tokentracker-cli 1.5.6 → 1.5.8

package/src/commands/init.js

@@ -1453,6 +1453,7 @@ function normalizePlatform(value) {
 }
 
 function buildNotifyHandler({ trackerDir, packageName }) {
+  const { backendFromUrl, captureClaudeBackend, hashClaudeRange } = require("../lib/claude-backend");
   // Keep this file dependency-free: Node built-ins only.
   // It must never block Codex; it spawns sync in the background and exits 0.
   const queueSignalPath = path.join(trackerDir, "notify.signal");
@@ -1526,6 +1527,14 @@ if (debugEnabled) {
   } catch (_) {}
 }
 
+// Capture before the throttle and before spawning sync. Never persist stdin.
+if (source === 'claude') {
+  try { captureClaudeBackend(trackerDir, JSON.parse(fs.readFileSync(0, 'utf8'))); } catch (_) {}
+}
+${backendFromUrl.toString()}
+${hashClaudeRange.toString()}
+${captureClaudeBackend.toString()}
+
 // Throttle spawn: at most once per 20 seconds.
 try {
     const throttlePath = path.join(trackerDir, 'sync.throttle');

package/src/commands/status.js

@@ -856,13 +856,19 @@ async function cmdStatus(argv = []) {
   // official API, so status surfaces the opt-in flag, the resolved storage
   // path, and whether the auth blob decrypts — the three inputs a "why is my
   // TRAE CN data missing" diagnosis needs.
-  // A resolvable default path does NOT mean the app is installed - the
-  // macOS/Windows resolver always derives one. Match the sync path semantics
-  // exactly: installed iff the storage file actually exists on disk.
+  // Follow junctions with stat. Only missing paths mean absent; access/IO
+  // errors must reach the auth reader and be shown as unreadable, not hidden
+  // behind existsSync's false result. Explicit overrides can also be absent.
   const traeCnStoragePath = resolveTraeCnStoragePath({ env: process.env, home });
-  const traeCnInstalled = Boolean(
-    traeCnStoragePath && fssync.existsSync(traeCnStoragePath),
-  );
+  let traeCnInstalled = false;
+  if (traeCnStoragePath) {
+    try {
+      fssync.statSync(traeCnStoragePath);
+      traeCnInstalled = true;
+    } catch (error) {
+      traeCnInstalled = error?.code !== "ENOENT" && error?.code !== "ENOTDIR";
+    }
+  }
   let traeCnAuthState = "not-signed-in";
   if (traeCnInstalled) {
     try {

package/src/commands/sync.js

@@ -185,7 +185,7 @@ const {
 const { purgeProjectUsage } = require("../lib/project-usage-purge");
 const {
   fetchTraeCnUsageWithAuth,
-  resolveTraeCnStoragePath,
+  readTraeCnAuthFromStorage,
   isTraeCnUsageEnabled,
 } = require("../lib/trae-cn-config");
 const {
@@ -2315,9 +2315,10 @@ async function cmdSync(argv, context = {}) {
         Math.floor((endTime - 30 * 24 * 60 * 60) / HALF_HOUR_SEC) * HALF_HOUR_SEC,
       );
       try {
-        // Absent storage means "not signed in" — a silent skip, not an error.
-        const traeCnStoragePath = resolveTraeCnStoragePath({ env: process.env, home });
-        if (traeCnStoragePath && fssync.existsSync(traeCnStoragePath)) {
+        // Read through junctions and let the credential-safe reader distinguish
+        // missing auth from access/IO errors. existsSync masks both as absent.
+        const traeCnAuth = readTraeCnAuthFromStorage({ env: process.env, home });
+        if (traeCnAuth) {
           if (progress?.enabled) {
             progress.start(`Fetching TRAE Work CN usage...`);
           }
@@ -4630,6 +4631,12 @@ async function readQueueBatch(queuePath, startOffset, maxBuckets) {
       // rows whose input_tokens still include cached tokens (6-7x inflated) —
       // while the local dashboard showed corrected numbers.
       bucket = require("../lib/local-api").normalizeQueueRow(bucket);
+      // Backend origins are local provenance; the current cloud accounting
+      // schema has no backend dimension. Do not disclose gateway hosts there.
+      if (bucket.backend_usage) {
+        bucket = { ...bucket };
+        delete bucket.backend_usage;
+      }
       bucketMap.set(`${source}|${model}|${hourStart}`, bucket);
       linesRead += 1;
       if (linesRead >= maxBuckets) break;
@@ -6372,8 +6379,10 @@ async function repairCodexRescanInflation({
       }
     }
     rebuilt = {
+      version: tmpCursors.hourly.version,
       buckets: tmpCursors.hourly.buckets || {},
       groupQueued: tmpCursors.hourly.groupQueued || {},
+      modelAttributionPolicy: tmpCursors.hourly.modelAttributionPolicy,
       codexHashes: Array.isArray(tmpCursors.codexHashes) ? tmpCursors.codexHashes : [],
       codexCompactionResponseIds: Array.isArray(tmpCursors.codexCompactionResponseIds)
         ? tmpCursors.codexCompactionResponseIds
@@ -6510,6 +6519,9 @@ async function repairCodexRescanInflation({
   //    rebuilt per-file cursors (offset at EOF) so the later parse in THIS sync
   //    does not re-read codex (which would re-inflate project buckets).
   const hourly = (cursors.hourly ||= { buckets: {}, groupQueued: {} });
+  // Without the rebuilt schema version, the next normalization treats these
+  // per-model keys as v1 and overwrites them all with an unknown bucket (#927).
+  hourly.version = rebuilt.version;
   hourly.buckets ||= {};
   hourly.groupQueued ||= {};
   for (const k of Object.keys(hourly.buckets)) {
@@ -6524,6 +6536,12 @@ async function repairCodexRescanInflation({
   for (const [k, v] of Object.entries(rebuilt.groupQueued)) {
     if (k.startsWith("codex|")) hourly.groupQueued[k] = v;
   }
+  // The rebuilt queue already uses the parser's current attribution policy.
+  // Preserve it so the following parse does not re-emit every repaired row.
+  hourly.modelAttributionPolicy = {
+    ...hourly.modelAttributionPolicy,
+    codex: rebuilt.modelAttributionPolicy.codex,
+  };
   cursors.files ||= {};
   for (const fp of Object.keys(cursors.files)) {
     if (isCodexSessionCursorPath(fp)) delete cursors.files[fp];

package/src/lib/claude-backend.js

@@ -0,0 +1,291 @@
+// Local-only accounting provenance. Never infer historical routing from current config.
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+
+function backendFromUrl(value) {
+  try {
+    if (typeof value !== "string" || !value.trim()) return { backend: "unknown" };
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol)) return { backend: "unknown" };
+    const backend_origin = url.origin;
+    return { backend: backend_origin === "https://api.anthropic.com" ? "anthropic" : "custom", backend_origin };
+  } catch { return { backend: "unknown" }; }
+}
+
+// Hash only the enclosed bytes, in bounded chunks. Persist no transcript text.
+function hashClaudeRange(filePath, start, end) {
+  const fs = require("node:fs");
+  const hash = require("node:crypto").createHash("sha256");
+  const fd = fs.openSync(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(64 * 1024);
+    for (let offset = start; offset < end;) {
+      const read = fs.readSync(fd, buffer, 0, Math.min(buffer.length, end - offset), offset);
+      if (!read) return null;
+      hash.update(buffer.subarray(0, read));
+      offset += read;
+    }
+    return hash.digest("hex");
+  } finally { fs.closeSync(fd); }
+}
+
+// Embedded verbatim in the dependency-free notify script. Read ONLY the endpoint
+// env var; never credentials. Hash paths/session IDs and discard the hook body.
+function captureClaudeBackend(trackerDir, payload, env = process.env) {
+  const fs = require("node:fs");
+  const path = require("node:path");
+  const crypto = require("node:crypto");
+  const event = payload?.hook_event_name;
+  if (!["SessionStart", "Stop", "SessionEnd"].includes(event)) return;
+  if (typeof payload.transcript_path !== "string" || typeof payload.session_id !== "string" || !payload.session_id) return;
+  const identity = backendFromUrl(env.ANTHROPIC_BASE_URL);
+  const dir = path.join(trackerDir, "claude-backends");
+  const file = crypto.createHash("sha256").update(path.resolve(payload.transcript_path)).digest("hex");
+  const session = crypto.createHash("sha256").update(String(payload.session_id)).digest("hex");
+  let stat;
+  try { stat = fs.statSync(payload.transcript_path); } catch {
+    if (event !== "SessionStart") return;
+  }
+  const observation = { event, session, inode: stat?.ino || 0, offset: stat?.size || 0, ...identity };
+  const anchorPath = path.join(dir, file + ".current.json");
+  let previous;
+  try { previous = JSON.parse(fs.readFileSync(anchorPath, "utf8")); } catch { /* first observation */ }
+  if (event === "Stop" && previous?.session === session && previous.event !== "SessionEnd"
+      && previous.backend_origin && previous.backend_origin === identity.backend_origin
+      && previous.offset < observation.offset) {
+    observation.range_hash = hashClaudeRange(payload.transcript_path, previous.offset, observation.offset);
+  }
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  fs.appendFileSync(path.join(dir, file + ".jsonl"), JSON.stringify(observation) + "\n", { mode: 0o600 });
+  fs.writeFileSync(anchorPath, JSON.stringify(observation), { mode: 0o600 });
+  fs.writeFileSync(path.join(trackerDir, "claude-backend-current.json"), JSON.stringify(identity), { mode: 0o600 });
+}
+
+function readLines(file) {
+  try { return fs.readFileSync(file, "utf8").split("\n").flatMap((line) => {
+    try { return [JSON.parse(line)]; } catch { return []; }
+  }); } catch { return []; }
+}
+
+// Parse shared upgrade metadata once per file revision, rather than once per
+// transcript in a large installation. Failed reads are retried on the next call.
+const legacyMetadataCache = new Map();
+function readLegacyMetadata(file) {
+  const fd = fs.openSync(file, "r");
+  try {
+    // Bind the revision stamp and contents to the same open file, even if the
+    // metadata pathname is replaced while we read it.
+    const stat = fs.fstatSync(fd);
+    const stamp = `${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}`;
+    const cached = legacyMetadataCache.get(file);
+    if (cached?.stamp === stamp) return cached.value;
+    const value = JSON.parse(fs.readFileSync(fd, "utf8"));
+    legacyMetadataCache.set(file, { stamp, value });
+    if (legacyMetadataCache.size > 8) legacyMetadataCache.delete(legacyMetadataCache.keys().next().value);
+    return value;
+  } finally { fs.closeSync(fd); }
+}
+
+// Sync receives flat paths while session metadata keys ordered cross-root groups.
+// Try the scanner's root order and its reverse, accepting ONLY an exact stored
+// hash. Equal basenames alone never establish shared history.
+function preserveLegacyClaudeGroups(files, trackerDir) {
+  let meta;
+  try { meta = readLegacyMetadata(path.join(trackerDir, "session.queue.jsonl.meta.json")); } catch { return; }
+  const groups = new Map();
+  for (const file of files) {
+    if (typeof file !== "string" || !file) continue;
+    const id = path.basename(file).match(/^([0-9a-f-]{36})\.jsonl$/i)?.[1];
+    if (!id) continue;
+    const group = groups.get(id) || [];
+    if (!group.includes(file)) group.push(file);
+    groups.set(id, group);
+  }
+  for (const group of groups.values()) {
+    if (group.length < 2) continue;
+    for (const ordered of [group, [...group].reverse()]) {
+      const key = crypto.createHash("sha256").update(`claude\0${ordered.map((file) => path.resolve(file)).join("\0")}`).digest("hex").slice(0, 24);
+      const stats = meta.files?.[key]?.stat_key?.split("|");
+      if (!stats || stats.length !== ordered.length) continue;
+      ordered.forEach((file, index) => {
+        try { preserveLegacyClaudePrefix(file, trackerDir, Number(stats[index].split(":")[0])); }
+        catch (error) {
+          // Discovery can race a removed/unreadable mirror. Let the parser's
+          // normal per-file handling continue with the surviving paths.
+          if (!["ENOENT", "EACCES", "EPERM", "ESTALE"].includes(error.code)) throw error;
+        }
+      });
+      break;
+    }
+  }
+}
+
+// Preserve the already-accounted prefix when upgrading. The boundary is frozen
+// before either scanner advances its cache; existing per-record decisions still
+// win. Store only byte counts, file identity and a digest, never transcript text.
+function preserveLegacyClaudePrefix(filePath, trackerDir, offset = 0) {
+  const key = crypto.createHash("sha256").update(path.resolve(filePath)).digest("hex");
+  const dir = path.join(trackerDir, "claude-backends");
+  const boundaryPath = path.join(dir, key + ".legacy.json");
+  try { return JSON.parse(fs.readFileSync(boundaryPath, "utf8")); } catch { /* first scan */ }
+  const stat = fs.statSync(filePath);
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset > stat.size) offset = 0;
+  try {
+    const cursor = readLegacyMetadata(path.join(trackerDir, "cursors.json"))?.files?.[filePath];
+    if (cursor?.inode === stat.ino && cursor.offset <= stat.size) offset = Math.max(offset, cursor.offset || 0);
+  } catch { /* no previously ingested queue */ }
+  try {
+    const cacheKey = crypto.createHash("sha256").update(`claude\0${path.resolve(filePath)}`).digest("hex").slice(0, 24);
+    const meta = readLegacyMetadata(path.join(trackerDir, "session.queue.jsonl.meta.json"));
+    const size = Number(meta.files?.[cacheKey]?.stat_key?.split(":")[0]);
+    if (size <= stat.size) offset = Math.max(offset, size || 0);
+  } catch { /* no previously ingested session */ }
+  offset = Math.min(Math.max(0, offset), stat.size);
+  const boundary = { inode: stat.ino, offset, hash: hashClaudeRange(filePath, 0, offset) };
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  try { fs.writeFileSync(boundaryPath, JSON.stringify(boundary), { mode: 0o600, flag: "wx" }); }
+  catch (error) { if (error.code !== "EEXIST") throw error; }
+  return JSON.parse(fs.readFileSync(boundaryPath, "utf8"));
+}
+
+function createBackendResolver(filePath, trackerDir, { legacyOffset = 0 } = {}) {
+  const key = crypto.createHash("sha256").update(path.resolve(filePath)).digest("hex");
+  const dir = path.join(trackerDir, "claude-backends");
+  const ledger = path.join(dir, key + ".usage.jsonl");
+  const decisions = new Map();
+  let decisionOffset = 0;
+  function refreshDecisions() {
+    let fd;
+    try {
+      fd = fs.openSync(ledger, "r");
+      const size = fs.fstatSync(fd).size;
+      if (size <= decisionOffset) return;
+      const bytes = Buffer.alloc(size - decisionOffset);
+      fs.readSync(fd, bytes, 0, bytes.length, decisionOffset);
+      // Only consume complete append records, including another scanner's.
+      const boundary = bytes.lastIndexOf(10) + 1;
+      for (const line of bytes.subarray(0, boundary).toString("utf8").split("\n")) {
+        try {
+          const row = JSON.parse(line);
+          if (!decisions.has(row.id)) decisions.set(row.id, row);
+        } catch { /* incomplete/corrupt record */ }
+      }
+      decisionOffset += boundary;
+    } catch (error) { if (error.code !== "ENOENT") throw error; }
+    finally { if (fd !== undefined) fs.closeSync(fd); }
+  }
+  refreshDecisions();
+  const observations = readLines(path.join(dir, key + ".jsonl"));
+  const fileStat = fs.statSync(filePath);
+  const inode = fileStat.ino;
+  const legacy = preserveLegacyClaudePrefix(filePath, trackerDir, legacyOffset);
+  const legacyEnd = legacy.inode === inode && legacy.offset <= fileStat.size
+    && hashClaudeRange(filePath, 0, legacy.offset) === legacy.hash ? legacy.offset : 0;
+  const intervals = [];
+  let previous = null;
+  for (const current of observations) {
+    if (current.event === "Stop" && previous && previous.event !== "SessionEnd"
+      && current.session === previous.session && current.inode === inode
+      && (previous.inode === inode || (previous.event === "SessionStart" && previous.offset === 0))
+      && current.offset > previous.offset && current.offset <= fileStat.size) {
+      const a = backendFromUrl(previous.backend_origin);
+      const b = backendFromUrl(current.backend_origin);
+      if (a.backend_origin && a.backend_origin === b.backend_origin) {
+        intervals.push({ start: previous.offset, end: current.offset, session: current.session, hash: current.range_hash, ...a });
+      }
+    }
+    previous = current;
+  }
+  // A missed Stop must not bridge multiple turns. Only inspect ranges actually
+  // bracketed by observations; no prompts or message bodies leave this function.
+  function validInterval(interval) {
+    if (interval.valid !== undefined) return interval.valid;
+    interval.valid = false;
+    const fd = fs.openSync(filePath, "r");
+    try {
+      const bytes = Buffer.alloc(interval.end - interval.start);
+      fs.readSync(fd, bytes, 0, bytes.length, interval.start);
+      if (!interval.hash || crypto.createHash("sha256").update(bytes).digest("hex") !== interval.hash) return false;
+      let turns = 0;
+      for (const line of bytes.toString("utf8").split("\n")) {
+        try {
+          const row = JSON.parse(line);
+          const content = row.message?.content;
+          if (row.type === "user" && (typeof content === "string" || content?.some?.((b) => b.type === "text"))) turns++;
+        } catch { /* partial boundary / non-JSON */ }
+      }
+      interval.valid = turns === 1;
+      return interval.valid;
+    } finally { fs.closeSync(fd); }
+  }
+  return (obj, start, end) => {
+    const id = crypto.createHash("sha256").update(JSON.stringify([
+      obj.sessionId, obj.uuid, obj.requestId, obj.message?.id, obj.timestamp, start, end,
+    ])).digest("hex");
+    const saved = decisions.get(id);
+    if (saved) return saved.legacy ? null : backendFromUrl(saved.backend_origin);
+    const session = typeof obj.sessionId === "string"
+      ? crypto.createHash("sha256").update(obj.sessionId).digest("hex") : null;
+    const matches = intervals.filter((i) => i.session === session && start >= i.start && end <= i.end && validInterval(i));
+    const identity = end <= legacyEnd ? { legacy: true } : matches.length === 1 ? backendFromUrl(matches[0].backend_origin) : { backend: "unknown" };
+    // First ingestion wins, including unknown. Late hooks cannot relabel usage.
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.appendFileSync(ledger, JSON.stringify({ id, ...identity }) + "\n", { mode: 0o600 });
+    // Sync and session analytics can run concurrently. O_APPEND orders these
+    // small records; read that order so the first durable decision always wins.
+    refreshDecisions();
+    return decisions.get(id)?.legacy ? null : backendFromUrl(decisions.get(id)?.backend_origin);
+  };
+}
+
+// Byte offsets, including CRLF and multibyte text, must agree with hook stat sizes.
+async function* claudeLines(filePath, start = 0, end = undefined) {
+  const input = fs.createReadStream(filePath, { start, ...(end > start ? { end: end - 1 } : {}) });
+  let pending = Buffer.alloc(0);
+  let offset = start;
+  for await (const chunk of input) {
+    pending = Buffer.concat([pending, chunk]);
+    let newline;
+    while ((newline = pending.indexOf(10)) !== -1) {
+      const next = offset + newline + 1;
+      yield { line: pending.subarray(0, newline).toString("utf8"), start: offset, end: next };
+      offset = next;
+      pending = pending.subarray(newline + 1);
+    }
+  }
+  // Preserve complete legacy files without a final newline; defer partial JSON.
+  if (pending.length) {
+    try { JSON.parse(pending.toString("utf8")); } catch { return; }
+    yield { line: pending.toString("utf8"), start: offset, end: offset + pending.length };
+  }
+}
+
+const TOKEN_FIELDS = ["input_tokens", "cached_input_tokens", "cache_creation_input_tokens", "output_tokens", "reasoning_output_tokens", "total_tokens"];
+function mergeBackendUsage(target, delta) {
+  if (!Array.isArray(delta?.backend_usage)) return;
+  target.backend_usage ||= [];
+  for (const part of delta.backend_usage) {
+    const identity = backendFromUrl(part.backend_origin);
+    let row = target.backend_usage.find((r) => r.backend === identity.backend && r.backend_origin === identity.backend_origin);
+    if (!row) { row = { ...identity }; target.backend_usage.push(row); }
+    for (const field of TOKEN_FIELDS) row[field] = (row[field] || 0) + (Number(part[field]) || 0);
+  }
+}
+function hasUnknownBackendCost(row) {
+  return row?.source === "claude" && row.backend_usage?.some((p) => p.backend !== "anthropic" && p.total_tokens > 0);
+}
+function readCustomBackend({ home, env = process.env }) {
+  // Current configuration is ONLY for the limits card, never usage attribution.
+  let configured = env.ANTHROPIC_BASE_URL;
+  if (!configured) {
+    try { configured = JSON.parse(fs.readFileSync(path.join(env.CLAUDE_CONFIG_DIR || path.join(home, ".claude"), "settings.json"), "utf8"))?.env?.ANTHROPIC_BASE_URL; } catch { /* absent */ }
+  }
+  if (configured) return backendFromUrl(configured);
+  try {
+    const observed = JSON.parse(fs.readFileSync(path.join(home, ".tokentracker", "tracker", "claude-backend-current.json"), "utf8"));
+    return backendFromUrl(observed.backend_origin);
+  } catch { return { backend: "unknown" }; }
+}
+
+module.exports = { preserveLegacyClaudeGroups, preserveLegacyClaudePrefix, hashClaudeRange, claudeLines, backendFromUrl, captureClaudeBackend, createBackendResolver, mergeBackendUsage, hasUnknownBackendCost, readCustomBackend, TOKEN_FIELDS };

package/src/lib/claude-config.js

@@ -5,7 +5,7 @@ const { ensureDir, readJson, writeJson } = require("./fs");
 const { buildNotifyCommand, notifyIdentity } = require("./notify-command");
 
 const DEFAULT_EVENT = "SessionEnd";
-const CLAUDE_USAGE_EVENTS = ["Stop", DEFAULT_EVENT];
+const CLAUDE_USAGE_EVENTS = ["SessionStart", "Stop", DEFAULT_EVENT];
 
 async function upsertClaudeHook({ settingsPath, hookCommand, event = DEFAULT_EVENT }) {
   return upsertClaudeHooks({ settingsPath, hookCommand, events: [event] });

package/src/lib/cursor-config.js

@@ -97,7 +97,9 @@ function extractCursorAuth({ home, platform, env, deps } = {}) {
     return null;
   }
   const jwt = readCursorAccessTokenFromStateDb(stateDbPath, deps);
-  if (!jwt || jwt.length < 10) return null;
+  // Encrypted Cursor Safe Storage values must not be treated as JWTs and must
+  // never trigger OS keychain decryption (see #1029 revert / #1043).
+  if (!jwt || jwt.length < 10 || jwt.startsWith('cursor-safe-storage:')) return null;
 
   // 2. Extract userId — try cli-config.json first, fall back to JWT decode
   let userId = extractUserIdFromCliConfig(cliConfigPath);

package/src/lib/devin-limits.js

@@ -16,6 +16,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
+const { parse: parseToml } = require("smol-toml");
 
 const DEVIN_PLAN_STATUS_URL =
   "https://server.codeium.com/exa.seat_management_pb.SeatManagementService/GetPlanStatus";
@@ -28,25 +29,26 @@ function isNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
 
-// Minimal root-level TOML reader for the CLI-written credentials file: bare
-// `key = value` lines before the first `[section]`, nothing else.
-function parseDevinCredentialsToml(raw) {
-  const fields = {};
-  for (const line of String(raw).split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    if (trimmed.startsWith("[")) break;
-    const match = /^([A-Za-z0-9_]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))\s*(?:#.*)?$/.exec(
-      trimmed,
-    );
-    if (!match) continue;
-    const [, key, doubleQuoted, singleQuoted, bare] = match;
-    fields[key] = doubleQuoted ?? singleQuoted ?? bare ?? "";
-  }
-  return fields;
+// Local sign-in problems are persistent configuration errors, not transient
+// fetch failures: the aggregator's disk-cache fallback must never mask them,
+// so they carry a distinctive code the assembly can gate on.
+function credentialsError(message) {
+  const error = new Error(message);
+  error.code = "CREDENTIALS_INVALID";
+  return error;
 }
 
-// Returns { apiKey } or null when no sign-in exists (no home, or the file is
+// A credential-file revision, not a token fingerprint or account claim. Both
+// in-place edits (ctime/mtime) and atomic replacements (device/inode) invalidate
+// old windows, including across restarts. Never persist the token or its hash.
+function devinCredentialIdentity(filePath, stat) {
+  return JSON.stringify([
+    path.resolve(filePath),
+    ...[stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].map(String),
+  ]);
+}
+
+// Returns { apiKey, cacheIdentity } or null when no sign-in exists (no home, or the file is
 // absent — ENOENT only). Any other read failure or a mangled file throws an
 // owned, actionable error with no path or filesystem details, so a broken
 // sign-in can never masquerade as "not configured".
@@ -64,20 +66,42 @@ function readDevinCredentials({ home, env = process.env } = {}) {
     ? path.join(dir, "devin", "credentials.toml")
     : path.join(dir, ".local", "share", "devin", "credentials.toml");
   let raw;
+  let descriptor;
+  let cacheIdentity = null;
   try {
-    raw = fs.readFileSync(base, "utf8");
+    // Read the token and revision from the same opened file, so an atomic
+    // replacement cannot stamp the old token with the new file's revision.
+    descriptor = fs.openSync(base, "r");
+    const before = fs.fstatSync(descriptor, { bigint: true });
+    if (!before.isFile()) throw new Error("Not a credentials file");
+    raw = fs.readFileSync(descriptor, "utf8");
+    const after = fs.fstatSync(descriptor, { bigint: true });
+    const identity = devinCredentialIdentity(base, before);
+    if (identity === devinCredentialIdentity(base, after)) cacheIdentity = identity;
   } catch (error) {
     if (error && error.code === "ENOENT") return null;
-    throw new Error(
+    throw credentialsError(
       "Could not read the Devin CLI credentials file — check its permissions or run `devin auth login` to sign in again.",
     );
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
+  // Decode the credential document, then select only the root-level auth
+  // fields, like the other providers' structured credential readers.
+  let fields;
+  try {
+    fields = parseToml(raw);
+  } catch {
+    // Parser errors may quote credentials; expose only an owned message.
+    throw credentialsError(
+      "Could not parse the Devin CLI credentials file — run `devin auth login` to sign in again.",
+    );
   }
-  const fields = parseDevinCredentialsToml(raw);
   const apiKey = isNonEmptyString(fields.windsurf_api_key)
     ? fields.windsurf_api_key.trim()
     : null;
   if (!apiKey) {
-    throw new Error(
+    throw credentialsError(
       "Devin credentials file has no sign-in token — run `devin auth login`.",
     );
   }
@@ -85,11 +109,20 @@ function readDevinCredentials({ home, env = process.env } = {}) {
     ? fields.api_server_url.trim().replace(/\/+$/, "")
     : null;
   if (apiServerUrl && apiServerUrl !== DEVIN_API_ORIGIN) {
-    throw new Error(
+    throw credentialsError(
       "Devin credentials point at a custom api_server_url, which this quota provider does not support.",
     );
   }
-  return { apiKey };
+  return { apiKey, cacheIdentity };
+}
+
+function resolveDevinCacheIdentity(options) {
+  try {
+    return readDevinCredentials(options)?.cacheIdentity || null;
+  } catch {
+    // Unreadable, missing or invalid current credentials must fail closed.
+    return null;
+  }
 }
 
 function malformed(field) {
@@ -226,9 +259,14 @@ async function fetchDevinLimits({ home, env = process.env, enabled = false, fetc
     throw error;
   }
   if (!response?.ok) {
-    throw new Error(
+    const error = new Error(
       `Devin quota request was rejected (HTTP ${response?.status ?? "?"}).`,
     );
+    // The aggregate's disk-cache fallback only covers transient failures:
+    // carrying the status lets it tell a 429/5xx blip from an ambiguous or
+    // persistent rejection like HTTP 400 (docs/devin-limits.md).
+    if (typeof response?.status === "number") error.statusCode = response.status;
+    throw error;
   }
   let body;
   try {
@@ -243,7 +281,9 @@ async function fetchDevinLimits({ home, env = process.env, enabled = false, fetc
     plan_label: windows.plan_label,
     primary_window: windows.primary_window,
     secondary_window: windows.secondary_window,
+    // Internal: the aggregate strips this before returning its payload.
+    cache_identity: credentials.cacheIdentity,
   };
 }
 
-module.exports = { fetchDevinLimits };
+module.exports = { fetchDevinLimits, resolveDevinCacheIdentity };

package/src/lib/diagnostics.js

@@ -20,6 +20,7 @@ const { probeOpenclawSessionPluginState } = require("./openclaw-session-plugin")
 const { probeGrokHookState } = require("./grok-hook");
 const { resolveTrackerPaths } = require("./tracker-paths");
 const { resolveDeviceTokenPresence } = require("./cloud-device-token");
+const { inspectTraeCnAuth } = require("./trae-cn-config");
 const wsl = require("./wsl-probe");
 // TASK-011: Kiro paths inlined here to avoid pulling the ~4000-line
 // rollout module on every `tokentracker status` / `diagnostics` call.
@@ -195,6 +196,7 @@ async function collectTrackerDiagnostics({
     ? new Date(uploadThrottle.lastSuccessMs).toISOString()
     : null;
   const autoRetryAt = parseEpochMsToIso(autoRetry?.retryAtMs);
+  const traeCn = inspectTraeCnAuth({ home });
 
   return {
     ok: true,
@@ -233,6 +235,7 @@ async function collectTrackerDiagnostics({
       merge_policy:
         "Kiro IDE and Kiro CLI both emit source='kiro' in queue.jsonl so token, cost, heatmap, and leaderboard aggregations merge transparently. Use this block to distinguish sub-path contributions.",
     },
+    trae_cn: { ...traeCn, storage_path: redactValue(traeCn.storage_path, home) },
     scan_roots: {
       codex: describeScanRoots(scanRoots.codex),
       claude: describeScanRoots(scanRoots.claude),

package/src/lib/doctor.js

@@ -293,6 +293,19 @@ async function checkNetwork({ baseUrl, fetch }) {
 
 function buildDiagnosticsChecks(diagnostics) {
   const checks = [];
+  const traeCn = diagnostics?.trae_cn;
+  if (traeCn) {
+    const { TRAE_CN_AUTH_HELP } = require("./trae-cn-config");
+    checks.push({
+      id: "trae_cn.auth",
+      status: !traeCn.usage_opt_in || traeCn.auth === "readable" ? "ok" : "warn",
+      detail: !traeCn.usage_opt_in
+        ? "usage sync off (TOKENTRACKER_TRAE_CN_USAGE=1 opts in); auth not read; no TRAE request made"
+        : `local auth ${traeCn.auth}; API access not checked (${traeCn.storage_path || "storage.json not found"}). ${TRAE_CN_AUTH_HELP}`,
+      critical: false,
+      meta: traeCn,
+    });
+  }
   const notify = diagnostics?.notify || {};
   const notifyConfigured = Boolean(
     notify.codex_notify_configured ||

package/src/lib/local-api.js

@@ -1,3 +1,4 @@
+const { hasUnknownBackendCost } = require("./claude-backend");
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
@@ -2942,6 +2943,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         if (!sa.models.has(mdl))
           sa.models.set(mdl, { model: mdl, model_id: mdl, pricing: getModelPricingInfo(mdl, { source: src }), totals: { total_tokens: 0, billable_total_tokens: 0, input_tokens: 0, output_tokens: 0, cached_input_tokens: 0, cache_creation_input_tokens: 0, reasoning_output_tokens: 0, conversation_count: 0, total_cost_usd: "0" } });
         const ma = sa.models.get(mdl);
+        if (hasUnknownBackendCost(row)) ma.pricing = getModelPricingInfo(mdl, row);
         const reportedCost = ["grok", "cline"].includes(src) && Number(row.total_cost_usd) > 0;
         const costSource = reportedCost ? "provider_reported" : "model_pricing";
         ma.cost_source = ma.cost_source && ma.cost_source !== costSource ? "mixed" : costSource;