log-llm-config 1.5.2 → 1.5.9

package/dist/log_config_files/collection/cowork_desktop_version_collector.js

@@ -0,0 +1,60 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Claude Desktop app version, surfaced as Cowork's Agent Profile `agent_version`.
+ *
+ * Cowork has no per-session version signal — its `local_<sessionId>.json` session files
+ * (see cowork_session_whitelist.ts) carry no version field, confirmed against a live install.
+ * Cowork runs inside the Claude Desktop app rather than as a standalone CLI, so the app's own
+ * bundle version is the only real "version" available for it: `CFBundleShortVersionString` from
+ * Claude.app's Info.plist, read via `plutil` (a stock macOS binary — no new dependency, same
+ * shell-out pattern as the sqlite3-based collectors).
+ *
+ * Gated on the Cowork enablement marker (~/Library/Application Support/Claude/
+ * cowork-enabled-cli-ops.json) so a machine with Claude Desktop installed but Cowork never
+ * enabled doesn't get an agent=cowork version row. macOS only — Claude Desktop/Cowork ships on
+ * macOS today.
+ */
+const FILE_TYPE = 'cowork_desktop_version';
+const BUNDLE_VERSION_KEY = 'CFBundleShortVersionString';
+const CLAUDE_APP_INFO_PLIST = '/Applications/Claude.app/Contents/Info.plist';
+function coworkEnabledMarkerPath(home) {
+    return join(home, 'Library', 'Application Support', 'Claude', 'cowork-enabled-cli-ops.json');
+}
+/** `plutil -extract CFBundleShortVersionString raw <path>`, or '' when plutil/the plist is unavailable. */
+function readBundleVersion(plistPath) {
+    try {
+        return execFileSync('/usr/bin/plutil', ['-extract', BUNDLE_VERSION_KEY, 'raw', plistPath], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Emit the Claude Desktop app version as a single-element aggregate, or [] when this isn't
+ * macOS, Cowork isn't enabled on this machine, or Claude.app/plutil is unavailable.
+ */
+function collectCoworkDesktopVersion(home = homedir(), plistPath = CLAUDE_APP_INFO_PLIST) {
+    if (process.platform !== 'darwin')
+        return [];
+    if (!existsSync(coworkEnabledMarkerPath(home)))
+        return [];
+    if (!existsSync(plistPath))
+        return [];
+    const version = readBundleVersion(plistPath);
+    if (!version)
+        return [];
+    return [
+        {
+            file_type: FILE_TYPE,
+            file_path: plistPath,
+            raw_content: { version },
+        },
+    ];
+}
+export { collectCoworkDesktopVersion, FILE_TYPE as COWORK_DESKTOP_VERSION_FILE_TYPE };

package/dist/log_config_files/collection/cursor_token_usage_collector.js

@@ -0,0 +1,188 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+/**
+ * Session / version / identity aggregator for Cursor.
+ *
+ * Cursor stores everything in a VSCode-style SQLite state DB at
+ * ~/Library/Application Support/Cursor/User/globalStorage/state.vscdb (macOS).
+ * Two tables carry the data we need:
+ *   ItemTable       — key/value store: Cursor version, cursorAuth/* identity rows
+ *   cursorDiskKV    — key/value store: composerData:<conversationId> entries,
+ *                     each with a JSON blob carrying createdAt, modelConfig.modelName
+ *
+ * We read identity (email, plan, version) from ItemTable and aggregate session counts +
+ * model names from composerData entries in cursorDiskKV, bounded to the last 30 days.
+ * Token counts are no longer written by Cursor 3.8+ so totals are always 0.
+ * No message content is read — only model names and timestamps.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'cursor_token_usage';
+const ROW_SEP = '\x1e';
+const FIELD_SEP = '\x1f';
+/** Platform-aware path to Cursor's global state.vscdb. */
+function vscdbPath(home) {
+    if (process.platform === 'darwin') {
+        return join(home, 'Library', 'Application Support', 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+    }
+    if (process.platform === 'linux') {
+        return join(home, '.config', 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+    }
+    // Windows: AppData/Roaming/Cursor/...
+    const appdata = process.env['APPDATA'] || join(home, 'AppData', 'Roaming');
+    return join(appdata, 'Cursor', 'User', 'globalStorage', 'state.vscdb');
+}
+function querySqlite(sqlite3, dbPath, sql) {
+    try {
+        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
+            input: `.timeout 5000\n${sql}\n`,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+function num(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const n = parseInt(value, 10);
+        return Number.isFinite(n) ? n : 0;
+    }
+    return 0;
+}
+/**
+ * Aggregate Cursor token usage / sessions / version / identity from state.vscdb.
+ * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
+ */
+function collectCursorTokenUsage(home = homedir()) {
+    const dbPath = vscdbPath(home);
+    if (!existsSync(dbPath))
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    // Identity: version, email, plan, subscription status, sign-up type, display name.
+    const identityRaw = querySqlite(sqlite3, dbPath, `SELECT key || char(31) || COALESCE(value, '') || char(30)
+     FROM ItemTable
+     WHERE key IN (
+       'cursor.startupMetrics.lastVersion',
+       'cursorAuth/cachedEmail',
+       'cursorAuth/stripeMembershipType',
+       'cursorAuth/stripeSubscriptionStatus',
+       'cursorAuth/cachedSignUpType',
+       'cursorAuth/cachedScopedProfile'
+     );`);
+    let version = '';
+    let email = '';
+    let plan = '';
+    let subscriptionStatus = '';
+    let signUpType = '';
+    let displayName = '';
+    if (identityRaw) {
+        for (const row of identityRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const sep = trimmed.indexOf(FIELD_SEP);
+            if (sep === -1)
+                continue;
+            const key = trimmed.slice(0, sep);
+            const value = trimmed.slice(sep + 1);
+            switch (key) {
+                case 'cursor.startupMetrics.lastVersion':
+                    version = value;
+                    break;
+                case 'cursorAuth/cachedEmail':
+                    email = value;
+                    break;
+                case 'cursorAuth/stripeMembershipType':
+                    plan = value;
+                    break;
+                case 'cursorAuth/stripeSubscriptionStatus':
+                    subscriptionStatus = value;
+                    break;
+                case 'cursorAuth/cachedSignUpType':
+                    signUpType = value;
+                    break;
+                case 'cursorAuth/cachedScopedProfile':
+                    try {
+                        const profile = JSON.parse(value);
+                        if (typeof profile['displayName'] === 'string')
+                            displayName = profile['displayName'];
+                    }
+                    catch {
+                        /* non-JSON or missing — skip */
+                    }
+                    break;
+            }
+        }
+    }
+    // Usage: aggregate session counts and model names from composerData entries in the last 30
+    // days. composerData:<conversationId> entries carry a Unix ms timestamp in $.createdAt and
+    // the model in $.modelConfig.modelName. Token counts are not written by Cursor 3.8+.
+    // cutoffMs is a safe integer — interpolating directly avoids an extra round-trip.
+    // key range (not LIKE 'composerData:%') so the query hits the primary-key index on `key`
+    // instead of a full-table scan. SQLite's LIKE optimizer only rewrites a prefix match to an
+    // index range scan when the comparison is case-sensitive: either PRAGMA case_sensitive_like
+    // is ON (with `key`'s default BINARY collation), or the column itself uses NOCASE collation.
+    // Neither holds here, so LIKE 'composerData:%' would fall back to a full scan of cursorDiskKV.
+    // ';' is the char after ':' in ASCII, so [composerData: , composerData;) is exactly the
+    // composerData:* prefix range. Note: this also makes the match case-sensitive (BINARY
+    // collation), narrower than the old case-insensitive LIKE — safe because Cursor always
+    // writes this key prefix as the exact literal 'composerData:', never a different casing.
+    const usageRaw = querySqlite(sqlite3, dbPath, `SELECT
+       COALESCE(json_extract(value, '$.modelConfig.modelName'), 'default') || char(31) ||
+       COUNT(*) || char(30)
+     FROM cursorDiskKV
+     WHERE key >= 'composerData:' AND key < 'composerData;'
+       AND CAST(json_extract(value, '$.createdAt') AS INTEGER) >= ${cutoffMs}
+     GROUP BY json_extract(value, '$.modelConfig.modelName');`);
+    const models = new Set();
+    let sessionCount = 0;
+    if (usageRaw) {
+        for (const row of usageRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const sep = trimmed.indexOf(FIELD_SEP);
+            if (sep === -1)
+                continue;
+            const model = trimmed.slice(0, sep).trim();
+            const cnt = num(trimmed.slice(sep + 1));
+            sessionCount += cnt;
+            if (model)
+                models.add(model);
+        }
+    }
+    if (sessionCount === 0 && !email && !version)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: dbPath,
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                model_token_split: {},
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals: {
+                    input_tokens: 0,
+                    output_tokens: 0,
+                },
+                email,
+                display_name: displayName,
+                plan,
+                subscription_status: subscriptionStatus,
+                auth_method: signUpType ? 'cursor_account' : '',
+            },
+        },
+    ];
+}
+export { collectCursorTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE, vscdbPath };

package/dist/log_config_files/collection/hermes_token_usage_collector.js

@@ -0,0 +1,219 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { resolveSqlite3Binary } from '../runtime/sqlite_binary.js';
+/**
+ * Session / token usage / model / version aggregator for Hermes Agent (Nous Research).
+ *
+ * Hermes keeps all state under ~/.hermes/. Three sources feed this aggregate, each read
+ * narrowly to avoid ever touching credential material:
+ *   - state.db (SQLite) `sessions` table — real per-session model + token columns
+ *     (input_tokens, output_tokens, reasoning_tokens, cache_read_tokens). started_at is a
+ *     Unix epoch *seconds* REAL column, bounded to the last 30 days.
+ *   - config.yaml — only the top-level `model` key (string, or a block with a `default`
+ *     sub-key) is extracted; config.yaml can hold literal provider API keys under
+ *     `providers:`, so this is a scoped line-scan, never a full YAML parse.
+ *   - auth.json — only the top-level `active_provider` key (e.g. "nous") is read; the
+ *     per-provider blocks under `providers:` hold OAuth/API-key secrets and are never
+ *     touched. "nous" is Nous Portal OAuth; anything else is a traditional API-key
+ *     provider (see hermes_cli/auth.py's ProviderConfig registry).
+ *
+ * There is no on-disk record of email/org/plan — those only exist inside the live OAuth
+ * access_token's JWT claims (the actual bearer credential, not a side identity token like
+ * Codex's id_token), so this collector does not decode it. Version comes from the bundled
+ * source checkout's hermes_cli/__init__.py (best-effort; empty string if unavailable).
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'hermes_token_usage';
+const ROW_SEP = '\x1e';
+const FIELD_SEP = '\x1f';
+const PROVIDER_NOUS = 'nous';
+const AUTH_NOUS_OAUTH = 'nous_oauth';
+const AUTH_API_KEY = 'api_key';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const n = parseFloat(value);
+        return Number.isFinite(n) ? n : 0;
+    }
+    return 0;
+}
+function querySqlite(sqlite3, dbPath, sql) {
+    try {
+        return execFileSync(sqlite3, ['-readonly', '-noheader', dbPath], {
+            input: `.timeout 5000\n${sql}\n`,
+            encoding: 'utf8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Extract a plain YAML scalar value, stripping quotes and a trailing inline comment.
+ * A quoted value's content ends at the matching close-quote (anything after, including a
+ * comment, is discarded). An unquoted value's comment starts at a `#` preceded by whitespace
+ * or at the start of the string (a bare `#` glued to non-space text is part of the value, per
+ * the YAML spec's plain-scalar comment rule).
+ */
+function stripYamlScalar(value) {
+    const trimmed = value.trim();
+    if (trimmed.startsWith('"')) {
+        const end = trimmed.indexOf('"', 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    if (trimmed.startsWith("'")) {
+        const end = trimmed.indexOf("'", 1);
+        return end !== -1 ? trimmed.slice(1, end) : trimmed.slice(1);
+    }
+    const commentIdx = trimmed.search(/(?:^|\s)#/);
+    return (commentIdx === -1 ? trimmed : trimmed.slice(0, commentIdx)).trim();
+}
+/**
+ * Scoped read of config.yaml's top-level `model` key only. Handles both the plain-string
+ * form (`model: "name"`) and the block form (`model:\n  default: "name"\n  provider: ...`).
+ * Never parses or returns any other key — config.yaml's `providers:` block can carry
+ * literal API keys, so this deliberately avoids a full YAML parse.
+ */
+function readConfiguredModel(home) {
+    let text;
+    try {
+        text = readFileSync(join(home, '.hermes', 'config.yaml'), 'utf8');
+    }
+    catch {
+        return '';
+    }
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const m = lines[i].match(/^model:\s*(.*)$/);
+        if (!m)
+            continue;
+        const inline = stripYamlScalar(m[1]);
+        if (inline)
+            return inline;
+        // Block form: scan indented lines immediately below for `default:`.
+        for (let j = i + 1; j < lines.length; j++) {
+            const next = lines[j];
+            if (next.trim() === '')
+                continue;
+            if (/^\S/.test(next))
+                break; // dedented — end of the `model:` block
+            const dm = next.match(/^\s+default:\s*(.*)$/);
+            if (dm)
+                return stripYamlScalar(dm[1]);
+        }
+        break; // found the top-level `model:` key; stop (avoid nested `model:` keys elsewhere)
+    }
+    return '';
+}
+/** Scoped read of auth.json's top-level `active_provider` key only — never the `providers` block. */
+function readActiveProvider(home) {
+    try {
+        const raw = JSON.parse(readFileSync(join(home, '.hermes', 'auth.json'), 'utf8'));
+        return typeof raw.active_provider === 'string' ? raw.active_provider : '';
+    }
+    catch {
+        return '';
+    }
+}
+/** Best-effort CLI version from the bundled source checkout; empty string if unavailable. */
+function readHermesVersion(home) {
+    try {
+        const text = readFileSync(join(home, '.hermes', 'hermes-agent', 'hermes_cli', '__init__.py'), 'utf8');
+        const m = text.match(/^__version__\s*=\s*["']([^"']+)["']/m);
+        return m ? m[1] : '';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Aggregate Hermes session count / token usage / models / version / active provider.
+ * Returns a single-element array (one per-machine aggregate) or [] when no usable DB exists.
+ */
+function collectHermesTokenUsage(home = homedir()) {
+    const dbPath = join(home, '.hermes', 'state.db');
+    if (!existsSync(dbPath))
+        return [];
+    const sqlite3 = resolveSqlite3Binary();
+    if (!sqlite3)
+        return [];
+    // started_at is Unix epoch *seconds* (REAL), unlike the epoch-ms convention elsewhere.
+    const cutoffSeconds = Math.floor(Date.now() / 1000) - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60;
+    const usageRaw = querySqlite(sqlite3, dbPath, `SELECT
+       COALESCE(model, 'default') || char(31) ||
+       COUNT(*) || char(31) ||
+       COALESCE(SUM(input_tokens), 0) || char(31) ||
+       COALESCE(SUM(output_tokens), 0) || char(31) ||
+       COALESCE(SUM(reasoning_tokens), 0) || char(31) ||
+       COALESCE(SUM(cache_read_tokens), 0) || char(30)
+     FROM sessions
+     WHERE started_at >= ${cutoffSeconds}
+     GROUP BY model;`);
+    const models = new Set();
+    const totals = emptyTotals();
+    const modelTokenSplit = {};
+    let sessionCount = 0;
+    if (usageRaw) {
+        for (const row of usageRaw.split(ROW_SEP)) {
+            const trimmed = row.trim();
+            if (!trimmed)
+                continue;
+            const fields = trimmed.split(FIELD_SEP);
+            if (fields.length < 6)
+                continue;
+            const [model, count, input, output, reasoning, cacheRead] = fields;
+            const cnt = num(count);
+            sessionCount += cnt;
+            if (model)
+                models.add(model);
+            const modelInput = num(input);
+            // reasoning_tokens folds into output_tokens — TokenTotals has no separate reasoning
+            // field (matches Codex's reasoning_output_tokens fold-in), so a reasoning/non-reasoning
+            // split isn't distinguishable downstream.
+            const modelOutput = num(output) + num(reasoning);
+            const modelCacheRead = num(cacheRead);
+            totals.input_tokens += modelInput;
+            totals.output_tokens += modelOutput;
+            totals.cache_read_input_tokens += modelCacheRead;
+            const modelSum = modelInput + modelOutput + modelCacheRead;
+            if (model && modelSum > 0) {
+                modelTokenSplit[model] = (modelTokenSplit[model] ?? 0) + modelSum;
+            }
+        }
+    }
+    const configuredModel = readConfiguredModel(home);
+    const activeProvider = readActiveProvider(home);
+    const version = readHermesVersion(home);
+    const authMethod = activeProvider
+        ? activeProvider === PROVIDER_NOUS
+            ? AUTH_NOUS_OAUTH
+            : AUTH_API_KEY
+        : '';
+    if (sessionCount === 0 && !configuredModel && !activeProvider)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: dbPath,
+            raw_content: {
+                version,
+                session_count: sessionCount,
+                models: [...models].sort(),
+                model_token_split: modelTokenSplit,
+                configured_model: configuredModel,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals,
+                active_provider: activeProvider,
+                auth_method: authMethod,
+            },
+        },
+    ];
+}
+export { collectHermesTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };

package/dist/log_config_files/collection/openclaw_token_usage_collector.js

@@ -0,0 +1,190 @@
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+/**
+ * Session / token usage / model / version aggregator for OpenClaw
+ * (github.com/openclaw/openclaw — a multi-channel AI gateway, unrelated to Hermes/Nous Research
+ * despite Hermes shipping a `hermes claw migrate` path to import from it).
+ *
+ * OpenClaw keeps a session store per agent at
+ * ~/.openclaw/agents/<agentId>/sessions/sessions.json — a sessionKey -> SessionEntry map
+ * (see docs/reference/session-management-compaction.md in the openclaw package: "Session
+ * store schema"). SessionEntry carries both routing/identity fields (displayName, channel,
+ * groupChannel, groupId, lastAccountId, lastChannel, lastThreadId, lastTo, deliveryContext,
+ * origin — who the session's conversation partner was) and numeric/model fields (inputTokens,
+ * outputTokens, cacheRead, cacheWrite, totalTokens, model, modelProvider). This collector reads
+ * ONLY the numeric/model fields — the existing openclaw_sessions file type registration already
+ * treats this file's content as sensitive (collect_style="metadata", path+mtime only), so the
+ * routing/identity fields are never touched or returned here.
+ *
+ * Version comes from a scoped read of openclaw.json's top-level `meta.lastTouchedVersion` key
+ * only — never any other key (openclaw.json's other sections can carry messaging/provider
+ * settings).
+ *
+ * Auth method comes from a scoped read of openclaw.json's `auth.profiles.*` entries — each
+ * profile is `{provider, mode}` (e.g. `{"provider": "anthropic", "mode": "api_key"}`); we read
+ * only those two keys, never any credential material (profiles carry no token/key fields to
+ * begin with). Exposed per-provider so the extractor can match it against the provider actually
+ * observed in session usage.
+ *
+ * Only checks ~/.openclaw (the canonical root); the moltbot/clawdbot compatible-fork roots
+ * tracked by the presence/log file types are not covered here.
+ */
+const TOKEN_USAGE_RECENCY_DAYS = 30;
+const TOKEN_USAGE_FILE_TYPE = 'openclaw_token_usage';
+function emptyTotals() {
+    return { input_tokens: 0, output_tokens: 0, cache_read_input_tokens: 0 };
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : 0;
+}
+function str(value) {
+    return typeof value === 'string' ? value.trim() : '';
+}
+/** Every ~/.openclaw/agents/<agentId>/sessions/sessions.json that exists. */
+function discoverSessionsStores(openclawDir) {
+    const agentsDir = join(openclawDir, 'agents');
+    let entries;
+    try {
+        entries = readdirSync(agentsDir, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const storePath = join(agentsDir, entry.name, 'sessions', 'sessions.json');
+        if (existsSync(storePath))
+            out.push(storePath);
+    }
+    return out;
+}
+/**
+ * Scoped read of one sessions.json store: only numeric/model fields per SessionEntry, bounded
+ * to the recency window. See the module docstring for the fields this deliberately never reads.
+ */
+function readSessionsStore(storePath, cutoffMs, acc) {
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(storePath, 'utf8'));
+    }
+    catch {
+        return;
+    }
+    if (!raw || typeof raw !== 'object')
+        return;
+    for (const value of Object.values(raw)) {
+        if (!value || typeof value !== 'object')
+            continue;
+        const entry = value;
+        // updatedAt is Unix epoch *milliseconds*, matching cutoffMs below (unlike Hermes's
+        // started_at, which is epoch seconds). Confirmed against a real sessions.json: a raw
+        // value of 1772443946772 resolves to 2026-03-02T09:32:26.772Z, the correct magnitude
+        // for epoch-ms — a seconds value at that date would be ~10 digits, not 13.
+        if (num(entry.updatedAt) < cutoffMs)
+            continue;
+        const sessionId = str(entry.sessionId);
+        if (sessionId)
+            acc.sessionIds.add(sessionId);
+        const model = str(entry.model);
+        const provider = str(entry.modelProvider);
+        if (model)
+            acc.models.add(model);
+        if (provider)
+            acc.providers.add(provider);
+        const input = num(entry.inputTokens);
+        const output = num(entry.outputTokens);
+        const cacheRead = num(entry.cacheRead);
+        acc.totals.input_tokens += input;
+        acc.totals.output_tokens += output;
+        acc.totals.cache_read_input_tokens += cacheRead;
+        const sum = input + output + cacheRead;
+        if (model && sum > 0) {
+            acc.modelTokenSplit[model] = (acc.modelTokenSplit[model] ?? 0) + sum;
+        }
+    }
+}
+/** Scoped read of openclaw.json's top-level `meta.lastTouchedVersion` key only. */
+function readVersion(openclawDir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
+        const meta = raw.meta;
+        return meta && typeof meta === 'object'
+            ? str(meta.lastTouchedVersion)
+            : '';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Scoped read of openclaw.json's `auth.profiles` — provider + mode only, never credentials
+ * (the profiles carry no token/key fields). Returns a provider -> mode map (e.g.
+ * `{"anthropic": "api_key"}`); a provider with multiple profiles keeps the last one read.
+ */
+function readAuthModesByProvider(openclawDir) {
+    try {
+        const raw = JSON.parse(readFileSync(join(openclawDir, 'openclaw.json'), 'utf8'));
+        const auth = raw.auth;
+        const profiles = auth && typeof auth === 'object' ? auth.profiles : undefined;
+        const out = {};
+        if (profiles && typeof profiles === 'object') {
+            for (const value of Object.values(profiles)) {
+                if (!value || typeof value !== 'object')
+                    continue;
+                const entry = value;
+                const provider = str(entry.provider);
+                const mode = str(entry.mode);
+                if (provider && mode)
+                    out[provider] = mode;
+            }
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Aggregate OpenClaw session count / token usage / models / providers / version across every
+ * agent dir's sessions.json store. Returns a single-element array (one per-machine aggregate)
+ * or [] when there is no recent session data.
+ */
+function collectOpenclawTokenUsage(home = homedir()) {
+    const openclawDir = join(home, '.openclaw');
+    const stores = discoverSessionsStores(openclawDir);
+    if (stores.length === 0)
+        return [];
+    const cutoffMs = Date.now() - TOKEN_USAGE_RECENCY_DAYS * 24 * 60 * 60 * 1000;
+    const acc = {
+        sessionIds: new Set(),
+        models: new Set(),
+        providers: new Set(),
+        totals: emptyTotals(),
+        modelTokenSplit: {},
+    };
+    for (const store of stores) {
+        readSessionsStore(store, cutoffMs, acc);
+    }
+    if (acc.sessionIds.size === 0)
+        return [];
+    return [
+        {
+            file_type: TOKEN_USAGE_FILE_TYPE,
+            file_path: openclawDir,
+            raw_content: {
+                version: readVersion(openclawDir),
+                session_count: acc.sessionIds.size,
+                models: [...acc.models].sort(),
+                providers: [...acc.providers].sort(),
+                model_token_split: acc.modelTokenSplit,
+                window_days: TOKEN_USAGE_RECENCY_DAYS,
+                totals: acc.totals,
+                auth_modes_by_provider: readAuthModesByProvider(openclawDir),
+            },
+        },
+    ];
+}
+export { collectOpenclawTokenUsage, TOKEN_USAGE_RECENCY_DAYS, TOKEN_USAGE_FILE_TYPE };