feat(antigravity): estimate local history costs from models.dev prices

[WeGoToMars]

Summary

This PR adds estimated dollar costs to Antigravity's existing local token history.

The estimates use public API prices from models.dev. They are shown as API-equivalent estimates, not as billed spend or subscription value.

How it works

CodexBar continues to read Antigravity token history from the same local SQLite and JSONL files. This PR does not change history discovery, token counting, timestamps, credentials, or account attribution.

For each recorded model:

• Supported Gemini models use Google pricing.
• Supported Claude models use Anthropic pricing.
• gpt-oss-120b uses OpenAI pricing.
• Unknown or unsupported models keep their token counts but do not receive a dollar estimate.

When a period contains both priced and unpriced requests, CodexBar shows the coverage explicitly. For example:

Coverage: 1 estimated · 1 unpriced

Dollar-related labels and explanations appear only when at least one cost can be estimated. Completely unpriced history continues to be presented as token history.

Pricing catalog and network behavior

Prices come from CodexBar's on-disk models.dev catalog.

The current implementation follows the existing Codex and Claude pricing-cache policy: it uses a fresh cached catalog when available and may refresh models.dev when the catalog is stale or missing. A failed refresh keeps the existing catalog.

This changes Antigravity's previous fully local behavior and needs a maintainer decision:

• Keep the shared automatic refresh behavior; or
• Make ordinary Antigravity reads cache-only and provide a separate opt-in refresh path.

The local history files themselves are never uploaded or modified.

Reliability

On Linux, catalog updates now use a same-directory atomic rename(2). Readers therefore see either the previous complete catalog or the new complete catalog, never a missing or partially written file.

The implementation follows the existing CostUsageClaudeCache pattern. Tests cover concurrent readers and writers and verify that no temporary or backup files remain.

User-facing changes

• codexbar cost --provider antigravity can show API-equivalent cost estimates.
• JSON output includes the existing cost provenance and coverage fields.
• Menu and provider-detail views show the estimate explanation only when costs are available.
• Unknown models remain visible with their original token counts.

Testing

Run on macOS at final head aab2de5:

• make check — 0 violations across 2,100 files
• make test — 1005 selections / 84 groups, first-pass all green, no retries
• Focused Antigravity, pricing, menu, architecture, and settings tests — 128 passed
• Concurrent catalog replacement test passed
• Linux-focused Antigravity suite — 16 tests, all passing on macOS numbering parity (full Linux coverage runs in CI)

GitHub CI additionally covers Linux x64, Linux arm64, and musl.

Proof

Synthetic fixture

Tested at final head aab2de5 with one supported model and one unsupported model.

$ shasum -a 256 session-a.db
e2ced86ffaf5c286f303758929788832c38260fbd1db8b3eee8499eadfa5b733 session-a.db

$ HOME="$TMP/home" XDG_CACHE_HOME="$TMP/cache"
CodexBarCLI cost --provider antigravity --format text

Antigravity API-equivalent estimate (not billed)
Today: $0.00 · 0 tokens
Last 30 days: $0.00 · 1.9K tokens
Coverage: 1 estimated · 1 unpriced
Not a subscription bill or plan value · local usage × public API prices

$ shasum -a 256 session-a.db
e2ced86ffaf5c286f303758929788832c38260fbd1db8b3eee8499eadfa5b733 session-a.db

The matching hashes confirm that the history database was not modified.

Redacted local-history run

Tested with a copy of real Antigravity history at final head aab2de5:

Antigravity API-equivalent estimate (not billed)
Today: $<redacted> · <redacted> tokens
Last 30 days: $<redacted> · <redacted> tokens
Not a subscription bill or plan value · local usage × public API prices

{
  "provider": "antigravity",
  "provenance": "listPriceEstimate",
  "historyCoverageIsEstablished": true,
  "coverage": { "estimated": 5, "unpriced": 0, "priced": 0, "unmetered": 0 },
  "last30DaysTokens": "<redacted>",
  "last30DaysCostUSD": "<redacted>"
}

Sensitive token counts and paths are redacted. The visible output confirms the estimate label, coverage reporting, and successful handling of local history. The copied input databases hashed identically before and after the run.

Related work

Related to #53. Builds on #2181 and #3001.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0762861b7c

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[clawsweeper]

Codex review: blocked before merge. Reviewed September 4, 2026, 3:26 AM ET / 07:26 UTC.

ClawSweeper review

What this changes

Adds public-price estimates to Antigravity’s local token history, updates CLI and native disclosures, preserves compatible Codex caches, and makes Linux pricing-cache replacement atomic.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 6 items remain

This remains useful work absent from main and v0.56.4. The Linux replacement and Codex cache fixes are present, but all three latest findings remain unresolved.

Priority: P2
Reviewed head: aab2de5057671a8faa1d52c02c4ae787255e3a1b
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Real-history proof and substantial focused tests support the feature, but the three remaining findings prevent merge readiness.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The captured final-head CLI run exercises the local reader and pricing fetcher against copied real Antigravity history, showing estimate wording, listPriceEstimate provenance, and five estimated requests; unchanged input hashes are reported. Synthetic mixed-coverage output supplements this proof, while native presentation defects remain separate findings.
Patch quality	🦐 gold shrimp (3/6)	3 actionable review findings remain.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The captured final-head CLI run exercises the local reader and pricing fetcher against copied real Antigravity history, showing estimate wording, listPriceEstimate provenance, and five estimated requests; unchanged input hashes are reported. Synthetic mixed-coverage output supplements this proof, while native presentation defects remain separate findings.
Evidence reviewed	11 items	Repository policy and scope: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-notes directory was found. Applied provider isolation, focused validation, and Keychain-safety guidance within the read-only review contract. Verified introduction and merge boundary: Reviewed the complete 22-file merge-base-to-head change. Raw test-merge parents are exactly the pinned main followed by the reviewed head; its changed-file list excludes main-only work. Still necessary on main: Current main reads Antigravity history without catalog refresh and returns unknown cost provenance; its documentation explicitly describes token-only, network-free history. The related merged disclosure and subscription-total PRs do not implement Antigravity pricing.
Findings	3 actionable findings	[P1] Preserve cache-only ordinary Antigravity reads [P2] Exclude synthetic empty-day zeroes from the estimate hint guard [P2] Disclose partial pricing coverage beside native totals
Security	None	None.

How this fits together

CodexBar reads local Antigravity history and turns recorded model usage into daily summaries. This change combines those records with cached public prices before presenting costs in the CLI and native app.

flowchart TD
  A[Local SQLite or JSONL history] --> B[Validated token records]
  C[Public pricing catalog] --> D[Cached prices]
  D --> E{Model has a price?}
  B --> E
  E -->|Yes| F[Estimated cost and tokens]
  E -->|No| G[Tokens with unpriced coverage]
  F --> H[CLI and native summaries]
  G --> H

Loading

Decision needed

Question	Recommendation
Should ordinary Antigravity history reads automatically refresh models.dev, changing the existing network-free contract?	Preserve cache-only ordinary reads: Use cached prices automatically and require an explicit action to fetch updated prices.

Why: The contributor explicitly requests this decision; matching Codex and Claude policy does not establish permission to change Antigravity’s existing contract.

Before merge

• Preserve cache-only ordinary Antigravity reads (P1) - This prior finding remains unresolved. With a missing or stale catalog, ordinary codexbar cost --provider antigravity reaches this refresh before reading local history: refresh defaults to enabled and the CLI disables background refresh. Previously network-free reads can therefore wait for the 20-second request timeout. Preserve cache-only ordinary reads with an explicit refresh action unless an owner approves the contract change acknowledged in the PR body.
• Exclude synthetic empty-day zeroes from the estimate hint guard (P2) - The production snapshot builder sets sessionCostUSD to zero when there are no requests today and supplies zero totals for complete empty history. This guard treats those placeholders as pricing evidence, so empty history or entirely unpriced earlier requests still show the estimate hint in both native views. Check genuine priced history or Antigravity provenance, preserving valid zero-price estimates, and test snapshots produced by the real builder.
• Disclose partial pricing coverage beside native totals (P2) - With one priced request and one unsupported model, the new reader totals only the priced request while retaining both requests' tokens. The CLI discloses this split, but the menu and inline dashboard show the partial amount with all tokens and only generic estimate wording. Add the existing estimated/unpriced coverage counts beside native period totals so users can distinguish incomplete pricing from a full estimate.
• Resolve merge risk (P2) - Existing Antigravity-only CLI workflows gain an automatic external request and can wait for its 20-second timeout; acceptance of that upgrade behavior remains undecided.
• Complete next step (P2) - Resolve the automatic catalog-refresh policy and fix the native empty-history hint and partial-coverage disclosures.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

• [P1] Preserve cache-only ordinary Antigravity reads — Sources/CodexBarCore/CostUsageFetcher.swift:1234-1239
• [P2] Exclude synthetic empty-day zeroes from the estimate hint guard — Sources/CodexBar/MenuCardView+Costs.swift:324-327
• [P2] Disclose partial pricing coverage beside native totals — Sources/CodexBar/InlineUsageDashboardContent.swift:223-225

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Production and test growth	Production +430 net lines; tests +1,400 net lines	Production growth implements catalog pricing and presentation, with substantial focused pricing, refresh, and cache-compatibility coverage.

Merge-risk options

Maintainer options:

1. Preserve offline compatibility (recommended)
   Gate catalog network access behind an explicit action and verify ordinary reads with missing, stale, and fresh caches.
2. Accept the changed network contract
   Record explicit owner approval for automatic refresh and demonstrate bounded behavior when the catalog endpoint is unavailable.

Technical review

Best possible solution:

Keep ordinary history reads cache-only with an explicit pricing-refresh action, and make native summaries distinguish genuine estimates, unpriced history, and partial totals.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: a missing or stale catalog, entirely unpriced history with no requests today, and mixed priced/unpriced requests expose the three remaining PR findings. Runtime reproduction was not executed during this read-only review.

Is this the best way to solve the issue?

No as submitted: reusing the existing catalog and pricing arithmetic is appropriate, but the network default needs approval and native disclosures need focused repairs.

Full review comments:

• [P1] Preserve cache-only ordinary Antigravity reads — Sources/CodexBarCore/CostUsageFetcher.swift:1234-1239
  This prior finding remains unresolved. With a missing or stale catalog, ordinary codexbar cost --provider antigravity reaches this refresh before reading local history: refresh defaults to enabled and the CLI disables background refresh. Previously network-free reads can therefore wait for the 20-second request timeout. Preserve cache-only ordinary reads with an explicit refresh action unless an owner approves the contract change acknowledged in the PR body.
  Confidence: 0.99
• [P2] Exclude synthetic empty-day zeroes from the estimate hint guard — Sources/CodexBar/MenuCardView+Costs.swift:324-327
  The production snapshot builder sets sessionCostUSD to zero when there are no requests today and supplies zero totals for complete empty history. This guard treats those placeholders as pricing evidence, so empty history or entirely unpriced earlier requests still show the estimate hint in both native views. Check genuine priced history or Antigravity provenance, preserving valid zero-price estimates, and test snapshots produced by the real builder.
  Confidence: 0.99
• [P2] Disclose partial pricing coverage beside native totals — Sources/CodexBar/InlineUsageDashboardContent.swift:223-225
  With one priced request and one unsupported model, the new reader totals only the priced request while retaining both requests' tokens. The CLI discloses this split, but the menu and inline dashboard show the partial amount with all tokens and only generic estimate wording. Add the existing estimated/unpriced coverage counts beside native period totals so users can distinguish incomplete pricing from a full estimate.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 392310c66548.

Labels

Label changes:

• remove merge-risk: 🚨 availability: Current PR review merge-risk labels are merge-risk: 🚨 compatibility.

Label justifications:

• P2: This is a bounded cost-reporting feature with unresolved compatibility and presentation defects.
• merge-risk: 🚨 compatibility: Ordinary Antigravity CLI reads change from network-free operation to potentially awaited catalog downloads.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The captured final-head CLI run exercises the local reader and pricing fetcher against copied real Antigravity history, showing estimate wording, listPriceEstimate provenance, and five estimated requests; unchanged input hashes are reported. Synthetic mixed-coverage output supplements this proof, while native presentation defects remain separate findings.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured final-head CLI run exercises the local reader and pricing fetcher against copied real Antigravity history, showing estimate wording, listPriceEstimate provenance, and five estimated requests; unchanged input hashes are reported. Synthetic mixed-coverage output supplements this proof, while native presentation defects remain separate findings.

Evidence

What I checked:

• Repository policy and scope: Read the complete root AGENTS.md. No nested AGENTS.md or maintainer-notes directory was found. Applied provider isolation, focused validation, and Keychain-safety guidance within the read-only review contract. (AGENTS.md:1, aab2de505767)
• Verified introduction and merge boundary: Reviewed the complete 22-file merge-base-to-head change. Raw test-merge parents are exactly the pinned main followed by the reviewed head; its changed-file list excludes main-only work. (b747df6d9973)
• Still necessary on main: Current main reads Antigravity history without catalog refresh and returns unknown cost provenance; its documentation explicitly describes token-only, network-free history. The related merged disclosure and subscription-total PRs do not implement Antigravity pricing. (Sources/CodexBarCore/CostUsageFetcher.swift:1213, 392310c66548)
• Latest release check: The v0.56.4 tag resolves to the supplied release commit and retains the token-only Antigravity path. (Sources/CodexBarCore/CostUsageFetcher.swift:1213, fb9d295304af)
• Automatic network access remains: Antigravity now refreshes prices before reading history. Pricing refresh defaults to enabled, the CLI explicitly awaits it, and the existing public-catalog GET has a 20-second timeout. The captured body and contributor comment explicitly leave this policy choice to an owner. (Sources/CodexBarCore/CostUsageFetcher.swift:1234, aab2de505767)
• Synthetic zeroes satisfy the new hint guard: The new guard accepts any non-nil aggregate cost, while tokenSnapshot supplies zero for complete empty histories and days without requests. Consequently, entirely unpriced history can receive an estimate hint. Added menu tests construct snapshots manually and miss these production-generated zeroes. (Sources/CodexBar/MenuCardView+Costs.swift:324, aab2de505767)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Yuxin-Qiao: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Preserve offline ordinary reads or obtain explicit approval for automatic catalog refresh.
• Test native hints with production-built empty and entirely unpriced snapshots, including no requests today.
• Show estimated/unpriced coverage beside native partial totals.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-04T05:32:17.735Z sha c14ff72 :: needs real behavior proof before merge. :: [P1] Preserve Antigravity’s offline cost path | [P2] Replace the Linux cache without removing its live path | [P2] Update the CLI reference for estimated Antigravity costs
• reviewed 2026-09-04T05:38:07.608Z sha c14ff72 :: needs real behavior proof before merge. :: [P1] Preserve Antigravity's offline cost path | [P2] Atomically replace the Linux pricing cache
• reviewed 2026-09-04T06:54:39.986Z sha f4a122f :: blocked before merge. :: [P1] Keep ordinary Antigravity history reads offline | [P2] Adopt the prior parser hash instead of rebuilding Codex cache
• reviewed 2026-09-04T07:19:11.013Z sha aab2de5 :: blocked before merge. :: [P1] Keep ordinary Antigravity history reads offline | [P2] Exclude synthetic empty-day zeroes from the pricing hint guard | [P2] Disclose partial cost coverage in native views

[WeGoToMars]

@clawsweeper re-review

Pushed a single squashed commit addressing the findings: POSIX rename(2) Linux replacement with concurrency coverage, docs disambiguation (history scanning vs catalog refresh, Codex/Claude parity noted for the offline-policy decision), redacted live-history proof at the final head, and the Swift 6.3.3 type-check fix. Full suite green locally (1005/84 first-pass).

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[WeGoToMars]

@clawsweeper re-review

Addressed the remaining contributor-side compatibility finding at aab2de5.

The remaining P1 is a maintainer policy decision: should Antigravity use the same automatic models.dev pricing refresh as Codex and Claude?

The refresh fetches only the public pricing catalog. Keeping the shared behavior also allows Antigravity-only users to receive estimates without relying on another provider to populate the catalog.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

[horosin]

I'm not even getting token counts for AGY, anything specific needs to be done for this to work?

[WeGoToMars]

I'm not even getting token counts for AGY, anything specific needs to be done for this to work?

Token counts support was merged in this PR: #3403

[WeGoToMars]

@steipete can you take a look at this PR?

[steipete]

The shared pricing-cache replacement bug identified here is now fixed on main in #3444 (559bfc8). Thanks @WeGoToMars for surfacing it.

The isolated fix uses one atomic destination write on both platforms, removing seven production lines. On Linux with Swift 6.3.3, the old code failed on the second save and left the catalog missing; the replacement passed 100 saves with disk and memo reads checked after each. The portable regression, all 1,025 local test selections, and all nine CI checks passed. One unrelated local RPC teardown timing failure passed on its group retry.

This PR remains open for its Antigravity estimation and networking-policy scope. Its separate Linux cache-replacement branch can be dropped when rebasing onto main.