tokentracker-cli 0.22.1 → 0.22.3

package/dashboard/dist/assets/{use-limits-display-prefs-BP17xuqs.js → use-limits-display-prefs-CzOLYgu5.js}

@@ -1 +1 @@
-import{r as a}from"./main-Csid8osN.js";const d=["claude","codex","cursor","gemini","kimi","kiro","copilot","antigravity"],S={claude:"Claude",codex:"Codex",cursor:"Cursor",gemini:"Gemini",kimi:"Kimi",kiro:"Kiro",copilot:"GitHub Copilot",antigravity:"Antigravity"},v={claude:"/brand-logos/claude-code.svg",codex:"/brand-logos/codex.svg",cursor:"/brand-logos/cursor.svg",gemini:"/brand-logos/gemini.svg",kimi:"/brand-logos/kimi.svg",kiro:"/brand-logos/kiro.svg",copilot:"/brand-logos/copilot.svg",antigravity:"/brand-logos/antigravity.svg"},l="tt.limits.providerOrder",g="tt.limits.providerVisibility";function w(){if(typeof window>"u")return[...d];try{const i=window.localStorage.getItem(l);if(!i)return[...d];const s=JSON.parse(i);if(!Array.isArray(s))return[...d];const r=s.filter(c=>d.includes(c));for(const c of d)r.includes(c)||r.push(c);return r}catch{return[...d]}}function y(){const i=Object.fromEntries(d.map(s=>[s,!0]));if(typeof window>"u")return i;try{const s=window.localStorage.getItem(g);if(!s)return i;const r=JSON.parse(s);if(!r||typeof r!="object")return i;const c={...i};for(const u of d)typeof r[u]=="boolean"&&(c[u]=r[u]);return c}catch{return i}}function C(){const[i,s]=a.useState(w),[r,c]=a.useState(y);a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(l,JSON.stringify(i))}catch{}},[i]),a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(g,JSON.stringify(r))}catch{}},[r]),a.useEffect(()=>{if(typeof window>"u")return;const o=t=>{t.key===l&&s(w()),t.key===g&&c(y())};return window.addEventListener("storage",o),()=>window.removeEventListener("storage",o)},[]);const u=a.useCallback(o=>{c(t=>({...t,[o]:!t[o]}))},[]),b=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<=0)return t;const n=[...t];return[n[e-1],n[e]]=[n[e],n[e-1]],n})},[]),p=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<0||e>=t.length-1)return t;const n=[...t];return[n[e],n[e+1]]=[n[e+1],n[e]],n})},[]),O=a.useCallback((o,t)=>{o!==t&&s(e=>{const n=e.indexOf(o),m=e.indexOf(t);if(n<0||m<0)return e;const f=[...e],[I]=f.splice(n,1);return f.splice(m,0,I),f})},[]),k=a.useCallback(()=>{s([...d]),c(Object.fromEntries(d.map(o=>[o,!0])))},[]),x=a.useMemo(()=>i.filter(o=>r[o]!==!1),[i,r]);return{order:i,visibility:r,visibleOrdered:x,toggle:u,moveUp:b,moveDown:p,moveToward:O,reset:k}}export{v as L,S as a,C as u};
+import{r as a}from"./main-DsrMFwQm.js";const d=["claude","codex","cursor","gemini","kimi","kiro","copilot","antigravity"],S={claude:"Claude",codex:"Codex",cursor:"Cursor",gemini:"Gemini",kimi:"Kimi",kiro:"Kiro",copilot:"GitHub Copilot",antigravity:"Antigravity"},v={claude:"/brand-logos/claude-code.svg",codex:"/brand-logos/codex.svg",cursor:"/brand-logos/cursor.svg",gemini:"/brand-logos/gemini.svg",kimi:"/brand-logos/kimi.svg",kiro:"/brand-logos/kiro.svg",copilot:"/brand-logos/copilot.svg",antigravity:"/brand-logos/antigravity.svg"},l="tt.limits.providerOrder",g="tt.limits.providerVisibility";function w(){if(typeof window>"u")return[...d];try{const i=window.localStorage.getItem(l);if(!i)return[...d];const s=JSON.parse(i);if(!Array.isArray(s))return[...d];const r=s.filter(c=>d.includes(c));for(const c of d)r.includes(c)||r.push(c);return r}catch{return[...d]}}function y(){const i=Object.fromEntries(d.map(s=>[s,!0]));if(typeof window>"u")return i;try{const s=window.localStorage.getItem(g);if(!s)return i;const r=JSON.parse(s);if(!r||typeof r!="object")return i;const c={...i};for(const u of d)typeof r[u]=="boolean"&&(c[u]=r[u]);return c}catch{return i}}function C(){const[i,s]=a.useState(w),[r,c]=a.useState(y);a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(l,JSON.stringify(i))}catch{}},[i]),a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(g,JSON.stringify(r))}catch{}},[r]),a.useEffect(()=>{if(typeof window>"u")return;const o=t=>{t.key===l&&s(w()),t.key===g&&c(y())};return window.addEventListener("storage",o),()=>window.removeEventListener("storage",o)},[]);const u=a.useCallback(o=>{c(t=>({...t,[o]:!t[o]}))},[]),b=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<=0)return t;const n=[...t];return[n[e-1],n[e]]=[n[e],n[e-1]],n})},[]),p=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<0||e>=t.length-1)return t;const n=[...t];return[n[e],n[e+1]]=[n[e+1],n[e]],n})},[]),O=a.useCallback((o,t)=>{o!==t&&s(e=>{const n=e.indexOf(o),m=e.indexOf(t);if(n<0||m<0)return e;const f=[...e],[I]=f.splice(n,1);return f.splice(m,0,I),f})},[]),k=a.useCallback(()=>{s([...d]),c(Object.fromEntries(d.map(o=>[o,!0])))},[]),x=a.useMemo(()=>i.filter(o=>r[o]!==!1),[i,r]);return{order:i,visibility:r,visibleOrdered:x,toggle:u,moveUp:b,moveDown:p,moveToward:O,reset:k}}export{v as L,S as a,C as u};

package/dashboard/dist/assets/{use-native-settings-C-RMuUxI.js → use-native-settings-D6YjGLZJ.js}

@@ -1 +1 @@
-import{C as a,a5 as x,r as n,aC as g,aD as m,aE as b,aF as u,aG as f,aA as h}from"./main-Csid8osN.js";import{C as y}from"./Card-DdDoM-Gd.js";function p({checked:s,onChange:t,disabled:e,ariaLabel:i}){return a.jsx("button",{type:"button",role:"switch","aria-checked":s,"aria-label":i,onClick:t,disabled:e,className:x("relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-oai-brand-500 disabled:opacity-50 disabled:cursor-not-allowed",s?"bg-oai-brand-500":"bg-oai-gray-300 dark:bg-oai-gray-700"),children:a.jsx("span",{className:x("inline-block h-3.5 w-3.5 rounded-full bg-white transition-transform",s?"translate-x-[18px]":"translate-x-[3px]")})})}function j({label:s,hint:t,control:e}){return a.jsxs("div",{className:"flex items-center justify-between gap-4 py-3",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("div",{className:"text-sm text-oai-gray-900 dark:text-oai-gray-200",children:s}),t?a.jsx("div",{className:"mt-0.5 text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),a.jsx("div",{className:"shrink-0",children:e})]})}function N({title:s,subtitle:t,action:e,children:i}){return a.jsxs(y,{children:[a.jsxs("div",{className:"mb-3 flex items-start justify-between gap-4",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("h2",{className:"text-sm font-medium text-oai-gray-500 dark:text-oai-gray-300 uppercase tracking-wide",children:s}),t?a.jsx("p",{className:"mt-1 truncate text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),e?a.jsx("div",{className:"shrink-0",children:e}):null]}),a.jsx("div",{className:"-mb-3 divide-y divide-oai-gray-200/60 dark:divide-oai-gray-800/60",children:i})]})}function w({options:s,value:t,onChange:e}){return a.jsx("div",{className:"inline-flex items-center rounded-lg border border-oai-gray-200 bg-oai-gray-50 p-0.5 dark:border-oai-gray-800 dark:bg-oai-gray-900",children:s.map(({value:i,label:d,Icon:l})=>{const r=t===i;return a.jsxs("button",{type:"button",onClick:()=>e(i),"aria-pressed":r,className:x("inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium transition-colors",r?"bg-white text-oai-black shadow-sm dark:bg-oai-gray-800 dark:text-white":"text-oai-gray-500 hover:text-oai-black dark:text-oai-gray-400 dark:hover:text-white"),children:[l?a.jsx(l,{className:"h-3.5 w-3.5","aria-hidden":!0}):null,a.jsx("span",{children:d})]},i)})})}function S(){const[s,t]=n.useState(null),e=g()&&m();n.useEffect(()=>{if(!e)return;const r=b(o=>t(o));return u(),r},[e]);const i=n.useCallback((r,o)=>{e&&(t(c=>c&&{...c,[r]:o}),f(r,o))},[e]),d=n.useCallback(r=>{e&&h(r)},[e]),l=n.useCallback(()=>{e&&u()},[e]);return{available:e,settings:s,setSetting:i,runAction:d,refresh:l}}export{N as S,p as T,j as a,w as b,S as u};
+import{C as a,a5 as x,r as n,aC as g,aD as m,aE as b,aF as u,aG as f,aA as h}from"./main-DsrMFwQm.js";import{C as y}from"./Card-Ce7Bq6YO.js";function p({checked:s,onChange:t,disabled:e,ariaLabel:i}){return a.jsx("button",{type:"button",role:"switch","aria-checked":s,"aria-label":i,onClick:t,disabled:e,className:x("relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-oai-brand-500 disabled:opacity-50 disabled:cursor-not-allowed",s?"bg-oai-brand-500":"bg-oai-gray-300 dark:bg-oai-gray-700"),children:a.jsx("span",{className:x("inline-block h-3.5 w-3.5 rounded-full bg-white transition-transform",s?"translate-x-[18px]":"translate-x-[3px]")})})}function j({label:s,hint:t,control:e}){return a.jsxs("div",{className:"flex items-center justify-between gap-4 py-3",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("div",{className:"text-sm text-oai-gray-900 dark:text-oai-gray-200",children:s}),t?a.jsx("div",{className:"mt-0.5 text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),a.jsx("div",{className:"shrink-0",children:e})]})}function N({title:s,subtitle:t,action:e,children:i}){return a.jsxs(y,{children:[a.jsxs("div",{className:"mb-3 flex items-start justify-between gap-4",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("h2",{className:"text-sm font-medium text-oai-gray-500 dark:text-oai-gray-300 uppercase tracking-wide",children:s}),t?a.jsx("p",{className:"mt-1 truncate text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),e?a.jsx("div",{className:"shrink-0",children:e}):null]}),a.jsx("div",{className:"-mb-3 divide-y divide-oai-gray-200/60 dark:divide-oai-gray-800/60",children:i})]})}function w({options:s,value:t,onChange:e}){return a.jsx("div",{className:"inline-flex items-center rounded-lg border border-oai-gray-200 bg-oai-gray-50 p-0.5 dark:border-oai-gray-800 dark:bg-oai-gray-900",children:s.map(({value:i,label:d,Icon:l})=>{const r=t===i;return a.jsxs("button",{type:"button",onClick:()=>e(i),"aria-pressed":r,className:x("inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium transition-colors",r?"bg-white text-oai-black shadow-sm dark:bg-oai-gray-800 dark:text-white":"text-oai-gray-500 hover:text-oai-black dark:text-oai-gray-400 dark:hover:text-white"),children:[l?a.jsx(l,{className:"h-3.5 w-3.5","aria-hidden":!0}):null,a.jsx("span",{children:d})]},i)})})}function S(){const[s,t]=n.useState(null),e=g()&&m();n.useEffect(()=>{if(!e)return;const r=b(o=>t(o));return u(),r},[e]);const i=n.useCallback((r,o)=>{e&&(t(c=>c&&{...c,[r]:o}),f(r,o))},[e]),d=n.useCallback(r=>{e&&h(r)},[e]),l=n.useCallback(()=>{e&&u()},[e]);return{available:e,settings:s,setSetting:i,runAction:d,refresh:l}}export{N as S,p as T,j as a,w as b,S as u};

package/dashboard/dist/assets/{use-reduced-motion-CPJKbom2.js → use-reduced-motion-0uADS5dP.js}

@@ -1 +1 @@
-import{aH as t,aI as o,r,aJ as s}from"./main-Csid8osN.js";function u(){!t.current&&o();const[e]=r.useState(s.current);return e}export{u};
+import{aH as t,aI as o,r,aJ as s}from"./main-DsrMFwQm.js";function u(){!t.current&&o();const[e]=r.useState(s.current);return e}export{u};

package/dashboard/dist/assets/{use-usage-limits-DIE-GP0H.js → use-usage-limits-xh-A-nDC.js}

@@ -1 +1 @@
-import{r,aj as l}from"./main-Csid8osN.js";function y(i){const[o,a]=r.useState(null),[u,s]=r.useState(null),[c,f]=r.useState(!0),n=!!i?.initialRefresh,g=r.useCallback(async()=>{try{const e=await l({refresh:!0});a(e&&typeof e=="object"?e:null),s(null)}catch(e){s(e?.message||String(e))}},[]);return r.useEffect(()=>{let e=!1;return(async()=>{try{const t=await l(n?{refresh:!0}:{});if(e)return;a(t&&typeof t=="object"?t:null),s(null)}catch(t){if(e)return;s(t?.message||String(t))}finally{e||f(!1)}})(),()=>{e=!0}},[n]),{data:o,error:u,isLoading:c,refresh:g}}export{y as u};
+import{r,aj as l}from"./main-DsrMFwQm.js";function y(i){const[o,a]=r.useState(null),[u,s]=r.useState(null),[c,f]=r.useState(!0),n=!!i?.initialRefresh,g=r.useCallback(async()=>{try{const e=await l({refresh:!0});a(e&&typeof e=="object"?e:null),s(null)}catch(e){s(e?.message||String(e))}},[]);return r.useEffect(()=>{let e=!1;return(async()=>{try{const t=await l(n?{refresh:!0}:{});if(e)return;a(t&&typeof t=="object"?t:null),s(null)}catch(t){if(e)return;s(t?.message||String(t))}finally{e||f(!1)}})(),()=>{e=!0}},[n]),{data:o,error:u,isLoading:c,refresh:g}}export{y as u};

package/dashboard/dist/index.html

@@ -210,8 +210,8 @@
         ]
       }
     </script>
-    <script type="module" crossorigin src="/assets/main-Csid8osN.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/main-A_x5MMU-.css">
+    <script type="module" crossorigin src="/assets/main-DsrMFwQm.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/main-D55hG1yw.css">
   </head>
   <body>
     <main class="aeo-seed-content" aria-label="Token Tracker AI-readable summary">

package/dashboard/dist/share.html

@@ -51,8 +51,8 @@
         "description": "Shareable Token Tracker dashboard snapshot."
       }
     </script>
-    <script type="module" crossorigin src="/assets/main-Csid8osN.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/main-A_x5MMU-.css">
+    <script type="module" crossorigin src="/assets/main-DsrMFwQm.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/main-D55hG1yw.css">
   </head>
   <body>
     <main class="aeo-seed-content" aria-label="Token Tracker share page summary">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokentracker-cli",
-  "version": "0.22.1",
+  "version": "0.22.3",
   "description": "Token usage tracker for AI agent CLIs (Claude Code, Codex, Cursor, Gemini, Kiro, OpenCode, OpenClaw, Every Code, Hermes, GitHub Copilot, Kimi Code, CodeBuddy, Grok Build, oh-my-pi, pi, Craft Agents, Kilo CLI, Kilo Code, Roo Code, Zed Agent, Goose)",
   "main": "src/cli.js",
   "bin": {

package/src/lib/cursor-config.js

@@ -96,9 +96,12 @@ function readCursorAccessTokenFromStateDb(stateDbPath, deps = {}) {
  * Extract Cursor session cookie from local SQLite + cli-config.json.
  * Returns { cookie, userId } or null on failure.
  *
- * Cookie format: WorkosCursorSessionToken=user_XXXXX%3A%3A<jwt>
+ * Cookie format: WorkosCursorSessionToken=<userId>%3A%3A<jwt>
  * - JWT from state.vscdb → ItemTable → cursorAuth/accessToken
- * - userId from cli-config.json → authInfo.authId → "auth0|user_XXXXX"
+ * - userId from cli-config.json → authInfo.authId
+ *   - native Cursor email/password: "auth0|user_XXXXX"        → "user_XXXXX"
+ *   - Google sign-in via WorkOS:    "google-oauth2|<numeric>" → kept verbatim
+ *   - other WorkOS subjects:        "github|…", "oidc|…"      → kept verbatim
  */
 function extractCursorSessionToken({ home, deps } = {}) {
   const { stateDbPath, cliConfigPath } = resolveCursorPaths({ home });
@@ -123,12 +126,24 @@ function extractCursorSessionToken({ home, deps } = {}) {
   return { cookie, userId };
 }
 
+// WorkOS OAuth subject prefixes Cursor accepts as-is in the session cookie.
+// Verified against cursor.com/api/usage-summary (issue #88).
+const WORKOS_OAUTH_SUBJECT_RE = /^(google-oauth2|github|oidc|auth0)\|[^|]+$/;
+
+function normalizeCursorSubject(subject) {
+  if (!subject) return null;
+  // Native Cursor: "auth0|user_XXXXX" → strip provider prefix, return "user_XXXXX"
+  const native = subject.match(/\|(user_[A-Za-z0-9_]+)$/);
+  if (native) return native[1];
+  // WorkOS-bridged OAuth: keep the full "<provider>|<id>" subject
+  if (WORKOS_OAUTH_SUBJECT_RE.test(subject)) return subject;
+  return null;
+}
+
 function extractUserIdFromCliConfig(configPath) {
   try {
     const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
-    const authId = config?.authInfo?.authId || "";
-    const match = authId.match(/\|(user_[A-Za-z0-9_]+)/);
-    return match ? match[1] : null;
+    return normalizeCursorSubject(config?.authInfo?.authId || "");
   } catch {
     return null;
   }
@@ -139,9 +154,7 @@ function extractUserIdFromJwt(jwt) {
     const parts = jwt.split(".");
     if (parts.length !== 3) return null;
     const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    const sub = payload.sub || "";
-    const match = sub.match(/(user_[A-Za-z0-9_]+)/);
-    return match ? match[1] : null;
+    return normalizeCursorSubject(payload.sub || "");
   } catch {
     return null;
   }

package/src/lib/local-api.js

@@ -674,6 +674,7 @@ function createLocalApiHandler({ queuePath }) {
   // Server-side cookie relay: captures auth cookies from InsForge cloud responses
   // so that both browser and WKWebView share the same login session via the proxy.
   // Persisted to disk so cookies survive server restarts.
+  const csrfRelayCookieName = "insforge_csrf_token";
   let relayCookies = new Map();
   const localAuthToken = crypto.randomBytes(24).toString("hex");
   const trackerDataDir = path.join(os.homedir(), ".tokentracker", "tracker");
@@ -755,6 +756,49 @@ function createLocalApiHandler({ queuePath }) {
     if (changed) persistRelayCookies();
   }
 
+  function getRelayCookieValue(name, { decode = false } = {}) {
+    const raw = relayCookies.get(name);
+    if (!raw || typeof raw !== "string") return "";
+    const pair = raw.split(";")[0] || "";
+    const eqIdx = pair.indexOf("=");
+    if (eqIdx < 1) return "";
+    const value = pair.substring(eqIdx + 1).trim();
+    if (!decode) return value;
+    try {
+      return decodeURIComponent(value);
+    } catch {
+      return value;
+    }
+  }
+
+  function captureAuthTokensFromBody(bodyBuffer, contentType) {
+    if (!bodyBuffer || !String(contentType || "").toLowerCase().includes("application/json")) return;
+    let parsed = null;
+    try {
+      parsed = JSON.parse(bodyBuffer.toString("utf8"));
+    } catch {
+      return;
+    }
+    let changed = false;
+    const token = typeof parsed?.csrfToken === "string" ? parsed.csrfToken.trim() : "";
+    if (token) {
+      const cookie = `${csrfRelayCookieName}=${encodeURIComponent(token)}; Path=/; SameSite=Lax`;
+      if (relayCookies.get(csrfRelayCookieName) !== cookie) {
+        relayCookies.set(csrfRelayCookieName, cookie);
+        changed = true;
+      }
+    }
+    const refreshToken = typeof parsed?.refreshToken === "string" ? parsed.refreshToken.trim() : "";
+    if (refreshToken) {
+      const cookie = `insforge_refresh_token=${encodeURIComponent(refreshToken)}; Path=/; HttpOnly; SameSite=Lax`;
+      if (relayCookies.get("insforge_refresh_token") !== cookie) {
+        relayCookies.set("insforge_refresh_token", cookie);
+        changed = true;
+      }
+    }
+    if (changed) persistRelayCookies();
+  }
+
   function normalizeCookieHeader(value) {
     if (Array.isArray(value)) return value.filter(Boolean).join("; ");
     return typeof value === "string" ? value : "";
@@ -852,25 +896,48 @@ function createLocalApiHandler({ queuePath }) {
         }
         const hasClientCookie = normalizeCookieHeader(proxyHeaders["cookie"]).trim().length > 0;
         const hasCsrfHeader = typeof proxyHeaders["x-csrf-token"] === "string" && proxyHeaders["x-csrf-token"].trim().length > 0;
-        const shouldInjectRelayCookies =
-          p !== "/api/auth/refresh" || hasClientCookie || hasCsrfHeader;
+        const relayCsrfToken = getRelayCookieValue(csrfRelayCookieName);
+        if (p === "/api/auth/refresh" && !hasCsrfHeader && relayCsrfToken) {
+          proxyHeaders["x-csrf-token"] = relayCsrfToken;
+        }
+        const hasEffectiveCsrfHeader =
+          hasCsrfHeader ||
+          (typeof proxyHeaders["x-csrf-token"] === "string" && proxyHeaders["x-csrf-token"].trim().length > 0);
+        let shouldInjectRelayCookies =
+          p !== "/api/auth/refresh" || hasClientCookie || hasEffectiveCsrfHeader;
+        const relayRefreshToken = getRelayCookieValue("insforge_refresh_token", { decode: true });
+        const shouldUseRelayRefreshFallback =
+          p === "/api/auth/refresh" && !hasClientCookie && !hasEffectiveCsrfHeader && relayRefreshToken;
+        if (shouldUseRelayRefreshFallback) {
+          shouldInjectRelayCookies = false;
+        }
 
         // Inject relay cookies so WebView benefits from browser's login session.
         // Refresh requests need either a browser cookie or an explicit CSRF token;
         // otherwise replaying a stale persisted refresh cookie just manufactures
         // Invalid CSRF errors on startup.
+        const originalCookieHeader = normalizeCookieHeader(proxyHeaders["cookie"]);
         const mergedCookie = shouldInjectRelayCookies
-          ? buildRelayCookieHeader(proxyHeaders["cookie"])
-          : normalizeCookieHeader(proxyHeaders["cookie"]);
+          ? buildRelayCookieHeader(originalCookieHeader)
+          : originalCookieHeader;
+        const injectedRelayCookies =
+          shouldInjectRelayCookies && relayCookies.size > 0 && mergedCookie !== originalCookieHeader;
         if (mergedCookie) proxyHeaders["cookie"] = mergedCookie;
 
         const bodyChunks = [];
         for await (const chunk of req) bodyChunks.push(chunk);
-        const body = bodyChunks.length > 0 ? Buffer.concat(bodyChunks) : undefined;
-        const proxyRes = await fetch(targetUrl, {
+        let proxyBody = bodyChunks.length > 0 ? Buffer.concat(bodyChunks) : undefined;
+        let effectiveTargetUrl = targetUrl;
+        if (shouldUseRelayRefreshFallback) {
+          effectiveTargetUrl = `${insforgeBase.replace(/\/$/, "")}/api/auth/refresh?client_type=mobile`;
+          proxyHeaders["content-type"] = "application/json";
+          delete proxyHeaders["content-length"];
+          proxyBody = Buffer.from(JSON.stringify({ refresh_token: relayRefreshToken }), "utf8");
+        }
+        const proxyRes = await fetch(effectiveTargetUrl, {
           method: req.method || "GET",
           headers: proxyHeaders,
-          body,
+          body: proxyBody,
           credentials: "include",
           redirect: "manual",
         });
@@ -886,11 +953,18 @@ function createLocalApiHandler({ queuePath }) {
           });
         res.writeHead(proxyRes.status, Object.fromEntries(responseHeaders));
         const resBody = Buffer.from(await proxyRes.arrayBuffer());
+        if (proxyRes.status >= 200 && proxyRes.status < 300) {
+          if (p === "/api/auth/logout") {
+            clearRelayCookies("sign out");
+          } else {
+            captureAuthTokensFromBody(resBody, proxyRes.headers.get("content-type"));
+          }
+        }
         if (
           p === "/api/auth/refresh"
           && proxyRes.status === 403
+          && injectedRelayCookies
           && !hasClientCookie
-          && !hasCsrfHeader
           && /invalid csrf token/i.test(resBody.toString("utf8"))
         ) {
           clearRelayCookies("stale refresh cookie without local CSRF context");