tokentracker-cli 1.5.14 → 1.5.16

package/src/lib/ark-agent-plan-limits.js

@@ -26,6 +26,7 @@ const os = require("node:os");
 const path = require("node:path");
 
 const { runCommand, resolveBinaryPath, statBinaryInDirs, commonGlobalBinDirectories, resolvedCliEnvironment } = require("./command-runner");
+const { createLimitsCache } = require("./limits-cache");
 
 const ARK_LIMITS_CACHE_FILE = "ark-agent-plan-limits-cache.json";
 const ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
@@ -188,68 +189,38 @@ function normalizeArkAgentPlanResponse(body) {
 // Alias for shared shape
 const normalizeArkCodingPlanResponse = normalizeArkAgentPlanResponse;
 
+// Deliberately fail-open on identity: the guard only applies when `profile
+// show` could establish the current identity — when it also failed, serving
+// the stale cache beats erroring out (availability over strictness). There is
+// no global max-age: dated windows are bounded by their own reset stamp and
+// undated ones by the 12h unknown-reset TTL.
+const arkLimitsCache = createLimitsCache({
+  file: ARK_LIMITS_CACHE_FILE,
+  key: null,
+  maxAgeMs: null,
+  unknownResetTtlMs: ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS,
+  fields: { plan_label: "string", product: "string", profile_identity: "string" },
+  windowKeys: ["primary_window", "secondary_window", "tertiary_window"],
+  identityField: "profile_identity",
+  identityRequired: false,
+  // The normalizer throws when no periods survive, so the write guard skips
+  // the window check the other providers need.
+  writeGuard: (record) => Boolean(record?.configured) && !record.error,
+  cachedFlag: true,
+  stale: true,
+  source: { const: "disk-cache" },
+});
+
 function arkAgentPlanCachePath({ home = os.homedir() } = {}) {
-  return path.join(home, ".tokentracker", "tracker", ARK_LIMITS_CACHE_FILE);
+  return arkLimitsCache.path({ home });
 }
 
 function readArkAgentPlanLimitsCache({ home = os.homedir(), nowMs = Date.now(), profileIdentity } = {}) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(arkAgentPlanCachePath({ home }), "utf8"));
-    if (profileIdentity && parsed?.profile_identity !== profileIdentity) return null;
-    const cachedAtMs = Date.parse(parsed?.cached_at || "");
-    if (!Number.isFinite(cachedAtMs) || cachedAtMs > nowMs + 60_000) return null;
-    const windows = [parsed?.primary_window, parsed?.secondary_window, parsed?.tertiary_window];
-    const surviving = windows.map((window) => {
-      if (!window) return null;
-      const resetAtMs = Date.parse(window.reset_at || "");
-      if (Number.isFinite(resetAtMs) && resetAtMs <= nowMs) return null;
-      return window;
-    });
-    if (surviving.every((window) => !window)) return null;
-    const bounded = surviving.map((window) => {
-      if (!window) return null;
-      return Number.isFinite(Date.parse(window.reset_at || ""))
-        || nowMs - cachedAtMs <= ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS
-        ? window
-        : null;
-    });
-    if (bounded.every((window) => !window)) return null;
-    return {
-      configured: true,
-      error: null,
-      plan_label: typeof parsed?.plan_label === "string" ? parsed.plan_label : null,
-      product: typeof parsed?.product === "string" ? parsed.product : null,
-      primary_window: bounded[0],
-      secondary_window: bounded[1],
-      tertiary_window: bounded[2],
-      cached: true,
-      stale: true,
-      cached_at: parsed.cached_at,
-      source: "disk-cache",
-    };
-  } catch (_error) {
-    return null;
-  }
+  return arkLimitsCache.read({ home, nowMs, identity: profileIdentity });
 }
 
 function writeArkAgentPlanLimitsCache(limits, { home = os.homedir(), nowMs = Date.now() } = {}) {
-  if (!limits?.configured || limits.error) return;
-  const cachePath = arkAgentPlanCachePath({ home });
-  const payload = {
-    plan_label: limits.plan_label || null,
-    product: limits.product || null,
-    profile_identity: limits.profile_identity || null,
-    primary_window: limits.primary_window || null,
-    secondary_window: limits.secondary_window || null,
-    tertiary_window: limits.tertiary_window || null,
-    cached_at: new Date(nowMs).toISOString(),
-  };
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    const tmpPath = `${cachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
-    fs.renameSync(tmpPath, cachePath);
-  } catch (_error) {}
+  arkLimitsCache.write(limits, { home, nowMs });
 }
 
 function hasArkCliInstallEvidence({ home = os.homedir(), platform = process.platform } = {}) {

package/src/lib/ark-coding-plan-limits.js

@@ -26,6 +26,7 @@ const os = require("node:os");
 const path = require("node:path");
 
 const { runCommand, resolveBinaryPath, statBinaryInDirs, commonGlobalBinDirectories, resolvedCliEnvironment } = require("./command-runner");
+const { createLimitsCache } = require("./limits-cache");
 
 const ARK_LIMITS_CACHE_FILE = "ark-coding-plan-limits-cache.json";
 const ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
@@ -212,75 +213,43 @@ function normalizeArkCodingPlanResponse(body) {
   };
 }
 
+// Deliberately fail-open on identity: the guard only applies when `profile
+// show` could establish the current identity — when it also failed, serving
+// the stale cache beats erroring out (availability over strictness). There is
+// no global max-age: dated windows are bounded by their own reset stamp and
+// undated ones by the 12h unknown-reset TTL.
+
+// A window whose reset_at has passed is stale — the quota has already rolled
+// over, so serving its old used_percent would mislead. Undated windows can't be
+// checked against a reset, so each one is dropped when the snapshot is too old;
+// a future-dated sibling must not keep it alive.
+const arkLimitsCache = createLimitsCache({
+  file: ARK_LIMITS_CACHE_FILE,
+  key: null,
+  maxAgeMs: null,
+  unknownResetTtlMs: ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS,
+  fields: { plan_label: "string", product: "string", profile_identity: "string" },
+  windowKeys: ["primary_window", "secondary_window", "tertiary_window"],
+  identityField: "profile_identity",
+  identityRequired: false,
+  // The normalizer throws when no periods survive, so the write guard skips
+  // the window check the other providers need.
+  writeGuard: (record) => Boolean(record?.configured) && !record.error,
+  cachedFlag: true,
+  stale: true,
+  source: { const: "disk-cache" },
+});
+
 function arkCodingPlanCachePath({ home = os.homedir() } = {}) {
-  return path.join(home, ".tokentracker", "tracker", ARK_LIMITS_CACHE_FILE);
+  return arkLimitsCache.path({ home });
 }
 
 function readArkCodingPlanLimitsCache({ home = os.homedir(), nowMs = Date.now(), profileIdentity } = {}) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(arkCodingPlanCachePath({ home }), "utf8"));
-    // Deliberately fail-open: the guard only applies when `profile show`
-    // could establish the current identity. When it also failed, serving
-    // the stale cache beats erroring out — availability over strictness.
-    if (profileIdentity && parsed?.profile_identity !== profileIdentity) return null;
-    const cachedAtMs = Date.parse(parsed?.cached_at || "");
-    if (!Number.isFinite(cachedAtMs) || cachedAtMs > nowMs + 60_000) return null;
-    // A window whose reset_at has passed is stale — the quota has already
-    // rolled over, so serving its old used_percent would mislead. Drop it.
-    const windows = [parsed?.primary_window, parsed?.secondary_window, parsed?.tertiary_window];
-    const surviving = windows.map((window) => {
-      if (!window) return null;
-      const resetAtMs = Date.parse(window.reset_at || "");
-      if (Number.isFinite(resetAtMs) && resetAtMs <= nowMs) return null;
-      return window;
-    });
-    if (surviving.every((window) => !window)) return null;
-    // Undated windows can't be checked against a reset, so drop each one when
-    // the snapshot is too old. A future-dated sibling must not keep it alive.
-    const bounded = surviving.map((window) => {
-      if (!window) return null;
-      return Number.isFinite(Date.parse(window.reset_at || ""))
-        || nowMs - cachedAtMs <= ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS
-        ? window
-        : null;
-    });
-    if (bounded.every((window) => !window)) return null;
-    return {
-      configured: true,
-      error: null,
-      plan_label: typeof parsed?.plan_label === "string" ? parsed.plan_label : null,
-      product: typeof parsed?.product === "string" ? parsed.product : null,
-      primary_window: bounded[0],
-      secondary_window: bounded[1],
-      tertiary_window: bounded[2],
-      cached: true,
-      stale: true,
-      cached_at: parsed.cached_at,
-      source: "disk-cache",
-    };
-  } catch (_error) {
-    return null;
-  }
+  return arkLimitsCache.read({ home, nowMs, identity: profileIdentity });
 }
 
 function writeArkCodingPlanLimitsCache(limits, { home = os.homedir(), nowMs = Date.now() } = {}) {
-  if (!limits?.configured || limits.error) return;
-  const cachePath = arkCodingPlanCachePath({ home });
-  const payload = {
-    plan_label: limits.plan_label || null,
-    product: limits.product || null,
-    profile_identity: limits.profile_identity || null,
-    primary_window: limits.primary_window || null,
-    secondary_window: limits.secondary_window || null,
-    tertiary_window: limits.tertiary_window || null,
-    cached_at: new Date(nowMs).toISOString(),
-  };
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    const tmpPath = `${cachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
-    fs.renameSync(tmpPath, cachePath);
-  } catch (_error) {}
+  arkLimitsCache.write(limits, { home, nowMs });
 }
 
 // runCommand / whichBinary / resolveBinaryPath now live in ./command-runner,

package/src/lib/cloud-account.js

@@ -216,6 +216,28 @@ function csrfTokenFromRefreshPayload(data) {
   return raw && raw.length > 0 ? raw : null;
 }
 
+function userFromRefreshPayload(data) {
+  if (!data || typeof data !== "object") return null;
+  const raw = data.user && typeof data.user === "object" && !Array.isArray(data.user)
+    ? data.user
+    : data.session && typeof data.session === "object" && data.session.user && typeof data.session.user === "object" && !Array.isArray(data.session.user)
+      ? data.session.user
+      : null;
+  return raw;
+}
+
+function userFromAccessToken(accessToken) {
+  try {
+    const payload = JSON.parse(Buffer.from(String(accessToken).split(".")[1], "base64url").toString("utf8"));
+    if (typeof payload?.sub !== "string" || !payload.sub) return null;
+    const user = { id: payload.sub };
+    if (typeof payload.email === "string" && payload.email) user.email = payload.email;
+    return user;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Perform the actual refresh POST. Throws a classified `AccountAuthError` on
  * every failure so callers can distinguish a transient outage (timeout,
@@ -283,7 +305,8 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
   const rotated = refreshTokenFromRefreshPayload(data);
   // The caller persists a rotation before its next account read. Key the
   // still-valid access token by that current refresh token, not the consumed one.
-  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs };
+  const user = userFromRefreshPayload(data) || userFromAccessToken(accessToken);
+  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs, user };
   return {
     accessToken,
     refreshToken: rotated && rotated !== refreshToken ? rotated : null,
@@ -292,6 +315,9 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
     // relayed (refresh, csrf) pair in sync — a stale relayed csrf breaks the
     // dashboard's cookie-path refresh with 403 Invalid CSRF.
     csrfToken: csrfTokenFromRefreshPayload(data),
+    // The InsForge SDK's refreshSession persists the session only when the
+    // response includes a user object alongside the access token.
+    user,
   };
 }
 
@@ -303,7 +329,7 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
  *
  * @param {boolean} [throwOnFailure] when true, reject with a classified
  *   `AccountAuthError` instead of resolving to `null`.
- * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null}|null>}
+ * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null, user: object|null}|null>}
  *   null when no refresh token is available or the refresh failed.
  */
 async function mintAccessToken({
@@ -327,7 +353,7 @@ async function mintAccessToken({
     tokenCache.accessToken &&
     tokenCache.expMs - skewMs > now()
   ) {
-    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null };
+    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null, user: tokenCache.user || null };
   }
 
   let inflight = mintInflight.get(cacheKey);