feat(usage): report complete delegated session costs

[mjacobs]

Session usage undercounted delegation because Claude Code stores each subagent in a separate transcript. session usage now includes descendant subagents by default across local, daemon, PostgreSQL, and DuckDB paths, while --own-only preserves the previous per-transcript view. Delegated forks count when they are inside the subagent subtree; root-level forks remain excluded.

Targeted refresh keeps daemon reads fresh without making the usage GET endpoint state-changing. Local and S3-backed parents synchronize through the protected refresh path before the CLI fetches combined usage, preserving remote namespaces and project attribution even when the configured root has been removed.

Explicit remote combined usage now requires daemon API v5. The CLI validates /api/v1/version before synchronization or usage retrieval and reports a clear upgrade-or---own-only error for older daemons; own-only queries retain their earlier compatibility.

Claude streaming rows are deduplicated globally by message/request identity. Reports keep the greatest output snapshot, attribute it to the earliest transcript, and settle equal snapshots deterministically across SQLite, PostgreSQL, and DuckDB. This prevents partial parent rows from displacing complete child rows while keeping per-session and automated/interactive attribution stable.

Billed Claude server-side web searches are priced on top of tokens across session, daily, and activity reports. The parser uses the linked WebSearch result when the message counter is absent; side-call tokens that Claude Code does not persist remain a documented undercount. Combined costs are exposed only when every included token-bearing session has contributing usage coverage, and the deprecated cost_usd field uses the same shared conversion on every backend.

The daemon embedding scheduler coalesces periodic ticks during an active bounded retry. Exhaustion releases the retained idle lease, while a later periodic tick or real mutation starts a fresh bounded reconciliation lifecycle.

Reviewers should focus on internal/service/session_usage_subagents.go, the remote guard in cmd/agentsview/session_usage.go, shared survivor selection in internal/activity/activity.go, snapshot ranking in each usage backend, S3 hydration in internal/sync/s3_source.go, and the retry lifecycle in cmd/agentsview/embed_scheduler.go.

[roborev-ci]

roborev: Combined Review (45e840e)

Medium-severity correctness issues remain in incremental web-search accounting and subagent token deduplication.

Medium

• internal/parser/claude.go:1132 — Incremental parsing annotates only newly appended messages. If a WebSearch assistant turn is synced before its tool-result record, the later result cannot update the stored assistant row after the incremental offset advances, permanently omitting the search fee until a full parse. Trigger a full parse or update the stored assistant message when the referenced tool call is outside the incremental batch, and test assistant/result records split across incremental syncs.

• internal/service/session_usage_subagents.go:164 — Missing entries in outputBySession conflate sessions with no eligible rows and sessions whose rows were removed as cross-session duplicates. Falling back to stored aggregates for the latter reintroduces duplicate tokens, causing total_output_tokens to double-count while cost and breakdown remain deduplicated. Track whether each session had eligible rows before deduplication and reserve the stored-aggregate fallback for genuinely rowless sessions.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 8m32s

[roborev-ci]

roborev: Combined Review (0853860)

Combined review found one medium-severity usage-accounting issue; no security issues were identified.

Medium

• internal/service/session_usage_subagents.go:168 — Combined usage replaces a session’s stored TotalOutputTokens with the sum of eligible usage rows whenever any such row exists. For sessions with partial token telemetry, this drops output tokens from messages without usable usage rows and can make the rolled-up total lower than the parent session’s known total, even without duplicates. Preserve the uncovered portion of each stored session aggregate and subtract only output attributable to rows removed by cross-session deduplication. Add coverage for a session containing both token-bearing and output-only messages.

---

Reviewers: 2 done | Synthesis: codex, 13s | Total: 11m14s

[roborev-ci]

roborev: Combined Review (2602dde)

Review found two medium-severity correctness issues affecting usage and cost reporting.

Medium

• internal/service/session_usage_rollup.go:125 — Fork sessions beneath a subagent are traversed but excluded from usage IDs. Claude creates fork children for branches inside agent-*.jsonl transcripts, so unique billed usage can be omitted from delegated cost totals and disagree with daily usage. Include subordinate forks after entering a subagent subtree and add a regression test covering unique usage in a subagent fork.

• internal/db/db.go:348 — The source data version advances to 76 without advancing internal/duckdb.SchemaVersion. Existing DuckDB/Quack mirrors at data version 75 may pass compatibility checks and serve unannotated token_usage, undercounting historical web-search fees. Bump internal/duckdb.SchemaVersion and update compatibility tests so older mirrors are rejected and rebuilt.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 10m35s

[roborev-ci]

roborev: Combined Review (1c2ae70)

Code review passed with no Medium, High, or Critical findings.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 11m37s

[roborev-ci]

roborev: Combined Review (ebe1dfc)

Medium-severity issue found: S3 Claude sources can underreport delegated-session costs.

Medium

• cmd/agentsview/archive_query_backend.go:339 — On-demand child refresh only searches the local filesystem via ClaudeSubagentTranscriptPaths. For supported S3 Claude sources, filepath.WalkDir finds no children, so newly discovered parent sessions can omit unsynced delegated-session costs, particularly in no-daemon mode. Use a source-aware provider abstraction with S3 support to enumerate and sync child transcripts before calculating usage, and add an S3 regression test.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 12m7s

[wesm]

rebasing and fixing

[roborev-ci]

roborev: Combined Review (3e5cade)

The change has two medium-severity issues that can underreport delegated-session usage and costs.

Medium

• internal/db/activityreport.go:165 — Duplicate messages can lose web-search usage and cost

  Deduplication skips later copies before reading their web_search_requests. Branch-local tool results can make duplicate Claude messages asymmetric: the first/root copy may report zero searches while a fork copy contains the billed searches. Skipping the fork omits both its requests and associated cost.

  Fix: Merge duplicate search counters before pricing, using the maximum rather than summing. Apply equivalent behavior across SQLite, PostgreSQL, and DuckDB, and add an asymmetric-duplicate regression test.

• internal/sync/s3_source.go:413 — S3 subagents can lose the parent’s host namespace

  On-demand S3 subagent sync derives the child session ID from its filename before hydration. If the parent persists in the database after its S3 root is no longer configured, hydration cannot recover the machine namespace from the unprefixed child ID. The child is then stored without the parent’s host prefix and no longer rolls up under the parent.

  Fix: Pass the resolved parent machine/host namespace into S3 subagent sync and apply it to every discovered child. Add coverage for persisted S3 parents whose original root is no longer configured.

---

Reviewers: 2 done | Synthesis: codex, 11s | Total: 14m51s

[roborev-ci]

roborev: Combined Review (caa4674)

Medium-severity issue found in S3 subagent refresh; no security vulnerabilities identified.

Medium

• internal/sync/s3_source.go:413 — S3 subagent refresh derives the child ID from the filename but obtains its machine namespace only by matching a currently configured S3 root. If the parent is loaded from its stored s3:// path after that root is removed or changed, file.Machine remains empty, so the child is stored or queried as unprefixed agent-* instead of <machine>~agent-*. This disconnects it from the namespaced parent and can collide with a local session.

  Suggested fix: Preserve the parent’s host namespace when invoking the refresh, or derive the machine directly from the canonical S3 URI. Add coverage for refreshing a namespaced stored S3 session without a matching configured root.

---

Reviewers: 2 done | Synthesis: codex, 10s | Total: 13m0s

[roborev-ci]

roborev: Combined Review (dbeb948)

Review identified one medium-severity correctness issue in S3 subagent project attribution.

Medium

• internal/sync/s3_source.go:419 — S3 subagent hydration looks up the raw child ID instead of its machine-prefixed ID. A same-named local session can incorrectly supply the remote child’s project, while an existing host~agent-* session is missed. If the S3 root is no longer configured, newly synced children also lose the stored parent’s project, corrupting project-level usage attribution.
  • Fix: Hydrate using the machine-prefixed child ID, then fall back to the stored parent’s project when neither the child nor configured root provides one. Add tests covering a colliding local child and project preservation after root removal.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 14m20s

[roborev-ci]

roborev: Combined Review (d46b0b4)

The change has one medium-severity freshness issue; no material security regressions were identified.

Medium

• internal/server/huma_routes_sessions.go:515 — The subagents=true daemon path queries archived descendants without performing the targeted parent/subagent refresh used by the direct backend. Because the CLI normally uses a running daemon, newly created local children may be missed until watcher throttling completes, while S3 children may remain absent until the 15-minute remote sync. Before aggregating on a writable local daemon, refresh the parent and discover/sync its subagent transcripts using the shared targeted-sync logic.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 21m3s

[roborev-ci]

roborev: Combined Review (c3256ac)

Combined review verdict: One medium-severity usage-accounting defect requires correction.

Medium

• Double deduction understates combined output tokens — internal/service/session_usage_subagents.go:160

  The root session’s TotalOutputTokens already has intra-session streaming snapshots deducted by GetSessionUsage, but combinedOutputTokens subtracts the same snapshots again. When the root also contains output-only messages absent from usage rows, the reconstruction understates the combined total.

  Suggested fix: Start from the root session’s raw stored aggregate, or track intra-session and cross-session deductions separately so each snapshot is deducted exactly once. Add coverage combining streamed snapshots, an output-only root message, and a subagent.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 11m57s

[roborev-ci]

roborev: Combined Review (d950788)

Review found three medium-severity issues involving token undercounting, unbounded query memory growth, and a state-changing GET endpoint.

Medium

• Double deduction undercounts combined output tokens — internal/service/session_usage_subagents.go:160
  The root session’s incomplete streaming snapshots are removed by GetSessionUsage, then subagent aggregation subtracts the same rows again through DeduplicatedOutputTokens. Roots containing both discarded snapshots and output-only messages can therefore be undercounted when subagents are included. Compute from the raw stored total_output_tokens, or separate intra-session snapshot deductions from cross-session deductions so each adjustment occurs once. Add coverage combining streaming snapshots, output-only tokens, and a subagent.

• Usage aggregation can cause excessive peak memory consumption — internal/db/usage.go:2196, internal/db/usage.go:2853, internal/postgres/usage.go:1526, internal/postgres/usage.go:2107
  Daily-usage and top-session queries retain every scanned usage row—including token JSON and strings—plus extra row and mask slices. Large or all-time archive queries previously streamed these results, so this can exhaust daemon memory at production scale. Select the greatest Claude snapshot in the SQLite/PostgreSQL queries using a window rank, as DuckDB does, or use another bounded or two-pass approach.

• State-changing synchronization is exposed through a CSRF-unprotected GET — internal/server/huma_routes_sessions.go:518
  The subagents=true usage request invokes SyncSessionWithSubagentsContext, which performs filesystem/S3 work and writes archive data. In loopback mode, cross-origin GET requests are not rejected, allowing a malicious page with a known or guessable session ID to repeatedly trigger persistent synchronization and expensive processing. Keep the GET route side-effect-free and move synchronization to a POST endpoint protected by existing origin checks, with the CLI calling it before fetching usage.

---

Reviewers: 2 done | Synthesis: codex, 16s | Total: 13m45s

[roborev-ci]

roborev: Combined Review (010625c)

One medium-severity correctness issue remains; no security regressions were identified.

Medium

• Incomplete cost coverage can still report has_cost: true — internal/service/session_usage_subagents.go:139

  HasCost considers only returned usage rows, while combinedOutputTokens also includes session-level output from rowless subagents. A priced parent combined with a subagent that has stored output tokens but no usage rows can therefore report has_cost: true even though the reported cost excludes that subagent. The fallback path has the same issue when it ignores costless sessions with BreakdownCount == 0.

  Mark the aggregate incomplete whenever an included session has token data without complete cost coverage in both combination paths, and extend the existing rowless-session test to assert HasCost == false.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 11m27s

[roborev-ci]

roborev: Combined Review (b5d89cc)

The change is generally sound, but one medium-severity cost-completeness issue remains.

Medium

• internal/service/session_usage_subagents.go:140 — Cost completeness checks only uncovered output tokens. An included session with context/input token data but no usage rows has zero output, leaving outputCostCovered true and allowing has_cost: true while silently omitting that session’s spend.
  • Fix: Track usage-row coverage for every included session. Set HasCost to false when a session has token data but neither surviving nor deduplicated usage rows, and add a test for a context-only, rowless subagent.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 14m45s

[roborev-ci]

roborev: Combined Review (f18185f)

Medium-severity coverage bug found; no exploitable security regressions identified.

Medium

• internal/service/session_usage_subagents.go:104 — Sessions are marked as covered before checking alloc.Contributes. A descendant with positive stored context-token metadata but only an unrelated empty or zero-token usage row can pass sessionUsageRowsCoverTokens, resulting in has_cost: true even though its token spend is excluded from the computed cost.
  • Fix: Track coverage only for contributing surviving or deduplicated rows, return explicit contribution metadata for discarded rows, and add a regression test covering a positive-peak child with a zero-token usage row.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 15m55s

[roborev-ci]

roborev: Combined Review (8da12af)

One medium-severity issue found; no critical or high-severity findings.

Medium

• internal/service/session_usage_subagents.go:213 — Cost coverage incorrectly treats token-presence flags as evidence of nonzero usage. A subagent with explicit zero-valued usage sets both presence flags but contributes no row, causing an otherwise complete combined cost to report has_cost: false.
  • Fix: Require row coverage only when stored output or peak-context values are positive, and add a regression test for a zero-valued subagent.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 14m49s

[roborev-ci]

roborev: Combined Review (4cdfe77)

One medium-severity issue remains: cross-session snapshot deduplication can undercount tokens and cost.

Medium

• internal/db/activityreport.go:174 — Complete-snapshot selection occurs per session before cross-session deduplication. When an earlier parent transcript contains a partial snapshot and a later subagent or fork contains the complete snapshot with the same Claude message/request IDs, both survive the per-session mask, then first-seen deduplication discards the complete row. Combined, daily, and activity reports can therefore undercount tokens and cost while incorrectly marking coverage complete.

  Recommended fix: Select the greatest snapshot globally for each Claude message/request identity before cross-session deduplication, retaining the earliest session only for attribution. Apply equivalent behavior to SQLite, PostgreSQL, and DuckDB, and add a cross-session test with differing snapshot sizes.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 10m19s

[roborev-ci]

roborev: Combined Review (1bef13d)

Code review found two medium-severity correctness issues; no security vulnerabilities were identified.

Medium

• internal/db/activityreport.go:524 — Activity-report backends apply only UsageSurvivorMask, losing the survivor’s earliest-session attribution. After partial rows are removed, usage is credited to the complete child rather than the original parent, affecting per-session and automated/interactive breakdowns. PostgreSQL, DuckDB, and reporting export are also affected. Apply the attribution returned by usageSurvivorSelection before materializing survivors across all affected paths.

• internal/db/usage.go:1141 — Snapshot ROW_NUMBER() ordering omits session_id, making selection nondeterministic when snapshots have identical output, timestamps, and ordinals. Rows with different input/cache counters, models, or web-search counts can produce inconsistent totals across backends. Add session_id ASC and consistent final tie-breakers to snapshot ranking in SQLite, PostgreSQL, and DuckDB.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 11m59s

[roborev-ci]

roborev: Combined Review (ca33db1)

Changes need revision: two medium-severity usage attribution and accounting issues remain.

Medium

• internal/duckdb/analytics_usage.go:3542 — Snapshot attribution replaces only session_id, leaving metadata such as display name, project, agent, machine, and start time from the selected child/later snapshot. This can pair a parent ID with child metadata and produce incorrect daily dimensions. Reload or join metadata using snapshot_attribution_session_id, and apply equivalent attribution to SQLite/PostgreSQL metadata fields.

• internal/postgres/usage.go:882 — PostgreSQL snapshot ranking recognizes only unquoted output_tokens. Supported numeric-string JSON such as "output_tokens":"42" ranks as zero, potentially selecting an earlier partial snapshot and undercounting usage. Accept both numeric and numeric-string values, consistent with the normal token parser and other backends.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 16m20s

[roborev-ci]

roborev: Combined Review (5668b12)

Medium-severity issues remain in remote usage compatibility and scheduler retry behavior.

Medium

• cmd/agentsview/session_usage.go:162 — Remote usage assumes the daemon supports subagents, but the API version remains unchanged. Older daemons may ignore the new body/query fields, while sync failures are only warnings, causing --server to silently report own-session totals as combined totals. Advertise and validate a version or capability for subagent usage before querying, and fail clearly when unsupported.

• cmd/agentsview/embed_scheduler.go:245 — After a backstop exhausts its retries, every subsequent periodic tick is ignored until a mutation occurs. A persistent daemon with no new mutations therefore never retries the failed reconciliation. Suppress ticks only during the current retry lifecycle, then allow a later periodic tick to begin a fresh bounded attempt without retaining the old idle lease.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 18m59s

[roborev-ci]

roborev: Combined Review (9d2930e)

Review found two medium-severity accounting issues that can underreport token usage or suppress valid rollup costs.

Medium

• internal/service/session_usage_subagents.go:231 — sessionOutputTokensAfterDedup loses output-only tokens when a fuller snapshot comes from another session but is attributed to this one. For example, a parent with a 5-token partial snapshot and 100 output-only tokens, plus a 631-token complete child copy, reports 631 rather than 731. This can also leave outputCostCovered incorrectly true, presenting incomplete cost as complete.

  • Fix: Track each source session’s raw-row output separately from attributed survivors, calculate the rowless residual from the stored aggregate, and add it to the globally deduplicated survivors.

• internal/service/session_usage_rollup.go:67 — subagentContributing is inferred from the row’s attributed SessionID. If a child supplies the complete version of a partial parent snapshot, the surviving row is attributed to the parent, leaving HasCost false and suppressing rollup_cost despite billable child usage.

  • Fix: Preserve survivor source-session provenance, or return an explicit descendant-contribution indicator from GetSessionUsageRows, and use it instead of the post-attribution session ID.

---

Reviewers: 2 done | Synthesis: codex, 13s | Total: 17m14s

[roborev-ci]

roborev: Combined Review (3c6211a)

One medium-severity issue remains in subagent usage attribution.

Medium

• Incorrect subagent attribution — internal/service/session_usage_subagents.go:392
  Breakdown attribution uses row.SessionID (the accounting destination) instead of SourceSessionID (the transcript that supplied the surviving row). When a fuller snapshot originates from a subagent but is attributed to its parent, subagent_session_id is incorrectly omitted, violating the API contract. Determine SubagentSessionID using usageRowSourceSessionID(row) and update the cross-session snapshot test to expect the child ID.

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 13m36s

[roborev-ci]

roborev: Combined Review (6995c27)

The PR has one medium-severity API compatibility issue; no high or critical findings were reported.

Medium

• API version does not distinguish subagent-usage support — internal/server/server.go:50

  The preceding release already advertises API version 5, so the compatibility check may accept older servers that do not support subagent usage. Those servers can ignore the new parameters and silently return own-only totals.

  Suggested fix: Bump APIVersion and SubagentUsageAPIVersion to 6, or probe a distinct capability. Add coverage against an API-v5 predecessor.

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 11m33s