@ipv9/tokentracker-cli 0.39.43 → 0.39.45

package/src/lib/transcript-suppression.js

@@ -0,0 +1,133 @@
+const { listProcessLines, parseProcessLine } = require("./process-list");
+
+// Detects Claude Code CLI processes started with `--no-session-persistence`.
+//
+// Why this exists: every Claude figure TokenTracker reports is parsed out of the
+// session transcripts under `~/.claude/projects`. That flag tells the CLI to
+// write no transcript at all, so those calls are unobservable here — they cost
+// real tokens and contribute zero. Before this check, the only visible symptom
+// was a source quietly reporting less than it should, which is indistinguishable
+// from "the user worked less today".
+//
+// This is a *live* signal, not a historical one: it answers "is something
+// running right now that I cannot see", which is why it needs no baseline, no
+// threshold, and no per-source history.
+//
+// PRIVACY (CONTRIBUTING.md): the command line is read and discarded inside this
+// call. What leaves this module is a count, a coarse reason, and the model ids —
+// never a pid, an argv string, an environment value, or a file path. Model ids
+// are already first-class tracked data (every queue row carries one), and they
+// are the one field that tells a user *which* stream is unobservable, so they
+// are included deliberately; they are also length- and charset-clamped below so
+// that no arbitrary command-line text can ride out through this field.
+
+const SUPPRESSION_FLAG = "--no-session-persistence";
+const CLAUDE_BINARY_NAME = "claude";
+const MODEL_FLAG = /(?:^|\s)--model[=\s]+([A-Za-z0-9._:-]{1,64})(?=\s|$)/;
+const SUPPRESSION_FLAG_PATTERN = /(?:^|\s)--no-session-persistence(?:=|\s|$)/;
+const DEFAULT_TTL_MS = 30_000;
+
+let cache = null;
+
+function resetTranscriptSuppressionCache() {
+  cache = null;
+}
+
+// argv[0] must be the `claude` binary. Matching on the flag alone would also
+// match any shell, editor, or grep whose own command line happens to contain
+// the string — including the process asking this question.
+//
+// The executable region is everything before the first `--flag`, not the first
+// whitespace-delimited token: `ps` gives one flat string, so a binary installed
+// under a path containing a space ("/Users/me/My Tools/claude") would otherwise
+// be read as argv[0] = "/Users/me/My" and missed. A miss is the failure mode
+// this whole check exists to prevent, so it is worth the wider window.
+function isClaudeInvocation(command) {
+  const executableRegion = String(command || "").split(/\s+--/)[0] || "";
+  const base = executableRegion.trim().split(/[/\\]/).pop() || "";
+  return base.replace(/\.exe$/i, "").toLowerCase() === CLAUDE_BINARY_NAME;
+}
+
+function hasSuppressionFlag(command) {
+  return SUPPRESSION_FLAG_PATTERN.test(String(command || ""));
+}
+
+function extractModel(command) {
+  const match = String(command || "").match(MODEL_FLAG);
+  return match?.[1] || null;
+}
+
+// Pure: takes `ps` output lines, returns the deduplicated model ids of every
+// suppressed Claude process. Deliberately returns models rather than processes —
+// there is no pid in the return value for anything downstream to leak.
+function findSuppressedModels(lines = []) {
+  const models = new Set();
+  let count = 0;
+
+  for (const line of lines) {
+    const parsed = parseProcessLine(line);
+    if (!parsed) continue;
+    if (!isClaudeInvocation(parsed.command)) continue;
+    if (!hasSuppressionFlag(parsed.command)) continue;
+    count += 1;
+    const model = extractModel(parsed.command);
+    if (model) models.add(model);
+  }
+
+  return { count, models: [...models].sort() };
+}
+
+// Returns { supported, checked, count, models, reason, checked_at }.
+//
+// `checked: false` is never reported as a clean result by callers. "I could not
+// look" and "I looked and found nothing" are different answers, and collapsing
+// them is how a monitor starts lying.
+function detectTranscriptSuppression({
+  commandRunner,
+  platform = process.platform,
+  now = () => new Date(),
+  ttlMs = DEFAULT_TTL_MS,
+  useCache = true,
+} = {}) {
+  const at = now();
+  const atMs = at.getTime();
+
+  if (useCache && cache && atMs - cache.atMs < ttlMs) {
+    return cache.value;
+  }
+
+  const listed = listProcessLines({ commandRunner, platform });
+
+  let value;
+  if (!listed.ok) {
+    value = {
+      supported: listed.supported,
+      checked: false,
+      count: 0,
+      models: [],
+      reason: listed.reason,
+      checked_at: at.toISOString(),
+    };
+  } else {
+    const { count, models } = findSuppressedModels(listed.lines);
+    value = {
+      supported: true,
+      checked: true,
+      count,
+      models,
+      reason: null,
+      checked_at: at.toISOString(),
+    };
+  }
+
+  if (useCache) cache = { atMs, value };
+  return value;
+}
+
+module.exports = {
+  DEFAULT_TTL_MS,
+  SUPPRESSION_FLAG,
+  detectTranscriptSuppression,
+  findSuppressedModels,
+  resetTranscriptSuppressionCache,
+};

package/src/lib/usage-limits.js

@@ -21,12 +21,21 @@ const {
   extractCursorSessionToken,
   fetchCursorUsageSummary,
 } = require("./cursor-config");
+const { PS_ARGS, PS_BINARY, parseProcessLine } = require("./process-list");
+const { createSingleFlight } = require("./single-flight");
 
 // 2-minute in-memory cache
 let cache = { data: null, fetchedAt: 0 };
+// One slot per module instance, not a shared singleton: `delete require.cache[…]`
+// is how the tests get a clean cache, and a shared instance would survive it.
+const runUsageLimitsFetch = createSingleFlight();
 const CACHE_TTL_MS = 2 * 60 * 1000;
 const DEFAULT_PROVIDER_TIMEOUT_MS = 15_000;
 const ANTIGRAVITY_LIMITS_CACHE_FILE = "usage-limits-cache.json";
+// Trust marker, not a user identity: only cache blocks written after the
+// current-user process-scan fix may be served. Missing/unknown markers fail
+// closed so a legacy multi-user cache cannot disclose another account.
+const ANTIGRAVITY_CACHE_PROCESS_SCOPE = "current-user-v1";
 const ANTIGRAVITY_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 const ANTIGRAVITY_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
 const CLAUDE_LIMITS_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
@@ -218,10 +227,23 @@ async function fetchCodexUsageLimits(
     method: "GET",
     headers,
   });
-  // 401/403/404 from wham means "no usage data available for this auth state" — render
-  // a neutral empty state instead of a red "Fetch failed" error.
+  // 401/403/404 from wham means "no usage data available for this auth state" —
+  // a free or multi-account user, or a token that went stale. #52 asked for a
+  // neutral state here rather than a red "Fetch failed".
+  //
+  // It got NO state. With no error and no windows, LimitChips falls through to
+  // `windows.length === 0 -> return null` and the chip disappears entirely,
+  // which is the outcome #105 calls worse than never having had a chip: the user
+  // has been trained to look there and now reads absence as "plenty left".
+  //
+  // `notice` is the third state the UI was missing. Visible and subtle, so #52's
+  // intent survives without #105's failure mode.
   if (res.status === 401 || res.status === 403 || res.status === 404) {
-    return { primary_window: null, secondary_window: null };
+    return {
+      primary_window: null,
+      secondary_window: null,
+      notice: "No usage data for this sign-in. Run `codex` to sign in again.",
+    };
   }
   if (!res.ok) {
     throw new Error(`Codex API returned ${res.status}`);
@@ -973,11 +995,22 @@ async function fetchGeminiLimits({ home, env, fetchImpl = fetch, commandRunner }
 
 function runCommand(commandRunner, command, args, options = {}) {
   const runner = typeof commandRunner === "function" ? commandRunner : cp.spawnSync;
-  return runner(command, args, {
+  const result = runner(command, args, {
     encoding: "utf8",
     maxBuffer: 10 * 1024 * 1024,
     ...options,
   });
+  // Every consumer reads spawnSync-style fields immediately. An async runner
+  // is therefore a contract error, not supported concurrency. Attach a handler
+  // immediately, then return a synchronous failure shape so the Promise cannot
+  // escape as unhandled process state.
+  if (result && typeof result.then === "function") {
+    Promise.resolve(result).catch(() => {});
+    const error = new TypeError("commandRunner must return synchronously");
+    error.code = "COMMAND_RUNNER_ASYNC_UNSUPPORTED";
+    return { status: 1, stdout: "", stderr: error.message, error };
+  }
+  return result;
 }
 
 function whichBinary(binary, { commandRunner } = {}) {
@@ -1319,17 +1352,6 @@ function fetchKiroLimits({ commandRunner, now = new Date() } = {}) {
   }
 }
 
-function parseProcessLine(line) {
-  const match = String(line || "")
-    .trim()
-    .match(/^(\d+)\s+(.*)$/);
-  if (!match) return null;
-  return {
-    pid: Number(match[1]),
-    command: match[2],
-  };
-}
-
 function isAntigravityCommandLine(command) {
   const lower = String(command || "").toLowerCase();
   return lower.includes("language_server")
@@ -1347,10 +1369,34 @@ function extractCommandFlag(command, flag) {
   return match?.[1] || null;
 }
 
+// Scans for the local Antigravity language server and reads its `--csrf_token`
+// out of the command line, so that the quota request below can authenticate to
+// it.
+//
+// The scan is scoped to the current user, and must stay that way. Under the
+// previous `-ax` this walked every account on the box and attached to whichever
+// Antigravity matched first. The token itself never reached an HTTP response —
+// `processInfo` is read field by field and never spread into a return value —
+// but what the token *fetches* does: `normalizeAntigravityResponse` returns
+// `account_email` and `account_plan`, `finalize` spreads them into the result,
+// and `getUsageLimits` serves that at `/functions/tokentracker-usage-limits`.
+// On a shared host this meant showing another person's email, plan and quota as
+// the local user's, and `writeAntigravityLimitsCache` persisted it to disk,
+// where the `!configured` branch would keep serving it after their process
+// exited.
+//
+// Sharing PS_ARGS with process-list.js is deliberate: two scans that must both
+// stay own-user should not be able to drift apart.
 function detectAntigravityProcess({ commandRunner } = {}) {
-  const result = runCommand(commandRunner, "/bin/ps", ["-ax", "-o", "pid=,command="], {
+  const result = runCommand(commandRunner, PS_BINARY, PS_ARGS, {
     timeout: 4000,
   });
+  if (result?.error?.code === "COMMAND_RUNNER_ASYNC_UNSUPPORTED") {
+    return {
+      configured: true,
+      error: result.error?.message || "Antigravity process detection failed.",
+    };
+  }
   const lines = String(result?.stdout || "").split("\n");
 
   let sawProcess = false;
@@ -1422,6 +1468,7 @@ function hasAntigravityWindow(limits) {
 }
 
 function normalizeAntigravityCachedLimits(raw, { nowMs = Date.now() } = {}) {
+  if (raw?.process_scope !== ANTIGRAVITY_CACHE_PROCESS_SCOPE) return null;
   const cachedAtMs = parseTimeMs(raw?.cached_at);
   if (!Number.isFinite(cachedAtMs)) return null;
   if (cachedAtMs > nowMs + 60_000) return null;
@@ -1450,6 +1497,7 @@ function writeAntigravityLimitsCache(limits, { home, nowMs = Date.now() } = {})
   if (!limits?.configured || limits.error || !hasAntigravityWindow(limits)) return;
   const payload = {
     antigravity: {
+      process_scope: ANTIGRAVITY_CACHE_PROCESS_SCOPE,
       account_email: limits.account_email || null,
       account_plan: limits.account_plan || null,
       primary_window: limits.primary_window || null,
@@ -1886,7 +1934,20 @@ function withPlanLabel(obj, raw, brand) {
   return { ...obj, plan_label: normalizePlanLabel(raw, brand) };
 }
 
-async function getUsageLimits({
+async function getUsageLimits(options = {}) {
+  const nowMs = Date.now();
+  if (cache.data && nowMs - cache.fetchedAt < CACHE_TTL_MS) {
+    return cache.data;
+  }
+  // Past the cache there is exactly one thing to do, and it is expensive: sweep
+  // every configured provider. Concurrent tabs, route mounts and revalidations
+  // land here together on a cold cache, and a forced refresh clears the cache
+  // first (local-api.js, the `refresh` param) — so "no cached data" is a common
+  // state for several callers at once, not a rare one. They share one sweep.
+  return runUsageLimitsFetch(() => fetchUsageLimits(options));
+}
+
+async function fetchUsageLimits({
   home,
   env,
   platform,
@@ -1898,9 +1959,10 @@ async function getUsageLimits({
   providerTimeoutMs = DEFAULT_PROVIDER_TIMEOUT_MS,
 } = {}) {
   const nowMs = Date.now();
-  if (cache.data && nowMs - cache.fetchedAt < CACHE_TTL_MS) {
-    return cache.data;
-  }
+  // The stale-Codex refresh is part of the same provider sweep and must share
+  // its abort bound. Creating this before the serial prelude prevents one raw
+  // OAuth fetch from holding the process-wide single-flight slot forever.
+  const providerFetch = withFetchTimeout(fetchImpl, providerTimeoutMs);
 
   const [claudeToken, claudeSubscription, codexAuth] = await Promise.all([
     Promise.resolve().then(() => readClaudeCodeAccessToken({ platform, securityRunner, home })),
@@ -1920,7 +1982,7 @@ async function getUsageLimits({
     try {
       const newTokens = await refreshCodexTokens({
         refreshToken: codexAuth.refreshToken,
-        fetchImpl,
+        fetchImpl: providerFetch,
       });
       const updatedAuth = await persistRefreshedAuth(
         codexAuth.authPath,
@@ -1943,7 +2005,6 @@ async function getUsageLimits({
   const codexAccountId = codexAuthRefreshed?.accountId || null;
   const codexPlanType = codexAuthRefreshed?.planType || null;
 
-  const providerFetch = withFetchTimeout(fetchImpl, providerTimeoutMs);
   const [claudeResult, codexResult, cursor, kimi, zai, gemini, kiro, antigravity, copilot] = await Promise.all([
     claudeToken
       ? withProviderTimeout(fetchClaudeUsageLimits(claudeToken, { fetchImpl: providerFetch, maxAttempts: 1 }), "Claude", providerTimeoutMs).then(
@@ -2013,6 +2074,10 @@ async function getUsageLimits({
     codex = {
       configured: true,
       error: null,
+      // A 4xx from wham produces no windows and no error. Carrying its `notice`
+      // through is what keeps the chip on screen instead of falling through to
+      // LimitChips' `windows.length === 0 -> return null`.
+      notice: codexResult.value.notice || null,
       plan_type: codexPlanType || null,
       primary_window: codexResult.value.primary_window,
       secondary_window: codexResult.value.secondary_window,
@@ -2040,8 +2105,20 @@ function resetUsageLimitsCache() {
   cache = { data: null, fetchedAt: 0 };
 }
 
+// The force protocol for the quota cache, in one place because two handlers
+// speak it: the CLI local API and the Vite dev middleware. They used to carry
+// their own copy of the same comparison, which is how one of them quietly stops
+// honouring a spelling — and a force that is silently downgraded to a cached
+// read looks exactly like a working one. `1` is what the dashboard client sends
+// (dashboard/src/lib/api.ts); `true` is what a human types into the URL bar.
+// Deliberately exact: no trimming, no case folding, no truthiness.
+function isForcedRefresh(value) {
+  return value === "1" || value === "true";
+}
+
 module.exports = {
   getUsageLimits,
+  isForcedRefresh,
   normalizePlanLabel,
   resetUsageLimitsCache,
   extractGeminiOauthClientCredentials,