
+        const org = asObject(orgs[0]);
+        if (typeof org.id === 'string')
+            out.account_id = out.account_id || org.id;
+        if (typeof org.title === 'string')
+            out.org_name = org.title;
+    }
+    return out;
+}
+/** Configured model from ~/.codex/config.toml (TOML — a simple `model = "..."` line). */
+function readConfiguredModel(home) {
+    try {
+        const toml = readFileSync(join(home, '.codex', 'config.toml'), 'utf8');
+        const m = toml.match(/^\s*model\s*=\s*["']([^"']+)["']/m);
+        return m ? m[1] : '';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Aggregate Codex token usage / sessions / version across recent rollout transcripts + identity.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
+ */
+function collectCodexTokenUsage(home = homedir()) {
+    const codexDir = join(home, '.codex');
+    const sessionRoots = [join(codexDir, 'sessions'), join(codexDir, 'archived_sessions')];
+    if (!sessionRoots.some((d) => existsSync(d)) && !existsSync(join(codexDir, 'auth.json'))) {
+        return [];
+    }
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = sessionRoots.flatMap((d) => (existsSync(d) ? recentRolloutFiles(d, cutoffMs) : []));
+    const totals = emptyTotals();
+    const models = new Set();
+    const providers = new Set();
+    const modelTokenSplit = {};
+    const sessions = new Set();
+    // Per-session cumulative usage, keyed by session id (else file path). total_token_usage is
+    // cumulative within a session, so the same session appearing in multiple rollout files
+    // (sessions/ + archived_sessions/) must be deduped — keep the largest snapshot rather than
+    // summing the files, which would double-count.
+    const sessionTotals = new Map();
+    let version = '';
+    let versionAt = '';
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        let sessionModel = '';
+        let sessionTotal = null; // last (cumulative) token usage
+        let sessionId = '';
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            const payload = asObject(entry.payload);
+            const ts = typeof entry.timestamp === 'string' ? entry.timestamp : '';
+            if (entry.type === 'session_meta') {
+                if (typeof payload.session_id === 'string')
+                    sessionId = payload.session_id;
+                if (typeof payload.cli_version === 'string' && payload.cli_version && ts >= versionAt) {
+                    version = payload.cli_version;
+                    versionAt = ts;
+                }
+                if (typeof payload.model_provider === 'string' && payload.model_provider) {
+                    providers.add(payload.model_provider);
+                }
+            }
+            // Model id can appear on turn/response lines as payload.model.
+            if (typeof payload.model === 'string' && payload.model) {
+                models.add(payload.model);
+                if (!sessionModel)
+                    sessionModel = payload.model;
+            }
+            if (payload.type === 'token_count') {
+                const usage = asObject(asObject(payload.info).total_token_usage);
+                if (Object.keys(usage).length) {
+                    // Cumulative within the session — keep the latest seen.
+                    sessionTotal = {
+                        input: num(usage.input_tokens),
+                        cached: num(usage.cached_input_tokens),
+                        output: num(usage.output_tokens) + num(usage.reasoning_output_tokens),
+                    };
+                }
+            }
+        }
+        const sessionKey = sessionId || file;
+        sessions.add(sessionKey);
+        if (sessionTotal) {
+            const sum = sessionTotal.input + sessionTotal.cached + sessionTotal.output;
+            const prev = sessionTotals.get(sessionKey);
+            // Keep the largest cumulative snapshot for a session so a duplicate file doesn't double-count.
+            if (!prev || sum > prev.sum) {
+                sessionTotals.set(sessionKey, {
+                    model: sessionModel,
+                    input: sessionTotal.input,
+                    cached: sessionTotal.cached,
+                    output: sessionTotal.output,
+                    sum,
+                });
+            }
+        }
+    }
+    for (const st of sessionTotals.values()) {
+        totals.input_tokens += st.input;
+        totals.cache_read_input_tokens += st.cached;
+        totals.output_tokens += st.output;
+        if (st.model && st.sum > 0) {
+            modelTokenSplit[st.model] = (modelTokenSplit[st.model] ?? 0) + st.sum;
+        }
+    }
+    const identity = readCodexIdentity(home);
+    const configuredModel = readConfiguredModel(home);
+    const sawUsage = files.length > 0;
+    if (!sawUsage && !identity.email)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: codexDir, // stable synthetic path → one aggregate row per machine
+            raw_content: {
+                version,
+                session_count: sessions.size,
+                models: [...models].sort(),
+                providers: [...providers].sort(),
+                model_token_split: modelTokenSplit,
+                configured_model: configuredModel,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+                ...identity, // auth_mode, email, name, plan, account_id, org_name (claims only)
+            },
+        },
+    ];
+}
+export { collectCodexTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/config_collector.js

@@ -227,6 +227,15 @@ export { collectConfigFilesFromPatterns };
 export { collectMcpToolFiles } from './mcp_tool_collector.js';
 export { collectConfigFilesFromInstalledPlugins, collectPluginCacheMcpFiles } from './plugin_collector.js';
 export { collectMcpFromClaudeJsonProjects } from './claude_known_projects_collector.js';
+export { collectClaudeTokenUsage } from './claude_token_usage_collector.js';
+export { collectCopilotTokenUsage } from './copilot_token_usage_collector.js';
+export { collectOpencodeTokenUsage } from './opencode_token_usage_collector.js';
+export { collectCodexTokenUsage } from './codex_token_usage_collector.js';
+export { collectCursorTokenUsage } from './cursor_token_usage_collector.js';
+export { collectHermesTokenUsage } from './hermes_token_usage_collector.js';
+export { collectOpenclawTokenUsage } from './openclaw_token_usage_collector.js';
+export { collectPiTokenUsage } from './pi_token_usage_collector.js';
+export { collectCoworkDesktopVersion } from './cowork_desktop_version_collector.js';
 export { collectClaudeDesktopExtensionManifests, collectClaudeDesktopExtensionSettingsFiles, enrichClaudeDesktopExtensionsInstallationsUpload, mergeClaudeDesktopExtensionEnableSettings, } from './claude_desktop_extensions_collector.js';
 export { collectCursorProjectWorkspaceMcpConfigs } from './cursor_project_mcp_collector.js';
 export { determineFileTypeFromPath } from './file_type_rules.js';

package/dist/log_config_files/collection/copilot_token_usage_collector.js

@@ -0,0 +1,154 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Token-usage / session / CLI-version aggregator for GitHub Copilot CLI.
+ *
+ * Copilot CLI writes one transcript per session under ~/.copilot/session-state/<id>/events.jsonl.
+ * Each transcript's `session.start` carries `copilotVersion` + `selectedModel`; its
+ * `session.shutdown` carries `tokenDetails` ({input,output,cache_read}.tokenCount),
+ * `totalPremiumRequests`, and per-model `modelMetrics`. We aggregate the *numbers* (and version /
+ * model ids) on the endpoint and emit only those — never transcript content.
+ *
+ * Bounded by mtime recency so a large session history is not fully re-parsed on every hook run.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'copilot_token_usage';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function asObject(value) {
+    return value && typeof value === 'object' ? value : {};
+}
+/** session.shutdown.tokenDetails → {input,output,cache_read}.tokenCount */
+function addTokenDetails(totals, tokenDetails) {
+    totals.input_tokens += num(asObject(tokenDetails.input).tokenCount);
+    totals.output_tokens += num(asObject(tokenDetails.output).tokenCount);
+    totals.cache_read_input_tokens += num(asObject(tokenDetails.cache_read).tokenCount);
+}
+/** Recursively collect events.jsonl files whose mtime is within the recency window. */
+function recentEventFiles(dir, cutoffMs) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            out.push(...recentEventFiles(full, cutoffMs));
+        }
+        else if (entry.isFile() && entry.name === 'events.jsonl') {
+            try {
+                if (statSync(full).mtimeMs >= cutoffMs)
+                    out.push(full);
+            }
+            catch {
+                /* unreadable — skip */
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Aggregate Copilot token usage / session count / version across recent session transcripts.
+ * Returns a single-element array (one per-machine aggregate) or [] when there is no recent data.
+ */
+function collectCopilotTokenUsage(home = homedir()) {
+    const sessionsDir = join(home, '.copilot', 'session-state');
+    if (!existsSync(sessionsDir))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const files = recentEventFiles(sessionsDir, cutoffMs);
+    if (files.length === 0)
+        return [];
+    const totals = emptyTotals();
+    const sessions = new Set();
+    const models = new Set();
+    const modelTokenSplit = {};
+    let premiumRequests = 0;
+    let version = '';
+    let versionAt = -1;
+    let sawData = false;
+    for (const file of files) {
+        let content;
+        try {
+            content = readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(trimmed);
+            }
+            catch {
+                continue;
+            }
+            sawData = true;
+            const type = entry.type;
+            const data = asObject(entry.data);
+            const sessionId = data.sessionId;
+            if (typeof sessionId === 'string' && sessionId)
+                sessions.add(sessionId);
+            if (type === 'session.start') {
+                // Keep the copilotVersion from the most recently started session.
+                const startTime = num(data.startTime);
+                const v = data.copilotVersion;
+                if (typeof v === 'string' && v && startTime >= versionAt) {
+                    version = v;
+                    versionAt = startTime;
+                }
+                if (typeof data.selectedModel === 'string' && data.selectedModel) {
+                    models.add(data.selectedModel);
+                }
+            }
+            else if (type === 'assistant.message') {
+                if (typeof data.model === 'string' && data.model)
+                    models.add(data.model);
+            }
+            else if (type === 'session.shutdown') {
+                premiumRequests += num(data.totalPremiumRequests);
+                addTokenDetails(totals, asObject(data.tokenDetails));
+                const modelMetrics = asObject(data.modelMetrics);
+                for (const [model, metrics] of Object.entries(modelMetrics)) {
+                    models.add(model);
+                    const usage = asObject(asObject(metrics).usage);
+                    const sum = num(usage.inputTokens) + num(usage.outputTokens) + num(usage.cacheReadTokens);
+                    if (sum > 0)
+                        modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + sum;
+                }
+            }
+        }
+    }
+    if (!sawData)
+        return [];
+    // Sessions without a sessionId in data still count via their transcript file.
+    const sessionCount = Math.max(sessions.size, files.length);
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: sessionsDir, // stable synthetic path → one aggregate row per machine
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                premium_requests: premiumRequests,
+                model_token_split: modelTokenSplit,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+            },
+        },
+    ];
+}
+export { collectCopilotTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };