Hardest problem: single-use refresh tokens
Grok's OIDC and Codex's ChatGPT grants rotate on every refresh. A naive refresh silently invalidated the provider CLI's own token and pushed the user into a refresh_token_reused re-login loop. The fix writes the rotated grant back to both tracker's store and the provider's file, making tracker a transparent read-only observer rather than a credential thief.
A silent data bug found by profiling
A slow refresh (18s) turned out not to be network-bound at all. insert_token_usage used INSERT OR IGNORE against a table with no UNIQUE constraint, so every sync re-inserted the full transcript history — 4.5M rows for 1,464 real events. Because the summary query SUMs those rows, reported lifetime cost was inflated 1,776x with nothing visibly wrong in the UI. A UNIQUE index, a one-time migration, a pre-filter before json.loads, and concurrent collection took refresh from 18.2s to 3.0s and the database from 808 MB to 9.1 MB.
Never drops a row
On HTTP 429 it honors the backoff window and renders the last-known sample tagged backing-off, so one rate-limited account cannot hide the rest of the fleet. Every rendered row carries its provenance: api, derived, cached, or backing-off.