tokentracker-cli 1.3.15 → 1.4.1

package/src/lib/cloud-usage-reset.js

@@ -0,0 +1,115 @@
+const fs = require("node:fs");
+const fsp = require("node:fs/promises");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const { openLock, writeFileAtomic } = require("./fs");
+const { functionUrlFor, fetchFunctionResponse } = require("./function-url");
+
+const MARKER = "cloud-usage-reset.json";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const failure = (code, status = 409) => Object.assign(new Error(code), { code, status });
+const sameBase = (a, b) => String(a).replace(/\/$/, "") === String(b).replace(/\/$/, "");
+
+function readCloudUsageReset(trackerDir) {
+  let raw;
+  try { raw = fs.readFileSync(path.join(trackerDir, MARKER), "utf8"); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  let value;
+  try { value = JSON.parse(raw); } catch { throw failure("cloud_usage_reset_invalid_state"); }
+  if (value?.version !== 1 || !UUID.test(value.operationId) || !UUID.test(value.deviceId) ||
+      !UUID.test(value.ownerId) || !/^https?:\/\//.test(value.baseUrl || "") ||
+      !["prepared", "uploading"].includes(value.phase)) throw failure("cloud_usage_reset_invalid_state");
+  return value;
+}
+
+function cloudUsageResetBlocksUpload(trackerDir, { ownerId, baseUrl, deviceId } = {}) {
+  try {
+    const marker = readCloudUsageReset(trackerDir);
+    return Boolean(marker && (marker.phase === "prepared" || marker.ownerId !== ownerId ||
+      !sameBase(marker.baseUrl, baseUrl) || (deviceId && marker.deviceId !== deviceId)));
+  }
+  catch { return true; }
+}
+
+async function writeMarker(trackerDir, marker) {
+  await writeFileAtomic(path.join(trackerDir, MARKER), JSON.stringify(marker) + "\n", { mode: 0o600 });
+}
+
+async function requestReset({ baseUrl, anonKey, authorization, body, fetchImpl = fetchFunctionResponse }) {
+  const response = await fetchImpl(functionUrlFor(baseUrl, "tokentracker-device-usage-reset"), {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${authorization}`,
+      ...(anonKey ? { apikey: anonKey } : {}) },
+    signal: AbortSignal.timeout(60_000),
+    body: JSON.stringify(body),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok || data.ok !== true) throw failure(data.code || "cloud_usage_reset_failed", response.status || 502);
+  if (data.operation_id !== body.operation_id) throw failure("cloud_usage_reset_invalid_response", 502);
+  return data;
+}
+
+// Called only after the local bridge has bound the JWT to its current device.
+// The marker precedes the remote mutation: an interrupted request must retry the
+// same operation, never clear already-replayed history a second time.
+async function resetCloudDeviceUsage({ trackerDir, ownerId, deviceId, baseUrl, anonKey, accessToken,
+  isCurrent = () => true, fetchImpl }) {
+  if (!UUID.test(ownerId) || !UUID.test(deviceId) || !accessToken) throw failure("auth_required", 401);
+  const lock = await openLock(path.join(trackerDir, "sync.lock"), { quietIfLocked: true });
+  if (!lock) throw failure("cloud_usage_reset_sync_busy");
+  try {
+    if (!isCurrent()) throw failure("auth_session_changed");
+    let marker = readCloudUsageReset(trackerDir);
+    const newOperation = !marker;
+    if (marker && (marker.ownerId !== ownerId || marker.deviceId !== deviceId || !sameBase(marker.baseUrl, baseUrl))) {
+      throw failure("cloud_usage_reset_owner_changed");
+    }
+    if (marker?.phase === "uploading") return { ok: true, operation_id: marker.operationId, status: "uploading" };
+    if (!marker) {
+      marker = { version: 1, operationId: crypto.randomUUID(), ownerId, deviceId, baseUrl, phase: "prepared" };
+      await writeMarker(trackerDir, marker);
+    }
+    if (!isCurrent()) throw failure("auth_session_changed");
+    const result = await requestReset({ baseUrl, anonKey, authorization: accessToken, fetchImpl,
+      body: { action: "reset", device_id: deviceId, operation_id: marker.operationId } }).catch(async error => {
+      // A definitive first-request rejection did not erase anything. Unknown
+      // outcomes and retries retain their operation so they cannot erase twice.
+      if (newOperation && [400, 401, 403, 404, 409, 422].includes(error.status)) {
+        await fsp.unlink(path.join(trackerDir, MARKER));
+      }
+      throw error;
+    });
+    if (result.device_id !== deviceId || !["reset", "complete"].includes(result.status)) {
+      throw failure("cloud_usage_reset_invalid_response", 502);
+    }
+    if (!isCurrent()) throw failure("auth_session_changed");
+    await writeFileAtomic(path.join(trackerDir, "queue.state.json"),
+      JSON.stringify({ offset: 0, updatedAt: new Date().toISOString() }) + "\n", { mode: 0o600 });
+    await fsp.unlink(path.join(trackerDir, "upload.throttle.json")).catch(error => { if (error.code !== "ENOENT") throw error; });
+    marker.phase = "uploading";
+    await writeMarker(trackerDir, marker);
+    return { ...result, status: "uploading" };
+  } finally { await lock.release(); }
+}
+
+// sync owns sync.lock here. Only its fully acknowledged queue can finish the
+// operation; a partial batch/checkpoint or another account leaves it pending.
+async function finishCloudDeviceUsageReset({ trackerDir, ownerId, deviceId, baseUrl, anonKey, deviceToken, fetchImpl }) {
+  const marker = readCloudUsageReset(trackerDir);
+  if (!marker || marker.phase !== "uploading" || marker.ownerId !== ownerId || (deviceId && marker.deviceId !== deviceId) || !sameBase(marker.baseUrl, baseUrl)) return false;
+  if (!deviceToken) return false;
+  const queuePath = path.join(trackerDir, "queue.jsonl");
+  const size = await fsp.stat(queuePath).then(stat => stat.size).catch(error => { if (error.code === "ENOENT") return 0; throw error; });
+  let offset;
+  try { offset = JSON.parse(await fsp.readFile(path.join(trackerDir, "queue.state.json"), "utf8")).offset; }
+  catch { throw failure("cloud_usage_reset_invalid_offset"); }
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset > size) throw failure("cloud_usage_reset_invalid_offset");
+  if (offset !== size) return false;
+  const result = await requestReset({ baseUrl, anonKey, authorization: deviceToken, fetchImpl,
+    body: { action: "refresh", operation_id: marker.operationId } });
+  if (result.status !== "complete" || result.device_id !== marker.deviceId) throw failure("cloud_usage_reset_invalid_response", 502);
+  await fsp.unlink(path.join(trackerDir, MARKER));
+  return true;
+}
+
+module.exports = { readCloudUsageReset, cloudUsageResetBlocksUpload, resetCloudDeviceUsage, finishCloudDeviceUsageReset };

package/src/lib/diagnostics.js

@@ -228,7 +228,7 @@ async function collectTrackerDiagnostics({
         ? { wsl_mode: wsl.getWslMode(process.env), wsl_installs: kiroWslInstalls }
         : {}),
       cli_approximation:
-        "Kiro CLI does not persist explicit token counts (billing is credit-based on Bedrock). Tokens are approximated at 4 chars/token from user prompt chars and assistant response chars. Source rows that came through this path have model='kiro-cli-agent' when the underlying model is unknown (auto-routing); known Bedrock ARNs canonicalize to their short name (e.g. claude-sonnet-4).",
+        "When Kiro CLI does not report token counts, tokens are estimated at ~4 chars/token from new user messages, tool outputs and assistant text. The estimate does not measure re-sent history, system context or cache usage, and can substantially undercount tool-heavy requests. contextUsage percentages are not converted to tokens because their denominator and request correspondence are not established. Dollar amounts use model rates, not Kiro credit charges; recorded usage_summary credits remain separate. Source rows use model='kiro-cli-agent' when the underlying model is unknown; known Bedrock ARNs canonicalize to their short name (e.g. claude-sonnet-4).",
       merge_policy:
         "Kiro IDE and Kiro CLI both emit source='kiro' in queue.jsonl so token, cost, heatmap, and leaderboard aggregations merge transparently. Use this block to distinguish sub-path contributions.",
     },

package/src/lib/kimi-model-repair.js

@@ -0,0 +1,173 @@
+"use strict";
+
+const fs = require("node:fs/promises");
+const path = require("node:path");
+const crypto = require("node:crypto");
+
+const KIMI_MODEL_REPAIR_KEY = "kimiModelAttribution_2026_10";
+const TOKEN_FIELDS = ["input_tokens", "cached_input_tokens", "cache_creation_input_tokens", "output_tokens", "reasoning_output_tokens", "total_tokens"];
+const keyOf = (row) => row?.source === "kimi" && typeof row.model === "string" && typeof row.hour_start === "string"
+  ? `kimi|${row.model}|${row.hour_start}` : null;
+const digest = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
+
+async function readBytes(file) {
+  try { return await fs.readFile(file); } catch (error) { if (error.code === "ENOENT") return Buffer.alloc(0); throw error; }
+}
+async function readJson(file) {
+  const bytes = await readBytes(file);
+  return bytes.length ? JSON.parse(bytes.toString("utf8")) : null;
+}
+function latestRows(bytes) {
+  const rows = new Map();
+  for (const line of bytes.toString("utf8").split("\n")) {
+    let row;
+    try { row = JSON.parse(line); } catch { continue; }
+    const key = keyOf(row);
+    if (key) rows.set(key, row);
+  }
+  return rows;
+}
+function sumsByHour(rows) {
+  const totals = new Map();
+  for (const row of rows.values()) {
+    const total = totals.get(row.hour_start) || Object.fromEntries(TOKEN_FIELDS.map((field) => [field, 0]));
+    for (const field of TOKEN_FIELDS) {
+      const count = Number(row[field] || 0);
+      if (!Number.isSafeInteger(count) || count < 0) throw new Error("Kimi repair encountered invalid token totals");
+      total[field] += count;
+    }
+    if (TOKEN_FIELDS.some((field) => total[field] !== 0)) totals.set(row.hour_start, total);
+  }
+  return totals;
+}
+function sameTotals(before, after) {
+  const left = sumsByHour(before), right = sumsByHour(after);
+  return left.size === right.size && [...left].every(([hour, total]) => right.has(hour)
+    && TOKEN_FIELDS.every((field) => total[field] === right.get(hour)[field]));
+}
+function sameSnapshot(left, right) {
+  return left && right && [...TOKEN_FIELDS, "conversation_count", "billable_total_tokens"]
+    .every((field) => Number(left[field] || 0) === Number(right[field] || 0));
+}
+async function fileSignature(file) {
+  const handle = await fs.open(file, "r");
+  try {
+    const stat = await handle.stat();
+    if (!stat.isFile()) throw new Error("Kimi repair source is not a file");
+    return { size: stat.size, ino: stat.ino, mtimeMs: stat.mtimeMs };
+  } finally { await handle.close(); }
+}
+async function writeJournal(file, journal) {
+  const temp = `${file}.${crypto.randomUUID()}.tmp`;
+  try {
+    await fs.writeFile(temp, JSON.stringify(journal), { mode: 0o600, flag: "wx" });
+    await fs.rename(temp, file);
+  } finally { await fs.rm(temp, { force: true }); }
+}
+
+// Caller holds sync.lock and commits cursors after this returns, before upload.
+// Only append to queue.jsonl; the caller compacts its pending suffix with
+// minPendingBytes:0 after cursor commit, preserving uploaded bytes and offset.
+// Parsers are injected to keep rollout.js independent of its migration helper.
+async function repairKimiModelAttribution({ cursors, queuePath, queueStatePath, legacyFiles = [], officialFiles = [], parseLegacy, parseOfficial, env = process.env }) {
+  const journalPath = `${queuePath}.kimi-model-repair.json`;
+  const migrations = cursors.migrations || {};
+  const applied = migrations[KIMI_MODEL_REPAIR_KEY];
+  if (applied?.status === "applied" || applied?.status === "noop") {
+    await fs.rm(journalPath, { force: true });
+    return { repaired: false, pendingCompaction: applied.pendingCompaction === true };
+  }
+  let journal = await readJson(journalPath);
+  if (!journal) {
+    const rawQueue = await readBytes(queuePath);
+    const live = latestRows(rawQueue);
+    for (const [key, bucket] of Object.entries(cursors.hourly?.buckets || {})) {
+      if (!key.startsWith("kimi|") || live.has(key)) continue;
+      const [, model, hour_start] = key.split("|");
+      live.set(key, { source: "kimi", model, hour_start, ...bucket.totals });
+    }
+    if (![...live.values()].some((row) => Number(row.total_tokens) > 0)) {
+      (cursors.migrations ||= {})[KIMI_MODEL_REPAIR_KEY] = { status: "noop", appliedAt: new Date().toISOString() };
+      return { repaired: false, pendingCompaction: false };
+    }
+    const files = [...new Set([...legacyFiles, ...officialFiles])];
+    const discovered = new Set(files);
+    const previousFiles = Object.entries(cursors.kimi?.fileOffsets || {}).concat(Object.entries(cursors.kimiCode?.fileOffsets || {}));
+    if (!officialFiles.length || previousFiles.some(([file]) => !discovered.has(file))) {
+      return { repaired: false, pendingCompaction: false, deferred: "missing-source" };
+    }
+    const signatures = new Map();
+    try {
+      for (const file of files) signatures.set(file, await fileSignature(file));
+      if (previousFiles.some(([file, prior]) => signatures.get(file).size < Number(prior.size || 0))) {
+        return { repaired: false, pendingCompaction: false, deferred: "truncated-source" };
+      }
+    } catch {
+      return { repaired: false, pendingCompaction: false, deferred: "unreadable-source" };
+    }
+    const scratch = await fs.mkdtemp(path.join(path.dirname(queuePath), ".kimi-model-repair-"));
+    const rebuilt = { version: 1, hourly: { version: 3, buckets: {}, groupQueued: {} } };
+    let corrected;
+    try {
+      const scratchQueue = path.join(scratch, "queue.jsonl");
+      await parseLegacy({ wireFiles: legacyFiles, cursors: rebuilt, queuePath: scratchQueue, env });
+      await parseOfficial({ wireFiles: officialFiles, cursors: rebuilt, queuePath: scratchQueue, env });
+      corrected = latestRows(await readBytes(scratchQueue));
+      for (const file of files) {
+        if (JSON.stringify(await fileSignature(file)) !== JSON.stringify(signatures.get(file))) {
+          return { repaired: false, pendingCompaction: false, deferred: "source-changed" };
+        }
+      }
+    } finally { await fs.rm(scratch, { recursive: true, force: true }); }
+    // Missing/corrupt history or newly appended usage must first settle through
+    // ordinary sync. A model-only repair may never change per-hour token totals.
+    if (!sameTotals(live, corrected)) return { repaired: false, pendingCompaction: false, deferred: "totals-not-conserved" };
+    const currentQueue = await readBytes(queuePath);
+    if (!currentQueue.equals(rawQueue)) return { repaired: false, pendingCompaction: false, deferred: "queue-changed" };
+    const state = await readJson(queueStatePath) || {};
+    const offset = Number(state.offset || 0);
+    if (!Number.isSafeInteger(offset) || offset < 0 || offset > rawQueue.length || (offset > 0 && rawQueue[offset - 1] !== 10)) {
+      return { repaired: false, pendingCompaction: false, deferred: "invalid-upload-offset" };
+    }
+    const corrections = [];
+    for (const [key, old] of live) {
+      if (!corrected.has(key)) corrections.push({ source: "kimi", model: old.model, hour_start: old.hour_start,
+        ...Object.fromEntries(TOKEN_FIELDS.map((field) => [field, 0])), billable_total_tokens: 0, conversation_count: 0 });
+    }
+    for (const [key, row] of corrected) if (!sameSnapshot(live.get(key), row)) corrections.push(row);
+    journal = { version: 1, uploadedOffset: offset, uploadedPrefixSha256: digest(rawQueue.subarray(0, offset)),
+      rows: corrections, kimi: rebuilt.kimi || {}, kimiCode: rebuilt.kimiCode || {}, hourly: rebuilt.hourly,
+      preparedAt: new Date().toISOString() };
+    await writeJournal(journalPath, journal);
+  }
+  const rawQueue = await readBytes(queuePath);
+  const state = await readJson(queueStatePath) || {};
+  if (journal.version !== 1 || !Number.isSafeInteger(journal.uploadedOffset) || journal.uploadedOffset < 0
+    || rawQueue.length < journal.uploadedOffset || Number(state.offset || 0) < journal.uploadedOffset
+    || digest(rawQueue.subarray(0, journal.uploadedOffset)) !== journal.uploadedPrefixSha256) {
+    return { repaired: false, pendingCompaction: false, deferred: "uploaded-prefix-changed" };
+  }
+  if (journal.rows.length) {
+    // A prior append can have stopped halfway through a JSON line. Preserve
+    // those bytes, terminate that incomplete record, then append complete LWW
+    // snapshots again. The journal bypasses conservation checks on partial work.
+    const separator = rawQueue.length && rawQueue.at(-1) !== 10 ? "\n" : "";
+    await fs.appendFile(queuePath, separator + journal.rows.map(JSON.stringify).join("\n") + "\n");
+  }
+  const hourly = (cursors.hourly ||= { version: 3, buckets: {}, groupQueued: {} });
+  for (const field of ["buckets", "groupQueued"]) {
+    hourly[field] ||= {};
+    for (const key of Object.keys(hourly[field])) if (key.startsWith("kimi|")) delete hourly[field][key];
+    for (const [key, value] of Object.entries(journal.hourly?.[field] || {})) if (key.startsWith("kimi|")) hourly[field][key] = value;
+  }
+  cursors.kimi = journal.kimi;
+  cursors.kimiCode = journal.kimiCode;
+  (cursors.migrations ||= {})[KIMI_MODEL_REPAIR_KEY] = {
+    status: "applied", appliedAt: new Date().toISOString(), correctedBuckets: journal.rows.length,
+    pendingCompaction: journal.rows.length > 0,
+  };
+  // Leave the journal until the next call observes the persisted marker.
+  return { repaired: true, pendingCompaction: journal.rows.length > 0 };
+}
+
+module.exports = { KIMI_MODEL_REPAIR_KEY, repairKimiModelAttribution };

package/src/lib/kimi-session.js

@@ -0,0 +1,216 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const { physicalJsonlRecords } = require("./jsonl-lines");
+const { resolveKimiDefaultModel } = require("./rollout");
+const { mergePerformance } = require("./session-performance");
+
+function readObject(file) {
+  try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return {}; }
+}
+
+function kimiSessionLocation(file) {
+  const official = path.basename(path.dirname(path.dirname(file))) === "agents";
+  const directory = official ? path.dirname(path.dirname(path.dirname(file))) : path.dirname(file);
+  const id = path.basename(directory);
+  const imported = official ? readObject(path.join(directory, "state.json"))?.custom : null;
+  // The official migrator keeps the legacy UUID under ses_<UUID>. Group its
+  // message-only mirror with the original wire, retaining any new usage tail.
+  const identity = imported?.imported_from_kimi_cli && typeof imported.kimi_cli_session_id === "string"
+    ? imported.kimi_cli_session_id : id.replace(/^(?:ses_|session_)(?=[0-9a-f-]{36}$)/i, "");
+  return { directory, id, identity, official, main: !official || path.basename(path.dirname(file)) === "main" };
+}
+
+function kimiSessionDependencies(files) {
+  return [...new Set(files.flatMap((file) => {
+    const location = kimiSessionLocation(file);
+    const root = path.dirname(path.dirname(path.dirname(location.directory)));
+    return [path.join(location.directory, "state.json"), path.join(root, "config.toml"), path.join(root, "kimi.json")];
+  }))];
+}
+
+function discoverKimiWireFiles(roots, incomplete) {
+  const files = new Set();
+  function walk(directory, depth = 0) {
+    if (depth > 5) return;
+    let entries;
+    try { entries = fs.readdirSync(directory, { withFileTypes: true }); } catch (error) {
+      if (error.code !== "ENOENT") incomplete.push({ path: directory, error: error.code || "unreadable" });
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) walk(file, depth + 1);
+      else if (entry.isFile() && entry.name === "wire.jsonl") files.add(file);
+    }
+  }
+  for (const root of roots) walk(path.join(root, "sessions"));
+  return [...files].sort();
+}
+
+const count = (value) => Number.isFinite(Number(value)) ? Math.max(0, Math.floor(Number(value))) : 0;
+function kimiUsage(usage, legacy) {
+  if (!usage || typeof usage !== "object") return null;
+  let input, cached, created, output;
+  // Same column semantics as parseKimiIncremental / parseKimiCodeIncremental.
+  if (legacy || usage.inputOther != null) {
+    input = count(legacy ? usage.input_other : usage.inputOther);
+    cached = count(legacy ? usage.input_cache_read : usage.inputCacheRead);
+    created = count(legacy ? usage.input_cache_creation : usage.inputCacheCreation);
+    output = count(usage.output);
+  } else {
+    created = count(usage.cache_creation_input_tokens);
+    cached = count(usage.cache_read_input_tokens ?? usage.input_tokens_details?.cached_tokens);
+    input = Math.max(0, count(usage.input_tokens) - (usage.cache_read_input_tokens != null ? 0 : cached));
+    output = count(usage.output_tokens);
+  }
+  return { input_tokens: input, cached_input_tokens: cached, cache_creation_input_tokens: created,
+    output_tokens: output, reasoning_output_tokens: 0, total_tokens: input + cached + created + output };
+}
+
+const modelAlias = (value) => typeof value === "string" && value.trim() ? value.trim().split("/").pop() : null;
+const EDIT_TOOLS = new Set(["edit", "write", "multiedit", "notebookedit", "strreplacefile", "writefile", "apply_patch"]);
+const AGENT_TOOLS = new Set(["agent", "agentswarm", "task"]);
+const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
+
+// Reads both wire protocols into metadata only. A full inventory shares its
+// usage-ID set, as sync does, so copied/forked step records count only once.
+async function readKimiSessions(files) {
+  const groups = new Map();
+  for (const file of [...new Set(files)]) {
+    const location = kimiSessionLocation(file);
+    const group = groups.get(location.identity) || { identity: location.identity, files: [], createdAt: Infinity };
+    const state = location.official ? readObject(path.join(location.directory, "state.json")) : {};
+    group.createdAt = Math.min(group.createdAt, Number(state.createdAt) || Infinity);
+    group.files.push({ file, ...location, state });
+    groups.set(location.identity, group);
+  }
+  const seenUsage = new Set();
+  const seenSignals = new Set();
+  const rows = [];
+  for (const group of [...groups.values()].sort((a, b) => a.createdAt - b.createdAt || a.identity.localeCompare(b.identity))) {
+    const tokens = kimiUsage({}, true);
+    const modelUsage = new Map();
+    const buckets = new Map();
+    const times = new Set();
+    let turns = 0, edits = 0, retries = 0, agents = 0, errors = 0;
+    let lastPrompt = null;
+    let cwd = null;
+    let resumeId = null;
+    const modelsForEdits = new Map();
+    // Legacy first preserves migrated user turns; context.append_message in
+    // the imported wire is history, never another prompt or usage event.
+    group.files.sort((a, b) => Number(a.official) - Number(b.official) || Number(b.main) - Number(a.main) || a.file.localeCompare(b.file));
+    for (const location of group.files) {
+      const root = path.dirname(path.dirname(path.dirname(location.directory)));
+      let model = resolveKimiDefaultModel({ KIMI_HOME: root });
+      if (location.official && location.main) {
+        resumeId = location.id;
+        if (typeof location.state.workDir === "string") cwd = location.state.workDir;
+      }
+      if (!location.official && !cwd) {
+        const workspaceHash = path.basename(path.dirname(location.directory));
+        const workDirs = readObject(path.join(root, "kimi.json"))?.work_dirs;
+        const workspace = Array.isArray(workDirs) && workDirs.find((row) => typeof row?.path === "string"
+          && crypto.createHash("md5").update(row.path).digest("hex") === workspaceHash);
+        if (workspace) cwd = workspace.path;
+      }
+      let turnOpen = false, hadEdit = false, turnModel = model;
+      const closeTurn = () => {
+        if (hadEdit) { edits++; modelsForEdits.set(turnModel, (modelsForEdits.get(turnModel) || 0) + 1); }
+        hadEdit = false; turnOpen = false;
+      };
+      const input = fs.createReadStream(location.file);
+      for await (const { line, terminated } of physicalJsonlRecords(input)) {
+        if (!terminated || !line) continue;
+        let entry;
+        try { entry = JSON.parse(line); } catch { continue; }
+        if (!entry || typeof entry !== "object") continue;
+        const message = entry.message && typeof entry.message === "object" ? entry.message : null;
+        const event = entry.type === "context.append_loop_event" ? entry.event : entry;
+        const timestampMs = Number(location.official ? entry.time ?? event?.time : entry.timestamp ?? message?.payload?.timestamp) * (location.official ? 1 : 1000);
+        const timestamp = Number.isFinite(timestampMs) && timestampMs > 0 && timestampMs <= 8640000000000000
+          ? new Date(timestampMs).toISOString() : null;
+        if (timestamp) times.add(timestampMs);
+        if (["config.update", "profile.bind", "llm.request"].includes(entry.type)) {
+          model = modelAlias(entry.modelAlias || entry.model) || model;
+          if (location.main && typeof (entry.cwd || entry.environmentDisclosure?.cwd) === "string") cwd = entry.cwd || entry.environmentDisclosure.cwd;
+        }
+        const isLegacyUsage = message?.type === "StatusUpdate";
+        const usage = isLegacyUsage ? message.payload?.token_usage : event?.type === "step.end" ? event.usage : null;
+        const usageId = isLegacyUsage ? message.payload?.message_id : event?.uuid;
+        if (usage && typeof usageId === "string" && timestamp) {
+          const ids = [isLegacyUsage ? `message:${usageId}` : `step:${usageId}`];
+          if (!isLegacyUsage && typeof event.messageId === "string") ids.push(`message:${event.messageId}`);
+          const delta = kimiUsage(usage, isLegacyUsage);
+          if (delta.total_tokens > 0 && !ids.some((id) => seenUsage.has(id))) {
+            for (const id of ids) seenUsage.add(id);
+            const modelRow = modelUsage.get(model) || { model, ...kimiUsage({}, true), usage_events: 0 };
+            const bucketTime = new Date(Math.floor(timestampMs / 60000) * 60000).toISOString();
+            const key = `${model}\0${bucketTime}`;
+            const bucket = buckets.get(key) || { model, timestamp: bucketTime, ...kimiUsage({}, true), usage_events: 0 };
+            for (const field of Object.keys(delta)) { tokens[field] += delta[field]; modelRow[field] += delta[field]; bucket[field] += delta[field]; }
+            modelRow.usage_events++; bucket.usage_events++;
+            const streamMs = count(event.llmStreamDurationMs);
+            const firstMs = Number(event.llmFirstTokenLatencyMs);
+            const performance = {
+              ...(delta.output_tokens >= 200 && streamMs >= 1000 && streamMs <= 3600000
+                ? { estimated_output_tokens: delta.output_tokens, estimated_duration_ms: streamMs, estimated_request_count: 1 } : {}),
+              ...(event.llmFirstTokenLatencyMs != null && Number.isFinite(firstMs) && firstMs >= 0
+                ? { first_response_total_ms: firstMs, first_response_sample_count: 1 } : {}),
+            };
+            modelRow.performance = mergePerformance(modelRow.performance, performance);
+            modelUsage.set(model, modelRow); buckets.set(key, bucket);
+            turnModel = model;
+          }
+        }
+        if (!location.main) continue;
+        const signalId = hash(line);
+        if (seenSignals.has(signalId)) continue;
+        seenSignals.add(signalId);
+        const prompt = message?.type === "TurnBegin" ? message.payload?.user_input
+          : entry.type === "turn.prompt" && (!entry.origin?.kind || entry.origin.kind === "user") ? entry.input : null;
+        if (prompt != null) {
+          closeTurn(); turns++; turnOpen = true; turnModel = model;
+          // Fingerprints live only for this scan; no text or hash is persisted.
+          const fingerprint = hash(JSON.stringify(prompt));
+          if (lastPrompt && fingerprint === lastPrompt) retries++;
+          lastPrompt = fingerprint;
+        }
+        const tool = message?.type === "ToolCall" ? message.payload?.function?.name : event?.type === "tool.call" ? event.name : null;
+        if (typeof tool === "string") {
+          const name = tool.toLowerCase();
+          if (turnOpen && EDIT_TOOLS.has(name)) hadEdit = true;
+          if (AGENT_TOOLS.has(name)) agents++;
+        }
+        if (entry.type === "turn.step.retrying" || message?.type === "StepInterrupted") errors++;
+        if (message?.type === "TurnEnd" || entry.type === "turn.ended") closeTurn();
+      }
+      closeTurn();
+    }
+    const orderedTimes = [...times].sort((a, b) => a - b);
+    let activeMs = 0;
+    for (let i = 1; i < orderedTimes.length; i++) {
+      const gap = orderedTimes[i] - orderedTimes[i - 1];
+      if (gap <= 30 * 60 * 1000) activeMs += gap;
+    }
+    const models = [...modelUsage.values()].map((row) => ({ ...row, edit_turns: modelsForEdits.get(row.model) || 0 }));
+    if (!tokens.total_tokens && !turns) continue;
+    rows.push({ identity: group.identity, files: group.files.map((row) => row.file), session_id: resumeId,
+      title: null, project_ref: cwd, model: models.length === 1 ? models[0].model : "unknown", model_usage: models,
+      usage_buckets: [...buckets.values()], tokens, turns, edit_turns: edits, retry_turns: retries,
+      subagent_calls: agents, subagent_types: {}, error_count: errors,
+      usage_events: models.reduce((sum, row) => sum + row.usage_events, 0),
+      started_at: orderedTimes.length ? new Date(orderedTimes[0]).toISOString() : null,
+      ended_at: orderedTimes.length ? new Date(orderedTimes.at(-1)).toISOString() : null, active_ms: activeMs,
+      performance: mergePerformance(...models.map((row) => row.performance)),
+      provenance: { source: "local-session-log", confidence: "observed", retry_confidence: "inferred", content_retained: false, usage: "kimi-wire-metadata" },
+    });
+  }
+  return rows;
+}
+
+module.exports = { discoverKimiWireFiles, kimiSessionDependencies, readKimiSessions };

package/src/lib/local-api.js

@@ -13,6 +13,7 @@ const {
   normalizeUsageScope,
 } = require("./source-metadata");
 const { accountSlugFor, fetchAccountUsage, mintAccessToken, invalidateCloudAccountPayloadCache, getCloudAccountSessionGeneration } = require("./cloud-account");
+const { resetCloudDeviceUsage, readCloudUsageReset } = require("./cloud-usage-reset");
 const { getOrCreateMachineId, computeStableMachineId } = require("./machine-id");
 const { functionUrlFor, fetchFunctionResponse } = require("./function-url");
 const { createCloudDeviceTokenStore } = require("./cloud-device-token");
@@ -2162,6 +2163,39 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
       return true;
     }
 
+    if (p === "/functions/tokentracker-cloud-usage-reset") {
+      if (!isAuthorizedLocalMutation(req) || req.headers["sec-fetch-site"] === "cross-site") { json(res, { error: "Unauthorized" }, 401); return true; }
+      try {
+        if (String(req.method).toUpperCase() === "GET") {
+          json(res, { pending: Boolean(readCloudUsageReset(trackerDataDir)) }); return true;
+        }
+        if (String(req.method).toUpperCase() !== "POST") { json(res, { error: "Method Not Allowed" }, 405); return true; }
+        const body = await readJsonBody(req);
+        const session = localCloudSession;
+        if (!getCloudSyncPref() || !session || body.cloudSessionId !== session.id || body.expectedOwnerId !== session.ownerId) {
+          json(res, { code: "auth_session_changed" }, 409); return true;
+        }
+        const metadata = localSyncDeviceMetadata.get(session.token);
+        const accessToken = String(req.headers.authorization || "").replace(/^Bearer /i, "").trim();
+        const runtime = assertInsforgeRuntime(getRuntime());
+        let claims;
+        try { claims = JSON.parse(Buffer.from(accessToken.split(".")[1], "base64url").toString("utf8")); } catch { /* rejected below */ }
+        if (claims?.sub !== session.ownerId || !Number.isFinite(claims?.exp) || claims.exp * 1000 <= Date.now()) {
+          json(res, { code: "auth_required" }, 401); return true;
+        }
+        const isCurrent = () => getCloudSyncPref() && localCloudSession === session && session.generation === localCloudGeneration &&
+          claims.exp * 1000 > Date.now() && getRuntime().baseUrl === session.baseUrl;
+        const result = await resetCloudDeviceUsage({ trackerDir: trackerDataDir, ownerId: session.ownerId,
+          deviceId: metadata?.deviceId, baseUrl: session.baseUrl, anonKey: runtime.anonKey, accessToken, isCurrent });
+        if (!isCurrent()) { json(res, { code: "auth_session_changed" }, 409); return true; }
+        clearLocalSyncDeviceTokenCache();
+        invalidateAfterAccountUpload();
+        invalidateCloudAccountPayloadCache();
+        json(res, { ...result, pending: true });
+      } catch (error) { json(res, { error: error.code || "cloud_usage_reset_failed", code: error.code || null }, error.status || 502); }
+      return true;
+    }
+
     // --- local-sync (POST) ---
     if (p === "/functions/tokentracker-local-sync") {
       if (String(req.method || "GET").toUpperCase() !== "POST") {
@@ -2263,10 +2297,20 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         if (extraEnv.TOKENTRACKER_DEVICE_TOKEN && uploadGeneration !== localCloudGeneration) {
           json(res, { ok: false, code: "auth_session_changed" }, 409); return true;
         }
+        if (extraEnv.TOKENTRACKER_DEVICE_TOKEN) {
+          const metadata = localSyncDeviceMetadata.get(extraEnv.TOKENTRACKER_DEVICE_TOKEN);
+          if (metadata?.deviceId) extraEnv.TOKENTRACKER_CLOUD_DEVICE_ID = metadata.deviceId;
+        }
         await Promise.all([...activeCloudSyncs].filter(controller => controller.signal.aborted).map(controller => controller.done).filter(Boolean));
         if (extraEnv.TOKENTRACKER_DEVICE_TOKEN && uploadGeneration !== localCloudGeneration) throw Object.assign(new Error("Account session changed"), { code: "auth_session_changed", status: 409 });
         if (extraEnv.TOKENTRACKER_DEVICE_TOKEN && localSyncDeviceTokenUserId) {
-          const binding = JSON.stringify({ ownerId: localSyncDeviceTokenUserId, baseUrl: localSyncBaseUrl || getRuntime().baseUrl });
+          const uploadBaseUrl = localSyncBaseUrl || getRuntime().baseUrl;
+          const reset = readCloudUsageReset(trackerDataDir);
+          if (reset && (reset.ownerId !== localSyncDeviceTokenUserId || reset.baseUrl.replace(/\/$/, "") !== uploadBaseUrl.replace(/\/$/, "") ||
+              (extraEnv.TOKENTRACKER_CLOUD_DEVICE_ID && reset.deviceId !== extraEnv.TOKENTRACKER_CLOUD_DEVICE_ID))) {
+            json(res, { ok: false, code: "cloud_usage_reset_owner_changed" }, 409); return true;
+          }
+          const binding = JSON.stringify({ ownerId: localSyncDeviceTokenUserId, baseUrl: uploadBaseUrl });
           const ownerPath = path.join(path.dirname(qp), "cloud-upload-owner.json");
           let previous = "";
           try { previous = fs.readFileSync(ownerPath, "utf8"); } catch { /* an unbound legacy cursor cannot prove its previous owner */ }
@@ -2279,6 +2323,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         const controller = new AbortController();
         if (extraEnv.TOKENTRACKER_DEVICE_TOKEN) activeCloudSyncs.add(controller);
         const syncStartedAt = Date.now();
+        if (localSyncDeviceTokenUserId) extraEnv.TOKENTRACKER_CLOUD_OWNER_ID = localSyncDeviceTokenUserId;
         extraEnv.TOKENTRACKER_LOCAL_SYNC_ATTEMPT_ID = crypto.randomUUID();
         const syncPromise = runSyncCommand(extraEnv, {
           signal: controller.signal,