From 03d096e54239370825b4afb5b639650546e49cd0 Mon Sep 17 00:00:00 2001
From: Paul D'Ambra <paul@posthog.com>
Date: Thu, 23 Jul 2026 20:48:59 +0100
Subject: [PATCH 1/8] feat(aio): honest per-tool spend attribution and
 cost-by-context-size

Fixes double-counting in by_tool (each generation's full cost was
attributed to every tool it called, summing to ~122% of real spend) by
adding cost_attributed_usd / share_attributed, which split cost evenly
across the distinct tools a generation called and reconcile to scoped
spend. Adds by_input_size, bucketing spend by $ai_input_tokens, since
context size -- not tool choice -- is the primary cost driver. Removes
the unused top_traces field.

Generated-By: PostHog Code
Task-Id: 68fa35a8-56d2-4be3-a0c9-d870e966acd2
---
 .../backend/api/personal_spend.py             | 322 ++++++++++++++----
 .../backend/api/test/test_personal_spend.py   | 102 +++++-
 .../frontend/generated/api.schemas.ts         |  64 ++--
 .../frontend/generated/api.ts                 |   2 +-
 products/ai_observability/mcp/tools.yaml      |  13 +-
 .../schema/generated-tool-definitions.json    |   2 +-
 services/mcp/schema/tool-definitions-all.json |   2 +-
 services/mcp/src/api/generated.ts             |  64 ++--
 .../mcp/src/generated/ai_observability/api.ts |   4 +-
 9 files changed, 436 insertions(+), 139 deletions(-)

diff --git a/products/ai_observability/backend/api/personal_spend.py b/products/ai_observability/backend/api/personal_spend.py
index 49b6417210ec..001200c7e419 100644
--- a/products/ai_observability/backend/api/personal_spend.py
+++ b/products/ai_observability/backend/api/personal_spend.py
@@ -70,6 +70,19 @@
 MAX_TIME_BUCKETS = 600
 _RELATIVE_DATE_RE = re.compile(r"^-?\d+[hdwmqyHDWMQY](Start|End)?$")
 
+# `by_input_size` buckets on `$ai_input_tokens`, ascending by lower bound. This is the
+# primary cost driver: large-context turns dominate spend regardless of which tool they
+# called (~half of spend comes from turns over 300k input tokens, verified against
+# production). Single source of truth for both the query's `multiIf` and the row labels.
+INPUT_SIZE_BUCKETS: list[tuple[str, int]] = [
+    ("<50k", 0),
+    ("50k-100k", 50_000),
+    ("100k-150k", 100_000),
+    ("150k-200k", 150_000),
+    ("200k-300k", 200_000),
+    (">300k", 300_000),
+]
+
 MIN_LIMIT = 1
 MAX_LIMIT = 200
 DEFAULT_LIMIT = 50
@@ -181,8 +194,9 @@ class _SpendQueryParamsSerializer(serializers.Serializer):
         allow_blank=False,
         max_length=MAX_PRODUCT_KEY_LENGTH,
         help_text=(
-            "Required `ai_product` key to scope the tool / model / trace breakdowns to a single product. "
-            f"Only the following products are currently supported: {', '.join(sorted(SUPPORTED_PRODUCTS))}."
+            "Required `ai_product` key to scope the tool / model / input-size / day breakdowns to a "
+            f"single product. Only the following products are currently supported: "
+            f"{', '.join(sorted(SUPPORTED_PRODUCTS))}."
         ),
     )
     limit = serializers.IntegerField(
@@ -242,7 +256,10 @@ class _ToolBreakdownRowSerializer(serializers.Serializer):
         allow_null=True,
         help_text=(
             "Individual tool name from `$ai_tools_called` (split on `,` since multi-tool generations "
-            "store a comma-separated list). Null = pure text response with no tool call."
+            "store a comma-separated list). Null = pure text response with no tool call. Skill "
+            "invocations all collapse to the single `Skill` token, because the specific skill name "
+            "isn't recorded at ingestion — treat that row as an upper bound across every skill "
+            "combined, not any one skill."
         ),
     )
     generation_count = serializers.IntegerField(
@@ -252,20 +269,39 @@ class _ToolBreakdownRowSerializer(serializers.Serializer):
         help_text=(
             "Sum of `$ai_total_cost_usd` for generations whose tool list includes this tool. Multi-tool "
             "generations contribute their full cost to every tool they invoked, so this sum can exceed "
-            "`summary.scoped_cost_usd`. Prefer `share_of_scoped` for headline percentages — it's computed "
-            "per row and doesn't require the totals to reconcile."
+            "`summary.scoped_cost_usd` and rows can't be added together. It measures co-occurrence, not "
+            "cost caused by the tool. Use `cost_attributed_usd` for a number that reconciles."
         ),
     )
     share_of_scoped = serializers.FloatField(
         help_text=(
-            "This tool's share of `summary.scoped_cost_usd`, expressed as a float in `[0, 1]`. Independent "
-            "per row, so co-occurring tools can each show a substantial share — the headline number to "
-            "present (e.g. `'Bash drove 47% of your spend'`)."
+            "This tool's share of `summary.scoped_cost_usd`, expressed as a float in `[0, 1]`. Computed "
+            "independently per row from `cost_usd`, so it inherits the same co-occurrence overstatement: "
+            "a tool that's simply present in most generations (e.g. Bash) shows a large share even when "
+            "it isn't what drove the cost, and shares across rows don't reconcile to 1. Use "
+            "`share_attributed` for an honest per-tool percentage."
         ),
     )
     avg_input_tokens = serializers.FloatField(
         help_text="Average `$ai_input_tokens` across these generations — high values signal context bloat per call.",
     )
+    cost_attributed_usd = serializers.FloatField(
+        help_text=(
+            "This tool's fractional share of generation cost: each generation's `$ai_total_cost_usd` is "
+            "divided evenly across the distinct tools it called, and a generation that called no tools "
+            "attributes its full cost to this same null `tool` row. Summed across all rows (when not "
+            "truncated), this reconciles to `summary.scoped_cost_usd` for the GENERATION cost only -- "
+            "embeddings carry no tools, so they're excluded here and the sum can land slightly under the "
+            "full scoped cost. Prefer this over `cost_usd` for an honest per-tool number."
+        ),
+    )
+    share_attributed = serializers.FloatField(
+        help_text=(
+            "`cost_attributed_usd` normalized to `summary.scoped_cost_usd`, as a float in `[0, 1]`. Shares "
+            "across rows reconcile (summing to at most 1, short by the embedding-cost fraction which "
+            "carries no tools) — this is the honest headline percentage, unlike `share_of_scoped`."
+        ),
+    )
 
 
 class _ModelBreakdownRowSerializer(serializers.Serializer):
@@ -276,6 +312,28 @@ class _ModelBreakdownRowSerializer(serializers.Serializer):
     output_tokens = serializers.IntegerField(help_text="Sum of `$ai_output_tokens` for this model.")
 
 
+class _InputSizeBreakdownRowSerializer(serializers.Serializer):
+    bucket = serializers.CharField(
+        help_text=(
+            "Label for this `$ai_input_tokens` bucket (e.g. `100k-150k`). Buckets: "
+            f"{', '.join(label for label, _ in INPUT_SIZE_BUCKETS)}."
+        )
+    )
+    min_input_tokens = serializers.IntegerField(
+        help_text="Inclusive lower bound of `$ai_input_tokens` for this bucket. Use to order or re-derive the bucket."
+    )
+    generation_count = serializers.IntegerField(
+        help_text="Number of $ai_generation + $ai_embedding events with `$ai_input_tokens` in this bucket."
+    )
+    cost_usd = serializers.FloatField(help_text="Sum of `$ai_total_cost_usd` for events in this bucket.")
+    share_of_scoped = serializers.FloatField(
+        help_text="This bucket's share of `summary.scoped_cost_usd`, as a float in `[0, 1]`. Reconciles across buckets."
+    )
+    avg_cost_per_generation = serializers.FloatField(
+        help_text="Average `$ai_total_cost_usd` per event in this bucket -- `cost_usd / generation_count`."
+    )
+
+
 class _DayBreakdownRowSerializer(serializers.Serializer):
     day = serializers.DateField(help_text="UTC calendar day the events fall on (`toDate(timestamp)`).")
     event_count = serializers.IntegerField(
@@ -333,28 +391,16 @@ class _BucketBreakdownRowSerializer(serializers.Serializer):
     )
 
 
-class _TopTraceRowSerializer(serializers.Serializer):
-    trace_id = serializers.CharField(
-        allow_null=True,
-        help_text=(
-            "`$ai_trace_id` of the session — opaque string scoped to the originating product. Format is "
-            "not stable: most are UUIDs but some SDK wrappers emit JSON-shaped strings like "
-            '`{"device_id":"...","session_id":"..."}`. Callers should treat this as an opaque '
-            "identifier (URL-encode before linking to a trace view)."
-        ),
-    )
-    generation_count = serializers.IntegerField(help_text="Number of $ai_generation events in this trace.")
-    cost_usd = serializers.FloatField(help_text="Total cost in USD for this trace.")
-    started_at = serializers.DateTimeField(allow_null=True, help_text="Timestamp of the earliest event in this trace.")
-
-
 class _SummarySerializer(serializers.Serializer):
     date_from = serializers.DateTimeField(
         help_text="Inclusive UTC start of the spend window resolved from the request."
     )
     date_to = serializers.DateTimeField(help_text="Exclusive UTC end of the spend window resolved from the request.")
     product = serializers.CharField(
-        help_text="The `ai_product` filter applied to tool / model / trace breakdowns — echoes the request `product`.",
+        help_text=(
+            "The `ai_product` filter applied to tool / model / input-size / day breakdowns — echoes the "
+            "request `product`."
+        ),
     )
     total_cost_usd = serializers.FloatField(
         help_text="Total LLM cost in USD across every `ai_product` for the user — independent of the `product` filter."
@@ -400,6 +446,24 @@ class _ModelBreakdownSerializer(serializers.Serializer):
     )
 
 
+class _InputSizeBreakdownSerializer(serializers.Serializer):
+    items = _InputSizeBreakdownRowSerializer(
+        many=True,
+        help_text=(
+            "One row per `$ai_input_tokens` bucket that has events, ordered by `min_input_tokens` "
+            "ascending. This is the primary cost driver: large-context turns dominate spend regardless "
+            "of which tool they called, so check this before attributing spend to a tool. Buckets with "
+            "no events are omitted."
+        ),
+    )
+    truncated = serializers.BooleanField(
+        help_text=(
+            "Always false: there are only six buckets and `by_input_size` ignores `limit` because "
+            "truncating by cost would drop whole buckets rather than individual rows."
+        )
+    )
+
+
 class _DayBreakdownSerializer(serializers.Serializer):
     items = _DayBreakdownRowSerializer(
         many=True,
@@ -437,13 +501,6 @@ class _BucketBreakdownSerializer(serializers.Serializer):
     )
 
 
-class _TopTracesSerializer(serializers.Serializer):
-    items = _TopTraceRowSerializer(many=True, help_text="Rows of top traces by cost, ordered by cost descending.")
-    truncated = serializers.BooleanField(
-        help_text="True when more rows exist beyond the requested `limit`. Re-request with a larger `limit` to retrieve them."
-    )
-
-
 class PersonalSpendAnalysisResponseSerializer(serializers.Serializer):
     """Structured personal LLM spend analysis for the requesting user."""
 
@@ -453,6 +510,13 @@ class PersonalSpendAnalysisResponseSerializer(serializers.Serializer):
     )
     by_tool = _ToolBreakdownSerializer(help_text="Spend grouped by tool. Scoped to `product` when set.")
     by_model = _ModelBreakdownSerializer(help_text="Spend grouped by `$ai_model`. Scoped to `product` when set.")
+    by_input_size = _InputSizeBreakdownSerializer(
+        help_text=(
+            "Spend grouped by `$ai_input_tokens` bucket. Scoped to `product`. Not subject to `limit`. This "
+            "is the primary cost driver: large-context turns dominate spend regardless of which tool they "
+            "called, so check this before attributing spend to a tool."
+        )
+    )
     by_day = _DayBreakdownSerializer(
         help_text="Spend grouped by UTC day, ordered ascending. Scoped to `product`. Not subject to `limit`."
     )
@@ -463,14 +527,6 @@ class PersonalSpendAnalysisResponseSerializer(serializers.Serializer):
             "Scoped to `product`. Only present when the request set `bucket_minutes`."
         ),
     )
-    top_traces = _TopTracesSerializer(
-        help_text=(
-            "Deprecated — always returns `{items: [], truncated: false}`. Trace IDs are opaque strings "
-            "that aren't actionable in the UI. Kept in the response shape so existing consumers don't "
-            "crash; remove your rendering of this field and we'll drop it from the response entirely "
-            "in a follow-up."
-        )
-    )
 
 
 def _email_filter(email: str) -> ast.Expr:
@@ -603,6 +659,60 @@ def _fetch_by_product(
     return _truncate(rows, limit)
 
 
+def _fetch_tool_cost_attribution(
+    team: Team,
+    email: str,
+    from_dt: datetime.datetime,
+    to_dt: datetime.datetime,
+    product: str,
+) -> dict[str | None, float]:
+    """Splits each generation's cost evenly across the DISTINCT tools it called,
+    so the sum across tools reconciles to the scoped generation cost instead of
+    overcounting co-occurring tools. `$ai_tools_called` can list the same tool more
+    than once (tools are recorded in call order, e.g. "Bash,Read,Bash"); `arrayDistinct`
+    collapses those repeats before dividing, since a tool called twice in one
+    generation still only "caused" that generation's cost once. Generations with no
+    tools attribute their full cost to the same NULL bucket the unattributed
+    `_fetch_by_tool` rows use. Not truncated by `limit` -- callers merge by `tool`
+    into an already-truncated row set, so untruncated tools here simply have no
+    matching row to attach to.
+    """
+    query = parse_select(
+        """
+        SELECT
+            tool,
+            round(sum(cost_share), 6) AS cost_attributed_usd
+        FROM (
+            SELECT
+                nullIf(arrayJoin(if(empty(tools), [''], tools)), '') AS tool,
+                cost / length(if(empty(tools), [''], tools)) AS cost_share
+            FROM (
+                SELECT
+                    arrayDistinct(arrayFilter(x -> x != '', splitByChar(',', coalesce(properties.$ai_tools_called, '')))) AS tools,
+                    toFloat(properties.$ai_total_cost_usd) AS cost
+                FROM events
+                WHERE equals(event, '$ai_generation')
+                    AND {product_filter}
+                    AND {email_filter}
+                    AND {timestamp_filter}
+            )
+        )
+        GROUP BY tool
+        """
+    )
+    result = execute_hogql_query(
+        query=query,
+        placeholders={
+            "product_filter": _product_filter(product),
+            "email_filter": _email_filter(email),
+            "timestamp_filter": _timestamp_filter(from_dt, to_dt),
+        },
+        team=team,
+        query_type="PersonalSpendToolCostAttribution",
+    )
+    return {(row[0] if row[0] is not None else None): float(row[1] or 0.0) for row in (result.results or [])}
+
+
 def _fetch_by_tool(
     team: Team,
     email: str,
@@ -652,7 +762,16 @@ def _fetch_by_tool(
         }
         for row in (result.results or [])
     ]
-    return _truncate(rows, limit)
+    truncated = _truncate(rows, limit)
+
+    # Merged by `tool` rather than requeried per-row: the attribution query isn't
+    # itself truncated, so a tool absent from the (possibly truncated) row set above
+    # just has no row to attach `cost_attributed_usd` to.
+    attribution = _fetch_tool_cost_attribution(team, email, from_dt, to_dt, product)
+    for row in truncated["items"]:
+        row["cost_attributed_usd"] = attribution.get(row["tool"], 0.0)
+
+    return truncated
 
 
 def _fetch_by_model(
@@ -706,6 +825,83 @@ def _fetch_by_model(
     return _truncate(rows, limit)
 
 
+def _input_size_bucket_case_sql() -> str:
+    """Builds the `multiIf(...)` branches from `INPUT_SIZE_BUCKETS`: each bucket (other
+    than the last) becomes `$ai_input_tokens < <next bucket's min>, '<label>'`, checked in
+    ascending order so `multiIf` matches the first (lowest) bucket the value clears; the
+    last bucket is the unconditional fallback. Bucket bounds are fixed constants defined
+    in this module, not request input, so interpolating them into the query text is safe.
+    """
+    branches = [
+        f"toFloat(properties.$ai_input_tokens) < {INPUT_SIZE_BUCKETS[i + 1][1]}, '{label}'"
+        for i, (label, _min_tokens) in enumerate(INPUT_SIZE_BUCKETS[:-1])
+    ]
+    fallback_label = INPUT_SIZE_BUCKETS[-1][0]
+    return f"multiIf({', '.join(branches)}, '{fallback_label}')"
+
+
+def _fetch_by_input_size(
+    team: Team,
+    email: str,
+    from_dt: datetime.datetime,
+    to_dt: datetime.datetime,
+    product: str,
+) -> dict[str, Any]:
+    """Buckets $ai_generation + $ai_embedding events by `$ai_input_tokens` -- the primary
+    cost driver, since large-context turns dominate spend regardless of which tool they
+    called. Same event set and product scoping as `_fetch_by_model`. Not subject to
+    `limit`: there are only as many rows as there are buckets (six), so truncating by
+    cost would drop whole buckets rather than individual rows."""
+    query = parse_select(
+        f"""
+        SELECT
+            {_input_size_bucket_case_sql()} AS bucket,
+            count() AS generation_count,
+            round(sum(toFloat(properties.$ai_total_cost_usd)), 6) AS cost_usd
+        FROM events
+        WHERE {{event_in}}
+            AND {{product_filter}}
+            AND {{email_filter}}
+            AND {{timestamp_filter}}
+        GROUP BY bucket
+        """
+    )
+    result = execute_hogql_query(
+        query=query,
+        placeholders={
+            "event_in": _event_in(["$ai_generation", "$ai_embedding"]),
+            "product_filter": _product_filter(product),
+            "email_filter": _email_filter(email),
+            "timestamp_filter": _timestamp_filter(from_dt, to_dt),
+        },
+        team=team,
+        query_type="PersonalSpendByInputSize",
+    )
+    rows_by_label = {
+        row[0]: {
+            "generation_count": int(row[1] or 0),
+            "cost_usd": float(row[2] or 0.0),
+        }
+        for row in (result.results or [])
+    }
+    items = [
+        {
+            "bucket": label,
+            "min_input_tokens": min_tokens,
+            "generation_count": rows_by_label[label]["generation_count"],
+            "cost_usd": rows_by_label[label]["cost_usd"],
+            "avg_cost_per_generation": (
+                rows_by_label[label]["cost_usd"] / rows_by_label[label]["generation_count"]
+                if rows_by_label[label]["generation_count"] > 0
+                else 0.0
+            ),
+        }
+        for label, min_tokens in INPUT_SIZE_BUCKETS
+        if label in rows_by_label
+    ]
+    return {"items": items, "truncated": False}
+
+
 def _fetch_by_day(
     team: Team,
     email: str,
@@ -877,26 +1073,31 @@ def _compute_spend_analysis(
         by_tool = _fetch_by_tool(team, email, from_dt, to_dt, product, limit)
         scoped = summary["scoped_cost_usd"] or 0.0
         # `cost_usd` in by_tool can exceed scoped_cost_usd because multi-tool generations
-        # contribute to every tool. `share_of_scoped` is independent per row, so agents can
-        # present headline percentages directly without reconciling sums.
+        # contribute to every tool; `share_of_scoped` is independent per row, so it can't
+        # be used as a headline percentage either -- see its help_text. `share_attributed`
+        # is `cost_attributed_usd` normalized the same way, and its sum across rows does
+        # reconcile to (at most) 1 -- see `cost_attributed_usd`'s help_text for why it can
+        # land slightly under 1 rather than exactly at it.
         for row in by_tool["items"]:
             row["share_of_scoped"] = (row["cost_usd"] / scoped) if scoped > 0 else 0.0
+            row["share_attributed"] = (row["cost_attributed_usd"] / scoped) if scoped > 0 else 0.0
+
+        by_input_size = _fetch_by_input_size(team, email, from_dt, to_dt, product)
+        for row in by_input_size["items"]:
+            row["share_of_scoped"] = (row["cost_usd"] / scoped) if scoped > 0 else 0.0
 
         payload = {
             "summary": summary,
             "by_product": _fetch_by_product(team, email, from_dt, to_dt, limit),
             "by_tool": by_tool,
             "by_model": _fetch_by_model(team, email, from_dt, to_dt, product, limit),
+            "by_input_size": by_input_size,
             "by_day": _fetch_by_day(team, email, from_dt, to_dt, product),
             **(
                 {"by_bucket": _fetch_by_bucket(team, email, from_dt, to_dt, product, bucket_minutes)}
                 if bucket_minutes is not None
                 else {}
             ),
-            # Deprecated — trace IDs are opaque and unactionable in the UI. Returned empty so
-            # existing consumers don't crash while they remove the rendering. Drop the field
-            # entirely once no consumer reads it.
-            "top_traces": {"items": [], "truncated": False},
         }
 
     response_data = PersonalSpendAnalysisResponseSerializer(payload).data
@@ -952,12 +1153,13 @@ class PersonalSpendViewSet(_PersonalSpendUserViewSet):
     when registered -- so this path should be comparable to what the
     satellite would have served. The endpoint is cached for 5 minutes per
     user (see `CACHE_TIMEOUT_SECONDS`). The `product` query param is required
-    and scopes tool / model / trace breakdowns to a single `ai_product`; see
-    `SUPPORTED_PRODUCTS` for the currently accepted values. `by_product` always
-    returns the full cross-product breakdown. The endpoint is only registered
-    on US Cloud + dev/test envs; hobby / self-hosted deploys never see this
-    URL; EU deploys serve it via `PersonalSpendEUProxyViewSet` (or a 302 to
-    the US URL while the cross-region secret is unprovisioned).
+    and scopes the tool / model / input-size / day breakdowns to a single
+    `ai_product`; see `SUPPORTED_PRODUCTS` for the currently accepted values.
+    `by_product` always returns the full cross-product breakdown. The
+    endpoint is only registered on US Cloud + dev/test envs; hobby /
+    self-hosted deploys never see this URL; EU deploys serve it via
+    `PersonalSpendEUProxyViewSet` (or a 302 to the US URL while the
+    cross-region secret is unprovisioned).
     """
 
     @extend_schema(
@@ -975,12 +1177,16 @@ class PersonalSpendViewSet(_PersonalSpendUserViewSet):
             "Return a structured personal LLM spend analysis for the requesting user. Pass "
             "`date_from` / `date_to` (absolute like `2026-04-23` or relative like `-7d`) to bound "
             "the window — defaults to the last 30 days, max 90 days. The `product=<ai_product>` "
-            "query param is required and scopes the tool / model / day / trace breakdowns to a single "
-            f"product; supported values: {', '.join(sorted(SUPPORTED_PRODUCTS))}. `by_product` is "
-            "always returned for cross-product visibility. `by_day` returns a day-ascending spend "
-            "series for the scoped product. Pass `bucket_minutes` (5, 15, 30, or 60; the window may span "
-            f"at most {MAX_TIME_BUCKETS} buckets) to additionally get `by_bucket`, a time-ascending "
-            "series with per-bucket cost split into uncached input / output / cache read / cache creation "
+            "query param is required and scopes the tool / model / input-size / day breakdowns to a "
+            f"single product; supported values: {', '.join(sorted(SUPPORTED_PRODUCTS))}. `by_product` "
+            "is always returned for cross-product visibility. `by_tool` reports both a co-occurrence "
+            "share (`share_of_scoped`) and an honest per-tool split (`cost_attributed_usd` / "
+            "`share_attributed`) that reconciles across rows. `by_input_size` groups spend by "
+            "`$ai_input_tokens` bucket and is usually the more useful lens: context size drives cost "
+            "regardless of which tool a turn called. `by_day` returns a day-ascending spend series for "
+            "the scoped product. Pass `bucket_minutes` (5, 15, 30, or 60; the window may span at most "
+            f"{MAX_TIME_BUCKETS} buckets) to additionally get `by_bucket`, a time-ascending series with "
+            "per-bucket cost split into uncached input / output / cache read / cache creation "
             "components. Use `refresh=true` to bypass the 5-minute response cache."
         ),
         tags=["AI observability"],
diff --git a/products/ai_observability/backend/api/test/test_personal_spend.py b/products/ai_observability/backend/api/test/test_personal_spend.py
index 6431c915f89a..149047e45d2c 100644
--- a/products/ai_observability/backend/api/test/test_personal_spend.py
+++ b/products/ai_observability/backend/api/test/test_personal_spend.py
@@ -277,8 +277,9 @@ def test_empty_result_when_no_events(self) -> None:
         assert body["by_product"] == {"items": [], "truncated": False}
         assert body["by_tool"] == {"items": [], "truncated": False}
         assert body["by_model"] == {"items": [], "truncated": False}
+        assert body["by_input_size"] == {"items": [], "truncated": False}
         assert body["by_day"] == {"items": [], "truncated": False}
-        assert body["top_traces"] == {"items": [], "truncated": False}
+        assert "top_traces" not in body
 
     def test_summary_reports_cross_product_totals_alongside_scoped(self) -> None:
         self._create_generation(ai_product="posthog_code", cost=2.0)
@@ -356,16 +357,97 @@ def test_by_tool_splits_comma_separated_tools(self) -> None:
         # Scoped total stays $3.50 — the multi-tool generation is only counted once there.
         assert response.json()["summary"]["scoped_cost_usd"] == 3.5
 
-    def test_top_traces_always_empty(self) -> None:
-        # `top_traces` is deprecated — kept in the response shape so existing consumers don't
-        # crash, but always returns empty. Trace IDs are opaque strings that aren't actionable
-        # in the UI.
+    def test_by_tool_cost_attributed_splits_evenly_across_distinct_tools(self) -> None:
+        # Same fixture as test_by_tool_splits_comma_separated_tools: a multi-tool generation
+        # plus two single-tool generations. Unlike `cost_usd` (which double-counts the
+        # multi-tool generation into both rows), `cost_attributed_usd` must split its $2.0
+        # evenly across Bash and Read so the per-tool sum reconciles to scoped_cost_usd
+        # instead of overcounting -- this is the regression the whole PR exists to fix.
+        self._create_generation(tool="Bash,Read", cost=2.0, trace_id="multi")
+        self._create_generation(tool="Bash", cost=1.0, trace_id="bash-only")
+        self._create_generation(tool="Read", cost=0.5, trace_id="read-only")
+        flush_persons_and_events()
+
+        response = self.client.get(f"{ENDPOINT}?product=posthog_code")
+        body = response.json()
+        rows = {r["tool"]: r for r in body["by_tool"]["items"]}
+
+        # Bash: $1.0 (bash-only) + $1.0 (half of the $2.0 multi-tool generation) = $2.0.
+        assert rows["Bash"]["cost_attributed_usd"] == 2.0
+        # Read: $0.5 (read-only) + $1.0 (half of the $2.0 multi-tool generation) = $1.5.
+        assert rows["Read"]["cost_attributed_usd"] == 1.5
+        # `cost_usd` still double-counts (unchanged, existing behavior) -- the two fields
+        # must genuinely differ, not just both exist.
+        assert rows["Bash"]["cost_usd"] == 3.0
+        assert rows["Read"]["cost_usd"] == 2.5
+
+        # Attributed cost reconciles to scoped_cost_usd; cost_usd does not ($5.5 > $3.5).
+        scoped = body["summary"]["scoped_cost_usd"]
+        assert scoped == 3.5
+        assert sum(r["cost_attributed_usd"] for r in rows.values()) == scoped
+        assert sum(r["cost_usd"] for r in rows.values()) != scoped
+
+        # share_attributed is cost_attributed_usd normalized the same way, and reconciles too.
+        assert rows["Bash"]["share_attributed"] == 2.0 / 3.5
+        assert rows["Read"]["share_attributed"] == 1.5 / 3.5
+        assert sum(r["share_attributed"] for r in rows.values()) == 1.0
+
+    def test_by_tool_cost_attributed_falls_back_to_null_tool_for_no_tools(self) -> None:
+        # A generation with no tools attributes its full cost to the same NULL `tool`
+        # bucket the existing (unattributed) rows already use for "no tool called".
+        self._create_generation(tool=None, cost=1.0)
+        flush_persons_and_events()
+
+        response = self.client.get(f"{ENDPOINT}?product=posthog_code")
+        rows = {r["tool"]: r for r in response.json()["by_tool"]["items"]}
+        assert rows.keys() == {None}
+        assert rows[None]["cost_attributed_usd"] == 1.0
+
+    def test_by_input_size_buckets_generations_by_input_tokens(self) -> None:
+        # One generation per bucket boundary, each with a distinguishing cost so the
+        # buckets can't be confused for one another.
+        self._create_generation(cost=1.0, input_tokens=10_000, trace_id="under-50k")
+        self._create_generation(cost=2.0, input_tokens=75_000, trace_id="50k-100k")
+        self._create_generation(cost=4.0, input_tokens=350_000, trace_id="over-300k")
+        # An embedding counts too -- by_input_size uses the same event set as by_model.
+        self._create_generation(cost=0.5, input_tokens=5_000, event_name="$ai_embedding", trace_id="embedding")
+        flush_persons_and_events()
+
+        response = self.client.get(ENDPOINT_OK)
+        body = response.json()
+        by_bucket = {r["bucket"]: r for r in body["by_input_size"]["items"]}
+
+        assert by_bucket["<50k"]["generation_count"] == 2  # the 10k generation + the 5k embedding
+        assert by_bucket["<50k"]["cost_usd"] == 1.5
+        assert by_bucket["<50k"]["min_input_tokens"] == 0
+        assert by_bucket["50k-100k"]["generation_count"] == 1
+        assert by_bucket["50k-100k"]["cost_usd"] == 2.0
+        assert by_bucket["50k-100k"]["min_input_tokens"] == 50_000
+        assert by_bucket[">300k"]["generation_count"] == 1
+        assert by_bucket[">300k"]["cost_usd"] == 4.0
+        assert by_bucket[">300k"]["min_input_tokens"] == 300_000
+        # Buckets with no events are omitted, not zero-filled.
+        assert set(by_bucket) == {"<50k", "50k-100k", ">300k"}
+
+        # Ordered ascending by min_input_tokens, not by cost.
+        assert [r["bucket"] for r in body["by_input_size"]["items"]] == ["<50k", "50k-100k", ">300k"]
+
+        # cost_usd across buckets reconciles to scoped_cost_usd.
+        scoped = body["summary"]["scoped_cost_usd"]
+        assert scoped == 7.5
+        assert sum(r["cost_usd"] for r in body["by_input_size"]["items"]) == scoped
+        assert sum(r["share_of_scoped"] for r in body["by_input_size"]["items"]) == 1.0
+        assert by_bucket["<50k"]["avg_cost_per_generation"] == 0.75
+
+    def test_top_traces_removed_from_response(self) -> None:
+        # `top_traces` was dropped entirely -- confirmed unused by the PostHog/code client,
+        # which already stopped rendering it. A stale client reading the field just sees it
+        # missing rather than the old always-empty placeholder.
         self._create_generation(trace_id="cheap", cost=0.5)
-        self._create_generation(trace_id="expensive", cost=5.0)
         flush_persons_and_events()
 
         response = self.client.get(ENDPOINT_OK)
-        assert response.json()["top_traces"] == {"items": [], "truncated": False}
+        assert "top_traces" not in response.json()
 
     def test_other_users_spend_is_not_visible(self) -> None:
         other_email = "other-user@example.com"
@@ -394,9 +476,9 @@ def test_date_window_passes_through_to_query_layer(self) -> None:
             response = self.client.get(f"{ENDPOINT}?{PRODUCT_QS}&date_from=-7d")
 
         assert response.status_code == status.HTTP_200_OK
-        # 5 fetchers run once (summary, by_product, by_tool, by_model, by_day). top_traces
-        # is deprecated and returned empty without a query.
-        assert mock_exec.call_count == 5
+        # 7 queries run once: summary, by_product, by_tool (+ its cost-attribution
+        # sub-query), by_model, by_input_size, by_day.
+        assert mock_exec.call_count == 7
 
     def test_second_call_serves_from_cache(self) -> None:
         with patch("products.ai_observability.backend.api.personal_spend.execute_hogql_query") as mock_exec:
diff --git a/products/ai_observability/frontend/generated/api.schemas.ts b/products/ai_observability/frontend/generated/api.schemas.ts
index ff6fc2e31d67..06981999d802 100644
--- a/products/ai_observability/frontend/generated/api.schemas.ts
+++ b/products/ai_observability/frontend/generated/api.schemas.ts
@@ -12,7 +12,7 @@ export interface _SummaryApi {
     date_from: string
     /** Exclusive UTC end of the spend window resolved from the request. */
     date_to: string
-    /** The `ai_product` filter applied to tool / model / trace breakdowns — echoes the request `product`. */
+    /** The `ai_product` filter applied to tool / model / input-size / day breakdowns — echoes the request `product`. */
     product: string
     /** Total LLM cost in USD across every `ai_product` for the user — independent of the `product` filter. */
     total_cost_usd: number
@@ -45,18 +45,22 @@ export interface _ProductBreakdownApi {
 
 export interface _ToolBreakdownRowApi {
     /**
-     * Individual tool name from `$ai_tools_called` (split on `,` since multi-tool generations store a comma-separated list). Null = pure text response with no tool call.
+     * Individual tool name from `$ai_tools_called` (split on `,` since multi-tool generations store a comma-separated list). Null = pure text response with no tool call. Skill invocations all collapse to the single `Skill` token, because the specific skill name isn't recorded at ingestion — treat that row as an upper bound across every skill combined, not any one skill.
      * @nullable
      */
     tool: string | null
     /** Number of $ai_generation events whose tool list includes this tool. */
     generation_count: number
-    /** Sum of `$ai_total_cost_usd` for generations whose tool list includes this tool. Multi-tool generations contribute their full cost to every tool they invoked, so this sum can exceed `summary.scoped_cost_usd`. Prefer `share_of_scoped` for headline percentages — it's computed per row and doesn't require the totals to reconcile. */
+    /** Sum of `$ai_total_cost_usd` for generations whose tool list includes this tool. Multi-tool generations contribute their full cost to every tool they invoked, so this sum can exceed `summary.scoped_cost_usd` and rows can't be added together. It measures co-occurrence, not cost caused by the tool. Use `cost_attributed_usd` for a number that reconciles. */
     cost_usd: number
-    /** This tool's share of `summary.scoped_cost_usd`, expressed as a float in `[0, 1]`. Independent per row, so co-occurring tools can each show a substantial share — the headline number to present (e.g. `'Bash drove 47% of your spend'`). */
+    /** This tool's share of `summary.scoped_cost_usd`, expressed as a float in `[0, 1]`. Computed independently per row from `cost_usd`, so it inherits the same co-occurrence overstatement: a tool that's simply present in most generations (e.g. Bash) shows a large share even when it isn't what drove the cost, and shares across rows don't reconcile to 1. Use `share_attributed` for an honest per-tool percentage. */
     share_of_scoped: number
     /** Average `$ai_input_tokens` across these generations — high values signal context bloat per call. */
     avg_input_tokens: number
+    /** This tool's fractional share of generation cost: each generation's `$ai_total_cost_usd` is divided evenly across the distinct tools it called, and a generation that called no tools attributes its full cost to this same null `tool` row. Summed across all rows (when not truncated), this reconciles to `summary.scoped_cost_usd` for the GENERATION cost only -- embeddings carry no tools, so they're excluded here and the sum can land slightly under the full scoped cost. Prefer this over `cost_usd` for an honest per-tool number. */
+    cost_attributed_usd: number
+    /** `cost_attributed_usd` normalized to `summary.scoped_cost_usd`, as a float in `[0, 1]`. Shares across rows reconcile (summing to at most 1, short by the embedding-cost fraction which carries no tools) — this is the honest headline percentage, unlike `share_of_scoped`. */
+    share_attributed: number
 }
 
 export interface _ToolBreakdownApi {
@@ -89,6 +93,28 @@ export interface _ModelBreakdownApi {
     truncated: boolean
 }
 
+export interface _InputSizeBreakdownRowApi {
+    /** Label for this `$ai_input_tokens` bucket (e.g. `100k-150k`). Buckets: <50k, 50k-100k, 100k-150k, 150k-200k, 200k-300k, >300k. */
+    bucket: string
+    /** Inclusive lower bound of `$ai_input_tokens` for this bucket. Use to order or re-derive the bucket. */
+    min_input_tokens: number
+    /** Number of $ai_generation + $ai_embedding events with `$ai_input_tokens` in this bucket. */
+    generation_count: number
+    /** Sum of `$ai_total_cost_usd` for events in this bucket. */
+    cost_usd: number
+    /** This bucket's share of `summary.scoped_cost_usd`, as a float in `[0, 1]`. Reconciles across buckets. */
+    share_of_scoped: number
+    /** Average `$ai_total_cost_usd` per event in this bucket -- `cost_usd / generation_count`. */
+    avg_cost_per_generation: number
+}
+
+export interface _InputSizeBreakdownApi {
+    /** One row per `$ai_input_tokens` bucket that has events, ordered by `min_input_tokens` ascending. This is the primary cost driver: large-context turns dominate spend regardless of which tool they called, so check this before attributing spend to a tool. Buckets with no events are omitted. */
+    items: _InputSizeBreakdownRowApi[]
+    /** Always false: there are only six buckets and `by_input_size` ignores `limit` because truncating by cost would drop whole buckets rather than individual rows. */
+    truncated: boolean
+}
+
 export interface _DayBreakdownRowApi {
     /** UTC calendar day the events fall on (`toDate(timestamp)`). */
     day: string
@@ -139,30 +165,6 @@ export interface _BucketBreakdownApi {
     truncated: boolean
 }
 
-export interface _TopTraceRowApi {
-    /**
-     * `$ai_trace_id` of the session — opaque string scoped to the originating product. Format is not stable: most are UUIDs but some SDK wrappers emit JSON-shaped strings like `{"device_id":"...","session_id":"..."}`. Callers should treat this as an opaque identifier (URL-encode before linking to a trace view).
-     * @nullable
-     */
-    trace_id: string | null
-    /** Number of $ai_generation events in this trace. */
-    generation_count: number
-    /** Total cost in USD for this trace. */
-    cost_usd: number
-    /**
-     * Timestamp of the earliest event in this trace.
-     * @nullable
-     */
-    started_at: string | null
-}
-
-export interface _TopTracesApi {
-    /** Rows of top traces by cost, ordered by cost descending. */
-    items: _TopTraceRowApi[]
-    /** True when more rows exist beyond the requested `limit`. Re-request with a larger `limit` to retrieve them. */
-    truncated: boolean
-}
-
 /**
  * Structured personal LLM spend analysis for the requesting user.
  */
@@ -175,12 +177,12 @@ export interface PersonalSpendAnalysisResponseApi {
     by_tool: _ToolBreakdownApi
     /** Spend grouped by `$ai_model`. Scoped to `product` when set. */
     by_model: _ModelBreakdownApi
+    /** Spend grouped by `$ai_input_tokens` bucket. Scoped to `product`. Not subject to `limit`. This is the primary cost driver: large-context turns dominate spend regardless of which tool they called, so check this before attributing spend to a tool. */
+    by_input_size: _InputSizeBreakdownApi
     /** Spend grouped by UTC day, ordered ascending. Scoped to `product`. Not subject to `limit`. */
     by_day: _DayBreakdownApi
     /** Spend grouped by UTC time bucket with per-bucket cost/token components, ordered ascending. Scoped to `product`. Only present when the request set `bucket_minutes`. */
     by_bucket?: _BucketBreakdownApi
-    /** Deprecated — always returns `{items: [], truncated: false}`. Trace IDs are opaque strings that aren't actionable in the UI. Kept in the response shape so existing consumers don't crash; remove your rendering of this field and we'll drop it from the response entirely in a follow-up. */
-    top_traces: _TopTracesApi
 }
 
 /**
@@ -2583,7 +2585,7 @@ export type LlmAnalyticsPersonalSpendListParams = {
      */
     limit?: number
     /**
-     * Required `ai_product` key to scope the tool / model / trace breakdowns to a single product. Only the following products are currently supported: posthog_code.
+     * Required `ai_product` key to scope the tool / model / input-size / day breakdowns to a single product. Only the following products are currently supported: posthog_code.
      * @minLength 1
      * @maxLength 64
      */
diff --git a/products/ai_observability/frontend/generated/api.ts b/products/ai_observability/frontend/generated/api.ts
index eacf8c3e55ac..95f70397230a 100644
--- a/products/ai_observability/frontend/generated/api.ts
+++ b/products/ai_observability/frontend/generated/api.ts
@@ -142,7 +142,7 @@ export const getLlmAnalyticsPersonalSpendListUrl = (params: LlmAnalyticsPersonal
 }
 
 /**
- * Return a structured personal LLM spend analysis for the requesting user. Pass `date_from` / `date_to` (absolute like `2026-04-23` or relative like `-7d`) to bound the window — defaults to the last 30 days, max 90 days. The `product=<ai_product>` query param is required and scopes the tool / model / day / trace breakdowns to a single product; supported values: posthog_code. `by_product` is always returned for cross-product visibility. `by_day` returns a day-ascending spend series for the scoped product. Pass `bucket_minutes` (5, 15, 30, or 60; the window may span at most 600 buckets) to additionally get `by_bucket`, a time-ascending series with per-bucket cost split into uncached input / output / cache read / cache creation components. Use `refresh=true` to bypass the 5-minute response cache.
+ * Return a structured personal LLM spend analysis for the requesting user. Pass `date_from` / `date_to` (absolute like `2026-04-23` or relative like `-7d`) to bound the window — defaults to the last 30 days, max 90 days. The `product=<ai_product>` query param is required and scopes the tool / model / input-size / day breakdowns to a single product; supported values: posthog_code. `by_product` is always returned for cross-product visibility. `by_tool` reports both a co-occurrence share (`share_of_scoped`) and an honest per-tool split (`cost_attributed_usd` / `share_attributed`) that reconciles across rows. `by_input_size` groups spend by `$ai_input_tokens` bucket and is usually the more useful lens: context size drives cost regardless of which tool a turn called. `by_day` returns a day-ascending spend series for the scoped product. Pass `bucket_minutes` (5, 15, 30, or 60; the window may span at most 600 buckets) to additionally get `by_bucket`, a time-ascending series with per-bucket cost split into uncached input / output / cache read / cache creation components. Use `refresh=true` to bypass the 5-minute response cache.
  */
 export const llmAnalyticsPersonalSpendList = async (
     params: LlmAnalyticsPersonalSpendListParams,
diff --git a/products/ai_observability/mcp/tools.yaml b/products/ai_observability/mcp/tools.yaml
index 1d7e938d9741..d3c9077985cd 100644
--- a/products/ai_observability/mcp/tools.yaml
+++ b/products/ai_observability/mcp/tools.yaml
@@ -468,10 +468,15 @@ tools:
         title: Get my LLM spend analysis
         description: >
             Retrieve the current user's personal LLM spend analysis across PostHog products over the last N days
-            (default 30, max 90). Returns a summary plus breakdowns by product, tool, model and UTC day. The `product`
-            query param is required and scopes the tool / model / day breakdowns to a single product; currently only
-            `posthog_code` is supported. `by_product` always returns the cross-product view, and `by_day` is a
-            day-ascending series for spend-over-time questions. Pass `refresh=true` to bypass the 5-minute cache.
+            (default 30, max 90). Returns a summary plus breakdowns by product, tool, model, input-size bucket and
+            UTC day. The `product` query param is required and scopes the tool / model / input-size / day
+            breakdowns to a single product; currently only `posthog_code` is supported. `by_product` always
+            returns the cross-product view, and `by_day` is a day-ascending series for spend-over-time questions.
+            `by_input_size` groups spend by `$ai_input_tokens` bucket and is usually the more useful lens than
+            `by_tool`, since context size drives cost regardless of which tool a turn called; use
+            `cost_attributed_usd` / `share_attributed` on `by_tool` rows for an honest per-tool split rather than
+            `cost_usd` / `share_of_scoped`, which overstate ubiquitous tools. Pass `refresh=true` to bypass the
+            5-minute cache.
     llma-prompt-archive:
         operation: llm_prompts_name_archive_create
         enabled: false
diff --git a/services/mcp/schema/generated-tool-definitions.json b/services/mcp/schema/generated-tool-definitions.json
index 18dc624e2072..1da12bcb682c 100644
--- a/services/mcp/schema/generated-tool-definitions.json
+++ b/services/mcp/schema/generated-tool-definitions.json
@@ -5531,7 +5531,7 @@
         }
     },
     "llma-personal-spend": {
-        "description": "Retrieve the current user's personal LLM spend analysis across PostHog products over the last N days (default 30, max 90). Returns a summary plus breakdowns by product, tool, model and UTC day. The `product` query param is required and scopes the tool / model / day breakdowns to a single product; currently only `posthog_code` is supported. `by_product` always returns the cross-product view, and `by_day` is a day-ascending series for spend-over-time questions. Pass `refresh=true` to bypass the 5-minute cache.",
+        "description": "Retrieve the current user's personal LLM spend analysis across PostHog products over the last N days (default 30, max 90). Returns a summary plus breakdowns by product, tool, model, input-size bucket and UTC day. The `product` query param is required and scopes the tool / model / input-size / day breakdowns to a single product; currently only `posthog_code` is supported. `by_product` always returns the cross-product view, and `by_day` is a day-ascending series for spend-over-time questions. `by_input_size` groups spend by `$ai_input_tokens` bucket and is usually the more useful lens than `by_tool`, since context size drives cost regardless of which tool a turn called; use `cost_attributed_usd` / `share_attributed` on `by_tool` rows for an honest per-tool split rather than `cost_usd` / `share_of_scoped`, which overstate ubiquitous tools. Pass `refresh=true` to bypass the 5-minute cache.",
         "category": "AI observability",
         "feature": "llm_analytics",
         "summary": "Get my LLM spend analysis",
diff --git a/services/mcp/schema/tool-definitions-all.json b/services/mcp/schema/tool-definitions-all.json
index 217faeaa0487..c0a82a0aea94 100644
--- a/services/mcp/schema/tool-definitions-all.json
+++ b/services/mcp/schema/tool-definitions-all.json
@@ -5840,7 +5840,7 @@
         }
     },
     "llma-personal-spend": {
-        "description": "Retrieve the current user's personal LLM spend analysis across PostHog products over the last N days (default 30, max 90). Returns a summary plus breakdowns by product, tool, model and UTC day. The `product` query param is required and scopes the tool / model / day breakdowns to a single product; currently only `posthog_code` is supported. `by_product` always returns the cross-product view, and `by_day` is a day-ascending series for spend-over-time questions. Pass `refresh=true` to bypass the 5-minute cache.",
+        "description": "Retrieve the current user's personal LLM spend analysis across PostHog products over the last N days (default 30, max 90). Returns a summary plus breakdowns by product, tool, model, input-size bucket and UTC day. The `product` query param is required and scopes the tool / model / input-size / day breakdowns to a single product; currently only `posthog_code` is supported. `by_product` always returns the cross-product view, and `by_day` is a day-ascending series for spend-over-time questions. `by_input_size` groups spend by `$ai_input_tokens` bucket and is usually the more useful lens than `by_tool`, since context size drives cost regardless of which tool a turn called; use `cost_attributed_usd` / `share_attributed` on `by_tool` rows for an honest per-tool split rather than `cost_usd` / `share_of_scoped`, which overstate ubiquitous tools. Pass `refresh=true` to bypass the 5-minute cache.",
         "category": "AI observability",
         "feature": "llm_analytics",
         "summary": "Get my LLM spend analysis",
diff --git a/services/mcp/src/api/generated.ts b/services/mcp/src/api/generated.ts
index 837d5fc980c6..dc97400c8e32 100644
--- a/services/mcp/src/api/generated.ts
+++ b/services/mcp/src/api/generated.ts
@@ -53887,7 +53887,7 @@ export namespace Schemas {
       date_from: string;
       /** Exclusive UTC end of the spend window resolved from the request. */
       date_to: string;
-      /** The `ai_product` filter applied to tool / model / trace breakdowns — echoes the request `product`. */
+      /** The `ai_product` filter applied to tool / model / input-size / day breakdowns — echoes the request `product`. */
       product: string;
       /** Total LLM cost in USD across every `ai_product` for the user — independent of the `product` filter. */
       total_cost_usd: number;
@@ -53920,18 +53920,22 @@ export namespace Schemas {
 
     export interface _ToolBreakdownRow {
       /**
-         * Individual tool name from `$ai_tools_called` (split on `,` since multi-tool generations store a comma-separated list). Null = pure text response with no tool call.
+         * Individual tool name from `$ai_tools_called` (split on `,` since multi-tool generations store a comma-separated list). Null = pure text response with no tool call. Skill invocations all collapse to the single `Skill` token, because the specific skill name isn't recorded at ingestion — treat that row as an upper bound across every skill combined, not any one skill.
          * @nullable
          */
       tool: string | null;
       /** Number of $ai_generation events whose tool list includes this tool. */
       generation_count: number;
-      /** Sum of `$ai_total_cost_usd` for generations whose tool list includes this tool. Multi-tool generations contribute their full cost to every tool they invoked, so this sum can exceed `summary.scoped_cost_usd`. Prefer `share_of_scoped` for headline percentages — it's computed per row and doesn't require the totals to reconcile. */
+      /** Sum of `$ai_total_cost_usd` for generations whose tool list includes this tool. Multi-tool generations contribute their full cost to every tool they invoked, so this sum can exceed `summary.scoped_cost_usd` and rows can't be added together. It measures co-occurrence, not cost caused by the tool. Use `cost_attributed_usd` for a number that reconciles. */
       cost_usd: number;
-      /** This tool's share of `summary.scoped_cost_usd`, expressed as a float in `[0, 1]`. Independent per row, so co-occurring tools can each show a substantial share — the headline number to present (e.g. `'Bash drove 47% of your spend'`). */
+      /** This tool's share of `summary.scoped_cost_usd`, expressed as a float in `[0, 1]`. Computed independently per row from `cost_usd`, so it inherits the same co-occurrence overstatement: a tool that's simply present in most generations (e.g. Bash) shows a large share even when it isn't what drove the cost, and shares across rows don't reconcile to 1. Use `share_attributed` for an honest per-tool percentage. */
       share_of_scoped: number;
       /** Average `$ai_input_tokens` across these generations — high values signal context bloat per call. */
       avg_input_tokens: number;
+      /** This tool's fractional share of generation cost: each generation's `$ai_total_cost_usd` is divided evenly across the distinct tools it called, and a generation that called no tools attributes its full cost to this same null `tool` row. Summed across all rows (when not truncated), this reconciles to `summary.scoped_cost_usd` for the GENERATION cost only -- embeddings carry no tools, so they're excluded here and the sum can land slightly under the full scoped cost. Prefer this over `cost_usd` for an honest per-tool number. */
+      cost_attributed_usd: number;
+      /** `cost_attributed_usd` normalized to `summary.scoped_cost_usd`, as a float in `[0, 1]`. Shares across rows reconcile (summing to at most 1, short by the embedding-cost fraction which carries no tools) — this is the honest headline percentage, unlike `share_of_scoped`. */
+      share_attributed: number;
     }
 
     export interface _ToolBreakdown {
@@ -53964,6 +53968,28 @@ export namespace Schemas {
       truncated: boolean;
     }
 
+    export interface _InputSizeBreakdownRow {
+      /** Label for this `$ai_input_tokens` bucket (e.g. `100k-150k`). Buckets: <50k, 50k-100k, 100k-150k, 150k-200k, 200k-300k, >300k. */
+      bucket: string;
+      /** Inclusive lower bound of `$ai_input_tokens` for this bucket. Use to order or re-derive the bucket. */
+      min_input_tokens: number;
+      /** Number of $ai_generation + $ai_embedding events with `$ai_input_tokens` in this bucket. */
+      generation_count: number;
+      /** Sum of `$ai_total_cost_usd` for events in this bucket. */
+      cost_usd: number;
+      /** This bucket's share of `summary.scoped_cost_usd`, as a float in `[0, 1]`. Reconciles across buckets. */
+      share_of_scoped: number;
+      /** Average `$ai_total_cost_usd` per event in this bucket -- `cost_usd / generation_count`. */
+      avg_cost_per_generation: number;
+    }
+
+    export interface _InputSizeBreakdown {
+      /** One row per `$ai_input_tokens` bucket that has events, ordered by `min_input_tokens` ascending. This is the primary cost driver: large-context turns dominate spend regardless of which tool they called, so check this before attributing spend to a tool. Buckets with no events are omitted. */
+      items: _InputSizeBreakdownRow[];
+      /** Always false: there are only six buckets and `by_input_size` ignores `limit` because truncating by cost would drop whole buckets rather than individual rows. */
+      truncated: boolean;
+    }
+
     export interface _DayBreakdownRow {
       /** UTC calendar day the events fall on (`toDate(timestamp)`). */
       day: string;
@@ -54014,30 +54040,6 @@ export namespace Schemas {
       truncated: boolean;
     }
 
-    export interface _TopTraceRow {
-      /**
-         * `$ai_trace_id` of the session — opaque string scoped to the originating product. Format is not stable: most are UUIDs but some SDK wrappers emit JSON-shaped strings like `{"device_id":"...","session_id":"..."}`. Callers should treat this as an opaque identifier (URL-encode before linking to a trace view).
-         * @nullable
-         */
-      trace_id: string | null;
-      /** Number of $ai_generation events in this trace. */
-      generation_count: number;
-      /** Total cost in USD for this trace. */
-      cost_usd: number;
-      /**
-         * Timestamp of the earliest event in this trace.
-         * @nullable
-         */
-      started_at: string | null;
-    }
-
-    export interface _TopTraces {
-      /** Rows of top traces by cost, ordered by cost descending. */
-      items: _TopTraceRow[];
-      /** True when more rows exist beyond the requested `limit`. Re-request with a larger `limit` to retrieve them. */
-      truncated: boolean;
-    }
-
     /**
      * Structured personal LLM spend analysis for the requesting user.
      */
@@ -54050,12 +54052,12 @@ export namespace Schemas {
       by_tool: _ToolBreakdown;
       /** Spend grouped by `$ai_model`. Scoped to `product` when set. */
       by_model: _ModelBreakdown;
+      /** Spend grouped by `$ai_input_tokens` bucket. Scoped to `product`. Not subject to `limit`. This is the primary cost driver: large-context turns dominate spend regardless of which tool they called, so check this before attributing spend to a tool. */
+      by_input_size: _InputSizeBreakdown;
       /** Spend grouped by UTC day, ordered ascending. Scoped to `product`. Not subject to `limit`. */
       by_day: _DayBreakdown;
       /** Spend grouped by UTC time bucket with per-bucket cost/token components, ordered ascending. Scoped to `product`. Only present when the request set `bucket_minutes`. */
       by_bucket?: _BucketBreakdown;
-      /** Deprecated — always returns `{items: [], truncated: false}`. Trace IDs are opaque strings that aren't actionable in the UI. Kept in the response shape so existing consumers don't crash; remove your rendering of this field and we'll drop it from the response entirely in a follow-up. */
-      top_traces: _TopTraces;
     }
 
     export interface PgAnalyzeIssueReference {
@@ -71552,7 +71554,7 @@ export namespace Schemas {
      */
     limit?: number;
     /**
-     * Required `ai_product` key to scope the tool / model / trace breakdowns to a single product. Only the following products are currently supported: posthog_code.
+     * Required `ai_product` key to scope the tool / model / input-size / day breakdowns to a single product. Only the following products are currently supported: posthog_code.
      * @minLength 1
      * @maxLength 64
      */
diff --git a/services/mcp/src/generated/ai_observability/api.ts b/services/mcp/src/generated/ai_observability/api.ts
index 087baa16ecb1..14f044df72fa 100644
--- a/services/mcp/src/generated/ai_observability/api.ts
+++ b/services/mcp/src/generated/ai_observability/api.ts
@@ -9,7 +9,7 @@
 import * as zod from 'zod'
 
 /**
- * Return a structured personal LLM spend analysis for the requesting user. Pass `date_from` / `date_to` (absolute like `2026-04-23` or relative like `-7d`) to bound the window — defaults to the last 30 days, max 90 days. The `product=<ai_product>` query param is required and scopes the tool / model / day / trace breakdowns to a single product; supported values: posthog_code. `by_product` is always returned for cross-product visibility. `by_day` returns a day-ascending spend series for the scoped product. Pass `bucket_minutes` (5, 15, 30, or 60; the window may span at most 600 buckets) to additionally get `by_bucket`, a time-ascending series with per-bucket cost split into uncached input / output / cache read / cache creation components. Use `refresh=true` to bypass the 5-minute response cache.
+ * Return a structured personal LLM spend analysis for the requesting user. Pass `date_from` / `date_to` (absolute like `2026-04-23` or relative like `-7d`) to bound the window — defaults to the last 30 days, max 90 days. The `product=<ai_product>` query param is required and scopes the tool / model / input-size / day breakdowns to a single product; supported values: posthog_code. `by_product` is always returned for cross-product visibility. `by_tool` reports both a co-occurrence share (`share_of_scoped`) and an honest per-tool split (`cost_attributed_usd` / `share_attributed`) that reconciles across rows. `by_input_size` groups spend by `$ai_input_tokens` bucket and is usually the more useful lens: context size drives cost regardless of which tool a turn called. `by_day` returns a day-ascending spend series for the scoped product. Pass `bucket_minutes` (5, 15, 30, or 60; the window may span at most 600 buckets) to additionally get `by_bucket`, a time-ascending series with per-bucket cost split into uncached input / output / cache read / cache creation components. Use `refresh=true` to bypass the 5-minute response cache.
  */
 export const llmAnalyticsPersonalSpendListQueryDateFromDefault = `-30d`
 export const llmAnalyticsPersonalSpendListQueryDateFromMax = 32
@@ -56,7 +56,7 @@ export const LlmAnalyticsPersonalSpendListQueryParams = /* @__PURE__ */ zod.obje
         .min(1)
         .max(llmAnalyticsPersonalSpendListQueryProductMax)
         .describe(
-            'Required `ai_product` key to scope the tool / model / trace breakdowns to a single product. Only the following products are currently supported: posthog_code.'
+            'Required `ai_product` key to scope the tool / model / input-size / day breakdowns to a single product. Only the following products are currently supported: posthog_code.'
         ),
     refresh: zod
         .boolean()

From a00ad9f4739c2fbaa756bf31c62daa281a7eb043 Mon Sep 17 00:00:00 2001
From: Paul D'Ambra <paul@posthog.com>
Date: Thu, 23 Jul 2026 22:51:26 +0100
Subject: [PATCH 2/8] chore(aio): extract _share_of helper for scoped-cost
 shares

Collapse the three repeated `(value / scoped) if scoped > 0 else 0.0`
share computations (by_tool.share_of_scoped, by_tool.share_attributed,
by_input_size.share_of_scoped) into one guarded helper.

Generated-By: PostHog Code
Task-Id: 68fa35a8-56d2-4be3-a0c9-d870e966acd2
---
 .../ai_observability/backend/api/personal_spend.py    | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/products/ai_observability/backend/api/personal_spend.py b/products/ai_observability/backend/api/personal_spend.py
index 001200c7e419..1119ab3e45bb 100644
--- a/products/ai_observability/backend/api/personal_spend.py
+++ b/products/ai_observability/backend/api/personal_spend.py
@@ -584,6 +584,11 @@ def _truncate(rows: list[dict[str, Any]], limit: int) -> dict[str, Any]:
     return {"items": rows[:limit], "truncated": len(rows) > limit}
 
 
+def _share_of(value: float, scoped: float) -> float:
+    """Fraction of scoped cost in `[0, 1]`, guarding the empty-window (`scoped == 0`) case."""
+    return (value / scoped) if scoped > 0 else 0.0
+
+
 def _fetch_summary(
     team: Team, email: str, from_dt: datetime.datetime, to_dt: datetime.datetime, product: str
 ) -> dict[str, Any]:
@@ -1079,12 +1084,12 @@ def _compute_spend_analysis(
         # reconcile to (at most) 1 -- see `cost_attributed_usd`'s help_text for why it can
         # land slightly under 1 rather than exactly at it.
         for row in by_tool["items"]:
-            row["share_of_scoped"] = (row["cost_usd"] / scoped) if scoped > 0 else 0.0
-            row["share_attributed"] = (row["cost_attributed_usd"] / scoped) if scoped > 0 else 0.0
+            row["share_of_scoped"] = _share_of(row["cost_usd"], scoped)
+            row["share_attributed"] = _share_of(row["cost_attributed_usd"], scoped)
 
         by_input_size = _fetch_by_input_size(team, email, from_dt, to_dt, product)
         for row in by_input_size["items"]:
-            row["share_of_scoped"] = (row["cost_usd"] / scoped) if scoped > 0 else 0.0
+            row["share_of_scoped"] = _share_of(row["cost_usd"], scoped)
 
         payload = {
             "summary": summary,

From 25c6f404bcaa50b59a0e9b9b42a5b9ba0c8b5041 Mon Sep 17 00:00:00 2001
From: "tests-posthog[bot]"
 <250237707+tests-posthog[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:19:25 +0000
Subject: [PATCH 3/8] test(mcp): update unit test snapshots

---
 .../unit/__snapshots__/tool-schemas/llma-personal-spend.json    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/mcp/tests/unit/__snapshots__/tool-schemas/llma-personal-spend.json b/services/mcp/tests/unit/__snapshots__/tool-schemas/llma-personal-spend.json
index e97c5a6d6fbd..838e13be4cfd 100644
--- a/services/mcp/tests/unit/__snapshots__/tool-schemas/llma-personal-spend.json
+++ b/services/mcp/tests/unit/__snapshots__/tool-schemas/llma-personal-spend.json
@@ -49,7 +49,7 @@
             "type": "number"
         },
         "product": {
-            "description": "Required `ai_product` key to scope the tool / model / trace breakdowns to a single product. Only the following products are currently supported: posthog_code.",
+            "description": "Required `ai_product` key to scope the tool / model / input-size / day breakdowns to a single product. Only the following products are currently supported: posthog_code.",
             "maxLength": 64,
             "minLength": 1,
             "type": "string"

From fd7238d1cbeb74a93b9b5e377aea743e457eb625 Mon Sep 17 00:00:00 2001
From: "tests-posthog[bot]"
 <250237707+tests-posthog[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:24:20 +0000
Subject: [PATCH 4/8] chore: update OpenAPI generated types

---
 products/ai_observability/mcp/tools.yaml        | 17 ++++++++---------
 .../frontend/generated/api.schemas.ts           |  9 +++++++++
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/products/ai_observability/mcp/tools.yaml b/products/ai_observability/mcp/tools.yaml
index d3c9077985cd..74397492ffe7 100644
--- a/products/ai_observability/mcp/tools.yaml
+++ b/products/ai_observability/mcp/tools.yaml
@@ -468,15 +468,14 @@ tools:
         title: Get my LLM spend analysis
         description: >
             Retrieve the current user's personal LLM spend analysis across PostHog products over the last N days
-            (default 30, max 90). Returns a summary plus breakdowns by product, tool, model, input-size bucket and
-            UTC day. The `product` query param is required and scopes the tool / model / input-size / day
-            breakdowns to a single product; currently only `posthog_code` is supported. `by_product` always
-            returns the cross-product view, and `by_day` is a day-ascending series for spend-over-time questions.
-            `by_input_size` groups spend by `$ai_input_tokens` bucket and is usually the more useful lens than
-            `by_tool`, since context size drives cost regardless of which tool a turn called; use
-            `cost_attributed_usd` / `share_attributed` on `by_tool` rows for an honest per-tool split rather than
-            `cost_usd` / `share_of_scoped`, which overstate ubiquitous tools. Pass `refresh=true` to bypass the
-            5-minute cache.
+            (default 30, max 90). Returns a summary plus breakdowns by product, tool, model, input-size bucket and UTC
+            day. The `product` query param is required and scopes the tool / model / input-size / day breakdowns to a
+            single product; currently only `posthog_code` is supported. `by_product` always returns the cross-product
+            view, and `by_day` is a day-ascending series for spend-over-time questions. `by_input_size` groups spend by
+            `$ai_input_tokens` bucket and is usually the more useful lens than `by_tool`, since context size drives cost
+            regardless of which tool a turn called; use `cost_attributed_usd` / `share_attributed` on `by_tool` rows for
+            an honest per-tool split rather than `cost_usd` / `share_of_scoped`, which overstate ubiquitous tools. Pass
+            `refresh=true` to bypass the 5-minute cache.
     llma-prompt-archive:
         operation: llm_prompts_name_archive_create
         enabled: false
diff --git a/products/experiments/frontend/generated/api.schemas.ts b/products/experiments/frontend/generated/api.schemas.ts
index e5c401a4bb3d..c72697283508 100644
--- a/products/experiments/frontend/generated/api.schemas.ts
+++ b/products/experiments/frontend/generated/api.schemas.ts
@@ -1757,6 +1757,15 @@ export interface ActivityLogEntryApi {
     readonly item_id: string
     detail?: DetailApi
     readonly created_at: string
+    /** Whether the activity was performed by the system rather than a user. */
+    readonly is_system: boolean
+    /** Whether the acting user was being impersonated by PostHog staff. */
+    readonly was_impersonated: boolean
+    /**
+     * API client that triggered the activity, from the x-posthog-client request header (e.g. 'mcp'). Null for requests that did not send the header.
+     * @nullable
+     */
+    readonly client: string | null
 }
 
 /**

From cb49604d777072d681fb159b5fb452e977ee1c94 Mon Sep 17 00:00:00 2001
From: Paul D'Ambra <paul@posthog.com>
Date: Fri, 24 Jul 2026 12:49:39 +0100
Subject: [PATCH 5/8] fix(aio): address review feedback on personal spend

- coalesce NULL $ai_input_tokens to 0 so unknown-size generations land in
  the lowest bucket instead of inflating the >300k headline fallback
- version the response cache namespace (v2) so a rolling deploy can't serve
  an old-shape payload against the new contract
- drop the production-derived spend figure from a public code comment

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../backend/api/personal_spend.py             | 26 +++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/products/ai_observability/backend/api/personal_spend.py b/products/ai_observability/backend/api/personal_spend.py
index 1119ab3e45bb..307c605d99e3 100644
--- a/products/ai_observability/backend/api/personal_spend.py
+++ b/products/ai_observability/backend/api/personal_spend.py
@@ -71,9 +71,9 @@
 _RELATIVE_DATE_RE = re.compile(r"^-?\d+[hdwmqyHDWMQY](Start|End)?$")
 
 # `by_input_size` buckets on `$ai_input_tokens`, ascending by lower bound. This is the
-# primary cost driver: large-context turns dominate spend regardless of which tool they
-# called (~half of spend comes from turns over 300k input tokens, verified against
-# production). Single source of truth for both the query's `multiIf` and the row labels.
+# primary cost driver: input tokens are billed per token, so large-context turns dominate
+# spend regardless of which tool they called. Single source of truth for both the query's
+# `multiIf` and the row labels.
 INPUT_SIZE_BUCKETS: list[tuple[str, int]] = [
     ("<50k", 0),
     ("50k-100k", 50_000),
@@ -89,6 +89,12 @@
 
 CACHE_TIMEOUT_SECONDS = 300
 
+# Namespaces the cache by response schema. Bump on any payload shape change so entries
+# written by an older process during a rolling deploy are never served against the new
+# contract (this revision added `by_input_size`, `cost_attributed_usd`, `share_attributed`
+# and removed `top_traces`).
+CACHE_SCHEMA_VERSION = "v2"
+
 UTC = ZoneInfo("UTC")
 
 
@@ -100,9 +106,10 @@ def _cache_key(
     email: str, date_from: str, date_to: str | None, product: str, limit: int, bucket_minutes: int | None
 ) -> str:
     to_slot = date_to or "_now"
-    # Suffix only when set, so bucketless requests keep their pre-bucket_minutes cache keys.
+    # Only append the bucket segment when set, so bucketless and bucketed requests get
+    # distinct keys without perturbing the bucketless key shape.
     bucket_slot = f":{bucket_minutes}" if bucket_minutes else ""
-    return f"personal_spend:{email}:{date_from}:{to_slot}:{product}:{limit}{bucket_slot}"
+    return f"personal_spend:{CACHE_SCHEMA_VERSION}:{email}:{date_from}:{to_slot}:{product}:{limit}{bucket_slot}"
 
 
 def _parse_date_param(value: str, field: str, now: datetime.datetime) -> datetime.datetime:
@@ -834,11 +841,14 @@ def _input_size_bucket_case_sql() -> str:
     """Builds the `multiIf(...)` branches from `INPUT_SIZE_BUCKETS`: each bucket (other
     than the last) becomes `$ai_input_tokens < <next bucket's min>, '<label>'`, checked in
     ascending order so `multiIf` matches the first (lowest) bucket the value clears; the
-    last bucket is the unconditional fallback. Bucket bounds are fixed constants defined
-    in this module, not request input, so interpolating them into the query text is safe.
+    last bucket is the unconditional fallback. Missing or unparseable `$ai_input_tokens`
+    coalesces to 0, so unknown-size events land in the lowest bucket rather than silently
+    inflating the `>300k` fallback (a NULL comparison is false, so it would otherwise fall
+    through every branch). Bucket bounds are fixed constants defined in this module, not
+    request input, so interpolating them into the query text is safe.
     """
     branches = [
-        f"toFloat(properties.$ai_input_tokens) < {INPUT_SIZE_BUCKETS[i + 1][1]}, '{label}'"
+        f"coalesce(toFloat(properties.$ai_input_tokens), 0) < {INPUT_SIZE_BUCKETS[i + 1][1]}, '{label}'"
         for i, (label, _min_tokens) in enumerate(INPUT_SIZE_BUCKETS[:-1])
     ]
     fallback_label = INPUT_SIZE_BUCKETS[-1][0]

From c7ba7b49bfd92de07c9fa85307dc2c319d51bf54 Mon Sep 17 00:00:00 2001
From: Paul D'Ambra <paul@posthog.com>
Date: Fri, 24 Jul 2026 13:15:37 +0100
Subject: [PATCH 6/8] fix(aio): avoid hogql f-string in personal spend
 input-size query

Pass the internally-built input-size bucket expression as a parsed
placeholder instead of interpolating it into the parse_select f-string,
clearing the hogql-fstring-audit semgrep rule.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .../backend/api/personal_spend.py                 | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/products/ai_observability/backend/api/personal_spend.py b/products/ai_observability/backend/api/personal_spend.py
index 307c605d99e3..c9df3d13f231 100644
--- a/products/ai_observability/backend/api/personal_spend.py
+++ b/products/ai_observability/backend/api/personal_spend.py
@@ -37,7 +37,7 @@
 from posthog.schema import HogQLQueryModifiers
 
 from posthog.hogql import ast
-from posthog.hogql.parser import parse_select
+from posthog.hogql.parser import parse_expr, parse_select
 from posthog.hogql.query import execute_hogql_query
 
 from posthog.auth import (
@@ -868,22 +868,23 @@ def _fetch_by_input_size(
     `limit`: there are only as many rows as there are buckets (six), so truncating by
     cost would drop whole buckets rather than individual rows."""
     query = parse_select(
-        f"""
+        """
         SELECT
-            {_input_size_bucket_case_sql()} AS bucket,
+            {bucket_case} AS bucket,
             count() AS generation_count,
             round(sum(toFloat(properties.$ai_total_cost_usd)), 6) AS cost_usd
         FROM events
-        WHERE {{event_in}}
-            AND {{product_filter}}
-            AND {{email_filter}}
-            AND {{timestamp_filter}}
+        WHERE {event_in}
+            AND {product_filter}
+            AND {email_filter}
+            AND {timestamp_filter}
         GROUP BY bucket
         """
     )
     result = execute_hogql_query(
         query=query,
         placeholders={
+            "bucket_case": parse_expr(_input_size_bucket_case_sql()),
             "event_in": _event_in(["$ai_generation", "$ai_embedding"]),
             "product_filter": _product_filter(product),
             "email_filter": _email_filter(email),

From b2effc87267738bcbffa048dfbd846aaece1c036 Mon Sep 17 00:00:00 2001
From: "tests-posthog[bot]"
 <250237707+tests-posthog[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 12:45:53 +0000
Subject: [PATCH 7/8] test(backend): update query snapshots

---
 .../__snapshots__/test_personal_spend.ambr    | 89 ++++++++++++++++++-
 1 file changed, 87 insertions(+), 2 deletions(-)

diff --git a/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr b/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr
index 4606a957cfbf..7706cda9f879 100644
--- a/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr
+++ b/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr
@@ -82,6 +82,91 @@
   '''
 # ---
 # name: TestPersonalSpendQueries.test_empty_result_when_no_events.2
+  '''
+  /* user_id:0 request:_snapshot_@me_spend_ */
+  SELECT tool AS tool,
+         round(sum(cost_share), 6) AS cost_attributed_usd
+  FROM
+    (SELECT nullIf(arrayJoin(if(empty(tools), [''], tools)), '') AS tool,
+            divide(cost, length(if(empty(tools), [''], tools))) AS cost_share
+     FROM
+       (SELECT arrayDistinct(arrayFilter(x -> ifNull(notEquals(x, ''), 1), splitByChar(',', coalesce(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_tools_called'), ''), 'null'), '^"|"$', ''), '')))) AS tools,
+               accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_total_cost_usd'), ''), 'null'), '^"|"$', ''), 'Float64') AS cost
+        FROM events
+        LEFT OUTER JOIN
+          (SELECT argMax(person_distinct_id_overrides.person_id, person_distinct_id_overrides.version) AS person_id,
+                  person_distinct_id_overrides.distinct_id AS distinct_id
+           FROM person_distinct_id_overrides
+           WHERE equals(person_distinct_id_overrides.team_id, 99999)
+           GROUP BY person_distinct_id_overrides.distinct_id
+           HAVING equals(argMax(person_distinct_id_overrides.is_deleted, person_distinct_id_overrides.version), 0) SETTINGS optimize_aggregation_in_order=1) AS events__override ON equals(events.distinct_id, events__override.distinct_id)
+        LEFT JOIN
+          (SELECT person.id AS id,
+                  replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(person.properties, 'email'), ''), 'null'), '^"|"$', '') AS properties___email
+           FROM person
+           WHERE and(equals(person.team_id, 99999), in(tuple(person.id, person.version),
+                                                         (SELECT person.id AS id, max(person.version) AS version
+                                                          FROM person
+                                                          WHERE equals(person.team_id, 99999)
+                                                          GROUP BY person.id
+                                                          HAVING and(equals(argMax(person.is_deleted, person.version), 0), less(argMax(toTimeZone(person.created_at, 'UTC'), person.version), plus(now64(6, 'UTC'), toIntervalDay(1))))))) SETTINGS optimize_aggregation_in_order=1) AS events__person ON equals(if(not(empty(events__override.distinct_id)), events__override.person_id, events.person_id), events__person.id)
+        WHERE and(equals(events.team_id, 99999), equals(events.event, '$ai_generation'), ifNull(equals(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, 'ai_product'), ''), 'null'), '^"|"$', ''), 'posthog_code'), 0), ifNull(equals(events__person.properties___email, 'user1@posthog.com'), 0), and(greaterOrEquals(events.timestamp, toDateTime64('explicit_redacted_timestamp', 6, 'UTC')), less(events.timestamp, toDateTime64('today', 6, 'UTC'))))))
+  GROUP BY tool
+  LIMIT 100 SETTINGS readonly=2,
+                     max_execution_time=60,
+                     allow_experimental_object_type=1,
+                     max_ast_elements=4000000,
+                     max_expanded_ast_elements=4000000,
+                     max_bytes_before_external_group_by=0,
+                     transform_null_in=1,
+                     optimize_min_equality_disjunction_chain_length=4294967295,
+                     optimize_rewrite_aggregate_function_with_if=0,
+                     optimize_min_inequality_conjunction_chain_length=4294967295,
+                     allow_experimental_join_condition=1,
+                     use_hive_partitioning=0
+  '''
+# ---
+# name: TestPersonalSpendQueries.test_empty_result_when_no_events.3
+  '''
+  /* user_id:0 request:_snapshot_@me_spend_ */
+  SELECT multiIf(ifNull(less(coalesce(accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_input_tokens'), ''), 'null'), '^"|"$', ''), 'Float64'), 0), 50000), 0), '<50k', ifNull(less(coalesce(accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_input_tokens'), ''), 'null'), '^"|"$', ''), 'Float64'), 0), 100000), 0), '50k-100k', ifNull(less(coalesce(accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_input_tokens'), ''), 'null'), '^"|"$', ''), 'Float64'), 0), 150000), 0), '100k-150k', ifNull(less(coalesce(accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_input_tokens'), ''), 'null'), '^"|"$', ''), 'Float64'), 0), 200000), 0), '150k-200k', ifNull(less(coalesce(accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_input_tokens'), ''), 'null'), '^"|"$', ''), 'Float64'), 0), 300000), 0), '200k-300k', '>300k') AS bucket,
+         count() AS generation_count,
+         round(sum(accurateCastOrNull(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_total_cost_usd'), ''), 'null'), '^"|"$', ''), 'Float64')), 6) AS cost_usd
+  FROM events
+  LEFT OUTER JOIN
+    (SELECT argMax(person_distinct_id_overrides.person_id, person_distinct_id_overrides.version) AS person_id,
+            person_distinct_id_overrides.distinct_id AS distinct_id
+     FROM person_distinct_id_overrides
+     WHERE equals(person_distinct_id_overrides.team_id, 99999)
+     GROUP BY person_distinct_id_overrides.distinct_id
+     HAVING equals(argMax(person_distinct_id_overrides.is_deleted, person_distinct_id_overrides.version), 0) SETTINGS optimize_aggregation_in_order=1) AS events__override ON equals(events.distinct_id, events__override.distinct_id)
+  LEFT JOIN
+    (SELECT person.id AS id,
+            replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(person.properties, 'email'), ''), 'null'), '^"|"$', '') AS properties___email
+     FROM person
+     WHERE and(equals(person.team_id, 99999), in(tuple(person.id, person.version),
+                                                   (SELECT person.id AS id, max(person.version) AS version
+                                                    FROM person
+                                                    WHERE equals(person.team_id, 99999)
+                                                    GROUP BY person.id
+                                                    HAVING and(equals(argMax(person.is_deleted, person.version), 0), less(argMax(toTimeZone(person.created_at, 'UTC'), person.version), plus(now64(6, 'UTC'), toIntervalDay(1))))))) SETTINGS optimize_aggregation_in_order=1) AS events__person ON equals(if(not(empty(events__override.distinct_id)), events__override.person_id, events.person_id), events__person.id)
+  WHERE and(equals(events.team_id, 99999), in(events.event, tuple('$ai_generation', '$ai_embedding')), ifNull(equals(replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, 'ai_product'), ''), 'null'), '^"|"$', ''), 'posthog_code'), 0), ifNull(equals(events__person.properties___email, 'user1@posthog.com'), 0), and(greaterOrEquals(events.timestamp, toDateTime64('explicit_redacted_timestamp', 6, 'UTC')), less(events.timestamp, toDateTime64('today', 6, 'UTC'))))
+  GROUP BY bucket
+  LIMIT 100 SETTINGS readonly=2,
+                     max_execution_time=60,
+                     allow_experimental_object_type=1,
+                     max_ast_elements=4000000,
+                     max_expanded_ast_elements=4000000,
+                     max_bytes_before_external_group_by=0,
+                     transform_null_in=1,
+                     optimize_min_equality_disjunction_chain_length=4294967295,
+                     optimize_rewrite_aggregate_function_with_if=0,
+                     optimize_min_inequality_conjunction_chain_length=4294967295,
+                     allow_experimental_join_condition=1,
+                     use_hive_partitioning=0
+  '''
+# ---
+# name: TestPersonalSpendQueries.test_empty_result_when_no_events.4
   '''
   /* user_id:0 request:_snapshot_@me_spend_ */
   SELECT replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, 'ai_product'), ''), 'null'), '^"|"$', '') AS product,
@@ -122,7 +207,7 @@
                     use_hive_partitioning=0
   '''
 # ---
-# name: TestPersonalSpendQueries.test_empty_result_when_no_events.3
+# name: TestPersonalSpendQueries.test_empty_result_when_no_events.5
   '''
   /* user_id:0 request:_snapshot_@me_spend_ */
   SELECT replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_model'), ''), 'null'), '^"|"$', '') AS model,
@@ -165,7 +250,7 @@
                     use_hive_partitioning=0
   '''
 # ---
-# name: TestPersonalSpendQueries.test_empty_result_when_no_events.4
+# name: TestPersonalSpendQueries.test_empty_result_when_no_events.6
   '''
   /* user_id:0 request:_snapshot_@me_spend_ */
   SELECT toDate(events.timestamp) AS day,

From 6cbc5c3ddc52c2ae3a630a035120c3b213edfa02 Mon Sep 17 00:00:00 2001
From: "tests-posthog[bot]"
 <250237707+tests-posthog[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 21:00:29 +0000
Subject: [PATCH 8/8] test(backend): update query snapshots

---
 .../backend/api/test/__snapshots__/test_personal_spend.ambr   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr b/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr
index 2c6522a0614c..8bebf2b681ab 100644
--- a/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr
+++ b/products/ai_observability/backend/api/test/__snapshots__/test_personal_spend.ambr
@@ -293,7 +293,7 @@
                     use_hive_partitioning=0
   '''
 # ---
-# name: TestPersonalSpendQueries.test_empty_result_when_no_events.5
+# name: TestPersonalSpendQueries.test_empty_result_when_no_events.7
   '''
   /* user_id:0 request:_snapshot_@me_spend_ */
   SELECT replaceRegexpAll(nullIf(nullIf(JSONExtractRaw(events.properties, '$ai_model'), ''), 'null'), '^"|"$', '') AS model
@@ -332,7 +332,7 @@
                    use_hive_partitioning=0
   '''
 # ---
-# name: TestPersonalSpendQueries.test_empty_result_when_no_events.6
+# name: TestPersonalSpendQueries.test_empty_result_when_no_events.8
   '''
   /* user_id:0 request:_snapshot_@me_spend_ */
   SELECT toDate(events.timestamp) AS day,