fix(stats): resolve blockers B1/B2/B3 and highs H1/H3

Author: k1yt

packages/types/src/__tests__/usage-stats.spec.ts

@@ -117,7 +117,7 @@ describe("usage-stats schemas", () => {
 		})
 
 		it("should reject missing semantics", () => {
-			const { semantics, ...withoutSemantics } = validEvent
+			const { semantics: _semantics, ...withoutSemantics } = validEvent
 			expect(() => UsageEventV1.parse(withoutSemantics)).toThrow()
 		})
 
@@ -126,7 +126,7 @@ describe("usage-stats schemas", () => {
 		})
 
 		it("should reject missing required fields (eventId)", () => {
-			const { eventId, ...withoutEventId } = validEvent
+			const { eventId: _eventId, ...withoutEventId } = validEvent
 			expect(() => UsageEventV1.parse(withoutEventId)).toThrow()
 		})
 
@@ -242,7 +242,7 @@ describe("usage-stats schemas", () => {
 		})
 
 		it("should reject missing required numeric field", () => {
-			const { costUsd, ...withoutCost } = validBucket
+			const { costUsd: _costUsd, ...withoutCost } = validBucket
 			expect(() => StatsBucket.parse(withoutCost)).toThrow()
 		})
 
@@ -311,12 +311,12 @@ describe("usage-stats schemas", () => {
 		})
 
 		it("should reject missing coverage", () => {
-			const { coverage, ...withoutCoverage } = validSnapshot
+			const { coverage: _coverage, ...withoutCoverage } = validSnapshot
 			expect(() => StatsSnapshot.parse(withoutCoverage)).toThrow()
 		})
 
 		it("should reject missing totals", () => {
-			const { totals, ...withoutTotals } = validSnapshot
+			const { totals: _totals, ...withoutTotals } = validSnapshot
 			expect(() => StatsSnapshot.parse(withoutTotals)).toThrow()
 		})
 	})

packages/types/src/vscode-extension-host.ts

@@ -108,6 +108,7 @@ export interface ExtensionMessage {
 		| "getUsageStatsResponse"
 		| "clearUsageStatsResponse"
 		| "exportUsageStatsResponse"
+		| "requestClearNonceResponse"
 		| "usageStatsChanged"
 	text?: string
 	/** For fileContent: { path, content, error? } */
@@ -258,6 +259,9 @@ export interface ExtensionMessage {
 	usageStatsSnapshot?: StatsSnapshot
 	clearUsageStatsResult?: { success: boolean; error?: string }
 	exportUsageStatsResult?: { format: "json" | "csv"; data: string; error?: string }
+	// B2 fix: host-issued clear nonce returned in `requestClearNonceResponse`.
+	// null when the service is unavailable or an error occurred (see `error`).
+	clearNonce?: string | null
 }
 
 export interface OpenAiCodexRateLimitsMessage {
@@ -634,6 +638,7 @@ export interface WebviewMessage {
 		| "getUsageStats"
 		| "clearUsageStats"
 		| "exportUsageStats"
+		| "requestClearNonce"
 	text?: string
 	taskId?: string
 	editedMessageContent?: string
@@ -748,6 +753,11 @@ export interface WebviewMessage {
 	usageStatsQuery?: StatsQuery
 	clearUsageStatsNonce?: string
 	exportUsageStatsFormat?: "json" | "csv"
+	// B2 fix: host-issued clear nonce returned to webview in response to
+	// `requestClearNonce`. The webview must use this nonce (not a self-generated
+	// one) when sending the subsequent `clearUsageStats` message, so the host's
+	// nonce validation actually passes.
+	clearNonce?: string
 }
 
 export interface RequestOpenAiCodexRateLimitsMessage {

src/core/task/Task.ts

@@ -3140,7 +3140,11 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 							// API attempts. We record the final usage event here.
 							// (Architecture report section 5.5-5.8: terminal finalize only, no chunk-level append)
 							if (this.usageRecorder) {
-								const requestKey = `${this.taskId}:${currentItem.retryAttempt ?? 0}`
+								// B1 fix: include apiReqIndex so each tool-use turn produces a unique
+								// requestKey. Previously requestKey = taskId:retryAttempt, which was
+								// identical for every turn of a task (retryAttempt resets to 0 per turn),
+								// causing the idempotency dedupe to drop all but the first turn's usage.
+								const requestKey = `${this.taskId}:${apiReqIndex}:${currentItem.retryAttempt ?? 0}`
 								const ctx: UsageRecordingContext = {
 									taskId: this.taskId,
 									parentTaskId: this.parentTaskId,
@@ -3284,7 +3288,9 @@ export class Task extends EventEmitter<TaskEvents> implements TaskLike {
 						// user cancellations. Record the partial usage with the appropriate status.
 						// (Architecture report section 5.5-5.8: terminal finalize only)
 						if (this.usageRecorder) {
-							const requestKey = `${this.taskId}:${currentItem.retryAttempt ?? 0}`
+							// B1 fix: include apiReqIndex so each tool-use turn produces a unique
+							// requestKey (see completed-path comment above).
+							const requestKey = `${this.taskId}:${lastApiReqIndex}:${currentItem.retryAttempt ?? 0}`
 							const failedStatus: "failed" | "cancelled" = this.abort ? "cancelled" : "failed"
 							const ctx: UsageRecordingContext = {
 								taskId: this.taskId,

src/core/webview/__tests__/usageStatsMessageHandler.spec.ts

@@ -538,22 +538,41 @@ describe("usageStatsMessageHandler", () => {
 	// ── handleRequestClearNonce ──────────────────────────────────────────────
 
 	describe("handleRequestClearNonce", () => {
-		it("returns nonce from service", async () => {
+		it("posts requestClearNonceResponse with nonce from service", async () => {
 			const issueClearNonce = vi.fn(() => "test-nonce-abc")
 			const provider = createMockProvider({ issueClearNonce })
 
-			const result = await handleRequestClearNonce(provider)
+			const message: WebviewMessage = {
+				type: "requestClearNonce",
+				requestId: "req-nonce-1",
+			}
+
+			await handleRequestClearNonce(provider, message)
 
 			expect(issueClearNonce).toHaveBeenCalled()
-			expect(result).toBe("test-nonce-abc")
+			expect(provider.postMessageToWebview).toHaveBeenCalledWith({
+				type: "requestClearNonceResponse",
+				requestId: "req-nonce-1",
+				clearNonce: "test-nonce-abc",
+			})
 		})
 
-		it("returns null when service is unavailable", async () => {
+		it("posts error response when service is unavailable", async () => {
 			const provider = createMockProvider(undefined)
 
-			const result = await handleRequestClearNonce(provider)
+			const message: WebviewMessage = {
+				type: "requestClearNonce",
+				requestId: "req-nonce-2",
+			}
+
+			await handleRequestClearNonce(provider, message)
 
-			expect(result).toBeNull()
+			expect(provider.postMessageToWebview).toHaveBeenCalledWith({
+				type: "requestClearNonceResponse",
+				requestId: "req-nonce-2",
+				clearNonce: null,
+				error: expect.stringContaining("[STATS_HANDLER/clear/002]"),
+			})
 		})
 	})
 })

src/core/webview/usageStatsMessageHandler.ts

@@ -322,20 +322,54 @@ export async function handleExportUsageStats(
 }
 
 /**
- * Issues a clear confirmation nonce and returns it to the webview.
- * The webview must include this nonce in the subsequent `clearUsageStats` message.
+ * Handles the `requestClearNonce` message (B2 fix).
  *
- * This is called from the webview's confirmation dialog flow.
- * The nonce is short-lived (5 minutes) and single-use.
+ * Issues a host-generated clear confirmation nonce and posts it back to the
+ * webview as `requestClearNonceResponse`. The webview must include this nonce
+ * in the subsequent `clearUsageStats` message.
+ *
+ * Previously the webview generated its own nonce, which the host never stored,
+ * so `clearStats` always failed with "nonce mismatch". The nonce is now
+ * host-issued, short-lived (5 minutes), and single-use — matching the security
+ * design intent.
  */
-export async function handleRequestClearNonce(provider: ClineProvider): Promise<string | null> {
-	const service = provider.getUsageStatsService()
+export async function handleRequestClearNonce(provider: ClineProvider, message: WebviewMessage): Promise<void> {
+	const requestId = message.requestId
 
-	if (!service) {
-		return null
-	}
+	try {
+		const service = provider.getUsageStatsService()
+
+		if (!service) {
+			await provider.postMessageToWebview({
+				type: "requestClearNonceResponse",
+				requestId,
+				clearNonce: null,
+				error: "[STATS_HANDLER/clear/002] Usage stats service is unavailable",
+			})
+			return
+		}
+
+		const nonce = service.issueClearNonce()
 
-	return service.issueClearNonce()
+		await provider.postMessageToWebview({
+			type: "requestClearNonceResponse",
+			requestId,
+			clearNonce: nonce,
+		})
+	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : String(error)
+
+		provider.log(
+			`[STATS_HANDLER/clear/003] Error issuing clear nonce: ${JSON.stringify(error, Object.getOwnPropertyNames(error), 2)}`,
+		)
+
+		await provider.postMessageToWebview({
+			type: "requestClearNonceResponse",
+			requestId,
+			clearNonce: null,
+			error: `[STATS_HANDLER/clear/003] Failed to issue clear nonce: ${errorMessage}`,
+		})
+	}
 }
 
 // Re-export StatsServiceError for convenience in tests

src/core/webview/webviewMessageHandler.ts

@@ -53,6 +53,7 @@ import {
 	handleGetUsageStats,
 	handleClearUsageStats,
 	handleExportUsageStats,
+	handleRequestClearNonce,
 } from "./usageStatsMessageHandler"
 import { changeLanguage, t } from "../../i18n"
 import { Package } from "../../shared/package"
@@ -3948,6 +3949,11 @@ export const webviewMessageHandler = async (
 			break
 		}
 
+		case "requestClearNonce": {
+			await handleRequestClearNonce(provider, message)
+			break
+		}
+
 		case "exportUsageStats": {
 			await handleExportUsageStats(provider, message)
 			break