tokentracker-cli 0.97.1 → 0.98.0

package/src/lib/cloud-account.js

@@ -68,6 +68,23 @@ function decodeJwtExpMs(token) {
   return 0;
 }
 
+// The account id the access token was minted for. Used to key the payload cache
+// below on something the backend does NOT rotate: the refresh token changes
+// under us on rotation, which would throw away a still-warm cache entry on
+// exactly the reads that repeat most.
+function decodeJwtSub(token) {
+  try {
+    const part = String(token || "").split(".")[1];
+    if (!part) return "";
+    const json = Buffer.from(part.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8");
+    const payload = JSON.parse(json);
+    if (payload && typeof payload.sub === "string") return payload.sub;
+  } catch {
+    /* ignore */
+  }
+  return "";
+}
+
 // Module-level access-token cache, keyed by the cloud base URL and refresh token
 // that produced it.
 // The popover polls frequently, so caching avoids hammering /api/auth/refresh.
@@ -81,9 +98,78 @@ let tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
 // intermittent "Activity silently dropped to this-machine data" symptom.
 const mintInflight = new Map();
 
+// Response cache for the account reads, mirroring the 30-second window the edge
+// functions already keep.
+//
+// Each `tokentracker-account-*` function caches the RPC snapshot it renders
+// from for 30 seconds (`COMPACT_TTL_MS` in dashboard/edge-patches/*), so two
+// reads inside one window render the same numbers from the same snapshot. That
+// cache only saves the edge-to-PostgREST hop, though: the full body still goes
+// out to every caller. And the callers repeat a lot — the Windows tray poller
+// re-reads the 52-week heatmap every ~49 seconds, and one popover refresh fans
+// out six reads at once. Holding the payload here for the same 30 seconds
+// returns exactly what the cloud would have returned, without paying for the
+// transfer again.
+//
+// Bodies are stored serialized and re-parsed on a hit so a caller mutating the
+// object it got back cannot corrupt what the next caller reads.
+const PAYLOAD_TTL_MS = 30_000;
+const PAYLOAD_CACHE_MAX = 64;
+const payloadCache = new Map();
+
+// Mirrors the params `fetchAccountFunction` actually puts on the wire, so two
+// requests share an entry only when they would have produced the same URL.
+function payloadCacheKey({ root, sub, slug, searchParams }) {
+  const pairs = [];
+  if (searchParams && typeof searchParams.entries === "function") {
+    for (const [key, value] of searchParams.entries()) {
+      if (key === "account" || key === "scope") continue;
+      if (value == null || value === "") continue;
+      pairs.push(`${key}=${String(value)}`);
+    }
+  }
+  pairs.sort();
+  return `${root}\0${sub}\0${slug}\0${pairs.join("&")}`;
+}
+
+function payloadCacheGet(key, now) {
+  const hit = payloadCache.get(key);
+  if (!hit) return null;
+  if (hit.expMs <= now()) {
+    payloadCache.delete(key);
+    return null;
+  }
+  // Re-insert so the eviction below drops the coldest entry, not this one.
+  payloadCache.delete(key);
+  payloadCache.set(key, hit);
+  try {
+    return JSON.parse(hit.body);
+  } catch {
+    payloadCache.delete(key);
+    return null;
+  }
+}
+
+function payloadCacheSet(key, data, now) {
+  let body;
+  try {
+    body = JSON.stringify(data);
+  } catch {
+    return; // Not serializable: skip the cache rather than fail the read.
+  }
+  if (body === undefined) return;
+  payloadCache.set(key, { expMs: now() + PAYLOAD_TTL_MS, body });
+  while (payloadCache.size > PAYLOAD_CACHE_MAX) {
+    const oldest = payloadCache.keys().next();
+    if (oldest.done) break;
+    payloadCache.delete(oldest.value);
+  }
+}
+
 function __resetCloudAccountCacheForTests() {
   tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
   mintInflight.clear();
+  payloadCache.clear();
 }
 
 // Failure classes surfaced to local-api so it can tell an intentional local
@@ -328,6 +414,25 @@ async function fetchAccountUsage({
   });
   if (!minted) return null;
 
+  // Keyed after the mint so rotation cannot invalidate the entry, and so a
+  // revoked session fails here rather than being served from cache.
+  const sub = decodeJwtSub(minted.accessToken);
+  const cacheKey = sub
+    ? payloadCacheKey({ root: String(baseUrl || DEFAULT_BASE_URL).replace(/\/$/, ""), sub, slug, searchParams })
+    : null;
+  if (cacheKey) {
+    const cached = payloadCacheGet(cacheKey, now);
+    if (cached !== null) {
+      // Still surface a rotation from this mint: dropping it would leave the
+      // caller relaying a refresh token the backend has already consumed.
+      return {
+        data: cached,
+        rotatedRefreshToken: minted.refreshToken,
+        rotatedCsrfToken: minted.csrfToken,
+      };
+    }
+  }
+
   const data = await fetchAccountFunction({
     baseUrl,
     anonKey,
@@ -337,16 +442,19 @@ async function fetchAccountUsage({
     fetchImpl,
     timeoutMs: getRemainingTimeout(),
   });
+  if (cacheKey && data != null) payloadCacheSet(cacheKey, data, now);
   return { data, rotatedRefreshToken: minted.refreshToken, rotatedCsrfToken: minted.csrfToken };
 }
 
 module.exports = {
   AccountAuthError,
   USAGE_TO_ACCOUNT_SLUG,
+  PAYLOAD_TTL_MS,
   accountSlugFor,
   accessTokenFromRefreshPayload,
   refreshTokenFromRefreshPayload,
   decodeJwtExpMs,
+  decodeJwtSub,
   mintAccessToken,
   fetchAccountFunction,
   fetchAccountUsage,

package/src/lib/grok-limits.js

@@ -495,6 +495,40 @@ async function resolveGrokAccessToken({
   };
 }
 
+// xAI reports the subscription as a human-readable product name on the billing
+// payload's top level (`subscriptionTier`, a sibling of `config`, not a member
+// of it) -- a Free account reads exactly "Free".
+const GROK_PLAN_TIERS = new Map([
+  ["supergrokheavy", "SuperGrok Heavy"],
+  ["supergrokplus", "SuperGrok Plus"],
+  ["supergroklite", "SuperGrok Lite"],
+  ["supergrok", "SuperGrok"],
+  ["xpremiumplus", "X Premium+"],
+  ["premiumplus", "X Premium+"],
+  ["xpremium", "X Premium+"],
+  ["apikey", "API Key"],
+  ["free", "Free"],
+]);
+
+/**
+ * Map xAI's subscription tier to the name its own UI shows.
+ *
+ * Separators are folded away before matching so the same table covers whichever
+ * casing the API returns ("SuperGrok Heavy", "SUPER_GROK_HEAVY", "superGrokHeavy").
+ * Unknown values return null rather than being passed through: the Limits panel
+ * falls back to the bare brand name, which is better than rendering a raw enum
+ * (issue #130 shipped "Kimi Type_event" that way).
+ */
+function deriveGrokPlanLabel(rawTier) {
+  if (rawTier == null) return null;
+  const key = String(rawTier).toLowerCase().replace(/[^a-z0-9]+/g, "");
+  if (!key) return null;
+  // Exact match only. Prefix matching would read an unseen tier such as
+  // "SuperGrok Business" as plain "SuperGrok", and a confidently wrong plan on
+  // the card is worse than no plan at all.
+  return GROK_PLAN_TIERS.get(key) ?? null;
+}
+
 /**
  * Parse either:
  *   - Unified billing (`?format=credits`): weekly/monthly period + creditUsagePercent
@@ -567,6 +601,8 @@ function normalizeGrokBillingResponse(body) {
   }
 
   return {
+    // Read from the response root, not from `config`.
+    plan_label: deriveGrokPlanLabel(body?.subscriptionTier),
     period_type: periodType,
     monthly_credits_limit: monthlyLimit,
     monthly_credits_used: used,
@@ -721,6 +757,7 @@ module.exports = {
   normalizeGrokPeriodType,
   inferGrokPeriodTypeFromDates,
   sumProductUsagePercent,
+  deriveGrokPlanLabel,
   normalizeGrokBillingResponse,
   fetchGrokBilling,
   fetchGrokLimits,

package/src/lib/opencode-config.js

@@ -26,7 +26,7 @@ function buildOpencodePlugin({ notifyPath }) {
   return (
     `// ${PLUGIN_MARKER}\n` +
     `const notifyPath = ${JSON.stringify(safeNotifyPath)};\n` +
-    `export const TokenTrackerPlugin = async ({ $ }) => {\n` +
+    `const server = async ({ $ }) => {\n` +
     `  return {\n` +
     `    event: async ({ event }) => {\n` +
     `      if (!event || event.type !== ${JSON.stringify(DEFAULT_EVENT)}) return;\n` +
@@ -40,6 +40,25 @@ function buildOpencodePlugin({ notifyPath }) {
     `      } catch (_) {}\n` +
     `    }\n` +
     `  };\n` +
+    `};\n` +
+    // Three loaders read this one file (issue #646):
+    //   * older opencode v1 takes the named export;
+    //   * current v1 (verified on 1.18.30) requires a default export carrying
+    //     `id` and `server()`, and rejects the file outright without them;
+    //   * v2 requires a default export carrying `id` and `setup()`/`effect()`,
+    //     and ignores `server()`.
+    // Emitting all three keeps a single generated file valid everywhere. v2's
+    // plugin context exposes no event stream and no shell (`@opencode-ai/plugin`
+    // v2 PluginContext is agent/aisdk/catalog/command/integration/reference/skill
+    // only), so there is nothing for `setup` to subscribe to -- it exists to make
+    // the plugin load instead of erroring on every startup. Usage itself does not
+    // depend on this hook: opencode rows are parsed from the on-disk storage and
+    // opencode.db, and the hook only makes a sync happen sooner.
+    `export const TokenTrackerPlugin = server;\n` +
+    `export default {\n` +
+    `  id: "tokentracker",\n` +
+    `  server,\n` +
+    `  setup: async () => {},\n` +
     `};\n`
   );
 }

package/src/lib/pricing/curated-overrides.json

@@ -159,6 +159,20 @@
       "cache_read": 0.014,
       "cache_write": 0.44
     },
+    "deepseek-v4.1-flash": {
+      "input": 0.3,
+      "output": 1.2,
+      "cache_read": 0.006,
+      "cache_write": 0.3,
+      "note": "DeepSeek V4.1 Flash (official API id deepseek-flash, released 2026-09-10). deepseek-v4.1-flash is the id reported by OpenRouter, Command Code and WorkBuddy. Peak rates per https://api-docs.deepseek.com/quick_start/pricing/ ($0.30 / $1.20 / $0.006 cache read per MTok); computeRowCost halves them off-peak like the other DeepSeek V4 entries."
+    },
+    "deepseek-flash": {
+      "input": 0.3,
+      "output": 1.2,
+      "cache_read": 0.006,
+      "cache_write": 0.3,
+      "note": "Official DeepSeek API id for DeepSeek-V4.1-Flash. Same rates as deepseek-v4.1-flash."
+    },
     "deepseek-chat": {
       "input": 0.14,
       "output": 0.28,
@@ -544,6 +558,14 @@
       "match": "minimax-m2.7",
       "ref": "MiniMax-M2.7"
     },
+    {
+      "match": "deepseek-v4.1-flash",
+      "ref": "deepseek-v4.1-flash"
+    },
+    {
+      "match": "deepseek-flash",
+      "ref": "deepseek-flash"
+    },
     {
       "match": "deepseek-v4-flash",
       "ref": "deepseek-v4-flash"

package/src/lib/pricing/index.js

@@ -33,6 +33,8 @@ const SOURCES_WITH_AUTHORITATIVE_COST = new Set(["grok"]);
 const SEED_SNAPSHOT_PATH = path.resolve(__dirname, "seed-snapshot.json");
 const DEEPSEEK_TIME_PRICED_MODELS = [
   "deepseek-v4-flash",
+  "deepseek-v4.1-flash",
+  "deepseek-flash",
   "deepseek-v4-pro",
 ];
 // Sync seed load. Done at require-time so callers that haven't awaited
@@ -194,8 +196,14 @@ function computeRowCost(row) {
     reportedCost > 0
   ) return reportedCost;
   const pricing = getRowPricing(row);
+  // OmO, like Codex, reports reasoning as a subset of `output` (its own
+  // usage.cost bills no separate reasoning component), so charging it again
+  // here would double-bill every reasoning token.
   const reasoningIncludedInOutput =
-    row.source === "codex" || row.source === "acode" || row.source === "every-code";
+    row.source === "codex" ||
+    row.source === "acode" ||
+    row.source === "every-code" ||
+    row.source === "omo";
   const reasoningCost = reasoningIncludedInOutput
     ? 0
     : (row.reasoning_output_tokens || 0) * (pricing.output || 0);