tokentracker-cli 0.23.2 → 0.24.0

package/dashboard/dist/assets/{use-limits-display-prefs-DZ9hgvef.js → use-limits-display-prefs-BVawA_Rp.js}

@@ -1 +1 @@
-import{r as a}from"./main-Cb6vMAZa.js";const d=["claude","codex","cursor","gemini","kimi","kiro","copilot","antigravity"],S={claude:"Claude",codex:"Codex",cursor:"Cursor",gemini:"Gemini",kimi:"Kimi",kiro:"Kiro",copilot:"GitHub Copilot",antigravity:"Antigravity"},v={claude:"/brand-logos/claude-code.svg",codex:"/brand-logos/codex.svg",cursor:"/brand-logos/cursor.svg",gemini:"/brand-logos/gemini.svg",kimi:"/brand-logos/kimi.svg",kiro:"/brand-logos/kiro.svg",copilot:"/brand-logos/copilot.svg",antigravity:"/brand-logos/antigravity.svg"},l="tt.limits.providerOrder",g="tt.limits.providerVisibility";function w(){if(typeof window>"u")return[...d];try{const i=window.localStorage.getItem(l);if(!i)return[...d];const s=JSON.parse(i);if(!Array.isArray(s))return[...d];const r=s.filter(c=>d.includes(c));for(const c of d)r.includes(c)||r.push(c);return r}catch{return[...d]}}function y(){const i=Object.fromEntries(d.map(s=>[s,!0]));if(typeof window>"u")return i;try{const s=window.localStorage.getItem(g);if(!s)return i;const r=JSON.parse(s);if(!r||typeof r!="object")return i;const c={...i};for(const u of d)typeof r[u]=="boolean"&&(c[u]=r[u]);return c}catch{return i}}function C(){const[i,s]=a.useState(w),[r,c]=a.useState(y);a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(l,JSON.stringify(i))}catch{}},[i]),a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(g,JSON.stringify(r))}catch{}},[r]),a.useEffect(()=>{if(typeof window>"u")return;const o=t=>{t.key===l&&s(w()),t.key===g&&c(y())};return window.addEventListener("storage",o),()=>window.removeEventListener("storage",o)},[]);const u=a.useCallback(o=>{c(t=>({...t,[o]:!t[o]}))},[]),b=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<=0)return t;const n=[...t];return[n[e-1],n[e]]=[n[e],n[e-1]],n})},[]),p=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<0||e>=t.length-1)return t;const n=[...t];return[n[e],n[e+1]]=[n[e+1],n[e]],n})},[]),O=a.useCallback((o,t)=>{o!==t&&s(e=>{const n=e.indexOf(o),m=e.indexOf(t);if(n<0||m<0)return e;const f=[...e],[I]=f.splice(n,1);return f.splice(m,0,I),f})},[]),k=a.useCallback(()=>{s([...d]),c(Object.fromEntries(d.map(o=>[o,!0])))},[]),x=a.useMemo(()=>i.filter(o=>r[o]!==!1),[i,r]);return{order:i,visibility:r,visibleOrdered:x,toggle:u,moveUp:b,moveDown:p,moveToward:O,reset:k}}export{v as L,S as a,C as u};
+import{r as a}from"./main-uaLO1Ae7.js";const d=["claude","codex","cursor","gemini","kimi","kiro","copilot","antigravity"],S={claude:"Claude",codex:"Codex",cursor:"Cursor",gemini:"Gemini",kimi:"Kimi",kiro:"Kiro",copilot:"GitHub Copilot",antigravity:"Antigravity"},v={claude:"/brand-logos/claude-code.svg",codex:"/brand-logos/codex.svg",cursor:"/brand-logos/cursor.svg",gemini:"/brand-logos/gemini.svg",kimi:"/brand-logos/kimi.svg",kiro:"/brand-logos/kiro.svg",copilot:"/brand-logos/copilot.svg",antigravity:"/brand-logos/antigravity.svg"},l="tt.limits.providerOrder",g="tt.limits.providerVisibility";function w(){if(typeof window>"u")return[...d];try{const i=window.localStorage.getItem(l);if(!i)return[...d];const s=JSON.parse(i);if(!Array.isArray(s))return[...d];const r=s.filter(c=>d.includes(c));for(const c of d)r.includes(c)||r.push(c);return r}catch{return[...d]}}function y(){const i=Object.fromEntries(d.map(s=>[s,!0]));if(typeof window>"u")return i;try{const s=window.localStorage.getItem(g);if(!s)return i;const r=JSON.parse(s);if(!r||typeof r!="object")return i;const c={...i};for(const u of d)typeof r[u]=="boolean"&&(c[u]=r[u]);return c}catch{return i}}function C(){const[i,s]=a.useState(w),[r,c]=a.useState(y);a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(l,JSON.stringify(i))}catch{}},[i]),a.useEffect(()=>{if(!(typeof window>"u"))try{window.localStorage.setItem(g,JSON.stringify(r))}catch{}},[r]),a.useEffect(()=>{if(typeof window>"u")return;const o=t=>{t.key===l&&s(w()),t.key===g&&c(y())};return window.addEventListener("storage",o),()=>window.removeEventListener("storage",o)},[]);const u=a.useCallback(o=>{c(t=>({...t,[o]:!t[o]}))},[]),b=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<=0)return t;const n=[...t];return[n[e-1],n[e]]=[n[e],n[e-1]],n})},[]),p=a.useCallback(o=>{s(t=>{const e=t.indexOf(o);if(e<0||e>=t.length-1)return t;const n=[...t];return[n[e],n[e+1]]=[n[e+1],n[e]],n})},[]),O=a.useCallback((o,t)=>{o!==t&&s(e=>{const n=e.indexOf(o),m=e.indexOf(t);if(n<0||m<0)return e;const f=[...e],[I]=f.splice(n,1);return f.splice(m,0,I),f})},[]),k=a.useCallback(()=>{s([...d]),c(Object.fromEntries(d.map(o=>[o,!0])))},[]),x=a.useMemo(()=>i.filter(o=>r[o]!==!1),[i,r]);return{order:i,visibility:r,visibleOrdered:x,toggle:u,moveUp:b,moveDown:p,moveToward:O,reset:k}}export{v as L,S as a,C as u};

package/dashboard/dist/assets/{use-native-settings-DS1TfSil.js → use-native-settings-DHtj5DnD.js}

@@ -1 +1 @@
-import{C as a,a7 as x,r as n,aH as g,aI as m,aJ as b,aK as u,aL as f,aF as h}from"./main-Cb6vMAZa.js";import{C as y}from"./Card-WqeqJCTJ.js";function p({checked:s,onChange:t,disabled:e,ariaLabel:i}){return a.jsx("button",{type:"button",role:"switch","aria-checked":s,"aria-label":i,onClick:t,disabled:e,className:x("relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-oai-brand-500 disabled:opacity-50 disabled:cursor-not-allowed",s?"bg-oai-brand-500":"bg-oai-gray-300 dark:bg-oai-gray-700"),children:a.jsx("span",{className:x("inline-block h-3.5 w-3.5 rounded-full bg-white transition-transform",s?"translate-x-[18px]":"translate-x-[3px]")})})}function j({label:s,hint:t,control:e}){return a.jsxs("div",{className:"flex items-center justify-between gap-4 py-3",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("div",{className:"text-sm text-oai-gray-900 dark:text-oai-gray-200",children:s}),t?a.jsx("div",{className:"mt-0.5 text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),a.jsx("div",{className:"shrink-0",children:e})]})}function N({title:s,subtitle:t,action:e,children:i}){return a.jsxs(y,{children:[a.jsxs("div",{className:"mb-3 flex items-start justify-between gap-4",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("h2",{className:"text-sm font-medium text-oai-gray-500 dark:text-oai-gray-300 uppercase tracking-wide",children:s}),t?a.jsx("p",{className:"mt-1 truncate text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),e?a.jsx("div",{className:"shrink-0",children:e}):null]}),a.jsx("div",{className:"-mb-3 divide-y divide-oai-gray-200/60 dark:divide-oai-gray-800/60",children:i})]})}function w({options:s,value:t,onChange:e}){return a.jsx("div",{className:"inline-flex items-center rounded-lg border border-oai-gray-200 bg-oai-gray-50 p-0.5 dark:border-oai-gray-800 dark:bg-oai-gray-900",children:s.map(({value:i,label:d,Icon:l})=>{const r=t===i;return a.jsxs("button",{type:"button",onClick:()=>e(i),"aria-pressed":r,className:x("inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium transition-colors",r?"bg-white text-oai-black shadow-sm dark:bg-oai-gray-800 dark:text-white":"text-oai-gray-500 hover:text-oai-black dark:text-oai-gray-400 dark:hover:text-white"),children:[l?a.jsx(l,{className:"h-3.5 w-3.5","aria-hidden":!0}):null,a.jsx("span",{children:d})]},i)})})}function S(){const[s,t]=n.useState(null),e=g()&&m();n.useEffect(()=>{if(!e)return;const r=b(o=>t(o));return u(),r},[e]);const i=n.useCallback((r,o)=>{e&&(t(c=>c&&{...c,[r]:o}),f(r,o))},[e]),d=n.useCallback(r=>{e&&h(r)},[e]),l=n.useCallback(()=>{e&&u()},[e]);return{available:e,settings:s,setSetting:i,runAction:d,refresh:l}}export{N as S,p as T,j as a,w as b,S as u};
+import{C as a,a7 as x,r as n,aH as g,aI as m,aJ as b,aK as u,aL as f,aF as h}from"./main-uaLO1Ae7.js";import{C as y}from"./Card-C22jvaH-.js";function p({checked:s,onChange:t,disabled:e,ariaLabel:i}){return a.jsx("button",{type:"button",role:"switch","aria-checked":s,"aria-label":i,onClick:t,disabled:e,className:x("relative inline-flex h-5 w-9 shrink-0 items-center rounded-full transition-colors focus:outline-none focus-visible:ring-2 focus-visible:ring-oai-brand-500 disabled:opacity-50 disabled:cursor-not-allowed",s?"bg-oai-brand-500":"bg-oai-gray-300 dark:bg-oai-gray-700"),children:a.jsx("span",{className:x("inline-block h-3.5 w-3.5 rounded-full bg-white transition-transform",s?"translate-x-[18px]":"translate-x-[3px]")})})}function j({label:s,hint:t,control:e}){return a.jsxs("div",{className:"flex items-center justify-between gap-4 py-3",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("div",{className:"text-sm text-oai-gray-900 dark:text-oai-gray-200",children:s}),t?a.jsx("div",{className:"mt-0.5 text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),a.jsx("div",{className:"shrink-0",children:e})]})}function N({title:s,subtitle:t,action:e,children:i}){return a.jsxs(y,{children:[a.jsxs("div",{className:"mb-3 flex items-start justify-between gap-4",children:[a.jsxs("div",{className:"min-w-0 flex-1",children:[a.jsx("h2",{className:"text-sm font-medium text-oai-gray-500 dark:text-oai-gray-300 uppercase tracking-wide",children:s}),t?a.jsx("p",{className:"mt-1 truncate text-xs text-oai-gray-500 dark:text-oai-gray-400",children:t}):null]}),e?a.jsx("div",{className:"shrink-0",children:e}):null]}),a.jsx("div",{className:"-mb-3 divide-y divide-oai-gray-200/60 dark:divide-oai-gray-800/60",children:i})]})}function w({options:s,value:t,onChange:e}){return a.jsx("div",{className:"inline-flex items-center rounded-lg border border-oai-gray-200 bg-oai-gray-50 p-0.5 dark:border-oai-gray-800 dark:bg-oai-gray-900",children:s.map(({value:i,label:d,Icon:l})=>{const r=t===i;return a.jsxs("button",{type:"button",onClick:()=>e(i),"aria-pressed":r,className:x("inline-flex items-center gap-1.5 rounded-md px-3 py-1.5 text-xs font-medium transition-colors",r?"bg-white text-oai-black shadow-sm dark:bg-oai-gray-800 dark:text-white":"text-oai-gray-500 hover:text-oai-black dark:text-oai-gray-400 dark:hover:text-white"),children:[l?a.jsx(l,{className:"h-3.5 w-3.5","aria-hidden":!0}):null,a.jsx("span",{children:d})]},i)})})}function S(){const[s,t]=n.useState(null),e=g()&&m();n.useEffect(()=>{if(!e)return;const r=b(o=>t(o));return u(),r},[e]);const i=n.useCallback((r,o)=>{e&&(t(c=>c&&{...c,[r]:o}),f(r,o))},[e]),d=n.useCallback(r=>{e&&h(r)},[e]),l=n.useCallback(()=>{e&&u()},[e]);return{available:e,settings:s,setSetting:i,runAction:d,refresh:l}}export{N as S,p as T,j as a,w as b,S as u};

package/dashboard/dist/assets/{use-reduced-motion-D82galUK.js → use-reduced-motion-8tbVQBYw.js}

@@ -1 +1 @@
-import{aM as t,aN as o,r,aO as s}from"./main-Cb6vMAZa.js";function u(){!t.current&&o();const[e]=r.useState(s.current);return e}export{u};
+import{aM as t,aN as o,r,aO as s}from"./main-uaLO1Ae7.js";function u(){!t.current&&o();const[e]=r.useState(s.current);return e}export{u};

package/dashboard/dist/assets/{use-usage-limits-B-svr8YY.js → use-usage-limits-SwQjCSa8.js}

@@ -1 +1 @@
-import{r,al as l}from"./main-Cb6vMAZa.js";function y(i){const[o,a]=r.useState(null),[u,s]=r.useState(null),[c,f]=r.useState(!0),n=!!i?.initialRefresh,g=r.useCallback(async()=>{try{const e=await l({refresh:!0});a(e&&typeof e=="object"?e:null),s(null)}catch(e){s(e?.message||String(e))}},[]);return r.useEffect(()=>{let e=!1;return(async()=>{try{const t=await l(n?{refresh:!0}:{});if(e)return;a(t&&typeof t=="object"?t:null),s(null)}catch(t){if(e)return;s(t?.message||String(t))}finally{e||f(!1)}})(),()=>{e=!0}},[n]),{data:o,error:u,isLoading:c,refresh:g}}export{y as u};
+import{r,al as l}from"./main-uaLO1Ae7.js";function y(i){const[o,a]=r.useState(null),[u,s]=r.useState(null),[c,f]=r.useState(!0),n=!!i?.initialRefresh,g=r.useCallback(async()=>{try{const e=await l({refresh:!0});a(e&&typeof e=="object"?e:null),s(null)}catch(e){s(e?.message||String(e))}},[]);return r.useEffect(()=>{let e=!1;return(async()=>{try{const t=await l(n?{refresh:!0}:{});if(e)return;a(t&&typeof t=="object"?t:null),s(null)}catch(t){if(e)return;s(t?.message||String(t))}finally{e||f(!1)}})(),()=>{e=!0}},[n]),{data:o,error:u,isLoading:c,refresh:g}}export{y as u};

package/dashboard/dist/assets/{useCurrency-uA9QPua4.js → useCurrency-Bc8I7sE1.js}

@@ -1 +1 @@
-import{r as e,aA as t,aB as r,I as c}from"./main-Cb6vMAZa.js";const a=Object.freeze({currency:c,rate:1,symbol:"$",rates:{...r},rateSource:"default",rateFetchedAt:null,setCurrency:()=>{}});function u(){return e.useContext(t)??a}export{u};
+import{r as e,aA as t,aB as r,I as c}from"./main-uaLO1Ae7.js";const a=Object.freeze({currency:c,rate:1,symbol:"$",rates:{...r},rateSource:"default",rateFetchedAt:null,setCurrency:()=>{}});function u(){return e.useContext(t)??a}export{u};

package/dashboard/dist/index.html

@@ -210,8 +210,8 @@
         ]
       }
     </script>
-    <script type="module" crossorigin src="/assets/main-Cb6vMAZa.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/main-0bSXJNLn.css">
+    <script type="module" crossorigin src="/assets/main-uaLO1Ae7.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/main-JP_EYeq-.css">
   </head>
   <body>
     <main class="aeo-seed-content" aria-label="Token Tracker AI-readable summary">

package/dashboard/dist/share.html

@@ -51,8 +51,8 @@
         "description": "Shareable Token Tracker dashboard snapshot."
       }
     </script>
-    <script type="module" crossorigin src="/assets/main-Cb6vMAZa.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/main-0bSXJNLn.css">
+    <script type="module" crossorigin src="/assets/main-uaLO1Ae7.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/main-JP_EYeq-.css">
   </head>
   <body>
     <main class="aeo-seed-content" aria-label="Token Tracker share page summary">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokentracker-cli",
-  "version": "0.23.2",
+  "version": "0.24.0",
   "description": "Token usage tracker for AI agent CLIs (Claude Code, Codex, Cursor, Gemini, Kiro, OpenCode, OpenClaw, Every Code, Hermes, GitHub Copilot, Kimi Code, CodeBuddy, Grok Build, oh-my-pi, pi, Craft Agents, Kilo CLI, Kilo Code, Roo Code, Zed Agent, Goose)",
   "main": "src/cli.js",
   "bin": {

package/src/lib/local-api.js

@@ -673,29 +673,18 @@ function json(res, data, status) {
 }
 
 // ---------------------------------------------------------------------------
-// IP check proxy (issue #81): ip.net.coffee/claude/ sets X-Frame-Options:
-// SAMEORIGIN so the dashboard iframe is blocked. We reverse-proxy through
-// /proxy/ipcheck/* so requests stay same-origin to 127.0.0.1, then strip the
-// embedding-hostile headers and rewrite root-relative URLs in HTML so the
-// page's own /api/* and /claude/* fetches route back through us.
+// IP check API proxy: dashboard/src/pages/IpCheckPage.jsx is a native React
+// page that calls ip.net.coffee's data endpoints (/api/iprisk, /api/geoip,
+// /api/dns/result, /favicons, /claude/status.json). Browser-side fetch can't
+// hit them cross-origin from the dashboard, so we reverse-proxy /proxy/ipcheck/*
+// to https://ip.net.coffee/* and strip embedding-hostile headers.
+// (Previously this proxy also served the upstream HTML page for an iframe;
+// the iframe and its HTML-rewrite path have been removed.)
 // ---------------------------------------------------------------------------
 
 const IP_CHECK_PROXY_PREFIX = "/proxy/ipcheck";
 const IP_CHECK_TARGET = "https://ip.net.coffee";
 
-function rewriteIpCheckHtml(html) {
-  const prefix = IP_CHECK_PROXY_PREFIX;
-  return html
-    .replace(
-      /(\s(?:href|src|action)\s*=\s*["'])\/(?!\/|proxy\/ipcheck\/)/g,
-      `$1${prefix}/`,
-    )
-    .replace(
-      /(fetch\s*\(\s*["'`])\/(?!\/|proxy\/ipcheck\/)/g,
-      `$1${prefix}/`,
-    );
-}
-
 // ---------------------------------------------------------------------------
 // Main handler factory
 // ---------------------------------------------------------------------------
@@ -1015,34 +1004,49 @@ function createLocalApiHandler({ queuePath, allowedHosts = [] } = {}) {
       return true;
     }
 
-    // --- ip-check proxy: reverse-proxy ip.net.coffee/claude/ (issue #81) ---
+    // --- ip-check proxy: reverse-proxy ip.net.coffee (issue #81) ---
+    // Lock-down: GET/HEAD only, restricted path prefixes, do not forward
+    // browser credentials or fingerprintable headers. Without these limits
+    // /proxy/ipcheck is an open reverse-proxy any local process can abuse
+    // (exfiltrate dashboard cookies, anonymously POST through user IP).
     if (p.startsWith(`${IP_CHECK_PROXY_PREFIX}/`) || p === IP_CHECK_PROXY_PREFIX) {
+      const method = String(req.method || "GET").toUpperCase();
+      if (method !== "GET" && method !== "HEAD") {
+        json(res, { error: "Method Not Allowed" }, 405);
+        return true;
+      }
       const targetPath = p === IP_CHECK_PROXY_PREFIX
         ? "/"
         : p.slice(IP_CHECK_PROXY_PREFIX.length) || "/";
+      const ALLOWED_PREFIXES = [
+        "/api/geoip/",
+        "/api/geoip-batch",
+        "/api/iprisk/",
+        "/api/dns/result/",
+        "/claude/status.json",
+        "/favicons/",
+        "/ip/",
+      ];
+      if (!ALLOWED_PREFIXES.some((prefix) => targetPath.startsWith(prefix))) {
+        json(res, { error: "Path not allowed" }, 403);
+        return true;
+      }
       const targetUrl = `${IP_CHECK_TARGET}${targetPath}${url.search || ""}`;
       try {
-        const proxyHeaders = {};
-        for (const [key, value] of Object.entries(req.headers)) {
-          const lk = key.toLowerCase();
-          if (["host", "connection", "referer", "origin"].includes(lk)) continue;
-          proxyHeaders[key] = value;
-        }
-        proxyHeaders["host"] = "ip.net.coffee";
-        proxyHeaders["referer"] = `${IP_CHECK_TARGET}${targetPath}`;
-
-        const method = String(req.method || "GET").toUpperCase();
-        let body;
-        if (method !== "GET" && method !== "HEAD") {
-          const chunks = [];
-          for await (const chunk of req) chunks.push(chunk);
-          if (chunks.length > 0) body = Buffer.concat(chunks);
-        }
+        // Whitelist forwarded headers — no cookies, no auth, no fingerprintable
+        // identity. Only what the upstream needs to negotiate content.
+        const proxyHeaders = {
+          host: "ip.net.coffee",
+          accept: req.headers["accept"] || "*/*",
+          "accept-language": req.headers["accept-language"] || "en",
+          "accept-encoding": req.headers["accept-encoding"] || "gzip",
+          "user-agent": "TokenTracker/IPCheck (https://www.tokentracker.cc)",
+          referer: `${IP_CHECK_TARGET}${targetPath}`,
+        };
 
         const proxyRes = await fetch(targetUrl, {
           method,
           headers: proxyHeaders,
-          body,
           redirect: "manual",
         });
 
@@ -1061,12 +1065,7 @@ function createLocalApiHandler({ queuePath, allowedHosts = [] } = {}) {
           ([k]) => !stripped.has(k.toLowerCase()),
         );
 
-        const contentType = proxyRes.headers.get("content-type") || "";
-        let resBody = Buffer.from(await proxyRes.arrayBuffer());
-        if (contentType.toLowerCase().includes("text/html")) {
-          resBody = Buffer.from(rewriteIpCheckHtml(resBody.toString("utf8")), "utf8");
-        }
-
+        const resBody = Buffer.from(await proxyRes.arrayBuffer());
         res.writeHead(proxyRes.status, Object.fromEntries(responseHeaders));
         res.end(resBody);
       } catch (e) {