tokentracker-cli 1.4.6 → 1.4.9

package/src/lib/provider-api-key-store.js

@@ -0,0 +1,110 @@
+"use strict";
+
+// Provider API keys saved from the dashboard's Limits panel.
+//
+// The launch environment is a shared, machine-wide namespace: a
+// `launchctl setenv OPENCODE_GO_API_KEY` reaches every launchd app on the
+// machine (that is how a global key silently unlocked another app's field in
+// #837). Keys entered in the panel are therefore persisted here instead, in a
+// 0600 JSON file under the tracker data dir next to cloud-device-token.json.
+//
+// The environment variable still wins when set, so headless installs and
+// wrapper-launched apps keep working; the store is the durable default for
+// users who never touch a terminal.
+
+const fssync = require("node:fs");
+const path = require("node:path");
+const { ensureDir, writeFileAtomic, chmod600IfPossible } = require("./fs");
+
+const PROVIDER_KEY_FILES = {
+  "opencode-go": "opencode-go-api-key.json",
+  "command-code": "command-code-api-key.json",
+};
+
+const PROVIDER_ENV_NAMES = {
+  "opencode-go": "OPENCODE_GO_API_KEY",
+  "command-code": "COMMAND_CODE_API_KEY",
+};
+
+const MIN_API_KEY_LENGTH = 8;
+const MAX_API_KEY_LENGTH = 4096;
+
+function isProviderId(provider) {
+  return typeof provider === "string" && Object.prototype.hasOwnProperty.call(PROVIDER_KEY_FILES, provider);
+}
+
+function envNameForProvider(provider) {
+  return isProviderId(provider) ? PROVIDER_ENV_NAMES[provider] : null;
+}
+
+function resolveProviderKeyDir({ trackerDir, home } = {}) {
+  if (typeof trackerDir === "string" && trackerDir.trim()) return trackerDir.trim();
+  if (typeof home === "string" && home.trim()) {
+    return path.join(home.trim(), ".tokentracker", "tracker");
+  }
+  return null;
+}
+
+function resolveProviderKeyPath({ provider, trackerDir, home } = {}) {
+  if (!isProviderId(provider)) return null;
+  const dir = resolveProviderKeyDir({ trackerDir, home });
+  if (!dir) return null;
+  return path.join(dir, PROVIDER_KEY_FILES[provider]);
+}
+
+// Keys are opaque bearer tokens. Reject anything that cannot be pasted into an
+// Authorization header verbatim (internal whitespace/control characters) and
+// keep an upper bound so a mis-pasted blob cannot bloat the auth file.
+function normalizeApiKey(value) {
+  if (typeof value !== "string") return "";
+  const trimmed = value.trim();
+  if (trimmed.length < MIN_API_KEY_LENGTH || trimmed.length > MAX_API_KEY_LENGTH) return "";
+  if (/[\s\u0000-\u001f\u007f]/.test(trimmed)) return "";
+  return trimmed;
+}
+
+// Never throws: a missing, unreadable, or malformed store must degrade to
+// "no stored key" so a limits fetch can still fall back to env/cookie/CLI.
+function readStoredApiKey({ provider, trackerDir, home } = {}) {
+  const filePath = resolveProviderKeyPath({ provider, trackerDir, home });
+  if (!filePath) return "";
+  let raw;
+  try {
+    raw = fssync.readFileSync(filePath, "utf8");
+  } catch {
+    return "";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return "";
+  }
+  return normalizeApiKey(parsed?.apiKey);
+}
+
+async function writeStoredApiKey({ provider, trackerDir, home, apiKey } = {}) {
+  const filePath = resolveProviderKeyPath({ provider, trackerDir, home });
+  if (!filePath) throw new Error("No tracker data directory available for the API key.");
+  const normalized = normalizeApiKey(apiKey);
+  if (!normalized) throw new Error("Invalid API key.");
+  await ensureDir(path.dirname(filePath));
+  const contents = `${JSON.stringify({ apiKey: normalized, updatedAt: new Date().toISOString() }, null, 2)}\n`;
+  await writeFileAtomic(filePath, contents, { mode: 0o600 });
+  // writeFileAtomic only applies `mode` to newly created files; an existing
+  // store with looser permissions must still end up private.
+  await chmod600IfPossible(filePath);
+  return filePath;
+}
+
+module.exports = {
+  PROVIDER_KEY_FILES,
+  PROVIDER_ENV_NAMES,
+  isProviderId,
+  envNameForProvider,
+  resolveProviderKeyDir,
+  resolveProviderKeyPath,
+  normalizeApiKey,
+  readStoredApiKey,
+  writeStoredApiKey,
+};

package/src/lib/rollout.js

@@ -28,6 +28,7 @@ const {
   CODEX_SERVICE_TIER_MARKER,
   readCodexServiceTier,
   isPriorityServiceTier,
+  isUltrafastServiceTier,
 } = require("./codex-service-tier");
 const {
   awaitsCompactedLine,
@@ -2649,6 +2650,7 @@ async function parseRolloutRecords({
     const bucket = getHourlyBucket(hourlyState, source, event.model, event.bucketStart);
     addTotals(bucket.totals, event.delta);
     if (isPriorityServiceTier(event.serviceTier)) addPriorityUsage(bucket.totals, event.delta);
+    if (isUltrafastServiceTier(event.serviceTier)) addUltrafastUsage(bucket.totals, event.delta);
     touchedBuckets.add(bucketKey(source, event.model, event.bucketStart));
     if (event.projectKey && projectState && projectTouchedBuckets) {
       const projectBucket = getProjectBucket(
@@ -2903,6 +2905,7 @@ async function parseRolloutRecords({
     // Only the model bucket gets the subset: the project bucket below carries
     // no model, so no per-model rate can be applied to it anyway.
     if (isPriorityServiceTier(serviceTier)) addPriorityUsage(bucket.totals, delta);
+    if (isUltrafastServiceTier(serviceTier)) addUltrafastUsage(bucket.totals, delta);
     touchedBuckets.add(bucketKey(source, model, bucketStart));
     if (currentProjectKey && projectState && projectTouchedBuckets) {
       const projectBucket = getProjectBucket(
@@ -4422,6 +4425,16 @@ const PRIORITY_SUBSET_FIELDS = [
   ["priority_reasoning_output_tokens", "reasoning_output_tokens"],
 ];
 
+const ULTRAFAST_SUBSET_FIELDS = [
+  ["ultrafast_input_tokens", "input_tokens"],
+  ["ultrafast_cached_input_tokens", "cached_input_tokens"],
+  ["ultrafast_cache_creation_input_tokens", "cache_creation_input_tokens"],
+  ["ultrafast_output_tokens", "output_tokens"],
+  ["ultrafast_reasoning_output_tokens", "reasoning_output_tokens"],
+];
+
+const SPEED_TIER_SUBSET_FIELDS = [...PRIORITY_SUBSET_FIELDS, ...ULTRAFAST_SUBSET_FIELDS];
+
 // The whole delta belongs to a priority request, so every base column it
 // carries is priority usage.
 function addPriorityUsage(target, delta) {
@@ -4431,9 +4444,16 @@ function addPriorityUsage(target, delta) {
   }
 }
 
+function addUltrafastUsage(target, delta) {
+  for (const [field, base] of ULTRAFAST_SUBSET_FIELDS) {
+    const value = Number(delta?.[base] || 0);
+    if (value > 0) target[field] = (Number(target[field]) || 0) + value;
+  }
+}
+
 function prioritySubsetOf(totals) {
   const subset = {};
-  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+  for (const [field] of SPEED_TIER_SUBSET_FIELDS) {
     const value = Number(totals?.[field]) || 0;
     if (value > 0) subset[field] = value;
   }
@@ -4441,7 +4461,7 @@ function prioritySubsetOf(totals) {
 }
 
 function addTotals(target, delta) {
-  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+  for (const [field] of SPEED_TIER_SUBSET_FIELDS) {
     const value = Number(delta?.[field]) || 0;
     if (value > 0) target[field] = (Number(target[field]) || 0) + value;
   }
@@ -4511,7 +4531,11 @@ function totalsKey(totals) {
   // Appended only when a priority subset exists, so buckets that never see the
   // tier keep their previously persisted queuedKey and are not re-enqueued.
   const priority = PRIORITY_SUBSET_FIELDS.map(([field]) => Number(totals[field]) || 0);
-  return priority.some((value) => value > 0) ? `${base}|p:${priority.join(",")}` : base;
+  const ultrafast = ULTRAFAST_SUBSET_FIELDS.map(([field]) => Number(totals[field]) || 0);
+  let key = base;
+  if (priority.some((value) => value > 0)) key += `|p:${priority.join(",")}`;
+  if (ultrafast.some((value) => value > 0)) key += `|u:${ultrafast.join(",")}`;
+  return key;
 }
 
 function toUtcHalfHourStart(ts) {

package/src/lib/sentry.js

@@ -0,0 +1,231 @@
+"use strict";
+
+/**
+ * Optional Sentry error reporting for the Node CLI / EmbeddedServer runtime.
+ *
+ * Privacy contract (keep in sync with docs/PRIVACY.md and dashboard/src/lib/sentry.js):
+ * - Off unless TOKENTRACKER_SENTRY_DSN (or SENTRY_DSN) is set.
+ * - Honors the same telemetry opt-out as the daily heartbeat
+ *   (TOKENTRACKER_NO_TELEMETRY / DO_NOT_TRACK / config.json `"telemetry": false`).
+ * - Fail-closed in the node test runner.
+ * - Never intended to carry prompts, code, or provider secrets; beforeSend
+ *   scrubs common secret patterns from event payloads.
+ */
+
+const path = require("node:path");
+const pkg = require("../../package.json");
+const { readJson } = require("./fs");
+const { isTelemetryDisabled } = require("./telemetry");
+
+const SECRET_PATTERN =
+  /(?:api[_-]?key|access[_-]?token|refresh[_-]?token|cookie|secret|password|dsn)[=:\s]+["']?[^\s"'\\]{8,}/gi;
+const BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g;
+
+let initialized = false;
+
+function resolveDsn(env = process.env) {
+  const raw = env?.TOKENTRACKER_SENTRY_DSN || env?.SENTRY_DSN || "";
+  return typeof raw === "string" ? raw.trim() : "";
+}
+
+function resolveEnvironment(env = process.env) {
+  const raw = typeof env?.TOKENTRACKER_SENTRY_ENVIRONMENT === "string"
+    ? env.TOKENTRACKER_SENTRY_ENVIRONMENT.trim()
+    : "";
+  if (raw) return raw;
+  if (env?.NODE_ENV === "production") return "production";
+  return "development";
+}
+
+function resolveShell(env = process.env) {
+  const raw = typeof env?.TOKENTRACKER_APP_SHELL === "string"
+    ? env.TOKENTRACKER_APP_SHELL.trim().toLowerCase()
+    : "";
+  if (raw === "macos" || raw === "windows" || raw === "linux" || raw === "cli") return raw;
+  return "cli";
+}
+
+function scrubString(value) {
+  if (typeof value !== "string" || !value) return value;
+  return value
+    .replace(BEARER_PATTERN, "Bearer [Filtered]")
+    .replace(JWT_PATTERN, "[Filtered]")
+    .replace(SECRET_PATTERN, "[Filtered]");
+}
+
+function scrubValue(value, depth = 0) {
+  if (depth > 6 || value == null) return value;
+  if (typeof value === "string") return scrubString(value);
+  if (Array.isArray(value)) return value.map((item) => scrubValue(item, depth + 1));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+      const lower = key.toLowerCase();
+      if (
+        lower.includes("authorization") ||
+        lower.includes("cookie") ||
+        lower.includes("password") ||
+        lower.includes("secret") ||
+        lower.includes("token") ||
+        lower.includes("api_key") ||
+        lower.includes("apikey")
+      ) {
+        out[key] = "[Filtered]";
+      } else {
+        out[key] = scrubValue(nested, depth + 1);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+
+function truncateMaybe(value, max = 240) {
+  if (typeof value !== "string") return value;
+  if (value.length <= max) return value;
+  return `${value.slice(0, max)}…[truncated]`;
+}
+
+function scrubEvent(event) {
+  if (!event || typeof event !== "object") return event;
+  const next = { ...event };
+  if (next.message) next.message = truncateMaybe(scrubString(next.message));
+  if (next.extra) next.extra = scrubValue(next.extra);
+  if (next.contexts) next.contexts = scrubValue(next.contexts);
+  if (next.request) next.request = scrubValue(next.request);
+  // Console breadcrumbs can carry parser / JSON.parse excerpts of local logs
+  // (prompt text). Drop them entirely; keep only non-console crumbs and scrub.
+  if (Array.isArray(next.breadcrumbs)) {
+    next.breadcrumbs = next.breadcrumbs
+      .filter((crumb) => crumb && crumb.category !== "console")
+      .map((crumb) => scrubValue(crumb));
+  }
+  if (next.exception?.values) {
+    next.exception = {
+      ...next.exception,
+      values: next.exception.values.map((item) => ({
+        ...item,
+        value: truncateMaybe(scrubString(item?.value)),
+      })),
+    };
+  }
+  // Never attach IP / user PII by default.
+  if (next.user) {
+    next.user = { id: typeof next.user.id === "string" ? next.user.id : undefined };
+  }
+  return next;
+}
+
+/**
+ * Initialise Sentry once for this process. Never throws.
+ * @returns {Promise<{ enabled: boolean, reason?: string }>}
+ */
+async function initSentry({
+  env = process.env,
+  trackerDir,
+  version = pkg.version,
+} = {}) {
+  try {
+    if (initialized) return { enabled: true, reason: "already-initialized" };
+    if (env?.NODE_TEST_CONTEXT !== undefined) {
+      return { enabled: false, reason: "test-env" };
+    }
+
+    const dsn = resolveDsn(env);
+    if (!dsn) return { enabled: false, reason: "no-dsn" };
+
+    let config = {};
+    if (trackerDir) {
+      config = (await readJson(path.join(trackerDir, "config.json"))) || {};
+    }
+    if (isTelemetryDisabled({ env, config })) {
+      return { enabled: false, reason: "opt-out" };
+    }
+
+    // Honor the same outbound proxy / fail-closed policy as the rest of the CLI.
+    // Sentry's Node transport uses node:https (not undici), so pass proxy explicitly.
+    const {
+      readPersistedProxyConfig,
+      resolveEffectiveProxySource,
+    } = require("./proxy-env");
+    const proxyConfig = readPersistedProxyConfig();
+    const proxyResolved = resolveEffectiveProxySource({ env, proxyConfig });
+    if (proxyResolved?.source === "blocked") {
+      return { enabled: false, reason: "proxy-blocked" };
+    }
+
+    // Lazy require keeps unit tests that never call init from paying the
+    // module graph cost at import time of unrelated modules.
+    const Sentry = require("@sentry/node");
+    Sentry.init({
+      dsn,
+      environment: resolveEnvironment(env),
+      release: `tokentracker@${String(version || "").trim() || "0.0.0"}`,
+      sendDefaultPii: false,
+      tracesSampleRate: 0,
+      // Errors only: drop process-session + console; replace Http so request
+      // sessions stay off (Http defaults sessions:true and bypasses beforeSend).
+      integrations(defaults) {
+        const filtered = defaults.filter((integration) => {
+          const name = integration?.name || "";
+          return name !== "ProcessSession" && name !== "Console" && name !== "Http";
+        });
+        filtered.push(Sentry.httpIntegration({ sessions: false }));
+        return filtered;
+      },
+      transportOptions: proxyResolved?.proxyUrl
+        ? { proxy: proxyResolved.proxyUrl }
+        : undefined,
+      beforeSend(event) {
+        return scrubEvent(event);
+      },
+      initialScope: {
+        tags: {
+          shell: resolveShell(env),
+          runtime: "node",
+        },
+      },
+    });
+    initialized = true;
+    return { enabled: true };
+  } catch {
+    return { enabled: false, reason: "init-failed" };
+  }
+}
+
+function captureException(error, context) {
+  if (!initialized) return;
+  try {
+    const Sentry = require("@sentry/node");
+    if (context) {
+      Sentry.withScope((scope) => {
+        if (context.tags) {
+          for (const [key, value] of Object.entries(context.tags)) {
+            scope.setTag(key, String(value));
+          }
+        }
+        if (context.extra) scope.setExtras(scrubValue(context.extra));
+        Sentry.captureException(error);
+      });
+      return;
+    }
+    Sentry.captureException(error);
+  } catch {
+    /* never break the CLI */
+  }
+}
+
+module.exports = {
+  initSentry,
+  captureException,
+  resolveDsn,
+  resolveEnvironment,
+  resolveShell,
+  scrubEvent,
+  scrubString,
+  // test helpers
+  _resetForTests() {
+    initialized = false;
+  },
+};

package/src/lib/session-analytics.js

@@ -87,7 +87,9 @@ const {
 // v23 excludes database updates and user records from request durations.
 // v24 keeps OpenCode usage dates at event time and fork history on its ancestor.
 // v25 adds Kimi wire sessions, including official/legacy migration dedup.
-const SIDECAR_VERSION = 25;
+// v26 retains Codex Ultrafast (service_tier ultrafast) subset columns so
+// date-filtered session views and cached sidecars keep the 6x premium.
+const SIDECAR_VERSION = 26;
 const EDIT_TOOLS = new Set([
   "apply_patch",
   "edit",
@@ -141,7 +143,7 @@ function addTotals(target, delta) {
     target[key] = finite(target[key]) + finite(delta?.[key]);
   }
   for (const key of MODEL_USAGE_SUM_FIELDS) {
-    if (!/^(?:long_context_|priority_)|^(?:usage_events|rerouted_usage_events)$/.test(key)) continue;
+    if (!/^(?:long_context_|priority_|ultrafast_)|^(?:usage_events|rerouted_usage_events|long_context_usage_events|priority_usage_events|ultrafast_usage_events)$/.test(key)) continue;
     if (delta?.[key]) target[key] = finite(target[key]) + finite(delta[key]);
   }
 }
@@ -179,10 +181,21 @@ const MODEL_USAGE_SUM_FIELDS = [
   "priority_long_context_cache_creation_input_tokens",
   "priority_long_context_output_tokens",
   "priority_long_context_reasoning_output_tokens",
+  "ultrafast_input_tokens",
+  "ultrafast_cached_input_tokens",
+  "ultrafast_cache_creation_input_tokens",
+  "ultrafast_output_tokens",
+  "ultrafast_reasoning_output_tokens",
+  "ultrafast_long_context_input_tokens",
+  "ultrafast_long_context_cached_input_tokens",
+  "ultrafast_long_context_cache_creation_input_tokens",
+  "ultrafast_long_context_output_tokens",
+  "ultrafast_long_context_reasoning_output_tokens",
   "usage_events",
   "rerouted_usage_events",
   "long_context_usage_events",
   "priority_usage_events",
+  "ultrafast_usage_events",
   // Not a token counter: an edit turn is a turn, and turn_context both marks
   // where a turn begins and names its model, so an edit turn has exactly one
   // owner. Splitting it here keeps by_model.tokens_per_edit a ratio over one

package/src/lib/static-server.js

@@ -33,11 +33,22 @@ async function serveStaticFile(baseDir, pathname, res, { localRuntimeConfig = fa
   // prevent directory traversal
   if (!filePath.startsWith(baseDir)) return false;
 
+  // Watch for the client going away from the start: if the browser cancels the
+  // request during the awaits below, "close" fires before the stream exists and
+  // a listener added later never runs, leaking the FileHandle (fatal on Node 25+).
+  let clientGone = res.destroyed;
+  let stream = null;
+  res.once("close", () => {
+    clientGone = true;
+    if (stream) stream.destroy();
+  });
+
   let handle;
   try {
     handle = await fsPromises.open(filePath, "r");
     const stat = await handle.stat();
     if (!stat.isFile()) return false;
+    if (clientGone) return true; // finally closes the handle
 
     const ext = path.extname(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] || "application/octet-stream";
@@ -47,21 +58,23 @@ async function serveStaticFile(baseDir, pathname, res, { localRuntimeConfig = fa
       const source = await handle.readFile("utf8");
       const content = source.replace(/<head(?:\s[^>]*)?>/i,
         "$&\n<script>window.__TOKENTRACKER_RUNTIME_CONFIG__={configurationError:\"runtime_config_unavailable\"};</script>\n<script src=\"/api/runtime-config.js\"></script>");
+      if (clientGone) return true;
       res.writeHead(200, { "Content-Type": contentType, "Content-Length": Buffer.byteLength(content), "Cache-Control": "no-store" });
       res.end(content);
       return true;
     }
 
+    if (clientGone) return true;
+
     res.writeHead(200, {
       "Content-Type": contentType,
       "Content-Length": stat.size,
       "Cache-Control": isHtml ? "no-cache" : "public, max-age=31536000, immutable",
     });
 
-    const stream = handle.createReadStream();
+    stream = handle.createReadStream();
     handle = null; // The stream owns and closes this descriptor.
     stream.on("error", (error) => res.destroy(error));
-    res.on("close", () => stream.destroy());
     stream.pipe(res);
     return true;
   } catch (_e) {

package/src/lib/usage-limits.js

@@ -56,6 +56,10 @@ const execFileAsync = promisify(cp.execFile);
 const USAGE_LIMITS_SELECTION_KEYS = ["off-on", "off-off", "on-on", "on-off"];
 const cacheBySelection = {};
 for (const key of USAGE_LIMITS_SELECTION_KEYS) cacheBySelection[key] = { data: null, expiresAtMs: 0 };
+// Credential replacements (provider-key save) bump this generation so a fetch
+// that started under the old credential cannot repopulate the memory or disk
+// caches after invalidation.
+let usageLimitsCacheGeneration = 0;
 function usageLimitsSelectionKey(options) {
   const devin = options?.devinEnabled === true ? "on" : "off";
   const antigravity = isAntigravityQuotaDisabled() ? "off" : "on";
@@ -2603,8 +2607,12 @@ function writeCodexLimitsCache(limits, { home, nowMs = Date.now() } = {}) {
   } catch (_error) {}
 }
 
-function resolveOpencodeGoLimitsCachePath({ home } = {}) {
-  return path.join(home || os.homedir(), ".tokentracker", "tracker", OPENCODE_GO_LIMITS_CACHE_FILE);
+function resolveOpencodeGoLimitsCachePath({ trackerDir, home } = {}) {
+  const dir =
+    typeof trackerDir === "string" && trackerDir.trim()
+      ? trackerDir.trim()
+      : path.join(home || os.homedir(), ".tokentracker", "tracker");
+  return path.join(dir, OPENCODE_GO_LIMITS_CACHE_FILE);
 }
 
 function hasOpencodeGoWindow(limits) {
@@ -2632,10 +2640,15 @@ function normalizeOpencodeGoCachedLimits(
   if (cachedAtMs > nowMs + 60_000) return null;
   if (nowMs - cachedAtMs > effectiveMaxAge) return null;
 
+  const credentialSource =
+    raw?.credential_source === "env" || raw?.credential_source === "stored"
+      ? raw.credential_source
+      : null;
   const cached = {
     configured: true,
     error: null,
     source: typeof raw?.source === "string" ? raw.source : "api",
+    credential_source: credentialSource,
     subscription_status: typeof raw?.subscription_status === "string" ? raw.subscription_status : null,
     plan_label: typeof raw?.plan_label === "string" ? raw.plan_label : null,
     primary_window: isOpencodeGoCacheWindowUsable(raw?.primary_window, { nowMs }) ? raw.primary_window : null,
@@ -2647,8 +2660,8 @@ function normalizeOpencodeGoCachedLimits(
   return hasOpencodeGoWindow(cached) ? cached : null;
 }
 
-function readOpencodeGoLimitsCache({ home, nowMs = Date.now() } = {}) {
-  const cachePath = resolveOpencodeGoLimitsCachePath({ home });
+function readOpencodeGoLimitsCache({ trackerDir, home, nowMs = Date.now() } = {}) {
+  const cachePath = resolveOpencodeGoLimitsCachePath({ trackerDir, home });
   try {
     const parsed = JSON.parse(fs.readFileSync(cachePath, "utf8"));
     return normalizeOpencodeGoCachedLimits(parsed?.opencodeGo, { nowMs });
@@ -2657,12 +2670,17 @@ function readOpencodeGoLimitsCache({ home, nowMs = Date.now() } = {}) {
   }
 }
 
-function writeOpencodeGoLimitsCache(limits, { home, nowMs = Date.now() } = {}) {
+function writeOpencodeGoLimitsCache(limits, { trackerDir, home, nowMs = Date.now() } = {}) {
   if (!limits?.configured || limits.error || !hasOpencodeGoWindow(limits)) return;
-  const cachePath = resolveOpencodeGoLimitsCachePath({ home });
+  const cachePath = resolveOpencodeGoLimitsCachePath({ trackerDir, home });
+  const credentialSource =
+    limits.credential_source === "env" || limits.credential_source === "stored"
+      ? limits.credential_source
+      : null;
   const payload = {
     opencodeGo: {
       source: limits.source || "api",
+      credential_source: credentialSource,
       subscription_status: limits.subscription_status || null,
       plan_label: limits.plan_label || null,
       primary_window: limits.primary_window || null,
@@ -3989,7 +4007,12 @@ async function getUsageLimits(options = {}) {
   if (inFlightBySelection[selection]) {
     return inFlightBySelection[selection];
   }
-  const promise = fetchUsageLimitsUncached({ ...options, selectionKey: selection }).finally(() => {
+  const cacheGeneration = usageLimitsCacheGeneration;
+  const promise = fetchUsageLimitsUncached({
+    ...options,
+    selectionKey: selection,
+    cacheGeneration,
+  }).finally(() => {
     if (inFlightBySelection[selection] === promise) inFlightBySelection[selection] = null;
   });
   inFlightBySelection[selection] = promise;
@@ -4002,6 +4025,7 @@ async function getUsageLimits(options = {}) {
  */
 async function fetchUsageLimitsUncached({
   home,
+  trackerDir,
   env,
   platform,
   securityRunner,
@@ -4013,6 +4037,10 @@ async function fetchUsageLimitsUncached({
   providerTimeoutMs = DEFAULT_PROVIDER_TIMEOUT_MS,
   forceRefresh = false,
   devinEnabled = false,
+  // Generation captured by getUsageLimits before the fetch began. A provider
+  // key save bumps it, and this fetch must then stop at returning its own
+  // result: publishing it would restore pre-save data for every later caller.
+  cacheGeneration = usageLimitsCacheGeneration,
   // Selection key fixed by getUsageLimits before the fetch began. Re-deriving it
   // here would let an opt-out flipped mid-fetch store a pre-opt-out result in the
   // post-opt-out slot.
@@ -4131,7 +4159,7 @@ async function fetchUsageLimitsUncached({
     // OpenCode Go: authoritative subscription windows come from the dashboard
     // scrape; local opencode.db cost is available only as an explicit estimate.
     // See src/lib/opencode-go-limits.js.
-    withProviderTimeout(fetchOpencodeGoLimits({ home, env, fetchImpl: providerFetch }), "OpenCode Go", providerTimeoutMs)
+    withProviderTimeout(fetchOpencodeGoLimits({ home, trackerDir, env, fetchImpl: providerFetch }), "OpenCode Go", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
     withProviderTimeout(
       fetchQoderLimits({
@@ -4189,7 +4217,7 @@ async function fetchUsageLimitsUncached({
     // outer race bounds the whole slot: without it three sequential per-request
     // timeouts (whoami, then credits+subscriptions) could hold the aggregate
     // ~2x longer than any sibling provider.
-    withProviderTimeout(fetchCommandcodeLimits({ home, env, fetchImpl: providerFetch }), "CommandCode", providerTimeoutMs)
+    withProviderTimeout(fetchCommandcodeLimits({ home, trackerDir, env, fetchImpl: providerFetch }), "CommandCode", providerTimeoutMs)
       .then(
         (value) => ({ status: "fulfilled", value }),
         (reason) => ({ status: "rejected", reason }),
@@ -4382,9 +4410,11 @@ async function fetchUsageLimitsUncached({
       stale: false,
       cached_at: new Date(nowMs).toISOString(),
     };
-    writeOpencodeGoLimitsCache(opencodeGo, { home, nowMs });
+    if (cacheGeneration === usageLimitsCacheGeneration) {
+      writeOpencodeGoLimitsCache(opencodeGo, { trackerDir, home, nowMs });
+    }
   } else {
-    const cached = readOpencodeGoLimitsCache({ home, nowMs });
+    const cached = readOpencodeGoLimitsCache({ trackerDir, home, nowMs });
     if (cached) {
       opencodeGo = cached;
     } else {
@@ -4491,16 +4521,22 @@ async function fetchUsageLimitsUncached({
     };
   }
 
-  cacheBySelection[selectionKey || usageLimitsSelectionKey({ devinEnabled })] = {
-    data,
-    expiresAtMs: cacheExpiresAtMs(data, nowMs),
-  };
+  if (cacheGeneration === usageLimitsCacheGeneration) {
+    cacheBySelection[selectionKey || usageLimitsSelectionKey({ devinEnabled })] = {
+      data,
+      expiresAtMs: cacheExpiresAtMs(data, nowMs),
+    };
+  }
   return data;
 }
 
-function resetUsageLimitsCache() {
+function resetUsageLimitsCache({ invalidateInFlight = false } = {}) {
+  if (invalidateInFlight) usageLimitsCacheGeneration += 1;
   for (const key of USAGE_LIMITS_SELECTION_KEYS) {
     cacheBySelection[key] = { data: null, expiresAtMs: 0 };
+    // Ordinary resets still let a running fetch serve refresh=1 callers; a
+    // credential replacement must not, so drop the old-key promises too.
+    if (invalidateInFlight) inFlightBySelection[key] = null;
   }
 }
 
@@ -4508,6 +4544,8 @@ module.exports = {
   getUsageLimits,
   normalizePlanLabel,
   resetUsageLimitsCache,
+  OPENCODE_GO_LIMITS_CACHE_FILE,
+  resolveOpencodeGoLimitsCachePath,
   cacheExpiresAtMs,
   runCommand,
   extractGeminiOauthClientCredentials,