tokentracker-cli 0.96.2 → 0.96.4

package/src/lib/usage-limits.js

@@ -11,7 +11,7 @@ const { promisify } = require("node:util");
 const {
   detectClaudeCodeCredentialsPresence,
   detectClaudeCodeSubscriptionDetails,
-  readClaudeCodeAccessToken,
+  readClaudeCodeOauthToken,
   readCodexAccessToken,
   readCodexAuthBundle,
 } = require("./subscriptions");
@@ -31,6 +31,7 @@ const { fetchGrokLimits } = require("./grok-limits");
 const { fetchZcodeLimits } = require("./zcode-limits");
 const { fetchOpencodeGoLimits } = require("./opencode-go-limits");
 const { fetchCommandcodeLimits } = require("./commandcode-limits");
+const { fetchDevinLimits } = require("./devin-limits");
 const { fetchQoderLimits, fetchQoderCnLimits } = require("./qoder-limits");
 const { fetchArkCodingPlanLimits } = require("./ark-coding-plan-limits");
 const { fetchArkAgentPlanLimits } = require("./ark-agent-plan-limits");
@@ -47,7 +48,15 @@ const execFileAsync = promisify(cp.execFile);
 // 2-minute in-memory cache. It also expires early at the earliest upcoming window
 // reset in the cached data (see cacheExpiresAtMs), floored so a provider reporting
 // a reset "right now" can't turn every poll into a full upstream round.
-let cache = { data: null, expiresAtMs: 0 };
+// Partitioned by the Devin opt-in selection so a request made while Devin is
+// off is never served (or joined onto) a response fetched while it was on.
+const cacheByDevinSelection = {
+  off: { data: null, expiresAtMs: 0 },
+  on: { data: null, expiresAtMs: 0 },
+};
+function devinSelectionKey(options) {
+  return options?.devinEnabled === true ? "on" : "off";
+}
 const CACHE_TTL_MS = 2 * 60 * 1000;
 // Must stay below the macOS app's post-reset re-fetch grace (10s in
 // DashboardViewModel.resetBoundaryGrace), or that targeted refresh would be
@@ -57,10 +66,10 @@ const DEFAULT_PROVIDER_TIMEOUT_MS = 15_000;
 const ANTIGRAVITY_LIMITS_CACHE_FILE = "usage-limits-cache.json";
 const ANTIGRAVITY_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 const ANTIGRAVITY_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
-// Public installed-app OAuth client used by Antigravity / agy (same id PokeTokenBar
-// and the agy binary embed). Not confidential — installed-app clients cannot keep a
-// secret. Used to refresh the on-disk Google token so quota can be read like
-// Claude/Codex without the IDE process running.
+// Same client id PokeTokenBar and the agy binary embed. This client requires a
+// client_secret; without it a refresh is rejected as 400 invalid_request, so
+// remote renewal is unavailable. After expiry, quota depends on a local
+// Antigravity/agy process or the user signing in again.
 const ANTIGRAVITY_OAUTH_CLIENT_ID = "1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com";
 const ANTIGRAVITY_OAUTH_TOKEN_URL = "https://oauth2.googleapis.com/token";
 const ANTIGRAVITY_LOAD_CODE_ASSIST_URL = "https://daily-cloudcode-pa.googleapis.com/v1internal:loadCodeAssist";
@@ -2574,22 +2583,44 @@ function resolveClaudeRateLimitPath({ home } = {}) {
   return path.join(home || os.homedir(), ".tokentracker", "tracker", CLAUDE_RATE_LIMIT_FILE);
 }
 
+function claudeTokenExpiryStamp(tokenExpiresAtMs) {
+  return Number.isFinite(tokenExpiresAtMs)
+    ? new Date(tokenExpiresAtMs).toISOString()
+    : null;
+}
+
 // Returns the cooldown expiry in ms if a 429 cooldown is still active, else null.
-function readClaudeRateLimitRetryAtMs({ home, nowMs = Date.now() } = {}) {
+// A cooldown armed for a previous access token must not outlive that token: after
+// the user refreshes the Claude Code login, forceRefresh still cannot punch through
+// this file, so a cooldown stamped with a different token expiry is discarded.
+// The token's own expiry identifies the credential without persisting anything
+// derived from the secret.
+function readClaudeRateLimitRetryAtMs({ home, nowMs = Date.now(), tokenExpiresAtMs } = {}) {
+  const cachePath = resolveClaudeRateLimitPath({ home });
   try {
-    const parsed = JSON.parse(fs.readFileSync(resolveClaudeRateLimitPath({ home }), "utf8"));
+    const parsed = JSON.parse(fs.readFileSync(cachePath, "utf8"));
     const retryAtMs = parseTimeMs(parsed?.retry_at);
-    if (retryAtMs !== null && retryAtMs > nowMs) return retryAtMs;
+    if (retryAtMs === null || retryAtMs <= nowMs) return null;
+    const stampedExpiry = typeof parsed.token_expires_at === "string"
+      ? parsed.token_expires_at
+      : null;
+    if (stampedExpiry && stampedExpiry !== claudeTokenExpiryStamp(tokenExpiresAtMs)) {
+      clearClaudeRateLimitCooldown({ home });
+      return null;
+    }
+    return retryAtMs;
   } catch (_error) {}
   return null;
 }
 
-function writeClaudeRateLimitCooldown(retryAfterSec, { home, nowMs = Date.now() } = {}) {
+function writeClaudeRateLimitCooldown(retryAfterSec, { home, nowMs = Date.now(), tokenExpiresAtMs } = {}) {
   const sec = Number.isFinite(retryAfterSec) && retryAfterSec > 0
     ? Math.min(retryAfterSec, CLAUDE_RATE_LIMIT_MAX_COOLDOWN_SEC)
     : CLAUDE_RATE_LIMIT_DEFAULT_COOLDOWN_SEC;
   const cachePath = resolveClaudeRateLimitPath({ home });
   const payload = { retry_at: new Date(nowMs + sec * 1000).toISOString() };
+  const expiryStamp = claudeTokenExpiryStamp(tokenExpiresAtMs);
+  if (expiryStamp) payload.token_expires_at = expiryStamp;
   try {
     fs.mkdirSync(path.dirname(cachePath), { recursive: true });
     const tmpPath = `${cachePath}.${process.pid}.tmp`;
@@ -3128,18 +3159,41 @@ function parseAntigravityCredentialPayload(raw) {
   };
 }
 
-function loadAntigravityCredentialsFromFiles({ home } = {}) {
+function isAntigravityCredentialFresh(creds, nowMs) {
+  return creds.expiryMs != null && creds.expiryMs > nowMs + ANTIGRAVITY_TOKEN_REFRESH_SKEW_MS;
+}
+
+function pickLatestAntigravityExpiry(candidates) {
+  let best = candidates[0];
+  for (let i = 1; i < candidates.length; i += 1) {
+    const expiry = candidates[i].expiryMs;
+    if (expiry != null && (best.expiryMs == null || expiry > best.expiryMs)) {
+      best = candidates[i];
+    }
+  }
+  return best;
+}
+
+function pickAntigravityCredentials(candidates, nowMs) {
+  if (candidates.length === 0) return null;
+  const fresh = candidates.filter((creds) => isAntigravityCredentialFresh(creds, nowMs));
+  if (fresh.length > 0) return pickLatestAntigravityExpiry(fresh);
+  const unknown = candidates.filter((creds) => creds.expiryMs == null);
+  if (unknown.length > 0) return unknown[0];
+  return pickLatestAntigravityExpiry(candidates);
+}
+
+function collectAntigravityFileCredentials({ home } = {}) {
+  const candidates = [];
   for (const credPath of listAntigravityCredentialPaths(home)) {
     try {
       const parsed = parseAntigravityCredentialPayload(fs.readFileSync(credPath, "utf8"));
-      if (parsed) {
-        return { ...parsed, source: "file", path: credPath };
-      }
+      if (parsed) candidates.push({ ...parsed, source: "file", path: credPath });
     } catch {
       // missing or unreadable
     }
   }
-  return null;
+  return candidates;
 }
 
 function readAntigravityKeychainRaw({ securityRunner, timeoutMs = 2000 } = {}) {
@@ -3170,14 +3224,18 @@ function readAntigravityKeychainRaw({ securityRunner, timeoutMs = 2000 } = {}) {
   }
 }
 
-function loadAntigravityCredentials({ home, platform = process.platform, securityRunner } = {}) {
-  const fromFile = loadAntigravityCredentialsFromFiles({ home });
-  if (fromFile) return fromFile;
-  if (platform !== "darwin" && typeof securityRunner !== "function") return null;
-  const raw = readAntigravityKeychainRaw({ securityRunner });
-  const parsed = parseAntigravityCredentialPayload(raw);
-  if (!parsed) return null;
-  return { ...parsed, source: "keychain", path: null };
+function loadAntigravityCredentials({
+  home,
+  platform = process.platform,
+  securityRunner,
+  nowMs = Date.now(),
+} = {}) {
+  const candidates = collectAntigravityFileCredentials({ home });
+  if (platform === "darwin" || typeof securityRunner === "function") {
+    const parsed = parseAntigravityCredentialPayload(readAntigravityKeychainRaw({ securityRunner }));
+    if (parsed) candidates.push({ ...parsed, source: "keychain", path: null });
+  }
+  return pickAntigravityCredentials(candidates, nowMs);
 }
 
 function persistAntigravityCredentials(creds, next, { nowMs = Date.now() } = {}) {
@@ -3317,9 +3375,12 @@ async function fetchAntigravityRemoteLimits({
   fetchImpl = fetch,
   nowMs = Date.now(),
   signal,
+  creds,
 } = {}) {
-  const creds = loadAntigravityCredentials({ home, platform, securityRunner });
-  if (!creds) return null;
+  const resolvedCreds = creds !== undefined
+    ? creds
+    : loadAntigravityCredentials({ home, platform, securityRunner, nowMs });
+  if (!resolvedCreds) return null;
 
   const loadWithToken = async (accessToken) => {
     const payload = await fetchAntigravityQuotaSummaryJson(fetchImpl, accessToken, signal);
@@ -3337,21 +3398,41 @@ async function fetchAntigravityRemoteLimits({
     };
   };
 
-  let accessToken = await resolveAntigravityAccessToken(creds, { fetchImpl, nowMs, signal });
+  let accessToken = await resolveAntigravityAccessToken(resolvedCreds, { fetchImpl, nowMs, signal });
   try {
     return await loadWithToken(accessToken);
   } catch (error) {
-    if (error?.code !== "AUTH_EXPIRED" || !creds.refreshToken) throw error;
-    accessToken = await resolveAntigravityAccessToken(creds, { fetchImpl, nowMs, forceRefresh: true, signal });
+    if (error?.code !== "AUTH_EXPIRED" || !resolvedCreds.refreshToken) throw error;
+    accessToken = await resolveAntigravityAccessToken(resolvedCreds, {
+      fetchImpl,
+      nowMs,
+      forceRefresh: true,
+      signal,
+    });
     return await loadWithToken(accessToken);
   }
 }
 
-function antigravityUnavailableResult({ home, nowMs, platform, securityRunner, remoteError } = {}) {
+function antigravityCredentialsNeedReauth(creds, { nowMs, remoteError } = {}) {
+  if (remoteError?.code === "AUTH_EXPIRED") return true;
+  return Boolean(
+    creds
+    && creds.expiryMs != null
+    && creds.expiryMs <= nowMs + ANTIGRAVITY_TOKEN_REFRESH_SKEW_MS,
+  );
+}
+
+function antigravityUnavailableResult({ home, nowMs, platform, securityRunner, remoteError, creds } = {}) {
   const cached = readAntigravityLimitsCache({ home, nowMs });
-  if (cached) return cached;
-  const creds = loadAntigravityCredentials({ home, platform, securityRunner });
-  if (!hasAntigravityInstallEvidence({ home }) && !creds) {
+  const resolvedCreds = creds !== undefined
+    ? creds
+    : loadAntigravityCredentials({ home, platform, securityRunner, nowMs });
+  if (cached) {
+    return antigravityCredentialsNeedReauth(resolvedCreds, { nowMs, remoteError })
+      ? { ...cached, auth_action_required: "reauth" }
+      : cached;
+  }
+  if (!hasAntigravityInstallEvidence({ home }) && !resolvedCreds) {
     return { configured: false };
   }
   if (remoteError) {
@@ -3361,7 +3442,7 @@ function antigravityUnavailableResult({ home, nowMs, platform, securityRunner, r
       : raw;
     return { configured: true, error: message };
   }
-  if (creds) {
+  if (resolvedCreds) {
     return { configured: true, error: ANTIGRAVITY_AUTH_EXPIRED_MESSAGE };
   }
   return { configured: true, error: ANTIGRAVITY_NOT_RUNNING_MESSAGE };
@@ -3390,6 +3471,7 @@ async function fetchAntigravityLimits({
   securityRunner,
   signal,
 } = {}) {
+  const creds = loadAntigravityCredentials({ home, platform, securityRunner, nowMs });
   const startedAtMs = performance.now();
   // min(this step's ceiling, budget left after reserving the fallback guard).
   // 0 means "no time left" — the caller must skip the call, not issue it.
@@ -3430,7 +3512,15 @@ async function fetchAntigravityLimits({
   if (remoteTimeoutMs > 0) {
     try {
       const remote = await withProviderTimeout(
-        fetchAntigravityRemoteLimits({ home, platform, securityRunner, fetchImpl, nowMs, signal }),
+        fetchAntigravityRemoteLimits({
+          home,
+          platform,
+          securityRunner,
+          fetchImpl,
+          nowMs,
+          signal,
+          creds,
+        }),
         "Antigravity",
         remoteTimeoutMs,
       );
@@ -3455,7 +3545,14 @@ async function fetchAntigravityLimits({
       signal,
     });
     if (!processInfo.configured) {
-      return antigravityUnavailableResult({ home, nowMs, platform, securityRunner, remoteError });
+      return antigravityUnavailableResult({
+        home,
+        nowMs,
+        platform,
+        securityRunner,
+        remoteError,
+        creds,
+      });
     }
     if (processInfo.error) {
       return { configured: true, error: processInfo.error };
@@ -3561,6 +3658,7 @@ async function fetchAntigravityLimits({
       platform,
       securityRunner,
       remoteError: remoteError || error,
+      creds,
     });
   }
 }
@@ -3597,7 +3695,7 @@ function withPlanLabel(obj, raw, brand) {
 // hammered). Survives an external resetUsageLimitsCache() (refresh=1 path in
 // local-api.js): a refresh arriving while a fetch is already running reuses that
 // in-flight fetch and returns its result.
-let inFlightFetch = null;
+const inFlightByDevinSelection = { off: null, on: null };
 
 // Codex stamps reset_at as unix seconds; every other provider (and Claude's
 // resets_at) uses ISO strings. Numbers that look like epoch milliseconds are
@@ -3635,17 +3733,19 @@ function cacheExpiresAtMs(data, fetchedAtMs) {
 }
 
 async function getUsageLimits(options = {}) {
+  const selection = devinSelectionKey(options);
+  const cache = cacheByDevinSelection[selection];
   const nowMs = Date.now();
   if (cache.data && nowMs < cache.expiresAtMs) {
     return cache.data;
   }
-  if (inFlightFetch) {
-    return inFlightFetch;
+  if (inFlightByDevinSelection[selection]) {
+    return inFlightByDevinSelection[selection];
   }
   const promise = fetchUsageLimitsUncached(options).finally(() => {
-    if (inFlightFetch === promise) inFlightFetch = null;
+    if (inFlightByDevinSelection[selection] === promise) inFlightByDevinSelection[selection] = null;
   });
-  inFlightFetch = promise;
+  inFlightByDevinSelection[selection] = promise;
   return promise;
 }
 
@@ -3660,14 +3760,17 @@ async function fetchUsageLimitsUncached({
   now = new Date(),
   providerTimeoutMs = DEFAULT_PROVIDER_TIMEOUT_MS,
   forceRefresh = false,
+  devinEnabled = false,
 } = {}) {
   const nowMs = Date.now();
 
-  const [claudeToken, claudeSubscription, codexAuth] = await Promise.all([
-    Promise.resolve().then(() => readClaudeCodeAccessToken({ platform, securityRunner, home })),
+  const [claudeOauth, claudeSubscription, codexAuth] = await Promise.all([
+    Promise.resolve().then(() => readClaudeCodeOauthToken({ platform, securityRunner, home, nowMs })),
     Promise.resolve().then(() => detectClaudeCodeSubscriptionDetails({ platform, securityRunner, home })),
     readCodexAuthBundle({ home, env }),
   ]);
+  const claudeToken = claudeOauth?.accessToken || null;
+  const claudeTokenExpiresAtMs = claudeOauth?.expiresAtMs ?? null;
   const claudePlanType = claudeSubscription?.planType || null;
 
   // Match the official Codex CLI: prefer the access token's JWT expiry and refresh only
@@ -3706,7 +3809,9 @@ async function fetchUsageLimitsUncached({
 
   // Skip the upstream Claude call entirely while a 429 cooldown is active — calling again
   // just renews the penalty. The result handling below serves cache or a cooldown message.
-  const claudeRetryAtMs = claudeToken ? readClaudeRateLimitRetryAtMs({ home, nowMs }) : null;
+  const claudeRetryAtMs = claudeToken
+    ? readClaudeRateLimitRetryAtMs({ home, nowMs, tokenExpiresAtMs: claudeTokenExpiresAtMs })
+    : null;
   // Also avoid cross-process hammering after a recent successful read: embedded-server
   // restarts and background polls read the disk cache instead of spending another Claude
   // OAuth usage request. An explicit user refresh (refresh=1 → forceRefresh) punches
@@ -3717,7 +3822,7 @@ async function fetchUsageLimitsUncached({
     : null;
 
   const providerFetch = withFetchTimeout(fetchImpl, providerTimeoutMs);
-  const [claudeResult, codexResult, cursor, kimi, gemini, kiro, antigravity, copilot, grok, zcode, opencodeGoRaw, qoder, qoderCn, codingPlan, agentPlan, commandCodeRaw, claudeServiceStatus] = await Promise.all([
+  const [claudeResult, codexResult, cursor, kimi, gemini, kiro, antigravity, copilot, grok, zcode, opencodeGoRaw, qoder, qoderCn, codingPlan, agentPlan, commandCodeRaw, devinRaw, claudeServiceStatus] = await Promise.all([
     claudeToken && !freshClaudeCache && !claudeRetryAtMs
       ? withProviderTimeout(fetchClaudeUsageLimits(claudeToken, { fetchImpl: providerFetch, maxAttempts: 1 }), "Claude", providerTimeoutMs).then(
           (value) => ({ status: "fulfilled", value }),
@@ -3831,6 +3936,16 @@ async function fetchUsageLimitsUncached({
         (value) => ({ status: "fulfilled", value }),
         (reason) => ({ status: "rejected", reason }),
       ),
+    // Devin (devin.ai): daily/weekly subscription quota from the official
+    // GetPlanStatus RPC, keyed by the session token the Devin CLI stores in
+    // ~/.local/share/devin/credentials.toml. No local fallback — window state
+    // lives server-side. fetchDevinLimits throws on auth expiry so the
+    // assemble step below can flag auth_action_required.
+    withProviderTimeout(fetchDevinLimits({ home, env, enabled: devinEnabled === true, fetchImpl: providerFetch }), "Devin", providerTimeoutMs)
+      .then(
+        (value) => ({ status: "fulfilled", value }),
+        (reason) => ({ status: "rejected", reason }),
+      ),
     // Public status-page probe (fail-soft, own 5-min cache in provider-status.js).
     // Only probed for configured accounts — without a token the Claude section
     // never renders, so the reading would have nowhere to go.
@@ -3878,13 +3993,21 @@ async function fetchUsageLimitsUncached({
     // surface an accurate "retry in ~Nm" message rather than the misleading hardcoded one.
     const reason = claudeResult?.reason;
     if (reason?.code === "RATE_LIMITED") {
-      writeClaudeRateLimitCooldown(reason.retryAfterSec, { home, nowMs });
+      writeClaudeRateLimitCooldown(reason.retryAfterSec, {
+        home,
+        nowMs,
+        tokenExpiresAtMs: claudeTokenExpiresAtMs,
+      });
     }
     const cached = readClaudeLimitsCache({ home, nowMs });
     if (cached) {
       claude = cached;
     } else {
-      const retryAtMs = readClaudeRateLimitRetryAtMs({ home, nowMs }) || claudeRetryAtMs;
+      const retryAtMs = readClaudeRateLimitRetryAtMs({
+        home,
+        nowMs,
+        tokenExpiresAtMs: claudeTokenExpiresAtMs,
+      }) || claudeRetryAtMs;
       claude = {
         configured: true,
         error: retryAtMs
@@ -3907,7 +4030,11 @@ async function fetchUsageLimitsUncached({
   // cool-down just armed by this cycle's 429 is included; a successful read above
   // cleared the file, so this is null in the happy path.
   if (claude.configured) {
-    const claudeCooldownMs = readClaudeRateLimitRetryAtMs({ home, nowMs });
+    const claudeCooldownMs = readClaudeRateLimitRetryAtMs({
+      home,
+      nowMs,
+      tokenExpiresAtMs: claudeTokenExpiresAtMs,
+    });
     if (claudeCooldownMs) {
       claude.retry_at = new Date(claudeCooldownMs).toISOString();
     }
@@ -4029,6 +4156,22 @@ async function fetchUsageLimitsUncached({
       : { configured: true, error: reason?.message || "Unknown error" };
   }
 
+  // Devin: server-owned quota windows like CommandCode — a fulfilled
+  // `configured: false` means no CLI credentials; a rejected fetch with
+  // AUTH_EXPIRED flags auth_action_required for the re-sign-in hint.
+  let devinObj;
+  if (devinRaw?.status === "fulfilled") {
+    const value = devinRaw.value;
+    devinObj = value && value.configured === false
+      ? value
+      : { ...value, stale: false, cached_at: new Date(nowMs).toISOString() };
+  } else {
+    const reason = devinRaw?.reason || null;
+    devinObj = reason?.code === "AUTH_EXPIRED"
+      ? { configured: true, error: reason?.message || "Unknown error", auth_action_required: "reauth" }
+      : { configured: true, error: reason?.message || "Unknown error" };
+  }
+
   const data = {
     fetched_at: new Date(nowMs).toISOString(),
     claude: withPlanLabel(claude, claudePlanType, "Claude"),
@@ -4050,6 +4193,9 @@ async function fetchUsageLimitsUncached({
     // maps plan ids to the CLI's exact display strings, so skip the shared
     // Title-Case normalization ("Goat") and surface them as-is.
     commandCode: commandCodeObj,
+    // Devin's planName ("Pro", "Max") is already the official display name —
+    // Title-Case normalization is still harmless and strips any brand prefix.
+    devin: withPlanLabel(devinObj, devinObj?.plan_label, "Devin"),
     qoder: withPlanLabel(qoder, qoder?.plan_label, "Qoder"),
     qoderCn: withPlanLabel(qoderCn, qoderCn?.plan_label, "Qoder CN"),
     codingPlan: withPlanLabel(codingPlan, codingPlan?.plan_label, "Ark Coding Plan"),
@@ -4077,12 +4223,16 @@ async function fetchUsageLimitsUncached({
     };
   }
 
-  cache = { data, expiresAtMs: cacheExpiresAtMs(data, nowMs) };
+  cacheByDevinSelection[devinSelectionKey({ devinEnabled })] = {
+    data,
+    expiresAtMs: cacheExpiresAtMs(data, nowMs),
+  };
   return data;
 }
 
 function resetUsageLimitsCache() {
-  cache = { data: null, expiresAtMs: 0 };
+  cacheByDevinSelection.off = { data: null, expiresAtMs: 0 };
+  cacheByDevinSelection.on = { data: null, expiresAtMs: 0 };
 }
 
 module.exports = {