fix(submit): bypass cost-without-tokens check for Cursor legacy premium-tool-call

[junhoyeo]

What I hit

Running npx tokscale@latest submit against a freshly synced local payload (5,038 Cursor CSV rows, 230 active days, 59.07B tokens across 10 clients) failed at server-side validation with a long list of Cost submitted without tokens errors. The full failure mode looks like this:

Tokscale - Submit Usage Data
  Syncing Cursor usage data...
  Cursor sync failed; using cached data: <…>
  Scanning local session data...
  Data to submit:
    Date range: 2024-06-06 to 2026-05-27
    Active days: 230
    Total tokens: 59,067,653,128
    Total cost: $45618.04
    Clients: amp, claude, codex, copilot, cursor, droid, gemini, openclaw, opencode, pi
    Models: 83 models

  Submitting to server...

  Error: Validation failed
    - Day 2025-04-29: Cost submitted without tokens
    - Client cursor/premium-tool-call on 2025-04-29: Cost submitted without tokens
    - Day 2025-05-01: Cost submitted without tokens
    - Client cursor/premium-tool-call on 2025-05-01: Cost submitted without tokens
    ...
    - Client cursor/claude-3-5-sonnet on 2025-05-18: Cost submitted without tokens
    - Client cursor/auto on 2025-05-28: Cost submitted without tokens
    - Day 2025-06-03: Cost submitted without tokens
    - Client cursor/claude-4-sonnet-thinking on 2025-06-03: Cost submitted without tokens
    - Client cursor/o3 on 2025-06-13: Cost submitted without tokens
    ...

The entire 230-day submission was rejected.

Root cause

pushCostSanityErrors in packages/frontend/src/lib/validation/submission.ts (introduced by PR #557 — fix(submit): reject implausible submitted totals) treats any (date, client, modelId) aggregate with cost > 0 && tokens === 0 as fatal:

if (cost > 0 && tokens === 0) {
  errors.push(`${label}: Cost submitted without tokens`);
  return;
}

The check fires at three levels: per-client, per-day total, and overall summary total. Any single offending row fails the whole submission.

Cursor's CSV usage exports have legitimate cost-only rows whose token columns are blank:

Source	What it is	Token columns
cursor/premium-tool-call	pre-2025-05 per-tool-call billing event	always empty
cursor/auto, cursor/claude-3.5-sonnet, cursor/claude-4-sonnet-thinking, cursor/o3	individual model calls Cursor records with Cost but no Total Tokens (sporadic)	sometimes empty

crates/tokscale-core/src/sessions/cursor.rs (the Rust CSV parser) preserves these rows verbatim, so they reach the server as cost > 0, tokens = 0 aggregates.

Forensic count from my local cache

I crawled ~/.config/tokscale/cursor-cache/usage.csv (the same file the CLI submits) and summed every (date, model) aggregate where cost > 0 && totalTokens === 0:

Model	Affected days	Rows	Total cost
premium-tool-call	14	871	$40.55
claude-4-sonnet-thinking	11	132	$4.44
auto	4	20	$0.68
claude-3.5-sonnet	2	2	$0.08
o3	1	2	$0.04
Total		1,027	$45.79

• premium-tool-call accounts for 89% of the rejected cost and is the only model that is always tokenless by design (it disappeared from Cursor's schema in May 2025).
• The other models are sporadic and far smaller (~$5.20 combined across 26 days).
• $45.79 of legacy data blocked submission of $45,618 of valid totals — 0.1% of the payload locked out the other 99.9%.

The fix

Two parts, both inside packages/frontend/src/lib/validation/submission.ts:

1. Cursor legacy carve-out (the actual unblock)

Add a narrow allowlist for the one model that legitimately and consistently has no token attribution:

// Cursor legacy: pre-2025-05 Cursor usage exports include `premium-tool-call`
// rows that are billed per tool invocation and carry no token attribution.
// They legitimately have cost > 0 with all token fields = 0 and must bypass
// the "Cost submitted without tokens" sanity check — otherwise any user with
// historical Cursor data is permanently locked out of `tokscale submit`.
const CURSOR_LEGACY_TOKENLESS_MODELS: ReadonlySet<string> = new Set([
  "premium-tool-call",
]);

function isLegacyTokenlessCursorClient(client: ClientLike): boolean {
  return (
    client.client === "cursor" &&
    CURSOR_LEGACY_TOKENLESS_MODELS.has(client.modelId) &&
    tokenTotal(client.tokens) === 0
  );
}

This carve-out is applied at all three check sites:

• Client level — skip the check entirely for legacy rows.
• Day level — subtract legacy cost from day.totals.cost before testing. If the day has only legacy rows the check no longer fires; if the day has a mix of legacy + a real tokenless regression, the remaining (non-legacy) cost still trips the check.
• Submission summary level — same subtraction logic across all contributions.

Other cursor models (auto, claude-3.5-sonnet, claude-4-sonnet-thinking, o3) are explicitly not included in the allowlist. They sometimes have tokenless rows, but unlike premium-tool-call those tokenless rows look like genuine parser/API regressions that we want to keep surfacing. Hiding them under a blanket cursor allowlist would mask real bugs.

2. Detailed English error messages

The old Cost submitted without tokens line was unactionable — operators had to re-run the CLI in debug mode to figure out which row failed. The new messages embed the full row context:

Client cursor/claude-3.5-sonnet (provider=anthropic) on 2025-05-18: Cost submitted without tokens (cost=$0.0400, tokens={input=0, output=0, cacheRead=0, cacheWrite=0, reasoning=0})

Day 2025-04-29: Cost submitted without tokens (cost=$2.0500, total tokens=0; offending clients: cursor/auto (provider=cursor) cost=$1.5000; cursor/claude-4-sonnet-thinking (provider=anthropic) cost=$0.5500)

Submission summary: Cost submitted without tokens (cost=$45.7900, total tokens=0; offending clients: cursor/claude-3.5-sonnet (provider=anthropic) cost=$0.0400; ...)

All three levels now report client, providerId, modelId, full cost, and the full token breakdown. Day- and summary-level errors also enumerate which clients on that scope were responsible.

The legacy pushCostSanityErrors helper was split into:

• A pure cost-per-million check (pushCostPerMillionError), unchanged in behavior.
• Inline cost-without-tokens checks at each site, which is the only way to include the per-site context (offender list, token breakdown) in the error string.

Why not the alternatives

Option	Why rejected
Drop tokenless Cursor rows in the Rust parser	Loses real cost attribution that the leaderboard depends on — the user paid for it, it should count.
Loosen cost > 0 && tokens === 0 to a warning globally	Re-opens the original PR #557 vulnerability (implausible cost-only submissions).
Estimate tokens from cost	Fabricates data; downstream cost-per-million sanity checks would fight the estimate.
Allow all cursor models with cost-only rows	Hides parser bugs in non-premium-tool-call paths.

Test plan

• npx vitest run __tests__/api/submit.test.ts — 47/47 pass (was 44 before, +3 new tests).
• npx vitest run (full frontend suite) — 283/283 pass.
• npx eslint src/lib/validation/submission.ts __tests__/api/submit.test.ts — clean.
• Existing rejects submitted cost without corresponding tokens test still passes (the new message still starts with the same prefix).
• New allows cursor legacy premium-tool-call rows that lack token attribution test verifies the unblock works for the exact shape I hit locally (date 2025-04-29, cost $2.05, all-zero tokens).
• New does not extend the cursor legacy bypass to other cursor models test pins the carve-out to premium-tool-call only — cursor/claude-3.5-sonnet with cost-only still fails.
• New allows cursor legacy rows mixed with normal token-bearing rows test covers the realistic mixed-day case.
• New includes client/provider/model/cost/tokens detail in tokenless-cost errors test pins the new English error format so it doesn't silently regress.

Files changed

• packages/frontend/src/lib/validation/submission.ts — carve-out + richer error messages.
• packages/frontend/__tests__/api/submit.test.ts — 4 new tests, existing assertions intact.

Rollback

git revert HEAD — single commit, isolated to the validation module.

---

Summary by cubic

Unblocks submissions with historical Cursor data by bypassing the “cost without tokens” check for legacy cursor/premium-tool-call rows and excluding their cost from cost-per-million checks. Real tokenless-cost regressions still fail and are easier to debug.

• Bug Fixes
  • Allowlisted legacy cursor/premium-tool-call rows (cost > 0, tokens = 0) at client/day/summary levels; other Cursor models remain strict.
  • Day/summary checks subtract legacy cost before validating and before the cost-per-million cap to avoid false positives on mixed days.
  • Use a small float epsilon when comparing post-subtraction cost to avoid rounding-noise rejections on all-legacy submissions.
  • Error messages now include client/provider/model, cost, and token breakdown; day/summary errors list offending clients.

^{Written for commit 8eb7bfa. Summary will update on new commits. Review in cubic}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tokscale	Ready	Preview, Comment	May 27, 2026 11:04am

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66f7bbd91c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exclude legacy Cursor cost from CPM checks

When a legacy cursor/premium-tool-call row shares a day with any token-bearing usage, this branch runs because day.totals.tokens > 0, and the cost-per-million check uses the full day cost including the tokenless legacy charge. A historical Cursor day such as $2.05 in premium tool calls plus 100 normal tokens now computes $20,500/M and is rejected, even though the legacy row is supposed to be skipped; subtract the legacy tokenless cost (and do the same for the summary check) before applying this sanity cap.

Useful? React with 👍 / 👎.

[junhoyeo]

Good catch — fixed in 5ab9a79. The day-level (and summary-level) branches now compute a shared checkableCost = max(0, totalCost - legacyCost) and pass that to both the cost-without-tokens check and pushCostPerMillionError, so a legacy premium-tool-call charge sharing a day with normal token-bearing usage no longer inflates the cost-per-million ratio. Added excludes cursor legacy cost from the cost-per-million sanity cap as a regression test exercising the exact $2.05 + 100 tokens shape you described — it previously would have computed $20,600/M and failed; now it passes.

[cubic-dev-ai]

1 issue found across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>