tokentrace 0.8.0 → 0.8.1

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to TokenTrace are documented here.
 
+## [0.8.1] - 2026-05-13
+
+### Fixed
+
+- Codex CLI imports now read exact `token_count` totals, including cached input and reasoning output tokens, so cleared Codex sessions are no longer undercounted.
+- Claude Code and Codex session artifacts can exceed the generic file-size cap without being skipped during discovery.
+- OpenAI-style, Claude-style, and generic usage parsers now normalize cached, cache-write, and reasoning token fields without double-counting them.
+- Parser-version-aware rescans now reprocess stale imports, and source-file replacement is atomic so a failed replacement cannot delete prior trusted sessions.
+- Unknown-cost cause summaries now assign each interaction to one primary cause instead of overlapping buckets.
+- Pricing, scan, settings, repair, and pricing-refresh APIs now reject malformed JSON with clean 400 responses.
+- Manual pricing saves now reject blank model/provider names and invalid numeric prices instead of silently storing unknown prices.
+- CLI commands now reject unknown flags across scan, pricing refresh, status, doctor, digest, and insights commands.
+- Local release checks now run ProjScan through `projscan@latest`, matching the GitHub security workflow guardrail.
+
 ## [0.8.0] - 2026-05-12
 
 ### Added

package/app/api/prices/refresh/route.ts

@@ -1,10 +1,15 @@
 import { NextResponse } from "next/server";
+import { readJsonObject } from "@/src/lib/api-json";
 import { refreshPricing } from "@/src/lib/pricing-refresh";
 
 export const dynamic = "force-dynamic";
 
 export async function POST(request: Request) {
-  const body = await request.json().catch(() => ({}));
+  const parsed = await readJsonObject(request);
+  if (!parsed.ok) {
+    return NextResponse.json({ error: parsed.error }, { status: 400 });
+  }
+  const body = parsed.body;
   const result = await refreshPricing({
     source: body?.source === "bundled" ? "bundled" : "remote",
     force: Boolean(body?.force)

package/app/api/prices/route.ts

@@ -1,12 +1,21 @@
 import { NextResponse } from "next/server";
+import { readJsonObject } from "@/src/lib/api-json";
 import { getPricingRows, upsertPricing } from "@/src/lib/pricing";
 
 export const dynamic = "force-dynamic";
 
-function nullableNumber(value: unknown) {
-  if (value === "" || value == null) return null;
+function requiredText(value: unknown) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function nullablePrice(value: unknown, field: string) {
+  if (value == null) return { ok: true as const, value: null };
+  if (typeof value === "string" && value.trim() === "") return { ok: true as const, value: null };
   const number = Number(value);
-  return Number.isFinite(number) ? number : null;
+  if (!Number.isFinite(number) || number < 0) {
+    return { ok: false as const, error: `${field} must be a non-negative number or empty` };
+  }
+  return { ok: true as const, value: number };
 }
 
 export async function GET() {
@@ -14,20 +23,34 @@ export async function GET() {
 }
 
 export async function POST(request: Request) {
-  const body = await request.json();
-  if (!body.providerId || !body.model) {
+  const parsed = await readJsonObject(request);
+  if (!parsed.ok) {
+    return NextResponse.json({ error: parsed.error }, { status: 400 });
+  }
+  const body = parsed.body;
+  const providerId = requiredText(body.providerId);
+  const model = requiredText(body.model);
+  if (!providerId || !model) {
     return NextResponse.json({ error: "providerId and model are required" }, { status: 400 });
   }
+  const inputTokenPrice = nullablePrice(body.inputTokenPrice, "inputTokenPrice");
+  const outputTokenPrice = nullablePrice(body.outputTokenPrice, "outputTokenPrice");
+  const cachedInputTokenPrice = nullablePrice(body.cachedInputTokenPrice, "cachedInputTokenPrice");
+  const cacheWriteTokenPrice = nullablePrice(body.cacheWriteTokenPrice, "cacheWriteTokenPrice");
+  if (!inputTokenPrice.ok) return NextResponse.json({ error: inputTokenPrice.error }, { status: 400 });
+  if (!outputTokenPrice.ok) return NextResponse.json({ error: outputTokenPrice.error }, { status: 400 });
+  if (!cachedInputTokenPrice.ok) return NextResponse.json({ error: cachedInputTokenPrice.error }, { status: 400 });
+  if (!cacheWriteTokenPrice.ok) return NextResponse.json({ error: cacheWriteTokenPrice.error }, { status: 400 });
 
   const id = upsertPricing({
-    providerId: String(body.providerId),
-    providerName: body.providerName ? String(body.providerName) : undefined,
-    model: String(body.model),
-    inputTokenPrice: nullableNumber(body.inputTokenPrice),
-    outputTokenPrice: nullableNumber(body.outputTokenPrice),
-    cachedInputTokenPrice: nullableNumber(body.cachedInputTokenPrice),
-    cacheWriteTokenPrice: nullableNumber(body.cacheWriteTokenPrice),
-    currency: body.currency ? String(body.currency) : "USD"
+    providerId,
+    providerName: requiredText(body.providerName) || undefined,
+    model,
+    inputTokenPrice: inputTokenPrice.value,
+    outputTokenPrice: outputTokenPrice.value,
+    cachedInputTokenPrice: cachedInputTokenPrice.value,
+    cacheWriteTokenPrice: cacheWriteTokenPrice.value,
+    currency: requiredText(body.currency) || "USD"
   });
 
   return NextResponse.json({ id, costsRecalculated: true });

package/app/api/repair-items/route.ts

@@ -5,6 +5,7 @@ import {
   saveUnknownCostReview,
   type UnknownCostRepairStatus
 } from "@/src/lib/unknown-cost-repair";
+import { readJsonObject } from "@/src/lib/api-json";
 
 export const dynamic = "force-dynamic";
 
@@ -34,7 +35,11 @@ export async function GET() {
 }
 
 export async function PUT(request: Request) {
-  const body = await request.json();
+  const parsed = await readJsonObject(request);
+  if (!parsed.ok) {
+    return NextResponse.json({ error: parsed.error }, { status: 400 });
+  }
+  const body = parsed.body;
   const key = text(body.key, 1000);
   const status = reviewState(body.status ?? body.state);
 

package/app/api/scan/route.ts

@@ -1,10 +1,15 @@
 import { NextResponse } from "next/server";
 import { runScan } from "@/src/ingestion/scan";
+import { readJsonObject } from "@/src/lib/api-json";
 
 export const dynamic = "force-dynamic";
 
 export async function POST(request: Request) {
-  const body = await request.json().catch(() => ({}));
+  const parsed = await readJsonObject(request);
+  if (!parsed.ok) {
+    return NextResponse.json({ error: parsed.error }, { status: 400 });
+  }
+  const body = parsed.body;
   const result = await runScan({
     folders: Array.isArray(body.folders)
       ? body.folders.filter((folder: unknown): folder is string => typeof folder === "string")

package/app/api/settings/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { getDatabasePath } from "@/src/db/client";
 import { getAppSettings, normalizeUsageGuardrails, saveAppSettings } from "@/src/db/settings";
+import { readJsonObject } from "@/src/lib/api-json";
 
 export const dynamic = "force-dynamic";
 
@@ -12,7 +13,11 @@ export async function GET() {
 }
 
 export async function PUT(request: Request) {
-  const body = await request.json();
+  const parsed = await readJsonObject(request);
+  if (!parsed.ok) {
+    return NextResponse.json({ error: parsed.error }, { status: 400 });
+  }
+  const body = parsed.body;
   const customFolders = Array.isArray(body.customFolders)
     ? body.customFolders.filter((folder: unknown): folder is string => typeof folder === "string")
     : [];