@ipv9/tokentracker-cli 0.39.38 → 0.39.40

package/src/commands/sync.js

@@ -62,13 +62,6 @@ const {
 } = require("../lib/rollout");
 const { computeClaudeGroundTruthBuckets } = require("../lib/claude-categorizer");
 const { createProgress, renderBar, formatNumber, formatBytes } = require("../lib/progress");
-const {
-  normalizeState: normalizeUploadState,
-  decideAutoUpload,
-  recordUploadFailure,
-  recordUploadSuccess,
-  parseRetryAfterMs,
-} = require("../lib/upload-throttle");
 const {
   isCursorInstalled,
   extractCursorSessionToken,
@@ -77,10 +70,16 @@ const {
 } = require("../lib/cursor-config");
 const { purgeProjectUsage } = require("../lib/project-usage-purge");
 const { resolveTrackerPaths } = require("../lib/tracker-paths");
-const { resolveRuntimeConfig } = require("../lib/runtime-config");
 
 const CURSOR_UNKNOWN_MIGRATION_KEY = "cursorUnknownPurge_2026_04";
 const ROLLOUT_CUMULATIVE_DELTA_MIGRATION_KEY = "rolloutCumulativeDeltaReparse_2026_05";
+// #75: rebuild Codex/every-code aggregates that were accumulated with the
+// pre-fix parser, which counted replayed subagent-fork parent history as child
+// consumption (up to ~40x Cache Read inflation on the local fork corpus). The
+// rolloutCumulativeDeltaReparse migration above already rebuilt these once, but
+// with the still-buggy parser, so a fresh key is required to rebuild again now
+// that the parser is fixed.
+const CODEX_FORK_OVERCOUNT_MIGRATION_KEY = "codexForkOvercountRebuild_2026_07";
 const CLAUDE_MEM_OBSERVER_REINCLUDE_KEY = "claudeMemObserverReinclude_2026_05_v3";
 const GROK_APPEND_ONLY_REPAIR_MIGRATION_KEY = "grokAppendOnlyRepair_2026_05_v4";
 const CLAUDE_MEM_OBSERVER_PATH_SEGMENT = "--claude-mem-observer-sessions";
@@ -146,14 +145,11 @@ async function cmdSync(argv) {
     const queueStatePath = path.join(trackerDir, "queue.state.json");
     const projectQueuePath = path.join(trackerDir, "project.queue.jsonl");
     const projectQueueStatePath = path.join(trackerDir, "project.queue.state.json");
-    const uploadThrottlePath = path.join(trackerDir, "upload.throttle.json");
     const grokSignalPath = path.join(trackerDir, "grok-last-session.json");
     const legacyGrokSignalPath = path.join(trackerDir, "tracker", "grok-last-session.json");
 
     const config = await readJson(configPath);
     const cursors = (await readJson(cursorsPath)) || { version: 1, files: {}, updatedAt: null };
-    const uploadThrottle = normalizeUploadState(await readJson(uploadThrottlePath));
-    let uploadThrottleState = uploadThrottle;
     let grokHookSignal = null;
     let grokHookSignalPath = null;
     for (const candidate of [grokSignalPath, legacyGrokSignalPath]) {
@@ -199,6 +195,7 @@ async function cmdSync(argv) {
     }
 
     await migrateRolloutCumulativeDeltaBuckets({ cursors, queuePath, rolloutFiles });
+    await migrateCodexForkOvercountRebuild({ cursors, queuePath, projectQueuePath, rolloutFiles });
 
     const openclawFiles = openclawSignal?.sessionFile
       ? [{ path: openclawSignal.sessionFile, source: "openclaw" }]
@@ -928,69 +925,7 @@ async function cmdSync(argv) {
 
     progress?.stop();
 
-    const runtime = resolveRuntimeConfig({ config: config || {}, env: process.env });
-
-    let uploadResult = { inserted: 0, skipped: 0 };
-    let uploadAttempted = false;
-
-    if (runtime.deviceToken && runtime.baseUrl) {
-      uploadAttempted = true;
-      try {
-        uploadResult = await drainQueueToCloud({
-          baseUrl: runtime.baseUrl,
-          deviceToken: runtime.deviceToken,
-          queuePath,
-          queueStatePath,
-          maxBatches: opts.drain ? 100 : 5,
-          batchSize: 200,
-        });
-        // Record success so the exponential backoff step resets — otherwise
-        // a single past failure keeps us pessimistically throttled forever.
-        uploadThrottleState = recordUploadSuccess({
-          nowMs: Date.now(),
-          state: uploadThrottleState,
-        });
-        await writeJson(uploadThrottlePath, uploadThrottleState);
-      } catch (e) {
-        // Persist a backoff on 429 / 5xx so the next auto-sync waits instead
-        // of retrying immediately and making the rate-limit worse. The
-        // throttle module already parses Retry-After when we surface it on
-        // the error object (drainQueueToCloud stamps err.status + err.retryAfterMs).
-        uploadThrottleState = recordUploadFailure({
-          nowMs: Date.now(),
-          state: uploadThrottleState,
-          error: e,
-        });
-        await writeJson(uploadThrottlePath, uploadThrottleState);
-        if (!opts.auto) {
-          process.stderr.write(`Upload error: ${e?.message || e}\n`);
-        }
-      }
-    }
 
-    const afterState = (await readJson(queueStatePath)) || { offset: 0 };
-    const queueSize = await safeStatSize(queuePath);
-    const projectAfterState = (await readJson(projectQueueStatePath)) || { offset: 0 };
-    const projectQueueSize = await safeStatSize(projectQueuePath);
-    const pendingBytes =
-      Math.max(0, queueSize - Number(afterState.offset || 0)) +
-      Math.max(0, projectQueueSize - Number(projectAfterState.offset || 0));
-
-    if (pendingBytes <= 0) {
-      await clearAutoRetry(trackerDir);
-    } else if (opts.auto && uploadAttempted) {
-      const retryAtMs = Number(uploadThrottleState?.nextAllowedAtMs || 0);
-      if (retryAtMs > Date.now()) {
-        await scheduleAutoRetry({
-          trackerDir,
-          retryAtMs,
-          reason: "backlog",
-          pendingBytes,
-          source: "auto-backlog",
-          autoRetryNoSpawn: runtime.autoRetryNoSpawn,
-        });
-      }
-    }
 
     const totalParsed =
       parseResult.filesProcessed +
@@ -1045,9 +980,6 @@ async function cmdSync(argv) {
     const summary = {
       totalParsed,
       totalBuckets,
-      upload: uploadResult,
-      uploadAttempted,
-      pendingBytes,
     };
 
     if (!opts.auto) {
@@ -1056,12 +988,6 @@ async function cmdSync(argv) {
           "Sync finished:",
           `- Parsed files: ${totalParsed}`,
           `- New 30-min buckets queued: ${totalBuckets}`,
-          runtime.deviceToken
-            ? `- Uploaded: ${uploadResult.inserted} inserted, ${uploadResult.skipped} skipped`
-            : "- Uploaded: skipped (no device token)",
-          runtime.deviceToken && pendingBytes > 0 && !opts.drain
-            ? `- Remaining: ${formatBytes(pendingBytes)} pending (run sync again, or use --drain)`
-            : null,
           "",
         ]
           .filter(Boolean)
@@ -1102,10 +1028,12 @@ module.exports = {
   cmdSync,
   migrateCursorUnknownBuckets,
   migrateRolloutCumulativeDeltaBuckets,
+  migrateCodexForkOvercountRebuild,
   reincludeClaudeMemObserverFiles,
   repairGrokQueueFromSessionSnapshots,
   CURSOR_UNKNOWN_MIGRATION_KEY,
   ROLLOUT_CUMULATIVE_DELTA_MIGRATION_KEY,
+  CODEX_FORK_OVERCOUNT_MIGRATION_KEY,
   CLAUDE_MEM_OBSERVER_REINCLUDE_KEY,
   GROK_APPEND_ONLY_REPAIR_MIGRATION_KEY,
 };
@@ -1276,102 +1204,10 @@ function deriveAutoSkipReason({ decision, state }) {
   return "throttled";
 }
 
-async function scheduleAutoRetry({
-  trackerDir,
-  retryAtMs,
-  reason,
-  pendingBytes,
-  source,
-  autoRetryNoSpawn,
-}) {
-  const retryMs = coerceRetryMs(retryAtMs);
-  if (!retryMs) return { scheduled: false, retryAtMs: 0 };
-
-  const retryPath = path.join(trackerDir, AUTO_RETRY_FILENAME);
-  const nowMs = Date.now();
-  const existing = await readJson(retryPath);
-  const existingMs = coerceRetryMs(existing?.retryAtMs);
-  if (existingMs && existingMs >= retryMs - 1000) {
-    return { scheduled: false, retryAtMs: existingMs };
-  }
-
-  const payload = {
-    version: 1,
-    retryAtMs: retryMs,
-    retryAt: new Date(retryMs).toISOString(),
-    reason: typeof reason === "string" && reason.length > 0 ? reason : "throttled",
-    pendingBytes: Math.max(0, Number(pendingBytes || 0)),
-    scheduledAt: new Date(nowMs).toISOString(),
-    source: typeof source === "string" ? source : "auto",
-  };
-
-  await writeJson(retryPath, payload);
-
-  const delayMs = Math.min(AUTO_RETRY_MAX_DELAY_MS, Math.max(0, retryMs - nowMs));
-  if (delayMs <= 0) return { scheduled: false, retryAtMs: retryMs };
-  if (autoRetryNoSpawn) {
-    return { scheduled: false, retryAtMs: retryMs };
-  }
-
-  spawnAutoRetryProcess({
-    retryPath,
-    trackerBinPath: path.join(trackerDir, "app", "bin", "tracker.js"),
-    fallbackPkg: "@ipv9/tokentracker-cli",
-    delayMs,
-  });
-  return { scheduled: true, retryAtMs: retryMs };
-}
 
-async function clearAutoRetry(trackerDir) {
-  const retryPath = path.join(trackerDir, AUTO_RETRY_FILENAME);
-  await fs.unlink(retryPath).catch(() => {});
-}
 
-function spawnAutoRetryProcess({ retryPath, trackerBinPath, fallbackPkg, delayMs }) {
-  const script = buildAutoRetryScript({ retryPath, trackerBinPath, fallbackPkg, delayMs });
-  try {
-    const child = cp.spawn(process.execPath, ["-e", script], {
-      detached: true,
-      stdio: "ignore",
-      env: process.env,
-    });
-    child.unref();
-  } catch (_e) {}
-}
 
-function buildAutoRetryScript({ retryPath, trackerBinPath, fallbackPkg, delayMs }) {
-  return (
-    `'use strict';\n` +
-    `const fs = require('node:fs');\n` +
-    `const cp = require('node:child_process');\n` +
-    `const retryPath = ${JSON.stringify(retryPath)};\n` +
-    `const trackerBinPath = ${JSON.stringify(trackerBinPath)};\n` +
-    `const fallbackPkg = ${JSON.stringify(fallbackPkg)};\n` +
-    `const delayMs = ${Math.max(0, Math.floor(delayMs || 0))};\n` +
-    `setTimeout(() => {\n` +
-    `  let retryAtMs = 0;\n` +
-    `  try {\n` +
-    `    const raw = fs.readFileSync(retryPath, 'utf8');\n` +
-    `    retryAtMs = Number(JSON.parse(raw).retryAtMs || 0);\n` +
-    `  } catch (_) {}\n` +
-    `  if (!retryAtMs || Date.now() + 1000 < retryAtMs) process.exit(0);\n` +
-    `  const argv = ['sync', '--auto', '--from-retry'];\n` +
-    `  const cmd = fs.existsSync(trackerBinPath)\n` +
-    `    ? [process.execPath, trackerBinPath, ...argv]\n` +
-    `    : ['npx', '--yes', fallbackPkg, ...argv];\n` +
-    `  try {\n` +
-    `    const child = cp.spawn(cmd[0], cmd.slice(1), { detached: true, stdio: 'ignore', env: process.env });\n` +
-    `    child.unref();\n` +
-    `  } catch (_) {}\n` +
-    `}, delayMs);\n`
-  );
-}
 
-function coerceRetryMs(v) {
-  const n = Number(v);
-  if (!Number.isFinite(n) || n <= 0) return 0;
-  return Math.floor(n);
-}
 
 async function writeOpenclawSignal(trackerDir) {
   const openclawSignalPath = path.join(trackerDir, "openclaw.signal");
@@ -1382,63 +1218,10 @@ async function writeOpenclawSignal(trackerDir) {
   }
 }
 
-const AUTO_RETRY_FILENAME = "auto.retry.json";
 const AUTO_RETRY_MAX_DELAY_MS = 2 * 60 * 60 * 1000;
 
-const INGEST_SLUG = "tokentracker-ingest";
 const MAX_INGEST_BUCKETS = 500;
 
-async function drainQueueToCloud({ baseUrl, deviceToken, queuePath, queueStatePath, maxBatches = 5, batchSize = 200 }) {
-  const state = (await readJson(queueStatePath)) || { offset: 0 };
-  let offset = Number(state.offset || 0);
-  let inserted = 0;
-  let skipped = 0;
-
-  const queueSize = await safeStatSize(queuePath);
-  const limit = Math.min(Math.max(1, Math.floor(Number(batchSize || 200))), MAX_INGEST_BUCKETS);
-
-  for (let batch = 0; batch < maxBatches; batch++) {
-    if (offset >= queueSize) break;
-    const result = await readQueueBatch(queuePath, offset, limit);
-    if (result.buckets.length === 0) break;
-
-    const root = baseUrl.replace(/\/$/, "");
-    const anonKey = process.env.TOKENTRACKER_INSFORGE_ANON_KEY || "";
-    const headers = {
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      Authorization: `Bearer ${deviceToken}`,
-    };
-    if (anonKey) headers.apikey = anonKey;
-    const res = await fetch(`${root}/functions/${INGEST_SLUG}`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({ hourly: result.buckets }),
-    });
-
-    const rawText = await res.text().catch(() => "");
-    let data = {};
-    try { data = JSON.parse(rawText); } catch { data = {}; }
-    if (!res.ok) {
-      const err = new Error(`HTTP ${res.status}: ${rawText.substring(0, 500)}`);
-      err.status = res.status;
-      const retryAfter = res.headers?.get?.("Retry-After") ?? null;
-      const retryAfterMs = parseRetryAfterMs(retryAfter);
-      if (retryAfterMs !== null) err.retryAfterMs = retryAfterMs;
-      throw err;
-    }
-
-    inserted += Number(data?.inserted || 0);
-    skipped += Number(data?.skipped || 0);
-
-    offset = result.nextOffset;
-    state.offset = offset;
-    state.updatedAt = new Date().toISOString();
-    await writeJson(queueStatePath, state);
-  }
-
-  return { inserted, skipped };
-}
 
 async function readQueueBatch(queuePath, startOffset, maxBuckets) {
   const st = await fs.stat(queuePath).catch(() => null);
@@ -1922,6 +1705,130 @@ async function migrateRolloutCumulativeDeltaBuckets({ cursors, queuePath, rollou
   cursors.migrations[ROLLOUT_CUMULATIVE_DELTA_MIGRATION_KEY] = new Date().toISOString();
 }
 
+// One-time rebuild for issue #75. The prior parser counted a Codex subagent
+// fork's replayed parent token_count history as the child's consumption. After
+// the parser fix (PR #77) that only corrects go-forward parsing — already-
+// ingested files sit at offset = EOF and are never re-read — so their inflated
+// contribution stays baked into cursors.hourly / project aggregates and the
+// dashboard until this migration retracts it and forces a clean re-parse.
+//
+// Choreography mirrors migrateRolloutCumulativeDeltaBuckets (codex-scoped, so
+// no other provider is touched): (1) drop the per-file cursors so the same-run
+// sync re-parses from offset 0 with the fixed accounting; (2) delete the
+// inflated hourly buckets and append zero rows to queue.jsonl — the dashboard
+// keep-lasts per source|model|hour_start (local-api.js readQueueData), so the
+// re-parse's corrected row supersedes the zero, or the zero stands for a file
+// no longer on disk; (3) do the same for project aggregates, which are on by
+// default (sync passes projectQueuePath) and would otherwise double-count on
+// re-parse — readProjectQueueData also keep-lasts per project_key|source|
+// hour_start. Run-once via the migrations sentinel (the issue asks for a
+// one-time rebuild, not a repeatable command).
+//
+// Project aggregates are handled conservatively: the accumulator buckets are
+// reset (so files still on disk rebuild clean and their corrected row wins via
+// keep-last), but no zero rows are written. A project bucket whose file was
+// deleted or whose repo moved keeps its prior queue row rather than being
+// zeroed — we never destroy project history we can no longer recompute. Main-
+// dashboard (source) totals are always rebuilt regardless of project
+// resolution. See step (3).
+async function migrateCodexForkOvercountRebuild({
+  cursors,
+  queuePath,
+  projectQueuePath,
+  rolloutFiles,
+}) {
+  if (!cursors || typeof cursors !== "object") return;
+  cursors.migrations = cursors.migrations || {};
+  if (cursors.migrations[CODEX_FORK_OVERCOUNT_MIGRATION_KEY]) return;
+
+  const rolloutPaths = new Set();
+  for (const entry of Array.isArray(rolloutFiles) ? rolloutFiles : []) {
+    const filePath = typeof entry === "string" ? entry : entry?.path;
+    const source = typeof entry === "string" ? "codex" : String(entry?.source || "codex");
+    if (filePath && (source === "codex" || source === "every-code")) {
+      rolloutPaths.add(filePath);
+    }
+  }
+
+  // (1) Drop per-file cursors -> clean re-parse from offset 0 with the fix.
+  if (cursors.files && typeof cursors.files === "object") {
+    for (const filePath of rolloutPaths) delete cursors.files[filePath];
+  }
+
+  // (2) Retract + delete inflated hourly codex/every-code buckets.
+  const hourlyRetractions = [];
+  const buckets = cursors.hourly?.buckets;
+  if (buckets && typeof buckets === "object") {
+    for (const key of Object.keys(buckets)) {
+      const [source, model, ...hourParts] = key.split("|");
+      if (source !== "codex" && source !== "every-code") continue;
+      hourlyRetractions.push(
+        JSON.stringify({
+          source,
+          model: model || "unknown",
+          hour_start: hourParts.join("|"),
+          input_tokens: 0,
+          cached_input_tokens: 0,
+          cache_creation_input_tokens: 0,
+          output_tokens: 0,
+          reasoning_output_tokens: 0,
+          total_tokens: 0,
+          billable_total_tokens: 0,
+          conversation_count: 0,
+        }),
+      );
+      delete buckets[key];
+    }
+  }
+  const groupQueued = cursors.hourly?.groupQueued;
+  if (groupQueued && typeof groupQueued === "object") {
+    for (const key of Object.keys(groupQueued)) {
+      if (key.startsWith("codex|") || key.startsWith("every-code|")) {
+        delete groupQueued[key];
+      }
+    }
+  }
+  if (hourlyRetractions.length > 0) {
+    await ensureDir(path.dirname(queuePath));
+    await fs.appendFile(queuePath, hourlyRetractions.join("\n") + "\n");
+  }
+
+  // (3) Reset the inflated project codex/every-code accumulator buckets, but
+  // do NOT append zero rows to project.queue.jsonl. Deleting the in-memory
+  // bucket is what prevents the double-count: the same-run re-parse of a file
+  // still on disk starts that project bucket fresh from zero and appends a
+  // corrected row, which the keep-last project reader (local-api.js
+  // readProjectQueueData, per project_key|source|hour_start) picks over the old
+  // inflated row. A bucket whose file has since been deleted or whose repo
+  // moved is NOT re-parsed; leaving its prior queue row in place keeps that
+  // (possibly fork-inflated) historical value visible rather than zeroing data
+  // we can no longer recompute. Unlike the hourly path, project aggregates were
+  // never retracted by the earlier delta migration, so a zero here would be a
+  // brand-new, unrecoverable loss for orphaned files — hence the conservative
+  // reset-accumulator-only approach.
+  let projectReset = 0;
+  const projectBuckets = cursors.projectHourly?.buckets;
+  if (projectQueuePath && projectBuckets && typeof projectBuckets === "object") {
+    for (const key of Object.keys(projectBuckets)) {
+      const source = projectBuckets[key]?.source;
+      if (source !== "codex" && source !== "every-code") continue;
+      delete projectBuckets[key];
+      projectReset += 1;
+    }
+  }
+
+  if (process.env.TOKENTRACKER_DEBUG) {
+    process.stderr.write(
+      `[codex-fork] #75 rebuild: reset ${rolloutPaths.size} codex/every-code file ` +
+        `cursors, retracted ${hourlyRetractions.length} hourly bucket(s), reset ` +
+        `${projectReset} project accumulator bucket(s) (no project rows zeroed); ` +
+        `this sync re-parses files still on disk with the corrected accounting\n`,
+    );
+  }
+
+  cursors.migrations[CODEX_FORK_OVERCOUNT_MIGRATION_KEY] = new Date().toISOString();
+}
+
 // One-time repair migration: rebuild source=claude rows in queue.jsonl from
 // the actual jsonl files using ccusage's algorithm (msgId+reqId global
 // dedup). Earlier `reincludeClaudeMemObserverFiles` versions (v1/v2/v3) each

package/src/lib/{browser-auth.js → browser-open.js}

@@ -1,138 +1,8 @@
-const http = require("node:http");
-const crypto = require("node:crypto");
+// Opens a URL in the user's browser. This module used to also run the cloud
+// sign-in flow (a local callback server plus a redirect dance); that went away
+// with the cloud, and the file was renamed so its name stops implying auth.
 const cp = require("node:child_process");
 
-const { DEFAULT_BASE_URL } = require("./runtime-config");
-
-async function beginBrowserAuth({ baseUrl, dashboardUrl, timeoutMs, open }) {
-  const nonce = crypto.randomBytes(16).toString("hex");
-  const callbackPath = `/tokentracker/callback/${nonce}`;
-  const authUrl = dashboardUrl ? new URL("/", dashboardUrl) : new URL("/auth/sign-up", baseUrl);
-  const postAuthRedirect = resolvePostAuthRedirect({ dashboardUrl, authUrl });
-  const { callbackUrl, waitForCallback } = await startLocalCallbackServer({
-    callbackPath,
-    timeoutMs,
-    redirectUrl: postAuthRedirect,
-  });
-  authUrl.searchParams.set("redirect", callbackUrl);
-  if (dashboardUrl && baseUrl && baseUrl !== DEFAULT_BASE_URL) {
-    authUrl.searchParams.set("base_url", baseUrl);
-  }
-
-  if (open !== false) openInBrowser(authUrl.toString());
-
-  return { authUrl: authUrl.toString(), waitForCallback };
-}
-
-async function startLocalCallbackServer({ callbackPath, timeoutMs, redirectUrl }) {
-  let resolved = false;
-  let resolveResult;
-  let rejectResult;
-
-  const resultPromise = new Promise((resolve, reject) => {
-    resolveResult = resolve;
-    rejectResult = reject;
-  });
-
-  const server = http.createServer((req, res) => {
-    if (resolved) {
-      res.writeHead(409, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Already authenticated.\n");
-      return;
-    }
-
-    const method = req.method || "GET";
-    if (method !== "GET") {
-      res.writeHead(405, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Method not allowed.\n");
-      return;
-    }
-
-    const url = new URL(req.url || "/", "http://127.0.0.1");
-    if (url.pathname !== callbackPath) {
-      res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Not found.\n");
-      return;
-    }
-
-    const accessToken = url.searchParams.get("access_token") || "";
-    if (!accessToken) {
-      res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
-      res.end("Missing access_token.\n");
-      return;
-    }
-
-    resolved = true;
-    if (redirectUrl) {
-      res.writeHead(302, {
-        Location: redirectUrl,
-        "Content-Type": "text/html; charset=utf-8",
-      });
-      res.end(
-        [
-          "<!doctype html>",
-          '<html><head><meta charset="utf-8"><title>TokenTracker</title></head>',
-          "<body>",
-          "<h2>Login succeeded</h2>",
-          `<p>Redirecting to <a href="${redirectUrl}">dashboard</a>...</p>`,
-          "</body></html>",
-        ].join(""),
-      );
-    } else {
-      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(
-        [
-          "<!doctype html>",
-          '<html><head><meta charset="utf-8"><title>TokenTracker</title></head>',
-          "<body>",
-          "<h2>Login succeeded</h2>",
-          "<p>You can close this tab and return to the CLI.</p>",
-          "</body></html>",
-        ].join(""),
-      );
-    }
-
-    resolveResult({
-      accessToken,
-      userId: url.searchParams.get("user_id") || null,
-      email: url.searchParams.get("email") || null,
-      name: url.searchParams.get("name") || null,
-    });
-  });
-
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve);
-  });
-
-  const addr = server.address();
-  const port = typeof addr === "object" && addr ? addr.port : null;
-  if (!port) {
-    server.close();
-    throw new Error("Failed to bind local callback server");
-  }
-
-  const callbackUrl = `http://127.0.0.1:${port}${callbackPath}`;
-
-  const timer = setTimeout(() => {
-    if (resolved) return;
-    resolved = true;
-    rejectResult(new Error("Authentication timed out"));
-    server.close();
-  }, timeoutMs);
-
-  async function waitForCallback() {
-    try {
-      return await resultPromise;
-    } finally {
-      clearTimeout(timer);
-      server.close();
-    }
-  }
-
-  return { callbackUrl, waitForCallback };
-}
-
 function detectDefaultBrowser() {
   try {
     const raw = cp.execFileSync("defaults", [
@@ -285,23 +155,7 @@ end if
   spawnBrowserCommand(cmd, args, { url, platform, stderr });
 }
 
-function resolvePostAuthRedirect({ dashboardUrl, authUrl }) {
-  try {
-    if (dashboardUrl) {
-      const target = new URL("/", dashboardUrl);
-      if (target.protocol === "http:" || target.protocol === "https:") {
-        return target.toString();
-      }
-      return null;
-    }
-  } catch (_e) {
-    return null;
-  }
-  return null;
-}
-
 module.exports = {
-  beginBrowserAuth,
   openInBrowser,
   buildBrowserOpenErrorMessage,
   spawnBrowserCommand,