feat: cross-machine usage aggregation + automatic sync by Yeachan-Heo · Pull Request #55 · junhoyeo/tokscale

Yeachan-Heo · 2025-12-27T07:30:07Z

Summary

Cross-machine aggregation: Usage from multiple devices is now properly SUMMED instead of overwritten
Automatic sync: New tokscale sync commands for hourly crontab automation
Closes Cross-machine usage not properly aggregated #52

Problem Solved

Before: Machine A=1000 tokens, Machine B=500 tokens → Result: 500 (Machine A data LOST)
After: Machine A=1000 tokens, Machine B=500 tokens → Result: 1500 (properly aggregated)

New Commands

tokscale sync setup    # Set up hourly cron job
tokscale sync status   # Check if sync is active
tokscale sync remove   # Remove the cron job

Changes

Track per-device contributions in devices field
Added --quiet flag to tokscale submit for cron compatibility
Sync logs to ~/.config/tokscale/sync.log
Legacy data migrated to devices.__legacy__

Testing

28 tests covering: cross-device aggregation, same-device replacement, legacy migration, multi-model scenarios

…e aggregation - Add DeviceSourceData interface for per-device contribution tracking - Add devices field to SourceBreakdownData type in helpers.ts and schema.ts - Modify mergeSourceBreakdowns() to accept deviceId parameter - Add recalculateSourceAggregate() helper to sum across devices - Migrate existing data without devices field to __legacy__ device - Update submit route to pass tokenRecord.tokenId as deviceId - Add tests for same-device replacement, cross-device aggregation, and legacy migration

- Add sync.ts with setupSync(), removeSync(), syncStatus() functions - Support crontab (macOS/Linux) and Task Scheduler (Windows) - Use process.argv[1] for CLI path resolution - Crontab entry uses --quiet flag for silent execution - Log output to ~/.config/tokscale/sync.log

…ron cleanup - Store devices[deviceId] on new day inserts to prevent double-counting when same device resubmits (was migrating to __legacy__ and adding) - Fix shell injection risk in crontab setup using printf with escaped quotes - Fix Windows Task Scheduler logging by wrapping in cmd.exe for redirections - Use specific grep pattern 'tokscale submit --quiet' to avoid removing unrelated cron jobs - Add tests for insert→resubmit flow to verify no double-counting

… direct tests - Add ?? {} defensive defaults for models access in mergeSourceBreakdowns() - Use TOKSCALE_SYNC_MANAGED marker for cron entries (prevents false matches) - Windows sync now uses .cmd script file approach (simpler, no quoting issues) - Add direct mergeSourceBreakdowns() function call tests for legacy data handling

…e, Windows cmd wrapper

…ration

…pe coercion - Legacy migration now uses '__legacy__' device instead of current deviceId - This preserves historical data separately from new device contributions - Added Number(...) || 0 for all arithmetic in recalculateSourceAggregate - Handles potential string values from JSON serialization - Updated tests to expect __legacy__ entry for legacy data migrations

- Reset aggregates before empty devices check to prevent stale values - Use Number() coercion in recalculateDayTotals for consistency

Convert all || 0 patterns to Number(...) || 0 to handle cases where values may be strings from JSON parsing or database retrieval.

vercel · 2025-12-27T07:30:12Z

@Yeachan-Heo is attempting to deploy a commit to the Inevitable Team on Vercel.

A member of the Team first needs to authorize it.

vercel · 2025-12-27T19:53:27Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
tokscale	Ready	Preview, Comment	Jan 6, 2026 10:31pm

junhoyeo · 2025-12-28T07:47:30Z

Hey @Yeachan-Heo, thanks for opening a PR tackling two tasks. Appreciate the contribution despite the complexity! 🙌
I'll review and merge once everything looks good.

One heads-up: the commits and PR body had the "Co-authored-by: Junho Yeo <...>" footer attached for some reason, so I removed those and force-pushed. Just wanted to let you know!

- Windows sync: Mark as experimental/disabled pending security review - bunx detection: Prevent sync setup from temp cache paths with clear error message - Crontab security: Add path validation to prevent injection via control chars - Legacy migration: Fix modelId→models conversion to preserve model breakdown Closes issues identified in PR junhoyeo#55 review.

junhoyeo · 2025-12-28T10:25:30Z

🔧 Additional Fixes Applied

Addressed the security and stability issues identified in the review. Here's what was fixed:

1. Windows Sync → Experimental (Disabled)

Windows Task Scheduler support is now marked as experimental and disabled by default
Shows clear warning message directing users to track progress
setupSync, syncStatus, and removeSync all handle Windows gracefully

2. bunx Temp Path Detection

Added isBunxTempPath() to detect temporary cache paths like:
- /tmp/bunx-501-tokscale/node_modules/.bin/tokscale
- ~/.bun/install/cache/@tokscale/cli@x.x.x/...
- /var/folders/.../T/bunx-... (macOS)
Shows clear error with install instructions when users try bunx tokscale sync setup

3. Crontab Security

Added validatePathSafety() to prevent crontab injection via:
- Newlines (\n, \r)
- Null bytes (\0)
- % characters (cron converts to newlines!)
- All control characters (ASCII 0-31, DEL 0x7F)
Validation runs before building cron entry

4. Legacy `modelId` → `models` Migration Bug (Critical)

Fixed the bug that was creating empty models: {} during legacy migration
Now properly handles:
- Legacy data with modelId only → creates correct model breakdown
- Legacy data with empty models: {} and modelId → falls back to modelId
- Legacy data with populated models → uses existing models
Added unit tests for all migration scenarios

Files Changed

File	Changes
`packages/cli/src/sync.ts`	+148 lines (bunx detection, path validation, Windows experimental)
`packages/frontend/src/lib/db/helpers.ts`	+23 lines (modelId migration fix)
`packages/frontend/__tests__/api/submit.test.ts`	+53 lines (migration tests)

Commit

5f932fc fix: address security and stability issues in cross-machine sync

All changes are surgical and independently verifiable. Ready for re-review! 🚀

junhoyeo · 2025-12-28T23:51:31Z

@Yeachan-Heo fyi, I will hold this pr from merging before #64 -- there will be significant changes there!

junhoyeo · 2026-01-06T22:24:40Z

Legacy data with modelId only → creates correct model breakdown

As of today, no users have the deprecated modeld field!

Resolved conflicts: - README.md: Keep main's structure (Overview before Contents), add Automatic Sync to TOC - cli.ts: Combine knownCommands to include both 'sync' and 'pricing' - submit.ts: Keep quiet flag feature with main's simplified structure

The submit command already has minimal necessary logs, and output is redirected to log file for cron jobs anyway. --no-spinner exists for scripts that need clean stdout.

junhoyeo · 2026-01-24T10:58:31Z

@cubic-dev-ai review this pull request

cubic-dev-ai · 2026-01-24T10:58:36Z

@cubic-dev-ai review this pull request

@junhoyeo I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

2 issues found across 7 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/cli/src/sync.ts">

<violation number="1" location="packages/cli/src/sync.ts:26">
P2: Variable `path` shadows the imported `path` module from `node:path`. This creates confusion and potential runtime errors if the function is later modified to use `path.join()` or similar methods. Rename to `cliPath` or `execPath`.</violation>
</file>

<file name="packages/cli/src/cli.ts">

<violation number="1" location="packages/cli/src/cli.ts:461">
P2: The new `--interval` flag is accepted but ignored: `setupSync` does not use the interval and the cron entry is hard-coded to hourly. Either implement interval handling or remove the flag to avoid misleading users.</violation>
</file>

Since this is your first cubic review, here's how it works:

cubic automatically reviews your code and comments on bugs and improvements
Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/cli/src/sync.ts

packages/cli/src/cli.ts

BackGwa · 2026-02-16T17:33:12Z

It looks like there haven’t been updates on this PR lately. Is it still active?
I’d love to help move this forward if I can.

Port device-level tracking from PR junhoyeo#55 into the client-based structure. Each client now tracks per-device contributions (keyed by API token ID) to prevent double-counting when the same user submits from multiple machines. On resubmit, only the device's data is replaced while other devices' data is preserved. Legacy data without device tracking is gracefully migrated to a __legacy__ device key. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Yeachan-Heo added 11 commits December 26, 2025 10:04

feat(cli): add --quiet flag to submit for cron compatibility

2f86c2d

docs: add automatic sync and cross-machine aggregation documentation

5646e1b

fix: address Oracle review round 3 - legacy inherits to current devic…

3ccf761

…e, Windows cmd wrapper

fix: preserve other devices contributions in merge, proper legacy mig…

9f7ca83

…ration

fix: handle empty devices aggregation, complete type coercion

6b177e9

- Reset aggregates before empty devices check to prevent stale values - Use Number() coercion in recalculateDayTotals for consistency

fix: complete type coercion in route.ts aggregation

6591b0e

Convert all || 0 patterns to Number(...) || 0 to handle cases where values may be strings from JSON parsing or database retrieval.

vercel bot deployed to Preview December 27, 2025 19:54 View deployment

junhoyeo force-pushed the feat/cross-machine-aggregation-sync branch from f906e18 to 6591b0e Compare December 28, 2025 07:17

junhoyeo self-requested a review December 28, 2025 07:22

junhoyeo self-assigned this Dec 28, 2025

vercel bot deployed to Preview December 28, 2025 10:32 View deployment

junhoyeo mentioned this pull request Dec 28, 2025

Document config file in readme #61

Closed

vercel bot deployed to Preview January 6, 2026 22:31 View deployment

refactor: remove --quiet flag from submit command

46e2e43

The submit command already has minimal necessary logs, and output is redirected to log file for cron jobs anyway. --no-spinner exists for scripts that need clean stdout.

cubic-dev-ai bot reviewed Jan 24, 2026

View reviewed changes

packages/cli/src/sync.ts Show resolved Hide resolved

packages/cli/src/cli.ts Show resolved Hide resolved

Yeachan-Heo mentioned this pull request Feb 28, 2026

feat: cross-machine usage aggregation with device-level dedup #252

Open

5 tasks

junhoyeo force-pushed the main branch from 63e6d84 to bef1da8 Compare March 25, 2026 22:13

Fullstop000 mentioned this pull request Mar 31, 2026

Feature Request: Multi-device stats aggregation for the same account #378

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: cross-machine usage aggregation + automatic sync#55

feat: cross-machine usage aggregation + automatic sync#55
Yeachan-Heo wants to merge 14 commits intojunhoyeo:mainfrom
Yeachan-Heo:feat/cross-machine-aggregation-sync

Yeachan-Heo commented Dec 27, 2025 •

edited by junhoyeo

Loading

Uh oh!

vercel bot commented Dec 27, 2025

Uh oh!

vercel bot commented Dec 27, 2025 •

edited

Loading

Uh oh!

junhoyeo commented Dec 28, 2025

Uh oh!

junhoyeo commented Dec 28, 2025

Uh oh!

junhoyeo commented Dec 28, 2025

Uh oh!

junhoyeo commented Jan 6, 2026

Uh oh!

junhoyeo commented Jan 24, 2026

Uh oh!

cubic-dev-ai bot commented Jan 24, 2026

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

Uh oh!

BackGwa commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Yeachan-Heo commented Dec 27, 2025 • edited by junhoyeo Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Problem Solved

New Commands

Changes

Testing

Uh oh!

vercel bot commented Dec 27, 2025

Uh oh!

vercel bot commented Dec 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

junhoyeo commented Dec 28, 2025

Uh oh!

junhoyeo commented Dec 28, 2025

🔧 Additional Fixes Applied

1. Windows Sync → Experimental (Disabled)

2. bunx Temp Path Detection

3. Crontab Security

4. Legacy modelId → models Migration Bug (Critical)

Files Changed

Commit

Uh oh!

junhoyeo commented Dec 28, 2025

Uh oh!

junhoyeo commented Jan 6, 2026

Uh oh!

junhoyeo commented Jan 24, 2026

Uh oh!

cubic-dev-ai bot commented Jan 24, 2026

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

BackGwa commented Feb 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Yeachan-Heo commented Dec 27, 2025 •

edited by junhoyeo

Loading

vercel bot commented Dec 27, 2025 •

edited

Loading

4. Legacy `modelId` → `models` Migration Bug (Critical)