tokentracker-cli 0.79.9 → 0.80.0

package/src/commands/sync.js

@@ -172,6 +172,18 @@ const CLOUD_CONVERSATIONS_BACKFILL_KEY = "cloudConversationsBackfill_2026_06";
 // ~/.codex/archived_sessions/ which sync does not scan) — clearing its bucket
 // would lose that history (ref the v6 ground-truth-repair data-loss incident).
 const CODEX_RESCAN_DEDUP_REPAIR_KEY = "codexRescanDedupRepair_2026_06";
+// One-time repair (#169 follow-up): forked Codex rollouts replay the parent
+// session's token history into the child file, and until the same-day burst
+// detector landed in rollout.js the parser counted those replayed rows as live
+// usage (PR #169's date guard only caught cross-day forks). Cursors sit at EOF
+// on every already-parsed file, so the forward fix alone never corrects the
+// inflated history. This re-runs the exact #187 guarded rebuild under a new key
+// — the rebuild re-parses every codex file with the CURRENT (fork-aware)
+// parser, so replay rows are excluded — and inherits all its safety properties
+// (unreproducible-session skip, atomic throwaway rebuild, queue strip, upload
+// offset reset for the cloud overwrite). Pre-gated: installs with no forked
+// rollout on disk carry no fork phantom and mark done without the rebuild.
+const CODEX_FORK_REPLAY_REPAIR_KEY = "codexForkReplayRepair_2026_07";
 const DROID_DUP_SESSION_REPAIR_KEY = "droidDupSessionInflationRepair_2026_06";
 const CODEX_COLD_SCAN_AUDIT_INTERVAL_MS = 24 * 60 * 60 * 1000;
 const CODEX_COLD_SCAN_AUDIT_MAX_SYNCS = 288;
@@ -405,7 +417,7 @@ async function cmdSync(argv) {
 
     if (isFullSourceScan) {
       await migrateRolloutCumulativeDeltaBuckets({ cursors, queuePath, rolloutFiles });
-      await repairCodexRescanInflation({
+      const codexRescanRepairRan = await repairCodexRescanInflation({
         cursors,
         queuePath,
         queueStatePath,
@@ -413,6 +425,15 @@ async function cmdSync(argv) {
         projectQueueStatePath,
         rolloutFiles,
       });
+      await repairCodexForkReplayInflation({
+        cursors,
+        queuePath,
+        queueStatePath,
+        projectQueuePath,
+        projectQueueStatePath,
+        rolloutFiles,
+        legacyRepairRan: codexRescanRepairRan,
+      });
       await repairDroidDuplicateSessionInflation({ cursors, queuePath, queueStatePath });
       await repairMimoClaudeMislabel({
         cursors,
@@ -2097,6 +2118,7 @@ module.exports = {
   migrateCursorUnknownBuckets,
   migrateRolloutCumulativeDeltaBuckets,
   repairCodexRescanInflation,
+  repairCodexForkReplayInflation,
   repairDroidDuplicateSessionInflation,
   repairMimoClaudeMislabel,
   reincludeClaudeMemObserverFiles,
@@ -2109,6 +2131,7 @@ module.exports = {
   CURSOR_UNKNOWN_MIGRATION_KEY,
   ROLLOUT_CUMULATIVE_DELTA_MIGRATION_KEY,
   CODEX_RESCAN_DEDUP_REPAIR_KEY,
+  CODEX_FORK_REPLAY_REPAIR_KEY,
   DROID_DUP_SESSION_REPAIR_KEY,
   CLAUDE_MEM_OBSERVER_REINCLUDE_KEY,
   GROK_APPEND_ONLY_REPAIR_MIGRATION_KEY,
@@ -3157,6 +3180,11 @@ async function repairCodexRescanInflation({
   projectQueuePath,
   projectQueueStatePath,
   rolloutFiles,
+  // The fork-replay repair (#169 follow-up) re-runs this exact rebuild under
+  // its own key: the rebuild always uses the CURRENT parser, so any parser fix
+  // shipped since the last run is applied to the rebuilt history.
+  migrationKey = CODEX_RESCAN_DEDUP_REPAIR_KEY,
+  uploadNote = "reset_after_codex_rescan_dedup_2026_06",
 }) {
   if (!cursors || typeof cursors !== "object") return false;
   const migrations = (cursors.migrations ||= {});
@@ -3167,7 +3195,7 @@ async function repairCodexRescanInflation({
   // found). Treating the skip sentinel as "done" is what left users like #187
   // permanently stuck on the inflated value after upgrading (the key was truthy
   // so the guard never got a second chance).
-  const priorRepair = migrations[CODEX_RESCAN_DEDUP_REPAIR_KEY];
+  const priorRepair = migrations[migrationKey];
   if (priorRepair && !(typeof priorRepair === "object" && priorRepair.skipped)) return false;
 
   // Codex session files THIS sync discovered (source === "codex").
@@ -3203,7 +3231,7 @@ async function repairCodexRescanInflation({
       if (codexFileSet.has(fp)) continue; // exact file re-scanned this run
       const id = codexSessionIdFromPath(fp);
       if (id && scannedSessionIds.has(id)) continue; // same session scanned elsewhere (moved)
-      migrations[CODEX_RESCAN_DEDUP_REPAIR_KEY] = {
+      migrations[migrationKey] = {
         skipped: true,
         reason: "codex_session_unreproducible",
         at: new Date().toISOString(),
@@ -3462,7 +3490,7 @@ async function repairCodexRescanInflation({
     }
     uploadState.offset = 0;
     uploadState.updatedAt = new Date().toISOString();
-    uploadState.note = "reset_after_codex_rescan_dedup_2026_06";
+    uploadState.note = uploadNote;
     await fs.writeFile(queueStatePath, JSON.stringify(uploadState));
   }
   if (projectRepairEnabled && typeof projectQueueStatePath === "string" && projectQueueStatePath) {
@@ -3474,14 +3502,140 @@ async function repairCodexRescanInflation({
     }
     uploadState.offset = 0;
     uploadState.updatedAt = new Date().toISOString();
-    uploadState.note = "reset_after_codex_rescan_dedup_2026_06";
+    uploadState.note = uploadNote;
     await fs.writeFile(projectQueueStatePath, JSON.stringify(uploadState));
   }
 
-  migrations[CODEX_RESCAN_DEDUP_REPAIR_KEY] = new Date().toISOString();
+  migrations[migrationKey] = new Date().toISOString();
   return true;
 }
 
+// #169 follow-up: repair the historical inflation left by same-day forked
+// Codex rollout replays (see CODEX_FORK_REPLAY_REPAIR_KEY). Delegates to the
+// #187 guarded rebuild with the fork-repair key.
+async function repairCodexForkReplayInflation({
+  cursors,
+  queuePath,
+  queueStatePath,
+  projectQueuePath,
+  projectQueueStatePath,
+  rolloutFiles,
+  // True when the #187 repair ran its rebuild earlier in THIS sync: that
+  // rebuild already used the fork-aware parser, so the history is clean and a
+  // second rebuild would be pure waste.
+  legacyRepairRan = false,
+}) {
+  if (!cursors || typeof cursors !== "object") return false;
+  const migrations = (cursors.migrations ||= {});
+  // Same completed-vs-skipped semantics as the #187 repair: an ISO string is
+  // final, a {skipped:true} sentinel retries (the skip condition can clear).
+  const prior = migrations[CODEX_FORK_REPLAY_REPAIR_KEY];
+  if (prior && !(typeof prior === "object" && prior.skipped)) return false;
+
+  if (legacyRepairRan) {
+    migrations[CODEX_FORK_REPLAY_REPAIR_KEY] = new Date().toISOString();
+    return false;
+  }
+
+  // Pre-gate: fork phantom can only exist on installs that have (or had) a
+  // forked rollout. Scanning file heads is cheap; the rebuild re-parses every
+  // codex file. Files forked AFTER the parser fix shipped never accrue
+  // phantom, so a definitive "no forks" verdict may finalize — but ONLY when
+  // this scan can actually stand for the install's whole codex history:
+  //   1. every candidate head was readable (an unreadable candidate could be
+  //      the one forked rollout), AND
+  //   2. every codex session recorded in cursors is covered by THIS scan's
+  //      file list (same UUID-keyed reproducibility rule as the #187 guard).
+  //      A forked rollout can be real yet absent from one run's rolloutFiles —
+  //      WSL/native split probing, a temporarily missing ~/.codex, a deleted
+  //      file whose phantom is already in history — and finalizing off such a
+  //      partial view would permanently foreclose the repair this migration
+  //      exists to perform, while the guarded repair itself would only have
+  //      deferred retryably.
+  // Either failure defers with the retryable {skipped:true} sentinel.
+  const forkScan = await scanForForkedCodexRollout(rolloutFiles);
+  if (!forkScan.forked) {
+    if (forkScan.indeterminate) {
+      migrations[CODEX_FORK_REPLAY_REPAIR_KEY] = {
+        skipped: true,
+        reason: "fork_scan_indeterminate",
+        at: new Date().toISOString(),
+      };
+      return false;
+    }
+    const scannedSessionIds = new Set();
+    const scannedPaths = new Set();
+    for (const entry of Array.isArray(rolloutFiles) ? rolloutFiles : []) {
+      const fp = typeof entry === "string" ? entry : entry?.path;
+      const src = typeof entry === "string" ? "codex" : String(entry?.source || "codex");
+      if (!fp || src !== "codex") continue;
+      scannedPaths.add(fp);
+      const id = codexSessionIdFromPath(fp);
+      if (id) scannedSessionIds.add(id);
+    }
+    if (cursors.files && typeof cursors.files === "object") {
+      for (const fp of Object.keys(cursors.files)) {
+        if (!isCodexSessionCursorPath(fp)) continue;
+        if (scannedPaths.has(fp)) continue;
+        const id = codexSessionIdFromPath(fp);
+        if (id && scannedSessionIds.has(id)) continue;
+        migrations[CODEX_FORK_REPLAY_REPAIR_KEY] = {
+          skipped: true,
+          reason: "codex_history_not_covered",
+          at: new Date().toISOString(),
+        };
+        return false;
+      }
+    }
+    migrations[CODEX_FORK_REPLAY_REPAIR_KEY] = new Date().toISOString();
+    return false;
+  }
+
+  return repairCodexRescanInflation({
+    cursors,
+    queuePath,
+    queueStatePath,
+    projectQueuePath,
+    projectQueueStatePath,
+    rolloutFiles,
+    migrationKey: CODEX_FORK_REPLAY_REPAIR_KEY,
+    uploadNote: "reset_after_codex_fork_replay_2026_07",
+  });
+}
+
+// Scans codex rollout heads for the fork marker. The child session_meta (with
+// forked_from_id) is the FIRST line of a forked rollout — observed at byte
+// offset ≤169 across every local sample — so a bounded head read is
+// sufficient. 64KB leaves ample margin for long base_instructions preceding
+// it; a substring false positive (the marker quoted in unrelated head content)
+// only costs one redundant guarded rebuild, never data. Tri-state result:
+// {forked:true} on a hit, {forked:false, indeterminate:false} only when every
+// candidate was inspected, {forked:false, indeterminate:true} when any head
+// read failed — the caller must not finalize "no forks" off a failed read.
+async function scanForForkedCodexRollout(rolloutFiles) {
+  const HEAD_BYTES = 65536;
+  let indeterminate = false;
+  for (const entry of Array.isArray(rolloutFiles) ? rolloutFiles : []) {
+    const fp = typeof entry === "string" ? entry : entry?.path;
+    const src = typeof entry === "string" ? "codex" : String(entry?.source || "codex");
+    if (!fp || src !== "codex") continue;
+    let fh = null;
+    try {
+      fh = await fs.open(fp, "r");
+      const buf = Buffer.alloc(HEAD_BYTES);
+      const { bytesRead } = await fh.read(buf, 0, HEAD_BYTES, 0);
+      if (buf.toString("utf8", 0, bytesRead).includes('"forked_from_id"')) {
+        return { forked: true, indeterminate: false };
+      }
+    } catch (_e) {
+      indeterminate = true;
+    } finally {
+      if (fh) await fh.close().catch(() => {});
+    }
+  }
+  return { forked: false, indeterminate };
+}
+
 function isCodexSessionCursorPath(filePath) {
   if (typeof filePath !== "string") return false;
   const normalized = filePath.replace(/\\/g, "/");

package/src/lib/local-api.js

@@ -1054,15 +1054,17 @@ function createLocalApiHandler({ queuePath }) {
   // sync is on. Cloud sync is a dashboard (WebView) preference persisted in
   // localStorage; the dashboard mirrors it here via POST
   // /functions/tokentracker-cloud-sync-pref so the auth-unaware popover can key
-  // off the same flag. Defaults OFF, exactly like the dashboard toggle.
+  // off the same flag. Defaults ON, exactly like the dashboard toggle — every
+  // consumer additionally requires a relayed refresh token, so the default only
+  // takes effect for signed-in users; an explicit {enabled:false} still wins.
   const cloudSyncPrefPath = path.join(trackerDataDir, "cloud-sync-pref.json");
   let cloudSyncPrefCache;
   function getCloudSyncPref() {
     if (cloudSyncPrefCache === undefined) {
       try {
-        cloudSyncPrefCache = JSON.parse(fs.readFileSync(cloudSyncPrefPath, "utf8"))?.enabled === true;
+        cloudSyncPrefCache = JSON.parse(fs.readFileSync(cloudSyncPrefPath, "utf8"))?.enabled !== false;
       } catch {
-        cloudSyncPrefCache = false;
+        cloudSyncPrefCache = true;
       }
     }
     return cloudSyncPrefCache;
@@ -2579,14 +2581,18 @@ function createLocalApiHandler({ queuePath }) {
     if (p === "/functions/tokentracker-usage-limits") {
       const { getUsageLimits, resetUsageLimitsCache } = require("./usage-limits");
       try {
-        const forceRefresh = url.searchParams.get("refresh");
-        if (forceRefresh === "1" || forceRefresh === "true") {
+        const refreshParam = url.searchParams.get("refresh");
+        const forceRefresh = refreshParam === "1" || refreshParam === "true";
+        if (forceRefresh) {
           resetUsageLimitsCache();
         }
         const data = await getUsageLimits({
           home: os.homedir(),
           env: process.env,
           platform: process.platform,
+          // Punches through the Claude disk fresh-cache (but not the 429
+          // cooldown) — an explicit user refresh should hit upstream.
+          forceRefresh,
         });
         json(res, data);
       } catch (e) {

package/src/lib/openclaw-session-plugin.js

@@ -312,6 +312,19 @@ async function removeOpenclawSessionPluginConfig({
 }
 
 function runOpenclawCli(args, env = process.env) {
+  // Test-only escape hatch: skip spawning the real `openclaw` CLI. Behaves like
+  // the CLI being absent (which is the CI environment anyway), so callers take
+  // their graceful skip path. Avoids a ~2s `plugins install --link` per cmdInit
+  // on dev machines that happen to have openclaw installed.
+  if ((env && env.TOKENTRACKER_SKIP_OPENCLAW_CLI) === "1") {
+    return {
+      code: 1,
+      skippedReason: "openclaw-cli-missing",
+      error: "skipped via TOKENTRACKER_SKIP_OPENCLAW_CLI",
+      stdout: "",
+      stderr: "",
+    };
+  }
   let res;
   try {
     res = cp.spawnSync("openclaw", args, {