worktrust 0.6.17 → 0.6.18

package/README.md

@@ -145,8 +145,10 @@ nothing it does not:
 | `day`, `started_at`, `ended_at` | the day, and when the measured stretch began and ended |
 | `seconds` | measured time: every gap between stamped events up to five minutes |
 | `model_seconds`, `tool_seconds`, `human_seconds`, `idle_seconds` | what those seconds were: the model answering, tools or an agent run, your own turns, and what a cap cut off |
-| `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write` | token counts, when the app records them |
+| `tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write` | token counts, when the app records them (one answer counted once, however many lines the app wrote it in) |
 | `agent_runs`, `agent_seconds`, `agent_peak` | subagents: how many ran, their own time, the most open at once (never added to `seconds`) |
+| `interrupts`, `steers` | how often you stopped the agent mid-answer, and how often your message arrived while it was still mid-task (counts, never the words) |
+| `utc_offset` | your computer's offset from UTC when the stretch began, such as +02:00, so a working day reads in your own local time |
 | `model` | the model's name as the app reported it |
 | `kind`, `layer`, `layers` | the kind of work (built, changed, researched) and the area it touched (front end, back end, data …), as the session hook names them |
 | `exchanges` | how many times you and the model took turns |
@@ -237,7 +239,7 @@ which would delete every password on the computer, and many people rightly keep
 | **Reads** | Which AI apps are installed (the settings folders of Claude Code, Codex, Cursor, Gemini CLI, Antigravity, VS Code, Windsurf, Hermes Agent, Goose, OpenCode, OpenClaw), and the chats Cursor and Copilot keep (clocks, models and token counts only). Afterwards, the session hook reads Claude Code's, Codex's and Antigravity's session files, the session databases of Hermes, Goose, OpenCode and OpenClaw, and the chats Cursor and Copilot keep, on this computer to measure durations and token counts. |
 | **Writes** | The key file (above). In each AI app's MCP settings (`~/.claude.json` through `claude mcp`, `~/.cursor/mcp.json`, `~/.codex/config.toml`, `~/.gemini/settings.json`, `~/.gemini/config/mcp_config.json` (Antigravity), VS Code's `mcp.json`, Windsurf's `mcp_config.json`, Hermes's and Goose's `config.yaml`, OpenCode's `opencode.json`, OpenClaw through `openclaw mcp set`) a WorkTrust entry that runs the local bridge, with no key in it; three hooks in `~/.claude/settings.json`; the bridge, the hook and the counter in `~/.worktrust/`. |
 | **Sends, to pair** | This computer's system (macOS, Windows, Linux) and host name. WorkTrust also records the network address the request arrives from, as a security record kept 90 days and seen only by WorkTrust staff (to answer a theft or fraud report). |
-| **Sends, afterwards** | Per measured stretch of work, and nothing else: its durations (`seconds`, `duration_basis`, `model_seconds`, `tool_seconds`, `human_seconds`, `idle_seconds`), token counts (`tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write`, `token_basis`), the model's name (`model`), the kind of work and one layer keyword such as frontend or backend (`title`, `kind`, `layer`, `layers`), counts of how you work (`exchanges`, `turn_basis`, `agent_runs`, `agent_seconds`, `agent_peak`), when it ended (`at`), a hash of the session and the day (`stretch_ref`), `steered_from` when it ran over SSH, and, so the work can be matched to GitHub, the repository as its remote's owner/name (`repo`) and the hashes of the commits made in the stretch (`commits`, never their messages). |
+| **Sends, afterwards** | Per measured stretch of work, and nothing else: its durations (`seconds`, `duration_basis`, `model_seconds`, `tool_seconds`, `human_seconds`, `idle_seconds`), token counts (`tokens_in`, `tokens_out`, `tokens_cache_read`, `tokens_cache_write`, `token_basis`), the model's name (`model`), the kind of work and one layer keyword such as frontend or backend (`title`, `kind`, `layer`, `layers`), counts of how you work (`exchanges`, `turn_basis`, `agent_runs`, `agent_seconds`, `agent_peak`, `interrupts`, `steers`), when it began and ended and your computer's offset from UTC (`started_at`, `at`, `utc_offset`), a hash of the session and the day (`stretch_ref`), `steered_from` when it ran over SSH, and, so the work can be matched to GitHub, the repository as its remote's owner/name (`repo`) and the hashes of the commits made in the stretch (`commits`, never their messages). |
 | **Never sends** | Prompts, answers, code, file names or paths, commit messages, branch names, or the name of your local folder (a repository is named only as its remote's owner/name, above). The door has no field for them and refuses a submission that carries them. |
 
 ## Why you can check it

package/log-session.mjs

@@ -342,22 +342,45 @@ function stretchesOf(file, since) {
   }
   if (messages.length === 0) return [];
   messages.sort((a, b) => a.at - b.at);
+  const byDay = byDayOf(messages);
+  const agents = agentsByDay(file, since);
+  return [...byDay.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([day, ofDay]) => { const stretch = measure(cwd, ofDay); return stretch && { ...stretch, ref: stretchRef(file, day), steered, agents: agents.get(day) ?? null }; }).filter(Boolean);
+}
+
+/**
+ * DAYS SPLIT ON THE CLOCK, NOTHING LOST AT MIDNIGHT (0.6.18, audit C14). A stretch is one session's UTC day, and the gap
+ * between a day's last message and the next day's first belonged to neither, so a run through the night lost one gap
+ * per midnight. A day whose first message follows the last one within the tool cap now opens with a BRIDGE: the message
+ * before it, carrying no tokens, no model and no turn, so the gap that crosses midnight is counted once, on the day it
+ * ends, under the same caps as any other.
+ * Messages must arrive sorted.
+ */
+function byDayOf(messages) {
   const byDay = new Map();
+  let prev = null;
   for (const message of messages) {
     const day = new Date(message.at).toISOString().slice(0, 10);
-    if (!byDay.has(day)) byDay.set(day, []);
+    // Only a gap the work could have run through (within the tool cap): a session resumed the next morning opens its day as it always did.
+    if (!byDay.has(day)) byDay.set(day, prev && message.at - prev.at <= TOOL_CAP * 1000 ? [{ ...prev, usage: null, model: null, cumulative: false, bridge: true }] : []);
     byDay.get(day).push(message);
+    prev = message;
   }
-  const agents = agentsByDay(file, since);
-  return [...byDay.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([day, ofDay]) => { const stretch = measure(cwd, ofDay); return stretch && { ...stretch, ref: stretchRef(file, day), steered, agents: agents.get(day) ?? null }; }).filter(Boolean);
+  return byDay;
 }
+/** The first message a day really holds (a bridge is the day before's). */
+const firstOf = (messages) => (messages.find((message) => !message.bridge) ?? messages[0]).at;
+/** The computer's offset from UTC at a moment, as +02:00: what the owner's mirror needs to read a working day in local time. */
+const offsetAt = (ms) => { const minutes = -new Date(ms).getTimezoneOffset(), abs = Math.abs(minutes); return `${minutes < 0 ? "-" : "+"}${String(Math.floor(abs / 60)).padStart(2, "0")}:${String(abs % 60).padStart(2, "0")}`; };
+/** Claude Code's own line when the person stops the agent mid-answer (Esc), read for its marker only. */
+const INTERRUPTED = /^\[Request interrupted by user/;
+const textOf = (content) => (typeof content === "string" ? content : Array.isArray(content) ? content.map((block) => (block && typeof block.text === "string" ? block.text : "")).join("") : "");
 
 /** One transcript line as the measure reads it: the clock, the role, what KIND of message it is (for the layers), its counts. */
 const messageOf = (line, at) => {
   const content = line.message?.content ?? null;
   const blocks = Array.isArray(content) ? content : [];
   return {
-    at, type: line.type, usage: line.message?.usage ?? null, model: line.message?.model ?? null, meta: line.isMeta === true, content,
+    at, type: line.type, usage: line.message?.usage ?? null, model: line.message?.model ?? null, messageId: typeof line.message?.id === "string" ? line.message.id : null, meta: line.isMeta === true, content,
     // A tool's answer comes back on the user role; a line a reader marks `agentic` is an agent run (Copilot's asked → completed).
     kind: line.type === "assistant" ? "assistant" : blocks.some((block) => block && block.type === "tool_result") ? "tool_result" : "user",
     toolUse: line.type === "assistant" && blocks.some((block) => block && block.type === "tool_use"),
@@ -456,12 +479,22 @@ function measure(cwd, messages) {
   const models = new Map();
   let exchanges = 0;
   for (const message of messages) {
-    if (message.type === "user" && !message.meta && isHumanTurn(message.content)) exchanges += 1;
+    if (message.type === "user" && !message.meta && !message.bridge && isHumanTurn(message.content)) exchanges += 1;
     if (message.model) models.set(message.model, (models.get(message.model) ?? 0) + 1);
   }
   const model = [...models.entries()].sort((a, b) => b[1] - a[1])[0]?.[0] ?? null;
   const tokens = tokensOf(messages);
-  return { cwd, seconds: measured, layers: measured !== null ? timeLayers(messages) : null, ...tokens, cumulative: messages.some((message) => message.cumulative), exchanges, model, from: messages[0].at, to: messages[messages.length - 1].at };
+  // HOW THE PERSON STEERED (owner, 2026-10-08): how often they stopped the agent (Claude Code's interruption line), and how
+  // often their next turn arrived while the agent was still mid-task (right after a tool call or its result). Counts only.
+  let interrupts = 0, steers = 0;
+  for (let i = 1; i < messages.length; i += 1) {
+    const message = messages[i], prev = messages[i - 1];
+    if (message.bridge || message.type !== "user" || message.meta || message.kind === "tool_result") continue;
+    if (INTERRUPTED.test(textOf(message.content).trim())) interrupts += 1;
+    else if (isHumanTurn(message.content) && (prev.kind === "tool_result" || prev.toolUse)) steers += 1;
+  }
+  const from = firstOf(messages);
+  return { cwd, seconds: measured, layers: measured !== null ? timeLayers(messages) : null, ...tokens, cumulative: messages.some((message) => message.cumulative), exchanges, interrupts, steers, model, from, to: messages[messages.length - 1].at, offset: offsetAt(from) };
 }
 
 /**
@@ -508,9 +541,14 @@ function usageShapeKnown(usage) {
 }
 function tokensOf(messages) {
   let tokensIn = 0, tokensOut = 0, cacheRead = 0, cacheWrite = 0, counted = 0, shapeKnown = true;
+  // ONE ANSWER, ONE USAGE (0.6.18): Claude Code writes an answer as a line per content block (thinking, text, each tool
+  // call), every one repeating the answer's usage; summed per line, a real session read 2.6 times its output tokens. An
+  // answer with an id is counted once; a line without one (Codex's token events) is its own.
+  const seen = new Set();
   for (const message of messages) {
     const usage = message.usage;
     if (!usage) continue;
+    if (message.messageId) { if (seen.has(message.messageId)) continue; seen.add(message.messageId); }
     if (!usageShapeKnown(usage)) { shapeKnown = false; break; }
     counted += 1;
     tokensIn += (usage.input_tokens ?? 0) + (usage.cache_creation_input_tokens ?? 0);
@@ -565,6 +603,10 @@ function payloadFor(stretch) {
     // THE LAYERS (2026-10-06), only on a measured stretch, each bounded by a day: what the seconds were. `seconds` above is untouched.
     ...(stretch.seconds !== null && stretch.layers ? { model_seconds: Math.min(DAY_SECONDS, stretch.layers.model), tool_seconds: Math.min(DAY_SECONDS, stretch.layers.tool), human_seconds: Math.min(DAY_SECONDS, stretch.layers.human), idle_seconds: Math.min(DAY_SECONDS, stretch.layers.idle) } : {}),
     // THE SUBAGENTS, as agent metadata beside the day: runs, their own seconds, the peak open at once. Never in `seconds`.
+    // WHEN AND HOW (0.6.18): the stretch's first moment and the computer's UTC offset then; the person's interruptions and mid-task turns, counts only.
+    started_at: new Date(stretch.from).toISOString(), utc_offset: stretch.offset,
+    ...(stretch.interrupts > 0 ? { interrupts: Math.min(10000, stretch.interrupts) } : {}),
+    ...(stretch.steers > 0 ? { steers: Math.min(10000, stretch.steers) } : {}),
     ...(stretch.agents && stretch.agents.runs > 0 ? { agent_runs: Math.min(AGENT_RUNS_MAX, stretch.agents.runs), agent_seconds: Math.min(AGENT_SECONDS_MAX, stretch.agents.seconds), agent_peak: Math.min(AGENT_RUNS_MAX, stretch.agents.peak) } : {}),
     at: new Date(stretch.to).toISOString(),
   };
@@ -643,23 +685,22 @@ function historyEntries(floor = null, all = false) {
     const lines = parsedLines(file);
     if (!lines) continue;
     let cwd = null, steered = null;
-    const byDay = new Map();
+    const read = [];
     for (const line of lines) {
       if (typeof line.cwd === "string") cwd = line.cwd;
       if (typeof line.steered === "string") steered = line.steered;
       if (!line.timestamp || (line.type !== "user" && line.type !== "assistant")) continue;
       const at = Date.parse(line.timestamp);
       if (!Number.isFinite(at)) continue;
-      const day = new Date(at).toISOString().slice(0, 10);
-      if (!byDay.has(day)) byDay.set(day, []);
-      byDay.get(day).push(messageOf(line, at));
+      read.push(messageOf(line, at));
     }
+    read.sort((a, b) => a.at - b.at);
+    const byDay = byDayOf(read);
     const agents = agentsByDay(file, null);
     for (const [day, messages] of byDay) {
       if (messages.length === 0) continue;
-      messages.sort((a, b) => a.at - b.at);
       // Under-reporting is the safe side (THE FLOORS): a day that began before the account changed is not offered at all.
-      if (floor !== null && messages[0].at < floor) continue;
+      if (floor !== null && firstOf(messages) < floor) continue;
       const last = messages[messages.length - 1].at;
       // The live window belongs to the hook: a stretch that log_work may still report is not history.
       if (!all && Date.now() - last < WINDOW_HOURS * 3600_000) continue;
@@ -668,7 +709,7 @@ function historyEntries(floor = null, all = false) {
       if (CODEX_ROLLOUT.test(file)) entrySource.set(entry, "codex");
       if (ANTIGRAVITY_TRANSCRIPT.test(file)) entrySource.set(entry, "antigravity");
       if (DATABASE_SESSION.test(file)) entrySource.set(entry, file.slice(0, file.indexOf(":")));
-      entryFile.set(entry, { file, from: messages[0].at, folder: cwd ? String(cwd).split(/[\\/]/).filter(Boolean).pop() ?? null : null });
+      entryFile.set(entry, { file, from: firstOf(messages), folder: cwd ? String(cwd).split(/[\\/]/).filter(Boolean).pop() ?? null : null });
       entries.push(entry);
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worktrust",
-  "version": "0.6.17",
+  "version": "0.6.18",
   "description": "Couple this computer to WorkTrust: approve a code in your browser, and every AI app here reports what you built. Metadata only, no dependencies.",
   "type": "module",
   "bin": {

package/preserve.mjs

@@ -168,7 +168,7 @@ async function apply(list, agreed = false) {
 }
 
 /** THE ALLOWLIST: what a line may carry, each value checked for its type. A key not named here never reaches the archive. */
-const COUNTS = ["seconds", "tokens_in", "tokens_out", "tokens_cache_read", "tokens_cache_write", "model_seconds", "tool_seconds", "human_seconds", "idle_seconds", "agent_runs", "agent_seconds", "agent_peak"];
+const COUNTS = ["seconds", "tokens_in", "tokens_out", "tokens_cache_read", "tokens_cache_write", "model_seconds", "tool_seconds", "human_seconds", "idle_seconds", "agent_runs", "agent_seconds", "agent_peak", "interrupts", "steers"];
 const ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,3})?Z$/;
 /** The hook's own words for a stretch (work area, kind, how it was steered, the measuring bases), kept as the hook sends them. */
 const WORDS = ["layer", "kind", "steered_from", "duration_basis", "token_basis", "turn_basis"];
@@ -195,6 +195,8 @@ function archiveLine(entry) {
   for (const key of WORDS) if (typeof entry[key] === "string" && WORD.test(entry[key])) line[key] = entry[key];
   if (Array.isArray(entry.layers) && entry.layers.length > 1 && entry.layers.every((word) => typeof word === "string" && WORD.test(word))) line.layers = entry.layers.slice(0, 8);
   if (typeof entry.exchanges === "number" && Number.isInteger(entry.exchanges) && entry.exchanges > 0) line.exchanges = entry.exchanges;
+  // The computer's offset from UTC when the stretch began (0.6.18), so a working day can be read in local time.
+  if (typeof entry.utc_offset === "string" && /^[+-]\d{2}:\d{2}$/.test(entry.utc_offset)) line.utc_offset = entry.utc_offset;
   // Commit hashes the stretch made, never a message: what ties AI time to delivered work in the repository.
   if (Array.isArray(entry.commits) && entry.commits.length > 0 && entry.commits.every((sha) => typeof sha === "string" && /^[0-9a-f]{7,40}$/.test(sha))) line.commits = entry.commits.slice(0, 50);
   // The project as a one-way hash of its name (owner/name, else the folder's own name): which days belong together, never which project.
@@ -244,6 +246,8 @@ function check(dir) {
   }
   const manifest = readJson(join(dir, "manifest.json")).value;
   if (rows.length > 0 && (!manifest || manifest.count !== lines.length || manifest.head !== lines.at(-1).hash)) return broken("manifest.json", "its count or head does not match the lines (lines were removed or added outside preserve)");
+  // THE MANIFEST'S SEAL (0.6.18, audit C9): a signed count and head, so a cut tail with a manifest edited to match is caught.
+  if (manifest && typeof manifest.signature === "string" && !signedBy(manifest)) return broken("manifest.json", "its signature does not verify with the key named in it (the count or the last line was changed)");
   const days = new Map();
   for (const line of lines) days.set(line.day, [...(days.get(line.day) ?? []), line]);
   const mine = deviceKey()?.publicX ?? null;
@@ -255,15 +259,19 @@ function check(dir) {
     if (!proof || proof.date !== day) return broken(where, "missing or unreadable");
     if (proof.count !== ofDay.length || proof.root !== rootOf(ofDay.map((line) => line.hash))) return broken(where, "the day's root does not match its lines");
     if (proof.signature === null) continue;
-    const { signature, ...body } = proof;
-    let valid = false;
-    try { valid = verify(null, Buffer.from(canonical(body)), createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: body.public_key }, format: "jwk" }), Buffer.from(signature, "base64url")); } catch { valid = false; }
-    if (!valid) return broken(where, "the signature does not verify with the key named in it");
+    if (!signedBy(proof)) return broken(where, "the signature does not verify with the key named in it");
     signed += 1;
-    if (body.public_key === mine) ours += 1;
+    if (proof.public_key === mine) ours += 1;
   }
-  return { lines, days, signed, ours, manifest };
+  return { lines, days, signed, ours, manifest, proofs: new Map([...days.keys()].map((day) => [day, readJson(join(dir, "proofs", `${day}.json`)).value])) };
 }
+/** Whether a signed body (a day's proof, the manifest) verifies under the key it names. */
+function signedBy(document) {
+  const { signature, ...body } = document;
+  try { return verify(null, Buffer.from(canonical(body)), createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: body.public_key }, format: "jwk" }), Buffer.from(signature, "base64url")); } catch { return false; }
+}
+/** Signed with this computer's key, or null: the body as it is signed. */
+const sealed = (body, key) => ({ ...body, signature: key ? sign(null, Buffer.from(canonical(body)), key.privateKey).toString("base64url") : null });
 
 function archive(dir) {
   IDS = computerIds();
@@ -297,13 +305,19 @@ function archive(dir) {
     prev = hashed.hash;
   }
   // A day that gained lines gets its root again over all of its lines; the lines themselves are never rewritten.
+  // THIS KEY SIGNS ONLY ITS OWN LINES (0.6.18, audit S7): a day is signed when every earlier line of it was already under
+  // this key's signature (or there were none); a day that came into the folder from elsewhere keeps an unsigned root.
   const key = deviceKey();
+  const ours = (document) => !document || (key && typeof document.signature === "string" && document.public_key === key.publicX);
   mkdirSync(join(dir, "proofs"), { recursive: true });
   for (const day of new Set(fresh.map((line) => line.day))) {
-    const body = proofBody(day, all.filter((line) => line.day === day), key);
-    writeFileSync(join(dir, "proofs", `${day}.json`), `${JSON.stringify({ ...body, signature: key ? sign(null, Buffer.from(canonical(body)), key.privateKey).toString("base64url") : null }, null, 1)}\n`);
+    const own = !existing.days?.has(day) || ours(existing.proofs?.get(day));
+    const body = proofBody(day, all.filter((line) => line.day === day), own ? key : null);
+    writeFileSync(join(dir, "proofs", `${day}.json`), `${JSON.stringify(sealed(body, own ? key : null), null, 1)}\n`);
   }
-  if (fresh.length > 0 || !existing.manifest) writeFileSync(join(dir, "manifest.json"), `${JSON.stringify({ format: "worktrust-ai-evidence/1", collector_version: COLLECTOR, created: existing.manifest?.created ?? new Date().toISOString(), updated: new Date().toISOString(), clients: [...new Set(all.map((line) => line.client))].sort(), ...IDS, count: all.length, head: prev }, null, 1)}\n`);
+  // The manifest is sealed the same way: a new archive, or one whose manifest this key already signed.
+  const manifestKey = !existing.manifest || ours(existing.manifest) ? key : null;
+  if (fresh.length > 0 || !existing.manifest) writeFileSync(join(dir, "manifest.json"), `${JSON.stringify(sealed({ format: "worktrust-ai-evidence/1", collector_version: COLLECTOR, created: existing.manifest?.created ?? new Date().toISOString(), updated: new Date().toISOString(), clients: [...new Set(all.map((line) => line.client))].sort(), ...IDS, count: all.length, head: prev, ...(manifestKey ? { public_key: manifestKey.publicX } : {}) }, manifestKey), null, 1)}\n`);
   say();
   say(`  ✓ ${fresh.length} new day-stretch${fresh.length === 1 ? "" : "es"} archived in ${dir}: it holds ${all.length}, the session hook measures ${measured.size} finished ones here now${key ? ", each day's root signed with this computer's device key" : ", unsigned (no device key on this computer)"}.`);
   if (waiting > 0) say(`    ${waiting} of today wait for tomorrow's run: a day is archived once it is over.`);
@@ -314,8 +328,9 @@ function verifyArchive(dir) {
   const result = check(dir);
   if (result.broken) { say(`  BROKEN  ${result.broken}`); process.exit(1); }
   if (result.lines.length === 0) { say(`  Nothing to verify in ${dir}.`); return; }
-  const signedBy = result.signed === 0 ? "no day signed" : result.ours === result.signed ? `${result.signed} signed by this computer's key` : `${result.signed} signed (${result.ours} by this computer's key, ${result.signed - result.ours} by another key named in them)`;
-  say(`  OK  ${result.lines.length} stretches · ${result.days.size} days · the chain is whole · every day's root matches · ${signedBy}`);
+  const daySeal = result.signed === 0 ? "no day signed" : result.ours === result.signed ? `${result.signed} signed by this computer's key` : `${result.signed} signed (${result.ours} by this computer's key, ${result.signed - result.ours} by another key named in them)`;
+  const seal = typeof result.manifest?.signature !== "string" ? "manifest unsigned" : result.manifest.public_key === deviceKey()?.publicX ? "manifest signed by this computer's key" : "manifest signed by another key named in it";
+  say(`  OK  ${result.lines.length} stretches · ${result.days.size} days · the chain is whole · every day's root matches · ${daySeal} · ${seal}`);
 }
 
 /** --summary: what a person or a team reads from the archive, counted locally (preserve-summary.mjs) once the chain checks out. */

package/worktrust.mjs

@@ -71,7 +71,7 @@ const command = args.find((arg, at) => !arg.startsWith("--") && !(at > 0 && VALU
 const flag = (name) => { const at = args.indexOf(`--${name}`); return at >= 0 ? args[at + 1] : undefined; };
 const has = (name) => args.includes(`--${name}`);
 /** This CLI's version, said to the door so the app can tell which computer runs an old one (check-cli-package holds it equal to package.json). */
-const CLI_VERSION = "0.6.17";
+const CLI_VERSION = "0.6.18";
 const ORIGIN = (flag("origin") ?? process.env.WORKTRUST_ORIGIN ?? "https://app.worktrust.io").replace(/\/$/, "");
 const MCP = flag("url") ?? process.env.WORKTRUST_MCP_URL ?? `${ORIGIN}/api/mcp`;
 const HOME_DIR = join(homedir(), ".worktrust");
@@ -670,7 +670,8 @@ async function offerRebuild(previousVersion, paths, key) {
   if (!previousVersion || previousVersion === CLI_VERSION) return;
   say();
   say(`  This computer's earlier lines in WorkTrust were measured by worktrust ${previousVersion}. Version ${CLI_VERSION} measures`);
-  say("  differently (what the seconds were, your own turns, tokens with the cache, more AI apps). You can re-measure the");
+  say("  differently (each answer's tokens counted once, nothing lost at midnight, when each stretch began, how you steered");
+  say("  the agent, what the seconds were, more AI apps). You can re-measure the");
   say("  sessions still on this computer and have WorkTrust replace this computer's earlier lines, day by day, never counting");
   say("  a day twice. Later: npx worktrust@latest history --rebuild");
   if (!(await ask("Show the plan and rebuild now?", false))) { say("  Not now."); return; }