tokentracker-cli 1.2.1 → 1.3.3

package/src/commands/device-login.js

@@ -6,30 +6,17 @@ const fs = require("node:fs/promises");
 
 const { readJson, updateJsonLocked } = require("../lib/fs");
 const { resolveTrackerPaths } = require("../lib/tracker-paths");
-const { resolveRuntimeConfig } = require("../lib/runtime-config");
+const { resolveRuntimeConfig, assertInsforgeRuntime, normalizeInstanceBaseUrl, clearDeviceIdentity, resetInstanceState } = require("../lib/runtime-config");
 const { functionUrlFor, fetchFunctionResponse } = require("../lib/function-url");
 
 const POLL_INTERVAL_MS = 5_000;
 const ABSOLUTE_TIMEOUT_MS = 16 * 60 * 1000; // matches the 15-min server window with a small buffer
 
-function readBaseUrl(config) {
-  return resolveRuntimeConfig({
-    // Preserve device-login's explicit legacy override names and precedence,
-    // while routing persisted config through the shared retired-host filter.
-    cli: {
-      baseUrl:
-        process.env.TOKENTRACKER_BASE_URL ||
-        process.env.TOKENTRACKER_API_URL,
-    },
-    config: config || {},
-    env: {},
-  }).baseUrl;
-}
-
-async function authorize({ baseUrl, clientInfo, machineId }) {
+async function authorize({ baseUrl, clientInfo, machineId, anonKey, timeoutMs = 20_000 }) {
   const res = await fetchFunctionResponse(functionUrlFor(baseUrl, "tokentracker-device-flow-authorize"), {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...(anonKey ? { apikey: anonKey } : {}) },
+    ...(timeoutMs > 0 ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
     body: JSON.stringify({
       client_info: clientInfo,
       // Machine-stable identity: the server anchors the issued device to this
@@ -46,10 +33,11 @@ async function authorize({ baseUrl, clientInfo, machineId }) {
   return res.json();
 }
 
-async function pollOnce({ baseUrl, deviceCode }) {
+async function pollOnce({ baseUrl, deviceCode, anonKey, timeoutMs = 20_000 }) {
   const res = await fetchFunctionResponse(functionUrlFor(baseUrl, "tokentracker-device-flow-poll"), {
     method: "POST",
-    headers: { "Content-Type": "application/json" },
+    headers: { "Content-Type": "application/json", ...(anonKey ? { apikey: anonKey } : {}) },
+    ...(timeoutMs > 0 ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
     body: JSON.stringify({ device_code: deviceCode }),
   });
   const data = await res.json().catch(() => ({}));
@@ -80,7 +68,12 @@ async function cmdDeviceLogin(argv = [], options = {}) {
   const { trackerDir } = await resolveTrackerPaths({ home });
   const configPath = path.join(trackerDir, "config.json");
   const config = (await readJson(configPath)) || {};
-  const baseUrl = opts.baseUrl || readBaseUrl(config);
+  if (opts.anonKeyFile) opts.anonKey = (await fs.readFile(opts.anonKeyFile, "utf8")).trim();
+  const runtime = assertInsforgeRuntime(resolveRuntimeConfig({
+    cli: { baseUrl: opts.baseUrl || process.env.TOKENTRACKER_BASE_URL || process.env.TOKENTRACKER_API_URL,
+      anonKey: opts.anonKey, dashboardUrl: opts.dashboardUrl }, config, env: process.env,
+  }));
+  const baseUrl = runtime.baseUrl;
 
   const clientInfo = `${os.platform()}-${os.arch()} ${os.hostname()}`;
   // Same machineId the local API serves to the dashboard — both login paths
@@ -88,7 +81,30 @@ async function cmdDeviceLogin(argv = [], options = {}) {
   const { getOrCreateMachineId } = require("../lib/local-api");
   const machineId = getOrCreateMachineId(path.join(trackerDir, "queue.jsonl"));
   process.stdout.write(`Requesting device code from ${baseUrl}...\n`);
-  const authResp = await authorize({ baseUrl, clientInfo, machineId });
+  const authResp = await authorize({ baseUrl, clientInfo, machineId, anonKey: runtime.anonKey, timeoutMs: runtime.httpTimeoutMs });
+  if (typeof authResp.verification_uri !== "string" || !authResp.verification_uri || !authResp.device_code) {
+    throw new Error("Device authorization returned an incomplete response");
+  }
+  const dashboard = new URL(runtime.dashboardUrl);
+  const expectedPath = dashboard.pathname.replace(/\/$/, "") + "/device";
+  for (const value of [authResp.verification_uri, authResp.verification_uri_complete].filter(Boolean)) {
+    const returned = new URL(value);
+    if (returned.origin !== dashboard.origin || returned.pathname !== expectedPath || returned.username || returned.password) {
+      throw new Error("Device authorization returned a different dashboard. Configure --dashboard-url for this instance.");
+    }
+  }
+  await updateJsonLocked(configPath, async current => {
+    const previous = resolveRuntimeConfig({ config, env: {} });
+    const latest = resolveRuntimeConfig({ config: current, env: {} });
+    if ((latest.baseUrl !== previous.baseUrl || latest.anonKey !== previous.anonKey) &&
+        (latest.baseUrl !== baseUrl || latest.anonKey !== runtime.anonKey)) {
+      throw new Error("Backend instance changed during device login");
+    }
+    const changedInstance = previous.baseUrl !== baseUrl || previous.anonKey !== runtime.anonKey;
+    if (changedInstance) resetInstanceState(trackerDir);
+    return { ...(changedInstance ? clearDeviceIdentity(current) : current), baseUrl,
+      anonKey: runtime.anonKey, dashboardUrl: runtime.dashboardUrl };
+  });
 
   if (opts.json) {
     process.stdout.write(JSON.stringify(authResp, null, 2) + "\n");
@@ -129,7 +145,7 @@ async function cmdDeviceLogin(argv = [], options = {}) {
     await sleepFn(wait);
     let result;
     try {
-      result = await pollOnce({ baseUrl, deviceCode: authResp.device_code });
+      result = await pollOnce({ baseUrl, deviceCode: authResp.device_code, anonKey: runtime.anonKey, timeoutMs: runtime.httpTimeoutMs });
       consecutiveErrors = 0;
     } catch (e) {
       consecutiveErrors++;
@@ -140,16 +156,21 @@ async function cmdDeviceLogin(argv = [], options = {}) {
       if (!result.deviceToken) {
         throw new Error("device login approved but server did not return a device token");
       }
-      await updateJsonLocked(configPath, async (current) => ({
-        ...current,
-        ...(machineId ? { machineId } : {}),
-        baseUrl,
-        user_id: result.user_id,
-        deviceToken: result.deviceToken,
-        deviceId: result.deviceId || current.deviceId || config.deviceId,
-        device_login_at: new Date().toISOString(),
-      }));
-      process.stdout.write(`\n✓ Approved. device token written to ${configPath}\n`);
+      await updateJsonLocked(configPath, async (current) => {
+        if (normalizeInstanceBaseUrl(current.baseUrl) !== baseUrl || current.anonKey !== runtime.anonKey) {
+          throw new Error("Backend instance changed during device login");
+        }
+        return { ...current,
+          ...(machineId ? { machineId } : {}),
+          baseUrl,
+          user_id: result.user_id,
+          deviceToken: result.deviceToken,
+          deviceTokenBaseUrl: baseUrl,
+          deviceId: result.deviceId || current.deviceId || config.deviceId,
+          device_login_at: new Date().toISOString(),
+        };
+      });
+      process.stdout.write(`\nApproved. device token written to ${configPath}\n`);
       return;
     }
     if (result.status === "expired") {
@@ -164,12 +185,18 @@ async function cmdDeviceLogin(argv = [], options = {}) {
 }
 
 function parseArgs(argv) {
-  const out = { json: false, baseUrl: null };
+  const out = { json: false, baseUrl: null, anonKey: null, anonKeyFile: null, dashboardUrl: null };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === "--json") out.json = true;
     else if (a === "--base-url") {
       out.baseUrl = argv[++i] || null;
+    } else if (a === "--anon-key") {
+      out.anonKey = argv[++i] || null;
+    } else if (a === "--anon-key-file") {
+      out.anonKeyFile = argv[++i] || null;
+    } else if (a === "--dashboard-url") {
+      out.dashboardUrl = argv[++i] || null;
     } else throw new Error(`Unknown option: ${a}`);
   }
   return out;

package/src/commands/init.js

@@ -79,7 +79,8 @@ const {
   resolveReasonixHome,
   resolveTraeStoragePath,
 } = require("../lib/rollout");
-const { resolveRuntimeConfig, DEFAULT_BASE_URL } = require("../lib/runtime-config");
+const { resolveRuntimeConfig, DEFAULT_BASE_URL, normalizeInstanceBaseUrl, assertInsforgeRuntime,
+  clearDeviceIdentity, resetInstanceState } = require("../lib/runtime-config");
 const {
   BOLD,
   DIM,
@@ -159,9 +160,10 @@ const SUPPORTED_PROVIDERS = [
   "Command Code",
 ];
 
-async function cmdInit(argv) {
+async function cmdInit(argv, options = {}) {
   const opts = parseArgs(argv);
-  const home = os.homedir();
+  const home = options.home || os.homedir();
+  if (opts.anonKeyFile) opts.anonKey = (await fs.readFile(opts.anonKeyFile, "utf8")).trim();
 
   const { rootDir, trackerDir, binDir } = await resolveTrackerPaths({ home });
 
@@ -171,10 +173,11 @@ async function cmdInit(argv) {
 
   const existingConfig = await readJson(configPath);
   const runtime = resolveRuntimeConfig({
-    cli: { baseUrl: opts.baseUrl, dashboardUrl: opts.dashboardUrl },
+    cli: { baseUrl: opts.baseUrl, dashboardUrl: opts.dashboardUrl, anonKey: opts.anonKey },
     config: existingConfig || {},
     env: process.env,
   });
+  assertInsforgeRuntime(runtime);
   const notifyPath = path.join(binDir, "notify.cjs");
   const appDir = path.join(trackerDir, "app");
   const trackerBinPath = path.join(appDir, "bin", "tracker.js");
@@ -369,16 +372,28 @@ async function runSetup({
     existingConfig && typeof existingConfig === "object" && !Array.isArray(existingConfig)
       ? existingConfig
       : {};
+  const previousRuntime = resolveRuntimeConfig({ config: existingPlainConfig, env: {} });
+  const changedInstance = normalizeInstanceBaseUrl(previousRuntime.baseUrl) !== runtime.baseUrl ||
+    previousRuntime.anonKey !== runtime.anonKey;
+  if (changedInstance) {
+    resetInstanceState(trackerDir);
+    deviceToken = null; deviceId = null;
+  }
   const config = {
-    ...existingPlainConfig,
+    ...(changedInstance ? clearDeviceIdentity(existingPlainConfig) : existingPlainConfig),
     installedAt,
     // Keep a persisted legacy URL until the first sync. sync owns the migration
     // lock and must reset the upload offset/backoff before removing this marker;
     // rewriting it here would skip the historical replay permanently.
     baseUrl: opts.baseUrl || existingPlainConfig.baseUrl || DEFAULT_BASE_URL,
   };
-  if (opts.dashboardUrl) {
-    config.dashboardUrl = opts.dashboardUrl;
+  if (changedInstance || opts.dashboardUrl) {
+    config.dashboardUrl = runtime.dashboardUrl;
+  }
+  if (changedInstance || opts.anonKey || runtime.sources.anonKey === "env") config.anonKey = runtime.anonKey;
+  if (runtime.baseUrl !== DEFAULT_BASE_URL) {
+    config.baseUrl = runtime.baseUrl;
+    config.dashboardUrl = runtime.dashboardUrl;
   }
 
   await writeJson(configPath, config);
@@ -1333,6 +1348,8 @@ function parseArgs(argv) {
   const out = {
     baseUrl: null,
     dashboardUrl: null,
+    anonKey: null,
+    anonKeyFile: null,
     email: null,
     password: null,
     deviceName: null,
@@ -1347,6 +1364,8 @@ function parseArgs(argv) {
     const a = argv[i];
     if (a === "--base-url") out.baseUrl = argv[++i] || null;
     else if (a === "--dashboard-url") out.dashboardUrl = argv[++i] || null;
+    else if (a === "--anon-key") out.anonKey = argv[++i] || null;
+    else if (a === "--anon-key-file") out.anonKeyFile = argv[++i] || null;
     else if (a === "--email") out.email = argv[++i] || null;
     else if (a === "--password") out.password = argv[++i] || null;
     else if (a === "--device-name") out.deviceName = argv[++i] || null;

package/src/commands/serve.js

@@ -159,7 +159,7 @@ async function cmdServe(argv) {
       const url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
 
       // CORS preflight
-      if (req.method === "OPTIONS") {
+      if (req.method === "OPTIONS" && !url.pathname.startsWith("/api/auth/")) {
         res.writeHead(204, {
           "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
           "Access-Control-Allow-Headers": "Content-Type, Authorization",
@@ -179,12 +179,12 @@ async function cmdServe(argv) {
       }
 
       // Static files
-      const served = await serveStaticFile(dashboardDir, url.pathname, res);
+      const served = await serveStaticFile(dashboardDir, url.pathname, res, { localRuntimeConfig: true });
       if (served) return;
 
       // SPA fallback
       if (shouldServeSpaFallback(req, url)) {
-        await serveStaticFile(dashboardDir, "/index.html", res);
+        await serveStaticFile(dashboardDir, "/index.html", res, { localRuntimeConfig: true });
         return;
       }
 

package/src/commands/sync.js

@@ -156,7 +156,7 @@ const {
   parseRetryAfterMs,
 } = require("../lib/upload-throttle");
 const AUTO_UPLOAD_CONFIG = {
-  intervalMs: 5 * 60_000,
+  intervalMs: 15 * 60_000,
   batchSize: 200,
   maxBatchesSmall: 5,
   maxBatchesLarge: 5,
@@ -507,6 +507,7 @@ async function clearSyncSkip(trackerDir) {
 }
 
 async function cmdSync(argv, context = {}) {
+  context = context && typeof context === "object" ? context : {};
   const opts = parseArgs(argv);
   const diagnostics = context && typeof context === "object" ? context.diagnostics : null;
   const cursorStoreOptions = context && typeof context === "object"
@@ -528,8 +529,8 @@ async function cmdSync(argv, context = {}) {
     ? context.cursorSyncDeps
     : {};
   const syncDiagnostics = diagnostics && typeof diagnostics === "object" ? diagnostics : null;
-  const home = os.homedir();
-  const { trackerDir } = await resolveTrackerPaths({ home });
+  const home = context.home || os.homedir();
+  const trackerDir = context.trackerDataDir || (await resolveTrackerPaths({ home })).trackerDir;
   // Manual CLI sync is a one-time upload request, without changing the toggle.
   // Hooks, native publication and detached retries must honor the saved opt-in.
   const requiresCloudSyncPref = opts.auto || opts.background || opts.fromRetry || opts.fromNotify || opts.fromOpenclaw ||
@@ -589,7 +590,8 @@ async function cmdSync(argv, context = {}) {
     // token unless the local API has already minted a replacement from the
     // user's current login session and passed it through the environment.
     // Ingest is a whole-row upsert per bucket key, making replay idempotent.
-    if (config && isLegacyInsforgeBaseUrl(config.baseUrl)) {
+    if (config && isLegacyInsforgeBaseUrl(config.baseUrl) &&
+        !Object.hasOwn(process.env, "TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN")) {
       const priorQueueState = (await readJson(queueStatePath)) || {};
       // Prepare the replay exactly once. The note survives successful batches,
       // so retryable failures retain both their committed offset and backoff
@@ -708,6 +710,7 @@ async function cmdSync(argv, context = {}) {
     const isBackgroundAllLocalSync = isBackgroundLightweightSync && opts.allLocalSources;
     const isFullSourceScan = !autoSourceScope && !isBackgroundLightweightSync;
     const sourceAllowed = (...sources) => {
+      if (Array.isArray(context.scanSources) && !sources.some(source => context.scanSources.includes(source))) return false;
       if (isBackgroundLightweightSync) {
         if (autoSourceScope) {
           return (
@@ -3373,7 +3376,7 @@ async function cmdSync(argv, context = {}) {
     }
     // An authenticated local API supplies this capability for this upload.
     // Keep a separately configured CLI account from overriding its owner.
-    const runtime = resolveRuntimeConfig({
+    const resolvedRuntime = resolveRuntimeConfig({
       cli: {
         deviceToken: process.env.TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN,
         ...(process.env.TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN ? {
@@ -3385,6 +3388,12 @@ async function cmdSync(argv, context = {}) {
       env: process.env,
     });
 
+    // Empty is an explicit local-server denial, so it cannot fall back to a
+    // separately configured CLI account when the browser is signed out.
+    const runtime = Object.hasOwn(process.env, "TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN")
+      ? { ...resolvedRuntime, deviceToken: resolvedRuntime.configurationError ? null : process.env.TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN }
+      : resolvedRuntime;
+
     let uploadResult = { inserted: 0, skipped: 0 };
     let uploadAttempted = false;
     let autoUploadDecision = null;
@@ -3397,22 +3406,25 @@ async function cmdSync(argv, context = {}) {
         0,
         queueSizeBefore - Number(uploadStateBefore.offset || 0),
       );
-      // Native publication owns a five-minute timer. Drains and a pending
-      // backend migration also bypass the success interval, but all automatic
-      // producers must respect a failed upload's retry deadline.
-      const bypassSuccessInterval = opts.publishAccount || opts.drain || legacyBaseUrlMigration;
+      // Automatic producers honor success and failure deadlines. A verified
+      // manual recheck may probe changed membership; the server decides access.
+      const bypassSuccessInterval = (!opts.auto && opts.drain) || legacyBaseUrlMigration;
       const lastSuccessMs = Number(uploadThrottleState.lastSuccessMs || 0);
       const successDeadline = lastSuccessMs > 0
-        ? Math.min(Number(uploadThrottleState.nextAllowedAtMs || 0),
-          lastSuccessMs + AUTO_UPLOAD_CONFIG.intervalMs + AUTO_UPLOAD_DEFAULTS.jitterMsMax)
+        ? Math.max(Number(uploadThrottleState.serverNextAllowedAtMs || 0), Math.min(Number(uploadThrottleState.nextAllowedAtMs || 0),
+          lastSuccessMs + AUTO_UPLOAD_CONFIG.intervalMs + AUTO_UPLOAD_DEFAULTS.jitterMsMax))
         : Number(uploadThrottleState.nextAllowedAtMs || 0);
+      const recheckCloudAccess = opts.drain && process.env.TOKENTRACKER_CLOUD_RECHECK === "1" &&
+        Boolean(process.env.TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN?.trim());
+      const storedBackoff = recheckCloudAccess ? 0 : Number(uploadThrottleState.backoffUntilMs || 0);
       autoUploadDecision = decideAutoUpload({
         nowMs: Date.now(),
         pendingBytes: pendingBytesBefore,
         state: {
           ...uploadThrottleState,
-          nextAllowedAtMs: bypassSuccessInterval
-            ? Number(uploadThrottleState.backoffUntilMs || 0)
+          backoffUntilMs: storedBackoff,
+          nextAllowedAtMs: recheckCloudAccess ? 0 : bypassSuccessInterval
+            ? Math.max(storedBackoff, Number(uploadThrottleState.serverNextAllowedAtMs || 0))
             : successDeadline,
         },
         config: AUTO_UPLOAD_CONFIG,
@@ -3458,6 +3470,7 @@ async function cmdSync(argv, context = {}) {
           const replacementDeviceToken = legacyBaseUrlMigration?.replacementDeviceToken;
           const stateAfterFailure = (await readJson(queueStatePath)) || { offset: 0 };
           const canFallbackWithoutSplittingHistory =
+            !Object.hasOwn(process.env, "TOKENTRACKER_LOCAL_SYNC_DEVICE_TOKEN") &&
             (error?.status === 401 || error?.status === 403) &&
             replacementDeviceToken &&
             fallbackDeviceToken &&
@@ -3496,12 +3509,16 @@ async function cmdSync(argv, context = {}) {
         }
         // Record success so the exponential backoff step resets — otherwise
         // a single past failure keeps us pessimistically throttled forever.
-        uploadThrottleState = recordUploadSuccess({
-          nowMs: Date.now(),
-          state: uploadThrottleState,
-          config: AUTO_UPLOAD_CONFIG,
-        });
-        await writeJson(uploadThrottlePath, uploadThrottleState);
+        if (uploadResult.batches > 0) {
+          uploadThrottleState = recordUploadSuccess({
+            nowMs: Date.now(),
+            state: uploadThrottleState,
+            config: AUTO_UPLOAD_CONFIG,
+            cloudAccess: uploadResult.cloudAccess,
+            attemptId: process.env.TOKENTRACKER_LOCAL_SYNC_ATTEMPT_ID,
+          });
+          await writeJson(uploadThrottlePath, uploadThrottleState);
+        }
       } catch (e) {
         // Persist a backoff on 429 / 5xx so the next auto-sync waits instead
         // of retrying immediately and making the rate-limit worse. The
@@ -4191,6 +4208,8 @@ async function drainQueueToCloud({ baseUrl, anonKey, deviceToken, queuePath, que
   let inserted = 0;
   let skipped = 0;
   let batches = 0;
+  let cloudAccess = null;
+  const uploadId = crypto.randomUUID();
 
   const queueSize = await safeStatSize(queuePath);
   const limit = Math.min(Math.max(1, Math.floor(Number(batchSize || 200))), MAX_INGEST_BUCKETS);
@@ -4216,6 +4235,7 @@ async function drainQueueToCloud({ baseUrl, anonKey, deviceToken, queuePath, que
       method: "POST",
       headers,
       body: JSON.stringify({
+        upload_id: uploadId,
         hourly: result.buckets,
         ...(result.sessionStates.length > 0
           ? { account_session_states: result.sessionStates }
@@ -4230,14 +4250,15 @@ async function drainQueueToCloud({ baseUrl, anonKey, deviceToken, queuePath, que
       const err = new Error(`HTTP ${res.status}: ${rawText.substring(0, 500)}`);
       err.status = res.status;
       err.code = res.status === 401 ? "CLOUD_DEVICE_TOKEN_REJECTED"
-        : res.status === 403 ? "CLOUD_UPLOAD_FORBIDDEN"
-          : "CLOUD_UPLOAD_FAILED";
+        : typeof data?.code === "string" ? data.code
+          : res.status === 403 ? "CLOUD_UPLOAD_FORBIDDEN" : "CLOUD_UPLOAD_FAILED";
       const retryAfter = res.headers?.get?.("Retry-After") ?? null;
       const retryAfterMs = parseRetryAfterMs(retryAfter);
       if (retryAfterMs !== null) err.retryAfterMs = retryAfterMs;
       throw err;
     }
 
+    cloudAccess = data;
     inserted += Number(data?.inserted || 0);
     skipped += Number(data?.skipped || 0);
     batches += 1;
@@ -4248,7 +4269,7 @@ async function drainQueueToCloud({ baseUrl, anonKey, deviceToken, queuePath, que
     await writeJson(queueStatePath, state);
   }
 
-  return { inserted, skipped, batches };
+  return { inserted, skipped, batches, ...(cloudAccess?.next_allowed_at ? { cloudAccess } : {}) };
 }
 
 async function readQueueBatch(queuePath, startOffset, maxBuckets) {

package/src/lib/atomic-json.js

@@ -0,0 +1,27 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const crypto = require("node:crypto");
+
+function writeJsonAtomicSync(filePath, value) {
+  const contents = JSON.stringify(value, null, 2) + "\n";
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tmp = `${filePath}.tmp.${crypto.randomUUID()}`;
+  let fd;
+  let created = false;
+  try {
+    fd = fs.openSync(tmp, "wx", 0o600);
+    created = true;
+    fs.writeFileSync(fd, contents, "utf8");
+    fs.closeSync(fd);
+    fd = undefined;
+    // Replace the final directory entry rather than following a link that
+    // appeared after the caller read or checked the previous configuration.
+    fs.renameSync(tmp, filePath);
+    created = false;
+  } finally {
+    if (fd !== undefined) fs.closeSync(fd);
+    if (created) fs.unlinkSync(tmp);
+  }
+}
+
+module.exports = { writeJsonAtomicSync };

package/src/lib/bearer-token.js

@@ -0,0 +1,11 @@
+function parseBearerToken(authorization) {
+  // Match only the prefix so an all-whitespace header cannot make two
+  // overlapping quantifiers repeatedly backtrack over the same characters.
+  const value = String(authorization || "");
+  const prefix = /^Bearer[ \t]+/i.exec(value);
+  if (!prefix) return null;
+  const token = value.slice(prefix[0].length);
+  return token && !/[\r\n]/.test(token) ? token : null;
+}
+
+module.exports = { parseBearerToken };

package/src/lib/cloud-account.js

@@ -383,6 +383,9 @@ async function fetchAccountFunction({
     if (!res || !res.ok) {
       const err = new Error(`Account fetch failed with HTTP ${res ? res.status : "?"}`);
       err.status = res ? res.status : 0;
+      const failure = res?.json ? await res.json().catch(() => ({})) : {};
+      if (typeof failure?.code === "string") err.code = failure.code;
+      if (typeof failure?.recovery_url === "string") err.recoveryUrl = failure.recovery_url;
       throw err;
     }
   const data = await res.json();
@@ -495,7 +498,7 @@ async function fetchAccountUsage({
         }
         return JSON.stringify(data);
       } catch (error) {
-        if ((error.status === 401 || error.status === 403) && sessionAtStart === sessionGeneration) {
+        if (error.status === 401 && sessionAtStart === sessionGeneration) {
           invalidateCloudAccountPayloadCache({ sessionChanged: true });
           error.invalidatedSessionGeneration = sessionGeneration;
         }