fix(cost): fix 3 bugs in cost tracking API

src/routes/cost.ts

@@ -135,15 +135,26 @@ export function registerCostRoutes(app: FastifyInstance, ctx: RouteContext): voi
    *   from — ISO timestamp lower bound (inclusive)
    *   to   — ISO timestamp upper bound (inclusive)
    */
+
+/** Validate from/to query params for cost endpoints. */
+function validateDateRange(from?: string, to?: string): { error: string; statusCode: number } | null {
+  if (from && isNaN(Date.parse(from))) return { error: 'Invalid "from" date format. Use ISO 8601.', statusCode: 400 };
+  if (to && isNaN(Date.parse(to))) return { error: 'Invalid "to" date format. Use ISO 8601.', statusCode: 400 };
+  if (from && to && new Date(from) > new Date(to)) return { error: '"from" must be before "to".', statusCode: 400 };
+  return null;
+}
+
   registerWithLegacy(app, 'get', '/v1/cost/summary', async (req: FastifyRequest, reply: FastifyReply) => {
     if (!requireRole(ctx.auth, req, reply, 'admin', 'operator', 'viewer')) return;
 
     const query = req.query as { from?: string; to?: string };
+    const dateError = validateDateRange(query.from, query.to);
+    if (dateError) return reply.status(dateError.statusCode).send({ code: 'INVALID_DATE_RANGE', message: dateError.error });
     const summary = metering.getUsageSummary({ from: query.from, to: query.to });
 
     const response: CostSummaryResponse = {
-      from: summary.from ?? null,
-      to: summary.to ?? null,
+      from: query.from ?? summary.from ?? null,
+      to: query.to ?? summary.to ?? null,
       totalInputTokens: summary.totalInputTokens,
       totalOutputTokens: summary.totalOutputTokens,
       totalCacheCreationTokens: summary.totalCacheCreationTokens,
@@ -168,6 +179,8 @@ export function registerCostRoutes(app: FastifyInstance, ctx: RouteContext): voi
     if (!requireRole(ctx.auth, req, reply, 'admin', 'operator', 'viewer')) return;
 
     const query = req.query as { from?: string; to?: string };
+    const dateError = validateDateRange(query.from, query.to);
+    if (dateError) return reply.status(dateError.statusCode).send({ code: 'INVALID_DATE_RANGE', message: dateError.error });
     const summary = metering.getUsageSummary({ from: query.from, to: query.to });
     const metricsCache = ctx.metricsCache;
     const analytics = metricsCache.getMetrics();

src/server.ts

@@ -967,6 +967,9 @@ async function main(): Promise<void> {
   });
   await container.start(['sessionManager', 'sessionMonitor', 'authManager', 'channelManager', 'acpLocalProfile', 'acpBackend']);
 
+  // Issue #3264: Initialize MeteringService for persistent cost tracking.
+  const metering = new MeteringService(eventBus, (sid) => sessions.getSession(sid)?.ownerKeyId, path.join(config.stateDir, 'metering.jsonl'));
+
   // Issue #488: Accumulate token usage from JSONL events into per-session metrics.
   // Issue #2536: Also count messages and tool calls from JSONL events.
   jsonlWatcher.onEntries((event) => {
@@ -975,6 +978,10 @@ async function main(): Promise<void> {
       if (tokenUsageDelta.inputTokens > 0 || tokenUsageDelta.outputTokens > 0) {
         const model = sessions.getSession(event.sessionId)?.model;
         metrics.recordTokenUsage(event.sessionId, tokenUsageDelta, model);
+        // Issue #3264: Persist token usage to MeteringService for cost API queries.
+        if (metering) {
+          metering.recordTokenUsage(event.sessionId, tokenUsageDelta, model);
+        }
       }
       // Issue #2536: Count messages and tool calls from parsed entries.
       for (const msg of event.messages) {
@@ -1050,7 +1057,7 @@ async function main(): Promise<void> {
     validateWorkDir: validateWorkDirWithConfig,
     serverState,
     quotas: new QuotaManager(),
-    metering: new MeteringService(eventBus, (sid) => sessions.getSession(sid)?.ownerKeyId, path.join(config.stateDir, 'metering.jsonl')),
+    metering,
     metricsCache,
     dashboardOidc,
     dashboardTokenSessions,