tokentracker-cli 1.5.0 → 1.5.2

package/src/lib/qoder-limits.js

@@ -40,6 +40,14 @@ const QODER_ACTIVITY_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const QODER_LIMITS_CACHE_FILE = "qoder-usage-limits-cache.json";
 const QODER_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 const QODER_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
+// Qoder Desktop 0.4+ writes its account usage summary to main.log, which can
+// accumulate a whole session before the quota is read. Scan a bounded window
+// backwards instead of assuming the summary is near EOF.
+const QODER_LOG_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+const QODER_LOG_SCAN_MAX_BYTES = 8 * 1024 * 1024;
+const QODER_LOG_SCAN_CHUNK_BYTES = 512 * 1024;
+const QODER_LOG_SCAN_OVERLAP_BYTES = 64 * 1024;
+const QODER_LOG_MAX_FILES = 8;
 const QODER_SERVER_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
 MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDA8iMH5c02LilrsERw9t6Pv5Nc
 4k6Pz1EaDicBMpdpxKduSZu5OANqUq8er4GM95omAGIOPOh+Nx0spthYA2BqGz+l
@@ -97,7 +105,10 @@ function normalizeQuotaSummary(summary) {
   if (total === 0 && (used !== 0 || remaining !== 0)) {
     throw new Error("Qoder zero total quota must have zero usage and remaining.");
   }
-  const usagePercentage = providedPercentage ?? (total > 0 ? (used / total) * 100 : 100);
+  // An empty 0/0 quota (no active plan) renders as 0%, matching Qoder's own
+  // Credits UI and the desktop/CLI paths; a server-provided percentage still
+  // wins when present.
+  const usagePercentage = providedPercentage ?? (total > 0 ? (used / total) * 100 : 0);
   return {
     used,
     total,
@@ -123,7 +134,7 @@ function normalizeQoderUsageResponse(response) {
   const usedPercent = shared
     ? total > 0
       ? (used / total) * 100
-      : 100
+      : 0
     : base.usagePercentage;
 
   return {
@@ -271,16 +282,17 @@ function normalizeQoderRpcUsage(response) {
   const used = quota ? finiteNumber(quota.used, "userQuota.used") : 0;
   const total = quota ? finiteNumber(quota.total, "userQuota.total") : 0;
   const remaining = quota ? finiteNumber(quota.remaining, "userQuota.remaining") : 0;
-  const reportedPercent = Number(response.totalUsagePercentage ?? quota?.percentage);
+  // totalUsagePercentage aggregates the plan and add-on buckets and reaches
+  // this function on mixed scales (the OpenAPI returns fractions, the desktop
+  // IPC returns percents), so the primary window always derives its percent
+  // from its own quota numbers.
   const usedPercent = total === 0
     ? 0
     : addOnWindow
       ? (used / total) * 100
       : response.isQuotaExceeded === true
         ? 100
-        : Number.isFinite(reportedPercent)
-          ? reportedPercent
-          : (used / total) * 100;
+        : (used / total) * 100;
   const normalizedExpiry = normalizeResetAt(response.expiresAt);
   const expiryMs = normalizedExpiry ? Date.parse(normalizedExpiry) : NaN;
   return {
@@ -575,7 +587,38 @@ async function fetchQoderUsage(cookieHeader, site, fetchImpl) {
   return normalizeQoderUsageResponse(await response.json());
 }
 
-function listRecentQoderRendererLogs(logRoot, maxFiles = 12) {
+function qoderLogRoots({
+  home = os.homedir(),
+  platform = process.platform,
+  env = process.env,
+  appDir = "Qoder",
+  envPrefix = "QODER",
+} = {}) {
+  const explicitLogRoot = env[`${envPrefix}_LOG_ROOT`];
+  if (typeof explicitLogRoot === "string" && explicitLogRoot.trim()) {
+    return [path.resolve(explicitLogRoot.trim())];
+  }
+  const configuredHome = env[`${envPrefix}_HOME`];
+  if (typeof configuredHome === "string" && configuredHome.trim()) {
+    return [path.join(path.resolve(configuredHome.trim()), "logs")];
+  }
+  const base = platform === "darwin"
+    ? path.join(home, "Library", "Application Support")
+    : platform === "win32"
+      ? (env.APPDATA || path.join(home, "AppData", "Roaming"))
+      : path.join(home, ".config");
+  // Qoder Desktop 0.4.x moved its Electron profile from Qoder[CN]/ to the
+  // bundle id directory and writes the account usage summary to main.log.
+  const bundleId = appDir === "QoderCN" || envPrefix === "QODER_CN"
+    ? "com.qodercn.app.stable"
+    : "com.qoder.app.stable";
+  return [
+    path.join(base, appDir, "logs"),
+    path.join(base, bundleId, "logs"),
+  ];
+}
+
+function listRecentQoderLogs(logRoot, maxFiles = QODER_LOG_MAX_FILES) {
   if (!fs.existsSync(logRoot)) return [];
   const files = [];
   const stack = [{ dir: logRoot, depth: 0 }];
@@ -591,19 +634,112 @@ function listRecentQoderRendererLogs(logRoot, maxFiles = 12) {
       const full = path.join(current.dir, entry.name);
       if (entry.isDirectory() && current.depth < 4) {
         stack.push({ dir: full, depth: current.depth + 1 });
-      } else if (entry.isFile() && entry.name === "renderer.log") {
+      } else if (entry.isFile() && (entry.name === "main.log" || entry.name === "renderer.log")) {
         let mtimeMs = 0;
+        let size = 0;
         try {
-          mtimeMs = fs.statSync(full).mtimeMs;
+          const stat = fs.statSync(full);
+          mtimeMs = stat.mtimeMs;
+          size = stat.size;
         } catch (_error) {}
-        files.push({ full, mtimeMs });
+        files.push({ full, mtimeMs, size });
       }
     }
   }
   return files
     .sort((a, b) => b.mtimeMs - a.mtimeMs)
-    .slice(0, maxFiles)
-    .map((entry) => entry.full);
+    .slice(0, maxFiles);
+}
+
+// Returns a parse hit, or null after a completed scan with no hit; undefined
+// means the scan itself failed (open/read) so callers must not treat it as
+// "no summary".
+function scanQoderLogFromEnd(logPath, parse, {
+  maxBytes = QODER_LOG_SCAN_MAX_BYTES,
+  chunkBytes = QODER_LOG_SCAN_CHUNK_BYTES,
+  overlapBytes = QODER_LOG_SCAN_OVERLAP_BYTES,
+} = {}) {
+  let fd;
+  try {
+    fd = fs.openSync(logPath, "r");
+  } catch (_error) {
+    return undefined;
+  }
+  try {
+    const size = fs.fstatSync(fd).size;
+    const floor = Math.max(0, size - maxBytes);
+    let end = size;
+    let carry = "";
+    while (end > floor) {
+      const start = Math.max(floor, end - chunkBytes);
+      const length = end - start;
+      const buffer = Buffer.alloc(length);
+      const read = fs.readSync(fd, buffer, 0, length, start);
+      const text = buffer.subarray(0, read).toString("utf8") + carry;
+      const parsed = parse(text);
+      if (parsed) return parsed;
+      // Keep this chunk's head so a line split across the boundary parses
+      // when the previous chunk is prepended.
+      carry = text.slice(0, overlapBytes);
+      end = start;
+    }
+  } catch (_error) {
+    return undefined;
+  } finally {
+    fs.closeSync(fd);
+  }
+  return null;
+}
+
+function parseQoderAccountUsageLog(text, { fallbackObservedAtMs = null } = {}) {
+  if (typeof text !== "string" || !text.includes('"qoderUsage"')) return null;
+  const lines = text.split(/\r?\n/);
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const line = lines[index];
+    if (!line.includes('"qoderUsage"')) continue;
+    const jsonStart = line.indexOf('{"') >= 0 ? line.indexOf('{"') : line.indexOf("{");
+    if (jsonStart < 0) continue;
+    let payload;
+    try {
+      payload = JSON.parse(line.slice(jsonStart));
+    } catch (_error) {
+      try {
+        payload = JSON.parse(line.slice(jsonStart, line.lastIndexOf("}") + 1));
+      } catch (_error2) {
+        continue;
+      }
+    }
+    const usage = payload?.qoderUsage;
+    if (!usage || typeof usage !== "object") continue;
+    let limits;
+    try {
+      limits = normalizeQoderRpcUsage({
+        userType: usage.userType,
+        expiresAt: usage.expiresAt,
+        isQuotaExceeded: usage.isQuotaExceeded,
+        totalUsagePercentage: usage.totalUsagePercentage,
+        userQuota: usage.userQuota,
+        addOnQuota: usage.addOnQuota,
+      });
+    } catch (_error) {
+      continue;
+    }
+    if (!limits) continue;
+    limits.source = "local-log";
+    const timestampMatch = /^\[([^\]]+)\]/.exec(line);
+    const lineObservedAtMs = timestampMatch ? Date.parse(timestampMatch[1]) : NaN;
+    return {
+      limits,
+      observedAtMs: Number.isFinite(lineObservedAtMs) ? lineObservedAtMs : fallbackObservedAtMs,
+      // The summary's own timestamp, or null when the line carries no parseable
+      // one and observedAtMs fell back to the file mtime. Callers that order
+      // this snapshot against other sources must use it, not observedAtMs: an
+      // mtime bump from an unrelated append would otherwise masquerade as a
+      // fresh observation.
+      lineObservedAtMs: Number.isFinite(lineObservedAtMs) ? lineObservedAtMs : null,
+    };
+  }
+  return null;
 }
 
 function parseQoderQuotaLog(text) {
@@ -640,46 +776,80 @@ function parseQoderQuotaLog(text) {
   };
 }
 
-function readQoderLocalQuota({
+// Maps a log path to its "size:mtimeMs" signature from the last completed
+// scan that found no usable summary (failed I/O is never recorded). Qoder
+// only appends to these logs, so an unchanged signature cannot have gained
+// one; pruning to the current candidate set keeps the map bounded.
+const qoderNoSummaryScans = new Map();
+
+function readQoderLocalQuotaWithAge({
   home = os.homedir(),
   platform = process.platform,
   env = process.env,
   appDir = "Qoder",
   envPrefix = "QODER",
+  nowMs = Date.now(),
+  maxAgeMs = QODER_LOG_MAX_AGE_MS,
+  olderThanMs = -Infinity,
 } = {}) {
-  const logRootKey = `${envPrefix}_LOG_ROOT`;
-  const homeKey = `${envPrefix}_HOME`;
-  const explicitLogRoot =
-    typeof env[logRootKey] === "string" && env[logRootKey].trim()
-      ? path.resolve(env[logRootKey].trim())
-      : null;
-  const configuredRoot =
-    typeof env[homeKey] === "string" && env[homeKey].trim()
-      ? path.resolve(env[homeKey].trim())
-      : null;
-  const logRoot = explicitLogRoot || (configuredRoot
-    ? path.join(configuredRoot, "logs")
-    : platform === "darwin"
-      ? path.join(home, "Library", "Application Support", appDir, "logs")
-      : platform === "win32"
-        ? path.join(env.APPDATA || path.join(home, "AppData", "Roaming"), appDir, "logs")
-        : path.join(home, ".config", appDir, "logs"));
-  for (const logPath of listRecentQoderRendererLogs(logRoot)) {
-    try {
-      const fd = fs.openSync(logPath, "r");
-      try {
-        const stat = fs.fstatSync(fd);
-        const length = Math.min(stat.size, 512 * 1024);
-        const buffer = Buffer.alloc(length);
-        fs.readSync(fd, buffer, 0, length, Math.max(0, stat.size - length));
-        const parsed = parseQoderQuotaLog(buffer.toString("utf8"));
-        if (parsed) return parsed;
-      } finally {
-        fs.closeSync(fd);
+  const candidates = [];
+  for (const logRoot of qoderLogRoots({ home, platform, env, appDir, envPrefix })) {
+    for (const entry of listRecentQoderLogs(logRoot)) {
+      if (nowMs - entry.mtimeMs > maxAgeMs) continue;
+      // A file last written at or before the cache snapshot cannot hold an
+      // observation newer than it (a line's time never exceeds the file
+      // mtime), so scanning it could never win the timestamp comparison.
+      if (entry.mtimeMs <= olderThanMs) continue;
+      candidates.push(entry);
+    }
+  }
+  candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  const scanned = candidates.slice(0, QODER_LOG_MAX_FILES);
+  const seenPaths = new Set();
+  let best = null;
+  for (const { full, mtimeMs, size } of scanned) {
+    seenPaths.add(full);
+    const signature = `${size}:${mtimeMs}`;
+    if (qoderNoSummaryScans.get(full) === signature) continue;
+    // A stale modern summary must not end the scan: fall through so a legacy
+    // match in the same chunk — or deeper — can still be used; only a fresh
+    // modern result returns early.
+    const parsed = scanQoderLogFromEnd(full, (text) => {
+      const accountUsage = parseQoderAccountUsageLog(text, { fallbackObservedAtMs: mtimeMs });
+      if (accountUsage && nowMs - (accountUsage.observedAtMs ?? mtimeMs) <= maxAgeMs) {
+        return accountUsage;
       }
-    } catch (_error) {}
+      const legacy = parseQoderQuotaLog(text);
+      return legacy ? { limits: legacy, observedAtMs: mtimeMs, lineObservedAtMs: null } : null;
+    });
+    if (parsed === undefined) continue; // Scan failed (I/O); retry on the next call.
+    if (!parsed) {
+      qoderNoSummaryScans.set(full, signature);
+      continue;
+    }
+    const observedAtMs = parsed.observedAtMs ?? mtimeMs;
+    if (nowMs - observedAtMs > maxAgeMs) continue;
+    // A summary that cannot beat the cache cutoff is not eligible: keep
+    // scanning, a deeper file may still hold a newer line that can.
+    if ((parsed.lineObservedAtMs ?? 0) <= olderThanMs) continue;
+    // A file's mtime order need not match its summary-line order: an append
+    // without a fresh summary leaves an old line in a freshly touched file.
+    // Keep the newest eligible line across the whole scan instead of the
+    // first hit — advancing the cache cutoff afterwards must not lock out a
+    // summary that was newer all along.
+    const lineObservedAtMs = parsed.lineObservedAtMs ?? null;
+    if (!best || (lineObservedAtMs ?? 0) > (best.lineObservedAtMs ?? 0)) {
+      best = { limits: parsed.limits, lineObservedAtMs };
+    }
   }
-  return null;
+  for (const cachedPath of qoderNoSummaryScans.keys()) {
+    if (!seenPaths.has(cachedPath)) qoderNoSummaryScans.delete(cachedPath);
+  }
+  return best;
+}
+
+function readQoderLocalQuota(options = {}) {
+  return readQoderLocalQuotaWithAge(options)?.limits ?? null;
 }
 
 function siteFromEnv(value) {
@@ -760,9 +930,34 @@ async function fetchQoderLimits({
     }
   }
 
-  // Once native sources are unavailable, prefer a bounded disk snapshot before
-  // the manual-cookie or local-log fallback.
+  // A 0.4.x desktop app refreshes its main.log summary whenever the account
+  // page reloads, so the newest line can be newer than the last-good cache.
+  // Compare the summary's own timestamp against the cache instead of always
+  // trusting the cache: only a parseable line timestamp may win, and files
+  // last written before the cache are skipped without a scan. Without a valid
+  // cache there is nothing to compare against, so the summary defers to the
+  // live manual-cookie session below and only serves as its fallback.
   const cachedLimits = readQoderLimitsCache({ home, nowMs, namespace: cacheNamespace });
+  const cachedAtMs = Date.parse(cachedLimits?.cached_at || "");
+  const cacheFloorMs = Number.isFinite(cachedAtMs) ? cachedAtMs : -Infinity;
+  const localScan = readQoderLocalQuotaWithAge({
+    home,
+    platform,
+    env,
+    appDir,
+    envPrefix,
+    nowMs,
+    olderThanMs: cacheFloorMs,
+  });
+  if (localScan && Number.isFinite(cacheFloorMs) && (localScan.lineObservedAtMs ?? 0) > cacheFloorMs) {
+    const local = localScan.limits;
+    if (activityWindow) {
+      local.secondary_window = activityWindow;
+      local.source += activitySource === "disk-cache" ? "+cached-activity" : "+activity";
+    }
+    writeQoderLimitsCache(local, { home, nowMs, namespace: cacheNamespace });
+    return local;
+  }
   if (cachedLimits) {
     if (activityWindow) cachedLimits.secondary_window = activityWindow;
     return cachedLimits;
@@ -791,15 +986,15 @@ async function fetchQoderLimits({
       // Qoder 1.18 can return an all-zero active plan with usage_percentage=0
       // while the desktop client separately marks the account quota-exceeded.
       // Preserve that status as metadata, but match Qoder's Credits UI by
-      // rendering an empty 0/0 bucket as 0%, not a full red 100% bar.
-      const local = result.primary_window?.limit_credits === 0
-        ? readQoderLocalQuota({ home, platform, env, appDir, envPrefix })
-        : null;
-      if (local) {
-        result.quota_exceeded = local.quota_exceeded === true;
+      // rendering an empty 0/0 bucket as 0%, not a full red 100% bar. With no
+      // valid cache the log scan above only ran as a companion — it lost its
+      // spot ahead of this session — so its result is still available here.
+      const zeroPlanLocal = result.primary_window?.limit_credits === 0 ? localScan : null;
+      if (zeroPlanLocal) {
+        result.quota_exceeded = zeroPlanLocal.limits.quota_exceeded === true;
         result.primary_window.reset_at = null;
         result.source = "provider-api+local-log";
-        result.plan_label = local.plan_label || null;
+        result.plan_label = zeroPlanLocal.limits.plan_label || null;
       }
       if (activityWindow) {
         result.secondary_window = activityWindow;
@@ -817,8 +1012,8 @@ async function fetchQoderLimits({
     }
   }
 
-  const local = readQoderLocalQuota({ home, platform, env, appDir, envPrefix });
-  if (local) {
+  if (localScan) {
+    const local = localScan.limits;
     if (activityWindow) {
       local.secondary_window = activityWindow;
       local.source += activitySource === "disk-cache" ? "+cached-activity" : "+activity";
@@ -826,6 +1021,7 @@ async function fetchQoderLimits({
     writeQoderLimitsCache(local, { home, nowMs, namespace: cacheNamespace });
     return local;
   }
+
   if (activityWindow) {
     return {
       configured: true,
@@ -874,6 +1070,7 @@ module.exports = {
   readQoderLimitsCache,
   writeQoderLimitsCache,
   parseQoderQuotaLog,
+  parseQoderAccountUsageLog,
   readQoderLocalQuota,
   fetchQoderLimits,
   fetchQoderCnLimits,

package/src/lib/rollout.js

@@ -35,6 +35,7 @@ const {
   createCompactionResponseIds,
   createUsageRecordState,
   extractTokenUsageRecord,
+  isCodexTotalOnlyResetSentinel,
   isCodexTurnEndEvent,
   isRecordOnly,
   noteLineAfterUsageRecord,
@@ -3606,6 +3607,67 @@ async function enqueueTouchedBuckets({ queuePath, hourlyState, touchedBuckets })
 
   const toAppend = [];
   for (const group of groupedBuckets.values()) {
+    // A local reconstruction may opt into observed-only attribution. Preserve
+    // every model bucket, including unknown, instead of guessing from the
+    // busiest model in the same half-hour. The policy lives in cursor state
+    // so hooks, desktop refreshes, and restarted CLI processes agree.
+    if (hourlyState.modelAttributionPolicy?.[group.source] === "observed") {
+      // A group last aligned under the default policy must not keep the stale
+      // dominant attribution downstream. Mirror the default path's alignment
+      // correction — one zero row for the old model — then observed mode
+      // re-emits every bucket, unknown included, and the alignment state is
+      // dropped so the correction fires at most once per group.
+      const alignedModelBucket = group.buckets.get(DEFAULT_MODEL) || null;
+      const staleAlignedModel = (() => {
+        if (!alignedModelBucket?.alignedModel) return null;
+        const normalized = normalizeModelInput(alignedModelBucket.alignedModel);
+        return normalized && normalized !== DEFAULT_MODEL && !group.buckets.has(normalized)
+          ? normalized
+          : null;
+      })();
+      if (staleAlignedModel) {
+        const zeroTotals = initTotals();
+        toAppend.push(JSON.stringify({
+          source: group.source,
+          model: staleAlignedModel,
+          hour_start: group.hourStart,
+          input_tokens: zeroTotals.input_tokens,
+          cached_input_tokens: zeroTotals.cached_input_tokens,
+          cache_creation_input_tokens: zeroTotals.cache_creation_input_tokens,
+          output_tokens: zeroTotals.output_tokens,
+          reasoning_output_tokens: zeroTotals.reasoning_output_tokens,
+          total_tokens: zeroTotals.total_tokens,
+          billable_total_tokens: zeroTotals.billable_total_tokens,
+          total_cost_usd: zeroTotals.total_cost_usd,
+          conversation_count: zeroTotals.conversation_count,
+        }));
+      }
+      for (const bucket of group.buckets.values()) bucket.alignedModel = null;
+      for (const [model, bucket] of group.buckets.entries()) {
+        const totals = bucket.totals;
+        const usagePrecision = bucket.usage_precision || null;
+        const key = usagePrecision ? `${totalsKey(totals)}|${usagePrecision}` : totalsKey(totals);
+        if (bucket.queuedKey === key) continue;
+        toAppend.push(JSON.stringify({
+          source: group.source,
+          model,
+          hour_start: group.hourStart,
+          input_tokens: totals.input_tokens,
+          cached_input_tokens: totals.cached_input_tokens,
+          cache_creation_input_tokens: totals.cache_creation_input_tokens,
+          output_tokens: totals.output_tokens,
+          reasoning_output_tokens: totals.reasoning_output_tokens,
+          total_tokens: totals.total_tokens,
+          billable_total_tokens: totals.billable_total_tokens ?? totals.total_tokens,
+          total_cost_usd: totals.total_cost_usd || 0,
+          usage_precision: usagePrecision || undefined,
+          ...prioritySubsetOf(totals),
+          conversation_count: totals.conversation_count,
+        }));
+        bucket.queuedKey = key;
+      }
+      continue;
+    }
     const unknownBucket = group.buckets.get(DEFAULT_MODEL) || null;
     const dominantModel = pickDominantModel(group.buckets);
     let alignedModel = null;
@@ -3977,6 +4039,10 @@ function normalizeHourlyState(raw) {
   const rawBuckets = state.buckets && typeof state.buckets === "object" ? state.buckets : {};
   const buckets = {};
   const groupQueued = {};
+  const modelAttributionPolicy = Object.fromEntries(
+    Object.entries(state.modelAttributionPolicy || {})
+      .filter(([, policy]) => policy === "observed"),
+  );
 
   if (!Number.isFinite(version) || version < 2) {
     for (const [key, value] of Object.entries(rawBuckets)) {
@@ -3994,6 +4060,7 @@ function normalizeHourlyState(raw) {
       version: 3,
       buckets,
       groupQueued,
+      ...(Object.keys(modelAttributionPolicy).length > 0 ? { modelAttributionPolicy } : {}),
       updatedAt: typeof state.updatedAt === "string" ? state.updatedAt : null,
     };
   }
@@ -4013,6 +4080,7 @@ function normalizeHourlyState(raw) {
     version: 3,
     buckets,
     groupQueued: version >= 3 ? existingGroupQueued : {},
+    ...(Object.keys(modelAttributionPolicy).length > 0 ? { modelAttributionPolicy } : {}),
     updatedAt: typeof state.updatedAt === "string" ? state.updatedAt : null,
   };
 }
@@ -5246,20 +5314,6 @@ function normalizeUsage(u) {
   return out;
 }
 
-function isCodexTotalOnlyResetSentinel(lastUsage, totalUsage) {
-  const componentTotal = (usage) => [
-    usage?.input_tokens,
-    usage?.cached_input_tokens,
-    usage?.cache_creation_input_tokens ?? usage?.cache_write_input_tokens,
-    usage?.output_tokens,
-    usage?.reasoning_output_tokens,
-  ].reduce((sum, value) => sum + Math.max(0, Number(value) || 0), 0);
-  return Number(lastUsage?.total_tokens || 0) > 0
-    && Number(totalUsage?.total_tokens || 0) === 0
-    && componentTotal(lastUsage) === 0
-    && componentTotal(totalUsage) === 0;
-}
-
 // Stable dedup key for one Claude jsonl entry. Anthropic's official protocol
 // guarantees `message.id` is globally unique per response, so msgId alone is a
 // valid dedup key. Older code required both msgId AND requestId, which short-

package/src/lib/session-analytics.js

@@ -93,6 +93,8 @@ const {
 // date-filtered session views and cached sidecars keep the 6x premium.
 // v27 adds oh-my-pi (omp) sessions from ~/.omp/agent/sessions/**/*.jsonl.
 const SIDECAR_VERSION = 27;
+// Invalidate only Codex token summaries; other sources keep their cached rows.
+const CODEX_USAGE_VERSION = 1;
 const EDIT_TOOLS = new Set([
   "apply_patch",
   "edit",
@@ -803,6 +805,7 @@ async function scanCodexSession(filePath) {
     seenTokenEvents: new Set(),
     collectBreakdowns: false,
     collectModelUsage: true,
+    ledgerUsage: true,
     onObject(obj, model) {
       signalCollector.consume(obj, model);
       performanceCollector.consume(obj, model);
@@ -2273,7 +2276,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
       previousMeta = JSON.parse(fs.readFileSync(metaPath, "utf8"));
       const checkedAt = Date.parse(previousMeta.checked_at || previousMeta.generated_at || "");
       if (
-        !retryZcodeScan && !retryOpencodeScan && !retryKimiScan && !retryOmpScan && !retryDshScan && previousMeta.version === SIDECAR_VERSION &&
+        !retryZcodeScan && !retryOpencodeScan && !retryKimiScan && !retryOmpScan && !retryDshScan && previousMeta.version === SIDECAR_VERSION && previousMeta.codex_usage_version === CODEX_USAGE_VERSION &&
         Number.isFinite(checkedAt) &&
         Date.now() - checkedAt < Math.max(0, Number(cacheTtlMs) || 0)
       ) {
@@ -2314,7 +2317,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
     // db + its WAL sidecars: the trio is one logical file for change detection.
     ...[...(discovered.zcode || []), ...(discovered.opencode || [])].flatMap((dbPath) => [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]),
   ]);
-  if (!force && !retryZcodeScan && !retryOpencodeScan && !retryKimiScan && !retryOmpScan && !retryDshScan && previousMeta?.version === SIDECAR_VERSION && previousMeta.signature === signature) {
+  if (!force && !retryZcodeScan && !retryOpencodeScan && !retryKimiScan && !retryOmpScan && !retryDshScan && previousMeta?.version === SIDECAR_VERSION && previousMeta.codex_usage_version === CODEX_USAGE_VERSION && previousMeta.signature === signature) {
     await writeAtomic(metaPath, `${JSON.stringify({ ...previousMeta, checked_at: new Date().toISOString() })}\n`);
     return readSidecar(sidecarPath);
   }
@@ -2344,6 +2347,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
   // vanished mid-scan). Swallowing these silently made sessions disappear with
   // no signal at all; count them so the API can say so.
   let skippedFiles = 0;
+  let incompleteCodexUsage = false;
   let incompleteZcodeScan = false;
   let incompleteOpencodeScan = false;
   let incompleteKimiScan = false;
@@ -2354,6 +2358,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
     const statKey = analyticsEntryStatKey(entry.source, entry.filePath);
     if (!statKey) {
       skippedFiles += 1;
+      if (entry.source === "codex") incompleteCodexUsage = true;
       if (entry.source === "zcode") incompleteZcodeScan = true;
       if (entry.source === "opencode") incompleteOpencodeScan = true;
       if (entry.source === "kimi") incompleteKimiScan = true;
@@ -2362,7 +2367,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
       continue;
     }
     let rows = null;
-    if (!force && !(entry.source === "zcode" && retryZcodeScan) && !(entry.source === "opencode" && retryOpencodeScan) && !(entry.source === "kimi" && retryKimiScan) && !(entry.source === "omp" && retryOmpScan) && !(entry.source === "dsh" && retryDshScan) && previousFiles[cacheKey]?.stat_key === statKey) {
+    if (!force && !(entry.source === "codex" && previousMeta?.codex_usage_version !== CODEX_USAGE_VERSION) && !(entry.source === "zcode" && retryZcodeScan) && !(entry.source === "opencode" && retryOpencodeScan) && !(entry.source === "kimi" && retryKimiScan) && !(entry.source === "omp" && retryOmpScan) && !(entry.source === "dsh" && retryDshScan) && previousFiles[cacheKey]?.stat_key === statKey) {
       if (entry.source === "zcode" || entry.source === "opencode" || entry.source === "kimi" || entry.source === "omp" || entry.source === "dsh") {
         // One db scans to many cached rows; recover them all from the previous
         // pass. An empty recovery means the sidecar lost its rows — rescan.
@@ -2392,6 +2397,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
         // One active/partial session must not poison the sidecar, but do not
         // pretend it never existed either.
         skippedFiles += 1;
+        if (entry.source === "codex") incompleteCodexUsage = true;
         if (entry.source === "zcode") incompleteZcodeScan = true;
         if (entry.source === "opencode") incompleteOpencodeScan = true;
         if (entry.source === "kimi") incompleteKimiScan = true;
@@ -2455,6 +2461,7 @@ async function buildSessionAnalyticsInternal({ home = os.homedir(), force = fals
     const generatedAt = new Date().toISOString();
     await writeAtomic(metaPath, `${JSON.stringify({
       version: SIDECAR_VERSION,
+      codex_usage_version: incompleteCodexUsage ? 0 : CODEX_USAGE_VERSION,
       signature,
       generated_at: generatedAt,
       checked_at: generatedAt,

package/src/lib/usage-limits.js

@@ -35,7 +35,7 @@ const { fetchDevinLimits } = require("./devin-limits");
 const { fetchQoderLimits, fetchQoderCnLimits } = require("./qoder-limits");
 const { fetchArkCodingPlanLimits } = require("./ark-coding-plan-limits");
 const { fetchArkAgentPlanLimits } = require("./ark-agent-plan-limits");
-const { fetchWorkbuddyLimits, fetchWorkbuddyAiLimits, selectWorkbuddyLimits } = require("./workbuddy-limits");
+const { fetchWorkbuddyLimits, fetchWorkbuddyAiLimits } = require("./workbuddy-limits");
 const { fetchProviderServiceStatus } = require("./provider-status");
 const { resolveKimiProfile } = require("./kimi-profile");
 const { readSqliteJsonRows, readSqliteJsonRowsAsync } = require("./sqlite-reader");
@@ -3938,7 +3938,7 @@ function normalizePlanLabel(raw, brand) {
   let s = String(raw).replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
   if (!s) return null;
   const lower = s.toLowerCase();
-  if (["free", "none", "unknown"].includes(lower)) return null;
+  if (["free", "none", "unknown", "invalid"].includes(lower)) return null;
   if (brand && lower === brand.toLowerCase()) return null; // e.g. Kiro defaults plan_name to "Kiro" when parse fails
   if (brand) {
     s = s.replace(new RegExp("^" + brand + "\\s+", "i"), "").trim();
@@ -4506,8 +4506,10 @@ async function fetchUsageLimitsUncached({
     codingPlan: withPlanLabel(codingPlan, codingPlan?.plan_label, "Ark Coding Plan"),
     agentPlan: withPlanLabel(agentPlan, agentPlan?.plan_label, "Ark Agent Plan"),
     // WorkBuddy preserves provider English names and official edition labels
-    // verbatim (including Free, STANDARD and Pro-Trial).
-    workbuddy: selectWorkbuddyLimits(workbuddy, workbuddyAi),
+    // verbatim (including Free, STANDARD and Pro-Trial). China and AI publish
+    // as separate providers — one row per signed-in edition, never merged.
+    workbuddy,
+    workbuddyAi,
   };
 
   for (const [providerName, provider] of Object.entries(data)) {