@vibe-cafe/vibe-usage 0.10.2 → 0.10.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibe-cafe/vibe-usage",
-  "version": "0.10.2",
+  "version": "0.10.3",
   "description": "Track your AI coding tool token usage and sync to vibecafe.ai",
   "type": "module",
   "scripts": {

package/src/api.js

@@ -10,6 +10,17 @@ const INITIAL_DELAY = 1000;
 // guaranteeing no uncompressed request ever leaves the client.
 const GZIP_MIN_BYTES = 0;
 
+export function retryDelayMs(attempt, random = Math.random) {
+  const ceiling = INITIAL_DELAY * 2 ** attempt;
+  // Equal jitter keeps a real backoff floor while preventing every desktop
+  // client from retrying a shared outage on the same 1s / 2s boundaries.
+  return Math.round(ceiling / 2 + random() * ceiling / 2);
+}
+
+function sleep(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
 export async function ingest(apiUrl, apiKey, buckets, opts, sessions) {
   let lastError;
   for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
@@ -22,8 +33,7 @@ export async function ingest(apiUrl, apiKey, buckets, opts, sessions) {
         throw err;
       }
       if (attempt < MAX_RETRIES - 1) {
-        const delay = INITIAL_DELAY * 2 ** attempt;
-        await new Promise(r => setTimeout(r, delay));
+        await sleep(retryDelayMs(attempt));
       }
     }
   }
@@ -222,13 +232,36 @@ function _jsonRequest(apiUrl, path, method, body, timeoutMs) {
 
 /**
  * GET user settings from the vibecafe API.
- * Returns null on any failure (network, auth, timeout) — caller should fail-safe.
+ * Returns null after transient failures are exhausted. A 401 remains distinct
+ * so callers can surface invalid credentials instead of calling it an outage.
  * @param {string} apiUrl
  * @param {string} apiKey
  * @returns {Promise<{uploadProject: boolean} | null>}
  */
-export function fetchSettings(apiUrl, apiKey) {
-  return new Promise((resolve) => {
+export async function fetchSettings(apiUrl, apiKey, retry = {}) {
+  const wait = retry.sleep ?? sleep;
+  const random = retry.random ?? Math.random;
+
+  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+    try {
+      return await fetchSettingsOnce(apiUrl, apiKey);
+    } catch (err) {
+      if (err.message === 'UNAUTHORIZED') throw err;
+      // Retrying a permanent client response cannot make it valid. 429 is the
+      // exception: it is transient load shedding and benefits from backoff.
+      if (err.statusCode >= 400 && err.statusCode < 500 && err.statusCode !== 429) {
+        return null;
+      }
+      if (attempt < MAX_RETRIES - 1) {
+        await wait(retryDelayMs(attempt, random));
+      }
+    }
+  }
+  return null;
+}
+
+function fetchSettingsOnce(apiUrl, apiKey) {
+  return new Promise((resolve, reject) => {
     const url = new URL('/api/usage/settings', apiUrl);
     const mod = url.protocol === 'https:' ? https : http;
 
@@ -242,20 +275,31 @@ export function fetchSettings(apiUrl, apiKey) {
       let data = '';
       res.on('data', (chunk) => { data += chunk; });
       res.on('end', () => {
+        if (res.statusCode === 401) {
+          reject(new Error('UNAUTHORIZED'));
+          return;
+        }
         if (res.statusCode < 200 || res.statusCode >= 300) {
-          resolve(null);
+          const err = new Error(`HTTP ${res.statusCode}: ${data}`);
+          err.statusCode = res.statusCode;
+          reject(err);
           return;
         }
         try {
-          resolve(JSON.parse(data));
+          const settings = JSON.parse(data);
+          if (typeof settings?.uploadProject !== 'boolean') {
+            reject(new Error('Invalid settings response'));
+            return;
+          }
+          resolve(settings);
         } catch {
-          resolve(null);
+          reject(new Error('Invalid settings response'));
         }
       });
     });
 
-    req.on('error', () => resolve(null));
-    req.on('timeout', () => { req.destroy(); resolve(null); });
+    req.on('error', reject);
+    req.on('timeout', () => { req.destroy(new Error('Settings request timed out')); });
     req.end();
   });
 }

package/src/sync.js

@@ -18,6 +18,15 @@ function formatBytes(bytes) {
   return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
 }
 
+export function resolveUploadProjectSetting(settings) {
+  if (typeof settings?.uploadProject !== 'boolean') {
+    const error = new Error('SETTINGS_UNAVAILABLE');
+    error.code = 'SETTINGS_UNAVAILABLE';
+    throw error;
+  }
+  return settings.uploadProject;
+}
+
 export async function runSync({ throws = false, quiet = false, surface = 'cli' } = {}) {
   const config = loadConfig();
   if (!config?.apiKey) {
@@ -32,6 +41,26 @@ export async function runSync({ throws = false, quiet = false, surface = 'cli' }
     saveConfig(config);
   }
 
+  // Privacy is a required input, not an optional hint. If the settings API is
+  // unavailable, treating it as `false` changes every project-bearing item's
+  // incremental identity to `unknown` and can trigger a full-history upload.
+  // Resolve it before parsing or loading upload state so failure is a true
+  // no-op: no data upload and no state mutation.
+  const apiUrl = config.apiUrl || 'https://vibecafe.ai';
+  let uploadProject;
+  try {
+    const settings = await fetchSettings(apiUrl, config.apiKey);
+    uploadProject = resolveUploadProjectSetting(settings);
+  } catch (err) {
+    if (err.message === 'UNAUTHORIZED') {
+      console.error(failure('API Key 无效，请运行 `npx @vibe-cafe/vibe-usage init` 重新配置。'));
+    } else {
+      console.error(failure('暂时无法读取上传设置，本次同步已安全取消（未上传数据）。请稍后重试。'));
+    }
+    if (throws) throw err;
+    process.exit(1);
+  }
+
   const allBuckets = [];
   const allSessions = [];
   const parserResults = [];
@@ -116,11 +145,6 @@ export async function runSync({ throws = false, quiet = false, surface = 'cli' }
   for (const b of allBuckets) if (!b.hostname) b.hostname = host;
   for (const s of allSessions) if (!s.hostname) s.hostname = host;
 
-  // Privacy: check if user allows project name upload
-  const apiUrl = config.apiUrl || 'https://vibecafe.ai';
-  const settings = await fetchSettings(apiUrl, config.apiKey);
-  const uploadProject = settings?.uploadProject === true;
-
   if (!quiet) {
     if (uploadProject) {
       console.log(dim('  项目名: 上传（可在 Web 设置中关闭）'));