cli: render contextual CVSS vector, advisory score, and reasoning for dependency findings

strix/report/state.py

@@ -39,13 +39,6 @@ def _strix_version() -> str | None:
         return None
 
 
-def _number(value: Any) -> int | float:
-    try:
-        return float(value or 0)
-    except (TypeError, ValueError):
-        return 0
-
-
 def _parse_repo_full_name(uri: str) -> str | None:
     """Extract ``owner/repo`` from a git URL or slug, else None."""
     text = uri.strip().removesuffix(".git")
@@ -122,7 +115,6 @@ class ReportState:
         self.run_name = run_name
         self.run_id = run_name or f"run-{uuid4().hex[:8]}"
         self.start_time = datetime.now(UTC).isoformat()
-        self.process_start_time = self.start_time
         self.end_time: str | None = None
 
         self.vulnerability_reports: list[dict[str, Any]] = []
@@ -131,7 +123,6 @@ class ReportState:
         self.scan_results: dict[str, Any] | None = None
         self.scan_config: dict[str, Any] | None = None
         self._llm_usage = LLMUsageLedger()
-        self._telemetry_llm_usage_baseline: dict[str, Any] = {}
         auth_mode = codex.auth_mode(load_settings().llm.model)
         self._llm_usage.zero_cost = auth_mode == "subscription"
         self.run_record: dict[str, Any] = {
@@ -197,7 +188,6 @@ class ReportState:
                 self.scan_results = scan_results
                 self.final_scan_result = self._format_final_scan_result(scan_results)
             self._hydrate_llm_usage(data.get("llm_usage"))
-            self._telemetry_llm_usage_baseline = self._build_llm_usage_record()
             logger.info("report state hydrated run.json from %s", run_dir)
 
         json_path = run_dir / "vulnerabilities.json"
@@ -341,25 +331,6 @@ class ReportState:
     def get_total_llm_usage(self) -> dict[str, Any]:
         return dict(self.run_record.get("llm_usage") or self._build_llm_usage_record())
 
-    def get_process_llm_usage(self) -> dict[str, int | float]:
-        """Return LLM usage accumulated since this process started."""
-        usage = self._llm_usage.to_record()
-        return {
-            key: max(
-                0, _number(usage.get(key)) - _number(self._telemetry_llm_usage_baseline.get(key))
-            )
-            for key in ("requests", "input_tokens", "output_tokens", "total_tokens", "cost")
-        }
-
-    def get_process_duration_seconds(self) -> float:
-        """Return this process's elapsed wall time for telemetry."""
-        try:
-            start = datetime.fromisoformat(self.process_start_time.replace("Z", "+00:00"))
-            duration = (datetime.now(start.tzinfo) - start).total_seconds()
-            return max(0.0, duration)
-        except (ValueError, TypeError, AttributeError):
-            return 0.0
-
     def get_total_llm_cost(self) -> float:
         """Live accumulated LLM cost, independent of the persisted run-record snapshot."""
         return self._llm_usage.total_cost

strix/skills/custom/dependency_cve_scanning.md

@@ -248,25 +248,15 @@ findings and rejects empty PoC fields):
 - Set `cwe` to the most specific `CWE-NNN` when the advisory names one.
 - Do NOT cap severity at LOW just because there is no dynamic reproduction — use
   the advisory score.
-- Set `reachability` + `reachability_evidence` from the usage analysis above —
-  the tool rejects a report with no evidence, so for `unknown` write what you
-  searched and why the result is inconclusive;
+- Set `reachability` + `reachability_evidence` from the usage analysis above;
   use `assumptions` for anything softer (confidence, caveats, analysis limits).
-- **Always set `contextual_cvss_breakdown` + `contextual_cvss_reasoning`.** Every
-  dependency finding carries a contextual rating of the CVE in this codebase
-  (see below). Start from the published metrics and change only what your
-  evidence proves.
-- Set every other field the report accepts when the information exists:
-  `package`, `ecosystem`, `installed_version`, `fixed_version`, `manifest_path`,
-  `introduced_by` for a transitive package, `dependency_path`, `cwe`,
-  `assumptions`, and the remediation instruction. A blank field costs the reader
-  a triage step.
+- Set `contextual_cvss_breakdown` + `contextual_cvss_reasoning` when this
+  codebase clearly changes the risk the published score describes (see below).
 
 ### Contextual CVSS
 
 The published score rates the CVE in the abstract. `contextual_cvss_breakdown`
-rates it **here**, in this codebase, and every dependency report must carry
-one. It is the same 8-metric CVSS v3.1 object as a
+rates it **here**, in this codebase — the same 8-metric CVSS v3.1 object as a
 normal finding's `cvss_breakdown` (`attack_vector`, `attack_complexity`,
 `privileges_required`, `user_interaction`, `scope`, `confidentiality`,
 `integrity`, `availability`). You never pass a score: the contextual score and
@@ -295,12 +285,8 @@ come from what the source requires; `attack_complexity` comes from the
 preconditions the hops enforce; `confidentiality`, `integrity`, and
 `availability` come from the data and privileges available at the sink.
 
-When you have no source-to-sink trace, still rate the finding: copy the
-published metrics, change only the metrics the usage level itself proves, and
-say so in the reasoning. For example, for a `not_imported` package that the
-build still ships, keep the published metrics and lower `confidentiality`,
-`integrity`, and `availability` to `N`, because no code path reaches the
-vulnerable symbol. Never invent a hop you did not read.
+No trace, no contextual breakdown: if you did not reach a symbol hit, or you
+could not follow a hop, omit the contextual fields instead of guessing.
 
 `contextual_cvss_reasoning` is required with the breakdown. Write two to four
 sentences that another engineer can check without opening the repository. Name
@@ -314,10 +300,9 @@ for an operator-supplied path behind the `--allow-unsafe-import` flag that
 attacker must already hold shell access on the job host, and the parsed data is
 build metadata rather than customer records."
 
-When the published rating already fits this codebase, repeat the published
-metrics in the breakdown and say in the reasoning that the deployment matches
-the advisory. A contextual rating is a claim you must be able to defend, and it
-never replaces `advisory_cvss` as the published reference.
+Omit all the contextual fields when the published rating already fits, and when
+the evidence is thin. A contextual rating is a claim you must be able to
+defend, and it never replaces `advisory_cvss` as the published reference.
 
 Verify the CVE with `web_search` when available before reporting. Never guess or
 hallucinate a CVE id.
@@ -335,7 +320,5 @@ hallucinate a CVE id.
 - Do not downgrade advisory severity for lack of dynamic reproduction.
 - Do not claim a `reachability` level the evidence does not prove — `unknown`
   with a reason is always acceptable; an overclaimed level never is.
-- Do not send a report without `contextual_cvss_breakdown` and
-  `contextual_cvss_reasoning` — the reader rates and ranks the finding with them.
-- Do not use the contextual breakdown to quietly de-rate a CVE you could not
-  analyze. State the limit of the analysis in the reasoning instead.
+- Do not send `contextual_cvss_breakdown` without evidence-backed reasoning, and
+  do not use it to quietly de-rate a CVE you simply could not analyze.

strix/telemetry/posthog.py

@@ -1,4 +1,5 @@
 import logging
+from datetime import datetime
 from typing import TYPE_CHECKING, Any
 
 import requests
@@ -104,11 +105,17 @@ def end(report_state: "ReportState", exit_reason: str = "completed") -> None:
         if sev in vulnerabilities_counts:
             vulnerabilities_counts[sev] += 1
 
-    duration = report_state.get_process_duration_seconds()
+    duration = 0.0
+    try:
+        start = datetime.fromisoformat(report_state.start_time.replace("Z", "+00:00"))
+        end_iso = report_state.end_time or datetime.now(start.tzinfo).isoformat()
+        duration = (datetime.fromisoformat(end_iso.replace("Z", "+00:00")) - start).total_seconds()
+    except (ValueError, TypeError, AttributeError):
+        pass
 
     llm_props: dict[str, int | float] = {}
     try:
-        usage = report_state.get_process_llm_usage()
+        usage = report_state.get_total_llm_usage()
         if isinstance(usage, dict):
             llm_props = {
                 "llm_requests": int(usage.get("requests") or 0),

strix/telemetry/scarf.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import logging
 import urllib.parse
+from datetime import datetime
 from typing import TYPE_CHECKING, Any
 
 import requests
@@ -113,11 +114,19 @@ def end(report_state: ReportState, exit_reason: str = "completed") -> None:
         if sev in vulnerabilities_counts:
             vulnerabilities_counts[sev] += 1
 
-    duration = report_state.get_process_duration_seconds()
+    duration = 0.0
+    try:
+        scan_start = datetime.fromisoformat(report_state.start_time.replace("Z", "+00:00"))
+        end_iso = report_state.end_time or datetime.now(scan_start.tzinfo).isoformat()
+        duration = (
+            datetime.fromisoformat(end_iso.replace("Z", "+00:00")) - scan_start
+        ).total_seconds()
+    except (ValueError, TypeError, AttributeError):
+        pass
 
     llm_props: dict[str, int | float] = {}
     try:
-        usage = report_state.get_process_llm_usage()
+        usage = report_state.get_total_llm_usage()
         if isinstance(usage, dict):
             llm_props = {
                 "llm_requests": int(usage.get("requests") or 0),

strix/tools/reporting/tool.py

@@ -757,28 +757,19 @@ def _validate_contextual_cvss(
     reasoning: str | None,
 ) -> list[str]:
     errors: list[str] = []
-    if not breakdown:
-        errors.append(
-            "contextual_cvss_breakdown is required: rate the CVE in this codebase with "
-            "all 8 CVSS v3.1 metrics (attack_vector, attack_complexity, "
-            "privileges_required, user_interaction, scope, confidentiality, integrity, "
-            "availability). When your trace does not change the published rating, repeat "
-            "the advisory's own metrics and adjust only what the usage level proves - a "
-            "package the code never imports is normally N on all three impact metrics."
-        )
-    else:
+    if breakdown:
         for name, valid in _CVSS_VALID.items():
             value = breakdown.get(name)
             if value not in valid:
                 errors.append(
                     f"Invalid contextual_cvss_breakdown {name}: {value}. Must be one of: {valid}"
                 )
-    if not (reasoning or "").strip():
-        errors.append(
-            "contextual_cvss_reasoning is required: state what you observed in this "
-            "codebase that justifies the contextual rating. A contextual score with "
-            "no reasoning is not shown."
-        )
+        if not (reasoning or "").strip():
+            errors.append(
+                "contextual_cvss_reasoning is required when contextual_cvss_breakdown is "
+                "set: state what you observed in this codebase that justifies the "
+                "contextual rating. A contextual score with no reasoning is not shown."
+            )
     return errors
 
 
@@ -846,7 +837,9 @@ def _build_dependency_metadata(
         metadata["introduced_by"] = introduced_by.strip()
     if dependency_path and dependency_path.strip():
         metadata["dependency_path"] = dependency_path.strip()
-    if reachability and reachability.strip():
+    # "unknown" is the absent case — omitting it keeps the jsonb contract clean,
+    # and evidence without a level would have nothing to qualify.
+    if reachability and reachability.strip() and reachability.strip() != "unknown":
         metadata["reachability"] = reachability.strip()
         if reachability_evidence and reachability_evidence.strip():
             metadata["reachability_evidence"] = reachability_evidence.strip()
@@ -982,12 +975,11 @@ async def _do_create_dependency(  # noqa: PLR0912
         errors.append(
             f"Invalid reachability: {reachability!r}. Must be one of: {sorted(_VALID_REACHABILITY)}"
         )
-    elif not (reachability_evidence or "").strip():
+    elif reachability != "unknown" and not (reachability_evidence or "").strip():
         errors.append(
-            "reachability_evidence is required: cite the concrete proof (import "
-            "file:line, matched symbol usage, or govulncheck call path), or, for "
-            "'unknown', say what you searched and why the result is inconclusive. "
-            "Never claim a reachability level without evidence."
+            "reachability_evidence is required when reachability is not 'unknown': "
+            "cite the concrete proof (import file:line, matched symbol usage, or "
+            "govulncheck call path). Never claim a reachability level without evidence."
         )
 
     errors.extend(_validate_contextual_cvss(contextual_cvss_breakdown, contextual_cvss_reasoning))
@@ -1225,9 +1217,8 @@ async def create_dependency_report(
             ``not_imported`` / ``imported`` / ``vulnerable_symbol_used`` /
             ``reachable_call_path`` / ``unknown``. Claim only what the
             evidence proves; when in doubt use ``unknown``.
-        reachability_evidence: **Required.** The concrete proof for the
-            claimed level, or, for ``unknown``, what you searched and why
-            the result is inconclusive: repo-relative
+        reachability_evidence: The concrete proof for the claimed level
+            (required for any level other than ``unknown``): repo-relative
             ``file:line`` of the import or symbol usage, the matched
             advisory symbols, or the govulncheck call-path excerpt.
             Whenever you found the vulnerable symbol in use, also give the
@@ -1241,7 +1232,7 @@ async def create_dependency_report(
             is off in production), and say who controls the input. State
             it plainly when no entry point reaches the sink — that is the
             most useful result a reader can get.
-        contextual_cvss_breakdown: **Required.** Full CVSS v3.1 rating of this
+        contextual_cvss_breakdown: Optional full CVSS v3.1 rating of this
             CVE **in this codebase** — the same 8-metric object as
             ``create_vulnerability_report``'s ``cvss_breakdown``:
             ``attack_vector`` (N/A/L/P), ``attack_complexity`` (L/H),
@@ -1259,13 +1250,11 @@ async def create_dependency_report(
             hops enforce, and the impact metrics from the data and
             privileges reachable at the sink. When provided, this rating
             determines the finding's severity; ``advisory_cvss`` stays as
-            the published reference. Send it on every report: when the
-            trace does not change the published rating, or when you could
-            not complete the trace, repeat the advisory's own metrics and
-            adjust only what the usage level itself proves (a package the
-            code never imports is normally ``N`` on all three impact
-            metrics), then say so in the reasoning.
-        contextual_cvss_reasoning: **Required.** Two to four detailed
+            the published reference. Omit the field when the trace does
+            not change the published rating, or when you could not
+            complete the trace.
+        contextual_cvss_reasoning: **Required whenever**
+            ``contextual_cvss_breakdown`` is set. Two to four detailed
             sentences that a reviewer can verify without opening the repo:
             how the application uses the package, which call sites or
             configuration you inspected (repo-relative ``file:line``),

tests/test_reporting_fields.py

@@ -37,24 +37,6 @@ _CVSS = {
 }
 
 
-_DEP_CONTEXT = {
-    "attack_vector": "N",
-    "attack_complexity": "L",
-    "privileges_required": "N",
-    "user_interaction": "N",
-    "scope": "U",
-    "confidentiality": "N",
-    "integrity": "N",
-    "availability": "H",
-}
-
-_DEP_CONTEXT_VECTOR = "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
-
-_DEP_EVIDENCE = "src/render.ts:14 imports the package."
-
-_DEP_REASONING = "Only scripts/import.py reaches the sink, so the impact is availability only."
-
-
 @pytest.fixture
 def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> ReportState:
     monkeypatch.chdir(tmp_path)
@@ -165,17 +147,13 @@ async def test_dependency_report_sets_class_and_metadata(report_state: ReportSta
         advisory_cvss=7.2,
         technical_analysis=None,
         fix_effort="trivial",
-        reachability="imported",
-        reachability_evidence=_DEP_EVIDENCE,
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
     )
     assert result["success"] is True
     report = report_state.vulnerability_reports[0]
     assert report["finding_class"] == "dependency_cve"
     assert report["cve"] == "CVE-2021-23337"
     assert report["severity"] == "high"
-    assert report["evidence"].startswith(
+    assert report["evidence"] == (
         "**Advisory evidence:** `CVE-2021-23337` applies to `lodash` "
         "at installed version `4.17.20`. The advisory is fixed in `4.17.21`."
     )
@@ -186,12 +164,6 @@ async def test_dependency_report_sets_class_and_metadata(report_state: ReportSta
         "package_ecosystem": "npm",
         "manifest_path": "package-lock.json",
         "fixed_version": "4.17.21",
-        "reachability": "imported",
-        "reachability_evidence": _DEP_EVIDENCE,
-        "contextual_cvss_breakdown": _DEP_CONTEXT,
-        "contextual_cvss_score": pytest.approx(7.5, abs=0.05),
-        "contextual_cvss_vector": _DEP_CONTEXT_VECTOR,
-        "contextual_cvss_reasoning": _DEP_REASONING,
     }
 
 
@@ -215,10 +187,6 @@ async def test_dependency_report_records_transitive_chain(report_state: ReportSt
         fix_effort="trivial",
         introduced_by="express@4.18.1",
         dependency_path="express@4.18.1 > body-parser@1.20.0 > qs@6.10.2",
-        reachability="imported",
-        reachability_evidence=_DEP_EVIDENCE,
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
     )
     assert result["success"] is True
     report = report_state.vulnerability_reports[0]
@@ -257,10 +225,6 @@ async def test_dependency_report_omits_blank_chain_fields(report_state: ReportSt
         fix_effort="trivial",
         introduced_by="  ",
         dependency_path=None,
-        reachability="imported",
-        reachability_evidence=_DEP_EVIDENCE,
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
     )
     assert result["success"] is True
     report = report_state.vulnerability_reports[0]
@@ -268,7 +232,7 @@ async def test_dependency_report_omits_blank_chain_fields(report_state: ReportSt
     assert "dependency_path" not in report["dependency_metadata"]
 
 
-async def test_dependency_report_with_no_contextual_impact_is_info(
+async def test_dependency_report_with_zero_cvss_remains_low_severity(
     report_state: ReportState,
 ) -> None:
     result = await _do_create_dependency(
@@ -288,16 +252,12 @@ async def test_dependency_report_with_no_contextual_impact_is_info(
         advisory_cvss=0.0,
         technical_analysis=None,
         fix_effort="low",
-        reachability="not_imported",
-        reachability_evidence="No file imports the package.",
-        contextual_cvss_breakdown={**_DEP_CONTEXT, "availability": "N"},
-        contextual_cvss_reasoning="No application code imports the package.",
     )
 
     assert result["success"] is True
-    assert result["severity"] == "info"
+    assert result["severity"] == "low"
     report = report_state.vulnerability_reports[0]
-    assert report["severity"] == "info"
+    assert report["severity"] == "low"
     assert report["cvss"] == 0.0
 
 
@@ -321,8 +281,6 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
         fix_effort="low",
         reachability="vulnerable_symbol_used",
         reachability_evidence="src/render.ts:14 calls `_.template()`.",
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
     )
 
     assert result["success"] is True
@@ -334,8 +292,7 @@ async def test_dependency_report_records_reachability(report_state: ReportState)
     )
     assert "**Usage analysis:**" in report["evidence"]
     assert "not a proof of exploitability or of safety" in report["evidence"]
-    # The level must never influence the rating — that comes from the contextual
-    # breakdown, or from advisory_cvss when no breakdown applies.
+    # The level must never influence the rating — that stays advisory_cvss only.
     assert report["severity"] == "high"
 
 
@@ -396,7 +353,7 @@ async def test_dependency_report_rejects_unknown_reachability_level(
     assert not report_state.vulnerability_reports
 
 
-async def test_dependency_report_records_unknown_reachability(report_state: ReportState) -> None:
+async def test_dependency_report_omits_unknown_reachability(report_state: ReportState) -> None:
     result = await _do_create_dependency(
         title="CVE-2024-0001 in sample 1.0.0",
         description="Published advisory affects the pinned version.",
@@ -414,15 +371,12 @@ async def test_dependency_report_records_unknown_reachability(report_state: Repo
         advisory_cvss=5.0,
         technical_analysis=None,
         fix_effort="low",
-        reachability_evidence="Grep for the package found no import.",
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
     )
 
     assert result["success"] is True, result
     metadata = report_state.vulnerability_reports[0]["dependency_metadata"]
-    assert metadata["reachability"] == "unknown"
-    assert metadata["reachability_evidence"] == "Grep for the package found no import."
+    assert "reachability" not in metadata
+    assert "reachability_evidence" not in metadata
 
 
 async def test_dependency_report_requires_advisory_cvss(report_state: ReportState) -> None:
@@ -499,10 +453,6 @@ async def test_dependency_report_dedupe_candidate_includes_dependency_metadata(
         advisory_cvss=0.0,
         technical_analysis=None,
         fix_effort="low",
-        reachability="imported",
-        reachability_evidence=_DEP_EVIDENCE,
-        contextual_cvss_breakdown=_DEP_CONTEXT,
-        contextual_cvss_reasoning=_DEP_REASONING,
     )
 
     assert result["success"] is True
@@ -518,12 +468,6 @@ async def test_dependency_report_dedupe_candidate_includes_dependency_metadata(
             "package_ecosystem": "npm",
             "manifest_path": "package-lock.json",
             "fixed_version": "1.0.1",
-            "reachability": "imported",
-            "reachability_evidence": _DEP_EVIDENCE,
-            "contextual_cvss_breakdown": _DEP_CONTEXT,
-            "contextual_cvss_score": pytest.approx(7.5, abs=0.05),
-            "contextual_cvss_vector": _DEP_CONTEXT_VECTOR,
-            "contextual_cvss_reasoning": _DEP_REASONING,
         },
         "technical_analysis": None,
     }
@@ -982,8 +926,6 @@ async def test_dependency_report_computes_contextual_cvss(
         cwe="CWE-94",
         fix_effort="trivial",
         manifest_path="package-lock.json",
-        reachability="vulnerable_symbol_used",
-        reachability_evidence="scripts/import.py:88 calls `_.template()`.",
         contextual_cvss_breakdown=_CONTEXTUAL_BREAKDOWN,
         contextual_cvss_reasoning="Only scripts/import.py reaches the sink.",
     )
@@ -1002,7 +944,7 @@ async def test_dependency_report_computes_contextual_cvss(
 
 
 @pytest.mark.asyncio
-async def test_dependency_report_requires_contextual_breakdown(
+async def test_dependency_report_rates_from_advisory_without_contextual(
     report_state: ReportState,
 ) -> None:
     result = await _do_create_dependency(
@@ -1022,12 +964,15 @@ async def test_dependency_report_requires_contextual_breakdown(
         cwe="CWE-94",
         fix_effort="trivial",
         manifest_path="package-lock.json",
-        reachability="imported",
-        reachability_evidence=_DEP_EVIDENCE,
     )
-    assert result["success"] is False
-    assert any("contextual_cvss_breakdown is required" in error for error in result["errors"])
-    assert report_state.vulnerability_reports == []
+    assert result["success"] is True, result
+    report = report_state.vulnerability_reports[0]
+    assert report["cvss"] == 7.2
+    assert report["severity"] == "high"
+    metadata = report["dependency_metadata"]
+    assert metadata["advisory_cvss"] == 7.2
+    assert "contextual_cvss_breakdown" not in metadata
+    assert "contextual_cvss_score" not in metadata
 
 
 @pytest.mark.asyncio

tests/test_telemetry_resume.py

@@ -1,89 +0,0 @@
-"""Regression tests for telemetry emitted by resumed runs."""
-
-from __future__ import annotations
-
-from datetime import UTC, datetime, timedelta
-from typing import Any
-
-import pytest
-from agents.usage import Usage
-
-from strix.report.state import ReportState
-from strix.telemetry import posthog, scarf
-
-
-def _usage(requests: int, input_tokens: int, output_tokens: int, total_tokens: int) -> Usage:
-    return Usage(
-        requests=requests,
-        input_tokens=input_tokens,
-        output_tokens=output_tokens,
-        total_tokens=total_tokens,
-    )
-
-
-def _capture(sent: list[dict[str, Any]], props: dict[str, Any]) -> bool:
-    sent.append(props)
-    return True
-
-
-@pytest.mark.parametrize("telemetry", [posthog, scarf])
-def test_scan_ended_reports_resumed_usage_delta(
-    telemetry: Any,
-    tmp_path: Any,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.chdir(tmp_path)
-    initial = ReportState(run_name="resumed")
-    initial.record_sdk_usage(
-        agent_id="agent",
-        usage=_usage(10, 1000, 200, 1200),
-        model="unknown",
-    )
-    initial.record_observed_llm_cost(1.25)
-    initial.end_time = (datetime.now(UTC) - timedelta(hours=1)).isoformat()
-    initial.run_record["end_time"] = initial.end_time
-    initial.save_run_data()
-
-    resumed = ReportState(run_name="resumed")
-    resumed.hydrate_from_run_dir()
-    resumed.record_sdk_usage(
-        agent_id="agent",
-        usage=_usage(3, 300, 50, 350),
-        model="unknown",
-    )
-    resumed.record_observed_llm_cost(0.75)
-
-    sent: list[dict[str, Any]] = []
-    monkeypatch.setattr(telemetry, "_send", lambda _event, props: _capture(sent, props))
-    telemetry.end(resumed)
-
-    assert sent[0]["llm_requests"] == 3
-    assert sent[0]["llm_input_tokens"] == 300
-    assert sent[0]["llm_output_tokens"] == 50
-    assert sent[0]["llm_tokens"] == 350
-    assert sent[0]["llm_cost"] == pytest.approx(0.75)
-    assert 0 <= sent[0]["duration_seconds"] <= 2
-
-
-@pytest.mark.parametrize("telemetry", [posthog, scarf])
-def test_scan_ended_reports_all_fresh_run_usage(
-    telemetry: Any,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    state = ReportState()
-    state.record_sdk_usage(
-        agent_id="agent",
-        usage=_usage(3, 300, 50, 350),
-        model="unknown",
-    )
-    state.record_observed_llm_cost(0.75)
-
-    sent: list[dict[str, Any]] = []
-    monkeypatch.setattr(telemetry, "_send", lambda _event, props: _capture(sent, props))
-    telemetry.end(state)
-
-    assert sent[0]["llm_requests"] == 3
-    assert sent[0]["llm_input_tokens"] == 300
-    assert sent[0]["llm_output_tokens"] == 50
-    assert sent[0]["llm_tokens"] == 350
-    assert sent[0]["llm_cost"] == pytest.approx(0.75)