tokentracker-cli 0.94.1 → 0.95.1

package/src/lib/cloud-account.js

@@ -73,8 +73,27 @@ function decodeJwtExpMs(token) {
 // The popover polls frequently, so caching avoids hammering /api/auth/refresh.
 let tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
 
+// In-flight refresh de-duplication ("single flight"), keyed the same way as
+// `tokenCache`. A full popover refresh fires six account reads concurrently; on
+// a cold cache every one of them used to POST /api/auth/refresh with the SAME
+// refresh token. When the backend rotates refresh tokens, the losers of that
+// race present an already-consumed token and fail — which is exactly the
+// intermittent "Activity silently dropped to this-machine data" symptom.
+const mintInflight = new Map();
+
 function __resetCloudAccountCacheForTests() {
   tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
+  mintInflight.clear();
+}
+
+// Failure classes surfaced to local-api so it can tell an intentional local
+// view ("signed out", "cloud sync off") apart from a temporary cloud outage.
+class AccountAuthError extends Error {
+  constructor(code, message) {
+    super(message || code);
+    this.name = "AccountAuthError";
+    this.code = code;
+  }
 }
 
 function csrfTokenFromRefreshPayload(data) {
@@ -87,30 +106,11 @@ function csrfTokenFromRefreshPayload(data) {
 }
 
 /**
- * Mint (or reuse a cached) InsForge access token from a refresh token.
- * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null}|null>}
- *   null when no refresh token is available or the refresh failed.
+ * Perform the actual refresh POST. Throws a classified `AccountAuthError` on
+ * every failure so callers can distinguish a transient outage (timeout,
+ * offline, rotated-token rejection) from an intentionally local view.
  */
-async function mintAccessToken({
-  baseUrl,
-  anonKey,
-  refreshToken,
-  fetchImpl = fetch,
-  now = Date.now,
-  skewMs = 60_000,
-  timeoutMs,
-} = {}) {
-  if (!refreshToken) return null;
-  const root = String(baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
-  const cacheKey = `${root}\0${refreshToken}`;
-  if (
-    tokenCache.cacheKey === cacheKey &&
-    tokenCache.accessToken &&
-    tokenCache.expMs - skewMs > now()
-  ) {
-    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null };
-  }
-
+async function performMint({ root, cacheKey, anonKey, refreshToken, fetchImpl, now, timeoutMs }) {
   const headers = { "Content-Type": "application/json", Accept: "application/json" };
   if (anonKey) headers.apikey = anonKey;
 
@@ -132,24 +132,37 @@ async function mintAccessToken({
       body: JSON.stringify({ refresh_token: refreshToken }),
       signal,
     });
-  } catch {
-    return null;
+  } catch (e) {
+    const aborted = e && (e.name === "AbortError" || e.name === "TimeoutError");
+    throw new AccountAuthError(
+      aborted ? "auth_timeout" : "auth_network",
+      e?.message || "token refresh failed",
+    );
   } finally {
     if (timeoutId) {
       clearTimeout(timeoutId);
     }
   }
-  if (!res || !res.ok) return null;
+  if (!res || !res.ok) {
+    const err = new AccountAuthError(
+      "auth_rejected",
+      `token refresh failed with HTTP ${res ? res.status : "?"}`,
+    );
+    err.status = res ? res.status : 0;
+    throw err;
+  }
 
   let data = null;
   try {
     data = await res.json();
-  } catch {
-    return null;
+  } catch (e) {
+    throw new AccountAuthError("auth_invalid", e?.message || "token refresh returned invalid JSON");
   }
 
   const accessToken = accessTokenFromRefreshPayload(data);
-  if (!accessToken) return null;
+  if (!accessToken) {
+    throw new AccountAuthError("auth_invalid", "token refresh returned no access token");
+  }
 
   const expMs = decodeJwtExpMs(accessToken) || now() + 10 * 60_000;
   tokenCache = { cacheKey, accessToken, expMs };
@@ -166,6 +179,60 @@ async function mintAccessToken({
   };
 }
 
+/**
+ * Mint (or reuse a cached) InsForge access token from a refresh token.
+ *
+ * Concurrent callers with the same (baseUrl, refreshToken) share ONE in-flight
+ * refresh; see `mintInflight`.
+ *
+ * @param {boolean} [throwOnFailure] when true, reject with a classified
+ *   `AccountAuthError` instead of resolving to `null`.
+ * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null}|null>}
+ *   null when no refresh token is available or the refresh failed.
+ */
+async function mintAccessToken({
+  baseUrl,
+  anonKey,
+  refreshToken,
+  fetchImpl = fetch,
+  now = Date.now,
+  skewMs = 60_000,
+  timeoutMs,
+  throwOnFailure = false,
+} = {}) {
+  if (!refreshToken) {
+    if (throwOnFailure) throw new AccountAuthError("auth_missing_refresh_token", "not signed in");
+    return null;
+  }
+  const root = String(baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
+  const cacheKey = `${root}\0${refreshToken}`;
+  if (
+    tokenCache.cacheKey === cacheKey &&
+    tokenCache.accessToken &&
+    tokenCache.expMs - skewMs > now()
+  ) {
+    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null };
+  }
+
+  let inflight = mintInflight.get(cacheKey);
+  if (!inflight) {
+    inflight = performMint({ root, cacheKey, anonKey, refreshToken, fetchImpl, now, timeoutMs })
+      .finally(() => {
+        // Only clear our own entry: a later caller may already have started a
+        // fresh mint after this one settled.
+        if (mintInflight.get(cacheKey) === inflight) mintInflight.delete(cacheKey);
+      });
+    mintInflight.set(cacheKey, inflight);
+  }
+
+  try {
+    return await inflight;
+  } catch (e) {
+    if (throwOnFailure) throw e;
+    return null;
+  }
+}
+
 /**
  * GET a `tokentracker-account-*` edge function, forwarding the popover's query
  * params (minus `account`/`scope`, which are local-only routing knobs).
@@ -237,6 +304,7 @@ async function fetchAccountUsage({
 } = {}) {
   const slug = accountSlugFor(usageSlug);
   if (!slug) return null;
+  if (!refreshToken) return null;
 
   const startTime = now();
   const getRemainingTimeout = () => {
@@ -246,6 +314,9 @@ async function fetchAccountUsage({
     return remaining > 0 ? remaining : 1;
   };
 
+  // `throwOnFailure` keeps "not signed in" (null, handled above) distinct from
+  // "signed in but the refresh call failed" (throws) so the caller does not
+  // silently downgrade an account view into a this-machine view.
   const minted = await mintAccessToken({
     baseUrl,
     anonKey,
@@ -253,6 +324,7 @@ async function fetchAccountUsage({
     fetchImpl,
     now,
     timeoutMs: getRemainingTimeout(),
+    throwOnFailure: true,
   });
   if (!minted) return null;
 
@@ -269,6 +341,7 @@ async function fetchAccountUsage({
 }
 
 module.exports = {
+  AccountAuthError,
   USAGE_TO_ACCOUNT_SLUG,
   accountSlugFor,
   accessTokenFromRefreshPayload,

package/src/lib/fs.js

@@ -413,6 +413,35 @@ async function openLock(
   }
 }
 
+async function updateJsonLocked(
+  filePath,
+  update,
+  { timeoutMs = 30_000, retryMs = 10 } = {},
+) {
+  const lockPath = `${filePath}.lock`;
+  const deadline = Date.now() + timeoutMs;
+  let lock = null;
+  while (!lock) {
+    lock = await openLock(lockPath, { quietIfLocked: true });
+    if (lock) break;
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting to update JSON file: ${filePath}`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, retryMs));
+  }
+
+  try {
+    const current = (await readJson(filePath)) || {};
+    const next = await update(current);
+    if (next == null) return current;
+    await writeJson(filePath, next);
+    await chmod600IfPossible(filePath);
+    return next;
+  } finally {
+    await lock.release();
+  }
+}
+
 module.exports = {
   ensureDir,
   writeFileAtomic,
@@ -422,4 +451,5 @@ module.exports = {
   chmod600IfPossible,
   openLock,
   inspectLock,
+  updateJsonLocked,
 };

package/src/lib/local-api.js

@@ -14,6 +14,11 @@ const { accountSlugFor, fetchAccountUsage, mintAccessToken } = require("./cloud-
 const { getOrCreateMachineId, computeStableMachineId } = require("./machine-id");
 
 const SYNC_TIMEOUT_MS = 120_000;
+// A failed account-view request should not stall every dashboard refresh
+// while an expired session or unreachable backend keeps timing out. The first
+// request still falls back normally; subsequent fan-out requests reuse that
+// decision for a short cooldown and return local data immediately.
+const ACCOUNT_VIEW_FAILURE_BACKOFF_MS = 2 * 60_000;
 const TRACKER_BIN = path.resolve(__dirname, "../../bin/tracker.js");
 const MAX_DEVICE_NAME_LENGTH = 128;
 
@@ -219,8 +224,12 @@ function normalizeQueueRow(row) {
   // non-zero billable usage (GitHub issue #106). Treat billing and usage as
   // orthogonal: bump billable up to total_tokens at read time so historical
   // queue.jsonl entries render correctly without requiring a file rewrite.
+  // Antigravity had the same symptom from e69e2746a (billable deleted during
+  // the O(N) refactoring, leaving 167 local rows with billable=0 until the
+  // parser fix). Apply the same read-time healing so upgraded installs show
+  // correct heatmap / rolling numbers without a queue rewrite.
   const sourceName = String(normalized.source || "").toLowerCase();
-  if (sourceName === "cursor") {
+  if (sourceName === "cursor" || sourceName === "antigravity") {
     const totalTokens = Number(normalized.total_tokens || 0);
     const billable = Number(normalized.billable_total_tokens || 0);
     if (totalTokens > 0 && billable < totalTokens) {
@@ -1135,6 +1144,30 @@ function createLocalApiHandler({ queuePath }) {
   const cookiePath = path.join(trackerDataDir, "relay-cookies.json");
   const localSyncDeviceTokenCache = new Map();
   const localSyncDeviceTokenInflight = new Map();
+  // A dashboard refresh fans out to several account-view endpoints. Keep the
+  // circuit-breaker state per session instead of one global slot (a successful
+  // request for one account must not clear another account's failure), and
+  // suppress the duplicate fan-out while the first cloud probe is pending.
+  const accountViewFailures = new Map();
+  const accountViewInFlight = new Set();
+
+  function accountViewFailureUntil(failureKey) {
+    const until = accountViewFailures.get(failureKey) || 0;
+    if (until > Date.now()) return until;
+    if (until) accountViewFailures.delete(failureKey);
+    return 0;
+  }
+
+  function rememberAccountViewFailure(failureKey) {
+    accountViewFailures.set(failureKey, Date.now() + ACCOUNT_VIEW_FAILURE_BACKOFF_MS);
+    // Refresh-token rotation or account switching can produce many keys over a
+    // long-lived tray session. Bound the map without affecting the active key.
+    while (accountViewFailures.size > 16) {
+      const oldest = accountViewFailures.keys().next().value;
+      if (!oldest || oldest === failureKey) break;
+      accountViewFailures.delete(oldest);
+    }
+  }
 
   // Load persisted cookies on startup
   try {
@@ -1399,15 +1432,52 @@ function createLocalApiHandler({ queuePath }) {
     }
   }
 
-  // Returns "served" when the cross-device aggregate was written to `res`, or
-  // "fallthrough" when the caller should serve the local single-machine data.
-  // Any failure (not signed in, cloud sync off, network/auth error) falls
-  // through so the popover always renders something.
+  // Why a *classified* fallback: the native popover keeps the last successful
+  // account (cross-device) snapshot on screen when a cloud read fails
+  // transiently, but must switch to this-machine data the moment the user signs
+  // out or turns cloud sync off. Both used to look identical from the outside
+  // (HTTP 200 + local payload + `X-TokenTracker-Account-View: 0`), so a single
+  // timed-out read silently shrank Activity to one device until the next
+  // manual sync. See ACCOUNT_FALLBACK_* below for the vocabulary.
+  const ACCOUNT_FALLBACK_CLOUD_SYNC_OFF = "cloud-sync-off";
+  const ACCOUNT_FALLBACK_SIGNED_OUT = "signed-out";
+
+  // Every transient reason is prefixed "transient-"; clients only need the
+  // prefix, so new reasons can be added without a client change.
+  function classifyAccountFallback(err) {
+    if (!err) return "transient-error";
+    if (err.name === "AbortError" || err.name === "TimeoutError" || err.code === "auth_timeout") {
+      return "transient-timeout";
+    }
+    if (err.code === "auth_rejected" || err.code === "auth_invalid" || err.status === 401 || err.status === 403) {
+      return "transient-auth";
+    }
+    if (err.code === "auth_network") return "transient-network";
+    if (Number.isFinite(err.status) && err.status > 0) return "transient-upstream";
+    return "transient-network";
+  }
+
+  // Returns "served" when the cross-device aggregate was written to `res`,
+  // otherwise a fallback reason (see above) telling the caller — and, through
+  // the `X-TokenTracker-Account-Fallback` header, the popover — why the local
+  // single-machine data is being served instead.
   async function tryServeAccountView(usageSlug, url, res) {
-    if (!getCloudSyncPref()) return "fallthrough";
+    if (!getCloudSyncPref()) return ACCOUNT_FALLBACK_CLOUD_SYNC_OFF;
     const refreshToken = getRefreshTokenForCloud();
-    if (!refreshToken) return "fallthrough";
+    if (!refreshToken) return ACCOUNT_FALLBACK_SIGNED_OUT;
     const runtime = resolveRuntimeConfig();
+    const failureKey = `${runtime.baseUrl}\0${refreshToken}`;
+    const requestKey = `${failureKey}\0${usageSlug}\0${url.searchParams.toString()}`;
+    if (accountViewFailureUntil(failureKey) > Date.now()) {
+      return "transient-backoff";
+    }
+    // Six native dashboard requests normally arrive together. If the cloud is
+    // already being probed for this session, let the remaining requests use
+    // their local fallback instead of opening more timeout-bound sockets.
+    if (accountViewInFlight.has(requestKey)) {
+      return "transient-inflight";
+    }
+    accountViewInFlight.add(requestKey);
     const envTimeout = process.env.TOKENTRACKER_HTTP_TIMEOUT_MS
       ? parseInt(process.env.TOKENTRACKER_HTTP_TIMEOUT_MS, 10)
       : 0;
@@ -1421,9 +1491,16 @@ function createLocalApiHandler({ queuePath }) {
         refreshToken,
         timeoutMs,
       });
-      if (!out || out.data == null) return "fallthrough";
+      // `null` here means the slug has no cloud equivalent, or the session
+      // vanished mid-request — a routing/session fact, not an outage.
+      if (!out) return ACCOUNT_FALLBACK_SIGNED_OUT;
+      if (out.data == null) {
+        rememberAccountViewFailure(failureKey);
+        return "transient-upstream";
+      }
       if (out.rotatedRefreshToken) setRelayRefreshToken(out.rotatedRefreshToken);
       if (out.rotatedCsrfToken) setRelayCsrfToken(out.rotatedCsrfToken);
+      accountViewFailures.delete(failureKey);
       res.writeHead(200, {
         "Content-Type": "application/json",
         "Cache-Control": "no-store",
@@ -1433,11 +1510,17 @@ function createLocalApiHandler({ queuePath }) {
       return "served";
     } catch (e) {
       // Signed in + cloud sync on, but the cloud read failed (offline, token
-      // rejected, edge error, or timeout). Fall back to local data rather than erroring.
+      // rejected, edge error, or timeout). Serve local data rather than
+      // erroring, but say so: this is a *temporary* downgrade and the client
+      // must not treat it as the user's real data scope.
+      const reason = classifyAccountFallback(e);
       if (resolveRuntimeConfig().debug) {
-        console.warn(`[LocalAPI] account view fallback for ${usageSlug}:`, e?.message || e);
+        console.warn(`[LocalAPI] account view fallback (${reason}) for ${usageSlug}:`, e?.message || e);
       }
-      return "fallthrough";
+      rememberAccountViewFailure(failureKey);
+      return reason;
+    } finally {
+      accountViewInFlight.delete(requestKey);
     }
   }
 
@@ -2006,14 +2089,17 @@ function createLocalApiHandler({ queuePath }) {
     // --- account (cross-device) view proxy for the native popover ---
     // When ?account=1 and the user is signed in with cloud sync on, serve the
     // same cross-device aggregate the dashboard shows; otherwise tag the
-    // response (X-TokenTracker-Account-View: 0) so the popover knows it got
-    // local single-machine data, and fall through to the local handler below.
+    // response (X-TokenTracker-Account-View: 0 plus an
+    // X-TokenTracker-Account-Fallback reason) so the popover knows it got local
+    // single-machine data and whether that is permanent (signed out / cloud
+    // sync off) or transient, and fall through to the local handler below.
     if (url.searchParams.get("account") === "1") {
       const usageSlug = p.startsWith("/functions/") ? p.slice("/functions/".length) : "";
       if (accountSlugFor(usageSlug)) {
         const result = await tryServeAccountView(usageSlug, url, res);
         if (result === "served") return true;
         res.setHeader("X-TokenTracker-Account-View", "0");
+        res.setHeader("X-TokenTracker-Account-Fallback", result);
       }
     }
 

package/src/lib/pricing/index.js

@@ -21,6 +21,10 @@ const PI_SUBSCRIPTION_SOURCES = new Set([
   "prime-agent-github-copilot",
   "prime-agent-copilot",
 ]);
+// LM Studio's server logs describe inference served by the local developer
+// server (including LM Link). Secure Cloud usage has a separate billing path
+// and is not present in these logs.
+const LOCAL_INFERENCE_SOURCES = new Set(["lmstudio"]);
 const SOURCES_WITH_AUTHORITATIVE_COST = new Set(["grok"]);
 const SEED_SNAPSHOT_PATH = path.resolve(__dirname, "seed-snapshot.json");
 const DEEPSEEK_TIME_PRICED_MODELS = [
@@ -169,6 +173,7 @@ function getRowPricing(row) {
 // computeRowCost in src/lib/local-api.js. Moved here so vite mock + local
 // server share one source of truth.
 function computeRowCost(row) {
+  if (LOCAL_INFERENCE_SOURCES.has(String(row?.source || "").toLowerCase())) return 0;
   // Pi can route a turn through a subscription-backed Copilot provider. Pi's
   // usage record reports a zero marginal cost for those turns; do not
   // reinterpret the Claude model name as an Anthropic API bill.

package/src/lib/pricing/matcher.js

@@ -164,6 +164,20 @@ function normalizeWorkbuddyModel(model) {
   return model;
 }
 
+// Unsloth Studio can mix local engines and paid API providers in one database.
+// The parser qualifies metered models with their provider and marks local,
+// subscription-backed, or ambiguous custom routes as unpriced. Returning a
+// sentinel here prevents the generic reverse-substring matcher from mistaking
+// a locally hosted model name for the similarly named cloud SKU.
+function normalizeUnslothModel(model) {
+  if (typeof model !== "string") return model;
+  const lower = model.trim().toLowerCase();
+  if (lower.startsWith("local/") || lower.startsWith("unpriced/")) {
+    return "__tokentracker_unpriced_unsloth_model__";
+  }
+  return model;
+}
+
 // Per-source model-name normalizers, applied at pricing-lookup time only (the
 // raw model name is preserved for storage/display). Add a source here when its
 // model strings don't match the LiteLLM/curated keys verbatim.
@@ -174,6 +188,7 @@ const SOURCE_MODEL_NORMALIZERS = {
   "pi-anthropic": normalizeClaudeModel,
   "prime-agent-anthropic": normalizeClaudeModel,
   zed: normalizeZedModel,
+  unsloth: normalizeUnslothModel,
   workbuddy: normalizeWorkbuddyModel,
 };