tokentracker-cli 1.5.15 → 1.5.17

package/src/lib/ark-agent-plan-limits.js

@@ -26,6 +26,7 @@ const os = require("node:os");
 const path = require("node:path");
 
 const { runCommand, resolveBinaryPath, statBinaryInDirs, commonGlobalBinDirectories, resolvedCliEnvironment } = require("./command-runner");
+const { createLimitsCache } = require("./limits-cache");
 
 const ARK_LIMITS_CACHE_FILE = "ark-agent-plan-limits-cache.json";
 const ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
@@ -188,68 +189,38 @@ function normalizeArkAgentPlanResponse(body) {
 // Alias for shared shape
 const normalizeArkCodingPlanResponse = normalizeArkAgentPlanResponse;
 
+// Deliberately fail-open on identity: the guard only applies when `profile
+// show` could establish the current identity — when it also failed, serving
+// the stale cache beats erroring out (availability over strictness). There is
+// no global max-age: dated windows are bounded by their own reset stamp and
+// undated ones by the 12h unknown-reset TTL.
+const arkLimitsCache = createLimitsCache({
+  file: ARK_LIMITS_CACHE_FILE,
+  key: null,
+  maxAgeMs: null,
+  unknownResetTtlMs: ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS,
+  fields: { plan_label: "string", product: "string", profile_identity: "string" },
+  windowKeys: ["primary_window", "secondary_window", "tertiary_window"],
+  identityField: "profile_identity",
+  identityRequired: false,
+  // The normalizer throws when no periods survive, so the write guard skips
+  // the window check the other providers need.
+  writeGuard: (record) => Boolean(record?.configured) && !record.error,
+  cachedFlag: true,
+  stale: true,
+  source: { const: "disk-cache" },
+});
+
 function arkAgentPlanCachePath({ home = os.homedir() } = {}) {
-  return path.join(home, ".tokentracker", "tracker", ARK_LIMITS_CACHE_FILE);
+  return arkLimitsCache.path({ home });
 }
 
 function readArkAgentPlanLimitsCache({ home = os.homedir(), nowMs = Date.now(), profileIdentity } = {}) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(arkAgentPlanCachePath({ home }), "utf8"));
-    if (profileIdentity && parsed?.profile_identity !== profileIdentity) return null;
-    const cachedAtMs = Date.parse(parsed?.cached_at || "");
-    if (!Number.isFinite(cachedAtMs) || cachedAtMs > nowMs + 60_000) return null;
-    const windows = [parsed?.primary_window, parsed?.secondary_window, parsed?.tertiary_window];
-    const surviving = windows.map((window) => {
-      if (!window) return null;
-      const resetAtMs = Date.parse(window.reset_at || "");
-      if (Number.isFinite(resetAtMs) && resetAtMs <= nowMs) return null;
-      return window;
-    });
-    if (surviving.every((window) => !window)) return null;
-    const bounded = surviving.map((window) => {
-      if (!window) return null;
-      return Number.isFinite(Date.parse(window.reset_at || ""))
-        || nowMs - cachedAtMs <= ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS
-        ? window
-        : null;
-    });
-    if (bounded.every((window) => !window)) return null;
-    return {
-      configured: true,
-      error: null,
-      plan_label: typeof parsed?.plan_label === "string" ? parsed.plan_label : null,
-      product: typeof parsed?.product === "string" ? parsed.product : null,
-      primary_window: bounded[0],
-      secondary_window: bounded[1],
-      tertiary_window: bounded[2],
-      cached: true,
-      stale: true,
-      cached_at: parsed.cached_at,
-      source: "disk-cache",
-    };
-  } catch (_error) {
-    return null;
-  }
+  return arkLimitsCache.read({ home, nowMs, identity: profileIdentity });
 }
 
 function writeArkAgentPlanLimitsCache(limits, { home = os.homedir(), nowMs = Date.now() } = {}) {
-  if (!limits?.configured || limits.error) return;
-  const cachePath = arkAgentPlanCachePath({ home });
-  const payload = {
-    plan_label: limits.plan_label || null,
-    product: limits.product || null,
-    profile_identity: limits.profile_identity || null,
-    primary_window: limits.primary_window || null,
-    secondary_window: limits.secondary_window || null,
-    tertiary_window: limits.tertiary_window || null,
-    cached_at: new Date(nowMs).toISOString(),
-  };
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    const tmpPath = `${cachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
-    fs.renameSync(tmpPath, cachePath);
-  } catch (_error) {}
+  arkLimitsCache.write(limits, { home, nowMs });
 }
 
 function hasArkCliInstallEvidence({ home = os.homedir(), platform = process.platform } = {}) {

package/src/lib/ark-coding-plan-limits.js

@@ -26,6 +26,7 @@ const os = require("node:os");
 const path = require("node:path");
 
 const { runCommand, resolveBinaryPath, statBinaryInDirs, commonGlobalBinDirectories, resolvedCliEnvironment } = require("./command-runner");
+const { createLimitsCache } = require("./limits-cache");
 
 const ARK_LIMITS_CACHE_FILE = "ark-coding-plan-limits-cache.json";
 const ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
@@ -212,75 +213,43 @@ function normalizeArkCodingPlanResponse(body) {
   };
 }
 
+// Deliberately fail-open on identity: the guard only applies when `profile
+// show` could establish the current identity — when it also failed, serving
+// the stale cache beats erroring out (availability over strictness). There is
+// no global max-age: dated windows are bounded by their own reset stamp and
+// undated ones by the 12h unknown-reset TTL.
+
+// A window whose reset_at has passed is stale — the quota has already rolled
+// over, so serving its old used_percent would mislead. Undated windows can't be
+// checked against a reset, so each one is dropped when the snapshot is too old;
+// a future-dated sibling must not keep it alive.
+const arkLimitsCache = createLimitsCache({
+  file: ARK_LIMITS_CACHE_FILE,
+  key: null,
+  maxAgeMs: null,
+  unknownResetTtlMs: ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS,
+  fields: { plan_label: "string", product: "string", profile_identity: "string" },
+  windowKeys: ["primary_window", "secondary_window", "tertiary_window"],
+  identityField: "profile_identity",
+  identityRequired: false,
+  // The normalizer throws when no periods survive, so the write guard skips
+  // the window check the other providers need.
+  writeGuard: (record) => Boolean(record?.configured) && !record.error,
+  cachedFlag: true,
+  stale: true,
+  source: { const: "disk-cache" },
+});
+
 function arkCodingPlanCachePath({ home = os.homedir() } = {}) {
-  return path.join(home, ".tokentracker", "tracker", ARK_LIMITS_CACHE_FILE);
+  return arkLimitsCache.path({ home });
 }
 
 function readArkCodingPlanLimitsCache({ home = os.homedir(), nowMs = Date.now(), profileIdentity } = {}) {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(arkCodingPlanCachePath({ home }), "utf8"));
-    // Deliberately fail-open: the guard only applies when `profile show`
-    // could establish the current identity. When it also failed, serving
-    // the stale cache beats erroring out — availability over strictness.
-    if (profileIdentity && parsed?.profile_identity !== profileIdentity) return null;
-    const cachedAtMs = Date.parse(parsed?.cached_at || "");
-    if (!Number.isFinite(cachedAtMs) || cachedAtMs > nowMs + 60_000) return null;
-    // A window whose reset_at has passed is stale — the quota has already
-    // rolled over, so serving its old used_percent would mislead. Drop it.
-    const windows = [parsed?.primary_window, parsed?.secondary_window, parsed?.tertiary_window];
-    const surviving = windows.map((window) => {
-      if (!window) return null;
-      const resetAtMs = Date.parse(window.reset_at || "");
-      if (Number.isFinite(resetAtMs) && resetAtMs <= nowMs) return null;
-      return window;
-    });
-    if (surviving.every((window) => !window)) return null;
-    // Undated windows can't be checked against a reset, so drop each one when
-    // the snapshot is too old. A future-dated sibling must not keep it alive.
-    const bounded = surviving.map((window) => {
-      if (!window) return null;
-      return Number.isFinite(Date.parse(window.reset_at || ""))
-        || nowMs - cachedAtMs <= ARK_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS
-        ? window
-        : null;
-    });
-    if (bounded.every((window) => !window)) return null;
-    return {
-      configured: true,
-      error: null,
-      plan_label: typeof parsed?.plan_label === "string" ? parsed.plan_label : null,
-      product: typeof parsed?.product === "string" ? parsed.product : null,
-      primary_window: bounded[0],
-      secondary_window: bounded[1],
-      tertiary_window: bounded[2],
-      cached: true,
-      stale: true,
-      cached_at: parsed.cached_at,
-      source: "disk-cache",
-    };
-  } catch (_error) {
-    return null;
-  }
+  return arkLimitsCache.read({ home, nowMs, identity: profileIdentity });
 }
 
 function writeArkCodingPlanLimitsCache(limits, { home = os.homedir(), nowMs = Date.now() } = {}) {
-  if (!limits?.configured || limits.error) return;
-  const cachePath = arkCodingPlanCachePath({ home });
-  const payload = {
-    plan_label: limits.plan_label || null,
-    product: limits.product || null,
-    profile_identity: limits.profile_identity || null,
-    primary_window: limits.primary_window || null,
-    secondary_window: limits.secondary_window || null,
-    tertiary_window: limits.tertiary_window || null,
-    cached_at: new Date(nowMs).toISOString(),
-  };
-  try {
-    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
-    const tmpPath = `${cachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
-    fs.renameSync(tmpPath, cachePath);
-  } catch (_error) {}
+  arkLimitsCache.write(limits, { home, nowMs });
 }
 
 // runCommand / whichBinary / resolveBinaryPath now live in ./command-runner,

package/src/lib/cloud-account.js

@@ -216,6 +216,28 @@ function csrfTokenFromRefreshPayload(data) {
   return raw && raw.length > 0 ? raw : null;
 }
 
+function userFromRefreshPayload(data) {
+  if (!data || typeof data !== "object") return null;
+  const raw = data.user && typeof data.user === "object" && !Array.isArray(data.user)
+    ? data.user
+    : data.session && typeof data.session === "object" && data.session.user && typeof data.session.user === "object" && !Array.isArray(data.session.user)
+      ? data.session.user
+      : null;
+  return raw;
+}
+
+function userFromAccessToken(accessToken) {
+  try {
+    const payload = JSON.parse(Buffer.from(String(accessToken).split(".")[1], "base64url").toString("utf8"));
+    if (typeof payload?.sub !== "string" || !payload.sub) return null;
+    const user = { id: payload.sub };
+    if (typeof payload.email === "string" && payload.email) user.email = payload.email;
+    return user;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Perform the actual refresh POST. Throws a classified `AccountAuthError` on
  * every failure so callers can distinguish a transient outage (timeout,
@@ -283,7 +305,8 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
   const rotated = refreshTokenFromRefreshPayload(data);
   // The caller persists a rotation before its next account read. Key the
   // still-valid access token by that current refresh token, not the consumed one.
-  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs };
+  const user = userFromRefreshPayload(data) || userFromAccessToken(accessToken);
+  tokenCache = { cacheKey: `${root}\0${rotated || refreshToken}`, accessToken, expMs, user };
   return {
     accessToken,
     refreshToken: rotated && rotated !== refreshToken ? rotated : null,
@@ -292,6 +315,9 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
     // relayed (refresh, csrf) pair in sync — a stale relayed csrf breaks the
     // dashboard's cookie-path refresh with 403 Invalid CSRF.
     csrfToken: csrfTokenFromRefreshPayload(data),
+    // The InsForge SDK's refreshSession persists the session only when the
+    // response includes a user object alongside the access token.
+    user,
   };
 }
 
@@ -303,7 +329,7 @@ async function performMint({ root, anonKey, refreshToken, fetchImpl, now, timeou
  *
  * @param {boolean} [throwOnFailure] when true, reject with a classified
  *   `AccountAuthError` instead of resolving to `null`.
- * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null}|null>}
+ * @returns {Promise<{accessToken: string, refreshToken: string|null, csrfToken: string|null, user: object|null}|null>}
  *   null when no refresh token is available or the refresh failed.
  */
 async function mintAccessToken({
@@ -327,7 +353,7 @@ async function mintAccessToken({
     tokenCache.accessToken &&
     tokenCache.expMs - skewMs > now()
   ) {
-    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null };
+    return { accessToken: tokenCache.accessToken, refreshToken: null, csrfToken: null, user: tokenCache.user || null };
   }
 
   let inflight = mintInflight.get(cacheKey);

package/src/lib/dsh-session.js

@@ -8,6 +8,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const crypto = require("node:crypto");
+const { createDshPerformanceCollector, normalizePerformance } = require("./session-performance");
 const {
   isDshSessionLogName,
   parseDshVersion,
@@ -101,6 +102,48 @@ function eventTimestampMs(entry) {
   return Number.isFinite(time) && time >= MIN_DSH_TIMESTAMP_MS ? time : null;
 }
 
+function firstStreamTokenTime(stream) {
+  // DSH v4 stores raw chunks and packed delta runs together. Only non-empty
+  // deltas (or a name-bearing tool delta) mark a token; block-start does not.
+  for (const record of stream) {
+    if (record?.type === "chunk") {
+      const chunk = record.chunk;
+      const token = ["text-delta", "reasoning-delta"].includes(chunk?.type)
+        ? typeof chunk.text === "string" && chunk.text.length > 0
+        : chunk?.type === "tool-call-delta" && (
+          (typeof chunk.argumentsDelta === "string" && chunk.argumentsDelta.length > 0)
+          || (typeof chunk.name === "string" && chunk.name.length > 0));
+      const time = eventTimestampMs(record);
+      if (token && time !== null) return time;
+    } else if (["text-chunks", "reasoning-chunks", "tool-call-chunks"].includes(record?.type)) {
+      const tool = record.type === "tool-call-chunks";
+      const fragments = tool ? record.args : record.texts;
+      let time = eventTimestampMs({ time: record.time0 });
+      if (time === null || !Array.isArray(fragments)) continue;
+      for (let index = 0; index < fragments.length; index += 1) {
+        if (index > 0) {
+          const gap = record.dt?.[index - 1];
+          if (typeof gap !== "number" || !Number.isFinite(gap)) break;
+          time += gap;
+        }
+        if ((typeof fragments[index] === "string" && fragments[index].length > 0)
+          || (tool && typeof record.name === "string" && record.name.length > 0)) return time;
+      }
+    }
+  }
+  return null;
+}
+
+function messageTiming(data, step, end) {
+  if (!step || step.failed || data?.interrupted || step.turn !== data?.turn || step.step !== data?.step) return null;
+  const stream = Array.isArray(data?.stream) ? data.stream : null;
+  if (stream) {
+    const finish = stream.findLast((record) => record?.type === "chunk" && record.chunk?.type === "finish");
+    if (!finish || !finish.chunk.reason?.kind || ["error", "aborted"].includes(finish.chunk.reason.kind)) return null;
+  }
+  return { start: step.ts, end, firstToken: stream ? firstStreamTokenTime(stream) : null };
+}
+
 function directoryEntryIs(entry, fullPath, kind) {
   const check = kind === "dir" ? entry.isDirectory() : entry.isFile();
   if (check) return true;
@@ -279,6 +322,7 @@ async function parseDshTranscript(filePath) {
     events: [],
   };
   const lines = text.split("\n");
+  let openStep = null;
   for (let index = 0; index < lines.length; index += 1) {
     const line = lines[index];
     if (!line) continue;
@@ -292,6 +336,33 @@ async function parseDshTranscript(filePath) {
     const data = entry.data && typeof entry.data === "object" ? entry.data : null;
     const seq = Number.isFinite(entry.seq) ? entry.seq : index;
     switch (entry.type) {
+      case "step/start": {
+        openStep = Number.isInteger(data?.turn) && Number.isInteger(data?.step)
+          ? { turn: data.turn, step: data.step, ts: eventTimestampMs(entry), failed: false } : null;
+        break;
+      }
+      case "assistant/attempt":
+      case "assistant/chunk": {
+        // A retry's step time includes failed work/backoff, so it cannot be a
+        // clean request sample even if the eventual message reports usage.
+        // v4 records the failed try as assistant/attempt. v1 has no attempt
+        // event: the failed try ends as a top-level assistant/chunk whose
+        // chunk is a finish with an error or aborted reason.
+        const chunk = data?.chunk;
+        const failedFinish = entry.type === "assistant/chunk"
+          && chunk?.type === "finish"
+          && ["error", "aborted"].includes(chunk.reason?.kind);
+        if ((entry.type === "assistant/attempt" || failedFinish)
+          && openStep && openStep.turn === data?.turn && openStep.step === data?.step) {
+          openStep.failed = true;
+        }
+        break;
+      }
+      case "step/end":
+      case "turn/start":
+      case "turn/end":
+        openStep = null;
+        break;
       case "session": {
         transcript.header = entry;
         break;
@@ -329,6 +400,8 @@ async function parseDshTranscript(filePath) {
         const ts = eventTimestampMs(entry);
         const model = modelName(message?.source?.model) || transcript.fallbackModel || "unknown";
         const delta = dshUsageDelta(data?.usage);
+        const timing = messageTiming(data, openStep, ts);
+        openStep = null;
         if (delta) {
           transcript.events.push({
             kind: "usage",
@@ -336,6 +409,7 @@ async function parseDshTranscript(filePath) {
             ts,
             model,
             delta,
+            timing,
           });
         }
         break;
@@ -405,6 +479,7 @@ function buildRow(transcript, owners) {
   const times = new Set();
   const agentTypes = new Map();
   const modelsForEdits = new Map();
+  const performanceCollector = createDshPerformanceCollector();
   let turns = 0;
   let edits = 0;
   let retries = 0;
@@ -451,6 +526,9 @@ function buildRow(transcript, owners) {
       addUsage(modelRow, delta);
       modelRow.usage_events += 1;
       modelUsage.set(model, modelRow);
+      if (event.timing) performanceCollector.consumeUsage({
+        model, outputTokens: delta.output_tokens + delta.reasoning_output_tokens, ...event.timing,
+      });
       if (event.ts != null) {
         const bucketTime = new Date(Math.floor(event.ts / 60000) * 60000).toISOString();
         const key = `${model}\u0000${bucketTime}`;
@@ -478,9 +556,11 @@ function buildRow(transcript, owners) {
     const gap = orderedTimes[index] - orderedTimes[index - 1];
     if (gap > 0 && gap <= DSH_ACTIVE_GAP_MS) activeMs += gap;
   }
+  const performance = performanceCollector.finish();
   const models = [...modelUsage.values()].map((row) => ({
     ...row,
     edit_turns: modelsForEdits.get(row.model) || 0,
+    performance: performance.byModel.get(row.model) || normalizePerformance(),
   }));
   // A session that only handshook (no user turn, no usage) has nothing to say.
   if (!tokens.total_tokens && !turns) return null;
@@ -507,6 +587,7 @@ function buildRow(transcript, owners) {
     started_at: orderedTimes.length ? new Date(orderedTimes[0]).toISOString() : null,
     ended_at: orderedTimes.length ? new Date(orderedTimes.at(-1)).toISOString() : null,
     active_ms: activeMs,
+    performance: performance.performance,
     provenance: {
       source: "local-session-log",
       confidence: "observed",

package/src/lib/local-api.js

@@ -1400,6 +1400,13 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
     }
   }
 
+  function rememberIssuedAccessToken(accessToken, sourceFingerprint) {
+    if (!sourceFingerprint || typeof accessToken !== "string" || accessToken.length > 8192) return;
+    const hash = crypto.createHash("sha256").update(accessToken).digest("hex");
+    if (!issuedAccessTokenInstances.has(hash)) issuedAccessTokenInstances.set(hash, sourceFingerprint);
+    while (issuedAccessTokenInstances.size > 64) issuedAccessTokenInstances.delete(issuedAccessTokenInstances.keys().next().value);
+  }
+
   function captureAuthTokensFromBody(bodyBuffer, contentType, { newLogin = false, sourceFingerprint } = {}) {
     if (!bodyBuffer || !String(contentType || "").toLowerCase().includes("application/json")) return;
     let parsed = null;
@@ -1408,11 +1415,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
     } catch {
       return;
     }
-    if (sourceFingerprint && typeof parsed?.accessToken === "string" && parsed.accessToken.length <= 8192) {
-      const hash = crypto.createHash("sha256").update(parsed.accessToken).digest("hex");
-      if (!issuedAccessTokenInstances.has(hash)) issuedAccessTokenInstances.set(hash, sourceFingerprint);
-      while (issuedAccessTokenInstances.size > 64) issuedAccessTokenInstances.delete(issuedAccessTokenInstances.keys().next().value);
-    }
+    rememberIssuedAccessToken(parsed?.accessToken, sourceFingerprint);
     let changed = false;
     const token = typeof parsed?.csrfToken === "string" ? parsed.csrfToken.trim() : "";
     if (token) {
@@ -2073,6 +2076,90 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         const hasCsrfHeader = typeof proxyHeaders["x-csrf-token"] === "string" && proxyHeaders["x-csrf-token"].trim().length > 0;
         const relayCsrfToken = getRelayCookieValue(csrfRelayCookieName);
         const relayRefreshToken = getRelayCookieValue("insforge_refresh_token", { decode: true });
+        // Issue #1074: the backend rotates refresh tokens, but this proxy and
+        // `mintAccessToken` used to POST the same token independently. A page
+        // refresh concurrent with a background account read then consumed the
+        // token twice — the loser got 401 and the SPA signed the user out.
+        // Route every refresh that still has a persisted token through the
+        // shared mint (cache + single-flight + one retry against a just-
+        // rotated file) so both callers share one result.
+        if (p === "/api/auth/refresh" && relayRefreshToken && String(req.method || "GET").toUpperCase() === "POST") {
+          for await (const _chunk of req) { /* drain unused body */ }
+          const latestRuntime = getRuntime();
+          if (latestRuntime.configurationError || latestRuntime.baseUrl !== runtime.baseUrl || latestRuntime.anonKey !== runtime.anonKey) {
+            json(res, { code: "instance_changed", error: "The configured backend changed during authentication. Reload and sign in again." }, 409);
+            return true;
+          }
+          const mintOpts = {
+            baseUrl: insforgeBase,
+            anonKey: runtime.anonKey,
+            timeoutMs: runtime.httpTimeoutMs,
+            throwOnFailure: true,
+          };
+          const rejectIfRefreshContextChanged = () => {
+            const currentRuntime = getRuntime();
+            if (currentRuntime.configurationError || currentRuntime.baseUrl !== runtime.baseUrl || currentRuntime.anonKey !== runtime.anonKey) {
+              json(res, { code: "instance_changed", error: "The configured backend changed during authentication. Reload and sign in again." }, 409);
+              return true;
+            }
+            if (authSessionAtStart !== getCloudAccountSessionGeneration()) {
+              json(res, { error: "Account session changed", code: "auth_session_changed" }, 409);
+              return true;
+            }
+            return false;
+          };
+          let minted = null;
+          try {
+            try {
+              minted = await mintAccessToken({ ...mintOpts, refreshToken: relayRefreshToken });
+            } catch (error) {
+              // Only retry a consumed-token 401 against a just-rotated
+              // persisted token for the SAME backend/session. Otherwise a
+              // rejected mint from instance A could submit instance B's
+              // newly saved refresh token to A.
+              if (rejectIfRefreshContextChanged()) return true;
+              const latest = getRelayCookieValue("insforge_refresh_token", { decode: true });
+              if (latest && latest !== relayRefreshToken && error?.status === 401) {
+                minted = await mintAccessToken({ ...mintOpts, refreshToken: latest });
+              } else {
+                throw error;
+              }
+            }
+          } catch (error) {
+            if (rejectIfRefreshContextChanged()) return true;
+            // performMint tags every non-OK HTTP status as auth_rejected.
+            // Only a real 401 means the credential was consumed/invalid;
+            // 429/503 must not sign the SPA out.
+            if (error?.status === 401) {
+              json(res, { error: "AUTH_UNAUTHORIZED", message: "Invalid or expired refresh token" }, 401);
+              return true;
+            }
+            throw error;
+          }
+          if (rejectIfRefreshContextChanged()) return true;
+          if (!minted?.accessToken) {
+            json(res, { error: "AUTH_UNAUTHORIZED", message: "Invalid or expired refresh token" }, 401);
+            return true;
+          }
+          const payload = { accessToken: minted.accessToken };
+          if (minted.refreshToken) payload.refreshToken = minted.refreshToken;
+          if (minted.user) payload.user = minted.user;
+          // Persist the rotation without bumping sessionGeneration — that
+          // would 409 a concurrent waiter that shared this mint.
+          // setRelayRefreshToken matches the background account-read path.
+          if (minted.refreshToken) setRelayRefreshToken(minted.refreshToken);
+          if (minted.csrfToken) setRelayCsrfToken(minted.csrfToken);
+          // Cache hits return csrfToken:null. The SDK still needs the current
+          // CSRF to sign out; without it, logout 403s and a reload signs the
+          // user back in. Fall back to the relayed token we just persisted.
+          const csrfToken = minted.csrfToken || getRelayCookieValue(csrfRelayCookieName);
+          if (csrfToken) payload.csrfToken = csrfToken;
+          rememberIssuedAccessToken(minted.accessToken, fingerprintFor(runtime));
+          const resBody = Buffer.from(JSON.stringify(payload));
+          res.writeHead(200, { "content-type": "application/json" });
+          res.end(resBody);
+          return true;
+        }
         // A cookie-less client (fresh WebView after an app update/restart) has no
         // browser session to pair a CSRF token with — the persisted refresh token
         // replayed through the mobile flow is the only viable recovery. The relay

package/src/lib/pricing/curated-overrides.json

@@ -903,6 +903,14 @@
       "match": "gpt-5.6",
       "ref": "gpt-5.6-sol"
     },
+    {
+      "match": "gemini-4-argon",
+      "ref": "gemini-4-argon"
+    },
+    {
+      "match": "gemini-4.argon",
+      "ref": "gemini-4-argon"
+    },
     {
       "match": "kiro",
       "ref": "kiro-cli-agent"