tokentracker-cli 1.4.7 → 1.4.10

package/src/lib/provider-api-key-store.js

@@ -0,0 +1,110 @@
+"use strict";
+
+// Provider API keys saved from the dashboard's Limits panel.
+//
+// The launch environment is a shared, machine-wide namespace: a
+// `launchctl setenv OPENCODE_GO_API_KEY` reaches every launchd app on the
+// machine (that is how a global key silently unlocked another app's field in
+// #837). Keys entered in the panel are therefore persisted here instead, in a
+// 0600 JSON file under the tracker data dir next to cloud-device-token.json.
+//
+// The environment variable still wins when set, so headless installs and
+// wrapper-launched apps keep working; the store is the durable default for
+// users who never touch a terminal.
+
+const fssync = require("node:fs");
+const path = require("node:path");
+const { ensureDir, writeFileAtomic, chmod600IfPossible } = require("./fs");
+
+const PROVIDER_KEY_FILES = {
+  "opencode-go": "opencode-go-api-key.json",
+  "command-code": "command-code-api-key.json",
+};
+
+const PROVIDER_ENV_NAMES = {
+  "opencode-go": "OPENCODE_GO_API_KEY",
+  "command-code": "COMMAND_CODE_API_KEY",
+};
+
+const MIN_API_KEY_LENGTH = 8;
+const MAX_API_KEY_LENGTH = 4096;
+
+function isProviderId(provider) {
+  return typeof provider === "string" && Object.prototype.hasOwnProperty.call(PROVIDER_KEY_FILES, provider);
+}
+
+function envNameForProvider(provider) {
+  return isProviderId(provider) ? PROVIDER_ENV_NAMES[provider] : null;
+}
+
+function resolveProviderKeyDir({ trackerDir, home } = {}) {
+  if (typeof trackerDir === "string" && trackerDir.trim()) return trackerDir.trim();
+  if (typeof home === "string" && home.trim()) {
+    return path.join(home.trim(), ".tokentracker", "tracker");
+  }
+  return null;
+}
+
+function resolveProviderKeyPath({ provider, trackerDir, home } = {}) {
+  if (!isProviderId(provider)) return null;
+  const dir = resolveProviderKeyDir({ trackerDir, home });
+  if (!dir) return null;
+  return path.join(dir, PROVIDER_KEY_FILES[provider]);
+}
+
+// Keys are opaque bearer tokens. Reject anything that cannot be pasted into an
+// Authorization header verbatim (internal whitespace/control characters) and
+// keep an upper bound so a mis-pasted blob cannot bloat the auth file.
+function normalizeApiKey(value) {
+  if (typeof value !== "string") return "";
+  const trimmed = value.trim();
+  if (trimmed.length < MIN_API_KEY_LENGTH || trimmed.length > MAX_API_KEY_LENGTH) return "";
+  if (/[\s\u0000-\u001f\u007f]/.test(trimmed)) return "";
+  return trimmed;
+}
+
+// Never throws: a missing, unreadable, or malformed store must degrade to
+// "no stored key" so a limits fetch can still fall back to env/cookie/CLI.
+function readStoredApiKey({ provider, trackerDir, home } = {}) {
+  const filePath = resolveProviderKeyPath({ provider, trackerDir, home });
+  if (!filePath) return "";
+  let raw;
+  try {
+    raw = fssync.readFileSync(filePath, "utf8");
+  } catch {
+    return "";
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return "";
+  }
+  return normalizeApiKey(parsed?.apiKey);
+}
+
+async function writeStoredApiKey({ provider, trackerDir, home, apiKey } = {}) {
+  const filePath = resolveProviderKeyPath({ provider, trackerDir, home });
+  if (!filePath) throw new Error("No tracker data directory available for the API key.");
+  const normalized = normalizeApiKey(apiKey);
+  if (!normalized) throw new Error("Invalid API key.");
+  await ensureDir(path.dirname(filePath));
+  const contents = `${JSON.stringify({ apiKey: normalized, updatedAt: new Date().toISOString() }, null, 2)}\n`;
+  await writeFileAtomic(filePath, contents, { mode: 0o600 });
+  // writeFileAtomic only applies `mode` to newly created files; an existing
+  // store with looser permissions must still end up private.
+  await chmod600IfPossible(filePath);
+  return filePath;
+}
+
+module.exports = {
+  PROVIDER_KEY_FILES,
+  PROVIDER_ENV_NAMES,
+  isProviderId,
+  envNameForProvider,
+  resolveProviderKeyDir,
+  resolveProviderKeyPath,
+  normalizeApiKey,
+  readStoredApiKey,
+  writeStoredApiKey,
+};

package/src/lib/rollout.js

@@ -28,6 +28,7 @@ const {
   CODEX_SERVICE_TIER_MARKER,
   readCodexServiceTier,
   isPriorityServiceTier,
+  isUltrafastServiceTier,
 } = require("./codex-service-tier");
 const {
   awaitsCompactedLine,
@@ -2649,6 +2650,7 @@ async function parseRolloutRecords({
     const bucket = getHourlyBucket(hourlyState, source, event.model, event.bucketStart);
     addTotals(bucket.totals, event.delta);
     if (isPriorityServiceTier(event.serviceTier)) addPriorityUsage(bucket.totals, event.delta);
+    if (isUltrafastServiceTier(event.serviceTier)) addUltrafastUsage(bucket.totals, event.delta);
     touchedBuckets.add(bucketKey(source, event.model, event.bucketStart));
     if (event.projectKey && projectState && projectTouchedBuckets) {
       const projectBucket = getProjectBucket(
@@ -2903,6 +2905,7 @@ async function parseRolloutRecords({
     // Only the model bucket gets the subset: the project bucket below carries
     // no model, so no per-model rate can be applied to it anyway.
     if (isPriorityServiceTier(serviceTier)) addPriorityUsage(bucket.totals, delta);
+    if (isUltrafastServiceTier(serviceTier)) addUltrafastUsage(bucket.totals, delta);
     touchedBuckets.add(bucketKey(source, model, bucketStart));
     if (currentProjectKey && projectState && projectTouchedBuckets) {
       const projectBucket = getProjectBucket(
@@ -4422,6 +4425,16 @@ const PRIORITY_SUBSET_FIELDS = [
   ["priority_reasoning_output_tokens", "reasoning_output_tokens"],
 ];
 
+const ULTRAFAST_SUBSET_FIELDS = [
+  ["ultrafast_input_tokens", "input_tokens"],
+  ["ultrafast_cached_input_tokens", "cached_input_tokens"],
+  ["ultrafast_cache_creation_input_tokens", "cache_creation_input_tokens"],
+  ["ultrafast_output_tokens", "output_tokens"],
+  ["ultrafast_reasoning_output_tokens", "reasoning_output_tokens"],
+];
+
+const SPEED_TIER_SUBSET_FIELDS = [...PRIORITY_SUBSET_FIELDS, ...ULTRAFAST_SUBSET_FIELDS];
+
 // The whole delta belongs to a priority request, so every base column it
 // carries is priority usage.
 function addPriorityUsage(target, delta) {
@@ -4431,9 +4444,16 @@ function addPriorityUsage(target, delta) {
   }
 }
 
+function addUltrafastUsage(target, delta) {
+  for (const [field, base] of ULTRAFAST_SUBSET_FIELDS) {
+    const value = Number(delta?.[base] || 0);
+    if (value > 0) target[field] = (Number(target[field]) || 0) + value;
+  }
+}
+
 function prioritySubsetOf(totals) {
   const subset = {};
-  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+  for (const [field] of SPEED_TIER_SUBSET_FIELDS) {
     const value = Number(totals?.[field]) || 0;
     if (value > 0) subset[field] = value;
   }
@@ -4441,7 +4461,7 @@ function prioritySubsetOf(totals) {
 }
 
 function addTotals(target, delta) {
-  for (const [field] of PRIORITY_SUBSET_FIELDS) {
+  for (const [field] of SPEED_TIER_SUBSET_FIELDS) {
     const value = Number(delta?.[field]) || 0;
     if (value > 0) target[field] = (Number(target[field]) || 0) + value;
   }
@@ -4511,7 +4531,11 @@ function totalsKey(totals) {
   // Appended only when a priority subset exists, so buckets that never see the
   // tier keep their previously persisted queuedKey and are not re-enqueued.
   const priority = PRIORITY_SUBSET_FIELDS.map(([field]) => Number(totals[field]) || 0);
-  return priority.some((value) => value > 0) ? `${base}|p:${priority.join(",")}` : base;
+  const ultrafast = ULTRAFAST_SUBSET_FIELDS.map(([field]) => Number(totals[field]) || 0);
+  let key = base;
+  if (priority.some((value) => value > 0)) key += `|p:${priority.join(",")}`;
+  if (ultrafast.some((value) => value > 0)) key += `|u:${ultrafast.join(",")}`;
+  return key;
 }
 
 function toUtcHalfHourStart(ts) {

package/src/lib/sentry.js

@@ -0,0 +1,231 @@
+"use strict";
+
+/**
+ * Optional Sentry error reporting for the Node CLI / EmbeddedServer runtime.
+ *
+ * Privacy contract (keep in sync with docs/PRIVACY.md and dashboard/src/lib/sentry.js):
+ * - Off unless TOKENTRACKER_SENTRY_DSN (or SENTRY_DSN) is set.
+ * - Honors the same telemetry opt-out as the daily heartbeat
+ *   (TOKENTRACKER_NO_TELEMETRY / DO_NOT_TRACK / config.json `"telemetry": false`).
+ * - Fail-closed in the node test runner.
+ * - Never intended to carry prompts, code, or provider secrets; beforeSend
+ *   scrubs common secret patterns from event payloads.
+ */
+
+const path = require("node:path");
+const pkg = require("../../package.json");
+const { readJson } = require("./fs");
+const { isTelemetryDisabled } = require("./telemetry");
+
+const SECRET_PATTERN =
+  /(?:api[_-]?key|access[_-]?token|refresh[_-]?token|cookie|secret|password|dsn)[=:\s]+["']?[^\s"'\\]{8,}/gi;
+const BEARER_PATTERN = /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g;
+
+let initialized = false;
+
+function resolveDsn(env = process.env) {
+  const raw = env?.TOKENTRACKER_SENTRY_DSN || env?.SENTRY_DSN || "";
+  return typeof raw === "string" ? raw.trim() : "";
+}
+
+function resolveEnvironment(env = process.env) {
+  const raw = typeof env?.TOKENTRACKER_SENTRY_ENVIRONMENT === "string"
+    ? env.TOKENTRACKER_SENTRY_ENVIRONMENT.trim()
+    : "";
+  if (raw) return raw;
+  if (env?.NODE_ENV === "production") return "production";
+  return "development";
+}
+
+function resolveShell(env = process.env) {
+  const raw = typeof env?.TOKENTRACKER_APP_SHELL === "string"
+    ? env.TOKENTRACKER_APP_SHELL.trim().toLowerCase()
+    : "";
+  if (raw === "macos" || raw === "windows" || raw === "linux" || raw === "cli") return raw;
+  return "cli";
+}
+
+function scrubString(value) {
+  if (typeof value !== "string" || !value) return value;
+  return value
+    .replace(BEARER_PATTERN, "Bearer [Filtered]")
+    .replace(JWT_PATTERN, "[Filtered]")
+    .replace(SECRET_PATTERN, "[Filtered]");
+}
+
+function scrubValue(value, depth = 0) {
+  if (depth > 6 || value == null) return value;
+  if (typeof value === "string") return scrubString(value);
+  if (Array.isArray(value)) return value.map((item) => scrubValue(item, depth + 1));
+  if (typeof value === "object") {
+    const out = {};
+    for (const [key, nested] of Object.entries(value)) {
+      const lower = key.toLowerCase();
+      if (
+        lower.includes("authorization") ||
+        lower.includes("cookie") ||
+        lower.includes("password") ||
+        lower.includes("secret") ||
+        lower.includes("token") ||
+        lower.includes("api_key") ||
+        lower.includes("apikey")
+      ) {
+        out[key] = "[Filtered]";
+      } else {
+        out[key] = scrubValue(nested, depth + 1);
+      }
+    }
+    return out;
+  }
+  return value;
+}
+
+function truncateMaybe(value, max = 240) {
+  if (typeof value !== "string") return value;
+  if (value.length <= max) return value;
+  return `${value.slice(0, max)}…[truncated]`;
+}
+
+function scrubEvent(event) {
+  if (!event || typeof event !== "object") return event;
+  const next = { ...event };
+  if (next.message) next.message = truncateMaybe(scrubString(next.message));
+  if (next.extra) next.extra = scrubValue(next.extra);
+  if (next.contexts) next.contexts = scrubValue(next.contexts);
+  if (next.request) next.request = scrubValue(next.request);
+  // Console breadcrumbs can carry parser / JSON.parse excerpts of local logs
+  // (prompt text). Drop them entirely; keep only non-console crumbs and scrub.
+  if (Array.isArray(next.breadcrumbs)) {
+    next.breadcrumbs = next.breadcrumbs
+      .filter((crumb) => crumb && crumb.category !== "console")
+      .map((crumb) => scrubValue(crumb));
+  }
+  if (next.exception?.values) {
+    next.exception = {
+      ...next.exception,
+      values: next.exception.values.map((item) => ({
+        ...item,
+        value: truncateMaybe(scrubString(item?.value)),
+      })),
+    };
+  }
+  // Never attach IP / user PII by default.
+  if (next.user) {
+    next.user = { id: typeof next.user.id === "string" ? next.user.id : undefined };
+  }
+  return next;
+}
+
+/**
+ * Initialise Sentry once for this process. Never throws.
+ * @returns {Promise<{ enabled: boolean, reason?: string }>}
+ */
+async function initSentry({
+  env = process.env,
+  trackerDir,
+  version = pkg.version,
+} = {}) {
+  try {
+    if (initialized) return { enabled: true, reason: "already-initialized" };
+    if (env?.NODE_TEST_CONTEXT !== undefined) {
+      return { enabled: false, reason: "test-env" };
+    }
+
+    const dsn = resolveDsn(env);
+    if (!dsn) return { enabled: false, reason: "no-dsn" };
+
+    let config = {};
+    if (trackerDir) {
+      config = (await readJson(path.join(trackerDir, "config.json"))) || {};
+    }
+    if (isTelemetryDisabled({ env, config })) {
+      return { enabled: false, reason: "opt-out" };
+    }
+
+    // Honor the same outbound proxy / fail-closed policy as the rest of the CLI.
+    // Sentry's Node transport uses node:https (not undici), so pass proxy explicitly.
+    const {
+      readPersistedProxyConfig,
+      resolveEffectiveProxySource,
+    } = require("./proxy-env");
+    const proxyConfig = readPersistedProxyConfig();
+    const proxyResolved = resolveEffectiveProxySource({ env, proxyConfig });
+    if (proxyResolved?.source === "blocked") {
+      return { enabled: false, reason: "proxy-blocked" };
+    }
+
+    // Lazy require keeps unit tests that never call init from paying the
+    // module graph cost at import time of unrelated modules.
+    const Sentry = require("@sentry/node");
+    Sentry.init({
+      dsn,
+      environment: resolveEnvironment(env),
+      release: `tokentracker@${String(version || "").trim() || "0.0.0"}`,
+      sendDefaultPii: false,
+      tracesSampleRate: 0,
+      // Errors only: drop process-session + console; replace Http so request
+      // sessions stay off (Http defaults sessions:true and bypasses beforeSend).
+      integrations(defaults) {
+        const filtered = defaults.filter((integration) => {
+          const name = integration?.name || "";
+          return name !== "ProcessSession" && name !== "Console" && name !== "Http";
+        });
+        filtered.push(Sentry.httpIntegration({ sessions: false }));
+        return filtered;
+      },
+      transportOptions: proxyResolved?.proxyUrl
+        ? { proxy: proxyResolved.proxyUrl }
+        : undefined,
+      beforeSend(event) {
+        return scrubEvent(event);
+      },
+      initialScope: {
+        tags: {
+          shell: resolveShell(env),
+          runtime: "node",
+        },
+      },
+    });
+    initialized = true;
+    return { enabled: true };
+  } catch {
+    return { enabled: false, reason: "init-failed" };
+  }
+}
+
+function captureException(error, context) {
+  if (!initialized) return;
+  try {
+    const Sentry = require("@sentry/node");
+    if (context) {
+      Sentry.withScope((scope) => {
+        if (context.tags) {
+          for (const [key, value] of Object.entries(context.tags)) {
+            scope.setTag(key, String(value));
+          }
+        }
+        if (context.extra) scope.setExtras(scrubValue(context.extra));
+        Sentry.captureException(error);
+      });
+      return;
+    }
+    Sentry.captureException(error);
+  } catch {
+    /* never break the CLI */
+  }
+}
+
+module.exports = {
+  initSentry,
+  captureException,
+  resolveDsn,
+  resolveEnvironment,
+  resolveShell,
+  scrubEvent,
+  scrubString,
+  // test helpers
+  _resetForTests() {
+    initialized = false;
+  },
+};

package/src/lib/session-analytics.js

@@ -87,7 +87,9 @@ const {
 // v23 excludes database updates and user records from request durations.
 // v24 keeps OpenCode usage dates at event time and fork history on its ancestor.
 // v25 adds Kimi wire sessions, including official/legacy migration dedup.
-const SIDECAR_VERSION = 25;
+// v26 retains Codex Ultrafast (service_tier ultrafast) subset columns so
+// date-filtered session views and cached sidecars keep the 6x premium.
+const SIDECAR_VERSION = 26;
 const EDIT_TOOLS = new Set([
   "apply_patch",
   "edit",
@@ -141,7 +143,7 @@ function addTotals(target, delta) {
     target[key] = finite(target[key]) + finite(delta?.[key]);
   }
   for (const key of MODEL_USAGE_SUM_FIELDS) {
-    if (!/^(?:long_context_|priority_)|^(?:usage_events|rerouted_usage_events)$/.test(key)) continue;
+    if (!/^(?:long_context_|priority_|ultrafast_)|^(?:usage_events|rerouted_usage_events|long_context_usage_events|priority_usage_events|ultrafast_usage_events)$/.test(key)) continue;
     if (delta?.[key]) target[key] = finite(target[key]) + finite(delta[key]);
   }
 }
@@ -179,10 +181,21 @@ const MODEL_USAGE_SUM_FIELDS = [
   "priority_long_context_cache_creation_input_tokens",
   "priority_long_context_output_tokens",
   "priority_long_context_reasoning_output_tokens",
+  "ultrafast_input_tokens",
+  "ultrafast_cached_input_tokens",
+  "ultrafast_cache_creation_input_tokens",
+  "ultrafast_output_tokens",
+  "ultrafast_reasoning_output_tokens",
+  "ultrafast_long_context_input_tokens",
+  "ultrafast_long_context_cached_input_tokens",
+  "ultrafast_long_context_cache_creation_input_tokens",
+  "ultrafast_long_context_output_tokens",
+  "ultrafast_long_context_reasoning_output_tokens",
   "usage_events",
   "rerouted_usage_events",
   "long_context_usage_events",
   "priority_usage_events",
+  "ultrafast_usage_events",
   // Not a token counter: an edit turn is a turn, and turn_context both marks
   // where a turn begins and names its model, so an edit turn has exactly one
   // owner. Splitting it here keeps by_model.tokens_per_edit a ratio over one

package/src/lib/static-server.js

@@ -33,11 +33,22 @@ async function serveStaticFile(baseDir, pathname, res, { localRuntimeConfig = fa
   // prevent directory traversal
   if (!filePath.startsWith(baseDir)) return false;
 
+  // Watch for the client going away from the start: if the browser cancels the
+  // request during the awaits below, "close" fires before the stream exists and
+  // a listener added later never runs, leaking the FileHandle (fatal on Node 25+).
+  let clientGone = res.destroyed;
+  let stream = null;
+  res.once("close", () => {
+    clientGone = true;
+    if (stream) stream.destroy();
+  });
+
   let handle;
   try {
     handle = await fsPromises.open(filePath, "r");
     const stat = await handle.stat();
     if (!stat.isFile()) return false;
+    if (clientGone) return true; // finally closes the handle
 
     const ext = path.extname(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] || "application/octet-stream";
@@ -47,21 +58,23 @@ async function serveStaticFile(baseDir, pathname, res, { localRuntimeConfig = fa
       const source = await handle.readFile("utf8");
       const content = source.replace(/<head(?:\s[^>]*)?>/i,
         "$&\n<script>window.__TOKENTRACKER_RUNTIME_CONFIG__={configurationError:\"runtime_config_unavailable\"};</script>\n<script src=\"/api/runtime-config.js\"></script>");
+      if (clientGone) return true;
       res.writeHead(200, { "Content-Type": contentType, "Content-Length": Buffer.byteLength(content), "Cache-Control": "no-store" });
       res.end(content);
       return true;
     }
 
+    if (clientGone) return true;
+
     res.writeHead(200, {
       "Content-Type": contentType,
       "Content-Length": stat.size,
       "Cache-Control": isHtml ? "no-cache" : "public, max-age=31536000, immutable",
     });
 
-    const stream = handle.createReadStream();
+    stream = handle.createReadStream();
     handle = null; // The stream owns and closes this descriptor.
     stream.on("error", (error) => res.destroy(error));
-    res.on("close", () => stream.destroy());
     stream.pipe(res);
     return true;
   } catch (_e) {