agentacct

A local-first ledger for coding-agent work. It reads the session files each client already writes — Claude Code’s JSONL transcripts, Codex’s SQLite state and rollouts, Hermes’s state database, OpenCode’s rollups, OpenClaw JSONL, DeepSeek Harness’s compressed logs, Kimi Code’s per-request usage records — and records what the agent says it did over MCP and host hooks, then joins the two on real session ids and labels every join with a confidence. A task becomes a receipt: participating sessions, the recorded outcome, checks with their exit codes, an activity timeline, tokens, and a cost estimate drawn with ≈ because it is a price-list estimate and not an invoice. Nothing leaves the machine: no account, no telemetry, no provider API key, and no attaching to agents it did not start. It ships as a Python CLI and TUI plus a notarized macOS app, and eight clients have integration paths of openly different strength.

Who built itThe repository is credited to the GitHub account mikehasa, which the commit history ties to 210 of its 484 commits; the second account, FZ2000, landed 159, three others one to three each, and 110 commits carry no linked account at all. No personal name appears in the metadata, and the homepage field points at https://trytofu.ai, a page titled “Tofu puts your AI-built app online in 10 minutes”, which describes a different product.

1. 01

   Two months, 42 versions, and two renames in the first week

   The repository was created on 2026-07-24 and released 0.1.0 the next day: a local-first ledger that imported client-reported tokens from local session files, took work context over MCP, joined the two with a confidence label and drew it on a local dashboard. Sixty-eight days later the changelog carries 42 version sections, ending at 0.12.9 on 2026-09-30, and the commit history 484 commits — 210 credited to the owner’s account, 159 to a second contributor, 110 with no linked account, and five spread across three others. It is not a lone hand at the keyboard: 79 commits carry co-author trailers, and 74 of those name a Claude model, the largest group being the 59 that say “Claude Fable 5.1”. The project also renamed itself twice in its first week. 0.5.0 renamed the MCP tools from sentinel_* to agentacct_* and the Python package from agent_chronicle to agentacct; 0.5.1 made AGENTACCT_* the primary environment prefix while keeping the older names accepted forever. The trace that survived is the project store directory, still called .agent-sentinel/state.

2. 02

   A work step is something the agent writes down, and evidence outranks wording

   agentacct does not watch an agent and guess what it did; the step record is written by the agent itself. Over MCP, agentacct_record_section opens a section as started, adds checkpoints, and closes it as completed, blocked or handed_off; machine checks such as a test run are recorded separately with their exit code, and the installed hook bridges add tool-activity ticks and workspace-relative file metadata that never include prompts, responses, thoughts or tool bodies. Whether a check counts is decided by how it was observed rather than by the agent’s wording — text such as “tests passed” is never parsed into a pass — and a finished task is rendered either Reported, meaning the agent said so, or Verified, which requires a passing check that post-dates the last recorded change. Two open pull requests tighten that contract further. Number 324 would make a 20–260 character progress note mandatory when a section closes as completed or handed off, with its last clause forced to open with one of six set words, and would print a corrected example call with every refusal; number 335 would put the agent’s own account — goal, newest progress note, next step — above the counted metrics on the receipt, labelled Agent reported. Every join to usage carries exact, high, medium or low, and an inherited session id can never be exact.

3. 03

   Seven local formats, one ledger, and one client that reports no tokens

   Token truth comes only from the files the clients write themselves, and no two write the same shape. Claude Code is read from the JSONL transcripts under its projects directory. Codex is read from state_5.sqlite plus rollout JSONL, where raw input already includes cached input, so the importer subtracts reported cache reads and writes to normalise a non-cached figure and refuses to add reasoning twice, which is already inside output. Hermes comes from session rows in state.db, OpenCode from per-session rollups in the native opencode.db, with exported JSON events as fallback, OpenClaw from assistant rows in JSONL, DeepSeek Harness from Zstandard-compressed logs under ~/.dsh that record tokens but no cost, and Kimi Code from a session_index.jsonl index plus per-request usage.record events in each session’s wire streams, which are deltas and never cumulative, so the importer sums them. Cursor is the deliberate exception: its primary state.vscdb yields composer identities, timestamps and child links only, and an unavailable token figure stays unavailable rather than becoming a zero. Support is published per capability rather than per logo: sessions, usage, mechanical capture, MCP semantics, model attribution, cache reads, cache writes and install are rated on their own, and five further agents sit on the roadmap with nothing behind them.

4. 04

   Where the money number comes from, and what it is not

   The money figure is an estimate and is labelled as one. Tokens are client_reported, read out of the client’s own session store. Cost is estimated_from_tokens: those tokens multiplied by the project’s local snapshot of LiteLLM’s public, community-maintained model price list, drawn as ≈$, while ~$ marks a known-partial subtotal. The built-in table is deliberately small and stops at gpt-5.5; a model id no row covers stays cost-unknown instead of taking a nearby price, cache reads price at 0.1 times input and cache writes at the input rate, and three aliases map a client’s own route names onto the table — claude-code to anthropic, codex to openai, and DeepSeek Harness’s deepseek-official to deepseek. The snapshot refreshes itself once it is older than seven days, best-effort, with a failed attempt throttled to one an hour so an unreachable network never blocks an import. The documentation is blunt about what the number is not: a subscription user is not charged per token, so the estimate is not what they paid, and there is no invoice access at all. A stored row also does not heal itself, because a scan reprices only what a catalog row now covers — which is why one patch adds a command that says why a row has no cost, and why a missing price for a single Codex model shipped as its own release.

5. 05

   The maintainer’s own store: 22.8 GB of evidence, and a release process written after it failed

   The maintainer runs it on the machine it is written on, and that store’s numbers are in the changelog. The append-only evidence spool had reached 22.8 GB while the projection built from it held 277 MB, and sampling showed about 94% of those bytes were dead shadow rows left behind by pruning. A verified cold compaction landed in number 328, but proving it was the hard part: equality against the live projection can never hold on a store that has been pruned, and a from-zero replay of the 3-million-row spool runs at roughly 137 rows a second — about six hours. The gate became a containment proof, and then had to exclude rows the live usage lane writes during the offline window. After the repair the maintainer’s store went from 21.24 GiB to 131.7 MiB. The same upkeep shows in the tests: number 340 recalibrated a display pin that had drifted from under 15% to 22.4% of 3,592 unique recorded titles, and number 342 chased a failure that appeared only because a two-day fixture sat across different calendar days and the weekly buckets are Monday-anchored. Release pull requests must state whether the macOS disk image will be rebuilt or reused, since the app embeds a frozen copy of the Python CLI — a rule written after four releases in a row shipped with no disk image at all.

6. 06

   What it says it cannot do, and the small round of attention from outside

   agentacct calls itself early alpha and writes its limits where they can be checked. It does not scan for or attach to agents it did not start, does not copy prompts, responses, thoughts or transcripts, stores no provider API key, and offers no hosted service; Windows is supported only through WSL, and the signed macOS app exists for people who would rather not install Python. The coverage matrix admits that one client can hold a proven usage lane and an experimental capture lane at the same time, and it uses that: for Kimi Code the hook bridge has fired on live desktop sessions — 64 payloads across five — but no live session has been seen binding a recorded section to its session id, Cursor proves presence and nothing about tokens, and OpenClaw’s routing metadata is not integrated. Dates are whole session totals attributed to an activity date, which the API exposes as a limitation instead of pretending to a daily split. The repository keeps the paper trail: 100 numbered review files under the usage-limits redesign, a critique and a synthesis document beside them, a 215 KB scenario matrix in the animation plans, and a data-quality plan with its own audit scripts. Attention from outside has been small and specific — a contributor’s readability cleanups, credited by name in the changelog, a fix for a stale export file from another account, and one inbound integration request, issue 349 from the founder of MemCode, asking whether an importer for memory save-and-recall metadata would be accepted and promising never to ingest memory text, prompts, credentials or source files.