@ipv9/tokentracker-cli 0.39.44 → 0.39.45

package/src/lib/process-list.js

@@ -0,0 +1,91 @@
+const cp = require("node:child_process");
+
+// Shared process-listing primitives. Extracted from usage-limits.js so that a
+// second caller (transcript-suppression.js) can reuse the parser instead of
+// keeping a second copy of the same regex in the tree.
+//
+// PRIVACY: callers get raw command lines here, and a command line can contain a
+// user's file paths. Nothing in this module writes, logs, caches, or returns a
+// command line beyond the synchronous call — that constraint belongs to every
+// caller, and CONTRIBUTING.md's rule ("never log, store, transmit, or print ...
+// file paths from user code") is what it exists to satisfy.
+
+const PS_BINARY = "/bin/ps";
+// `-x` (own user, including processes with no controlling terminal) rather than
+// `-ax` (every user on the box). The suppression check reports its findings over
+// an unauthenticated loopback endpoint, and on a multi-user host `-a` would make
+// that endpoint answer questions about other people's sessions. Scoping the scan
+// itself is the narrow fix: a session TokenTracker could not have recorded
+// anyway is one this user is not running.
+//
+// Verified on both supported platforms rather than assumed from documented
+// semantics, because Linux `ps` is procps and parses dash-prefixed options as
+// UNIX-style, where `-x` is not an option at all. It does accept this as the BSD
+// `x`: on Debian 12 / procps-ng 4.0.2, `ps -x -o pid=,command=` exits 0 and
+// lists one user, while `-ax` on the same box lists seven. macOS/BSD `ps` is the
+// native case. Had procps rejected it, every Linux host would have fallen into
+// `process_list_failed` — a permanent non-advisory warn, which would pin
+// `degraded` for a whole platform.
+//
+// Frozen because two modules now share this array. Importing one constant stops
+// the two scans from drifting apart editorially; freezing is what stops a caller
+// pushing `-a` onto it at runtime.
+const PS_ARGS = Object.freeze(["-x", "-o", "pid=,command="]);
+const PS_TIMEOUT_MS = 4000;
+const PS_MAX_BUFFER = 10 * 1024 * 1024;
+
+function parseProcessLine(line) {
+  const match = String(line || "")
+    .trim()
+    .match(/^(\d+)\s+(.*)$/);
+  if (!match) return null;
+  return {
+    pid: Number(match[1]),
+    command: match[2],
+  };
+}
+
+// `/bin/ps` with these flags is a POSIX assumption. Windows has no equivalent
+// at this path, and guessing at `tasklist` output would be an untested code
+// path, so the honest answer there is "not supported" rather than "no problems
+// found" — the caller must not turn this into a passing check.
+function isProcessListSupported(platform = process.platform) {
+  return platform !== "win32";
+}
+
+// Returns { supported, ok, lines, reason }. `ok: false` never throws: a machine
+// that refuses `ps` (sandbox, hardened runtime) is a normal condition here, and
+// the caller reports it as "could not check" rather than as "nothing found".
+function listProcessLines({ commandRunner, platform = process.platform } = {}) {
+  if (!isProcessListSupported(platform)) {
+    return { supported: false, ok: false, lines: [], reason: "unsupported_platform" };
+  }
+
+  const runner = typeof commandRunner === "function" ? commandRunner : cp.spawnSync;
+  let result;
+  try {
+    result = runner(PS_BINARY, PS_ARGS, {
+      encoding: "utf8",
+      maxBuffer: PS_MAX_BUFFER,
+      timeout: PS_TIMEOUT_MS,
+    });
+  } catch {
+    return { supported: true, ok: false, lines: [], reason: "process_list_failed" };
+  }
+
+  if (result?.error || result?.status !== 0) {
+    return { supported: true, ok: false, lines: [], reason: "process_list_failed" };
+  }
+
+  const stdout = typeof result?.stdout === "string" ? result.stdout : "";
+  return { supported: true, ok: true, lines: stdout.split("\n"), reason: null };
+}
+
+module.exports = {
+  PS_ARGS,
+  PS_BINARY,
+  PS_TIMEOUT_MS,
+  isProcessListSupported,
+  listProcessLines,
+  parseProcessLine,
+};

package/src/lib/rollout.js

@@ -3398,8 +3398,11 @@ async function parseHermesIncremental({ hermesPath, dbPath, cursors, queuePath,
       // Skip if delta is zero (session unchanged since last sync)
       if (dInput === 0 && dOutput === 0 && dCacheRead === 0 && dCacheWrite === 0 && dReasoning === 0) continue;
 
-      // Prefer ended_at for bucket placement; fall back to started_at
-      const epochSec = endedAt ?? startedAt;
+      // A first observation has only the session start as a usable timestamp.
+      // Attribute later active-session deltas to this sync so cross-day usage
+      // does not keep growing the day on which the session originally started.
+      // Once Hermes records completion, ended_at is authoritative for the final delta.
+      const epochSec = endedAt ?? (prev ? Date.parse(updatedAt) / 1000 : startedAt);
       if (!epochSec || !Number.isFinite(epochSec)) continue;
       const tsIso = new Date(epochSec * 1000).toISOString();
       const bucketStart = toUtcHalfHourStart(tsIso);

package/src/lib/single-flight.js

@@ -0,0 +1,59 @@
+"use strict";
+
+/**
+ * Coalesce concurrent calls to one expensive async producer.
+ *
+ * The problem it solves is not "the same work runs twice" — it is that the work
+ * being duplicated fans out to every configured provider's private endpoint. Two
+ * dashboard tabs, a route mount, and a scheduled revalidation can all arrive
+ * inside the same second on a cold cache; without this, each one launches its own
+ * full sweep.
+ *
+ * `run(fn)` returns the in-flight promise when one exists, so every caller in a
+ * window shares a single execution and a single result object. The slot is
+ * released as soon as the work settles — success or failure — so the next call
+ * starts fresh work rather than replaying a stale outcome.
+ *
+ * Deliberately NOT keyed by argument: the single consumer here has one shared
+ * result for the whole process. A joining caller therefore receives the FIRST
+ * caller's work, arguments included. That is the intended trade for the fan-out,
+ * and it is safe only because every production call site passes the same inputs.
+ *
+ * @returns {(fn: () => Promise<any>) => Promise<any>}
+ */
+function createSingleFlight() {
+  let inFlight = null;
+
+  return function run(fn) {
+    if (inFlight) return inFlight;
+
+    // `Promise.resolve().then(fn)` rather than `fn()` so a synchronous throw
+    // inside fn becomes a rejection on this path too, instead of escaping past
+    // the slot cleanup and wedging `inFlight` forever.
+    //
+    // Release carries no `inFlight === pending` identity guard, deliberately. A
+    // later run can only claim the slot after this one released it — while
+    // `pending` is unsettled every arrival joins instead of replacing it — so a
+    // stale callback clearing a successor's slot is unreachable, and a mutation
+    // test found the guard dead. Adding a way to clear the slot from outside
+    // would make it reachable again; there is none, and #141 requires that a
+    // cache reset specifically must not do it.
+    const pending = Promise.resolve()
+      .then(fn)
+      .finally(() => {
+        inFlight = null;
+      });
+
+    // Module state now holds a promise that real callers may all walk away from.
+    // Without a handler of its own, a rejection reaching only this reference is
+    // an unhandledRejection raised from state nobody is watching — a failure mode
+    // that did not exist while every caller owned its own promise. Callers still
+    // receive the rejection; this only marks the stored reference as handled.
+    pending.catch(() => {});
+
+    inFlight = pending;
+    return pending;
+  };
+}
+
+module.exports = { createSingleFlight };

package/src/lib/transcript-suppression.js

@@ -0,0 +1,133 @@
+const { listProcessLines, parseProcessLine } = require("./process-list");
+
+// Detects Claude Code CLI processes started with `--no-session-persistence`.
+//
+// Why this exists: every Claude figure TokenTracker reports is parsed out of the
+// session transcripts under `~/.claude/projects`. That flag tells the CLI to
+// write no transcript at all, so those calls are unobservable here — they cost
+// real tokens and contribute zero. Before this check, the only visible symptom
+// was a source quietly reporting less than it should, which is indistinguishable
+// from "the user worked less today".
+//
+// This is a *live* signal, not a historical one: it answers "is something
+// running right now that I cannot see", which is why it needs no baseline, no
+// threshold, and no per-source history.
+//
+// PRIVACY (CONTRIBUTING.md): the command line is read and discarded inside this
+// call. What leaves this module is a count, a coarse reason, and the model ids —
+// never a pid, an argv string, an environment value, or a file path. Model ids
+// are already first-class tracked data (every queue row carries one), and they
+// are the one field that tells a user *which* stream is unobservable, so they
+// are included deliberately; they are also length- and charset-clamped below so
+// that no arbitrary command-line text can ride out through this field.
+
+const SUPPRESSION_FLAG = "--no-session-persistence";
+const CLAUDE_BINARY_NAME = "claude";
+const MODEL_FLAG = /(?:^|\s)--model[=\s]+([A-Za-z0-9._:-]{1,64})(?=\s|$)/;
+const SUPPRESSION_FLAG_PATTERN = /(?:^|\s)--no-session-persistence(?:=|\s|$)/;
+const DEFAULT_TTL_MS = 30_000;
+
+let cache = null;
+
+function resetTranscriptSuppressionCache() {
+  cache = null;
+}
+
+// argv[0] must be the `claude` binary. Matching on the flag alone would also
+// match any shell, editor, or grep whose own command line happens to contain
+// the string — including the process asking this question.
+//
+// The executable region is everything before the first `--flag`, not the first
+// whitespace-delimited token: `ps` gives one flat string, so a binary installed
+// under a path containing a space ("/Users/me/My Tools/claude") would otherwise
+// be read as argv[0] = "/Users/me/My" and missed. A miss is the failure mode
+// this whole check exists to prevent, so it is worth the wider window.
+function isClaudeInvocation(command) {
+  const executableRegion = String(command || "").split(/\s+--/)[0] || "";
+  const base = executableRegion.trim().split(/[/\\]/).pop() || "";
+  return base.replace(/\.exe$/i, "").toLowerCase() === CLAUDE_BINARY_NAME;
+}
+
+function hasSuppressionFlag(command) {
+  return SUPPRESSION_FLAG_PATTERN.test(String(command || ""));
+}
+
+function extractModel(command) {
+  const match = String(command || "").match(MODEL_FLAG);
+  return match?.[1] || null;
+}
+
+// Pure: takes `ps` output lines, returns the deduplicated model ids of every
+// suppressed Claude process. Deliberately returns models rather than processes —
+// there is no pid in the return value for anything downstream to leak.
+function findSuppressedModels(lines = []) {
+  const models = new Set();
+  let count = 0;
+
+  for (const line of lines) {
+    const parsed = parseProcessLine(line);
+    if (!parsed) continue;
+    if (!isClaudeInvocation(parsed.command)) continue;
+    if (!hasSuppressionFlag(parsed.command)) continue;
+    count += 1;
+    const model = extractModel(parsed.command);
+    if (model) models.add(model);
+  }
+
+  return { count, models: [...models].sort() };
+}
+
+// Returns { supported, checked, count, models, reason, checked_at }.
+//
+// `checked: false` is never reported as a clean result by callers. "I could not
+// look" and "I looked and found nothing" are different answers, and collapsing
+// them is how a monitor starts lying.
+function detectTranscriptSuppression({
+  commandRunner,
+  platform = process.platform,
+  now = () => new Date(),
+  ttlMs = DEFAULT_TTL_MS,
+  useCache = true,
+} = {}) {
+  const at = now();
+  const atMs = at.getTime();
+
+  if (useCache && cache && atMs - cache.atMs < ttlMs) {
+    return cache.value;
+  }
+
+  const listed = listProcessLines({ commandRunner, platform });
+
+  let value;
+  if (!listed.ok) {
+    value = {
+      supported: listed.supported,
+      checked: false,
+      count: 0,
+      models: [],
+      reason: listed.reason,
+      checked_at: at.toISOString(),
+    };
+  } else {
+    const { count, models } = findSuppressedModels(listed.lines);
+    value = {
+      supported: true,
+      checked: true,
+      count,
+      models,
+      reason: null,
+      checked_at: at.toISOString(),
+    };
+  }
+
+  if (useCache) cache = { atMs, value };
+  return value;
+}
+
+module.exports = {
+  DEFAULT_TTL_MS,
+  SUPPRESSION_FLAG,
+  detectTranscriptSuppression,
+  findSuppressedModels,
+  resetTranscriptSuppressionCache,
+};

package/src/lib/usage-limits.js

@@ -21,12 +21,21 @@ const {
   extractCursorSessionToken,
   fetchCursorUsageSummary,
 } = require("./cursor-config");
+const { PS_ARGS, PS_BINARY, parseProcessLine } = require("./process-list");
+const { createSingleFlight } = require("./single-flight");
 
 // 2-minute in-memory cache
 let cache = { data: null, fetchedAt: 0 };
+// One slot per module instance, not a shared singleton: `delete require.cache[…]`
+// is how the tests get a clean cache, and a shared instance would survive it.
+const runUsageLimitsFetch = createSingleFlight();
 const CACHE_TTL_MS = 2 * 60 * 1000;
 const DEFAULT_PROVIDER_TIMEOUT_MS = 15_000;
 const ANTIGRAVITY_LIMITS_CACHE_FILE = "usage-limits-cache.json";
+// Trust marker, not a user identity: only cache blocks written after the
+// current-user process-scan fix may be served. Missing/unknown markers fail
+// closed so a legacy multi-user cache cannot disclose another account.
+const ANTIGRAVITY_CACHE_PROCESS_SCOPE = "current-user-v1";
 const ANTIGRAVITY_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 const ANTIGRAVITY_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
 const CLAUDE_LIMITS_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
@@ -986,11 +995,22 @@ async function fetchGeminiLimits({ home, env, fetchImpl = fetch, commandRunner }
 
 function runCommand(commandRunner, command, args, options = {}) {
   const runner = typeof commandRunner === "function" ? commandRunner : cp.spawnSync;
-  return runner(command, args, {
+  const result = runner(command, args, {
     encoding: "utf8",
     maxBuffer: 10 * 1024 * 1024,
     ...options,
   });
+  // Every consumer reads spawnSync-style fields immediately. An async runner
+  // is therefore a contract error, not supported concurrency. Attach a handler
+  // immediately, then return a synchronous failure shape so the Promise cannot
+  // escape as unhandled process state.
+  if (result && typeof result.then === "function") {
+    Promise.resolve(result).catch(() => {});
+    const error = new TypeError("commandRunner must return synchronously");
+    error.code = "COMMAND_RUNNER_ASYNC_UNSUPPORTED";
+    return { status: 1, stdout: "", stderr: error.message, error };
+  }
+  return result;
 }
 
 function whichBinary(binary, { commandRunner } = {}) {
@@ -1332,17 +1352,6 @@ function fetchKiroLimits({ commandRunner, now = new Date() } = {}) {
   }
 }
 
-function parseProcessLine(line) {
-  const match = String(line || "")
-    .trim()
-    .match(/^(\d+)\s+(.*)$/);
-  if (!match) return null;
-  return {
-    pid: Number(match[1]),
-    command: match[2],
-  };
-}
-
 function isAntigravityCommandLine(command) {
   const lower = String(command || "").toLowerCase();
   return lower.includes("language_server")
@@ -1360,10 +1369,34 @@ function extractCommandFlag(command, flag) {
   return match?.[1] || null;
 }
 
+// Scans for the local Antigravity language server and reads its `--csrf_token`
+// out of the command line, so that the quota request below can authenticate to
+// it.
+//
+// The scan is scoped to the current user, and must stay that way. Under the
+// previous `-ax` this walked every account on the box and attached to whichever
+// Antigravity matched first. The token itself never reached an HTTP response —
+// `processInfo` is read field by field and never spread into a return value —
+// but what the token *fetches* does: `normalizeAntigravityResponse` returns
+// `account_email` and `account_plan`, `finalize` spreads them into the result,
+// and `getUsageLimits` serves that at `/functions/tokentracker-usage-limits`.
+// On a shared host this meant showing another person's email, plan and quota as
+// the local user's, and `writeAntigravityLimitsCache` persisted it to disk,
+// where the `!configured` branch would keep serving it after their process
+// exited.
+//
+// Sharing PS_ARGS with process-list.js is deliberate: two scans that must both
+// stay own-user should not be able to drift apart.
 function detectAntigravityProcess({ commandRunner } = {}) {
-  const result = runCommand(commandRunner, "/bin/ps", ["-ax", "-o", "pid=,command="], {
+  const result = runCommand(commandRunner, PS_BINARY, PS_ARGS, {
     timeout: 4000,
   });
+  if (result?.error?.code === "COMMAND_RUNNER_ASYNC_UNSUPPORTED") {
+    return {
+      configured: true,
+      error: result.error?.message || "Antigravity process detection failed.",
+    };
+  }
   const lines = String(result?.stdout || "").split("\n");
 
   let sawProcess = false;
@@ -1435,6 +1468,7 @@ function hasAntigravityWindow(limits) {
 }
 
 function normalizeAntigravityCachedLimits(raw, { nowMs = Date.now() } = {}) {
+  if (raw?.process_scope !== ANTIGRAVITY_CACHE_PROCESS_SCOPE) return null;
   const cachedAtMs = parseTimeMs(raw?.cached_at);
   if (!Number.isFinite(cachedAtMs)) return null;
   if (cachedAtMs > nowMs + 60_000) return null;
@@ -1463,6 +1497,7 @@ function writeAntigravityLimitsCache(limits, { home, nowMs = Date.now() } = {})
   if (!limits?.configured || limits.error || !hasAntigravityWindow(limits)) return;
   const payload = {
     antigravity: {
+      process_scope: ANTIGRAVITY_CACHE_PROCESS_SCOPE,
       account_email: limits.account_email || null,
       account_plan: limits.account_plan || null,
       primary_window: limits.primary_window || null,
@@ -1899,7 +1934,20 @@ function withPlanLabel(obj, raw, brand) {
   return { ...obj, plan_label: normalizePlanLabel(raw, brand) };
 }
 
-async function getUsageLimits({
+async function getUsageLimits(options = {}) {
+  const nowMs = Date.now();
+  if (cache.data && nowMs - cache.fetchedAt < CACHE_TTL_MS) {
+    return cache.data;
+  }
+  // Past the cache there is exactly one thing to do, and it is expensive: sweep
+  // every configured provider. Concurrent tabs, route mounts and revalidations
+  // land here together on a cold cache, and a forced refresh clears the cache
+  // first (local-api.js, the `refresh` param) — so "no cached data" is a common
+  // state for several callers at once, not a rare one. They share one sweep.
+  return runUsageLimitsFetch(() => fetchUsageLimits(options));
+}
+
+async function fetchUsageLimits({
   home,
   env,
   platform,
@@ -1911,9 +1959,10 @@ async function getUsageLimits({
   providerTimeoutMs = DEFAULT_PROVIDER_TIMEOUT_MS,
 } = {}) {
   const nowMs = Date.now();
-  if (cache.data && nowMs - cache.fetchedAt < CACHE_TTL_MS) {
-    return cache.data;
-  }
+  // The stale-Codex refresh is part of the same provider sweep and must share
+  // its abort bound. Creating this before the serial prelude prevents one raw
+  // OAuth fetch from holding the process-wide single-flight slot forever.
+  const providerFetch = withFetchTimeout(fetchImpl, providerTimeoutMs);
 
   const [claudeToken, claudeSubscription, codexAuth] = await Promise.all([
     Promise.resolve().then(() => readClaudeCodeAccessToken({ platform, securityRunner, home })),
@@ -1933,7 +1982,7 @@ async function getUsageLimits({
     try {
       const newTokens = await refreshCodexTokens({
         refreshToken: codexAuth.refreshToken,
-        fetchImpl,
+        fetchImpl: providerFetch,
       });
       const updatedAuth = await persistRefreshedAuth(
         codexAuth.authPath,
@@ -1956,7 +2005,6 @@ async function getUsageLimits({
   const codexAccountId = codexAuthRefreshed?.accountId || null;
   const codexPlanType = codexAuthRefreshed?.planType || null;
 
-  const providerFetch = withFetchTimeout(fetchImpl, providerTimeoutMs);
   const [claudeResult, codexResult, cursor, kimi, zai, gemini, kiro, antigravity, copilot] = await Promise.all([
     claudeToken
       ? withProviderTimeout(fetchClaudeUsageLimits(claudeToken, { fetchImpl: providerFetch, maxAttempts: 1 }), "Claude", providerTimeoutMs).then(
@@ -2057,8 +2105,20 @@ function resetUsageLimitsCache() {
   cache = { data: null, fetchedAt: 0 };
 }
 
+// The force protocol for the quota cache, in one place because two handlers
+// speak it: the CLI local API and the Vite dev middleware. They used to carry
+// their own copy of the same comparison, which is how one of them quietly stops
+// honouring a spelling — and a force that is silently downgraded to a cached
+// read looks exactly like a working one. `1` is what the dashboard client sends
+// (dashboard/src/lib/api.ts); `true` is what a human types into the URL bar.
+// Deliberately exact: no trimming, no case folding, no truthiness.
+function isForcedRefresh(value) {
+  return value === "1" || value === "true";
+}
+
 module.exports = {
   getUsageLimits,
+  isForcedRefresh,
   normalizePlanLabel,
   resetUsageLimitsCache,
   extractGeminiOauthClientCredentials,