Repository navigation
Conversation
Update the bundled runtime attribution patch for SDK 1.0.32 while keeping exact-match postinstall validation. Existing model, mode, MCP, approval, and authentication tests pass unchanged. Refs hxy91819/bb#17
Vitest 4.1.5 resolves its optional peer Vite to 7.3.1, which is vulnerable to arbitrary file reads through the dev server WebSocket fetchModule path (GHSA-p9ff-h696-f583, fixed in 7.3.2). Declare a transitive override so resolution lands on a patched 7.x, and regenerate nub.lock (Vite 7.3.6, plus the peer-resolution normalization nub applies when a lock gains an override).
Amp-Thread-ID: https://ampcode.com/threads/T-01a11543-a6ef-7060-a5c6-1786e697c8b4 Co-authored-by: Amp <amp@ampcode.com>
Amp-Thread-ID: https://ampcode.com/threads/T-01a11543-a6ef-7060-a5c6-1786e697c8b4 Co-authored-by: Amp <amp@ampcode.com>
Preserve raw SDK input and mark v2 rows so Usage can distinguish SDK corrections from native hook accounting. Reviewed with autoreview: thr_84mppz3mym, thr_7a5xjnyua6. Amp-Thread-ID: https://ampcode.com/threads/T-01a11543-a6ef-7060-a5c6-1786e697c8b4 Co-authored-by: Amp <amp@ampcode.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
SDK prompt consumption is not recorded in the Cursor usage ledger, leaving downstream usage tools without reported token counts.
Evidence
The original SDK stream loop did not persist
usagemessages. Added writer and runner regressions verify reported per-turn counters, stable hashed event identities, separate cache buckets, private file creation, and non-fatal recording errors. A fixture with 49 SDK input tokens, 31 cache reads and 11 cache writes produces seven uncached input tokens.Fix
Write SDK usage messages as version-2 Cursor ledger rows, subtract cache-read/write counts from input while retaining original SDK input, and avoid adding reasoning/run totals twice. Store hashed identities rather than raw agent/run ids, model and project basename rather than full paths, and no prompts/responses. Recording failure does not fail the turn. Only future reported events are captured; missing usage is not estimated. Requires a downstream reader supporting version 2; this PR does not change that reader.
Depends on
feature/sdk-only-backend(transitivelyfix/sdk-session-resume), SDK upgrade #3 andfix/vite-ghsa-p9ff-h696-f583. Unique scope is707b9c9..feature/sdk-usage-ledger: five files, 216 insertions, no deletions. Comparing only against SDK-only removal incorrectly includes SDK/security dependency changes. This stack conflicts with session-fork in the SDK runner; neither is independent of the shared removal/upgrade prerequisites.Validation
Fresh exact-source verification of validated source, not a descendant/aggregate substitution:
Tracked worktree remained clean after validation. Used a disposable detached worktree and its own frozen-lockfile Nub install. Opt-in real-model tests, where present, remained skipped; these results do not claim live authentication, billing or real sandbox containment.
Rebase, dependencies and evidence
Merge/review prerequisites first: #13, #3, #10.
Submission alias has the same tree as the verified source branch; current upstream main remains the source baseline. Overlapping implementations and compatibility limitations are documented above. Exact-source validation is now complete. This PR is ready for maintainer review; declared prerequisites and integration conflicts still constrain merge order.
Ready for review
Exact-source check, full default test suite and build all passed. The earlier source-verification gap is closed. Declared prerequisites remain merge-order constraints, not a reason to prevent review; this does not authorize merging unrelated prerequisite features.