tokentracker-cli 0.70.0 → 0.72.0

package/src/lib/telemetry.js

@@ -0,0 +1,192 @@
+"use strict";
+
+/**
+ * Anonymous daily heartbeat for counting active installs.
+ *
+ * Privacy contract (documented in README "Privacy" section — keep in sync):
+ * the payload carries exactly four fields — a one-way sha256 hash of the
+ * machine id, the app version, `process.platform`, and the app shell
+ * (cli / macos / windows). No token counts, no model names, no usernames,
+ * no paths. Opt out with TOKENTRACKER_NO_TELEMETRY=1, the DO_NOT_TRACK
+ * standard, or `"telemetry": false` in config.json.
+ */
+
+const path = require("node:path");
+const crypto = require("node:crypto");
+
+const pkg = require("../../package.json");
+const { readJson, writeJson } = require("./fs");
+const { getOrCreateMachineId } = require("./machine-id");
+const { resolveRuntimeConfig } = require("./runtime-config");
+const {
+  decideAutoUpload,
+  recordUploadSuccess,
+  recordUploadFailure,
+} = require("./upload-throttle");
+
+const HEARTBEAT_FUNCTION_SLUG = "tokentracker-telemetry";
+const HEARTBEAT_STATE_FILE = "telemetry.heartbeat.json";
+const HEARTBEAT_INTERVAL_MS = 24 * 60 * 60 * 1000;
+// The hash namespace is versioned so the anonymous id can be rotated fleet-wide
+// by bumping the string. sha256(namespace + machineId) cannot be joined back to
+// the cloud device rows (those store the machineId itself).
+const MACHINE_HASH_NAMESPACE = "tokentracker-telemetry-v1:";
+// Generous because some networks need 3-4s just for the TLS handshake to the
+// cloud host; sync awaits this at most once per day so the worst-case stall
+// is bounded and rare.
+const DEFAULT_TIMEOUT_MS = 10_000;
+const VALID_SHELLS = new Set(["cli", "macos", "windows"]);
+
+const THROTTLE_CONFIG = {
+  intervalMs: HEARTBEAT_INTERVAL_MS,
+  jitterMsMax: 60_000,
+  backoffInitialMs: 60 * 60_000, // failures retry hourly at most
+  backoffMaxMs: HEARTBEAT_INTERVAL_MS,
+};
+
+function isTelemetryDisabled({ env = process.env, config = {} } = {}) {
+  if (isTruthyFlag(env?.TOKENTRACKER_NO_TELEMETRY)) return true;
+  if (isTruthyFlag(env?.DO_NOT_TRACK)) return true;
+  if (config && config.telemetry === false) return true;
+  return false;
+}
+
+function isTruthyFlag(value) {
+  if (typeof value !== "string") return false;
+  const v = value.trim().toLowerCase();
+  return v === "1" || v === "true";
+}
+
+function hashMachineId(machineId) {
+  return crypto
+    .createHash("sha256")
+    .update(`${MACHINE_HASH_NAMESPACE}${machineId}`)
+    .digest("hex");
+}
+
+function resolveShell(env = process.env) {
+  const raw = typeof env?.TOKENTRACKER_APP_SHELL === "string"
+    ? env.TOKENTRACKER_APP_SHELL.trim().toLowerCase()
+    : "";
+  return VALID_SHELLS.has(raw) ? raw : "cli";
+}
+
+function buildHeartbeatPayload({ machineId, version = pkg.version, platform = process.platform, env = process.env }) {
+  return {
+    machine_hash: hashMachineId(machineId),
+    app_version: String(version || "").slice(0, 32),
+    platform: String(platform || "unknown").slice(0, 16),
+    shell: resolveShell(env),
+  };
+}
+
+/**
+ * Send the daily heartbeat if allowed. Never throws; every failure path is a
+ * silent no-op so serve/sync flow is never affected. Returns a small status
+ * object for tests and debug logging.
+ */
+async function maybeSendHeartbeat({
+  trackerDir,
+  fetchImpl = fetch,
+  nowMs = Date.now(),
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  version,
+} = {}) {
+  try {
+    if (!trackerDir) return { sent: false, reason: "no-tracker-dir" };
+
+    // Never phone home from the node test runner: many tests drive cmdSync /
+    // cmdServe directly from sandboxed temp homes, and their fresh throttle
+    // state would let a real POST through to production on every run. Tests
+    // that exercise this module inject their own env without this marker.
+    if (env?.NODE_TEST_CONTEXT !== undefined) {
+      return { sent: false, reason: "test-env" };
+    }
+
+    const configPath = path.join(trackerDir, "config.json");
+    const config = (await readJson(configPath)) || {};
+    if (isTelemetryDisabled({ env, config })) {
+      return { sent: false, reason: "opt-out" };
+    }
+
+    const statePath = path.join(trackerDir, HEARTBEAT_STATE_FILE);
+    const state = await readJson(statePath);
+    const decision = decideAutoUpload({
+      nowMs,
+      pendingBytes: 1, // heartbeats always have "one ping pending"
+      state,
+      config: THROTTLE_CONFIG,
+    });
+    if (!decision.allowed) {
+      return { sent: false, reason: "throttled", blockedUntilMs: decision.blockedUntilMs };
+    }
+
+    const machineId = getOrCreateMachineId(path.join(trackerDir, "queue.jsonl"));
+    if (!machineId) return { sent: false, reason: "no-machine-id" };
+
+    const runtime = resolveRuntimeConfig({ config, env });
+    const payload = buildHeartbeatPayload({ machineId, version, env });
+
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await fetchImpl(`${runtime.baseUrl}/functions/${HEARTBEAT_FUNCTION_SLUG}`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          apikey: runtime.anonKey,
+        },
+        body: JSON.stringify(payload),
+        signal: controller.signal,
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+
+    if (!response || !response.ok) {
+      const failedState = recordUploadFailure({
+        nowMs,
+        state,
+        error: { message: `heartbeat http ${response?.status || "error"}`, status: response?.status },
+        config: THROTTLE_CONFIG,
+      });
+      await writeJson(statePath, failedState);
+      return { sent: false, reason: "http-error", status: response?.status };
+    }
+
+    const nextState = recordUploadSuccess({ nowMs, state, config: THROTTLE_CONFIG });
+    await writeJson(statePath, nextState);
+    return { sent: true, reason: "sent" };
+  } catch (e) {
+    // Includes abort/network errors: record backoff if we can, stay silent.
+    try {
+      const statePath = path.join(trackerDir, HEARTBEAT_STATE_FILE);
+      const state = await readJson(statePath);
+      await writeJson(
+        statePath,
+        recordUploadFailure({
+          nowMs,
+          state,
+          error: { message: String(e?.message || e) },
+          config: THROTTLE_CONFIG,
+        }),
+      );
+    } catch {
+      // Even state persistence failed — nothing else to do.
+    }
+    return { sent: false, reason: "error" };
+  }
+}
+
+module.exports = {
+  HEARTBEAT_FUNCTION_SLUG,
+  HEARTBEAT_STATE_FILE,
+  HEARTBEAT_INTERVAL_MS,
+  isTelemetryDisabled,
+  hashMachineId,
+  resolveShell,
+  buildHeartbeatPayload,
+  maybeSendHeartbeat,
+};

package/src/lib/usage-limits.js

@@ -28,9 +28,15 @@ const { fetchZcodeLimits } = require("./zcode-limits");
 const { fetchOpencodeGoLimits } = require("./opencode-go-limits");
 const { readSqliteJsonRows } = require("./sqlite-reader");
 
-// 2-minute in-memory cache
-let cache = { data: null, fetchedAt: 0 };
+// 2-minute in-memory cache. It also expires early at the earliest upcoming window
+// reset in the cached data (see cacheExpiresAtMs), floored so a provider reporting
+// a reset "right now" can't turn every poll into a full upstream round.
+let cache = { data: null, expiresAtMs: 0 };
 const CACHE_TTL_MS = 2 * 60 * 1000;
+// Must stay below the macOS app's post-reset re-fetch grace (10s in
+// DashboardViewModel.resetBoundaryGrace), or that targeted refresh would be
+// served this cache's pre-reset snapshot and miss the rollover.
+const CACHE_MIN_TTL_MS = 5 * 1000;
 const DEFAULT_PROVIDER_TIMEOUT_MS = 15_000;
 const ANTIGRAVITY_LIMITS_CACHE_FILE = "usage-limits-cache.json";
 const ANTIGRAVITY_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
@@ -1921,24 +1927,48 @@ function normalizeClaudeCachedLimits(
   return hasClaudeWindow(cached) ? cached : null;
 }
 
+function readClaudeLimitsCacheRaw({ home } = {}) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolveClaudeLimitsCachePath({ home }), "utf8"));
+    return parsed?.claude ?? null;
+  } catch (_error) {
+    return null;
+  }
+}
+
 function readClaudeLimitsCache({
   home,
   nowMs = Date.now(),
   maxAgeMs = CLAUDE_LIMITS_CACHE_MAX_AGE_MS,
   stale = true,
 } = {}) {
-  const cachePath = resolveClaudeLimitsCachePath({ home });
-  try {
-    const parsed = JSON.parse(fs.readFileSync(cachePath, "utf8"));
-    return normalizeClaudeCachedLimits(parsed?.claude, { nowMs, maxAgeMs, stale });
-  } catch (_error) {
-    return null;
-  }
+  return normalizeClaudeCachedLimits(readClaudeLimitsCacheRaw({ home }), { nowMs, maxAgeMs, stale });
+}
+
+// A cached snapshot stops being "fresh" the moment any of its windows crosses the
+// reset boundary it was written with: serving it past that point hides the rollover
+// from reset detection (the menu bar confetti) for up to the fresh TTL. Only resets
+// that were still ahead at write time count — a provider stamping already-past reset
+// times must not force a live call on every poll.
+function claudeCacheCrossedReset(raw, { nowMs } = {}) {
+  const cachedAtMs = parseTimeMs(raw?.cached_at);
+  if (!Number.isFinite(cachedAtMs)) return false;
+  const windows = [
+    raw?.five_hour,
+    raw?.seven_day,
+    raw?.seven_day_opus,
+    ...(Array.isArray(raw?.weekly_scoped) ? raw.weekly_scoped : []),
+  ];
+  return windows.some((window) => {
+    const resetMs = parseTimeMs(window?.resets_at);
+    return resetMs !== null && resetMs > cachedAtMs && resetMs <= nowMs;
+  });
 }
 
 function readFreshClaudeLimitsCache({ home, nowMs = Date.now() } = {}) {
-  return readClaudeLimitsCache({
-    home,
+  const raw = readClaudeLimitsCacheRaw({ home });
+  if (!raw || claudeCacheCrossedReset(raw, { nowMs })) return null;
+  return normalizeClaudeCachedLimits(raw, {
     nowMs,
     maxAgeMs: CLAUDE_LIMITS_CACHE_FRESH_TTL_MS,
     stale: false,
@@ -2564,9 +2594,44 @@ function withPlanLabel(obj, raw, brand) {
 // in-flight fetch and returns its result.
 let inFlightFetch = null;
 
+// Codex stamps reset_at as unix seconds; every other provider (and Claude's
+// resets_at) uses ISO strings. Numbers that look like epoch milliseconds are
+// accepted as-is so a future provider can't silently regress this.
+function resetValueToMs(value) {
+  if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+    return value < 1e12 ? value * 1000 : value;
+  }
+  return parseTimeMs(value);
+}
+
+// Walk the aggregated response and collect every window reset timestamp,
+// whatever the provider-specific nesting looks like.
+function collectResetTimesMs(node, out) {
+  if (!node || typeof node !== "object") return;
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "reset_at" || key === "resets_at") {
+      const ms = resetValueToMs(value);
+      if (ms !== null) out.push(ms);
+    } else if (value && typeof value === "object") {
+      collectResetTimesMs(value, out);
+    }
+  }
+}
+
+// The moment any window rolls over, cached data stops being current — reset
+// detection (the menu bar confetti) would otherwise lag by up to the full TTL.
+function cacheExpiresAtMs(data, fetchedAtMs) {
+  const times = [];
+  collectResetTimesMs(data, times);
+  const upcoming = times.filter((t) => t > fetchedAtMs);
+  const ttlExpiry = fetchedAtMs + CACHE_TTL_MS;
+  if (upcoming.length === 0) return ttlExpiry;
+  return Math.min(ttlExpiry, Math.max(Math.min(...upcoming), fetchedAtMs + CACHE_MIN_TTL_MS));
+}
+
 async function getUsageLimits(options = {}) {
   const nowMs = Date.now();
-  if (cache.data && nowMs - cache.fetchedAt < CACHE_TTL_MS) {
+  if (cache.data && nowMs < cache.expiresAtMs) {
     return cache.data;
   }
   if (inFlightFetch) {
@@ -2775,18 +2840,19 @@ async function fetchUsageLimitsUncached({
     opencodeGo: withPlanLabel(opencodeGo, opencodeGo?.plan_label, "OpenCode Go"),
   };
 
-  cache = { data, fetchedAt: nowMs };
+  cache = { data, expiresAtMs: cacheExpiresAtMs(data, nowMs) };
   return data;
 }
 
 function resetUsageLimitsCache() {
-  cache = { data: null, fetchedAt: 0 };
+  cache = { data: null, expiresAtMs: 0 };
 }
 
 module.exports = {
   getUsageLimits,
   normalizePlanLabel,
   resetUsageLimitsCache,
+  cacheExpiresAtMs,
   runCommand,
   extractGeminiOauthClientCredentials,
   loadKimiCredentials,

package/dashboard/dist/assets/DialogDescription-DNyMczI_.js

@@ -1 +0,0 @@
-import{r as n,b9 as a}from"./main-DPyNBrFb.js";import{u as p}from"./DialogTitle-BrR7t4i0.js";import{u as c}from"./useScrollLock-D0Td7eQX.js";const x=n.forwardRef(function(e,r){const{render:l,className:u,style:m,id:s,...t}=e,{store:i}=p(),o=c(s);return i.useSyncedValueWithCleanup("descriptionElementId",o),a("p",e,{ref:r,props:[{id:o},t]})});export{x as D};

package/dashboard/dist/assets/check-gQkfPY06.js

@@ -1 +0,0 @@
-import{c}from"./main-DPyNBrFb.js";const e=[["path",{d:"M20 6 9 17l-5-5",key:"1gmf2c"}]],t=c("check",e);export{t as C};