tokentracker-cli 1.5.2 → 1.5.3

package/src/lib/deepseek-status.js

@@ -0,0 +1,157 @@
+// DeepSeek service-status probe.
+//
+// status.deepseek.com is a Flashcat(快猫)-hosted Next.js app. Unlike Statuspage.io
+// it exposes no public JSON API and sends no CORS headers, so a browser cannot
+// read it directly. The page state is, however, inlined in the server render as
+// React Server Component "flight" data: the client script pushes JSON chunks via
+// self.__next_f.push([1, "<json string>"]). We concatenate those chunks and read
+// the single machine-readable signal — the live `active_changes` array.
+//
+// Semantics (Flashcat change status -> Statuspage.io indicator):
+//   operational                                      -> none
+//   degraded / degraded_performance / maintenance    -> minor
+//   partial_outage                                   -> major
+//   major_outage / full_outage                       -> critical
+// An empty active_changes array means everything is operational. Anything we
+// cannot parse throws, so the caller falls back instead of inventing "all good".
+
+const DEEPSEEK_STATUS_URL = "https://status.deepseek.com/";
+
+const RSC_PUSH_RE = /self\.__next_f\.push\(\[1,("(?:[^"\\]|\\.)*")\]\)/g;
+
+const CHANGE_STATUS_TO_INDICATOR = {
+  operational: "none",
+  degraded: "minor",
+  degraded_performance: "minor",
+  maintenance: "minor",
+  under_maintenance: "minor",
+  partial_outage: "major",
+  major_outage: "critical",
+  full_outage: "critical",
+  outage: "critical",
+};
+
+const INDICATOR_RANK = { none: 0, minor: 1, major: 2, critical: 3 };
+
+function extractFlight(html) {
+  if (typeof html !== "string" || html.length === 0) {
+    throw new Error("DeepSeek status: expected an HTML document");
+  }
+  let flight = "";
+  let chunks = 0;
+  RSC_PUSH_RE.lastIndex = 0;
+  let match;
+  while ((match = RSC_PUSH_RE.exec(html))) {
+    try {
+      flight += JSON.parse(match[1]);
+    } catch (_error) {
+      throw new Error("DeepSeek status: malformed RSC chunk");
+    }
+    chunks += 1;
+  }
+  if (chunks === 0) {
+    throw new Error("DeepSeek status: no RSC data found");
+  }
+  return flight;
+}
+
+// Return the balanced JSON array that starts at `start` (a '[' in flight).
+function sliceJsonArray(flight, start) {
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i = start; i < flight.length; i += 1) {
+    const ch = flight[i];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') inString = true;
+    else if (ch === "[") depth += 1;
+    else if (ch === "]") {
+      depth -= 1;
+      if (depth === 0) return flight.slice(start, i + 1);
+    }
+  }
+  throw new Error("DeepSeek status: unterminated active_changes array");
+}
+
+function readUpdatedAt(flight) {
+  const match = /"initialDataUpdatedAt":(\d{10,})/.exec(flight);
+  if (!match) return undefined;
+  const ms = Number(match[1]);
+  return Number.isFinite(ms) ? new Date(ms).toISOString() : undefined;
+}
+
+/**
+ * Parse the status.deepseek.com HTML into a Statuspage.io-shaped payload:
+ *   { status: { indicator, description }, page: { updated_at } }
+ * Throws when the page structure is not understood, so callers fall back
+ * instead of reporting a false "operational".
+ */
+function parseDeepSeekStatusPage(html) {
+  const flight = extractFlight(html);
+  const marker = '"active_changes":';
+  const markerIndex = flight.indexOf(marker);
+  if (markerIndex === -1) {
+    throw new Error("DeepSeek status: active_changes not found");
+  }
+  // The value must be an array. If upstream ever reports null / an object /
+  // anything else, refuse to guess a healthier-looking array further along the
+  // document — throwing keeps the caller on its last-good / "unknown" path
+  // instead of inventing a false "operational".
+  let arrayStart = markerIndex + marker.length;
+  while (arrayStart < flight.length && /\s/.test(flight[arrayStart])) arrayStart += 1;
+  if (flight[arrayStart] !== "[") {
+    throw new Error("DeepSeek status: active_changes is not an array");
+  }
+  let changes;
+  try {
+    changes = JSON.parse(sliceJsonArray(flight, arrayStart));
+  } catch (error) {
+    throw new Error("DeepSeek status: cannot parse active_changes (" + error.message + ")");
+  }
+  if (!Array.isArray(changes)) {
+    throw new Error("DeepSeek status: active_changes is not an array");
+  }
+
+  const updatedAt = readUpdatedAt(flight);
+  if (changes.length === 0) {
+    return { status: { indicator: "none", description: "" }, page: { updated_at: updatedAt } };
+  }
+
+  let worstIndicator = "none";
+  let worstRank = -1;
+  let descriptions = [];
+  for (const change of changes) {
+    if (!change || typeof change !== "object") continue;
+    const rawStatus = String(change.status || change.change_status || change.impact || "").toLowerCase();
+    const indicator = CHANGE_STATUS_TO_INDICATOR[rawStatus] || "minor";
+    const rank = INDICATOR_RANK[indicator];
+    const description = typeof change.name === "string" ? change.name
+      : typeof change.title === "string" ? change.title
+      : typeof change.description === "string" ? change.description
+      : "";
+    if (rank > worstRank) {
+      worstRank = rank;
+      worstIndicator = indicator;
+      descriptions = description ? [description] : [];
+    } else if (rank === worstRank && description) {
+      descriptions.push(description);
+    }
+  }
+  // A non-empty array with no readable change is still "something is wrong".
+  if (worstRank < 0) worstIndicator = "minor";
+
+  return {
+    status: { indicator: worstIndicator, description: descriptions.join("; ") },
+    page: { updated_at: updatedAt },
+  };
+}
+
+module.exports = {
+  parseDeepSeekStatusPage,
+  DEEPSEEK_STATUS_URL,
+};

package/src/lib/local-api.js

@@ -20,6 +20,7 @@ const { createCloudDeviceTokenStore } = require("./cloud-device-token");
 const { parseBearerToken } = require("./bearer-token");
 const { writeJsonAtomicSync } = require("./atomic-json");
 const { createLocalUsageTransfer, MAX_BYTES: LOCAL_USAGE_MAX_BYTES } = require("./local-usage-transfer");
+const { fetchProviderServiceStatus } = require("./provider-status");
 
 const SYNC_TIMEOUT_MS = 120_000;
 // A failed account-view request should not stall every dashboard refresh
@@ -1677,6 +1678,32 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
 
   return async function handleLocalApi(req, res, url) {
     const p = url.pathname;
+    // status.deepseek.com has no public JSON API or CORS, so the dashboard
+    // cannot probe it like the other providers. Relay it through the local app:
+    // fetchProviderServiceStatus("deepseek") fetches + parses the server-rendered
+    // page (with a 5-minute cache and 6s timeout in provider-status.js) and we
+    // return a Statuspage.io-shaped payload the existing dashboard parser reads.
+    if (p === "/api/deepseek-status") {
+      const method = String(req.method || "GET").toUpperCase();
+      if (method !== "GET" && method !== "HEAD") {
+        json(res, { error: "Method Not Allowed" }, 405);
+        return true;
+      }
+      try {
+        const reading = await fetchProviderServiceStatus("deepseek");
+        if (!reading) {
+          json(res, { error: "DeepSeek status unavailable" }, 502);
+          return true;
+        }
+        json(res, {
+          page: { updated_at: reading.updated_at },
+          status: { indicator: reading.indicator, description: reading.description || "" },
+        });
+      } catch (error) {
+        json(res, { error: `DeepSeek status probe error: ${error?.message || error}` }, 502);
+      }
+      return true;
+    }
     if (p === "/api/local-usage") {
       if (!isAuthorizedLocalMutation(req)) { json(res, { code: "unauthorized" }, 401); return true; }
       try {
@@ -2718,7 +2745,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         const src = row.source || "unknown";
         const mdl = row.model || "unknown";
         if (!bySource.has(src))
-          bySource.set(src, { source: src, source_scope: getSourceScope(src), totals: { total_tokens: 0, billable_total_tokens: 0, input_tokens: 0, output_tokens: 0, cached_input_tokens: 0, cache_creation_input_tokens: 0, reasoning_output_tokens: 0, total_cost_usd: "0" }, models: new Map() });
+          bySource.set(src, { source: src, source_scope: getSourceScope(src), totals: { total_tokens: 0, billable_total_tokens: 0, input_tokens: 0, output_tokens: 0, cached_input_tokens: 0, cache_creation_input_tokens: 0, reasoning_output_tokens: 0, conversation_count: 0, total_cost_usd: "0" }, models: new Map() });
         const sa = bySource.get(src);
         sa.totals.total_tokens += row.total_tokens || 0;
         sa.totals.billable_total_tokens += row.billable_total_tokens ?? row.total_tokens ?? 0;
@@ -2727,8 +2754,12 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         sa.totals.cached_input_tokens += row.cached_input_tokens || 0;
         sa.totals.cache_creation_input_tokens += row.cache_creation_input_tokens || 0;
         sa.totals.reasoning_output_tokens += row.reasoning_output_tokens || 0;
+        // Request-only sources (#948: credit-billed transcripts that report no
+        // tokens) carry their activity solely as conversation_count — thread it
+        // through so the dashboard can surface "0 tokens / N requests".
+        sa.totals.conversation_count += row.conversation_count || 0;
         if (!sa.models.has(mdl))
-          sa.models.set(mdl, { model: mdl, model_id: mdl, pricing: getModelPricingInfo(mdl, { source: src }), totals: { total_tokens: 0, billable_total_tokens: 0, input_tokens: 0, output_tokens: 0, cached_input_tokens: 0, cache_creation_input_tokens: 0, reasoning_output_tokens: 0, total_cost_usd: "0" } });
+          sa.models.set(mdl, { model: mdl, model_id: mdl, pricing: getModelPricingInfo(mdl, { source: src }), totals: { total_tokens: 0, billable_total_tokens: 0, input_tokens: 0, output_tokens: 0, cached_input_tokens: 0, cache_creation_input_tokens: 0, reasoning_output_tokens: 0, conversation_count: 0, total_cost_usd: "0" } });
         const ma = sa.models.get(mdl);
         const reportedCost = ["grok", "cline"].includes(src) && Number(row.total_cost_usd) > 0;
         const costSource = reportedCost ? "provider_reported" : "model_pricing";
@@ -2740,6 +2771,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         ma.totals.cached_input_tokens += row.cached_input_tokens || 0;
         ma.totals.cache_creation_input_tokens += row.cache_creation_input_tokens || 0;
         ma.totals.reasoning_output_tokens += row.reasoning_output_tokens || 0;
+        ma.totals.conversation_count += row.conversation_count || 0;
         // Price each row, exactly as aggregateByDay does for the hero (#653).
         // computeRowCost is not linear for models with a Fast tier or
         // long-context rates: priority_* / long_context_* mark a subset of the
@@ -3672,7 +3704,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
 
     // --- usage-limits ---
     if (p === "/functions/tokentracker-usage-limits") {
-      const { getUsageLimits, resetUsageLimitsCache } = require("./usage-limits");
+      const { getUsageLimits, resetUsageLimitsCache, normalizeHiddenProviders } = require("./usage-limits");
       try {
         // Devin quota is opt-in (Settings > Usage & Limits > Providers). An
         // explicit devin=1 without local authentication is rejected before any
@@ -3683,7 +3715,14 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         const localAuthorized = isAuthorizedLocalMutation(req);
         const devinParam = url.searchParams.get("devin");
         const devinEnabled = devinParam === "1" || devinParam === "true";
-        if (devinEnabled && !localAuthorized) {
+        // Provider visibility gate (#956): hidden=<csv> names provider rows to
+        // skip entirely — no upstream call, no credential read. Like devin=1,
+        // an explicit list is honored only together with the loopback auth
+        // header (letting an unauthenticated caller scope the fetch would let
+        // it pick exactly which credentials to leave alone). Unknown ids are
+        // dropped by the normalizer, so the gate only ever narrows.
+        const hiddenProviders = normalizeHiddenProviders(url.searchParams.get("hidden"));
+        if ((devinEnabled || hiddenProviders) && !localAuthorized) {
           json(res, { error: "Unauthorized" }, 401);
           return true;
         }
@@ -3701,6 +3740,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
           // cooldown) — an explicit user refresh should hit upstream.
           forceRefresh,
           devinEnabled,
+          hiddenProviders,
         });
         json(res, data);
       } catch (e) {