tokentracker-cli 0.93.6 → 0.94.0

package/src/lib/session-analytics.js

@@ -54,7 +54,9 @@ const wsl = require("./wsl-probe");
 // stay valid while Grok entries appear on the next full rebuild.
 // v11 groups native/WSL copies of one logical Claude/Codex session and scans
 // their union, deduping shared records while retaining divergent tails.
-const SIDECAR_VERSION = 11;
+// v12 retains Codex parent/subagent metadata locally and derives exact child
+// token totals from observed child rollouts instead of spawn-call estimates.
+const SIDECAR_VERSION = 12;
 const EDIT_TOOLS = new Set([
   "apply_patch",
   "edit",
@@ -511,6 +513,18 @@ async function scanCodexSession(filePath) {
     version: SIDECAR_VERSION,
     session_hash: sessionHash("codex", parsed.sessionId || primaryFilePath),
     session_id: parsed.sessionId || null,
+    // Local-only lineage. Codex v2 normally writes forked_from_id; keep
+    // parent_thread_id as a compatibility fallback, but reject disagreement.
+    parent_session_id: parsed.forkedFromId || parsed.parentThreadId || null,
+    parent_link_conflict: Boolean(
+      parsed.forkedFromId
+      && parsed.parentThreadId
+      && parsed.forkedFromId !== parsed.parentThreadId
+    ),
+    forked_from_id: parsed.forkedFromId || null,
+    thread_source: typeof parsed.threadSource === "string" ? parsed.threadSource : null,
+    agent_nickname: typeof parsed.agentNickname === "string" ? parsed.agentNickname : null,
+    agent_role: typeof parsed.agentRole === "string" ? parsed.agentRole : null,
     // Local-only: stripped in summarizeSessions before any cloud/CSV export.
     title,
     source: "codex",
@@ -829,7 +843,14 @@ function providerRoots(home, providerDir, env, deps = {}) {
   const discoverWslHome = deps.discoverWslHome || wsl.discoverWslHome;
   const roots = [];
   if (platform !== "win32" || wsl.shouldProbeNative(env)) {
-    roots.push(path.join(home, providerDir));
+    const useProcessCodexHome = providerDir === ".codex"
+      && path.resolve(home) === path.resolve(homedir())
+      && typeof env?.CODEX_HOME === "string"
+      && env.CODEX_HOME.trim();
+    const nativeRoot = useProcessCodexHome
+      ? path.resolve(env.CODEX_HOME.trim())
+      : path.join(home, providerDir);
+    roots.push(nativeRoot);
   }
   // Only the machine's own home has a WSL sibling worth probing.
   // discoverWslHome resolves \\wsl$ independently of `home`, so probing for an
@@ -1029,10 +1050,15 @@ function sessionFileStatKey(filePath) {
 const codexTitleIndexCache = new Map();
 
 function codexTitleIndexPathFor(filePath) {
-  const parts = path.resolve(filePath).split(path.sep);
-  const idx = parts.lastIndexOf(".codex");
-  if (idx === -1) return null;
-  return [...parts.slice(0, idx + 1), "session_index.jsonl"].join(path.sep);
+  let current = path.dirname(path.resolve(filePath));
+  while (true) {
+    if (["sessions", "archived_sessions"].includes(path.basename(current))) {
+      return path.join(path.dirname(current), "session_index.jsonl");
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
 }
 
 function loadCodexTitleIndex(filePath) {
@@ -1239,7 +1265,9 @@ function withinDayRange(row, from, to) {
 }
 
 function summarizeSessions(sessions, { from = "", to = "", includeSessions = true } = {}) {
-  const filtered = (sessions || []).filter((row) => withinDayRange(row, from, to));
+  const filtered = annotateCodexThreadUsage((sessions || [])
+    .filter((row) => withinDayRange(row, from, to))
+    .map((row) => ({ ...row })));
   const byModel = new Map();
   const subagents = new Map();
   for (const row of filtered) {
@@ -1268,6 +1296,26 @@ function summarizeSessions(sessions, { from = "", to = "", includeSessions = tru
       agg.edit_cost_usd += finite(row.cost_usd);
     }
     byModel.set(key, agg);
+    if (row.source === "codex" && row.parent_session_hash) {
+      const name = row.agent_role || row.agent_nickname || "subagent";
+      const sub = subagents.get(name) || {
+        name,
+        calls: 0,
+        sessions: 0,
+        total_tokens: 0,
+        cost_usd: 0,
+        attribution: "observed-child-session",
+      };
+      sub.calls += 1;
+      sub.sessions += 1;
+      sub.total_tokens += finite(row.total_tokens);
+      sub.cost_usd += finite(row.cost_usd);
+      subagents.set(name, sub);
+      continue;
+    }
+    // Codex child rollouts are first-class rows. A spawn call in the parent is
+    // a control-plane event, not token usage, so do not mix in an estimate.
+    if (row.source === "codex") continue;
     for (const [name, calls] of Object.entries(row.subagent_types || {})) {
       const sub = subagents.get(name) || { name, calls: 0, sessions: 0, total_tokens: 0, cost_usd: 0 };
       sub.calls += finite(calls);
@@ -1301,7 +1349,22 @@ function summarizeSessions(sessions, { from = "", to = "", includeSessions = tru
     // Git attribution and the local-only session browser, but never leave the
     // Node process through API/CSV payloads.
     sessions: includeSessions
-      ? filtered.map(({ project_ref: _projectRef, session_id: _sessionId, title: _title, _cache_key: _cacheKey, ...row }) => row)
+      ? filtered.map(({
+        project_ref: _projectRef,
+        session_id: _sessionId,
+        parent_session_id: _parentSessionId,
+        forked_from_id: _forkedFromId,
+        parent_session_hash: _parentSessionHash,
+        root_session_hash: _rootSessionHash,
+        agent_nickname: _agentNickname,
+        agent_role: _agentRole,
+        thread_source: _threadSource,
+        parent_link_conflict: _parentLinkConflict,
+        orphaned_subagent: _orphanedSubagent,
+        title: _title,
+        _cache_key: _cacheKey,
+        ...row
+      }) => row)
       : [],
     session_count: filtered.length,
     summary: {
@@ -1350,6 +1413,14 @@ function toSessionBrowserRow(row) {
   return {
     session_hash: row.session_hash,
     session_id: row.session_id || null,
+    parent_session_id: row.parent_session_id || null,
+    parent_session_hash: row.parent_session_hash || null,
+    root_session_hash: row.root_session_hash || row.session_hash,
+    thread_kind: row.parent_session_id ? "subagent" : "root",
+    agent_nickname: row.agent_nickname || null,
+    agent_role: row.agent_role || null,
+    orphaned_subagent: Boolean(row.orphaned_subagent),
+    parent_link_conflict: Boolean(row.parent_link_conflict),
     title: row.title || null,
     source: row.source,
     project_key: row.project_key,
@@ -1364,7 +1435,15 @@ function toSessionBrowserRow(row) {
     edit_turns: finite(row.edit_turns),
     retry_turns: finite(row.retry_turns),
     subagent_calls: finite(row.subagent_calls),
+    direct_subagent_count: finite(row.direct_subagent_count),
+    descendant_subagent_count: finite(row.descendant_subagent_count),
+    own_total_tokens: finite(row.total_tokens),
+    subagent_total_tokens: finite(row.subagent_total_tokens),
+    combined_total_tokens: finite(row.combined_total_tokens || row.total_tokens),
     total_tokens: finite(row.total_tokens),
+    own_cost_usd: finite(row.cost_usd),
+    subagent_cost_usd: finite(row.subagent_cost_usd),
+    combined_cost_usd: finite(row.combined_cost_usd || row.cost_usd),
     cost_usd: finite(row.cost_usd),
     productive: Boolean(row.productive),
     first_pass: Boolean(row.first_pass ?? row.one_shot),
@@ -1396,6 +1475,14 @@ function mergeSessionFragments(rows) {
     cur.productive = Boolean(cur.productive) || Boolean(row.productive);
     cur.active_ms = finite(cur.active_ms) + finite(row.active_ms);
     if (!cur.title && row.title) cur.title = row.title;
+    if (!cur.parent_session_id && row.parent_session_id) cur.parent_session_id = row.parent_session_id;
+    if (cur.parent_session_id && row.parent_session_id && cur.parent_session_id !== row.parent_session_id) {
+      cur.parent_session_id = null;
+      cur.parent_link_conflict = true;
+    }
+    if (!cur.forked_from_id && row.forked_from_id) cur.forked_from_id = row.forked_from_id;
+    if (!cur.agent_nickname && row.agent_nickname) cur.agent_nickname = row.agent_nickname;
+    if (!cur.agent_role && row.agent_role) cur.agent_role = row.agent_role;
     // Representative model/project comes from the busiest fragment (most
     // tokens) so a tiny sidechain cannot overwrite the real coding model.
     if (finite(row.total_tokens) > finite(cur._repr_tokens)) {
@@ -1427,19 +1514,127 @@ function mergeSessionFragments(rows) {
   return merged;
 }
 
+// Attach exact Codex parent/child usage without changing the authoritative
+// per-session total_tokens field. Combined fields are derived views only, so
+// summing total_tokens across all rows still equals the global usage ledger.
+function annotateCodexThreadUsage(rows) {
+  const byId = new Map();
+  const childrenById = new Map();
+  const linkedParentById = new Map();
+
+  for (const row of rows || []) {
+    if (row?.source !== "codex" || typeof row.session_id !== "string" || !row.session_id) continue;
+    const existing = byId.get(row.session_id);
+    if (existing && existing !== row) {
+      existing.parent_link_conflict = true;
+      row.parent_link_conflict = true;
+      continue;
+    }
+    byId.set(row.session_id, row);
+  }
+
+  function hasParentCycle(start) {
+    const seen = new Set();
+    let current = start;
+    while (current?.parent_session_id && byId.has(current.parent_session_id)) {
+      if (seen.has(current.session_id) || current.parent_session_id === current.session_id) return true;
+      seen.add(current.session_id);
+      current = byId.get(current.parent_session_id);
+    }
+    return false;
+  }
+
+  for (const row of byId.values()) {
+    const parentId = typeof row.parent_session_id === "string" ? row.parent_session_id.trim() : "";
+    if (!parentId) continue;
+    if (row.parent_link_conflict || hasParentCycle(row)) {
+      row.parent_link_conflict = true;
+      continue;
+    }
+    if (!byId.has(parentId)) {
+      row.orphaned_subagent = true;
+      continue;
+    }
+    const children = childrenById.get(parentId) || [];
+    children.push(row);
+    childrenById.set(parentId, children);
+    linkedParentById.set(row.session_id, parentId);
+  }
+
+  const memo = new Map();
+  function aggregate(row, visiting = new Set()) {
+    if (memo.has(row.session_id)) return memo.get(row.session_id);
+    if (visiting.has(row.session_id)) {
+      row.parent_link_conflict = true;
+      return { count: 0, tokens: 0, cost: 0 };
+    }
+    const nextVisiting = new Set(visiting);
+    nextVisiting.add(row.session_id);
+    let count = 0;
+    let tokens = 0;
+    let cost = 0;
+    for (const child of childrenById.get(row.session_id) || []) {
+      const nested = aggregate(child, nextVisiting);
+      count += 1 + nested.count;
+      tokens += finite(child.total_tokens) + nested.tokens;
+      cost += finite(child.cost_usd) + nested.cost;
+    }
+    const result = { count, tokens, cost };
+    memo.set(row.session_id, result);
+    return result;
+  }
+
+  function rootFor(row) {
+    const seen = new Set([row.session_id]);
+    let current = row;
+    while (current && linkedParentById.has(current.session_id)) {
+      const linkedParentId = linkedParentById.get(current.session_id);
+      if (seen.has(linkedParentId)) {
+        row.parent_link_conflict = true;
+        break;
+      }
+      seen.add(linkedParentId);
+      current = byId.get(linkedParentId);
+    }
+    return current || row;
+  }
+
+  for (const row of rows || []) {
+    row.own_total_tokens = finite(row.total_tokens);
+    row.own_cost_usd = finite(row.cost_usd);
+    row.direct_subagent_count = row.source === "codex" && row.session_id
+      ? (childrenById.get(row.session_id) || []).length
+      : 0;
+    const nested = row.source === "codex" && row.session_id
+      ? aggregate(row)
+      : { count: 0, tokens: 0, cost: 0 };
+    row.descendant_subagent_count = nested.count;
+    row.subagent_total_tokens = nested.tokens;
+    row.subagent_cost_usd = nested.cost;
+    row.combined_total_tokens = finite(row.total_tokens) + nested.tokens;
+    row.combined_cost_usd = finite(row.cost_usd) + nested.cost;
+    if (row.source === "codex" && row.session_id) {
+      const parent = byId.get(linkedParentById.get(row.session_id));
+      row.parent_session_hash = parent?.session_hash || null;
+      row.root_session_hash = rootFor(row).session_hash || row.session_hash;
+    }
+  }
+  return rows;
+}
+
 // Local-only session list for the dashboard session browser. Unlike
 // summarizeSessions (cloud/CSV safe), this retains session_id + project_ref so
 // the UI can offer one-click resume. Callers must only expose it over the
 // local API.
 function listSessionsForBrowser(sessions, { from = "", to = "", limit = 0 } = {}) {
-  const filtered = mergeSessionFragments(sessions)
+  const filtered = annotateCodexThreadUsage(mergeSessionFragments(sessions)
     // Only sessions that actually spent tokens are worth listing. This drops
     // two kinds of noise: non-session logs under ~/.claude/projects
     // (skill-injections.jsonl, journal.jsonl, …), and sessions abandoned before
     // the model replied. Both render as "unknown · 0 tokens · $0.00" rows with
     // no model, no cost and nothing to analyze.
     .filter((row) => finite(row.total_tokens) > 0)
-    .filter((row) => withinDayRange(row, from, to));
+    .filter((row) => withinDayRange(row, from, to)));
   filtered.sort((a, b) => String(b.ended_at || "").localeCompare(String(a.ended_at || "")));
   const cap = Number(limit) > 0 ? Number(limit) : 0;
   const limited = cap > 0 ? filtered.slice(0, cap) : filtered;

package/src/lib/subscription-manager.js

@@ -0,0 +1,293 @@
+const path = require("node:path");
+const fs = require("node:fs/promises");
+const crypto = require("node:crypto");
+
+const { readJsonStrict, writeFileAtomic, chmod600IfPossible } = require("./fs");
+
+// Manual subscription manager: user-entered billing plans (service, plan,
+// auto-renew flag, next renewal/expiry timestamp). Distinct from
+// subscriptions.js (auto-detected local plan tiers) and usage-limits.js
+// (rate-limit window resets) — see issue #460.
+const STORE_FILE = "subscription-manager.json";
+const STORE_VERSION = 1;
+const MAX_TEXT_LENGTH = 120;
+const CYCLE_UNITS = new Set(["weekly", "monthly", "yearly"]);
+
+function resolveSubscriptionsPath(trackerDir) {
+  return path.join(trackerDir, STORE_FILE);
+}
+
+function normalizeText(value, { required, field, maxLength = MAX_TEXT_LENGTH } = {}) {
+  if (value === null || value === undefined) {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  if (typeof value !== "string") throw new Error(`${field} must be a string`);
+  const trimmed = value.trim();
+  if (!trimmed) {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  if (trimmed.length > maxLength) {
+    throw new Error(`${field} must be at most ${maxLength} characters`);
+  }
+  return trimmed;
+}
+
+// Accepts epoch milliseconds or any Date-parseable string. Stored values are
+// UTC ISO strings truncated to whole minutes so comparisons stay clean and a
+// second-level drift between input formats never changes the billed minute.
+function normalizeBillingTime(value, { field = "nextBillingAt", required = true } = {}) {
+  let ms;
+  if (value === null || value === undefined) {
+    if (required) throw new Error(`${field} is required`);
+    return null;
+  }
+  if (typeof value === "number") {
+    ms = value;
+  } else if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (!trimmed) {
+      if (required) throw new Error(`${field} is required`);
+      return null;
+    }
+    ms = new Date(trimmed).getTime();
+  } else {
+    throw new Error(`${field} is required`);
+  }
+  if (!Number.isFinite(ms)) throw new Error(`${field} must be a valid date`);
+  return new Date(Math.floor(ms / 60000) * 60000).toISOString();
+}
+
+// Billing cycle length. Drives the progress bar span and how far an
+// auto-renew subscription rolls forward after a recorded renewal passes.
+// Defaults to monthly so pre-cycle records keep their original semantics.
+function normalizeCycle(value) {
+  if (value === null || value === undefined) return "monthly";
+  if (typeof value !== "string" || !CYCLE_UNITS.has(value)) {
+    throw new Error("cycle must be one of: weekly, monthly, yearly");
+  }
+  return value;
+}
+
+function normalizeSubscriptionFields(fields) {
+  if (!fields || typeof fields !== "object" || Array.isArray(fields)) {
+    throw new Error("subscription must be an object");
+  }
+  if (typeof fields.autoRenew !== "boolean") {
+    throw new Error("autoRenew must be a boolean");
+  }
+  return {
+    service: normalizeText(fields.service, { required: true, field: "service" }),
+    plan: normalizeText(fields.plan ?? null, { required: false, field: "plan" }),
+    // Optional link to a usage-limits provider row (e.g. "codex"). The value
+    // is a limits provider id but is not validated against the canonical list
+    // here — the backend stays lenient, the dropdown constrains it in the UI.
+    provider: normalizeText(fields.provider ?? null, {
+      required: false,
+      field: "provider",
+      maxLength: 64,
+    }),
+    autoRenew: fields.autoRenew,
+    cycle: normalizeCycle(fields.cycle),
+    nextBillingAt: normalizeBillingTime(fields.nextBillingAt),
+    // Billing anchor: the day the subscription started. The dashboard derives
+    // every cycle boundary from this date, so month-end anchors (Jan 31) stay
+    // stable instead of drifting after the first clamped month. Optional:
+    // records created before the field existed fall back to a derived anchor.
+    startedAt:
+      fields.startedAt === undefined
+        ? null
+        : normalizeBillingTime(fields.startedAt, { field: "startedAt", required: false }),
+  };
+}
+
+function isValidStoredRecord(record) {
+  if (!record || typeof record !== "object" || Array.isArray(record)) return false;
+  if (typeof record.id !== "string" || !record.id) return false;
+  if (typeof record.service !== "string" || !record.service) return false;
+  if (typeof record.autoRenew !== "boolean") return false;
+  if (typeof record.nextBillingAt !== "string") return false;
+  return Number.isFinite(new Date(record.nextBillingAt).getTime());
+}
+
+// Read the store. Any state other than a clean file or a plainly missing one
+// must never collapse into an empty store on its own: the next write would
+// silently destroy every stored subscription (user-entered data that cannot
+// be rebuilt from logs). Reads surface the damage as an error; only the write
+// path may recover, and only after backing the original file up.
+async function readStore(filePath, { forWrite = false } = {}) {
+  const { status, value, error } = await readJsonStrict(filePath);
+  if (status === "missing") {
+    return { store: { version: STORE_VERSION, items: [] }, needsBackup: false };
+  }
+  if (status === "error") {
+    // Unreadable (permissions, I/O error): refuse — a blind overwrite would
+    // destroy data we were never able to see.
+    throw new Error(`Cannot read subscription store: ${error?.message || String(error)}`);
+  }
+  if (status === "invalid" || !value || typeof value !== "object" || Array.isArray(value)) {
+    if (!forWrite) {
+      throw new Error("Subscription store is corrupted (invalid JSON)");
+    }
+    return { store: { version: STORE_VERSION, items: [] }, needsBackup: true };
+  }
+  if (!Array.isArray(value.items)) {
+    // Valid JSON object without a usable items array: nothing recoverable
+    // inside, so an empty store is honest. If the key exists with a wrong
+    // type, keep the file backed up before a write replaces it.
+    return {
+      store: { version: STORE_VERSION, items: [] },
+      needsBackup: value.items !== undefined,
+    };
+  }
+  const items = [];
+  let dropped = false;
+  for (const item of value.items) {
+    if (isValidStoredRecord(item)) {
+      items.push(item);
+    } else {
+      dropped = true;
+    }
+  }
+  const version = Number.isFinite(value.version) ? value.version : STORE_VERSION;
+  return { store: { version, items }, needsBackup: dropped };
+}
+
+// A write is about to replace a store that contained unreadable data — keep
+// a copy around first so nothing is lost without a trace. Copy (not rename):
+// if the replacement write then fails, the canonical path must still hold the
+// damaged original, otherwise the next write would treat it as missing and
+// start from an empty store.
+async function backupDamagedStore(filePath) {
+  const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+  try {
+    await fs.copyFile(filePath, `${filePath}.corrupt-${stamp}`);
+  } catch (e) {
+    if (e?.code !== "ENOENT") {
+      throw new Error(`Cannot back up the damaged subscription store: ${e?.message || String(e)}`);
+    }
+  }
+}
+
+async function loadStoreForWrite(filePath) {
+  const { store, needsBackup } = await readStore(filePath, { forWrite: true });
+  if (needsBackup) await backupDamagedStore(filePath);
+  return store;
+}
+
+async function writeStore(filePath, store) {
+  // Private from creation: the 0o600 applies to the tmp file before the
+  // rename, so a crash before the fallback chmod cannot leave a
+  // world-readable store behind.
+  await writeFileAtomic(filePath, JSON.stringify(store, null, 2) + "\n", { mode: 0o600 });
+  await chmod600IfPossible(filePath);
+}
+
+function sortByNextBillingAt(items) {
+  return [...items].sort((a, b) =>
+    new Date(a.nextBillingAt).getTime() - new Date(b.nextBillingAt).getTime(),
+  );
+}
+
+// One subscription per tool: the dashboard derives the subscription's name
+// and inline progress row from the linked provider, so two records sharing a
+// provider cannot be displayed. Enforced inside the store lock's
+// read-modify-write transaction — the frontend picker cannot cover concurrent
+// requests, stale pages, or direct API calls. `excludeId` lets an update
+// re-save its own provider.
+function assertProviderAvailable(items, provider, excludeId = null) {
+  if (!provider) return;
+  const conflict = items.find(
+    (item) => item.provider === provider && item.id !== excludeId,
+  );
+  if (conflict) {
+    throw new Error(
+      `Provider "${provider}" already has a subscription (${conflict.id})`,
+    );
+  }
+}
+
+// In-process FIFO queue per store file. Every mutation is a full
+// read-modify-write transaction; without serialization two concurrent writes
+// read the same snapshot and the later one silently drops the earlier change
+// (issue: 30 concurrent creates survived as a single record). The queue keeps
+// independent store files unblocked while ordering operations on the same one.
+const storeLocks = new Map();
+
+function withStoreLock(filePath, operation) {
+  const previous = storeLocks.get(filePath) || Promise.resolve();
+  // Run even if the previous transaction rejected; its error already reached
+  // its own caller and must not wedge the queue.
+  const run = previous.then(operation, operation);
+  storeLocks.set(filePath, run.then(() => undefined, () => undefined));
+  return run;
+}
+
+async function listSubscriptions({ trackerDir }) {
+  const { store } = await readStore(resolveSubscriptionsPath(trackerDir));
+  return sortByNextBillingAt(store.items);
+}
+
+async function createSubscription({ trackerDir, fields }) {
+  // Validate before taking the lock so a bad payload never queues a write.
+  const normalized = normalizeSubscriptionFields(fields);
+  const filePath = resolveSubscriptionsPath(trackerDir);
+  return withStoreLock(filePath, async () => {
+    const now = new Date().toISOString();
+    const record = {
+      id: crypto.randomUUID(),
+      ...normalized,
+      createdAt: now,
+      updatedAt: now,
+    };
+    const store = await loadStoreForWrite(filePath);
+    assertProviderAvailable(store.items, normalized.provider);
+    store.items.push(record);
+    await writeStore(filePath, store);
+    return record;
+  });
+}
+
+async function updateSubscription({ trackerDir, id, fields }) {
+  if (typeof id !== "string" || !id) throw new Error("id is required");
+  const filePath = resolveSubscriptionsPath(trackerDir);
+  return withStoreLock(filePath, async () => {
+    const store = await loadStoreForWrite(filePath);
+    const index = store.items.findIndex((item) => item.id === id);
+    if (index === -1) throw new Error("Subscription not found");
+    const existing = store.items[index];
+    // Merge over the existing record so callers may send only changed fields.
+    const merged = normalizeSubscriptionFields({ ...existing, ...(fields || {}) });
+    assertProviderAvailable(store.items, merged.provider, id);
+    const record = {
+      ...existing,
+      ...merged,
+      updatedAt: new Date().toISOString(),
+    };
+    store.items[index] = record;
+    await writeStore(filePath, store);
+    return record;
+  });
+}
+
+async function deleteSubscription({ trackerDir, id }) {
+  if (typeof id !== "string" || !id) throw new Error("id is required");
+  const filePath = resolveSubscriptionsPath(trackerDir);
+  return withStoreLock(filePath, async () => {
+    const store = await loadStoreForWrite(filePath);
+    const index = store.items.findIndex((item) => item.id === id);
+    if (index === -1) throw new Error("Subscription not found");
+    store.items.splice(index, 1);
+    await writeStore(filePath, store);
+    return { removed: true };
+  });
+}
+
+module.exports = {
+  listSubscriptions,
+  createSubscription,
+  updateSubscription,
+  deleteSubscription,
+  resolveSubscriptionsPath,
+};

package/src/lib/telemetry.js

@@ -6,7 +6,7 @@
  * Privacy contract (documented in README "Privacy" section — keep in sync):
  * the payload carries exactly four fields — a one-way sha256 hash of the
  * machine id, the app version, `process.platform`, and the app shell
- * (cli / macos / windows). No token counts, no model names, no usernames,
+ * (cli / macos / windows / linux). No token counts, no model names, no usernames,
  * no paths. Opt out with TOKENTRACKER_NO_TELEMETRY=1, the DO_NOT_TRACK
  * standard, or `"telemetry": false` in config.json.
  */
@@ -35,7 +35,7 @@ const MACHINE_HASH_NAMESPACE = "tokentracker-telemetry-v1:";
 // cloud host; sync awaits this at most once per day so the worst-case stall
 // is bounded and rare.
 const DEFAULT_TIMEOUT_MS = 10_000;
-const VALID_SHELLS = new Set(["cli", "macos", "windows"]);
+const VALID_SHELLS = new Set(["cli", "macos", "windows", "linux"]);
 
 const THROTTLE_CONFIG = {
   intervalMs: HEARTBEAT_INTERVAL_MS,