tokentracker-cli 1.3.16 → 1.4.2

package/src/commands/doctor.js

@@ -5,6 +5,7 @@ const { readJsonStrict, writeFileAtomic, chmod600IfPossible } = require("../lib/
 const { resolveTrackerPaths } = require("../lib/tracker-paths");
 const { collectTrackerDiagnostics } = require("../lib/diagnostics");
 const { resolveRuntimeConfig } = require("../lib/runtime-config");
+const { resolveDeviceTokenPresence } = require("../lib/cloud-device-token");
 const { buildDoctorReport } = require("../lib/doctor");
 
 async function cmdDoctor(argv = []) {
@@ -16,11 +17,24 @@ async function cmdDoctor(argv = []) {
   const configStatus = await readJsonStrict(configPath);
   const config =
     configStatus.status === "ok" && isPlainObject(configStatus.value) ? configStatus.value : {};
-  const runtime = resolveRuntimeConfig({
+  let runtime = resolveRuntimeConfig({
     cli: { baseUrl: opts.baseUrl },
     config,
     env: process.env,
   });
+  const deviceTokenPresence = resolveDeviceTokenPresence({
+    trackerDir,
+    config,
+    runtime,
+  });
+  if (deviceTokenPresence.set && !(typeof runtime.deviceToken === "string" && runtime.deviceToken.trim())) {
+    // Sentinel only — doctor reports set/unset and never uses the value for auth.
+    runtime = {
+      ...runtime,
+      deviceToken: "present",
+      sources: { ...(runtime.sources || {}), deviceToken: deviceTokenPresence.source },
+    };
+  }
   const diagnostics = await collectTrackerDiagnostics({ home });
   const cliPath = process.argv[1] ? path.resolve(process.argv[1]) : null;
 

package/src/commands/init.js

@@ -79,6 +79,7 @@ const {
   resolveAnythingllmDbPath,
   resolveDevinDbPath,
   resolveReasonixHome,
+  resolveMuseHome,
   resolveTraeStoragePath,
 } = require("../lib/rollout");
 const { resolveRuntimeConfig, DEFAULT_BASE_URL, normalizeInstanceBaseUrl, assertInsforgeRuntime,
@@ -141,6 +142,7 @@ const SUPPORTED_PROVIDERS = [
   "Prime Agent",
   "Craft Agents",
   "Reasonix",
+  "Muse Code",
   "Kilo CLI",
   "Kilo Code",
   "Roo Code",
@@ -882,6 +884,13 @@ async function applyIntegrationSetup({
     }
   }
 
+  // Muse Code: passive reader of ~/.local/share/muse/sessions/**/session.jsonl.
+  {
+    if (fssync.existsSync(path.join(resolveMuseHome(process.env), "sessions"))) {
+      summary.push({ label: "Muse Code", status: "detected", detail: "Passive session reader (no hook needed)" });
+    }
+  }
+
   // International TRAE usage is read locally; no hook or vendor login is needed.
   {
     const { resolveTraeDbPaths } = require("../lib/trae-db");

package/src/commands/status.js

@@ -47,6 +47,7 @@ const {
   probeOpenclawSessionPluginState,
 } = require("../lib/openclaw-session-plugin");
 const { resolveTrackerPaths } = require("../lib/tracker-paths");
+const { resolveDeviceTokenPresence } = require("../lib/cloud-device-token");
 const {
   resolveKimiWireFiles,
   resolveKimiCodeWireFiles,
@@ -74,6 +75,8 @@ const {
   resolveCraftConfigDir,
   resolveReasonixHome,
   resolveReasonixTelemetryFiles,
+  resolveMuseHome,
+  resolveMuseSessionFiles,
   resolveKilocodeTaskFiles,
   resolveRoocodeTaskFiles,
   resolveClineSessionFilesWithStatus,
@@ -552,6 +555,10 @@ async function cmdStatus(argv = []) {
   const reasonixInstalled = Boolean(reasonixHome && fssync.existsSync(reasonixHome));
   const reasonixFiles = reasonixInstalled ? resolveReasonixTelemetryFiles(process.env) : [];
 
+  // Muse Code (Meta) — passive scan of per-session session.jsonl logs.
+  const museInstalled = fssync.existsSync(path.join(resolveMuseHome(process.env), "sessions"));
+  const museFiles = museInstalled ? resolveMuseSessionFiles(process.env) : [];
+
   // Kilo CLI (kilo.ai @kilocode/plugin) — passive scan of kilo.db.
   const xdgDataHome = process.env.XDG_DATA_HOME || path.join(home, ".local", "share");
   const kiloHome = process.env.KILO_HOME || path.join(xdgDataHome, "kilo");
@@ -1036,12 +1043,17 @@ async function cmdStatus(argv = []) {
     },
   });
 
+  const deviceTokenPresence = resolveDeviceTokenPresence({
+    trackerDir,
+    config: config || {},
+  });
+
   if (opts.json || opts.light) {
     const summary = {
       version: pkg.version,
       generated_at: new Date().toISOString(),
       base_url: config?.baseUrl || null,
-      device_token_set: Boolean(config?.deviceToken),
+      device_token_set: deviceTokenPresence.set,
       queue: {
         pending_bytes: pendingBytes,
         size_bytes: queueSize,
@@ -1136,6 +1148,9 @@ async function cmdStatus(argv = []) {
         reasonix: reasonixInstalled
           ? { installed: true, files: reasonixFiles.length }
           : { installed: false },
+        muse: museInstalled
+          ? { installed: true, files: museFiles.length }
+          : { installed: false },
         anythingllm: anythingllmInstalled
           ? { installed: true, detail: anythingllmDbPath }
           : { installed: false },
@@ -1271,7 +1286,7 @@ async function cmdStatus(argv = []) {
       `TokenTracker v${pkg.version}`,
       "Status:",
       `- Base URL: ${config?.baseUrl || "unset"}`,
-      `- Device token: ${config?.deviceToken ? "set" : "unset"}`,
+      `- Device token: ${deviceTokenPresence.set ? "set" : "unset"}`,
       `- Queue: ${pendingBytes} bytes pending`,
       `- Last parse: ${cursors?.updatedAt || "never"}`,
       `- Last notify: ${lastNotify || "never"}`,
@@ -1300,7 +1315,7 @@ async function cmdStatus(argv = []) {
         ? `- Kimi Code: passive reader (${kimiWireFiles.length + kimiCodeWireFiles.length} wire.jsonl file${(kimiWireFiles.length + kimiCodeWireFiles.length) !== 1 ? "s" : ""} found, directories: ${kimiActive.join(" | ") || "none"})`
         : null,
       kiroCliInstalled
-        ? `- Kiro CLI: passive reader (${kiroCliFileCount} session file${kiroCliFileCount !== 1 ? "s" : ""} found, SQLite ${kiroCliDbFound ? "found" : "not found"}, installs: ${kiroCliActive.join(" | ")}; tokens approximated from char lengths and merged under 'kiro')`
+        ? `- Kiro CLI: passive reader (${kiroCliFileCount} session file${kiroCliFileCount !== 1 ? "s" : ""} found, SQLite ${kiroCliDbFound ? "found" : "not found"}, installs: ${kiroCliActive.join(" | ")}; missing token counts use new-text estimates at ~4 chars/token, excluding re-sent history, system context and cache usage; model-rate costs are separate from Kiro credit charges; merged under 'kiro')`
         : null,
       kiroIdeInstalled
         ? `- Kiro IDE: passive reader (${kiroIdeActive.join(" | ")})`
@@ -1335,6 +1350,9 @@ async function cmdStatus(argv = []) {
       reasonixInstalled
         ? `- Reasonix: passive reader (${reasonixFiles.length} telemetry file${reasonixFiles.length !== 1 ? "s" : ""} found)`
         : null,
+      museInstalled
+        ? `- Muse Code: passive reader (${museFiles.length} session jsonl file${museFiles.length !== 1 ? "s" : ""} found)`
+        : null,
       anythingllmInstalled
         ? `- AnythingLLM Desktop: passive reader (${anythingllmDbPath})`
         : null,

package/src/commands/sync.js

@@ -5,6 +5,8 @@ const fssync = require("node:fs");
 const cp = require("node:child_process");
 const readline = require("node:readline");
 const { functionUrlFor, fetchFunctionResponse } = require("../lib/function-url");
+const { cloudUsageResetBlocksUpload, finishCloudDeviceUsageReset } = require("../lib/cloud-usage-reset");
+const { KIMI_MODEL_REPAIR_KEY, repairKimiModelAttribution } = require("../lib/kimi-model-repair");
 
 const { resolveInstallPaths, resolveZcodeNativeDbPath, resolveMimoNativeDbPath, ensureFlatCursor } = require("../lib/install-resolver");
 const { multiInstallParse, mergeBothFileSources } = require("../lib/multi-install-parser");
@@ -100,6 +102,8 @@ const {
   parseCraftIncremental,
   resolveReasonixTelemetryFiles,
   parseReasonixIncremental,
+  resolveMuseSessionFiles,
+  parseMuseIncremental,
   resolveGrokBuildSessions,
   parseGrokBuildIncremental,
   resolveAntigravityDbPath,
@@ -347,6 +351,7 @@ const AUTO_SYNC_SOURCES = new Set([
   "lmstudio",
   "mimo",
   "minimax-code",
+  "muse",
   "omo",
   "omp",
   "opencode",
@@ -369,6 +374,7 @@ const BACKGROUND_AUTO_SYNC_SOURCES = new Set([
   "acode",
   "codex",
   "every-code",
+  "muse",
   "reasonix",
 ]);
 
@@ -542,7 +548,13 @@ async function cmdSync(argv, context = {}) {
   // Hooks, native publication and detached retries must honor the saved opt-in.
   const requiresCloudSyncPref = opts.auto || opts.background || opts.fromRetry || opts.fromNotify || opts.fromOpenclaw ||
     Boolean(process.env.TOKENTRACKER_LOCAL_SYNC_ATTEMPT_ID);
-  const canUpload = () => !requiresCloudSyncPref || readCloudSyncEnabled(trackerDir);
+  let cloudResetRuntime = null;
+  const canUpload = () => !cloudUsageResetBlocksUpload(trackerDir, {
+    ownerId: process.env.TOKENTRACKER_CLOUD_OWNER_ID,
+    baseUrl: cloudResetRuntime?.baseUrl || process.env.TOKENTRACKER_INSFORGE_BASE_URL,
+    deviceId: process.env.TOKENTRACKER_CLOUD_DEVICE_ID,
+  }) &&
+    (!requiresCloudSyncPref || readCloudSyncEnabled(trackerDir));
 
   await ensureDir(trackerDir);
   if (opts.fromOpenclaw) {
@@ -2508,6 +2520,17 @@ async function cmdSync(argv, context = {}) {
     const kimiWireFiles = sourceAllowed("kimi")
       ? mergeBothFileSources({ resolveFiles: resolveKimiWireFiles, env: process.env })
       : [];
+    const kimiCodeWireFiles = sourceAllowed("kimi-code")
+      ? mergeBothFileSources({ resolveFiles: resolveKimiCodeWireFiles, env: process.env })
+      : [];
+    if (isFullSourceScan && sourceAllowed("kimi") && sourceAllowed("kimi-code")) {
+      await repairKimiModelAttribution({
+        cursors, queuePath, queueStatePath,
+        legacyFiles: kimiWireFiles, officialFiles: kimiCodeWireFiles,
+        parseLegacy: parseKimiIncremental, parseOfficial: parseKimiCodeIncremental,
+        env: process.env,
+      });
+    }
     if (kimiWireFiles.length > 0) {
       if (progress?.enabled) {
         progress.start(`Parsing Kimi Code ${renderBar(0)} | buckets 0`);
@@ -2533,9 +2556,6 @@ async function cmdSync(argv, context = {}) {
 
     // ── Kimi Code official (@moonshot-ai/kimi-code, ~/.kimi-code) ──
     let kimiCodeResult = { recordsProcessed: 0, eventsAggregated: 0, bucketsQueued: 0 };
-    const kimiCodeWireFiles = sourceAllowed("kimi-code")
-      ? mergeBothFileSources({ resolveFiles: resolveKimiCodeWireFiles, env: process.env })
-      : [];
     if (kimiCodeWireFiles.length > 0) {
       if (progress?.enabled) {
         progress.start(`Parsing Kimi Code (official) ${renderBar(0)} | buckets 0`);
@@ -2899,6 +2919,25 @@ async function cmdSync(argv, context = {}) {
       }
     }
 
+    // Muse Code (Meta) — usage counts from per-session session.jsonl logs.
+    let museResult = { recordsProcessed: 0, eventsAggregated: 0, bucketsQueued: 0 };
+    const museFiles = sourceAllowed("muse")
+      ? mergeBothFileSources({ resolveFiles: resolveMuseSessionFiles, env: process.env })
+      : [];
+    if (museFiles.length > 0) {
+      try {
+        museResult = await parseMuseIncremental({
+          sessionFiles: museFiles,
+          cursors,
+          queuePath,
+          env: process.env,
+          onProgress: makeProviderProgress("Muse"),
+        });
+      } catch (err) {
+        warnProviderParseFailure("Muse", err, opts);
+      }
+    }
+
     // ── Grok Build (xAI) ──
     let grokResult = {
       recordsProcessed: 0,
@@ -3357,6 +3396,7 @@ async function cmdSync(argv, context = {}) {
       minimaxCodeResult.recordsProcessed +
       craftResult.recordsProcessed +
       reasonixResult.recordsProcessed +
+      museResult.recordsProcessed +
       grokResult.recordsProcessed +
       copilotResult.recordsProcessed +
       lmstudioResult.recordsProcessed +
@@ -3403,6 +3443,7 @@ async function cmdSync(argv, context = {}) {
       minimaxCodeResult.bucketsQueued +
       craftResult.bucketsQueued +
       reasonixResult.bucketsQueued +
+      museResult.bucketsQueued +
       grokResult.bucketsQueued +
       copilotResult.bucketsQueued +
       lmstudioResult.bucketsQueued +
@@ -3434,6 +3475,7 @@ async function cmdSync(argv, context = {}) {
       !codexColdAuditDue &&
       !codexFallbackRetryRan &&
       !grokHookSignalConsumed &&
+      !cursors.migrations?.[KIMI_MODEL_REPAIR_KEY]?.pendingCompaction &&
       !opts.repairGrok;
 
     if (syncDiagnostics) {
@@ -3458,6 +3500,12 @@ async function cmdSync(argv, context = {}) {
         deferredCodexAuditSyncs + 1,
       );
     }
+    if (cursors.migrations?.[KIMI_MODEL_REPAIR_KEY]?.pendingCompaction) {
+      const state = (await readJson(queueStatePath)) || { offset: 0 };
+      await compactPendingQueue({ queuePath, offset: Number(state.offset || 0), minPendingBytes: 0 });
+      cursors.migrations[KIMI_MODEL_REPAIR_KEY].pendingCompaction = false;
+      await cursorStore.commit(cursors);
+    }
     if (grokHookSignalConsumed && grokHookSignalPath) {
       await fs.unlink(grokHookSignalPath).catch(() => {});
     }
@@ -3490,6 +3538,7 @@ async function cmdSync(argv, context = {}) {
     const runtime = Object.hasOwn(process.env, "TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN")
       ? { ...resolvedRuntime, deviceToken: resolvedRuntime.configurationError ? null : process.env.TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN }
       : resolvedRuntime;
+    cloudResetRuntime = runtime;
 
     let uploadResult = { inserted: 0, skipped: 0 };
     let uploadAttempted = false;
@@ -3658,6 +3707,12 @@ async function cmdSync(argv, context = {}) {
     // and can keep auto retry alive even after cloud sync has drained.
     const pendingBytes = Math.max(0, queueSize - Number(afterState.offset || 0));
 
+    if (pendingBytes === 0 && canUpload() && runtime.deviceToken) {
+      await finishCloudDeviceUsageReset({ trackerDir, ownerId: process.env.TOKENTRACKER_CLOUD_OWNER_ID,
+        baseUrl: runtime.baseUrl, anonKey: runtime.anonKey, deviceToken: runtime.deviceToken,
+        deviceId: process.env.TOKENTRACKER_CLOUD_DEVICE_ID });
+    }
+
     if (pendingBytes <= 0 || !canUpload()) {
       await clearAutoRetry(trackerDir);
     } else if (opts.auto && uploadAttempted && !opts.publishAccount) {

package/src/lib/cloud-device-token.js

@@ -1,6 +1,10 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const crypto = require("node:crypto");
+const {
+  resolveRuntimeConfig,
+  normalizeInstanceBaseUrl,
+} = require("./runtime-config");
 
 function validBinding(binding) {
   return ["userId", "baseUrl", "machineId"].every(
@@ -8,6 +12,27 @@ function validBinding(binding) {
   );
 }
 
+function readCloudDeviceTokenEntry(filePath) {
+  let fd;
+  try {
+    fd = fs.openSync(filePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
+    if (!fs.fstatSync(fd).isFile()) return null;
+    fs.fchmodSync(fd, 0o600);
+    const data = JSON.parse(fs.readFileSync(fd, "utf8"));
+    if (data?.version === 1 && validBinding(data) && typeof data.token === "string" && data.token) {
+      return {
+        version: 1,
+        userId: data.userId,
+        baseUrl: data.baseUrl,
+        machineId: data.machineId,
+        token: data.token,
+      };
+    }
+  } catch { /* missing or invalid cache requires ordinary issuance */ }
+  finally { if (fd !== undefined) fs.closeSync(fd); }
+  return null;
+}
+
 // A successful auth refresh supplies the binding. This file never imports a
 // CLI config token, whose owner may belong to another signed-in account.
 function createCloudDeviceTokenStore(filePath) {
@@ -17,15 +42,7 @@ function createCloudDeviceTokenStore(filePath) {
   function load() {
     if (loaded) return entry;
     loaded = true;
-    let fd;
-    try {
-      fd = fs.openSync(filePath, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0));
-      if (!fs.fstatSync(fd).isFile()) return null;
-      fs.fchmodSync(fd, 0o600);
-      const data = JSON.parse(fs.readFileSync(fd, "utf8"));
-      if (data?.version === 1 && validBinding(data) && typeof data.token === "string" && data.token) entry = data;
-    } catch { /* missing or invalid cache requires ordinary issuance */ }
-    finally { if (fd !== undefined) fs.closeSync(fd); }
+    entry = readCloudDeviceTokenEntry(filePath);
     return entry;
   }
 
@@ -71,4 +88,54 @@ function createCloudDeviceTokenStore(filePath) {
   };
 }
 
-module.exports = { createCloudDeviceTokenStore };
+/**
+ * Presence for status/doctor/diagnostics — same stores upload uses.
+ * Prefer config/env/cli (resolveRuntimeConfig); else cloud-device-token.json
+ * when baseUrl (+ machineId when known) match. Never clears the store.
+ */
+function resolveDeviceTokenPresence({
+  trackerDir,
+  config = {},
+  runtime = null,
+  env = process.env,
+} = {}) {
+  const resolved = runtime || resolveRuntimeConfig({ config, env });
+  if (typeof resolved?.deviceToken === "string" && resolved.deviceToken.trim()) {
+    return {
+      set: true,
+      source: resolved.sources?.deviceToken || "config",
+    };
+  }
+
+  if (!trackerDir || typeof trackerDir !== "string") {
+    return { set: false, source: null };
+  }
+
+  const entry = readCloudDeviceTokenEntry(path.join(trackerDir, "cloud-device-token.json"));
+  if (!entry) return { set: false, source: null };
+
+  const expectedBase =
+    normalizeInstanceBaseUrl(resolved?.baseUrl) ||
+    (typeof resolved?.baseUrl === "string" ? resolved.baseUrl.trim() : "") ||
+    normalizeInstanceBaseUrl(config.baseUrl) ||
+    (typeof config.baseUrl === "string" ? config.baseUrl.trim() : "");
+  if (expectedBase && entry.baseUrl !== expectedBase) {
+    return { set: false, source: null };
+  }
+
+  const expectedMachine =
+    typeof config.machineId === "string" && config.machineId.trim()
+      ? config.machineId.trim()
+      : null;
+  if (expectedMachine && entry.machineId !== expectedMachine) {
+    return { set: false, source: null };
+  }
+
+  return { set: true, source: "cloud-device-token" };
+}
+
+module.exports = {
+  createCloudDeviceTokenStore,
+  resolveDeviceTokenPresence,
+  readCloudDeviceTokenEntry,
+};

package/src/lib/cloud-usage-reset.js

@@ -0,0 +1,115 @@
+const fs = require("node:fs");
+const fsp = require("node:fs/promises");
+const path = require("node:path");
+const crypto = require("node:crypto");
+const { openLock, writeFileAtomic } = require("./fs");
+const { functionUrlFor, fetchFunctionResponse } = require("./function-url");
+
+const MARKER = "cloud-usage-reset.json";
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const failure = (code, status = 409) => Object.assign(new Error(code), { code, status });
+const sameBase = (a, b) => String(a).replace(/\/$/, "") === String(b).replace(/\/$/, "");
+
+function readCloudUsageReset(trackerDir) {
+  let raw;
+  try { raw = fs.readFileSync(path.join(trackerDir, MARKER), "utf8"); }
+  catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  let value;
+  try { value = JSON.parse(raw); } catch { throw failure("cloud_usage_reset_invalid_state"); }
+  if (value?.version !== 1 || !UUID.test(value.operationId) || !UUID.test(value.deviceId) ||
+      !UUID.test(value.ownerId) || !/^https?:\/\//.test(value.baseUrl || "") ||
+      !["prepared", "uploading"].includes(value.phase)) throw failure("cloud_usage_reset_invalid_state");
+  return value;
+}
+
+function cloudUsageResetBlocksUpload(trackerDir, { ownerId, baseUrl, deviceId } = {}) {
+  try {
+    const marker = readCloudUsageReset(trackerDir);
+    return Boolean(marker && (marker.phase === "prepared" || marker.ownerId !== ownerId ||
+      !sameBase(marker.baseUrl, baseUrl) || (deviceId && marker.deviceId !== deviceId)));
+  }
+  catch { return true; }
+}
+
+async function writeMarker(trackerDir, marker) {
+  await writeFileAtomic(path.join(trackerDir, MARKER), JSON.stringify(marker) + "\n", { mode: 0o600 });
+}
+
+async function requestReset({ baseUrl, anonKey, authorization, body, fetchImpl = fetchFunctionResponse }) {
+  const response = await fetchImpl(functionUrlFor(baseUrl, "tokentracker-device-usage-reset"), {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${authorization}`,
+      ...(anonKey ? { apikey: anonKey } : {}) },
+    signal: AbortSignal.timeout(60_000),
+    body: JSON.stringify(body),
+  });
+  const data = await response.json().catch(() => ({}));
+  if (!response.ok || data.ok !== true) throw failure(data.code || "cloud_usage_reset_failed", response.status || 502);
+  if (data.operation_id !== body.operation_id) throw failure("cloud_usage_reset_invalid_response", 502);
+  return data;
+}
+
+// Called only after the local bridge has bound the JWT to its current device.
+// The marker precedes the remote mutation: an interrupted request must retry the
+// same operation, never clear already-replayed history a second time.
+async function resetCloudDeviceUsage({ trackerDir, ownerId, deviceId, baseUrl, anonKey, accessToken,
+  isCurrent = () => true, fetchImpl }) {
+  if (!UUID.test(ownerId) || !UUID.test(deviceId) || !accessToken) throw failure("auth_required", 401);
+  const lock = await openLock(path.join(trackerDir, "sync.lock"), { quietIfLocked: true });
+  if (!lock) throw failure("cloud_usage_reset_sync_busy");
+  try {
+    if (!isCurrent()) throw failure("auth_session_changed");
+    let marker = readCloudUsageReset(trackerDir);
+    const newOperation = !marker;
+    if (marker && (marker.ownerId !== ownerId || marker.deviceId !== deviceId || !sameBase(marker.baseUrl, baseUrl))) {
+      throw failure("cloud_usage_reset_owner_changed");
+    }
+    if (marker?.phase === "uploading") return { ok: true, operation_id: marker.operationId, status: "uploading" };
+    if (!marker) {
+      marker = { version: 1, operationId: crypto.randomUUID(), ownerId, deviceId, baseUrl, phase: "prepared" };
+      await writeMarker(trackerDir, marker);
+    }
+    if (!isCurrent()) throw failure("auth_session_changed");
+    const result = await requestReset({ baseUrl, anonKey, authorization: accessToken, fetchImpl,
+      body: { action: "reset", device_id: deviceId, operation_id: marker.operationId } }).catch(async error => {
+      // A definitive first-request rejection did not erase anything. Unknown
+      // outcomes and retries retain their operation so they cannot erase twice.
+      if (newOperation && [400, 401, 403, 404, 409, 422].includes(error.status)) {
+        await fsp.unlink(path.join(trackerDir, MARKER));
+      }
+      throw error;
+    });
+    if (result.device_id !== deviceId || !["reset", "complete"].includes(result.status)) {
+      throw failure("cloud_usage_reset_invalid_response", 502);
+    }
+    if (!isCurrent()) throw failure("auth_session_changed");
+    await writeFileAtomic(path.join(trackerDir, "queue.state.json"),
+      JSON.stringify({ offset: 0, updatedAt: new Date().toISOString() }) + "\n", { mode: 0o600 });
+    await fsp.unlink(path.join(trackerDir, "upload.throttle.json")).catch(error => { if (error.code !== "ENOENT") throw error; });
+    marker.phase = "uploading";
+    await writeMarker(trackerDir, marker);
+    return { ...result, status: "uploading" };
+  } finally { await lock.release(); }
+}
+
+// sync owns sync.lock here. Only its fully acknowledged queue can finish the
+// operation; a partial batch/checkpoint or another account leaves it pending.
+async function finishCloudDeviceUsageReset({ trackerDir, ownerId, deviceId, baseUrl, anonKey, deviceToken, fetchImpl }) {
+  const marker = readCloudUsageReset(trackerDir);
+  if (!marker || marker.phase !== "uploading" || marker.ownerId !== ownerId || (deviceId && marker.deviceId !== deviceId) || !sameBase(marker.baseUrl, baseUrl)) return false;
+  if (!deviceToken) return false;
+  const queuePath = path.join(trackerDir, "queue.jsonl");
+  const size = await fsp.stat(queuePath).then(stat => stat.size).catch(error => { if (error.code === "ENOENT") return 0; throw error; });
+  let offset;
+  try { offset = JSON.parse(await fsp.readFile(path.join(trackerDir, "queue.state.json"), "utf8")).offset; }
+  catch { throw failure("cloud_usage_reset_invalid_offset"); }
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset > size) throw failure("cloud_usage_reset_invalid_offset");
+  if (offset !== size) return false;
+  const result = await requestReset({ baseUrl, anonKey, authorization: deviceToken, fetchImpl,
+    body: { action: "refresh", operation_id: marker.operationId } });
+  if (result.status !== "complete" || result.device_id !== marker.deviceId) throw failure("cloud_usage_reset_invalid_response", 502);
+  await fsp.unlink(path.join(trackerDir, MARKER));
+  return true;
+}
+
+module.exports = { readCloudUsageReset, cloudUsageResetBlocksUpload, resetCloudDeviceUsage, finishCloudDeviceUsageReset };

package/src/lib/diagnostics.js

@@ -19,6 +19,7 @@ const { probeOpenclawHookState } = require("./openclaw-hook");
 const { probeOpenclawSessionPluginState } = require("./openclaw-session-plugin");
 const { probeGrokHookState } = require("./grok-hook");
 const { resolveTrackerPaths } = require("./tracker-paths");
+const { resolveDeviceTokenPresence } = require("./cloud-device-token");
 const wsl = require("./wsl-probe");
 // TASK-011: Kiro paths inlined here to avoid pulling the ~4000-line
 // rollout module on every `tokentracker status` / `diagnostics` call.
@@ -228,7 +229,7 @@ async function collectTrackerDiagnostics({
         ? { wsl_mode: wsl.getWslMode(process.env), wsl_installs: kiroWslInstalls }
         : {}),
       cli_approximation:
-        "Kiro CLI does not persist explicit token counts (billing is credit-based on Bedrock). Tokens are approximated at 4 chars/token from user prompt chars and assistant response chars. Source rows that came through this path have model='kiro-cli-agent' when the underlying model is unknown (auto-routing); known Bedrock ARNs canonicalize to their short name (e.g. claude-sonnet-4).",
+        "When Kiro CLI does not report token counts, tokens are estimated at ~4 chars/token from new user messages, tool outputs and assistant text. The estimate does not measure re-sent history, system context or cache usage, and can substantially undercount tool-heavy requests. contextUsage percentages are not converted to tokens because their denominator and request correspondence are not established. Dollar amounts use model rates, not Kiro credit charges; recorded usage_summary credits remain separate. Source rows use model='kiro-cli-agent' when the underlying model is unknown; known Bedrock ARNs canonicalize to their short name (e.g. claude-sonnet-4).",
       merge_policy:
         "Kiro IDE and Kiro CLI both emit source='kiro' in queue.jsonl so token, cost, heatmap, and leaderboard aggregations merge transparently. Use this block to distinguish sub-path contributions.",
     },
@@ -238,7 +239,9 @@ async function collectTrackerDiagnostics({
     },
     config: {
       base_url: typeof config?.baseUrl === "string" ? config.baseUrl : null,
-      device_token: config?.deviceToken ? "set" : "unset",
+      device_token: resolveDeviceTokenPresence({ trackerDir, config: config || {} }).set
+        ? "set"
+        : "unset",
       device_id: maskId(config?.deviceId),
       installed_at: typeof config?.installedAt === "string" ? config.installedAt : null,
     },