troxy-cli 1.29.1 → 1.29.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.29.1",
+  "version": "1.29.2",
   "description": "A secure control layer for AI agents: policies across payments, messages, logins, destructive actions, model usage, and secrets, all enforceable from the CLI",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/hook-report.js

@@ -42,6 +42,11 @@ export function extractUsage(entry) {
     // dollar math server-side from the model id; this file only sums what
     // the transcript says was used.
     tokens: inputTokens + outputTokens + cacheCreation + cacheRead,
+    // Reply-only portion of the total above - sent alongside actual_tokens,
+    // never in place of it (server still bills off the combined total; this
+    // is purely so the activity log can show "X tokens (Y reply)" instead
+    // of one opaque combined number - Gilad, 2026-09-04).
+    outputTokens,
     // Lives on the transcript ENTRY itself, not inside message.usage -
     // confirmed live 2026-09-03 against a real session file (values seen:
     // 'high', 'max'). Whatever string Claude Code actually used, passed
@@ -128,7 +133,11 @@ export function usageForCurrentTurn(transcriptPath) {
   if (seen.size === 0) return null;
 
   let totalTokens = 0;
-  for (const u of seen.values()) totalTokens += u.tokens;
+  let totalOutputTokens = 0;
+  for (const u of seen.values()) {
+    totalTokens += u.tokens;
+    totalOutputTokens += u.outputTokens || 0;
+  }
 
   // turn_key: dedups a hook that fires twice for the same turn (a retry,
   // a Claude Code internal replay) against a repeat POST for the same
@@ -151,8 +160,8 @@ export function usageForCurrentTurn(transcriptPath) {
   const contentExcerpt = replyText ? replyText.slice(0, MAX_EXCERPT_LEN) : null;
 
   return {
-    tokens: totalTokens, model: lastModel, effort: lastEffort, toolUseBlocksSoFar,
-    turnKey, contentExcerpt,
+    tokens: totalTokens, outputTokens: totalOutputTokens, model: lastModel,
+    effort: lastEffort, toolUseBlocksSoFar, turnKey, contentExcerpt,
   };
 }
 
@@ -202,6 +211,10 @@ export async function runHookReport() {
     const turnKey = sessionId ? `${sessionId}:${usage.turnKey}` : null;
 
     const body = { model: usage.model, actual_tokens: usage.tokens, turn_key: turnKey };
+    // Additive only - the backend already treats a missing/invalid value as
+    // "no breakdown available" and falls back to the plain total, so it's
+    // safe to just omit this rather than validate it client-side too.
+    if (usage.outputTokens > 0) body.actual_output_tokens = usage.outputTokens;
     // content_excerpt is optional and additive - the backend classifies it
     // if present, samples/rate-limits on its own, and silently skips when
     // it isn't. Sending it is not required for the usage report itself to

package/src/tests/hook-report.test.js

@@ -59,8 +59,9 @@ describe('extractUsage', () => {
       },
     };
     const result = extractUsage(entry);
-    assert.deepEqual(Object.keys(result).sort(), ['effort', 'messageId', 'model', 'tokens']);
+    assert.deepEqual(Object.keys(result).sort(), ['effort', 'messageId', 'model', 'outputTokens', 'tokens']);
     assert.equal(result.effort, 'high');
+    assert.equal(result.outputTokens, 5);
     assert.ok(!JSON.stringify(result).includes('actual conversation'));
   });
 
@@ -108,6 +109,20 @@ describe('usageForCurrentTurn', () => {
     assert.equal(result.tokens, 10 + 20 + 5 + 8);
   });
 
+  it('sums outputTokens (reply-only) alongside tokens, same dedup-by-message-id rule', () => {
+    // Same fixture as the two-real-model-calls test above - outputTokens must
+    // dedup identically (20 + 8, not 20+20+8) since it comes off the same
+    // per-message.id `seen` map as the combined total.
+    writeLines([
+      { type: 'user', message: { content: [{ type: 'text', text: 'hi' }] } },
+      assistantLine('msg_1', { input_tokens: 10, output_tokens: 20 }),
+      assistantLine('msg_1', { input_tokens: 10, output_tokens: 20 }),
+      assistantLine('msg_2', { input_tokens: 5, output_tokens: 8 }),
+    ]);
+    const result = usageForCurrentTurn(transcriptPath());
+    assert.equal(result.outputTokens, 20 + 8, 'reply-only total did not dedup by message.id like tokens does');
+  });
+
   it('only looks back to the last user-authored line, not the whole session', () => {
     writeLines([
       { type: 'user', message: { content: [{ type: 'text', text: 'first turn' }] } },