tokentracker-cli 1.5.6 → 1.5.7

package/src/lib/devin-limits.js

@@ -16,6 +16,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
+const { parse: parseToml } = require("smol-toml");
 
 const DEVIN_PLAN_STATUS_URL =
   "https://server.codeium.com/exa.seat_management_pb.SeatManagementService/GetPlanStatus";
@@ -28,25 +29,26 @@ function isNonEmptyString(value) {
   return typeof value === "string" && value.trim().length > 0;
 }
 
-// Minimal root-level TOML reader for the CLI-written credentials file: bare
-// `key = value` lines before the first `[section]`, nothing else.
-function parseDevinCredentialsToml(raw) {
-  const fields = {};
-  for (const line of String(raw).split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    if (trimmed.startsWith("[")) break;
-    const match = /^([A-Za-z0-9_]+)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))\s*(?:#.*)?$/.exec(
-      trimmed,
-    );
-    if (!match) continue;
-    const [, key, doubleQuoted, singleQuoted, bare] = match;
-    fields[key] = doubleQuoted ?? singleQuoted ?? bare ?? "";
-  }
-  return fields;
+// Local sign-in problems are persistent configuration errors, not transient
+// fetch failures: the aggregator's disk-cache fallback must never mask them,
+// so they carry a distinctive code the assembly can gate on.
+function credentialsError(message) {
+  const error = new Error(message);
+  error.code = "CREDENTIALS_INVALID";
+  return error;
 }
 
-// Returns { apiKey } or null when no sign-in exists (no home, or the file is
+// A credential-file revision, not a token fingerprint or account claim. Both
+// in-place edits (ctime/mtime) and atomic replacements (device/inode) invalidate
+// old windows, including across restarts. Never persist the token or its hash.
+function devinCredentialIdentity(filePath, stat) {
+  return JSON.stringify([
+    path.resolve(filePath),
+    ...[stat.dev, stat.ino, stat.size, stat.mtimeNs, stat.ctimeNs].map(String),
+  ]);
+}
+
+// Returns { apiKey, cacheIdentity } or null when no sign-in exists (no home, or the file is
 // absent — ENOENT only). Any other read failure or a mangled file throws an
 // owned, actionable error with no path or filesystem details, so a broken
 // sign-in can never masquerade as "not configured".
@@ -64,20 +66,42 @@ function readDevinCredentials({ home, env = process.env } = {}) {
     ? path.join(dir, "devin", "credentials.toml")
     : path.join(dir, ".local", "share", "devin", "credentials.toml");
   let raw;
+  let descriptor;
+  let cacheIdentity = null;
   try {
-    raw = fs.readFileSync(base, "utf8");
+    // Read the token and revision from the same opened file, so an atomic
+    // replacement cannot stamp the old token with the new file's revision.
+    descriptor = fs.openSync(base, "r");
+    const before = fs.fstatSync(descriptor, { bigint: true });
+    if (!before.isFile()) throw new Error("Not a credentials file");
+    raw = fs.readFileSync(descriptor, "utf8");
+    const after = fs.fstatSync(descriptor, { bigint: true });
+    const identity = devinCredentialIdentity(base, before);
+    if (identity === devinCredentialIdentity(base, after)) cacheIdentity = identity;
   } catch (error) {
     if (error && error.code === "ENOENT") return null;
-    throw new Error(
+    throw credentialsError(
       "Could not read the Devin CLI credentials file — check its permissions or run `devin auth login` to sign in again.",
     );
+  } finally {
+    if (descriptor !== undefined) fs.closeSync(descriptor);
+  }
+  // Decode the credential document, then select only the root-level auth
+  // fields, like the other providers' structured credential readers.
+  let fields;
+  try {
+    fields = parseToml(raw);
+  } catch {
+    // Parser errors may quote credentials; expose only an owned message.
+    throw credentialsError(
+      "Could not parse the Devin CLI credentials file — run `devin auth login` to sign in again.",
+    );
   }
-  const fields = parseDevinCredentialsToml(raw);
   const apiKey = isNonEmptyString(fields.windsurf_api_key)
     ? fields.windsurf_api_key.trim()
     : null;
   if (!apiKey) {
-    throw new Error(
+    throw credentialsError(
       "Devin credentials file has no sign-in token — run `devin auth login`.",
     );
   }
@@ -85,11 +109,20 @@ function readDevinCredentials({ home, env = process.env } = {}) {
     ? fields.api_server_url.trim().replace(/\/+$/, "")
     : null;
   if (apiServerUrl && apiServerUrl !== DEVIN_API_ORIGIN) {
-    throw new Error(
+    throw credentialsError(
       "Devin credentials point at a custom api_server_url, which this quota provider does not support.",
     );
   }
-  return { apiKey };
+  return { apiKey, cacheIdentity };
+}
+
+function resolveDevinCacheIdentity(options) {
+  try {
+    return readDevinCredentials(options)?.cacheIdentity || null;
+  } catch {
+    // Unreadable, missing or invalid current credentials must fail closed.
+    return null;
+  }
 }
 
 function malformed(field) {
@@ -226,9 +259,14 @@ async function fetchDevinLimits({ home, env = process.env, enabled = false, fetc
     throw error;
   }
   if (!response?.ok) {
-    throw new Error(
+    const error = new Error(
       `Devin quota request was rejected (HTTP ${response?.status ?? "?"}).`,
     );
+    // The aggregate's disk-cache fallback only covers transient failures:
+    // carrying the status lets it tell a 429/5xx blip from an ambiguous or
+    // persistent rejection like HTTP 400 (docs/devin-limits.md).
+    if (typeof response?.status === "number") error.statusCode = response.status;
+    throw error;
   }
   let body;
   try {
@@ -243,7 +281,9 @@ async function fetchDevinLimits({ home, env = process.env, enabled = false, fetc
     plan_label: windows.plan_label,
     primary_window: windows.primary_window,
     secondary_window: windows.secondary_window,
+    // Internal: the aggregate strips this before returning its payload.
+    cache_identity: credentials.cacheIdentity,
   };
 }
 
-module.exports = { fetchDevinLimits };
+module.exports = { fetchDevinLimits, resolveDevinCacheIdentity };

package/src/lib/diagnostics.js

@@ -20,6 +20,7 @@ const { probeOpenclawSessionPluginState } = require("./openclaw-session-plugin")
 const { probeGrokHookState } = require("./grok-hook");
 const { resolveTrackerPaths } = require("./tracker-paths");
 const { resolveDeviceTokenPresence } = require("./cloud-device-token");
+const { inspectTraeCnAuth } = require("./trae-cn-config");
 const wsl = require("./wsl-probe");
 // TASK-011: Kiro paths inlined here to avoid pulling the ~4000-line
 // rollout module on every `tokentracker status` / `diagnostics` call.
@@ -195,6 +196,7 @@ async function collectTrackerDiagnostics({
     ? new Date(uploadThrottle.lastSuccessMs).toISOString()
     : null;
   const autoRetryAt = parseEpochMsToIso(autoRetry?.retryAtMs);
+  const traeCn = inspectTraeCnAuth({ home });
 
   return {
     ok: true,
@@ -233,6 +235,7 @@ async function collectTrackerDiagnostics({
       merge_policy:
         "Kiro IDE and Kiro CLI both emit source='kiro' in queue.jsonl so token, cost, heatmap, and leaderboard aggregations merge transparently. Use this block to distinguish sub-path contributions.",
     },
+    trae_cn: { ...traeCn, storage_path: redactValue(traeCn.storage_path, home) },
     scan_roots: {
       codex: describeScanRoots(scanRoots.codex),
       claude: describeScanRoots(scanRoots.claude),

package/src/lib/doctor.js

@@ -293,6 +293,19 @@ async function checkNetwork({ baseUrl, fetch }) {
 
 function buildDiagnosticsChecks(diagnostics) {
   const checks = [];
+  const traeCn = diagnostics?.trae_cn;
+  if (traeCn) {
+    const { TRAE_CN_AUTH_HELP } = require("./trae-cn-config");
+    checks.push({
+      id: "trae_cn.auth",
+      status: !traeCn.usage_opt_in || traeCn.auth === "readable" ? "ok" : "warn",
+      detail: !traeCn.usage_opt_in
+        ? "usage sync off (TOKENTRACKER_TRAE_CN_USAGE=1 opts in); auth not read; no TRAE request made"
+        : `local auth ${traeCn.auth}; API access not checked (${traeCn.storage_path || "storage.json not found"}). ${TRAE_CN_AUTH_HELP}`,
+      critical: false,
+      meta: traeCn,
+    });
+  }
   const notify = diagnostics?.notify || {};
   const notifyConfigured = Boolean(
     notify.codex_notify_configured ||

package/src/lib/local-api.js

@@ -1,3 +1,4 @@
+const { hasUnknownBackendCost } = require("./claude-backend");
 const fs = require("node:fs");
 const os = require("node:os");
 const path = require("node:path");
@@ -2942,6 +2943,7 @@ function createLocalApiHandler({ queuePath, serverVersion = null, trackerDataDir
         if (!sa.models.has(mdl))
           sa.models.set(mdl, { model: mdl, model_id: mdl, pricing: getModelPricingInfo(mdl, { source: src }), totals: { total_tokens: 0, billable_total_tokens: 0, input_tokens: 0, output_tokens: 0, cached_input_tokens: 0, cache_creation_input_tokens: 0, reasoning_output_tokens: 0, conversation_count: 0, total_cost_usd: "0" } });
         const ma = sa.models.get(mdl);
+        if (hasUnknownBackendCost(row)) ma.pricing = getModelPricingInfo(mdl, row);
         const reportedCost = ["grok", "cline"].includes(src) && Number(row.total_cost_usd) > 0;
         const costSource = reportedCost ? "provider_reported" : "model_pricing";
         ma.cost_source = ma.cost_source && ma.cost_source !== costSource ? "mixed" : costSource;

package/src/lib/local-usage-transfer.js

@@ -7,6 +7,8 @@ const crypto = require("node:crypto");
 const { openLock, writeFileAtomic } = require("./fs");
 const { isAccountLevelSource } = require("./source-metadata");
 
+const { backendFromUrl, TOKEN_FIELDS: BACKEND_TOKEN_FIELDS } = require("./claude-backend");
+
 const SCHEMA = "tokentracker.local-usage.v1";
 const MAX_BYTES = 5 * 1024 * 1024;
 const MAX_STATE_BYTES = 64 * 1024 * 1024;
@@ -15,7 +17,7 @@ const TOKEN_FIELDS = ["input_tokens", "output_tokens", "cached_input_tokens", "c
   "reasoning_output_tokens", "total_tokens", "billable_total_tokens", "conversation_count",
   ...["long_context_", "priority_", "priority_long_context_", "ultrafast_", "ultrafast_long_context_"].flatMap((prefix) =>
     ["input_tokens", "output_tokens", "cached_input_tokens", "cache_creation_input_tokens", "reasoning_output_tokens"].map((field) => prefix + field))];
-const ROW_FIELDS = new Set(["source", "model", "hour_start", "total_cost_usd", ...TOKEN_FIELDS]);
+const ROW_FIELDS = new Set(["source", "model", "hour_start", "total_cost_usd", "backend_usage", ...TOKEN_FIELDS]);
 const validId = (id) => typeof id === "string" && /^[A-Za-z0-9_-]{8,128}$/.test(id);
 const validTime = (value) => typeof value === "string" && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
 const digest = (value) => crypto.createHash("sha256").update(JSON.stringify(value)).digest("hex");
@@ -47,6 +49,25 @@ function cleanRow(row, strict = false) {
     if (!Number.isFinite(row.total_cost_usd) || row.total_cost_usd < 0) fail("invalid_snapshot");
     result.total_cost_usd = row.total_cost_usd;
   }
+  if (row.backend_usage !== undefined) {
+    if (row.source !== "claude" || !Array.isArray(row.backend_usage)) fail("invalid_snapshot");
+    const sums = {};
+    result.backend_usage = row.backend_usage.map((part) => {
+      if (!part || typeof part !== "object") fail("invalid_snapshot");
+      const identity = backendFromUrl(part.backend_origin);
+      if (part.backend !== identity.backend || part.backend_origin !== identity.backend_origin ||
+          Object.keys(part).some((key) => !["backend", "backend_origin", ...BACKEND_TOKEN_FIELDS].includes(key))) fail("invalid_snapshot");
+      const clean = { ...identity };
+      for (const field of BACKEND_TOKEN_FIELDS) {
+        const value = part[field] ?? 0;
+        if (!Number.isSafeInteger(value) || value < 0) fail("invalid_snapshot");
+        sums[field] = (sums[field] || 0) + value;
+        if (sums[field] > (result[field] || 0)) fail("invalid_snapshot");
+        clean[field] = value;
+      }
+      return clean;
+    });
+  }
   return result;
 }
 

package/src/lib/pricing/index.js

@@ -1,3 +1,4 @@
+const { hasUnknownBackendCost, TOKEN_FIELDS } = require("../claude-backend");
 // Public pricing API. Replaces the hard-coded MODEL_PRICING table that used
 // to live in src/lib/local-api.js. Keeps the same synchronous shape so all
 // existing callers (computeRowCost, /functions/* handlers, tests) work
@@ -139,6 +140,7 @@ const pricingInfoCache = { revision: -1, entries: new Map() };
 // Preserve matcher provenance: a known zero rate is free, a missing model is
 // unpriced. Both return zero dollars, but they mean different things in the UI.
 function getModelPricingInfo(model, opts = {}) {
+  if (hasUnknownBackendCost(opts)) return { status: "unpriced", source: null, ...ZERO_PRICING };
   const source = typeof opts === "string" ? opts : opts.source;
   const sourceKey = typeof source === "string" ? source.toLowerCase() : null;
   if (pricingInfoCache.revision !== state.revision) {
@@ -340,6 +342,16 @@ function speedTierSubsetCost(row, prefix, pricing, ctx) {
 // computeRowCost in src/lib/local-api.js. Moved here so vite mock + local
 // server share one source of truth.
 function computeRowCost(row) {
+  if (hasUnknownBackendCost(row)) {
+    // Existing totals without provenance retain their historical estimate. Only
+    // the newly ingested custom/unknown subset is excluded from model pricing.
+    const priced = { ...row, backend_usage: undefined };
+    for (const part of row.backend_usage) {
+      if (part.backend === "anthropic") continue;
+      for (const field of TOKEN_FIELDS) priced[field] = Math.max(0, (priced[field] || 0) - (part[field] || 0));
+    }
+    return computeRowCost(priced);
+  }
   if (LOCAL_INFERENCE_SOURCES.has(String(row?.source || "").toLowerCase())) return 0;
   // Pi can route a turn through a subscription-backed Copilot provider. Pi's
   // usage record reports a zero marginal cost for those turns; do not