@ipv9/tokentracker-cli 0.39.38 → 0.39.40

package/src/lib/doctor.js

@@ -29,7 +29,8 @@ async function buildDoctorReport({
     checks.push(await checkCliEntrypoint(paths.cliPath));
   }
 
-  checks.push(await checkNetwork({ baseUrl: runtime?.baseUrl || null, fetch }));
+  // No cloud reachability check: TokenTracker is local-only, so there is no
+  // remote endpoint whose availability could affect anything here.
 
   if (diagnostics) {
     checks.push(...buildDiagnosticsChecks(diagnostics));
@@ -142,10 +143,6 @@ async function commandExistsOnPath(command, env = process.env) {
 
 function buildRuntimeChecks(runtime = {}) {
   const checks = [];
-  const baseUrl =
-    typeof runtime.baseUrl === "string" && runtime.baseUrl.trim() ? runtime.baseUrl.trim() : null;
-  const deviceToken =
-    typeof runtime.deviceToken === "string" && runtime.deviceToken.trim() ? "set" : "unset";
   const dashboardUrl =
     typeof runtime.dashboardUrl === "string" && runtime.dashboardUrl.trim()
       ? runtime.dashboardUrl.trim()
@@ -154,29 +151,9 @@ function buildRuntimeChecks(runtime = {}) {
     ? Number(runtime.httpTimeoutMs)
     : null;
   const debug = Boolean(runtime.debug);
-  const autoRetryNoSpawn = Boolean(runtime.autoRetryNoSpawn);
 
-  checks.push({
-    id: "runtime.base_url",
-    status: baseUrl ? "ok" : "fail",
-    detail: baseUrl ? "base_url set" : "base_url missing",
-    critical: false,
-    meta: {
-      base_url: baseUrl,
-      source: runtime?.sources?.baseUrl || null,
-    },
-  });
-
-  checks.push({
-    id: "runtime.device_token",
-    status: deviceToken === "set" ? "ok" : "warn",
-    detail: deviceToken === "set" ? "device token set" : "device token missing",
-    critical: false,
-    meta: {
-      device_token: deviceToken,
-      source: runtime?.sources?.deviceToken || null,
-    },
-  });
+  // base URL / device token checks removed: local-only, there is no remote
+  // endpoint to point at and no credential to hold.
 
   checks.push({
     id: "runtime.dashboard_url",
@@ -211,16 +188,11 @@ function buildRuntimeChecks(runtime = {}) {
     },
   });
 
-  checks.push({
-    id: "runtime.auto_retry_no_spawn",
-    status: "ok",
-    detail: autoRetryNoSpawn ? "auto retry spawn disabled" : "auto retry spawn enabled",
-    critical: false,
-    meta: {
-      auto_retry_no_spawn: autoRetryNoSpawn,
-      source: runtime?.sources?.autoRetryNoSpawn || null,
-    },
-  });
+  // runtime.auto_retry_no_spawn removed: scheduleAutoRetry and
+  // spawnAutoRetryProcess went with cloud upload, so this reported on a spawn
+  // path that cannot happen — and told anyone setting the env var that their
+  // opt-out had taken effect on nothing.
+
 
   return checks;
 }
@@ -346,48 +318,6 @@ async function checkCliEntrypoint(cliPath) {
   }
 }
 
-async function checkNetwork({ baseUrl, fetch }) {
-  if (!baseUrl) {
-    return {
-      id: "network.base_url",
-      status: "warn",
-      detail: "base_url missing (skipped)",
-      critical: false,
-      meta: { base_url: null },
-    };
-  }
-
-  const start = Date.now();
-  try {
-    if (typeof fetch !== "function") throw new Error("Missing fetch");
-    const res = await fetch(baseUrl, { method: "GET" });
-    const latency = Date.now() - start;
-    return {
-      id: "network.base_url",
-      status: "ok",
-      detail: `HTTP ${res.status} (reachable)`,
-      critical: false,
-      meta: {
-        status_code: res.status,
-        latency_ms: latency,
-        base_url: baseUrl,
-      },
-    };
-  } catch (err) {
-    const latency = Date.now() - start;
-    return {
-      id: "network.base_url",
-      status: "fail",
-      detail: "Network error",
-      critical: false,
-      meta: {
-        error: err?.message || String(err),
-        latency_ms: latency,
-        base_url: baseUrl,
-      },
-    };
-  }
-}
 
 function buildDiagnosticsChecks(diagnostics) {
   const checks = [];
@@ -409,14 +339,9 @@ function buildDiagnosticsChecks(diagnostics) {
     meta: { configured: notifyConfigured },
   });
 
-  const uploadError = diagnostics?.upload?.last_error || null;
-  checks.push({
-    id: "upload.last_error",
-    status: uploadError ? "warn" : "ok",
-    detail: uploadError ? "last upload error present" : "no upload errors",
-    critical: false,
-    meta: { last_error: uploadError ? uploadError.message || null : null },
-  });
+  // The upload.last_error check is gone with cloud upload: `diagnostics.upload`
+  // no longer exists, so the check could only ever report "no upload errors" —
+  // a permanent green that says nothing.
 
   return checks;
 }

package/src/lib/file-identity.js

@@ -0,0 +1,69 @@
+const crypto = require("node:crypto");
+const fssync = require("node:fs");
+
+// Fingerprint the first bytes of a file so rotation is detected even when the
+// OS reuses the inode after unlink+recreate (Linux logrotate). Returns "" on
+// any error so callers treat "no fingerprint" as "not changed". Also returns
+// "" when the file is shorter than the fingerprint window: for a sub-256B
+// file that is still being appended to, the window would extend into the
+// not-yet-written append zone, so plain growth (not rotation) would shift
+// the hash and produce a false "rotated" signal.
+function readFileHeadSignature(filePath) {
+  try {
+    const fd = fssync.openSync(filePath, "r");
+    try {
+      const buf = Buffer.alloc(256);
+      const bytes = fssync.readSync(fd, buf, 0, 256, 0);
+      if (bytes < 256) return "";
+      return crypto.createHash("sha1").update(buf.subarray(0, bytes)).digest("hex");
+    } finally {
+      fssync.closeSync(fd);
+    }
+  } catch {
+    return "";
+  }
+}
+
+// A token that changes whenever a file's contents could have changed. Returns
+// null when the path is not a readable regular file, which callers must treat
+// as "cannot be reused" rather than "unchanged".
+function fileIdentity(filePath) {
+  let st = null;
+  try {
+    st = fssync.statSync(filePath);
+  } catch {
+    return null;
+  }
+  if (!st.isFile()) return null;
+  return {
+    inode: st.ino || 0,
+    size: Number.isFinite(st.size) ? st.size : 0,
+    mtimeMs: Number.isFinite(st.mtimeMs) ? st.mtimeMs : 0,
+    head: readFileHeadSignature(filePath),
+  };
+}
+
+// Equality, not ordering. Deliberately not `cur.mtimeMs > prev.mtimeMs`: a
+// clock that moves backwards, a restored mtime, or a truncation must all read
+// as "changed" and force a re-read. The cost of a false "changed" is a wasted
+// parse; the cost of a false "unchanged" is serving stale data forever.
+function isUnchanged(prev, cur) {
+  if (!prev || !cur) return false;
+  // An empty head means the file was too short to fingerprint, so it carries
+  // no rotation signal — fall back to inode/size/mtime alone rather than
+  // treating "" as a mismatch.
+  const headChanged =
+    typeof prev.head === "string" && prev.head !== "" && prev.head !== cur.head;
+  return (
+    prev.inode === cur.inode &&
+    prev.size === cur.size &&
+    prev.mtimeMs === cur.mtimeMs &&
+    !headChanged
+  );
+}
+
+module.exports = {
+  readFileHeadSignature,
+  fileIdentity,
+  isUnchanged,
+};

package/src/lib/init-flow.js

@@ -27,9 +27,12 @@ function renderAuthTransition({ authUrl, canAutoOpen }) {
 }
 
 function renderSuccessBox({ configPath, dashboardUrl }) {
-  const identityLine = "Account linked.";
-  const lines = ["You are all set!", "", identityLine, `Token saved to: ${configPath}`, ""];
-  if (dashboardUrl) lines.push(`View your stats at: ${dashboardUrl}`);
+  // Local-only: there is no account and no remote dashboard. `dashboardUrl` is
+  // null on a clean install now that the cloud default is gone, so fall back to
+  // the address `serve` actually listens on — otherwise setup finishes without
+  // telling the user where to look.
+  const lines = ["You are all set!", "", `Config saved to: ${configPath}`, ""];
+  lines.push(`View your stats at: ${dashboardUrl || "http://localhost:7680"}`);
   lines.push("You can close this terminal window.");
   process.stdout.write(`${renderBox(lines)}\n`);
 }

package/src/lib/local-api.js

@@ -3,7 +3,6 @@ const os = require("node:os");
 const path = require("node:path");
 const { spawn } = require("node:child_process");
 const crypto = require("node:crypto");
-const { DEFAULT_BASE_URL, resolveRuntimeConfig } = require("./runtime-config");
 const {
   filterRowsByUsageScope,
   getSourceScope,
@@ -445,35 +444,7 @@ function trimOutput(value, max = 4000) {
   return t.length <= max ? t : t.slice(t.length - max);
 }
 
-function normalizeRemoteHttpBaseUrl(value) {
-  if (typeof value !== "string") return null;
-  const trimmed = value.trim();
-  if (!trimmed) return null;
-  try {
-    const url = new URL(trimmed);
-    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-    url.username = "";
-    url.password = "";
-    url.hash = "";
-    return url.toString().replace(/\/$/, "");
-  } catch (_e) {
-    return null;
-  }
-}
 
-function resolveAllowedInsforgeBaseUrl(value) {
-  const requested = normalizeRemoteHttpBaseUrl(value);
-  if (!requested) return null;
-
-  const runtime = resolveRuntimeConfig();
-  const allowed = new Set(
-    [runtime.baseUrl, DEFAULT_BASE_URL]
-      .map((entry) => normalizeRemoteHttpBaseUrl(entry))
-      .filter(Boolean),
-  );
-
-  return allowed.has(requested) ? requested : null;
-}
 
 function parseCookieHeader(value) {
   const out = new Map();
@@ -709,45 +680,6 @@ const HOP_BY_HOP_HEADERS = new Set([
   "trailers",
 ]);
 
-// Strip forbidden + hop-by-hop headers when forwarding an inbound request to
-// fetch(). Honours the Connection header's named-headers list (RFC 7230 §6.1)
-// so values like `Connection: keep-alive, x-custom` also drop x-custom.
-function buildProxyHeaders(headers) {
-  const entries =
-    headers && typeof headers.entries === "function"
-      ? Array.from(headers.entries())
-      : Object.entries(headers || {});
-
-  const connectionNamed = new Set();
-  const normalized = [];
-  for (const [rawKey, rawValue] of entries) {
-    if (rawValue == null) continue;
-    const key = String(rawKey).toLowerCase();
-    normalized.push([key, rawValue]);
-    if (key === "connection") {
-      const values = Array.isArray(rawValue) ? rawValue : [rawValue];
-      for (const v of values) {
-        String(v)
-          .split(",")
-          .map((part) => part.trim().toLowerCase())
-          .filter(Boolean)
-          .forEach((part) => connectionNamed.add(part));
-      }
-    }
-  }
-
-  const out = {};
-  for (const [key, rawValue] of normalized) {
-    if (HOP_BY_HOP_HEADERS.has(key) || connectionNamed.has(key)) continue;
-    if (Array.isArray(rawValue)) {
-      const joined = rawValue.filter((e) => e != null).map(String).join(", ");
-      if (joined) out[key] = joined;
-      continue;
-    }
-    out[key] = String(rawValue);
-  }
-  return out;
-}
 
 // ---------------------------------------------------------------------------
 // Main handler factory
@@ -756,169 +688,7 @@ function buildProxyHeaders(headers) {
 function createLocalApiHandler({ queuePath }) {
   const qp = queuePath || resolveQueuePath();
 
-  // Server-side cookie relay: captures auth cookies from InsForge cloud responses
-  // so that both browser and WKWebView share the same login session via the proxy.
-  // Persisted to disk so cookies survive server restarts.
-  const csrfRelayCookieName = "insforge_csrf_token";
-  let relayCookies = new Map();
   const localAuthToken = crypto.randomBytes(24).toString("hex");
-  const trackerDataDir = path.join(os.homedir(), ".tokentracker", "tracker");
-  const cookiePath = path.join(trackerDataDir, "relay-cookies.json");
-
-  // Load persisted cookies on startup
-  try {
-    if (!fs.existsSync(trackerDataDir)) fs.mkdirSync(trackerDataDir, { recursive: true });
-    if (fs.existsSync(cookiePath)) {
-      const content = fs.readFileSync(cookiePath, "utf8");
-      const saved = JSON.parse(content);
-      if (saved && typeof saved === "object") {
-        let count = 0;
-        for (const [k, v] of Object.entries(saved)) {
-          relayCookies.set(k, v);
-          count++;
-        }
-        if (count > 0) console.log(`[LocalAPI] Loaded ${count} relay cookies from ${cookiePath}`);
-      }
-    }
-  } catch (e) {
-    console.error("[LocalAPI] Failed to load relay cookies:", e.message);
-  }
-
-  function persistRelayCookies() {
-    try {
-      // Sticky semantics: never replace an existing on-disk session with an empty cookie map.
-      if (relayCookies.size === 0) return;
-
-      const json = JSON.stringify(Object.fromEntries(relayCookies));
-      fs.writeFileSync(cookiePath, json, { encoding: "utf8", mode: 0o600 });
-    } catch (e) {
-      console.error("[LocalAPI] Failed to persist relay cookies:", e.message);
-    }
-  }
-
-  function clearRelayCookies(reason) {
-    if (relayCookies.size === 0) return;
-    relayCookies.clear();
-    try {
-      if (fs.existsSync(cookiePath)) fs.unlinkSync(cookiePath);
-    } catch (e) {
-      console.error("[LocalAPI] Failed to clear relay cookies:", e.message);
-      return;
-    }
-    if (reason) console.warn(`[LocalAPI] Cleared relay cookies: ${reason}`);
-  }
-
-  function captureSetCookies(headerValue) {
-    if (!headerValue) return;
-    const parts = headerValue.split(/,(?=\s*\w+=)/);
-    let changed = false;
-    for (const raw of parts) {
-      const eqIdx = raw.indexOf("=");
-      if (eqIdx < 1) continue;
-      const name = raw.substring(0, eqIdx).trim();
-      if (!name) continue;
-
-      // Basic sticky logic: if it's a deletion cookie (Max-Age=0 or past date),
-      // we only remove it if we have it.
-      const lower = raw.toLowerCase();
-      const isDeletion = lower.includes("max-age=0") || lower.includes("expires=thu, 01 jan 1970");
-      
-      if (isDeletion) {
-        if (relayCookies.has(name)) {
-          relayCookies.delete(name);
-          changed = true;
-          console.log(`[LocalAPI] Cookie deleted: ${name}`);
-        }
-      } else {
-        const oldVal = relayCookies.get(name);
-        if (oldVal !== raw.trim()) {
-          relayCookies.set(name, raw.trim());
-          changed = true;
-          console.log(`[LocalAPI] Cookie captured: ${name}`);
-        }
-      }
-    }
-    if (changed) persistRelayCookies();
-  }
-
-  function getRelayCookieValue(name, { decode = false } = {}) {
-    const raw = relayCookies.get(name);
-    if (!raw || typeof raw !== "string") return "";
-    const pair = raw.split(";")[0] || "";
-    const eqIdx = pair.indexOf("=");
-    if (eqIdx < 1) return "";
-    const value = pair.substring(eqIdx + 1).trim();
-    if (!decode) return value;
-    try {
-      return decodeURIComponent(value);
-    } catch {
-      return value;
-    }
-  }
-
-  function captureAuthTokensFromBody(bodyBuffer, contentType) {
-    if (!bodyBuffer || !String(contentType || "").toLowerCase().includes("application/json")) return;
-    let parsed = null;
-    try {
-      parsed = JSON.parse(bodyBuffer.toString("utf8"));
-    } catch {
-      return;
-    }
-    let changed = false;
-    const token = typeof parsed?.csrfToken === "string" ? parsed.csrfToken.trim() : "";
-    if (token) {
-      const cookie = `${csrfRelayCookieName}=${encodeURIComponent(token)}; Path=/; SameSite=Lax`;
-      if (relayCookies.get(csrfRelayCookieName) !== cookie) {
-        relayCookies.set(csrfRelayCookieName, cookie);
-        changed = true;
-      }
-    }
-    const refreshToken = typeof parsed?.refreshToken === "string" ? parsed.refreshToken.trim() : "";
-    if (refreshToken) {
-      const cookie = `insforge_refresh_token=${encodeURIComponent(refreshToken)}; Path=/; HttpOnly; SameSite=Lax`;
-      if (relayCookies.get("insforge_refresh_token") !== cookie) {
-        relayCookies.set("insforge_refresh_token", cookie);
-        changed = true;
-      }
-    }
-    if (changed) persistRelayCookies();
-  }
-
-  function normalizeCookieHeader(value) {
-    if (Array.isArray(value)) return value.filter(Boolean).join("; ");
-    return typeof value === "string" ? value : "";
-  }
-
-  function buildRelayCookieHeader(clientCookieHeader, { relayPrecedenceNames = [] } = {}) {
-    const normalizedClientCookieHeader = normalizeCookieHeader(clientCookieHeader);
-    if (relayCookies.size === 0) return normalizedClientCookieHeader;
-    const relayPrecedence = new Set(relayPrecedenceNames);
-    const clientPairs = new Map();
-    if (normalizedClientCookieHeader) {
-      for (const part of normalizedClientCookieHeader.split(";")) {
-        const eqIdx = part.indexOf("=");
-        if (eqIdx < 1) continue;
-        const n = part.substring(0, eqIdx).trim();
-        if (n) clientPairs.set(n, part.trim());
-      }
-    }
-    // Merge relay cookies. Normal requests keep client precedence; refresh
-    // recovery can opt relay cookies into precedence over stale WebView cookies.
-    for (const [name, raw] of relayCookies) {
-      if (clientPairs.has(name) && !relayPrecedence.has(name)) continue;
-      const scIdx = raw.indexOf(";");
-      const pair = scIdx > 0 ? raw.substring(0, scIdx).trim() : raw;
-      clientPairs.set(name, pair);
-    }
-    return [...clientPairs.values()].join("; ");
-  }
-
-  // Ephemeral auth bridge: WebView sets a "native" flag before opening system browser
-  // for OAuth. The callback page (in browser) checks this flag to decide whether to
-  // relay the code back to the app or handle it as a normal web flow.
-  let _nativeAuthPending = false;
-  let _nativeAuthExpiry = 0;
-
   function isAuthorizedLocalMutation(req) {
     const headerToken = req?.headers?.["x-tokentracker-local-auth"];
     const cookieToken = parseCookieHeader(req?.headers?.cookie).get("tokentracker_local_auth");
@@ -945,124 +715,6 @@ function createLocalApiHandler({ queuePath }) {
       return true;
     }
 
-    // --- Auth bridge: native OAuth flag (WebView ↔ system browser) ---
-    if (p === "/api/auth-bridge/verifier") {
-      const method = String(req.method || "GET").toUpperCase();
-      if (method === "PUT" || method === "POST") {
-        if (!isAuthorizedLocalMutation(req)) {
-          json(res, { error: "Unauthorized" }, 401);
-          return true;
-        }
-        const body = await readJsonBody(req);
-        _nativeAuthPending = Boolean(body?.native);
-        _nativeAuthExpiry = Date.now() + 5 * 60 * 1000; // 5 min TTL
-        json(res, { ok: true });
-        return true;
-      }
-      if (method === "GET") {
-        const isNative = _nativeAuthPending && Date.now() < _nativeAuthExpiry;
-        _nativeAuthPending = false; // one-time read
-        _nativeAuthExpiry = 0;
-        json(res, { native: isNative });
-        return true;
-      }
-      json(res, { error: "Method Not Allowed" }, 405);
-      return true;
-    }
-
-    // --- auth proxy: forward /api/auth/* to InsForge cloud ---
-    if (p.startsWith("/api/auth/")) {
-      const runtime = resolveRuntimeConfig();
-      const insforgeBase = runtime.baseUrl || DEFAULT_BASE_URL;
-      try {
-        const targetUrl = `${insforgeBase.replace(/\/$/, "")}${p}${url.search || ""}`;
-        const proxyHeaders = buildProxyHeaders(req.headers);
-        const hasClientCookie = normalizeCookieHeader(proxyHeaders["cookie"]).trim().length > 0;
-        const hasCsrfHeader = typeof proxyHeaders["x-csrf-token"] === "string" && proxyHeaders["x-csrf-token"].trim().length > 0;
-        const relayCsrfToken = getRelayCookieValue(csrfRelayCookieName);
-        if (p === "/api/auth/refresh" && relayCsrfToken) {
-          proxyHeaders["x-csrf-token"] = relayCsrfToken;
-        }
-        const hasEffectiveCsrfHeader =
-          hasCsrfHeader ||
-          (typeof proxyHeaders["x-csrf-token"] === "string" && proxyHeaders["x-csrf-token"].trim().length > 0);
-        let shouldInjectRelayCookies =
-          p !== "/api/auth/refresh" || hasClientCookie || hasEffectiveCsrfHeader;
-        const relayRefreshToken = getRelayCookieValue("insforge_refresh_token", { decode: true });
-        const shouldUseRelayRefreshFallback =
-          p === "/api/auth/refresh" && !hasClientCookie && !hasEffectiveCsrfHeader && relayRefreshToken;
-        if (shouldUseRelayRefreshFallback) {
-          shouldInjectRelayCookies = false;
-        }
-
-        // Inject relay cookies so WebView benefits from browser's login session.
-        // Refresh requests need either a browser cookie or an explicit CSRF token;
-        // otherwise replaying a stale persisted refresh cookie just manufactures
-        // Invalid CSRF errors on startup.
-        const originalCookieHeader = normalizeCookieHeader(proxyHeaders["cookie"]);
-        const mergedCookie = shouldInjectRelayCookies
-          ? buildRelayCookieHeader(originalCookieHeader, {
-              relayPrecedenceNames: p === "/api/auth/refresh"
-                ? [csrfRelayCookieName, "insforge_refresh_token"]
-                : [],
-            })
-          : originalCookieHeader;
-        const injectedRelayCookies =
-          shouldInjectRelayCookies && relayCookies.size > 0 && mergedCookie !== originalCookieHeader;
-        if (mergedCookie) proxyHeaders["cookie"] = mergedCookie;
-
-        const bodyChunks = [];
-        for await (const chunk of req) bodyChunks.push(chunk);
-        let proxyBody = bodyChunks.length > 0 ? Buffer.concat(bodyChunks) : undefined;
-        let effectiveTargetUrl = targetUrl;
-        if (shouldUseRelayRefreshFallback) {
-          effectiveTargetUrl = `${insforgeBase.replace(/\/$/, "")}/api/auth/refresh?client_type=mobile`;
-          proxyHeaders["content-type"] = "application/json";
-          delete proxyHeaders["content-length"];
-          proxyBody = Buffer.from(JSON.stringify({ refresh_token: relayRefreshToken }), "utf8");
-        }
-        const proxyRes = await fetch(effectiveTargetUrl, {
-          method: req.method || "GET",
-          headers: proxyHeaders,
-          body: proxyBody,
-          credentials: "include",
-          redirect: "manual",
-        });
-        const responseHeaders = [...proxyRes.headers.entries()]
-          .filter(([k]) => !["transfer-encoding", "connection"].includes(k.toLowerCase()))
-          .map(([k, v]) => {
-            if (k.toLowerCase() === "set-cookie") {
-              const rewritten = v.replace(/;\s*[Dd]omain=[^;]*/g, "; Domain=localhost");
-              captureSetCookies(rewritten);
-              return [k, rewritten];
-            }
-            return [k, v];
-          });
-        res.writeHead(proxyRes.status, Object.fromEntries(responseHeaders));
-        const resBody = Buffer.from(await proxyRes.arrayBuffer());
-        if (proxyRes.status >= 200 && proxyRes.status < 300) {
-          if (p === "/api/auth/logout") {
-            clearRelayCookies("sign out");
-          } else {
-            captureAuthTokensFromBody(resBody, proxyRes.headers.get("content-type"));
-          }
-        }
-        if (
-          p === "/api/auth/refresh"
-          && proxyRes.status === 403
-          && injectedRelayCookies
-          && !hasClientCookie
-          && /invalid csrf token/i.test(resBody.toString("utf8"))
-        ) {
-          clearRelayCookies("stale refresh cookie without local CSRF context");
-        }
-        res.end(resBody);
-      } catch (e) {
-        json(res, { error: `Auth proxy error: ${e?.message || e}` }, 502);
-      }
-      return true;
-    }
-
     // --- ip-check proxy: reverse-proxy ip.net.coffee (issue #81) ---
     // Lock-down: GET/HEAD only, restricted path prefixes, do not forward
     // browser credentials or fingerprintable headers. Without these limits
@@ -1101,7 +753,7 @@ function createLocalApiHandler({ queuePath }) {
           accept: req.headers["accept"] || "*/*",
           "accept-language": req.headers["accept-language"] || "en",
           "accept-encoding": req.headers["accept-encoding"] || "gzip",
-          "user-agent": "TokenTracker/IPCheck (https://www.tokentracker.cc)",
+          "user-agent": "TokenTracker/IPCheck",
           referer: `${IP_CHECK_TARGET}${targetPath}`,
         };
 
@@ -1207,7 +859,7 @@ function createLocalApiHandler({ queuePath }) {
           headers: {
             accept: req.headers["accept"] || "image/*",
             "accept-language": req.headers["accept-language"] || "en",
-            "user-agent": "TokenTracker/AvatarProxy (https://www.tokentracker.cc)",
+            "user-agent": "TokenTracker/AvatarProxy",
           },
         });
         if (!upstream.ok) {
@@ -1257,19 +909,10 @@ function createLocalApiHandler({ queuePath }) {
         } catch {
           body = {};
         }
-        const extraEnv = {};
-        if (typeof body.deviceToken === "string" && body.deviceToken.trim()) {
-          extraEnv.TOKENTRACKER_DEVICE_TOKEN = body.deviceToken.trim();
-        }
-        if (body.insforgeBaseUrl != null) {
-          const allowedBaseUrl = resolveAllowedInsforgeBaseUrl(body.insforgeBaseUrl);
-          if (!allowedBaseUrl) {
-            json(res, { ok: false, error: "Unsupported insforgeBaseUrl override" }, 400);
-            return true;
-          }
-          extraEnv.TOKENTRACKER_INSFORGE_BASE_URL = allowedBaseUrl;
-        }
-        const result = await runSyncCommand(extraEnv);
+        // Local-only: the sync command takes no cloud credentials or endpoint
+        // overrides any more, so the request body carries nothing to forward.
+        void body;
+        const result = await runSyncCommand({});
         try {
           const { resetUsageLimitsCache } = require("./usage-limits");
           resetUsageLimitsCache();
@@ -1876,7 +1519,6 @@ function createLocalApiHandler({ queuePath }) {
 
 module.exports = {
   createLocalApiHandler,
-  resolveAllowedInsforgeBaseUrl,
   resolveQueuePath,
   // Exported for cross-consumer tests (pricing + native contract lock).
   MODEL_PRICING,

package/src/lib/pricing/curated-overrides.json

@@ -3,7 +3,7 @@
     "note": "Curated price overrides. Always wins over LiteLLM. Two reasons to live here: (1) self-defined alias names that LiteLLM will never carry (kiro-*, hy3-*, composer-*, kimi-for-coding, free-tier OpenRouter routes); (2) prices we want to pin even if LiteLLM has the model (e.g. cache_write fields LiteLLM often omits). Units: USD per million tokens. Edit this file to override pricing without redeploying.",
     "units": "usd_per_million_tokens",
     "deepseek_v4_pro_discount_expiry": "2026-05-31T15:59:00Z — DeepSeek v4-pro is currently at a 75% promotional discount. After expiry the prices revert to 4x: input $1.74/M, output $3.48/M, cache_read $0.0145/M, cache_write $1.74/M. Update this file before the cutover.",
-    "sonnet5_intro_price_expiry": "2026-08-31 — Sonnet 5 intro price 2/10 reverts to 3/15 sticker. The src pricing path auto-tracks LiteLLM (no edit needed), but the 5 dashboard/edge-patches MODEL_PRICING tables hardcode 2/10 and must be reverted to 3/15 manually + re-vendor the seed. See issue #16."
+    "sonnet5_intro_price_expiry": "2026-08-31 — Sonnet 5 intro price 2/10 reverts to 3/15 sticker. The src pricing path auto-tracks LiteLLM (no edit needed); re-vendor the seed after the cutover. See issue #16."
   },
   "exact": {
     "claude-fable-5": { "input": 10, "output": 50, "cache_read": 1, "cache_write": 12.5, "note": "Pinned from Anthropic public pricing until bundled LiteLLM seed carries Fable 5." },