tokentracker-cli 0.89.0 → 0.90.0

package/src/lib/command-runner.js

@@ -0,0 +1,286 @@
+"use strict";
+
+// Shared command runner for local-CLI limit providers.
+//
+// Extracted from usage-limits.js (which keeps a require of it) so
+// ark-coding-plan-limits.js and future providers don't have to copy it.
+// This is a superset of both former copies: the original's `completeWhen`
+// early-settlement hook, plus the hardening that previously only lived in
+// the ark copy — an abort `signal` wired into the spawn lifecycle, a
+// `platform` override with `where.exe` discovery on native Windows, and a
+// byte-capped maxBuffer for piped spawn output.
+
+const cp = require("node:child_process");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+
+function runCommand(commandRunner, command, args, options = {}) {
+  const merged = {
+    encoding: "utf8",
+    maxBuffer: 10 * 1024 * 1024,
+    useShell: false,
+    ...options,
+  };
+  if (typeof commandRunner === "function") {
+    return Promise.resolve(commandRunner(command, args, merged));
+  }
+
+  const {
+    timeout,
+    maxBuffer,
+    completeWhen,
+    completionGraceMs = 250,
+    killProcessGroup = false,
+    platform = process.platform,
+    signal,
+    useShell = false,
+    ...spawnOptions
+  } = merged;
+  return new Promise((resolve) => {
+    if (signal?.aborted) {
+      const error = new Error(`spawn ${command} aborted`);
+      error.name = "AbortError";
+      resolve({ status: null, stdout: "", stderr: "", error });
+      return;
+    }
+
+    const useProcessGroup = killProcessGroup && platform !== "win32";
+    // `useShell` is opt-in per call site. It exists for npm's Windows .cmd
+    // shims, which Node's spawn cannot execute directly — but shell
+    // execution means cmd.exe re-parses the joined command line, so any
+    // argument carrying shell metacharacters (e.g. a powershell -Command
+    // script with `|`) would be split. Default false keeps direct spawns,
+    // which is what every pre-existing usage-limits call site expects.
+    // Under shell execution quote the command unconditionally: cmd.exe
+    // metacharacters are not limited to whitespace (`C:\Users\a&b\...`
+    // has none yet splits at `&`), and Windows account names allow them.
+    const shellCommand = useShell && !command.startsWith('"')
+      ? `"${command}"`
+      : command;
+    let child;
+    try {
+      child = cp.spawn(shellCommand, args, {
+        ...spawnOptions,
+        detached: useProcessGroup || spawnOptions.detached,
+        shell: useShell,
+        stdio: ["ignore", "pipe", "pipe"],
+      });
+    } catch (error) {
+      resolve({ status: null, stdout: "", stderr: "", error });
+      return;
+    }
+
+    let stdout = "";
+    let stderr = "";
+    let outputBytes = 0;
+    let settled = false;
+    let timedOut = false;
+    let timer = null;
+    let hardTimer = null;
+    let completionTimer = null;
+    let abortListener = null;
+
+    const settle = ({ status = null, error = null } = {}) => {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      if (hardTimer) clearTimeout(hardTimer);
+      if (completionTimer) clearTimeout(completionTimer);
+      if (abortListener) signal?.removeEventListener("abort", abortListener);
+      let finalError = error;
+      if (!finalError && timedOut) {
+        finalError = new Error(`spawn ${command} ETIMEDOUT`);
+        finalError.code = "ETIMEDOUT";
+      }
+      const result = { status, stdout, stderr };
+      if (finalError) result.error = finalError;
+      resolve(result);
+    };
+
+    const signalChild = (killSignal) => {
+      try {
+        if (useProcessGroup && Number.isInteger(child.pid)) {
+          process.kill(-child.pid, killSignal);
+        } else {
+          child.kill(killSignal);
+        }
+      } catch (_error) {}
+    };
+
+    const stopChild = ({ timeoutExpired = false } = {}) => {
+      if (settled) return;
+      if (timeoutExpired) timedOut = true;
+      signalChild("SIGTERM");
+      // A CLI may leave descendants or inherited stdio alive after SIGTERM.
+      // Escalate after a short grace period and settle even if close never fires.
+      hardTimer = setTimeout(() => {
+        signalChild("SIGKILL");
+        settle({ status: null });
+      }, 1000);
+      if (typeof hardTimer.unref === "function") hardTimer.unref();
+    };
+
+    const scheduleCompletion = () => {
+      if (typeof completeWhen !== "function" || settled) return;
+      let complete = false;
+      try {
+        complete = Boolean(completeWhen(stdout, stderr));
+      } catch (_error) {}
+      if (!complete) return;
+      if (completionTimer) clearTimeout(completionTimer);
+      completionTimer = setTimeout(
+        () => stopChild(),
+        Math.max(0, Number(completionGraceMs) || 0),
+      );
+    };
+
+    const appendOutput = (key, chunk) => {
+      if (settled) return;
+      if (key === "stdout") stdout += chunk;
+      else stderr += chunk;
+      outputBytes += Buffer.byteLength(chunk, "utf8");
+      // Unlike exec/execFile, spawn does not apply a maxBuffer guard to piped
+      // streams. Enforce the combined byte cap here so a verbose CLI cannot
+      // grow this process without bound.
+      if (outputBytes > maxBuffer) {
+        const error = new Error(`spawn ${command} maxBuffer length exceeded`);
+        error.code = "ERR_CHILD_PROCESS_STDIO_MAXBUFFER";
+        signalChild("SIGKILL");
+        settle({ status: null, error });
+        return;
+      }
+      scheduleCompletion();
+    };
+
+    child.stdout?.setEncoding("utf8");
+    child.stderr?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => appendOutput("stdout", chunk));
+    child.stderr?.on("data", (chunk) => appendOutput("stderr", chunk));
+    child.on("error", (error) => settle({ status: null, error }));
+    child.on("close", (code) => settle({ status: timedOut ? null : code }));
+
+    if (signal) {
+      abortListener = () => stopChild();
+      signal.addEventListener("abort", abortListener, { once: true });
+      if (signal.aborted) abortListener();
+    }
+    if (Number.isFinite(timeout) && timeout > 0) {
+      timer = setTimeout(() => stopChild({ timeoutExpired: true }), timeout);
+    }
+  });
+}
+
+// Locate a binary on PATH. Unix uses `which`; native Windows ships no `which`
+// (it has `where.exe` instead), so blindly spawning `which` there returns
+// ENOENT and every provider would report itself unconfigured even when the
+// binary is installed and signed in.
+async function whichBinary(binary, { commandRunner, platform = process.platform, signal } = {}) {
+  const probe = platform === "win32" ? "where" : "which";
+  const result = await runCommand(commandRunner, probe, [binary], {
+    timeout: 2000,
+    signal,
+    platform,
+    killProcessGroup: true,
+  });
+  if (result?.error || result?.status !== 0) return null;
+  const stdout = typeof result?.stdout === "string" ? result.stdout.trim() : "";
+  if (!stdout) return null;
+  // `where` on Windows emits CRLF and may list several matches across PATH
+  // entries; take the first line without the trailing `\r`, or the polluted
+  // path would fail at spawn time.
+  return stdout
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .find(Boolean) || null;
+}
+
+async function isBinaryAvailable(binary, { commandRunner, platform, signal } = {}) {
+  return (await whichBinary(binary, { commandRunner, platform, signal })) !== null;
+}
+
+// Expand a versioned install root (e.g. ~/.nvm/versions/node/<ver>/ or
+// fnm's node-versions/<ver>/installation/) into its per-version bin
+// directories. Returns [] when the root does not exist.
+function versionedBinDirs(root, inner) {
+  try {
+    return fs.readdirSync(root, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory() && !entry.name.startsWith("."))
+      .sort((a, b) => b.name.localeCompare(a.name, "en", { numeric: true }))
+      .map((entry) => path.join(root, entry.name, ...inner));
+  } catch (_error) {
+    return [];
+  }
+}
+
+// Directories where globally installed CLIs commonly live even when the
+// current process has a minimal PATH (e.g. a Finder-launched macOS app does
+// not inherit the login-shell PATH, so Homebrew and npm global binaries are
+// unreachable through `which`). Probed with statSync — no spawn.
+function commonGlobalBinDirectories({ home = os.homedir(), platform = process.platform } = {}) {
+  if (platform === "win32") {
+    return [
+      path.join(home, "AppData", "Roaming", "npm"),
+    ];
+  }
+  return [
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    path.join(home, ".npm-global", "bin"),
+    // volta keeps shims for every global install here
+    path.join(home, ".volta", "bin"),
+    // nvm / fnm install npm globals under a per-version prefix that a
+    // minimal PATH never sees; newest version first.
+    ...versionedBinDirs(path.join(home, ".nvm", "versions", "node"), ["bin"]),
+    ...versionedBinDirs(path.join(home, ".local", "share", "fnm", "node-versions"), ["installation", "bin"]),
+    ...(platform === "darwin"
+      ? versionedBinDirs(path.join(home, "Library", "Application Support", "fnm", "node-versions"), ["installation", "bin"])
+      : []),
+  ];
+}
+
+// Probe `binary` inside the given directories with statSync — no spawn.
+// Exported so providers can treat a hit as install evidence without
+// paying for a `which` process.
+function statBinaryInDirs(binary, searchDirs, platform = process.platform) {
+  for (const dir of searchDirs) {
+    const candidate = path.join(dir, binary);
+    for (const suffix of platform === "win32" ? ["", ".cmd", ".exe"] : [""]) {
+      try {
+        if (fs.statSync(candidate + suffix).isFile()) return candidate + suffix;
+      } catch (_error) {}
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve a binary to an absolute path: `which`/`where` first, then a
+ * spawn-free probe of the common global-install directories above. Returns
+ * null when the binary cannot be found. Callers should spawn the returned
+ * path (not the bare name): a bare name goes through PATH search again —
+ * and on Windows cmd.exe searches the current directory first, which would
+ * let an `arkcli.bat` dropped in the server cwd hijack the spawn.
+ */
+async function resolveBinaryPath(binary, { commandRunner, home, platform = process.platform, signal, globalBinDirs } = {}) {
+  let resolved = null;
+  try {
+    resolved = await whichBinary(binary, { commandRunner, platform, signal });
+  } catch (_error) {
+    resolved = null;
+  }
+  if (resolved) return resolved;
+  const searchDirs = Array.isArray(globalBinDirs)
+    ? globalBinDirs
+    : commonGlobalBinDirectories({ home, platform });
+  return statBinaryInDirs(binary, searchDirs, platform);
+}
+
+module.exports = {
+  runCommand,
+  whichBinary,
+  isBinaryAvailable,
+  commonGlobalBinDirectories,
+  statBinaryInDirs,
+  resolveBinaryPath,
+};

package/src/lib/cursor-config.js

@@ -1,7 +1,6 @@
 const os = require("node:os");
 const path = require("node:path");
 const fs = require("node:fs");
-const https = require("node:https");
 
 const { readJson } = require("./fs");
 const { readSqliteFirstValue } = require("./sqlite-reader");
@@ -139,58 +138,73 @@ const CURSOR_CSV_URL = "https://cursor.com/api/dashboard/export-usage-events-csv
 const CURSOR_SUMMARY_URL = "https://cursor.com/api/usage-summary";
 const CURSOR_SOURCE_SCOPE = "account";
 
+function isCursorFetchTimeout(err) {
+  return Boolean(err && (err.name === "TimeoutError" || err.name === "AbortError"));
+}
+
+function remapCursorFetchTimeout(err) {
+  if (isCursorFetchTimeout(err)) {
+    throw new Error("Cursor API request timed out");
+  }
+  throw err;
+}
+
+const CURSOR_REDIRECT_HOSTS = new Set(["cursor.com", "www.cursor.com"]);
+
+/**
+ * Resolve a redirect `Location` before the session cookie is forwarded to it.
+ *
+ * The header is attacker-influenced in principle, and the next hop carries the
+ * Cursor session cookie, so an off-origin redirect would disclose it. Resolving
+ * against the request URL also handles a relative Location, which bare
+ * `fetch(location)` would reject.
+ */
+function resolveCursorRedirect(location, baseUrl) {
+  let url;
+  try {
+    url = new URL(location, baseUrl);
+  } catch {
+    throw new Error("Cursor API redirect to an untrusted origin");
+  }
+  if (url.protocol !== "https:" || !CURSOR_REDIRECT_HOSTS.has(url.hostname)) {
+    throw new Error("Cursor API redirect to an untrusted origin");
+  }
+  return url.toString();
+}
+
 /**
  * Fetch full usage CSV from Cursor API.
  * Returns raw CSV string or throws on error.
  */
-function fetchCursorUsageCsv({ cookie, timeoutMs = 30000 }) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(CURSOR_CSV_URL);
-    const req = https.request(
-      {
-        hostname: url.hostname,
-        path: url.pathname + url.search,
-        method: "GET",
-        headers: {
-          Accept: "*/*",
-          Cookie: cookie,
-          Referer: "https://www.cursor.com/settings",
-          "User-Agent":
-            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
-        },
-        timeout: timeoutMs,
-      },
-      (res) => {
-        if (res.statusCode === 401 || res.statusCode === 403) {
-          res.resume();
-          return reject(new Error("Cursor session expired — re-login in Cursor to refresh"));
-        }
-        if (res.statusCode === 308 || res.statusCode === 301 || res.statusCode === 302) {
-          // Follow redirect once
-          const location = res.headers.location;
-          res.resume();
-          if (!location) return reject(new Error(`Cursor API redirect without Location header`));
-          return fetchUrlRaw({ urlStr: location, cookie, timeoutMs }).then(resolve, reject);
-        }
-        if (res.statusCode !== 200) {
-          res.resume();
-          return reject(new Error(`Cursor API returned ${res.statusCode}`));
-        }
-        let data = "";
-        res.on("data", (chunk) => {
-          data += chunk;
-        });
-        res.on("end", () => resolve(data));
-        res.on("error", reject);
-      },
-    );
-    req.on("error", reject);
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("Cursor API request timed out"));
-    });
-    req.end();
-  });
+function fetchCursorUsageCsv({ cookie, timeoutMs = 30000, fetchImpl = fetch }) {
+  return fetchImpl(CURSOR_CSV_URL, {
+    method: "GET",
+    headers: {
+      Accept: "*/*",
+      Cookie: cookie,
+      Referer: "https://www.cursor.com/settings",
+      "User-Agent":
+        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+    },
+    redirect: "manual",
+    signal: AbortSignal.timeout(timeoutMs),
+  }).then(async (res) => {
+    if (res.status === 401 || res.status === 403) {
+      throw new Error("Cursor session expired — re-login in Cursor to refresh");
+    }
+    if (res.status === 308 || res.status === 301 || res.status === 302) {
+      // Follow redirect once. Keep this hop on redirect:"manual" so the
+      // Location + Cookie are forwarded explicitly (cursor.com → www.cursor.com).
+      const location = res.headers.get("location");
+      if (!location) throw new Error("Cursor API redirect without Location header");
+      const target = resolveCursorRedirect(location, CURSOR_CSV_URL);
+      return fetchUrlRaw({ urlStr: target, cookie, timeoutMs, fetchImpl });
+    }
+    if (res.status !== 200) {
+      throw new Error(`Cursor API returned ${res.status}`);
+    }
+    return res.text();
+  }).catch(remapCursorFetchTimeout);
 }
 
 /**
@@ -220,43 +234,27 @@ function fetchCursorUsageSummary({ cookie, timeoutMs = 30000, fetchImpl = fetch
   });
 }
 
-function fetchUrlRaw({ urlStr, cookie, timeoutMs }) {
-  return new Promise((resolve, reject) => {
-    const url = new URL(urlStr);
-    const req = https.request(
-      {
-        hostname: url.hostname,
-        path: url.pathname + url.search,
-        method: "GET",
-        headers: {
-          Accept: "*/*",
-          Cookie: cookie,
-          Referer: "https://www.cursor.com/settings",
-          "User-Agent":
-            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
-        },
-        timeout: timeoutMs,
-      },
-      (res) => {
-        if (res.statusCode !== 200) {
-          res.resume();
-          return reject(new Error(`Cursor API returned ${res.statusCode} from ${urlStr}`));
-        }
-        let data = "";
-        res.on("data", (chunk) => {
-          data += chunk;
-        });
-        res.on("end", () => resolve(data));
-        res.on("error", reject);
-      },
-    );
-    req.on("error", reject);
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("Cursor API request timed out"));
-    });
-    req.end();
-  });
+function fetchUrlRaw({ urlStr, cookie, timeoutMs = 30000, fetchImpl = fetch }) {
+  return fetchImpl(urlStr, {
+    method: "GET",
+    headers: {
+      Accept: "*/*",
+      Cookie: cookie,
+      Referer: "https://www.cursor.com/settings",
+      "User-Agent":
+        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+    },
+    // Keep manual: the previous hop did not follow a second redirect.
+    // redirect:"follow" would turn a second 301/302/308 into a silent
+    // success and may drop the explicit Cookie on a cross-host hop.
+    redirect: "manual",
+    signal: AbortSignal.timeout(timeoutMs),
+  }).then(async (res) => {
+    if (res.status !== 200) {
+      throw new Error(`Cursor API returned ${res.status} from ${urlStr}`);
+    }
+    return res.text();
+  }).catch(remapCursorFetchTimeout);
 }
 
 // ── CSV parsing ──

package/src/lib/fs.js

@@ -10,8 +10,17 @@ async function writeFileAtomic(filePath, content) {
   const dir = path.dirname(filePath);
   await ensureDir(dir);
   const tmp = `${filePath}.tmp.${Date.now()}`;
-  await fs.writeFile(tmp, content, { encoding: "utf8" });
-  await fs.rename(tmp, filePath);
+  try {
+    await fs.writeFile(tmp, content, { encoding: "utf8" });
+    await fs.rename(tmp, filePath);
+  } catch (err) {
+    try {
+      await fs.unlink(tmp);
+    } catch {
+      /* tmp may not exist if writeFile failed before creating it */
+    }
+    throw err;
+  }
 }
 
 async function readJson(filePath) {

package/src/lib/local-api.js

@@ -2621,6 +2621,143 @@ function createLocalApiHandler({ queuePath }) {
       return true;
     }
 
+    // --- outbound proxy preference (manual / system / off) ---
+    // Persisted on config.json next to the queue. GET is unauthenticated so the
+    // settings page can probe availability; POST requires local-auth.
+    if (p === "/functions/tokentracker-proxy-config") {
+      const {
+        normalizeProxyConfig,
+        parseProxyPayload,
+      } = require("./proxy-settings");
+      const {
+        applyUndiciProxyIfNeeded,
+        getLastProxyApplyError,
+        resolveEffectiveProxySource,
+        invalidateSystemProxyCache,
+      } = require("./proxy-env");
+      const { writeFileAtomic, chmod600IfPossible } = require("./fs");
+      const configPath = path.join(path.dirname(qp), "config.json");
+      const readConfig = () => {
+        try {
+          const parsed = JSON.parse(fs.readFileSync(configPath, "utf8"));
+          return parsed && typeof parsed === "object" ? parsed : {};
+        } catch {
+          return {};
+        }
+      };
+      const writeConfig = async (next) => {
+        await writeFileAtomic(configPath, JSON.stringify(next, null, 2));
+        await chmod600IfPossible(configPath);
+      };
+      const toResponse = (configObj) => {
+        const normalized = normalizeProxyConfig(configObj?.proxy);
+        const effective = resolveEffectiveProxySource({
+          env: process.env,
+          proxyConfig: configObj?.proxy,
+        });
+        return {
+          mode: normalized.mode,
+          protocol: normalized.protocol,
+          host: normalized.host,
+          port: normalized.port,
+          effective: effective.source,
+          applyError: getLastProxyApplyError(),
+        };
+      };
+      const method = String(req.method || "GET").toUpperCase();
+      if (method === "GET") {
+        json(res, toResponse(readConfig()));
+        return true;
+      }
+      if (method === "POST" || method === "PUT") {
+        if (!isAuthorizedLocalMutation(req)) {
+          json(res, { ok: false, error: "Unauthorized" }, 401);
+          return true;
+        }
+        let body = {};
+        try {
+          body = await readJsonBody(req);
+        } catch {
+          json(res, { ok: false, error: "invalid JSON" }, 400);
+          return true;
+        }
+        const parsed = parseProxyPayload(body);
+        if (!parsed.ok) {
+          json(res, { ok: false, error: parsed.error }, 400);
+          return true;
+        }
+        const current = readConfig();
+        const prevProxy = current.proxy && typeof current.proxy === "object" && !Array.isArray(current.proxy)
+          ? current.proxy
+          : {};
+        current.proxy = {
+          ...prevProxy,
+          mode: parsed.value.mode,
+          protocol: parsed.value.protocol,
+          host: parsed.value.host,
+          port: parsed.value.port,
+        };
+        try {
+          await writeConfig(current);
+        } catch (error) {
+          json(res, { ok: false, error: error?.message || "failed to save proxy config" }, 500);
+          return true;
+        }
+        invalidateSystemProxyCache();
+        const applyResult = applyUndiciProxyIfNeeded({ proxyConfig: current.proxy });
+        json(res, {
+          ok: applyResult?.ok !== false,
+          unprotected: applyResult?.unprotected === true,
+          ...toResponse(current),
+        });
+        return true;
+      }
+      json(res, { error: "Method Not Allowed" }, 405);
+      return true;
+    }
+
+    if (p === "/functions/tokentracker-proxy-test") {
+      const { parseProxyPayload, buildProxyUrl } = require("./proxy-settings");
+      const { runProxyConnectivityTest } = require("./proxy-env");
+      if (String(req.method || "GET").toUpperCase() !== "POST") {
+        json(res, { error: "Method Not Allowed" }, 405);
+        return true;
+      }
+      if (!isAuthorizedLocalMutation(req)) {
+        json(res, { ok: false, error: "Unauthorized" }, 401);
+        return true;
+      }
+      let body = {};
+      try {
+        body = await readJsonBody(req);
+      } catch {
+        json(res, { ok: false, error: "invalid JSON" }, 400);
+        return true;
+      }
+      const parsed = parseProxyPayload({ ...body, mode: "manual" });
+      if (!parsed.ok) {
+        json(res, { ok: false, error: parsed.error }, 400);
+        return true;
+      }
+      const proxyUrl = buildProxyUrl({ ...parsed.value, mode: "manual" });
+      const configPath = path.join(path.dirname(qp), "config.json");
+      let config = {};
+      try {
+        config = JSON.parse(fs.readFileSync(configPath, "utf8")) || {};
+      } catch {
+        config = {};
+      }
+      const runtime = resolveRuntimeConfig({ config, env: process.env });
+      const targetUrl = runtime.dashboardUrl || runtime.baseUrl;
+      const result = await runProxyConnectivityTest({
+        proxyUrl,
+        targetUrl,
+        timeoutMs: 5000,
+      });
+      json(res, result);
+      return true;
+    }
+
     // --- telemetry preference (anonymous analytics opt-out mirror) ---
     // The dashboard's analytics init on localhost / native-app surfaces asks
     // this before sending anything, so TOKENTRACKER_NO_TELEMETRY /