tokentrace 0.10.1 → 0.11.0

package/CHANGELOG.md

@@ -4,7 +4,27 @@ All notable changes to TokenTrace are documented here.
 
 ## Unreleased
 
-No unreleased changes yet.
+## [0.11.0] - 2026-05-18
+
+### Added
+
+- `npm run security:ioc` scans project files and local Claude/VS Code hook files for high-signal Mini Shai-Hulud/TanStack supply-chain indicators before release.
+- Tokenizer-backed estimates for recognized OpenAI/Codex and Claude-family model names, with explicit `tokenizer estimate` and `simple estimate` confidence labels.
+- Native SQLite history ingestion for local usage databases with usage-shaped tables, source-file evidence, import-profile metadata, and source-provided cost preservation.
+- Data Confidence scoring on Overview, Projects, Sessions, and Session Timeline views, combining token source, cost coverage, parser confidence, and scan freshness.
+- Import Profiles in Settings so users can define safe local wrapper-log matchers without writing parser code.
+- Repair Workbench bulk actions for marking visible unknown-cost groups verified, parser-review, ignored, or reopened.
+- Supply-chain IOC status in Scan Health, backed by the same local `security:ioc` scanner used by release checks.
+
+### Changed
+
+- Session Timeline pages now explain token spikes, model changes, cache activity, cost coverage, confidence drivers, and direct unknown-cost repair links.
+- Scan Health now distinguishes exact, tokenizer-estimated, simple-estimated, high-confidence, low-confidence, and unknown token rows.
+- The roadmap API and CLI now report the 0.11.0 Accuracy & Evidence release contract.
+
+### Fixed
+
+- Source-provided interaction costs are no longer overwritten as unknown during post-scan cost recalculation when model rates are missing.
 
 ## [0.10.1] - 2026-05-18
 

package/README.md

@@ -4,7 +4,7 @@
 
 # TokenTrace CLI
 
-Local-first AI CLI usage analytics. TokenTrace scans local CLI logs, normalizes token usage, estimates missing counts, and shows cost, model, project, and session analytics in a browser dashboard.
+Local-first AI CLI usage analytics. TokenTrace scans local CLI logs and local usage databases, normalizes token usage, estimates missing counts with confidence labels, and shows cost, model, project, session, repair, and evidence analytics in a browser dashboard.
 
 TokenTrace is designed for local development machines first, with macOS-oriented defaults. It does not require a cloud account and does not send telemetry or logs anywhere.
 
@@ -40,7 +40,7 @@ tokentrace agent --json # Print machine-readable agent discovery manifest
 tokentrace capabilities --json
                         # Alias for agent discovery manifest
 tokentrace roadmap --json
-                        # Print Guided Operator release implementation status
+                        # Print Accuracy & Evidence release implementation status
 tokentrace scan         # Scan local AI CLI usage logs
 tokentrace doctor --json
                         # Inspect scan health and repair recommendations
@@ -114,7 +114,7 @@ curl http://127.0.0.1:3030/api/agent
 curl http://127.0.0.1:3030/api/capabilities
 ```
 
-The Guided Operator release status is also machine-readable:
+The Accuracy & Evidence release status is also machine-readable:
 
 ```bash
 tokentrace roadmap --json
@@ -149,12 +149,28 @@ npm run verify       # Run Vitest, TypeScript, and ESLint checks
 npm run package:test # Verify, build, and dry-run the npm package
 npm run package:inspect
                     # Check package transparency guardrails
+npm run security:ioc
+                    # Scan lockfiles, workflows, and local AI-tool hooks for supply-chain IOCs
 npm run smoke:packed
                     # Inspect packed tarball and smoke test packed CLI
 tokentrace roadmap --json
                     # Inspect evidence gates and release status
 ```
 
+## Accuracy And Evidence
+
+TokenTrace labels the trust level behind imported numbers:
+
+- exact provider token counts
+- tokenizer estimates for recognized OpenAI/Codex and Claude-family model names
+- simple estimates when only text-like content is available
+- source-provided costs from local SQLite histories
+- unknown cost repair groups when model, token, or rate evidence is missing
+
+The dashboard surfaces a Data Confidence score on Overview, Projects, Sessions,
+and Session Timeline pages. Scan Health also includes a supply-chain IOC check
+so package trust is visible in the product, not only in release scripts.
+
 Release work uses internal milestone commits until the next public minor
 release. See [docs/RELEASE_CHECKLIST.md](docs/RELEASE_CHECKLIST.md) before
 bumping versions, tagging, creating GitHub releases, or publishing npm.
@@ -324,6 +340,7 @@ Stop the server with `Ctrl+C` in the terminal where `tokentrace` is running.
 - The published package ships readable application source and the compiled CLI runtime, not generated `.next/server` route bundles.
 - `tokentrace serve` prepares the local dashboard build in the user's TokenTrace app-data directory the first time it is needed.
 - `npm run package:inspect` fails if generated Next.js build output appears in the published tarball.
+- `npm run security:ioc` scans lockfiles, workflows, and local Claude/VS Code hook files for high-signal supply-chain compromise indicators.
 - Public npm publishing is configured through GitHub Actions Trusted Publishing and provenance from version tags.
 - Socket GitHub checks and ProjScan are used as release guardrails, alongside `npm audit --audit-level=moderate`.
 - Release notes are published directly in GitHub Releases from the relevant changelog section, not as a link-only summary.

package/SECURITY.md

@@ -40,8 +40,12 @@ When running from source, the default development database is
 ## Release Trust
 
 Public package releases are built from Git tags. The release flow includes
-package inspection, production dependency audit, ProjScan checks, and npm
-Trusted Publishing through GitHub Actions.
+package inspection, supply-chain IOC scanning, production dependency audit,
+ProjScan checks, and npm Trusted Publishing through GitHub Actions.
+
+Run `npm run security:ioc` to check lockfiles, GitHub Actions workflows, and
+local Claude/VS Code hook files for high-signal Mini Shai-Hulud/TanStack-style
+indicators before release or after a dependency scare.
 
 ## Reporting
 

package/app/api/repair-items/route.ts

@@ -1,5 +1,6 @@
 import { NextResponse } from "next/server";
 import {
+  bulkUpdateUnknownCostRepairs,
   buildUnknownCostRepairWorkbench,
   getUnknownCostReview,
   saveUnknownCostReview,
@@ -40,9 +41,30 @@ export async function PUT(request: Request) {
     return NextResponse.json({ error: parsed.error }, { status: 400 });
   }
   const body = parsed.body;
+  const keys = Array.isArray(body.keys)
+    ? body.keys.map((value) => text(value, 1000)).filter(Boolean)
+    : [];
   const key = text(body.key, 1000);
   const status = reviewState(body.status ?? body.state);
 
+  if (keys.length) {
+    if (!status) {
+      return NextResponse.json({ error: "status must be unresolved, ignored, resolved, or needs-parser-review" }, { status: 400 });
+    }
+    const currentKeys = new Set(buildUnknownCostRepairWorkbench().groups.map((group) => group.key));
+    const missingKey = keys.find((item) => !currentKeys.has(item) && !getUnknownCostReview(item)?.updatedAt);
+    if (missingKey) {
+      return NextResponse.json({ error: "one or more repair keys were not found in current workbench evidence" }, { status: 404 });
+    }
+    return NextResponse.json(
+      bulkUpdateUnknownCostRepairs({
+        keys,
+        status,
+        notes: text(body.notes ?? body.note, 500)
+      })
+    );
+  }
+
   if (!key) {
     return NextResponse.json({ error: "key is required" }, { status: 400 });
   }

package/app/api/settings/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { getDatabasePath } from "@/src/db/client";
 import { getAppSettings, normalizeUsageGuardrails, saveAppSettings } from "@/src/db/settings";
 import { jsonBooleanFlag, readJsonObject } from "@/src/lib/api-json";
+import { normalizeImportProfiles } from "@/src/lib/import-profiles";
 
 export const dynamic = "force-dynamic";
 
@@ -27,7 +28,8 @@ export async function PUT(request: Request) {
   const saved = saveAppSettings({
     customFolders,
     storeRawMessageContent: jsonBooleanFlag(body.storeRawMessageContent),
-    usageGuardrails: normalizeUsageGuardrails(body.usageGuardrails)
+    usageGuardrails: normalizeUsageGuardrails(body.usageGuardrails),
+    importProfiles: normalizeImportProfiles(body.importProfiles)
   });
 
   return NextResponse.json(saved);

package/app/diagnostics/page.tsx

@@ -7,8 +7,10 @@ import { DataValue, FieldLabel, MonoText, PageHeader } from "@/components/ui/typ
 import { ScanHealthSummary } from "@/components/scan-health-summary";
 import { getAnalyticsData, getScanTrustData, type DebugScanRun } from "@/src/lib/analytics";
 import { buildDoctorReport, type DoctorReport } from "@/src/lib/doctor";
+import { buildScanHealth } from "@/src/lib/scan-health";
 import { getDefaultSearchRoots } from "@/src/ingestion/discovery";
 import { formatDate } from "@/src/lib/format";
+import { getSupplyChainHealth } from "@/src/lib/supply-chain-health";
 
 export const dynamic = "force-dynamic";
 
@@ -461,7 +463,17 @@ function ScanHistoryPanel({ scanRuns }: { scanRuns: DebugScanRun[] }) {
 }
 
 export default async function DiagnosticsPage() {
-  const data = getScanTrustData();
+  const baseData = getScanTrustData();
+  const supplyChain = getSupplyChainHealth();
+  const data = {
+    ...baseData,
+    health: buildScanHealth({
+      scanRuns: baseData.scanRuns,
+      scanFiles: baseData.scanFiles,
+      confidence: baseData.confidence,
+      supplyChain
+    })
+  };
   const analytics = getAnalyticsData();
   const roots = await getDefaultSearchRoots();
   const doctorReport = buildDoctorReport({

package/app/guide/page.tsx

@@ -168,6 +168,11 @@ const workflows = [
     problem: "Parser warnings",
     path: "Parsers, Discovery, Scan Health",
     action: "Check parser confidence, unsupported files, and imported-with-errors rows before trusting an adapter."
+  },
+  {
+    problem: "Package trust check",
+    path: "Scan Health",
+    action: "Review the supply-chain IOC check alongside parser and model-rate health before release or upgrade work."
   }
 ];
 
@@ -175,7 +180,7 @@ const pageMap = [
   ["Overview", "Top-level totals, trends, repair queue, guardrails, and recommended next actions."],
   ["Sessions", "Per-session evidence with models, costs, cache activity, parser provenance, and tool calls."],
   ["Model Rates", "Editable provider model rates used for dashboard cost estimates and unknown-cost repair."],
-  ["Scan Health", "First-run checklist, scan health, supported file types, and diagnostics for missing data."],
+  ["Scan Health", "First-run checklist, scan health, supply-chain IOC check, supported file types, and diagnostics for missing data."],
   ["Discovery", "Recently scanned files grouped by parser, source family, status, and import yield."],
   ["Parsers", "Adapter choices, warnings, confidence, and parser repair clues for local files."]
 ];
@@ -483,8 +488,8 @@ export default function GuidePage() {
                   <h3 className="text-sm font-semibold leading-tight">Release readiness</h3>
                 </div>
                 <p className="mt-2 text-sm leading-6 text-muted-foreground">
-                  Current package version is {roadmapStatus.packageVersion}. The 0.10.0 roadmap is released, and 0.10.1 carries
-                  the current guide, scan, evidence, and overview polish.
+                  Current package version is {roadmapStatus.packageVersion}. The current roadmap focuses on accuracy, evidence,
+                  repair workflow, import profiles, and package-trust checks.
                 </p>
                 <div className="mt-4 grid grid-cols-2 gap-3 text-sm">
                   <div>

package/app/page.tsx

@@ -26,6 +26,7 @@ import { buildPostSessionReview, type PostSessionReview } from "@/src/lib/post-s
 export const dynamic = "force-dynamic";
 
 type UsageComparison = ReturnType<typeof getAnalyticsData>["comparison"];
+type DataConfidence = ReturnType<typeof getAnalyticsData>["dataConfidence"];
 
 function CostSessionsMetricPane({
   label,
@@ -638,6 +639,41 @@ function UsagePulsePanel({ comparison }: { comparison: UsageComparison }) {
   );
 }
 
+function confidenceVariant(grade: DataConfidence["grade"]) {
+  if (grade === "high") return "success";
+  if (grade === "medium") return "warning";
+  if (grade === "low") return "destructive";
+  return "secondary";
+}
+
+function DataConfidenceStrip({ confidence }: { confidence: DataConfidence }) {
+  return (
+    <Card>
+      <CardContent className="flex flex-col gap-3 p-4 lg:flex-row lg:items-center lg:justify-between">
+        <div className="min-w-0">
+          <div className="flex flex-wrap items-center gap-2">
+            <div className="text-sm font-semibold">Data Confidence</div>
+            <Badge variant={confidenceVariant(confidence.grade)}>{confidence.score}/100 {confidence.grade}</Badge>
+          </div>
+          <p className="mt-1 text-sm leading-6 text-muted-foreground">
+            {confidence.drivers.slice(0, 2).join(" ")}
+          </p>
+        </div>
+        <div className="flex flex-wrap gap-2">
+          {confidence.repairHref ? (
+            <Button asChild variant="outline" size="sm">
+              <Link href={confidence.repairHref}>Open repair <ArrowRight className="h-4 w-4" /></Link>
+            </Button>
+          ) : null}
+          <Button asChild variant="outline" size="sm">
+            <Link href="/diagnostics">Open Scan Health <ArrowRight className="h-4 w-4" /></Link>
+          </Button>
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
+
 function guardrailBadgeVariant(status: UsageGuardrailMetric["status"]) {
   if (status === "exceeded") return "destructive";
   if (status === "warning") return "warning";
@@ -934,6 +970,8 @@ export default async function OverviewPage({ searchParams }: OverviewPageProps)
 
       <UsagePulsePanel comparison={data.comparison} />
 
+      <DataConfidenceStrip confidence={data.dataConfidence} />
+
       <div className="grid gap-3 md:grid-cols-2 xl:grid-cols-6">
         <TokenAccountingCard
           summary={summary}

package/app/projects/page.tsx

@@ -12,6 +12,13 @@ import { formatCurrency, formatDate, formatTokens } from "@/src/lib/format";
 
 export const dynamic = "force-dynamic";
 
+function confidenceVariant(grade: string) {
+  if (grade === "high") return "success";
+  if (grade === "medium") return "warning";
+  if (grade === "low") return "destructive";
+  return "secondary";
+}
+
 export default function ProjectAnalyticsPage() {
   const data = getAnalyticsData();
   const mostExpensive = data.projects[0];
@@ -145,6 +152,7 @@ export default function ProjectAnalyticsPage() {
                 <TableHead>Cost</TableHead>
                 <TableHead>Sessions</TableHead>
                 <TableHead>Interactions</TableHead>
+                <TableHead>Confidence</TableHead>
                 <TableHead>Output/Input</TableHead>
                 <TableHead>Last used</TableHead>
               </TableRow>
@@ -164,6 +172,11 @@ export default function ProjectAnalyticsPage() {
                   <TableCell>{formatCurrency(project.cost)}</TableCell>
                   <TableCell>{project.sessions.toLocaleString()}</TableCell>
                   <TableCell>{project.interactions.toLocaleString()}</TableCell>
+                  <TableCell>
+                    <Badge variant={confidenceVariant(project.confidenceGrade ?? "empty")}>
+                      {project.confidenceScore ?? 0}/100 {project.confidenceGrade ?? "empty"}
+                    </Badge>
+                  </TableCell>
                   <TableCell>{project.outputInputRatio.toFixed(2)}x</TableCell>
                   <TableCell>{formatDate(project.lastUsedAt)}</TableCell>
                 </TableRow>

package/app/repair/page.tsx

@@ -2,6 +2,7 @@ import Link from "next/link";
 import { ArrowRight, CheckCircle2, CircleDashed, Search, Settings2 } from "lucide-react";
 import { EmptyState } from "@/components/empty-state";
 import { PeriodFilter } from "@/components/period-filter";
+import { RepairBulkActions } from "@/components/repair-bulk-actions";
 import { RepairStateControl } from "@/components/repair-state-control";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
@@ -257,99 +258,98 @@ export default async function RepairPage({ searchParams }: RepairPageProps) {
         </CardHeader>
         <CardContent className="table-scroll overflow-x-auto">
           {hasGroups ? (
-            <Table className="min-w-[84rem]">
-              <TableHeader>
-                <TableRow>
-                  <TableHead>State</TableHead>
-                  <TableHead>Cause</TableHead>
-                  <TableHead className="min-w-56">Model</TableHead>
-                  <TableHead className="min-w-72">Suggestion</TableHead>
-                  <TableHead className="min-w-80">Source</TableHead>
-                  <TableHead>Interactions</TableHead>
-                  <TableHead>Tokens</TableHead>
-                  <TableHead className="min-w-28">Actions</TableHead>
-                </TableRow>
-              </TableHeader>
-              <TableBody>
-                {workbench.groups.map((group) => (
-                  <TableRow key={group.key} className={focusKey === group.key ? "bg-muted/40" : undefined}>
-                    <TableCell className="align-top">
-                      <RepairStateControl
-                        repairKey={group.key}
-                        initialStatus={group.review.status}
-                        initialNotes={group.review.notes}
-                        sourceFile={group.sourceFile}
-                        model={group.model}
-                        provider={group.provider}
-                        cause={group.cause}
-                      />
-                    </TableCell>
-                    <TableCell className="align-top">
-                      <Badge variant={causeVariant(group.cause)}>{causeLabel(group.cause)}</Badge>
-                    </TableCell>
-                    <TableCell className="align-top">
-                      <div className="font-medium">{group.model}</div>
-                      <div className="mt-1 text-xs text-muted-foreground">{group.provider} / {group.tool}</div>
-                    </TableCell>
-                    <TableCell className="min-w-72 max-w-80 align-top">
-                      <div className="flex items-center gap-2 text-sm font-medium">
-                        {group.suggestion.suggestedModel ? (
-                          <CheckCircle2 className="h-4 w-4 text-primary" />
-                        ) : (
-                          <CircleDashed className="h-4 w-4 text-muted-foreground" />
-                        )}
-                        {suggestionLabel(group)}
-                      </div>
-                      <div className="mt-1 text-xs leading-relaxed text-muted-foreground">
-                        {group.suggestion.confidence} confidence. {group.suggestion.reason}
-                      </div>
-                    </TableCell>
-                    <TableCell className="max-w-96 align-top">
-                      <Link href={mergeHrefParams(group.sourceHref, rangeLinkParams)} title={group.sourceFile}>
-                        <MonoText className="block truncate text-xs text-muted-foreground underline-offset-4 hover:underline">
-                          {group.sourceFile}
-                        </MonoText>
-                      </Link>
-                    </TableCell>
-                    <TableCell className="align-top">{group.interactions.toLocaleString()}</TableCell>
-                    <TableCell className="min-w-28 align-top">
-                      <div>{formatTokens(group.totalTokens)}</div>
-                      <div className="mt-1 text-xs text-muted-foreground">
-                        {formatTokens(group.inputTokens)} in, {formatTokens(group.outputTokens)} out
-                      </div>
-                    </TableCell>
-                    <TableCell className="align-top">
-                      <div className="flex flex-wrap gap-2">
-                        <Link
-                          href={
-                            group.pricingHref
-                              ? mergeHrefParams(group.pricingHref, { returnTo: mergeHrefParams(group.itemHref, rangeLinkParams) })
-                              : mergeHrefParams(group.repairHref, rangeLinkParams)
-                          }
-                          className="inline-flex items-center gap-1 font-medium text-primary underline-offset-4 hover:underline"
-                        >
-                          {group.pricingHref ? "Set model rate" : "Review parser"} <ArrowRight className="h-3.5 w-3.5" />
-                        </Link>
-                        <Link href={mergeHrefParams(group.itemHref, rangeLinkParams)} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
-                          Open repair
-                        </Link>
-                        <Link href={mergeHrefParams(group.parserHref, rangeLinkParams)} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
-                          Review parser
+            <div className="space-y-3">
+              <RepairBulkActions
+                keys={workbench.groups.map((group) => group.key)}
+                modelRatesHref={mergeHrefParams("/pricing", rangeLinkParams)}
+                scanHealthHref="/diagnostics"
+              />
+              <Table className="min-w-[84rem]">
+                <TableHeader>
+                  <TableRow>
+                    <TableHead>State</TableHead>
+                    <TableHead>Cause</TableHead>
+                    <TableHead className="min-w-56">Model</TableHead>
+                    <TableHead className="min-w-72">Suggestion</TableHead>
+                    <TableHead className="min-w-80">Source</TableHead>
+                    <TableHead>Interactions</TableHead>
+                    <TableHead>Tokens</TableHead>
+                    <TableHead className="min-w-28">Actions</TableHead>
+                  </TableRow>
+                </TableHeader>
+                <TableBody>
+                  {workbench.groups.map((group) => (
+                    <TableRow key={group.key} className={focusKey === group.key ? "bg-muted/40" : undefined}>
+                      <TableCell className="align-top">
+                        <RepairStateControl
+                          repairKey={group.key}
+                          initialStatus={group.review.status}
+                          initialNotes={group.review.notes}
+                          sourceFile={group.sourceFile}
+                          model={group.model}
+                          provider={group.provider}
+                          cause={group.cause}
+                        />
+                      </TableCell>
+                      <TableCell className="align-top">
+                        <Badge variant={causeVariant(group.cause)}>{causeLabel(group.cause)}</Badge>
+                      </TableCell>
+                      <TableCell className="align-top">
+                        <div className="font-medium">{group.model}</div>
+                        <div className="mt-1 text-xs text-muted-foreground">{group.provider} / {group.tool}</div>
+                      </TableCell>
+                      <TableCell className="min-w-72 max-w-80 align-top">
+                        <div className="flex items-center gap-2 text-sm font-medium">
+                          {group.suggestion.suggestedModel ? (
+                            <CheckCircle2 className="h-4 w-4 text-primary" />
+                          ) : (
+                            <CircleDashed className="h-4 w-4 text-muted-foreground" />
+                          )}
+                          {suggestionLabel(group)}
+                        </div>
+                        <div className="mt-1 text-xs leading-relaxed text-muted-foreground">
+                          {group.suggestion.confidence} confidence. {group.suggestion.reason}
+                        </div>
+                      </TableCell>
+                      <TableCell className="max-w-96 align-top">
+                        <Link href={mergeHrefParams(group.sourceHref, rangeLinkParams)} title={group.sourceFile}>
+                          <MonoText className="block truncate text-xs text-muted-foreground underline-offset-4 hover:underline">
+                            {group.sourceFile}
+                          </MonoText>
                         </Link>
-                        {group.pricingHref ? (
-                          <Link href={mergeHrefParams(group.pricingHref, { returnTo: mergeHrefParams(group.itemHref, rangeLinkParams) })} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
-                            Set model rate
+                      </TableCell>
+                      <TableCell className="align-top">{group.interactions.toLocaleString()}</TableCell>
+                      <TableCell className="min-w-28 align-top">
+                        <div>{formatTokens(group.totalTokens)}</div>
+                        <div className="mt-1 text-xs text-muted-foreground">
+                          {formatTokens(group.inputTokens)} in, {formatTokens(group.outputTokens)} out
+                        </div>
+                      </TableCell>
+                      <TableCell className="align-top">
+                        <div className="flex flex-wrap gap-2">
+                          <Link
+                            href={
+                              group.pricingHref
+                                ? mergeHrefParams(group.pricingHref, { returnTo: mergeHrefParams(group.itemHref, rangeLinkParams) })
+                                : mergeHrefParams(group.repairHref, rangeLinkParams)
+                            }
+                            className="inline-flex items-center gap-1 font-medium text-primary underline-offset-4 hover:underline"
+                          >
+                            {group.pricingHref ? "Set model rate" : "Review parser"} <ArrowRight className="h-3.5 w-3.5" />
                           </Link>
-                        ) : null}
-                        <Link href={mergeHrefParams(group.sourceHref, rangeLinkParams)} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
-                          View evidence
-                        </Link>
-                      </div>
-                    </TableCell>
-                  </TableRow>
-                ))}
-              </TableBody>
-            </Table>
+                          <Link href={mergeHrefParams(group.itemHref, rangeLinkParams)} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
+                            Open repair
+                          </Link>
+                          <Link href={mergeHrefParams(group.sourceHref, rangeLinkParams)} className="font-medium text-muted-foreground underline-offset-4 hover:underline">
+                            View evidence
+                          </Link>
+                        </div>
+                      </TableCell>
+                    </TableRow>
+                  ))}
+                </TableBody>
+              </Table>
+            </div>
           ) : (
             <EmptyState
               title="No unknown-cost repair items"

package/app/sessions/[id]/page.tsx

@@ -22,6 +22,13 @@ function eventLabel(kind: SessionTimelineEventKind) {
   return kind.replace(/-/g, " ");
 }
 
+function confidenceVariant(grade: string) {
+  if (grade === "high") return "success";
+  if (grade === "medium") return "warning";
+  if (grade === "low") return "destructive";
+  return "secondary";
+}
+
 function SummaryTile({
   label,
   value,
@@ -146,6 +153,58 @@ export default async function SessionTimelinePage({
         />
       </div>
 
+      <Card>
+        <CardHeader className="flex flex-col gap-3 lg:flex-row lg:items-start lg:justify-between">
+          <div>
+            <CardTitle>Session Evidence</CardTitle>
+            <CardDescription>
+              Why this session costs what it costs, which token counts are exact or estimated, and what can be repaired.
+            </CardDescription>
+          </div>
+          <Badge variant={confidenceVariant(timeline.confidence.grade)}>
+            {timeline.confidence.score}/100 {timeline.confidence.grade} confidence
+          </Badge>
+        </CardHeader>
+        <CardContent className="grid gap-4 border-t p-4 lg:grid-cols-[1.2fr_0.8fr]">
+          <div className="grid gap-3 sm:grid-cols-3">
+            <div>
+              <FieldLabel>Token source</FieldLabel>
+              <div className="mt-1 text-sm font-medium">
+                {timeline.confidence.exactTokenInteractions.toLocaleString()} exact /{" "}
+                {timeline.confidence.tokenizerEstimateInteractions.toLocaleString()} tokenizer /{" "}
+                {timeline.confidence.simpleEstimateInteractions.toLocaleString()} simple
+              </div>
+            </div>
+            <div>
+              <FieldLabel>Cost coverage</FieldLabel>
+              <div className="mt-1 text-sm font-medium">
+                {timeline.confidence.pricedCostInteractions.toLocaleString()} priced /{" "}
+                {timeline.confidence.unknownCostInteractions.toLocaleString()} unknown
+              </div>
+            </div>
+            <div>
+              <FieldLabel>Spike clues</FieldLabel>
+              <div className="mt-1 text-sm font-medium">
+                {timeline.spikes.length ? `${timeline.spikes.length.toLocaleString()} token spikes` : "No token spikes"}
+              </div>
+            </div>
+          </div>
+          <div className="rounded-md border bg-muted/20 p-3">
+            <FieldLabel>Next repair step</FieldLabel>
+            <div className="mt-1 text-sm text-muted-foreground">
+              {timeline.repair.repairHref
+                ? `Unknown cost cause: ${timeline.repair.unknownCostCause}. Open the repair workbench for this source.`
+                : "No session-specific cost repair is required."}
+            </div>
+            {timeline.repair.repairHref ? (
+              <Button asChild size="sm" variant="outline" className="mt-3">
+                <Link href={timeline.repair.repairHref}>Open repair</Link>
+              </Button>
+            ) : null}
+          </div>
+        </CardContent>
+      </Card>
+
       <Card>
         <CardHeader>
           <CardTitle>Timeline</CardTitle>

package/bin/tokentrace.js

@@ -30,7 +30,7 @@ Usage:
   tokentrace capabilities --json
                           Alias for agent discovery manifest
   tokentrace roadmap --json
-                          Print Guided Operator release implementation status
+                          Print Accuracy & Evidence release implementation status
   tokentrace scan         Scan local AI CLI usage logs
   tokentrace doctor --json
                           Inspect scan health and repair recommendations