tokentracker-cli 1.5.15 → 1.5.16

package/src/lib/ark-agent-plan-limits.js

@@ -26,6 +26,7 @@ const os = require("node:os");
 const path = require("node:path");
 
 const { runCommand, resolveBinaryPath, statBinaryInDirs, commonGlobalBinDirectories, resolvedCliEnvironment } = require("./command-runner");
+const { createLimitsCache } = require("./limits-cache");
 
 const ARK_LIMITS_CACHE_FILE = "ark-agent-plan-limits-cache.json";
 const ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
@@ -188,68 +189,38 @@ function normalizeArkAgentPlanResponse(body) {
 // Alias for shared shape
 const normalizeArkCodingPlanResponse = normalizeArkAgentPlanResponse;
 
+// Deliberately fail-open on identity: the guard only applies when `profile
+// show` could establish the current identity — when it also failed, serving
+// the stale cache beats erroring out (availability over strictness). There is
+// no global max-age: dated windows are bounded by their own reset stamp and
+// undated ones by the 12h unknown-reset TTL.
+const arkLimitsCache = createLimitsCache({
+  file: ARK_LIMITS_CACHE_FILE,
+  key: null,
+  maxAgeMs: null,
+  unknownResetTtlMs: ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS,
+  fields: { plan_label: "string", product: "string", profile_identity: "string" },
+  windowKeys: ["primary_window", "secondary_window", "tertiary_window"],
+  identityField: "profile_identity",
+  identityRequired: false,
+  // The normalizer throws when no periods survive, so the write guard skips
+  // the window check the other providers need.
+  writeGuard: (record) => Boolean(record?.configured) && !record.error,
+  cachedFlag: true,
+  stale: true,
+  source: { const: "disk-cache" },
+});
+
 function arkAgentPlanCachePath({ home = os.homedir() } = {}) {
-  return path.join(home, ".tokentracker", "tracker", ARK_LIMITS_CACHE_FILE);
+  return arkLimitsCache.path({ home });
 }
 
 function readArkAgentPlanLimitsCache({ home = os.homedir(), nowMs = Date.now(), profileIdentity } = {}) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(arkAgentPlanCachePath({ home }), "utf8"));
-    if (profileIdentity && parsed?.profile_identity !== profileIdentity) return null;
-    const cachedAtMs = Date.parse(parsed?.cached_at || "");
-    if (!Number.isFinite(cachedAtMs) || cachedAtMs > nowMs + 60_000) return null;
-    const windows = [parsed?.primary_window, parsed?.secondary_window, parsed?.tertiary_window];
-    const surviving = windows.map((window) => {
-      if (!window) return null;
-      const resetAtMs = Date.parse(window.reset_at || "");
-      if (Number.isFinite(resetAtMs) && resetAtMs <= nowMs) return null;
-      return window;
-    });
-    if (surviving.every((window) => !window)) return null;
-    const bounded = surviving.map((window) => {
-      if (!window) return null;
-      return Number.isFinite(Date.parse(window.reset_at || ""))
-        || nowMs - cachedAtMs <= ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS
-        ? window
-        : null;
-    });
-    if (bounded.every((window) => !window)) return null;
-    return {
-      configured: true,
-      error: null,
-      plan_label: typeof parsed?.plan_label === "string" ? parsed.plan_label : null,
-      product: typeof parsed?.product === "string" ? parsed.product : null,
-      primary_window: bounded[0],
-      secondary_window: bounded[1],
-      tertiary_window: bounded[2],
-      cached: true,
-      stale: true,
-      cached_at: parsed.cached_at,
-      source: "disk-cache",
-    };
-  } catch (_error) {
-    return null;
-  }
+  return arkLimitsCache.read({ home, nowMs, identity: profileIdentity });
 }
 
 function writeArkAgentPlanLimitsCache(limits, { home = os.homedir(), nowMs = Date.now() } = {}) {
-  if (!limits?.configured || limits.error) return;
-  const cachePath = arkAgentPlanCachePath({ home });
-  const payload = {
-    plan_label: limits.plan_label || null,
-    product: limits.product || null,
-    profile_identity: limits.profile_identity || null,
-    primary_window: limits.primary_window || null,
-    secondary_window: limits.secondary_window || null,
-    tertiary_window: limits.tertiary_window || null,
-    cached_at: new Date(nowMs).toISOString(),
-  };
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    const tmpPath = `${cachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
-    fs.renameSync(tmpPath, cachePath);
-  } catch (_error) {}
+  arkLimitsCache.write(limits, { home, nowMs });
 }
 
 function hasArkCliInstallEvidence({ home = os.homedir(), platform = process.platform } = {}) {

package/src/lib/ark-coding-plan-limits.js

@@ -26,6 +26,7 @@ const os = require("node:os");
 const path = require("node:path");
 
 const { runCommand, resolveBinaryPath, statBinaryInDirs, commonGlobalBinDirectories, resolvedCliEnvironment } = require("./command-runner");
+const { createLimitsCache } = require("./limits-cache");
 
 const ARK_LIMITS_CACHE_FILE = "ark-coding-plan-limits-cache.json";
 const ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
@@ -212,75 +213,43 @@ function normalizeArkCodingPlanResponse(body) {
   };
 }
 
+// Deliberately fail-open on identity: the guard only applies when `profile
+// show` could establish the current identity — when it also failed, serving
+// the stale cache beats erroring out (availability over strictness). There is
+// no global max-age: dated windows are bounded by their own reset stamp and
+// undated ones by the 12h unknown-reset TTL.
+
+// A window whose reset_at has passed is stale — the quota has already rolled
+// over, so serving its old used_percent would mislead. Undated windows can't be
+// checked against a reset, so each one is dropped when the snapshot is too old;
+// a future-dated sibling must not keep it alive.
+const arkLimitsCache = createLimitsCache({
+  file: ARK_LIMITS_CACHE_FILE,
+  key: null,
+  maxAgeMs: null,
+  unknownResetTtlMs: ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS,
+  fields: { plan_label: "string", product: "string", profile_identity: "string" },
+  windowKeys: ["primary_window", "secondary_window", "tertiary_window"],
+  identityField: "profile_identity",
+  identityRequired: false,
+  // The normalizer throws when no periods survive, so the write guard skips
+  // the window check the other providers need.
+  writeGuard: (record) => Boolean(record?.configured) && !record.error,
+  cachedFlag: true,
+  stale: true,
+  source: { const: "disk-cache" },
+});
+
 function arkCodingPlanCachePath({ home = os.homedir() } = {}) {
-  return path.join(home, ".tokentracker", "tracker", ARK_LIMITS_CACHE_FILE);
+  return arkLimitsCache.path({ home });
 }
 
 function readArkCodingPlanLimitsCache({ home = os.homedir(), nowMs = Date.now(), profileIdentity } = {}) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(arkCodingPlanCachePath({ home }), "utf8"));
-    // Deliberately fail-open: the guard only applies when `profile show`
-    // could establish the current identity. When it also failed, serving
-    // the stale cache beats erroring out — availability over strictness.
-    if (profileIdentity && parsed?.profile_identity !== profileIdentity) return null;
-    const cachedAtMs = Date.parse(parsed?.cached_at || "");
-    if (!Number.isFinite(cachedAtMs) || cachedAtMs > nowMs + 60_000) return null;
-    // A window whose reset_at has passed is stale — the quota has already
-    // rolled over, so serving its old used_percent would mislead. Drop it.
-    const windows = [parsed?.primary_window, parsed?.secondary_window, parsed?.tertiary_window];
-    const surviving = windows.map((window) => {
-      if (!window) return null;
-      const resetAtMs = Date.parse(window.reset_at || "");
-      if (Number.isFinite(resetAtMs) && resetAtMs <= nowMs) return null;
-      return window;
-    });
-    if (surviving.every((window) => !window)) return null;
-    // Undated windows can't be checked against a reset, so drop each one when
-    // the snapshot is too old. A future-dated sibling must not keep it alive.
-    const bounded = surviving.map((window) => {
-      if (!window) return null;
-      return Number.isFinite(Date.parse(window.reset_at || ""))
-        || nowMs - cachedAtMs <= ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS
-        ? window
-        : null;
-    });
-    if (bounded.every((window) => !window)) return null;
-    return {
-      configured: true,
-      error: null,
-      plan_label: typeof parsed?.plan_label === "string" ? parsed.plan_label : null,
-      product: typeof parsed?.product === "string" ? parsed.product : null,
-      primary_window: bounded[0],
-      secondary_window: bounded[1],
-      tertiary_window: bounded[2],
-      cached: true,
-      stale: true,
-      cached_at: parsed.cached_at,
-      source: "disk-cache",
-    };
-  } catch (_error) {
-    return null;
-  }
+  return arkLimitsCache.read({ home, nowMs, identity: profileIdentity });
 }
 
 function writeArkCodingPlanLimitsCache(limits, { home = os.homedir(), nowMs = Date.now() } = {}) {
-  if (!limits?.configured || limits.error) return;
-  const cachePath = arkCodingPlanCachePath({ home });
-  const payload = {
-    plan_label: limits.plan_label || null,
-    product: limits.product || null,
-    profile_identity: limits.profile_identity || null,
-    primary_window: limits.primary_window || null,
-    secondary_window: limits.secondary_window || null,
-    tertiary_window: limits.tertiary_window || null,
-    cached_at: new Date(nowMs).toISOString(),
-  };
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    const tmpPath = `${cachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
-    fs.renameSync(tmpPath, cachePath);
-  } catch (_error) {}
+  arkLimitsCache.write(limits, { home, nowMs });
 }
 
 // runCommand / whichBinary / resolveBinaryPath now live in ./command-runner,

package/src/lib/cloud-account.js

@@ -216,6 +216,28 @@ function csrfTokenFromRefreshPayload(data) {
   return raw && raw.length > 0 ? raw : null;
 }
 
+function userFromRefreshPayload(data) {
+  if (!data || typeof data !== "object") return null;
+  const raw = data.user && typeof data.user === "object" && !Array.isArray(data.user)
+    ? data.user
+    : data.session && typeof data.session === "object" && data.session.user && typeof data.session.user === "object" && !Array.isArray(data.session.user)
+      ? data.session.user
+      : null;
+  return raw;
+}
+
+function userFromAccessToken(accessToken) {
+  try {
+    const payload = JSON.parse(Buffer.from(String(accessToken).split(".")[1], "base64url").toString("utf8"));
+    if (typeof payload?.sub !== "string" || !payload.sub) return null;
+    const user = { id: payload.sub };
+    if (typeof payload.email === "string" && payload.email) user.email = payload.email;
+    return user;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Perform the actual refresh POST. Throws a classified `AccountAuthError` on
  * every failure so callers can distinguish a transient outage (timeout,
@@ -283,7 +305,8 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
   const rotated = refreshTokenFromRefreshPayload(data);
   // The caller persists a rotation before its next account read. Key the
   // still-valid access token by that current refresh token, not the consumed one.
-  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs };
+  const user = userFromRefreshPayload(data) || userFromAccessToken(accessToken);
+  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs, user };
   return {
     accessToken,
     refreshToken: rotated && rotated !== refreshToken ? rotated : null,
@@ -292,6 +315,9 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
     // relayed (refresh, csrf) pair in sync — a stale relayed csrf breaks the
     // dashboard's cookie-path refresh with 403 Invalid CSRF.
     csrfToken: csrfTokenFromRefreshPayload(data),
+    // The InsForge SDK's refreshSession persists the session only when the
+    // response includes a user object alongside the access token.
+    user,
   };
 }
 
@@ -303,7 +329,7 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
  *
  * @param {boolean} [throwOnFailure] when true, reject with a classified
  *   `AccountAuthError` instead of resolving to `null`.
- * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null}|null>}
+ * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null, user: object|null}|null>}
  *   null when no refresh token is available or the refresh failed.
  */
 async function mintAccessToken({
@@ -327,7 +353,7 @@ async function mintAccessToken({
     tokenCache.accessToken &&
     tokenCache.expMs - skewMs > now()
   ) {
-    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null };
+    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null, user: tokenCache.user || null };
   }
 
   let inflight = mintInflight.get(cacheKey);

package/src/lib/local-api.js

@@ -1400,6 +1400,13 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
     }
   }
 
+  function rememberIssuedAccessToken(accessToken, sourceFingerprint) {
+    if (!sourceFingerprint || typeof accessToken !== "string" || accessToken.length > 8192) return;
+    const hash = crypto.createHash("sha256").update(accessToken).digest("hex");
+    if (!issuedAccessTokenInstances.has(hash)) issuedAccessTokenInstances.set(hash, sourceFingerprint);
+    while (issuedAccessTokenInstances.size > 64) issuedAccessTokenInstances.delete(issuedAccessTokenInstances.keys().next().value);
+  }
+
   function captureAuthTokensFromBody(bodyBuffer, contentType, { newLogin = false, sourceFingerprint } = {}) {
     if (!bodyBuffer || !String(contentType || "").toLowerCase().includes("application/json")) return;
     let parsed = null;
@@ -1408,11 +1415,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
     } catch {
       return;
     }
-    if (sourceFingerprint && typeof parsed?.accessToken === "string" && parsed.accessToken.length <= 8192) {
-      const hash = crypto.createHash("sha256").update(parsed.accessToken).digest("hex");
-      if (!issuedAccessTokenInstances.has(hash)) issuedAccessTokenInstances.set(hash, sourceFingerprint);
-      while (issuedAccessTokenInstances.size > 64) issuedAccessTokenInstances.delete(issuedAccessTokenInstances.keys().next().value);
-    }
+    rememberIssuedAccessToken(parsed?.accessToken, sourceFingerprint);
     let changed = false;
     const token = typeof parsed?.csrfToken === "string" ? parsed.csrfToken.trim() : "";
     if (token) {
@@ -2073,6 +2076,90 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         const hasCsrfHeader = typeof proxyHeaders["x-csrf-token"] === "string" && proxyHeaders["x-csrf-token"].trim().length > 0;
         const relayCsrfToken = getRelayCookieValue(csrfRelayCookieName);
         const relayRefreshToken = getRelayCookieValue("insforge_refresh_token", { decode: true });
+        // Issue #1074: the backend rotates refresh tokens, but this proxy and
+        // `mintAccessToken` used to POST the same token independently. A page
+        // refresh concurrent with a background account read then consumed the
+        // token twice — the loser got 401 and the SPA signed the user out.
+        // Route every refresh that still has a persisted token through the
+        // shared mint (cache + single-flight + one retry against a just-
+        // rotated file) so both callers share one result.
+        if (p === "/api/auth/refresh" && relayRefreshToken && String(req.method || "GET").toUpperCase() === "POST") {
+          for await (const _chunk of req) { /* drain unused body */ }
+          const latestRuntime = getRuntime();
+          if (latestRuntime.configurationError || latestRuntime.baseUrl !== runtime.baseUrl || latestRuntime.anonKey !== runtime.anonKey) {
+            json(res, { code: "instance_changed", error: "The configured backend changed during authentication. Reload and sign in again." }, 409);
+            return true;
+          }
+          const mintOpts = {
+            baseUrl: insforgeBase,
+            anonKey: runtime.anonKey,
+            timeoutMs: runtime.httpTimeoutMs,
+            throwOnFailure: true,
+          };
+          const rejectIfRefreshContextChanged = () => {
+            const currentRuntime = getRuntime();
+            if (currentRuntime.configurationError || currentRuntime.baseUrl !== runtime.baseUrl || currentRuntime.anonKey !== runtime.anonKey) {
+              json(res, { code: "instance_changed", error: "The configured backend changed during authentication. Reload and sign in again." }, 409);
+              return true;
+            }
+            if (authSessionAtStart !== getCloudAccountSessionGeneration()) {
+              json(res, { error: "Account session changed", code: "auth_session_changed" }, 409);
+              return true;
+            }
+            return false;
+          };
+          let minted = null;
+          try {
+            try {
+              minted = await mintAccessToken({ ...mintOpts, refreshToken: relayRefreshToken });
+            } catch (error) {
+              // Only retry a consumed-token 401 against a just-rotated
+              // persisted token for the SAME backend/session. Otherwise a
+              // rejected mint from instance A could submit instance B's
+              // newly saved refresh token to A.
+              if (rejectIfRefreshContextChanged()) return true;
+              const latest = getRelayCookieValue("insforge_refresh_token", { decode: true });
+              if (latest && latest !== relayRefreshToken && error?.status === 401) {
+                minted = await mintAccessToken({ ...mintOpts, refreshToken: latest });
+              } else {
+                throw error;
+              }
+            }
+          } catch (error) {
+            if (rejectIfRefreshContextChanged()) return true;
+            // performMint tags every non-OK HTTP status as auth_rejected.
+            // Only a real 401 means the credential was consumed/invalid;
+            // 429/503 must not sign the SPA out.
+            if (error?.status === 401) {
+              json(res, { error: "AUTH_UNAUTHORIZED", message: "Invalid or expired refresh token" }, 401);
+              return true;
+            }
+            throw error;
+          }
+          if (rejectIfRefreshContextChanged()) return true;
+          if (!minted?.accessToken) {
+            json(res, { error: "AUTH_UNAUTHORIZED", message: "Invalid or expired refresh token" }, 401);
+            return true;
+          }
+          const payload = { accessToken: minted.accessToken };
+          if (minted.refreshToken) payload.refreshToken = minted.refreshToken;
+          if (minted.user) payload.user = minted.user;
+          // Persist the rotation without bumping sessionGeneration — that
+          // would 409 a concurrent waiter that shared this mint.
+          // setRelayRefreshToken matches the background account-read path.
+          if (minted.refreshToken) setRelayRefreshToken(minted.refreshToken);
+          if (minted.csrfToken) setRelayCsrfToken(minted.csrfToken);
+          // Cache hits return csrfToken:null. The SDK still needs the current
+          // CSRF to sign out; without it, logout 403s and a reload signs the
+          // user back in. Fall back to the relayed token we just persisted.
+          const csrfToken = minted.csrfToken || getRelayCookieValue(csrfRelayCookieName);
+          if (csrfToken) payload.csrfToken = csrfToken;
+          rememberIssuedAccessToken(minted.accessToken, fingerprintFor(runtime));
+          const resBody = Buffer.from(JSON.stringify(payload));
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(resBody);
+          return true;
+        }
         // A cookie-less client (fresh WebView after an app update/restart) has no
         // browser session to pair a CSRF token with — the persisted refresh token
         // replayed through the mobile flow is the only viable recovery. The relay

package/src/lib/pricing/curated-overrides.json

@@ -903,6 +903,14 @@
       "match": "gpt-5.6",
       "ref": "gpt-5.6-sol"
     },
+    {
+      "match": "gemini-4-argon",
+      "ref": "gemini-4-argon"
+    },
+    {
+      "match": "gemini-4.argon",
+      "ref": "gemini-4-argon"
+    },
     {
       "match": "kiro",
       "ref": "kiro-cli-agent"