[Danielweng0902]

Reimplements #4574 in the shape from its close comment: one shared, fingerprint-gated OpenCodeLocalHistoryStore replaces the separate full-load reader.

The three close-comment concerns, addressed

Concern	v2
Separate reader loads all matching history before windowing	The store retains compact per-turn entries and windows them into day rows at read time — nothing pre-windowed is held
Cached Codex publication runs the scan again	Decoded entries persist in the store's own SQLite database (opencode-local-history-v1.sqlite, never cost-usage.sqlite); cached publications call cachedDailyReport which reads that durable cache without touching the OpenCode database at all
Two histories sharing Go's 4 MiB cache evict each other	The store never touches the OpenCode Go reader's in-memory CacheBox — it has its own durable cache, mirroring the OpenCodex usage store's layout

Scans re-read the OpenCode database only when its size/mtime/WAL fingerprint changed, so unchanged databases cost one stat per scan.

What carries over from #4574

The #3273 contract is unchanged: opt-in default-off, OpenAI-provider assistant records only (exact providerID == "openai"), stable-ID v1/v2 deduplication, recorded cost surfaced as-is, sourceRecorded/mixed provenance with the labelled list-price hints, and permanent exclusion from scoped CODEX_HOME scans, managed accounts, and the Spend Dashboard. The lane activation, ambient scope selection, and account-switch survival behavior also carry over.

Tests

• OpenCodeLocalHistoryStoreTests (20): provider selection, step-finish precedence, v1/v2 dedup, conservative day totals, windowing calendars, XDG/OPENCODE_DB contract, and the new fingerprint gating / cache-only publication / cache removal behaviors
• OpenCodeLocalHistoryMergeTests: foreground merge, seeded cached publication, ambient-only gating, provenance windows
• OpenCodeLocalHistorySettingsTests: lane activation, ambient scope over managed homes, publication survival across account switches

Gatekeeper passes (two suppression anchors follow the renamed lane helper). Local run: 39/39 in the feature suites; the two parallel-load-flaky dashboard timing tests fail identically on the base commit and pass in isolation.

Closes nothing — #3273 stays the tracker. Happy to adjust the store's cache location or fingerprint semantics if the tightened budgets want something different.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-22T08:53:20.448543Z	4e8145e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs real behavior proof before merge.

What this changes

Adds a default-off setting that merges OpenAI-provider OpenCode history into ambient Codex history using a new persistent cache.

Example: OpenCode records 150 tokens and $0 for an OpenAI assistant turn today.

• Before: Ambient Codex history excludes the turn.
• After: With the setting enabled, the app includes 150 tokens under an OpenCode-labelled model and preserves the recorded $0.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The feature has explicit owner support, but current implementation evidence does not establish the replacement store's shipped behavior, and account isolation plus core storage and integration defects block merging.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is necessary before merge. See Before merge.
Patch quality	🧂 unranked krab (1/6)	10 actionable review findings remain.

Product

Kind: Feature · Worth it: Yes · Fix scope: Partial
User problem: People using OpenCode with OpenAI cannot see those locally recorded tokens alongside ambient Codex history.
Reason: The maintainer explicitly welcomed this bounded, default-off feature in the linked predecessor's closing comment; the present patch does not yet deliver its intended CLI and publication coverage.

Merge readiness

⛔ Blocked before merge - 13 items remain

Keep this PR open for revision: the maintainer welcomed this feature, but the implementation still lacks bounded ingestion and introduces an unrelated Claude account-isolation regression.

Priority: P2
Reviewed head: 4e8145e779b1259a6c3073402ff1c5f924a465db

Before merge

• Add real behavior proof - The replacement store is covered by in-process fixtures, while the linked terminal and upgrade traces exercise the earlier implementation in Add opt-in OpenCode local history for the ambient Codex ledger #4574; provide current-head screenshots, logs, or terminal output showing opt-in ingestion, cache-only restart and catch-up, and scoped exclusion, with private paths, keys, and endpoints redacted, plus a v0.79.0 upgrade retaining settings and history. After adding proof, update the PR body, then request a new review with @clawsweeper re-review. The PR author or someone with repository write access can request it.
• Preserve the prepared Claude account scanner options (P1) - For a Claude token account mapped to a custom config directory, lines 268–275 prepare account-specific projects roots, but this call replaces those options with a fresh lookup. A readable mapped directory therefore passes validation while the scan reads ambient/default history and publishes it under the selected account. This also happens with OpenCode disabled. Pass options as before and retain the account-directory isolation regression coverage.
• Bound ingestion and cached reads instead of loading the whole history (P2) - A growing OpenCode database is fully scanned into [Entry], encoded as one JSON/base64 SQLite row, and fully decoded again on every cached publication before filtering dates. Any source change repeats the complete scan and rewrite, including years outside a one-day request; there is no row, byte, time, or cancellation budget. This retains the central memory/I/O failure identified in the maintainer's closure of Add opt-in OpenCode local history for the ambient Codex ledger #4574. Use the existing incremental store ownership with bounded ingestion and windowed cache queries.
• Carry the OpenCode setting through background catch-up (P2) - After a foreground refresh includes OpenCode rows, publishAvailableCodexCostCatchUpSnapshot calls the cached loader without the new argument, so its default is false. Completing native Codex catch-up then publishes a native-only snapshot under the still-enabled ambient scope, making OpenCode totals disappear. Capture the source choice in the catch-up context and pass it to this production caller.
• Connect the opt-in source to the cost CLI (P2) - codexbar cost --provider codex never reads or passes the new source choice, and the new fetcher argument defaults to false. Enabling the setting therefore changes app totals while text and JSON CLI output still omit every OpenCode turn, contrary to the carried-over menu/CLI contract. Wire the existing opt-in into the CLI load and preserve the ambient/scoped and session-grouping boundaries.
• Pass snapshot provenance to charts and inline disclosures (P2) - The sole production chart construction in StatusItemController+HostedSubmenus.swift omits this argument, so recorded-only OpenCode history still renders Est. total and the ordinary token-price disclaimer. Both InlineUsageDashboardContent.swift hint calls likewise omit provenance. Pass the snapshot's provenance at these consumers so recorded $0 and mixed costs are described accurately.
• Validate cached history against the selected source path (P2) - The cache filename is shared across OPENCODE_DB and XDG selections, but cached publication ignores the persisted fingerprint's path. After database A populates the cache, selecting database B and hydrating before its first scan publishes A's records as B's ambient history. Compare the stored source identity with the selected path without opening or statting the source, or namespace the cache by source identity.
• Persist only fingerprints that bracket the decoded snapshot (P2) - The source fingerprint is captured only after decoding and JSON encoding. If OpenCode commits a new turn after the SELECT snapshot finishes but before this stat, old entries are saved with the new database fingerprint. Subsequent unchanged scans then accept that cache and omit the committed turn indefinitely until another write. Capture the fingerprint before the read, recheck it afterward, and avoid marking an unstable read current.
• Deduplicate v2 turns only against usable legacy usage (P2) - A legacy message row with a missing, malformed, or negative cost suppresses a valid session_message turn with the same ID even though the legacy path contributes nothing. For example, legacy cost -3 plus v2 cost 3 yields no request instead of the valid $3 request. Reuse the usable-legacy projection approach already present on main in the OpenCode Go reader and documented by Fix OpenCode Go v2 local history gaps #4587.
• Check the actual SQLite WAL sidecar filenames (P2) - appendingPathExtension checks opencode.db.wal and opencode.db.shm, while SQLite uses opencode.db-wal and opencode.db-shm. If normal opening returns CANTOPEN because an existing WAL/shared-memory file cannot be opened, this predicate incorrectly permits immutable mode, which ignores committed WAL frames and can cache incomplete history. Use the actual suffixes and keep immutable fallback restricted to genuinely absent sidecars.
• Recover from a damaged disposable history cache (P2) - A truncated or invalid cache database makes readCachedEntries() throw before the healthy OpenCode source is read. The caller swallows that error and silently omits OpenCode history on every subsequent refresh. The existing Clear cost cache action removes CodexBar/cost-usage, while this cache defaults to the sibling CodexBar/opencode-local-history, so that recovery action cannot repair it. Treat disposable-cache read failures as a rebuildable miss and include this cache in the existing clear action.
• Add data-model compatibility proof - The review found that existing stored data may not work after upgrade. Show that existing data still loads and works with this change.
• Explain or restore the original intent of Claude account-directory scanner options - 8b93139: Restrict a mapped Claude account's local estimate to its selected config directory and prevent ambient history from crossing account selections.

Findings

• [P1] Preserve the prepared Claude account scanner options — Sources/CodexBarCore/CostUsageFetcher.swift:294
• [P2] Bound ingestion and cached reads instead of loading the whole history — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:251-253
• [P2] Carry the OpenCode setting through background catch-up — Sources/CodexBar/UsageStore+CodexCostCatchUp.swift:252-259

Provenance

• Claude account-directory scanner options changes intended behavior without addressing why it exists (8b93139: Restrict a mapped Claude account's local estimate to its selected config directory and prevent ambient history from crossing account selections.)

Tests

• Low-value test Tests/CodexBarTests/OpenCodeLocalHistoryStoreTests.swift: Remove the helper-only selection follows the upstream single database contract test and retain public-store scenarios that demonstrate actual database selection; several assertions merely pin ignored channel inputs.
• Missing end-to-end proof: Provide current-head app or CLI evidence for opt-in ingestion, cache-only restart and catch-up, source exclusion, and an upgrade from v0.79.0; base-fail/head-pass regression execution is not demonstrated for the findings.

Agent review details

How this fits together

The local cost pipeline reads provider history, caches decoded usage, and publishes daily totals to app menus, charts, and CLI consumers; account-owned dashboard scans must exclude ambient OpenCode records.

flowchart LR
  A[OpenCode SQLite history] --> B[OpenCode history store]
  B --> C[Persistent decoded cache]
  C --> D[Codex cost fetcher]
  E[Native Codex history] --> D
  D --> F[Ambient menus and charts]
  D --> G[CLI consumers]

Loading

Technical review

Best possible solution:

Integrate bounded, source-scoped incremental ingestion with the existing cost-store owners and every intended history consumer while preserving account isolation.

Do we have a high-confidence way to reproduce the issue?

Source inspection establishes the caller omissions, discarded Claude options, and cache defects; no target code was executed under the read-only review constraint.

Is this the best way to solve the issue?

The ambient-only boundary follows the maintainer's direction, but wrapping a complete decoded history array in SQLite does not satisfy the requested bounded incremental design.

Full review comments:

• [P1] Preserve the prepared Claude account scanner options — Sources/CodexBarCore/CostUsageFetcher.swift:294
  For a Claude token account mapped to a custom config directory, lines 268–275 prepare account-specific projects roots, but this call replaces those options with a fresh lookup. A readable mapped directory therefore passes validation while the scan reads ambient/default history and publishes it under the selected account. This also happens with OpenCode disabled. Pass options as before and retain the account-directory isolation regression coverage.
  Confidence: 1
• [P2] Bound ingestion and cached reads instead of loading the whole history — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:251-253
  A growing OpenCode database is fully scanned into [Entry], encoded as one JSON/base64 SQLite row, and fully decoded again on every cached publication before filtering dates. Any source change repeats the complete scan and rewrite, including years outside a one-day request; there is no row, byte, time, or cancellation budget. This retains the central memory/I/O failure identified in the maintainer's closure of Add opt-in OpenCode local history for the ambient Codex ledger #4574. Use the existing incremental store ownership with bounded ingestion and windowed cache queries.
  Confidence: 1
• [P2] Carry the OpenCode setting through background catch-up — Sources/CodexBar/UsageStore+CodexCostCatchUp.swift:252-259
  After a foreground refresh includes OpenCode rows, publishAvailableCodexCostCatchUpSnapshot calls the cached loader without the new argument, so its default is false. Completing native Codex catch-up then publishes a native-only snapshot under the still-enabled ambient scope, making OpenCode totals disappear. Capture the source choice in the catch-up context and pass it to this production caller.
  Confidence: 1
• [P2] Connect the opt-in source to the cost CLI — Sources/CodexBarCLI/CLICostCommand.swift:112-127
codexbar cost --provider codex never reads or passes the new source choice, and the new fetcher argument defaults to false. Enabling the setting therefore changes app totals while text and JSON CLI output still omit every OpenCode turn, contrary to the carried-over menu/CLI contract. Wire the existing opt-in into the CLI load and preserve the ambient/scoped and session-grouping boundaries.
  Confidence: 1
• [P2] Pass snapshot provenance to charts and inline disclosures — Sources/CodexBar/CostHistoryChartMenuView.swift:100-104
  The sole production chart construction in StatusItemController+HostedSubmenus.swift omits this argument, so recorded-only OpenCode history still renders Est. total and the ordinary token-price disclaimer. Both InlineUsageDashboardContent.swift hint calls likewise omit provenance. Pass the snapshot's provenance at these consumers so recorded $0 and mixed costs are described accurately.
  Confidence: 1
• [P2] Validate cached history against the selected source path — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:98-100
  The cache filename is shared across OPENCODE_DB and XDG selections, but cached publication ignores the persisted fingerprint's path. After database A populates the cache, selecting database B and hydrating before its first scan publishes A's records as B's ambient history. Compare the stored source identity with the selected path without opening or statting the source, or namespace the cache by source identity.
  Confidence: 0.99
• [P2] Persist only fingerprints that bracket the decoded snapshot — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:264-266
  The source fingerprint is captured only after decoding and JSON encoding. If OpenCode commits a new turn after the SELECT snapshot finishes but before this stat, old entries are saved with the new database fingerprint. Subsequent unchanged scans then accept that cache and omit the committed turn indefinitely until another write. Capture the fingerprint before the read, recheck it afterward, and avoid marking an unstable read current.
  Confidence: 0.99
• [P2] Deduplicate v2 turns only against usable legacy usage — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:599-601
  A legacy message row with a missing, malformed, or negative cost suppresses a valid session_message turn with the same ID even though the legacy path contributes nothing. For example, legacy cost -3 plus v2 cost 3 yields no request instead of the valid $3 request. Reuse the usable-legacy projection approach already present on main in the OpenCode Go reader and documented by Fix OpenCode Go v2 local history gaps #4587.
  Confidence: 1
• [P2] Check the actual SQLite WAL sidecar filenames — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:441-444
appendingPathExtension checks opencode.db.wal and opencode.db.shm, while SQLite uses opencode.db-wal and opencode.db-shm. If normal opening returns CANTOPEN because an existing WAL/shared-memory file cannot be opened, this predicate incorrectly permits immutable mode, which ignores committed WAL frames and can cache incomplete history. Use the actual suffixes and keep immutable fallback restricted to genuinely absent sidecars.
  Confidence: 0.98
• [P2] Recover from a damaged disposable history cache — Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:81-82
  A truncated or invalid cache database makes readCachedEntries() throw before the healthy OpenCode source is read. The caller swallows that error and silently omits OpenCode history on every subsequent refresh. The existing Clear cost cache action removes CodexBar/cost-usage, while this cache defaults to the sibling CodexBar/opencode-local-history, so that recovery action cannot repair it. Treat disposable-cache read failures as a rebuildable miss and include this cache in the existing clear action.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8de11fffdf1a.

Provenance checked

• Cost provenance and estimate disclosure keeps the original intent (Integrate spend reporting series (#3015–#3019) #3026: Keep source provenance and reporting-window semantics explicit; source-recorded amounts require distinct disclosure.)
• Ambient cross-client accounting keeps the original intent (81c8a1c: Allow supported cross-client history in ambient views while keeping account-scoped and dashboard history separate.)
• Local-history presentation keeps the original intent (Add local session cost ledger #2172: Expose machine-local history independently of managed-account quota and authentication.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Introduced changes verified: Reviewed the pinned merge-base-to-head changes, distinguishing them from subsequent main changes; the checkout remained clean. (4e8145e779b1)
• Existing owner direction: The maintainer welcomed a shared incremental history path with bounded memory, cache-only publication, and one default-off setting in Add opt-in OpenCode local history for the ambient Codex ledger #4574 (comment).
• Full PR discussion inspected: The current body and comments supply feature-test results but no execution trace of the replacement store; the captured body identity is 500a99fd81cefb7d35c13a81f2b067c5987457d9b69dd9d53c2ce65a3c4e1827. (4e8145e779b1)
• Complete history still materialized: The source query accumulates every matching turn, persistence encodes the entire array into one payload, and cached publication decodes the entire payload before windowing. (Sources/CodexBarCore/Providers/OpenCode/OpenCodeLocalHistoryStore.swift:252, 4e8145e779b1)
• Claude directory isolation removed: The introduced hunk replaces the prepared scanner options with a fresh options lookup, discarding the mapped Claude account's projects root. (Sources/CodexBarCore/CostUsageFetcher.swift:294, 4e8145e779b1)
• Original account-root contract: feat(claude): map token accounts to a Claude config directory #4556 explicitly requires mapped Claude account estimates to use only the selected config directory's history. (Sources/CodexBarCore/CostUsageFetcher.swift:288, 8b931397a110)

Likely related people:

• Peter Steinberger: Raw commit 8b93139 adds Sources/CodexBarCore/CostUsageFetcher.swift:266 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 8b931397a110; files: Sources/CodexBarCore/CostUsageFetcher.swift)

Root-cause cluster

Relationship: same_root_cause
Canonical: #3273
Summary: This PR attempts the approved ambient-history portion of the original OpenCode request and replaces the earlier closed implementation.

Members:

• canonical: Feature request: include OpenCode sessions in Codex usage tracking #3273 - Original request for OpenCode-originated OpenAI/Codex history, with the attribution discussion.
• superseded: Add opt-in OpenCode local history for the ambient Codex ledger #4574 - Earlier implementation explicitly replaced by this PR after the maintainer requested bounded incremental storage.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• add P2: This is an optional history feature with useful owner direction and substantial implementation work; no currently shipped emergency is established.
• add merge-risk: 🚨 compatibility: The patch discards existing Claude account-directory selection when loading local costs, including when OpenCode remains disabled.
• add merge-risk: 🚨 availability: Every changed OpenCode database causes unbounded full-history decoding and serialization on the shared scan path, without cancellation checks inside that work.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Label justifications:

• P2: This is an optional history feature with useful owner direction and substantial implementation work; no currently shipped emergency is established.
• merge-risk: 🚨 compatibility: The patch discards existing Claude account-directory selection when loading local costs, including when OpenCode remains disabled.
• merge-risk: 🚨 availability: Every changed OpenCode database causes unbounded full-history decoding and serialization on the shared scan path, without cancellation checks inside that work.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 22, 2026, 5:12 AM ET / 09:12 UTC.

[steipete]

Thanks @Danielweng0902 for coming back to this, and the off-by-default setting and account isolation are exactly right. I'm closing this version, though, because the core storage issue from #4574 is still there: the new store keeps all of history in one cached blob and decodes the whole thing on cached publication, and a changed source re-reads and rewrites everything. In a synthetic history with 100k records and one requested day, the store alone peaked around 129 MB on a cached refresh.

The shape that fits is an adapter onto the existing incremental history store, so cached publication only touches windowed data and work stays bounded as history grows. If you want to try that, it would be very welcome.

[Danielweng0902]

Thanks for the clear close note — the incremental shape is up in #4744. The store now keeps per-table [low, high] rowid windows (the SQLite analogue of the usage store's byte cursors), so cached publication is a windowed indexed query and a changed source reads only the rows the window is missing: on the same 100k-record synthetic database, a one-row append ingests one row, and the store's marginal peak RSS on a cached refresh is within noise of the native-only baseline (the 129 MB store-alone peak is gone). Happy to keep iterating there.