@ipv9/tokentracker-cli 0.39.38 → 0.39.40

package/src/commands/init.js

@@ -57,7 +57,6 @@ const {
   resolvePiAgentDir,
   piAgentDirCollidesWithOmp,
 } = require("../lib/rollout");
-const { resolveRuntimeConfig, DEFAULT_BASE_URL } = require("../lib/runtime-config");
 const {
   BOLD,
   DIM,
@@ -86,7 +85,6 @@ const ASCII_LOGO = [
 ].join("\n");
 
 const DIVIDER = "----------------------------------------------";
-const DEFAULT_DASHBOARD_URL = "https://www.tokentracker.cc";
 
 // Single source of truth for the welcome screen's provider count + sample list.
 // Keep in sync with the supported-tools table in CLAUDE.md.
@@ -120,11 +118,6 @@ async function cmdInit(argv) {
   const linkCodeStatePath = path.join(trackerDir, "link_code_state.json");
 
   const existingConfig = await readJson(configPath);
-  const runtime = resolveRuntimeConfig({
-    cli: { baseUrl: opts.baseUrl, dashboardUrl: opts.dashboardUrl },
-    config: existingConfig || {},
-    env: process.env,
-  });
   const notifyPath = path.join(binDir, "notify.cjs");
   const appDir = path.join(trackerDir, "app");
   const trackerBinPath = path.join(appDir, "bin", "tracker.js");
@@ -156,7 +149,6 @@ async function cmdInit(argv) {
       home,
       trackerDir,
       notifyPath,
-      runtime,
     });
     renderLocalReport({ summary: preview.summary, isDryRun: true });
     renderAccountNotLinked({ context: "dry-run" });
@@ -178,7 +170,6 @@ async function cmdInit(argv) {
       notifyPath,
       appDir,
       trackerBinPath,
-      runtime,
       existingConfig,
     });
   } catch (err) {
@@ -280,20 +271,10 @@ function renderAccountNotLinked({ context } = {}) {
   renderLocalSuccess();
 }
 
-function shouldUseBrowserAuth({ deviceToken, opts }) {
-  if (deviceToken) return false;
-  if (opts.noAuth) return false;
-  if (opts.linkCode) return false;
-  if (opts.email || opts.password) return false;
-  return true;
-}
-
-async function buildDryRunSummary({ opts, home, trackerDir, notifyPath, runtime }) {
-  const deviceToken = runtime?.deviceToken || null;
-  const pendingBrowserAuth = shouldUseBrowserAuth({ deviceToken, opts });
+async function buildDryRunSummary({ opts, home, trackerDir, notifyPath }) {
   const context = buildIntegrationTargets({ home, trackerDir, notifyPath });
   const summary = await previewIntegrations({ context });
-  return { summary, pendingBrowserAuth, deviceToken };
+  return { summary };
 }
 
 async function runSetup({
@@ -307,15 +288,12 @@ async function runSetup({
   notifyPath,
   appDir,
   trackerBinPath,
-  runtime,
   existingConfig,
 }) {
   await ensureDir(trackerDir);
   await ensureDir(binDir);
-  let deviceToken = runtime?.deviceToken || null;
   let deviceId = existingConfig?.deviceId || null;
   const installedAt = existingConfig?.installedAt || new Date().toISOString();
-  let pendingBrowserAuth = false;
 
   await installLocalTrackerApp({ appDir });
 
@@ -323,13 +301,33 @@ async function runSetup({
     existingConfig && typeof existingConfig === "object" && !Array.isArray(existingConfig)
       ? existingConfig
       : {};
+  // Scrub cloud credentials and endpoints on upgrade. Spreading the previous
+  // config forward kept a live InsForge bearer token in config.json, and this
+  // branch also removed the `status` / `diagnostics` lines that used to reveal
+  // it — so the user is told "local-only, nothing is uploaded" while a valid
+  // credential sits on disk with nothing left to report or rotate it.
+  const {
+    deviceToken: _removedDeviceToken,
+    baseUrl: _removedBaseUrl,
+    dashboardUrl: _removedDashboardUrl,
+    ...carriedConfig
+  } = existingPlainConfig;
   const config = {
-    ...existingPlainConfig,
+    ...carriedConfig,
     installedAt,
-    baseUrl: opts.baseUrl || existingPlainConfig.baseUrl || DEFAULT_BASE_URL,
   };
-  if (opts.dashboardUrl) {
-    config.dashboardUrl = opts.dashboardUrl;
+
+  // Files written by the removed cloud paths. The only code that ever deleted
+  // relay-cookies.json was clearRelayCookies(), which went with the auth proxy,
+  // so an upgrading machine would otherwise keep a refresh token forever.
+  for (const stale of ["relay-cookies.json", "upload.throttle.json", "auto.retry.json"]) {
+    try {
+      await fs.unlink(path.join(trackerDir, stale));
+    } catch (error) {
+      if (error?.code !== "ENOENT") {
+        process.stderr.write(`[tokentracker] could not remove ${stale}: ${error.message}\n`);
+      }
+    }
   }
 
   await writeJson(configPath, config);
@@ -350,8 +348,6 @@ async function runSetup({
 
   return {
     summary,
-    pendingBrowserAuth,
-    deviceToken,
     deviceId,
     installedAt,
   };
@@ -803,8 +799,6 @@ function arraysEqual(a, b) {
 
 function parseArgs(argv) {
   const out = {
-    baseUrl: null,
-    dashboardUrl: null,
     email: null,
     password: null,
     deviceName: null,
@@ -817,13 +811,33 @@ function parseArgs(argv) {
 
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
-    if (a === "--base-url") out.baseUrl = argv[++i] || null;
-    else if (a === "--dashboard-url") out.dashboardUrl = argv[++i] || null;
-    else if (a === "--email") out.email = argv[++i] || null;
-    else if (a === "--password") out.password = argv[++i] || null;
-    else if (a === "--device-name") out.deviceName = argv[++i] || null;
-    else if (a === "--link-code") out.linkCode = argv[++i] || null;
-    else if (a === "--no-auth") out.noAuth = true;
+    // Cloud sign-in flags (--email/--password/--device-name/--link-code/
+    // --no-auth) are gone: there is no account to sign into. Accept and
+    // ignore --no-auth so existing scripts and hooks do not start failing
+    // with "Unknown option"; the others were only ever used with it.
+    if (a === "--no-auth") {
+      // Accepted and ignored: it was the "skip sign-in" opt-out, and there is
+      // no sign-in left to skip. Silently tolerated so existing hooks and
+      // scripts do not start failing with "Unknown option".
+      out.noAuth = true;
+    } else if (a === "--email" || a === "--password" || a === "--device-name") {
+      i += 1;
+    } else if (
+      a.startsWith("--email=") ||
+      a.startsWith("--password=") ||
+      a.startsWith("--device-name=")
+    ) {
+      // Swallow the `=` form too. Falling through raised
+      // `Unknown option: --password=hunter2`, and bin/tracker.js prints the
+      // stack — putting the secret on stderr and into any captured log.
+    } else if (a === "--link-code" || a.startsWith("--link-code=")) {
+      // Fail loudly. Unlike the others this was documented standalone, so a
+      // user pairing a device would otherwise see "Setup complete!" and
+      // believe the code was honored.
+      throw new Error(
+        "--link-code is no longer supported: TokenTracker is local-only and has no device pairing.",
+      );
+    }
     else if (a === "--no-open") out.noOpen = true;
     else if (a === "--yes") out.yes = true;
     else if (a === "--dry-run") out.dryRun = true;
@@ -883,7 +897,6 @@ const codexOriginalPath = ${JSON.stringify(originalPath)};
 const codeOriginalPath = ${JSON.stringify(path.join(trackerDir, "code_notify_original.json"))};
 const trackerBinPath = ${JSON.stringify(trackerBinPath)};
   const depsMarkerPath = path.join(trackerDir, 'app', 'bin', 'tracker.js');
-  const configPath = path.join(trackerDir, 'config.json');
 const fallbackPkg = ${JSON.stringify(fallbackPkg)};
 const selfPath = path.resolve(__filename);
 const home = os.homedir();
@@ -919,20 +932,17 @@ if (debugEnabled) {
 }
 
 // Throttle spawn: at most once per 20 seconds.
+// Parsing local logs and uploading to the cloud are two separate decisions.
+// This hook makes only the first one. It runs whether or not a device token
+// exists, because a local-only install still needs its queue refreshed when a
+// session ends. Upload stays gated on a device token inside sync itself, so
+// no credential here means local parse happens and nothing is transmitted.
 try {
-    const throttlePath = path.join(trackerDir, 'sync.throttle');
-    let deviceToken = process.env.TOKENTRACKER_DEVICE_TOKEN || null;
-    if (!deviceToken) {
-      try {
-        const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-        if (cfg && typeof cfg.deviceToken === 'string') deviceToken = cfg.deviceToken;
-      } catch (_) {}
-    }
-    const canSync = Boolean(deviceToken && deviceToken.length > 0);
-    const now = Date.now();
-    let last = 0;
-    try { last = Number(fs.readFileSync(throttlePath, 'utf8')) || 0; } catch (_) {}
-    if (canSync && now - last > 20_000) {
+  const throttlePath = path.join(trackerDir, 'sync.throttle');
+  const now = Date.now();
+  let last = 0;
+  try { last = Number(fs.readFileSync(throttlePath, 'utf8')) || 0; } catch (_) {}
+  if (now - last > 20_000) {
     try { fs.writeFileSync(throttlePath, String(now), 'utf8'); } catch (_) {}
     const hasLocalRuntime = fs.existsSync(trackerBinPath);
     const hasLocalDeps = fs.existsSync(depsMarkerPath);

package/src/commands/serve.js

@@ -2,7 +2,6 @@ const http = require("node:http");
 const os = require("node:os");
 const path = require("node:path");
 const fssync = require("node:fs");
-const cp = require("node:child_process");
 
 const { resolveTrackerPaths } = require("../lib/tracker-paths");
 const { createLocalApiHandler, resolveQueuePath } = require("../lib/local-api");
@@ -12,7 +11,7 @@ const {
 } = require("../lib/local-data-preflight");
 const { ensurePricingLoaded } = require("../lib/pricing");
 const { serveStaticFile } = require("../lib/static-server");
-const { openInBrowser } = require("../lib/browser-auth");
+const { openInBrowser } = require("../lib/browser-open");
 
 const DEFAULT_PORT = 7680;
 const DEFAULT_MAX_PORT_ATTEMPTS = 20;
@@ -20,7 +19,7 @@ const NPM_PACKAGE_NAME = "@ipv9/tokentracker-cli";
 const LOCAL_BIND_HOST = "127.0.0.1";
 
 function buildPortInUseHint(port) {
-  return `Port ${port} is still in use after cleanup. Try: npx ${NPM_PACKAGE_NAME} serve --port ${port + 1}\n`;
+  return `Port ${port} is unavailable. Try: npx ${NPM_PACKAGE_NAME} serve --port ${port + 1}\n`;
 }
 
 function isPortUnavailableError(error) {
@@ -155,7 +154,6 @@ async function cmdServe(argv) {
   try {
     port = await listenOnAvailablePort(server, opts.port, {
       allowFallback: !opts.portExplicit,
-      ensurePortFreeFn: opts.portExplicit ? ensurePortFree : null,
       onRetry: (failedPort) => {
         process.stdout.write(`Port ${failedPort} unavailable, trying ${failedPort + 1}...\n`);
       },
@@ -208,47 +206,6 @@ async function cmdServe(argv) {
   await new Promise(() => {});
 }
 
-function findPidOnPort(port) {
-  try {
-    const out = cp.execFileSync("lsof", ["-ti", `tcp:${port}`], { encoding: "utf8", timeout: 5000 });
-    const pids = out.trim().split(/\s+/).map(Number).filter((n) => Number.isFinite(n) && n > 0);
-    return pids;
-  } catch (_e) {
-    return [];
-  }
-}
-
-async function ensurePortFree(port) {
-  const pids = findPidOnPort(port);
-  if (pids.length === 0) return;
-
-  // Don't kill ourselves
-  const self = process.pid;
-  const targets = pids.filter((p) => p !== self);
-  if (targets.length === 0) return;
-
-  process.stdout.write(`Stopping previous server on port ${port} (pid ${targets.join(", ")})...\n`);
-  for (const pid of targets) {
-    try {
-      process.kill(pid, "SIGTERM");
-    } catch (_e) {}
-  }
-
-  // Wait briefly for port to free up
-  for (let i = 0; i < 10; i++) {
-    await new Promise((r) => setTimeout(r, 300));
-    if (findPidOnPort(port).length === 0) return;
-  }
-
-  // Force kill if still alive
-  for (const pid of targets) {
-    try {
-      process.kill(pid, "SIGKILL");
-    } catch (_e) {}
-  }
-  await new Promise((r) => setTimeout(r, 500));
-}
-
 function listenOnce(server, port, host) {
   return new Promise((resolve, reject) => {
     let settled = false;
@@ -283,7 +240,6 @@ async function listenOnAvailablePort(
     host = LOCAL_BIND_HOST,
     allowFallback = false,
     maxAttempts = DEFAULT_MAX_PORT_ATTEMPTS,
-    ensurePortFreeFn = null,
     onRetry = null,
   } = {},
 ) {
@@ -292,10 +248,6 @@ async function listenOnAvailablePort(
   let lastError = null;
 
   for (let i = 0; i < attempts && port < 65536; i++, port++) {
-    if (ensurePortFreeFn) {
-      await ensurePortFreeFn(port);
-    }
-
     try {
       await listenOnce(server, port, host);
       return port;

package/src/commands/status.js

@@ -25,9 +25,6 @@ const {
   describeCopilotOtelStatus,
   readCopilotOauthToken,
 } = require("../lib/usage-limits");
-const {
-  normalizeState: normalizeUploadState,
-} = require("../lib/upload-throttle");
 const { collectTrackerDiagnostics } = require("../lib/diagnostics");
 const { detectPassiveProviders, isPassiveModeActive } = require("../lib/passive-mode");
 const { probeOpenclawHookState } = require("../lib/openclaw-hook");
@@ -68,15 +65,11 @@ async function cmdStatus(argv = []) {
 
   const home = os.homedir();
   const { trackerDir, binDir } = await resolveTrackerPaths({ home });
-  const configPath = path.join(trackerDir, "config.json");
   const queuePath = path.join(trackerDir, "queue.jsonl");
-  const queueStatePath = path.join(trackerDir, "queue.state.json");
   const cursorsPath = path.join(trackerDir, "cursors.json");
   const notifySignalPath = path.join(trackerDir, "notify.signal");
   const openclawSignalPath = path.join(trackerDir, "openclaw.signal");
   const throttlePath = path.join(trackerDir, "sync.throttle");
-  const uploadThrottlePath = path.join(trackerDir, "upload.throttle.json");
-  const autoRetryPath = path.join(trackerDir, "auto.retry.json");
   const codexHome = process.env.CODEX_HOME || path.join(home, ".codex");
   const codexConfigPath = path.join(codexHome, "config.toml");
   const codeHome = process.env.CODE_HOME || path.join(home, ".code");
@@ -99,16 +92,9 @@ async function cmdStatus(argv = []) {
   const codebuddyHookCommand = buildHookCommand(notifyPath, "codebuddy");
   const geminiHookCommand = buildGeminiHookCommand(notifyPath);
 
-  const config = await readJson(configPath);
   const cursors = await readJson(cursorsPath);
-  const queueState = (await readJson(queueStatePath)) || { offset: 0 };
-  const uploadThrottle = normalizeUploadState(
-    await readJson(uploadThrottlePath),
-  );
-  const autoRetry = await readJson(autoRetryPath);
 
   const queueSize = await safeStatSize(queuePath);
-  const pendingBytes = Math.max(0, queueSize - (queueState.offset || 0));
 
   const lastNotify = (await safeReadText(notifySignalPath))?.trim() || null;
   const lastOpenclawSync =
@@ -148,23 +134,6 @@ async function cmdStatus(argv = []) {
     env: process.env,
   });
 
-  const lastUpload = uploadThrottle.lastSuccessMs
-    ? parseEpochMsToIso(uploadThrottle.lastSuccessMs)
-    : typeof queueState.updatedAt === "string"
-      ? queueState.updatedAt
-      : null;
-  const nextUpload = parseEpochMsToIso(uploadThrottle.nextAllowedAtMs || null);
-  const backoffUntil = parseEpochMsToIso(uploadThrottle.backoffUntilMs || null);
-  const lastUploadError = uploadThrottle.lastError
-    ? `${uploadThrottle.lastErrorAt || "unknown"} ${uploadThrottle.lastError}`
-    : null;
-  const autoRetryAt = parseEpochMsToIso(autoRetry?.retryAtMs || null);
-  const autoRetryLine = autoRetryAt
-    ? `- Auto retry after: ${autoRetryAt} (${autoRetry?.reason || "scheduled"}, pending ${Number(
-        autoRetry?.pendingBytes || 0,
-      )} bytes)`
-    : null;
-
   const subscriptions = await collectLocalSubscriptions({
     home,
     env: process.env,
@@ -277,22 +246,13 @@ async function cmdStatus(argv = []) {
   if (opts.json || opts.light) {
     const summary = {
       generated_at: new Date().toISOString(),
-      base_url: config?.baseUrl || null,
-      device_token_set: Boolean(config?.deviceToken),
       queue: {
-        pending_bytes: pendingBytes,
         size_bytes: queueSize,
-        offset: queueState.offset || 0,
       },
       last_parse: cursors?.updatedAt || null,
       last_notify: lastNotify || null,
       last_openclaw_sync: lastOpenclawSync || null,
       last_notify_spawn: lastNotifySpawn || null,
-      last_upload: lastUpload || null,
-      next_upload_after: nextUpload || null,
-      backoff_until: backoffUntil || null,
-      last_upload_error: lastUploadError || null,
-      auto_retry: autoRetry || null,
       hooks: {
         codex_notify: notifyConfigured,
         every_code_notify: everyCodeConfigured,
@@ -371,18 +331,11 @@ async function cmdStatus(argv = []) {
   process.stdout.write(
     [
       "Status:",
-      `- Base URL: ${config?.baseUrl || "unset"}`,
-      `- Device token: ${config?.deviceToken ? "set" : "unset"}`,
-      `- Queue: ${pendingBytes} bytes pending`,
+      `- Queue: ${queueSize} bytes`,
       `- Last parse: ${cursors?.updatedAt || "never"}`,
       `- Last notify: ${lastNotify || "never"}`,
       `- Last OpenClaw-triggered sync: ${lastOpenclawSync || "never"}`,
       `- Last notify-triggered sync: ${lastNotifySpawn || "never"}`,
-      `- Last upload: ${lastUpload || "never"}`,
-      `- Next upload after: ${nextUpload || "never"}`,
-      `- Backoff until: ${backoffUntil || "never"}`,
-      lastUploadError ? `- Last upload error: ${lastUploadError}` : null,
-      autoRetryLine,
       `- Codex notify: ${notifyConfigured ? JSON.stringify(codexNotify) : "unset"}`,
       `- Every Code notify: ${everyCodeConfigured ? JSON.stringify(everyCodeNotify) : "unset"}`,
       `- Claude hooks: ${claudeHookConfigured ? "set" : "unset"}`,
@@ -538,16 +491,9 @@ function renderLightTable(summary) {
   const rows = [];
   const push = (k, v) => rows.push([k, v == null || v === "" ? "—" : String(v)]);
 
-  push("Base URL", summary.base_url);
-  push("Device token", summary.device_token_set ? "set" : "unset");
-  push("Queue pending (bytes)", summary.queue.pending_bytes);
   push("Queue size (bytes)", summary.queue.size_bytes);
   push("Last parse", summary.last_parse);
   push("Last notify", summary.last_notify);
-  push("Last upload", summary.last_upload);
-  push("Next upload after", summary.next_upload_after);
-  push("Backoff until", summary.backoff_until);
-  if (summary.last_upload_error) push("Last upload error", summary.last_upload_error);
 
   for (const [name, state] of Object.entries(summary.hooks || {})) {
     push(`Hook · ${name}`, state ? "set" : "unset");