From 330b963d8c783725df56d1e1067fdbd6a8869b44 Mon Sep 17 00:00:00 2001
From: "itarun.p" <itarun.p@somapait.com>
Date: Mon, 24 Aug 2026 11:39:05 +0700
Subject: [PATCH] fix: disable unsafe historical Hermes reconciliation

---
 src/cli.js                                    |  2 +-
 src/commands/sync.js                          |  5 ++++
 .../sync-unsafe-hermes-reconciliation.test.js | 28 +++++++++++++++++++
 3 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 test/sync-unsafe-hermes-reconciliation.test.js

diff --git a/src/cli.js b/src/cli.js
index 9954f98e..7ab12187 100644
--- a/src/cli.js
+++ b/src/cli.js
@@ -61,7 +61,7 @@ function printHelp() {
       "  npx --yes @ipv9/tokentracker-cli                                         Start local dashboard",
       "  npx --yes @ipv9/tokentracker-cli [--debug] serve [--port 7680] [--open] [--no-open] [--sync]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] init [--yes] [--dry-run] [--no-open]",
-      "  npx --yes @ipv9/tokentracker-cli [--debug] sync [--auto] [--drain] [--from-openclaw] [--compact] [--repair-grok] [--reconcile-hermes]",
+      "  npx --yes @ipv9/tokentracker-cli [--debug] sync [--auto] [--drain] [--from-openclaw] [--compact] [--repair-grok]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] status [--probe-keychain] [--probe-keychain-details]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] diagnostics [--out diagnostics.json]",
       "  npx --yes @ipv9/tokentracker-cli [--debug] doctor [--json] [--out doctor.json]",
diff --git a/src/commands/sync.js b/src/commands/sync.js
index 10ac8cc1..90312689 100644
--- a/src/commands/sync.js
+++ b/src/commands/sync.js
@@ -125,6 +125,11 @@ const CLAUDE_GROUND_TRUTH_REPAIR_KEY = "claudeGroundTruthRepair_2026_05_v4";
 
 async function cmdSync(argv) {
   const opts = parseArgs(argv);
+  if (opts.reconcileHermes) {
+    throw new Error(
+      "Historical Hermes reconciliation is disabled: session_model_usage has cumulative totals but no temporal delta ledger, so rebuilding daily/hourly buckets would misattribute long-running sessions."
+    );
+  }
   const home = os.homedir();
   const { trackerDir } = await resolveTrackerPaths({ home });
 
diff --git a/test/sync-unsafe-hermes-reconciliation.test.js b/test/sync-unsafe-hermes-reconciliation.test.js
new file mode 100644
index 00000000..aa714c4d
--- /dev/null
+++ b/test/sync-unsafe-hermes-reconciliation.test.js
@@ -0,0 +1,28 @@
+const assert = require("node:assert/strict");
+const fs = require("node:fs/promises");
+const os = require("node:os");
+const path = require("node:path");
+const { test } = require("node:test");
+
+const { cmdSync } = require("../src/commands/sync");
+
+test("sync --reconcile-hermes fails closed before creating tracker state", async () => {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "tokentracker-unsafe-hermes-reconcile-"));
+  const previousHome = process.env.HOME;
+  try {
+    process.env.HOME = tmp;
+
+    await assert.rejects(
+      () => cmdSync(["--reconcile-hermes"]),
+      /historical Hermes reconciliation is disabled.*temporal/i,
+    );
+    await assert.rejects(
+      () => fs.stat(path.join(tmp, ".tokentracker", "tracker")),
+      { code: "ENOENT" },
+    );
+  } finally {
+    if (previousHome === undefined) delete process.env.HOME;
+    else process.env.HOME = previousHome;
+    await fs.rm(tmp, { recursive: true, force: true });
+  }
+});