tokentracker-cli 0.88.7 → 0.88.8

package/src/lib/subscriptions.js

@@ -446,6 +446,7 @@ async function readCodexAuthBundle({ home, env } = {}) {
 
 module.exports = {
   collectLocalSubscriptions,
+  detectClaudeCodeCredentialsPresence,
   detectClaudeCodeSubscriptionDetails,
   readClaudeCodeAccessToken,
   readCodexAccessToken,

package/src/lib/usage-limits.js

@@ -9,6 +9,7 @@ const { performance } = require("node:perf_hooks");
 const { promisify } = require("node:util");
 
 const {
+  detectClaudeCodeCredentialsPresence,
   detectClaudeCodeSubscriptionDetails,
   readClaudeCodeAccessToken,
   readCodexAccessToken,
@@ -188,6 +189,10 @@ function extractClaudeScopedWeekly(body) {
   return out.length > 0 ? out : null;
 }
 
+// Shared by the 401 path below and by the blank-credential path in getUsageLimits:
+// both mean "the CLI login no longer works", and both are fixed the same way.
+const CLAUDE_AUTH_EXPIRED_MESSAGE = "Claude token expired — run `claude` once to refresh.";
+
 async function fetchClaudeUsageLimits(accessToken, { fetchImpl = fetch, maxAttempts = 3 } = {}) {
   const url = "https://api.anthropic.com/api/oauth/usage";
   const headers = {
@@ -198,7 +203,7 @@ async function fetchClaudeUsageLimits(accessToken, { fetchImpl = fetch, maxAttem
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     const res = await fetchImpl(url, { method: "GET", headers });
     if (res.status === 401) {
-      const err = new Error("Claude token expired — run `claude` once to refresh.");
+      const err = new Error(CLAUDE_AUTH_EXPIRED_MESSAGE);
       err.code = "AUTH_EXPIRED";
       throw err;
     }
@@ -3243,7 +3248,17 @@ async function fetchUsageLimitsUncached({
 
   let claude;
   if (!claudeToken) {
-    claude = { configured: false };
+    // Claude Code blanks `accessToken`/`refreshToken` in place when its login expires
+    // (macOS Keychain item and .credentials.json alike) instead of removing the entry,
+    // so "no token" is ambiguous: never signed in, or signed in and expired. An entry
+    // that still exists means the latter — reporting `configured: false` there hides the
+    // whole Claude section while the usage bars (parsed from local logs, no auth needed)
+    // keep updating, which reads as "TokenTracker doesn't support my plan" rather than
+    // "your CLI login expired". Existence-only probe: no secret is read here.
+    const credentialsPresent = detectClaudeCodeCredentialsPresence({ platform, securityRunner, home });
+    claude = credentialsPresent
+      ? { configured: true, error: CLAUDE_AUTH_EXPIRED_MESSAGE, auth_action_required: "reauth" }
+      : { configured: false };
   } else if (freshClaudeCache) {
     claude = freshClaudeCache;
   } else if (claudeResult && claudeResult.status === "fulfilled") {