tokentracker-cli 1.1.7 → 1.1.8

package/src/lib/cloud-account.js

@@ -12,6 +12,7 @@
 
 const { DEFAULT_BASE_URL, DEFAULT_ANON_KEY } = require("./runtime-config");
 const { expandHeatmapCompact } = require("./heatmap-compact");
+const { functionUrlFor, fetchFunctionResponse } = require("./function-url");
 
 // usage-* (local CLI) → account-* (cloud) slug map. Only these have a
 // cross-device cloud equivalent; project-usage / usage-limits / category
@@ -107,24 +108,17 @@ let tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
 // intermittent "Activity silently dropped to this-machine data" symptom.
 const mintInflight = new Map();
 
-// Response cache for the account reads, mirroring the 30-second window the edge
-// functions already keep.
-//
-// Each `tokentracker-account-*` function caches the RPC snapshot it renders
-// from for 30 seconds (`COMPACT_TTL_MS` in dashboard/edge-patches/*), so two
-// reads inside one window render the same numbers from the same snapshot. That
-// cache only saves the edge-to-PostgREST hop, though: the full body still goes
-// out to every caller. And the callers repeat a lot — the Windows tray poller
-// re-reads the 52-week heatmap every ~49 seconds, and one popover refresh fans
-// out six reads at once. Holding the payload here for the same 30 seconds
-// returns exactly what the cloud would have returned, without paying for the
-// transfer again.
-//
-// Bodies are stored serialized and re-parsed on a hit so a caller mutating the
-// object it got back cannot corrupt what the next caller reads.
-const PAYLOAD_TTL_MS = 30_000;
+// Ordinary cross-device reads may lag by two minutes for summaries and five
+// minutes for charts. Uploads and explicit refreshes invalidate this window.
+// Serialized copies prevent consumers from changing another consumer's data.
+const SUMMARY_PAYLOAD_TTL_MS = 120_000;
+const PAYLOAD_TTL_MS = 300_000;
 const PAYLOAD_CACHE_MAX = 64;
 const payloadCache = new Map();
+const payloadInflight = new Map();
+const payloadVersions = new Map();
+let payloadGeneration = 0;
+let sessionGeneration = 0;
 
 // Mirrors the params `fetchAccountFunction` actually puts on the wire, so two
 // requests share an entry only when they would have produced the same URL.
@@ -132,7 +126,7 @@ function payloadCacheKey({ root, sub, slug, searchParams }) {
   const pairs = [];
   if (searchParams && typeof searchParams.entries === "function") {
     for (const [key, value] of searchParams.entries()) {
-      if (key === "account" || key === "scope") continue;
+      if (key === "account" || key === "scope" || key === "refresh") continue;
       if (value == null || value === "") continue;
       pairs.push(`${key}=${String(value)}`);
     }
@@ -159,7 +153,7 @@ function payloadCacheGet(key, now) {
   }
 }
 
-function payloadCacheSet(key, data, now) {
+function payloadCacheSet(key, data, now, ttlMs) {
   let body;
   try {
     body = JSON.stringify(data);
@@ -167,7 +161,7 @@ function payloadCacheSet(key, data, now) {
     return; // Not serializable: skip the cache rather than fail the read.
   }
   if (body === undefined) return;
-  payloadCache.set(key, { expMs: now() + PAYLOAD_TTL_MS, body });
+  payloadCache.set(key, { expMs: now() + ttlMs, body });
   while (payloadCache.size > PAYLOAD_CACHE_MAX) {
     const oldest = payloadCache.keys().next();
     if (oldest.done) break;
@@ -175,10 +169,26 @@ function payloadCacheSet(key, data, now) {
   }
 }
 
+function invalidateCloudAccountPayloadCache({ sessionChanged = false } = {}) {
+  if (sessionChanged) {
+    sessionGeneration += 1;
+    tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
+    mintInflight.clear();
+  }
+  payloadGeneration += 1;
+  payloadCache.clear();
+  payloadInflight.clear();
+  payloadVersions.clear();
+}
+
+function getCloudAccountSessionGeneration() {
+  return sessionGeneration;
+}
+
 function __resetCloudAccountCacheForTests() {
   tokenCache = { cacheKey: null, accessToken: null, expMs: 0 };
   mintInflight.clear();
-  payloadCache.clear();
+  invalidateCloudAccountPayloadCache({ sessionChanged: true });
 }
 
 // Failure classes surfaced to local-api so it can tell an intentional local
@@ -205,7 +215,8 @@ function csrfTokenFromRefreshPayload(data) {
  * every failure so callers can distinguish a transient outage (timeout,
  * offline, rotated-token rejection) from an intentionally local view.
  */
-async function performMint({ root, cacheKey, anonKey, refreshToken, fetchImpl, now, timeoutMs }) {
+async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeoutMs }) {
+  const mintSessionGeneration = sessionGeneration;
   const headers = { "Content-Type": "application/json", Accept: "application/json" };
   if (anonKey) headers.apikey = anonKey;
 
@@ -260,9 +271,13 @@ async function performMint({ root, cacheKey, anonKey, refreshToken, fetchImpl, n
   }
 
   const expMs = decodeJwtExpMs(accessToken) || now() + 10 * 60_000;
-  tokenCache = { cacheKey, accessToken, expMs };
-
+  if (mintSessionGeneration !== sessionGeneration) {
+    throw new AccountAuthError("auth_session_changed", "account session changed during token refresh");
+  }
   const rotated = refreshTokenFromRefreshPayload(data);
+  // The caller persists a rotation before its next account read. Key the
+  // still-valid access token by that current refresh token, not the consumed one.
+  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs };
   return {
     accessToken,
     refreshToken: rotated && rotated !== refreshToken ? rotated : null,
@@ -311,7 +326,7 @@ async function mintAccessToken({
 
   let inflight = mintInflight.get(cacheKey);
   if (!inflight) {
-    inflight = performMint({ root, cacheKey, anonKey, refreshToken, fetchImpl, now, timeoutMs })
+    inflight = performMint({ root, anonKey, refreshToken, fetchImpl, now, timeoutMs })
       .finally(() => {
         // Only clear our own entry: a later caller may already have started a
         // fresh mint after this one settled.
@@ -342,10 +357,10 @@ async function fetchAccountFunction({
   timeoutMs,
 } = {}) {
   const root = String(baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
-  const url = new URL(`${root}/functions/${slug}`);
+  const url = new URL(functionUrlFor(root, slug));
   if (searchParams && typeof searchParams.entries === "function") {
     for (const [key, value] of searchParams.entries()) {
-      if (key === "account" || key === "scope") continue;
+      if (key === "account" || key === "scope" || key === "refresh") continue;
       if (value != null && value !== "") url.searchParams.set(key, String(value));
     }
   }
@@ -364,13 +379,13 @@ async function fetchAccountFunction({
   }
 
   try {
-    const res = await fetchImpl(url.toString(), { method: "GET", headers, signal });
+    const res = await fetchFunctionResponse(url.toString(), { method: "GET", headers, signal }, fetchImpl);
     if (!res || !res.ok) {
       const err = new Error(`Account fetch failed with HTTP ${res ? res.status : "?"}`);
       err.status = res ? res.status : 0;
       throw err;
     }
-    const data = await res.json();
+  const data = await res.json();
     return slug === HEATMAP_ACCOUNT_SLUG ? expandHeatmapCompact(data) : data;
   } finally {
     if (timeoutId) {
@@ -402,6 +417,7 @@ async function fetchAccountUsage({
   if (!slug) return null;
   if (!refreshToken) return null;
 
+  const sessionAtStart = sessionGeneration;
   const startTime = now();
   const getRemainingTimeout = () => {
     if (!timeoutMs) return undefined;
@@ -423,6 +439,9 @@ async function fetchAccountUsage({
     throwOnFailure: true,
   });
   if (!minted) return null;
+  if (sessionAtStart !== sessionGeneration) {
+    throw new AccountAuthError("auth_session_changed", "account session changed during token refresh");
+  }
 
   // Keyed after the mint so rotation cannot invalidate the entry, and so a
   // revoked session fails here rather than being served from cache.
@@ -430,7 +449,8 @@ async function fetchAccountUsage({
   const cacheKey = sub
     ? payloadCacheKey({ root: String(baseUrl || DEFAULT_BASE_URL).replace(/\/$/, ""), sub, slug, searchParams })
     : null;
-  if (cacheKey) {
+  const force = searchParams?.get("refresh") === "1";
+  if (cacheKey && !force) {
     const cached = payloadCacheGet(cacheKey, now);
     if (cached !== null) {
       // Still surface a rotation from this mint: dropping it would leave the
@@ -443,16 +463,47 @@ async function fetchAccountUsage({
     }
   }
 
-  const data = await fetchAccountFunction({
-    baseUrl,
-    anonKey,
-    accessToken: minted.accessToken,
-    slug,
-    searchParams,
-    fetchImpl,
-    timeoutMs: getRemainingTimeout(),
-  });
-  if (cacheKey && data != null) payloadCacheSet(cacheKey, data, now);
+  const flightKey = cacheKey ? `${cacheKey}\0${payloadGeneration}\0${force ? "refresh" : `normal:${payloadVersions.get(cacheKey) || 0}`}` : null;
+  let pending = flightKey && payloadInflight.get(flightKey);
+  if (!pending) {
+    // A forced read supersedes an older ordinary read of the same account.
+    // Keep concurrent forced consumers together without sharing its old flight.
+    if (force && cacheKey) {
+      payloadCache.delete(cacheKey);
+      payloadVersions.set(cacheKey, (payloadVersions.get(cacheKey) || 0) + 1);
+    }
+    const generation = payloadGeneration;
+    const version = payloadVersions.get(cacheKey) || 0;
+    pending = (async () => {
+      try {
+        const data = await fetchAccountFunction({
+          baseUrl, anonKey, accessToken: minted.accessToken, slug, searchParams,
+          fetchImpl, timeoutMs: getRemainingTimeout(),
+        });
+        if (generation === payloadGeneration && version === (payloadVersions.get(cacheKey) || 0) && cacheKey && data != null) {
+          payloadCacheSet(cacheKey, data, now, slug === "tokentracker-account-summary" ? SUMMARY_PAYLOAD_TTL_MS : PAYLOAD_TTL_MS);
+        }
+        return JSON.stringify(data);
+      } catch (error) {
+        if (error.status === 401 || error.status === 403) {
+          invalidateCloudAccountPayloadCache({ sessionChanged: true });
+        }
+        throw error;
+      }
+    })();
+    if (flightKey) {
+      payloadInflight.set(flightKey, pending);
+      const cleanup = () => {
+        if (payloadInflight.get(flightKey) === pending) payloadInflight.delete(flightKey);
+      };
+      pending.then(cleanup, cleanup);
+    }
+  }
+  const body = await pending;
+  if (sessionAtStart !== sessionGeneration) {
+    throw new AccountAuthError("auth_session_changed", "account session changed during account read");
+  }
+  const data = body === undefined ? undefined : JSON.parse(body);
   return { data, rotatedRefreshToken: minted.refreshToken, rotatedCsrfToken: minted.csrfToken };
 }
 
@@ -460,6 +511,9 @@ module.exports = {
   AccountAuthError,
   USAGE_TO_ACCOUNT_SLUG,
   PAYLOAD_TTL_MS,
+  SUMMARY_PAYLOAD_TTL_MS,
+  invalidateCloudAccountPayloadCache,
+  getCloudAccountSessionGeneration,
   HEATMAP_ACCOUNT_SLUG,
   accountSlugFor,
   accessTokenFromRefreshPayload,

package/src/lib/function-url.js

@@ -0,0 +1,27 @@
+const { DEFAULT_BASE_URL } = require("./runtime-config");
+
+const PROD_FUNCTIONS_URL = "https://srctyff5.function2.insforge.app";
+
+// Use only the production deployment verified by the platform. A custom or
+// self-hosted API keeps its proxy route instead of sending credentials elsewhere.
+function functionUrlFor(baseUrl, slug) {
+  const root = String(baseUrl || "").trim().replace(/\/$/, "");
+  return root === DEFAULT_BASE_URL
+    ? `${PROD_FUNCTIONS_URL}/${slug}`
+    : `${root}/functions/${slug}`;
+}
+
+async function fetchFunctionResponse(url, init = {}, fetchImpl = fetch) {
+  const response = await fetchImpl(url, init);
+  const method = String(init.method || "GET").toUpperCase();
+  const target = new URL(String(url));
+  if (response.status === 404 && (method === "GET" || method === "HEAD")
+      && target.origin === PROD_FUNCTIONS_URL) {
+    const legacy = new URL(`${DEFAULT_BASE_URL}/functions${target.pathname}`);
+    legacy.search = target.search;
+    return fetchImpl(legacy.toString(), init);
+  }
+  return response;
+}
+
+module.exports = { functionUrlFor, fetchFunctionResponse };

package/src/lib/local-api.js

@@ -10,8 +10,9 @@ const {
   listExcludedSources,
   normalizeUsageScope,
 } = require("./source-metadata");
-const { accountSlugFor, fetchAccountUsage, mintAccessToken } = require("./cloud-account");
+const { accountSlugFor, fetchAccountUsage, mintAccessToken, invalidateCloudAccountPayloadCache, getCloudAccountSessionGeneration } = require("./cloud-account");
 const { getOrCreateMachineId, computeStableMachineId } = require("./machine-id");
+const { functionUrlFor, fetchFunctionResponse } = require("./function-url");
 
 const SYNC_TIMEOUT_MS = 120_000;
 // A failed account-view request should not stall every dashboard refresh
@@ -1145,12 +1146,49 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
   const cookiePath = path.join(trackerDataDir, "relay-cookies.json");
   const localSyncDeviceTokenCache = new Map();
   const localSyncDeviceTokenInflight = new Map();
+  let localSyncDeviceTokenUserId = "";
+  function clearLocalSyncDeviceTokenCache() {
+    localSyncDeviceTokenCache.clear();
+    localSyncDeviceTokenInflight.clear();
+    localSyncDeviceTokenUserId = "";
+  }
+  function currentCloudUploadFailure(syncStartedAt, { backoff = false } = {}) {
+    try {
+      const state = JSON.parse(fs.readFileSync(path.join(path.dirname(qp), "upload.throttle.json"), "utf8"));
+      if (Date.parse(state.lastErrorAt || "") >= syncStartedAt && Number(state.lastErrorStatus) > 0) {
+        if (state.lastErrorCode === "CLOUD_DEVICE_TOKEN_REJECTED") clearLocalSyncDeviceTokenCache();
+        return { code: state.lastErrorCode || "CLOUD_UPLOAD_FAILED", status: Number(state.lastErrorStatus) };
+      }
+      if (backoff && Number(state.backoffUntilMs || 0) > syncStartedAt) {
+        return { code: "SYNC_UPLOAD_BACKOFF", status: 429 };
+      }
+    } catch { /* no upload failure was recorded */ }
+    return null;
+  }
   // A dashboard refresh fans out to several account-view endpoints. Keep the
   // circuit-breaker state per session instead of one global slot (a successful
   // request for one account must not clear another account's failure), and
   // suppress the duplicate fan-out while the first cloud probe is pending.
   const accountViewFailures = new Map();
   const accountViewInFlight = new Set();
+  let accountUploadState = readAccountUploadState();
+
+  function readAccountUploadState() {
+    try {
+      const state = JSON.parse(fs.readFileSync(path.join(path.dirname(qp), "queue.state.json"), "utf8"));
+      return JSON.stringify([Number(state.offset) || 0, state.updatedAt || ""]);
+    } catch {
+      return "";
+    }
+  }
+
+  function invalidateAfterAccountUpload() {
+    const state = readAccountUploadState();
+    if (state !== accountUploadState) {
+      accountUploadState = state;
+      invalidateCloudAccountPayloadCache();
+    }
+  }
 
   function accountViewFailureUntil(failureKey) {
     const until = accountViewFailures.get(failureKey) || 0;
@@ -1202,6 +1240,8 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
   }
 
   function clearRelayCookies(reason) {
+    clearLocalSyncDeviceTokenCache();
+    invalidateCloudAccountPayloadCache({ sessionChanged: true });
     if (relayCookies.size === 0) return;
     relayCookies.clear();
     try {
@@ -1230,6 +1270,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       
       if (isDeletion) {
         if (relayCookies.has(name)) {
+          if (name === "insforge_refresh_token") invalidateCloudAccountPayloadCache({ sessionChanged: true });
           relayCookies.delete(name);
           changed = true;
           console.log(`[LocalAPI] Cookie deleted: ${name}`);
@@ -1237,6 +1278,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       } else {
         const oldVal = relayCookies.get(name);
         if (oldVal !== raw.trim()) {
+          if (name === "insforge_refresh_token") invalidateCloudAccountPayloadCache({ sessionChanged: true });
           relayCookies.set(name, raw.trim());
           changed = true;
           console.log(`[LocalAPI] Cookie captured: ${name}`);
@@ -1261,7 +1303,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
     }
   }
 
-  function captureAuthTokensFromBody(bodyBuffer, contentType) {
+  function captureAuthTokensFromBody(bodyBuffer, contentType, { newLogin = false } = {}) {
     if (!bodyBuffer || !String(contentType || "").toLowerCase().includes("application/json")) return;
     let parsed = null;
     try {
@@ -1280,8 +1322,10 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
     }
     const refreshToken = typeof parsed?.refreshToken === "string" ? parsed.refreshToken.trim() : "";
     if (refreshToken) {
+      if (newLogin) clearLocalSyncDeviceTokenCache();
       const cookie = `insforge_refresh_token=${encodeURIComponent(refreshToken)}; Path=/; HttpOnly; SameSite=Lax`;
       if (relayCookies.get("insforge_refresh_token") !== cookie) {
+        invalidateCloudAccountPayloadCache({ sessionChanged: true });
         relayCookies.set("insforge_refresh_token", cookie);
         changed = true;
       }
@@ -1300,6 +1344,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
   // takes effect for signed-in users; an explicit {enabled:false} still wins.
   const cloudSyncPrefPath = path.join(trackerDataDir, "cloud-sync-pref.json");
   let cloudSyncPrefCache;
+  let cloudSyncPrefGeneration = 0;
   function getCloudSyncPref() {
     if (cloudSyncPrefCache === undefined) {
       try {
@@ -1311,6 +1356,11 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
     return cloudSyncPrefCache;
   }
   function setCloudSyncPref(enabled) {
+    if (getCloudSyncPref() !== Boolean(enabled)) {
+      cloudSyncPrefGeneration += 1;
+      clearLocalSyncDeviceTokenCache();
+      invalidateCloudAccountPayloadCache();
+    }
     cloudSyncPrefCache = Boolean(enabled);
     try {
       if (!fs.existsSync(trackerDataDir)) fs.mkdirSync(trackerDataDir, { recursive: true });
@@ -1344,8 +1394,8 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
     }
   }
 
-  function localSyncDeviceTokenCacheKey(refreshToken, machineId, baseUrl) {
-    return `${baseUrl}\0${refreshToken}\0${machineId}`;
+  function localSyncDeviceTokenCacheKey(userId, machineId, baseUrl) {
+    return `${baseUrl}\0${userId}\0${machineId}`;
   }
 
   async function issueDeviceTokenForLocalSync(queuePathForMachineId, options = {}) {
@@ -1360,27 +1410,41 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       normalizeRemoteHttpBaseUrl(options.baseUrl) ||
       normalizeRemoteHttpBaseUrl(runtime.baseUrl) ||
       normalizeRemoteHttpBaseUrl(DEFAULT_BASE_URL);
-    const cacheKey = localSyncDeviceTokenCacheKey(refreshToken, machineId, baseUrl);
+    const sessionAtStart = getCloudAccountSessionGeneration();
+    const cloudPrefAtStart = cloudSyncPrefGeneration;
+    const minted = await mintAccessToken({
+      baseUrl,
+      anonKey: runtime.anonKey,
+      refreshToken,
+      timeoutMs: runtime.httpTimeoutMs,
+    });
+    if (!minted?.accessToken || sessionAtStart !== getCloudAccountSessionGeneration()) return null;
+    const rotatedRefreshToken =
+      typeof minted.refreshToken === "string" && minted.refreshToken.trim()
+        ? minted.refreshToken.trim()
+        : "";
+    if (rotatedRefreshToken) setRelayRefreshToken(rotatedRefreshToken);
+    if (minted.csrfToken) setRelayCsrfToken(minted.csrfToken);
+    if (!getCloudSyncPref() || cloudPrefAtStart !== cloudSyncPrefGeneration) return null;
+    // The token comes from a successful refresh, not from a caller-supplied JWT.
+    // Token rotation keeps the same subject and therefore the same device key.
+    let userId = "";
+    try {
+      const payload = JSON.parse(Buffer.from(minted.accessToken.split(".")[1], "base64url").toString("utf8"));
+      userId = typeof payload.sub === "string" ? payload.sub : "";
+    } catch { /* legacy opaque access tokens retain their isolated refresh key */ }
+    if (userId && localSyncDeviceTokenUserId && userId !== localSyncDeviceTokenUserId) {
+      clearLocalSyncDeviceTokenCache();
+    }
+    if (userId) localSyncDeviceTokenUserId = userId;
+    const identity = userId || `refresh:${rotatedRefreshToken || refreshToken}`;
+    const cacheKey = localSyncDeviceTokenCacheKey(identity, machineId, baseUrl);
     const cachedToken = localSyncDeviceTokenCache.get(cacheKey);
     if (cachedToken) return cachedToken;
     const inflightToken = localSyncDeviceTokenInflight.get(cacheKey);
-    if (inflightToken) return inflightToken;
+    if (inflightToken?.sessionGeneration === sessionAtStart) return inflightToken.promise;
 
     const issuePromise = (async () => {
-      const minted = await mintAccessToken({
-        baseUrl,
-        anonKey: runtime.anonKey,
-        refreshToken,
-        timeoutMs: runtime.httpTimeoutMs,
-      });
-      if (!minted?.accessToken) return null;
-      const rotatedRefreshToken =
-        typeof minted.refreshToken === "string" && minted.refreshToken.trim()
-          ? minted.refreshToken.trim()
-          : "";
-      if (rotatedRefreshToken) setRelayRefreshToken(rotatedRefreshToken);
-      if (minted.csrfToken) setRelayCsrfToken(minted.csrfToken);
-
       const root = String(baseUrl || DEFAULT_BASE_URL).replace(/\/$/, "");
       const headers = {
         "Content-Type": "application/json",
@@ -1401,7 +1465,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
             process.platform === "linux" ? "Linux x86_64" :
               "web";
 
-      const res = await fetch(`${root}/functions/tokentracker-device-token-issue`, {
+      const res = await fetchFunctionResponse(functionUrlFor(root, "tokentracker-device-token-issue"), {
         method: "POST",
         headers,
         signal: controller ? controller.signal : undefined,
@@ -1416,20 +1480,22 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       }).finally(() => {
         if (timeoutId) clearTimeout(timeoutId);
       });
-      if (!res.ok) return null;
+      if (sessionAtStart !== getCloudAccountSessionGeneration() || !getCloudSyncPref() || cloudPrefAtStart !== cloudSyncPrefGeneration) return null;
+      if (!res.ok) {
+        if (res.status === 401) clearLocalSyncDeviceTokenCache();
+        return null;
+      }
       const data = await res.json().catch(() => null);
       const token = typeof data?.token === "string" ? data.token.trim() : "";
-      if (token) {
-        const activeRefreshToken = rotatedRefreshToken || refreshToken;
-        localSyncDeviceTokenCache.set(localSyncDeviceTokenCacheKey(activeRefreshToken, machineId, baseUrl), token);
-      }
+      if (sessionAtStart !== getCloudAccountSessionGeneration() || !getCloudSyncPref() || cloudPrefAtStart !== cloudSyncPrefGeneration) return null;
+      if (token) localSyncDeviceTokenCache.set(cacheKey, token);
       return token || null;
     })();
-    localSyncDeviceTokenInflight.set(cacheKey, issuePromise);
+    localSyncDeviceTokenInflight.set(cacheKey, { promise: issuePromise, sessionGeneration: sessionAtStart });
     try {
       return await issuePromise;
     } finally {
-      localSyncDeviceTokenInflight.delete(cacheKey);
+      if (localSyncDeviceTokenInflight.get(cacheKey)?.promise === issuePromise) localSyncDeviceTokenInflight.delete(cacheKey);
     }
   }
 
@@ -1466,10 +1532,11 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
     if (!getCloudSyncPref()) return ACCOUNT_FALLBACK_CLOUD_SYNC_OFF;
     const refreshToken = getRefreshTokenForCloud();
     if (!refreshToken) return ACCOUNT_FALLBACK_SIGNED_OUT;
+    invalidateAfterAccountUpload();
     const runtime = resolveRuntimeConfig();
     const failureKey = `${runtime.baseUrl}\0${refreshToken}`;
     const requestKey = `${failureKey}\0${usageSlug}\0${url.searchParams.toString()}`;
-    if (accountViewFailureUntil(failureKey) > Date.now()) {
+    if (url.searchParams.get("refresh") !== "1" && accountViewFailureUntil(failureKey) > Date.now()) {
       return "transient-backoff";
     }
     // Six native dashboard requests normally arrive together. If the cloud is
@@ -1483,6 +1550,8 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       ? parseInt(process.env.TOKENTRACKER_HTTP_TIMEOUT_MS, 10)
       : 0;
     const timeoutMs = envTimeout > 0 ? envTimeout : 4000;
+    const sessionAtStart = getCloudAccountSessionGeneration();
+    const cloudPrefAtStart = cloudSyncPrefGeneration;
     try {
       const out = await fetchAccountUsage({
         usageSlug,
@@ -1495,12 +1564,20 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       // `null` here means the slug has no cloud equivalent, or the session
       // vanished mid-request — a routing/session fact, not an outage.
       if (!out) return ACCOUNT_FALLBACK_SIGNED_OUT;
+      if (sessionAtStart !== getCloudAccountSessionGeneration()) {
+        throw Object.assign(new Error("Account session changed"), { code: "auth_session_changed" });
+      }
       if (out.data == null) {
         rememberAccountViewFailure(failureKey);
         return "transient-upstream";
       }
       if (out.rotatedRefreshToken) setRelayRefreshToken(out.rotatedRefreshToken);
       if (out.rotatedCsrfToken) setRelayCsrfToken(out.rotatedCsrfToken);
+      if (!getCloudSyncPref()) return ACCOUNT_FALLBACK_CLOUD_SYNC_OFF;
+      if (cloudPrefAtStart !== cloudSyncPrefGeneration) {
+        json(res, { error: "Cloud sync preference changed", code: "CLOUD_SYNC_CHANGED" }, 409);
+        return "served";
+      }
       accountViewFailures.delete(failureKey);
       res.writeHead(200, {
         "Content-Type": "application/json",
@@ -1510,6 +1587,10 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
       res.end(JSON.stringify(out.data));
       return "served";
     } catch (e) {
+      if (e.code === "auth_session_changed") {
+        json(res, { error: "Account session changed", code: e.code }, 409);
+        return "served";
+      }
       // Signed in + cloud sync on, but the cloud read failed (offline, token
       // rejected, edge error, or timeout). Serve local data rather than
       // erroring, but say so: this is a *temporary* downgrade and the client
@@ -1685,6 +1766,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
 
     // --- auth proxy: forward /api/auth/* to InsForge cloud ---
     if (p.startsWith("/api/auth/")) {
+      const authSessionAtStart = getCloudAccountSessionGeneration();
       const runtime = resolveRuntimeConfig();
       const insforgeBase = runtime.baseUrl || DEFAULT_BASE_URL;
       try {
@@ -1782,6 +1864,11 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
         // Error responses must not mutate relay state: a 403's deletion
         // set-cookie (insforge_refresh_token=; Expires=1970) would otherwise
         // destroy a still-valid persisted session.
+        if ((p === "/api/auth/refresh" || p === "/api/auth/logout") &&
+            authSessionAtStart !== getCloudAccountSessionGeneration()) {
+          json(res, { error: "Account session changed", code: "auth_session_changed" }, 409);
+          return true;
+        }
         const allowRelayCapture = proxyRes.status < 400;
         const responseHeaders = [...proxyRes.headers.entries()]
           .filter(([k]) => !["transfer-encoding", "connection"].includes(k.toLowerCase()))
@@ -1798,7 +1885,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
           if (p === "/api/auth/logout") {
             clearRelayCookies("sign out");
           } else {
-            captureAuthTokensFromBody(resBody, proxyRes.headers.get("content-type"));
+            captureAuthTokensFromBody(resBody, proxyRes.headers.get("content-type"), { newLogin: p !== "/api/auth/refresh" });
           }
         }
         if (
@@ -2027,6 +2114,10 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
           extraEnv.TOKENTRACKER_WSL_MODE = "native-only";
         }
         if (typeof body.deviceToken === "string" && body.deviceToken.trim()) {
+          if (!getCloudSyncPref() && !background) {
+            json(res, { ok: false, error: "Cloud sync disabled", code: "CLOUD_SYNC_DISABLED" }, 409);
+            return true;
+          }
           extraEnv.TOKENTRACKER_DEVICE_TOKEN = body.deviceToken.trim();
         }
         let localSyncBaseUrl = null;
@@ -2044,6 +2135,8 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
             getCloudSyncPref() &&
             getRefreshTokenForCloud()) {
           let issuedToken = null;
+          const issuerSessionAtStart = getCloudAccountSessionGeneration();
+          const issuerCloudPrefAtStart = cloudSyncPrefGeneration;
           try {
             issuedToken = await issueDeviceTokenForLocalSync(qp, { baseUrl: localSyncBaseUrl });
           } catch (e) {
@@ -2051,6 +2144,14 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
               console.warn("[LocalAPI] local sync device token issue failed:", e?.message || e);
             }
           }
+          if (issuerSessionAtStart !== getCloudAccountSessionGeneration()) {
+            json(res, { ok: false, error: "Account session changed", code: "auth_session_changed" }, 409);
+            return true;
+          }
+          if (!getCloudSyncPref() || issuerCloudPrefAtStart !== cloudSyncPrefGeneration) {
+            json(res, { ok: false, error: "Cloud sync preference changed", code: "CLOUD_SYNC_CHANGED" }, 409);
+            return true;
+          }
           if (!issuedToken) {
             if (drain) {
               json(res, { ok: false, error: "Unable to issue cloud device token for local sync" }, 502);
@@ -2060,6 +2161,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
             extraEnv.TOKENTRACKER_DEVICE_TOKEN = issuedToken;
           }
         }
+        const syncStartedAt = Date.now();
         const result = await runSyncCommand(extraEnv, {
           drain,
           auto,
@@ -2068,7 +2170,15 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
           allLocalSources,
           waitForLock:
             !drain && !background && Boolean(extraEnv.TOKENTRACKER_DEVICE_TOKEN),
+        }).catch((error) => {
+          const failure = currentCloudUploadFailure(syncStartedAt, { backoff: auto && drain });
+          if (failure) Object.assign(error, failure);
+          throw error;
         });
+        const failure = currentCloudUploadFailure(syncStartedAt);
+        if (failure) throw Object.assign(new Error("Cloud upload failed"), failure);
+        invalidateAfterAccountUpload();
+        if (drain) invalidateCloudAccountPayloadCache();
         try {
           const { resetUsageLimitsCache } = require("./usage-limits");
           resetUsageLimitsCache();
@@ -2077,7 +2187,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null }) {
         }
         json(res, { ok: true, ...result });
       } catch (e) {
-        json(res, { ok: false, error: e?.message, code: e?.code ?? null, stdout: e?.stdout || "", stderr: e?.stderr || "" }, 500);
+        json(res, { ok: false, error: e?.message, code: e?.code ?? null, stdout: e?.stdout || "", stderr: e?.stderr || "" }, e?.status || 500);
       }
       return true;
     }