tokmon 0.22.6 → 0.23.0

package/dist/{chunk-FO7IUYCM.js → chunk-AON6GE7D.js}

@@ -1,6 +1,16 @@
 #!/usr/bin/env node
+import {
+  appVersion,
+  browserUrl,
+  findWebRoot,
+  send,
+  sendJson,
+  serveStatic
+} from "./chunk-HXDAOOSI.js";
 import {
   PROVIDERS,
+  TOKMON_CAPABILITIES,
+  TOKMON_PROTOCOL_VERSION,
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
   TokmonRpcGroup,
@@ -11,7 +21,7 @@ import {
   namedHex,
   resolveTimezone,
   withTimeout
-} from "./chunk-AQNFQRWV.js";
+} from "./chunk-PGQK7MOE.js";
 import {
   cacheDir,
   expandHome,
@@ -19,11 +29,11 @@ import {
   normalizeConfig,
   saveConfig,
   snapshotCacheFile
-} from "./chunk-QTHCHB7S.js";
+} from "./chunk-DJPUYMZM.js";
 
 // src/web/server.ts
 import { createServer } from "http";
-import { randomBytes } from "crypto";
+import { randomBytes, timingSafeEqual as timingSafeEqual2 } from "crypto";
 
 // src/web/data.ts
 async function resolveAccounts(config) {
@@ -103,115 +113,11 @@ function tzFor(config) {
   return resolveTimezone(config.timezone);
 }
 
-// src/web/static.ts
-import { createReadStream, existsSync, readFileSync } from "fs";
-import { stat } from "fs/promises";
-import { fileURLToPath } from "url";
-import { extname, join, normalize, sep } from "path";
-var MIME = {
-  ".html": "text/html; charset=utf-8",
-  ".js": "text/javascript; charset=utf-8",
-  ".mjs": "text/javascript; charset=utf-8",
-  ".css": "text/css; charset=utf-8",
-  ".json": "application/json; charset=utf-8",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".ico": "image/x-icon",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".otf": "font/otf",
-  ".map": "application/json; charset=utf-8",
-  ".webmanifest": "application/manifest+json"
-};
-function findWebRoot() {
-  const candidates = ["./web/", "../web/", "../dist/web/", "../../dist/web/"];
-  for (const rel of candidates) {
-    try {
-      const dir = fileURLToPath(new URL(rel, import.meta.url));
-      if (existsSync(join(dir, "index.html"))) return dir.replace(/[\\/]+$/, "");
-    } catch {
-    }
-  }
-  return null;
-}
-function resolveStaticPath(webRoot, urlPath) {
-  let clean;
-  try {
-    clean = decodeURIComponent(urlPath.split("?")[0]);
-  } catch {
-    return null;
-  }
-  const rel = normalize(clean).replace(/^(\.\.[/\\])+/, "").replace(/^[/\\]+/, "");
-  const full = join(webRoot, rel);
-  if (full !== webRoot && !full.startsWith(webRoot + sep)) return null;
-  return full;
-}
-function send(res, status, type, body) {
-  res.writeHead(status, { "Content-Type": type, "Cache-Control": "no-store" });
-  res.end(body);
-}
-function sendJson(res, status, data) {
-  send(res, status, "application/json; charset=utf-8", JSON.stringify(data));
-}
-function serveStatic(webRoot, urlPath, res) {
-  const path = urlPath.split("?")[0];
-  const filePath = resolveStaticPath(webRoot, path === "/" ? "/index.html" : path);
-  if (!filePath) {
-    send(res, 403, "text/plain", "forbidden");
-    return;
-  }
-  void stat(filePath).then((st) => {
-    if (st.isFile()) {
-      const type = MIME[extname(filePath).toLowerCase()] || "application/octet-stream";
-      const immutable = filePath.includes(`${sep}assets${sep}`);
-      res.writeHead(200, {
-        "Content-Type": type,
-        "Cache-Control": immutable ? "public, max-age=31536000, immutable" : "no-cache"
-      });
-      createReadStream(filePath).pipe(res);
-    } else {
-      throw new Error("not a file");
-    }
-  }).catch(() => {
-    if (extname(path)) {
-      send(res, 404, "text/plain", "not found");
-      return;
-    }
-    const indexPath = join(webRoot, "index.html");
-    if (!existsSync(indexPath)) {
-      send(res, 404, "text/plain", "not found");
-      return;
-    }
-    res.writeHead(200, { "Content-Type": MIME[".html"], "Cache-Control": "no-cache" });
-    createReadStream(indexPath).on("error", () => {
-      try {
-        res.destroy();
-      } catch {
-      }
-    }).pipe(res);
-  });
-}
-function appVersion() {
-  for (const rel of ["../package.json", "../../package.json"]) {
-    try {
-      const p = fileURLToPath(new URL(rel, import.meta.url));
-      const pkg = JSON.parse(readFileSync(p, "utf-8"));
-      if (typeof pkg.version === "string") return pkg.version;
-    } catch {
-    }
-  }
-  return "";
-}
-
 // src/web/vite-dev.ts
-import { existsSync as existsSync2 } from "fs";
-import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
+import { existsSync } from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
 import { createRequire } from "module";
-import { join as join2 } from "path";
+import { join } from "path";
 function isDevMode() {
   const forced = process.env.TOKMON_WEB_MODE;
   if (forced === "dev") return true;
@@ -221,8 +127,8 @@ function isDevMode() {
 function findWebSource() {
   for (const rel of ["../../web/", "../web/", "./web/"]) {
     try {
-      const dir = fileURLToPath2(new URL(rel, import.meta.url));
-      if (existsSync2(join2(dir, "vite.config.ts")) && existsSync2(join2(dir, "index.html"))) {
+      const dir = fileURLToPath(new URL(rel, import.meta.url));
+      if (existsSync(join(dir, "vite.config.ts")) && existsSync(join(dir, "index.html"))) {
         return dir.replace(/[\\/]+$/, "");
       }
     } catch {
@@ -237,12 +143,12 @@ async function createViteDevServer(httpServer, log) {
     return null;
   }
   try {
-    const req = createRequire(pathToFileURL(join2(root, "package.json")).href);
+    const req = createRequire(pathToFileURL(join(root, "package.json")).href);
     const vitePath = req.resolve("vite");
     const vite = await import(pathToFileURL(vitePath).href);
     const dev = await vite.createServer({
       root,
-      configFile: join2(root, "vite.config.ts"),
+      configFile: join(root, "vite.config.ts"),
       server: { middlewareMode: true, hmr: { server: httpServer } },
       appType: "spa",
       clearScreen: false,
@@ -266,13 +172,90 @@ code{color:#e6b450}</style></head><body>
 </body></html>`;
 
 // src/web/data-engine.ts
-import { readFileSync as readFileSync2, writeFileSync, mkdirSync, renameSync } from "fs";
+import { readFileSync, writeFileSync, mkdirSync, renameSync } from "fs";
+
+// src/web/refresh-queue.ts
+function deferred() {
+  let resolve;
+  let reject;
+  const promise = new Promise((onResolve, onReject) => {
+    resolve = onResolve;
+    reject = onReject;
+  });
+  return { promise, resolve, reject };
+}
+function createRefreshQueue(perform, skipAutomatic = () => false) {
+  let activePass = null;
+  let activeResult = null;
+  let queued = null;
+  let stopped = false;
+  const launch = (result = deferred()) => {
+    const pass = Promise.resolve().then(perform);
+    activePass = pass;
+    activeResult = result;
+    const settled = (succeeded, cause) => {
+      if (activePass !== pass) return;
+      activePass = null;
+      activeResult = null;
+      const next = queued;
+      queued = null;
+      if (next && !stopped) {
+        void next.promise.then(
+          () => {
+            if (succeeded) result.resolve();
+            else result.reject(cause);
+          },
+          result.reject
+        );
+        launch(next);
+        return;
+      }
+      if (next) next.resolve();
+      if (succeeded) result.resolve();
+      else result.reject(cause);
+    };
+    void pass.then(() => settled(true), (cause) => settled(false, cause));
+    return result.promise;
+  };
+  const run = (force = false) => {
+    if (stopped || !force && skipAutomatic()) return Promise.resolve();
+    if (!activePass) return launch();
+    if (!force) return activeResult.promise;
+    if (!queued) queued = deferred();
+    return queued.promise;
+  };
+  return {
+    run,
+    stop() {
+      stopped = true;
+      activeResult?.resolve();
+      queued?.resolve();
+      queued = null;
+    }
+  };
+}
+async function settleRefreshTasks(tasks) {
+  const results = await Promise.allSettled(tasks);
+  const failure = results.find((result) => result.status === "rejected");
+  if (failure) throw failure.reason;
+}
+
+// src/web/data-engine.ts
 var TABLE_INTERVAL_MS = 3e5;
 var PEAK_INTERVAL_MS = 3e5;
 var IDLE_PAUSE_MS = 6e4;
 var SNAPSHOT_CACHE_THROTTLE_MS = 2e4;
 var REVEAL_THROTTLE_MS = 500;
 var FETCH_TIMEOUT_MS = 3e4;
+function runInBackground(task) {
+  void task.catch(() => {
+  });
+}
+function throwIfRefreshFailures(scope, failures) {
+  if (failures.length > 0) {
+    throw new AggregateError(failures, `${scope} refresh failed for ${failures.length} account${failures.length === 1 ? "" : "s"}`);
+  }
+}
 function createDataEngine(opts) {
   const { version } = opts;
   let tz = opts.tz;
@@ -324,7 +307,7 @@ function createDataEngine(opts) {
   });
   const hydrateFromCache = () => {
     try {
-      const cached = JSON.parse(readFileSync2(snapshotCacheFile(), "utf-8"));
+      const cached = JSON.parse(readFileSync(snapshotCacheFile(), "utf-8"));
       if (!cached || !Array.isArray(cached.accounts)) return;
       for (const a of cached.accounts) {
         if (a.dashboard || a.table) {
@@ -375,47 +358,35 @@ function createDataEngine(opts) {
   };
   let usageAccounts = resolved.filter((r) => r.hasUsage);
   let billingAccounts = resolved.filter((r) => r.hasBilling);
-  const makeRefreshLoop = (opts2) => {
-    let busy = false;
-    let forcePending = false;
-    const run = async (force = false) => {
+  const makeRefreshLoop = (opts2) => createRefreshQueue(
+    async () => {
       if (stopped) return;
-      if (busy) {
-        if (force) forcePending = true;
-        return;
-      }
-      if (!force && idle()) return;
       const epoch = configEpoch;
-      busy = true;
-      try {
-        for (const r of opts2.accounts()) {
-          if (stopped) return;
-          let value = null;
-          let ok = true;
-          try {
-            value = await withTimeout(opts2.fetch(r), FETCH_TIMEOUT_MS);
-          } catch {
-            ok = false;
-          }
-          if (stopped || epoch !== configEpoch) return;
-          if (ok) {
-            opts2.apply(r.account.id, value);
-            opts2.state.set(r.account.id, "ready");
-          } else opts2.state.set(r.account.id, "error");
-          reveal();
-        }
-        rebuild();
-      } finally {
-        busy = false;
-        if (forcePending && !stopped) {
-          forcePending = false;
-          void run(true);
+      const failures = [];
+      for (const r of opts2.accounts()) {
+        if (stopped) return;
+        let value = null;
+        let ok = true;
+        try {
+          value = await withTimeout(opts2.fetch(r), FETCH_TIMEOUT_MS);
+        } catch (cause) {
+          ok = false;
+          failures.push(cause);
         }
+        if (stopped || epoch !== configEpoch) return;
+        if (ok) {
+          opts2.apply(r.account.id, value);
+          opts2.state.set(r.account.id, "ready");
+        } else opts2.state.set(r.account.id, "error");
+        reveal();
       }
-    };
-    return run;
-  };
+      rebuild();
+      throwIfRefreshFailures(opts2.scope, failures);
+    },
+    idle
+  );
   const refreshSummary = makeRefreshLoop({
+    scope: "summary",
     accounts: () => usageAccounts,
     fetch: (r) => fetchAccountSummary(r.account, tz),
     apply: (id, dashboard) => {
@@ -424,6 +395,7 @@ function createDataEngine(opts) {
     state: summaryState
   });
   const refreshTable = makeRefreshLoop({
+    scope: "history",
     accounts: () => usageAccounts,
     fetch: (r) => fetchAccountTable(r.account, tz),
     apply: (id, table) => {
@@ -432,6 +404,7 @@ function createDataEngine(opts) {
     state: tableState
   });
   const refreshBilling = makeRefreshLoop({
+    scope: "billing",
     accounts: () => billingAccounts,
     fetch: (r) => fetchAccountBilling(r.account, tz),
     apply: (id, result) => {
@@ -439,22 +412,19 @@ function createDataEngine(opts) {
     },
     state: billingState
   });
-  let peakBusy = false;
-  const refreshPeak = async (force = false) => {
-    if (stopped || peakBusy || !hasClaude || !force && idle()) return;
-    const epoch = configEpoch;
-    peakBusy = true;
-    try {
+  const refreshPeak = createRefreshQueue(
+    async () => {
+      if (stopped || !hasClaude) return;
+      const epoch = configEpoch;
       const next = await fetchPeak();
       if (stopped || epoch !== configEpoch || !hasClaude) return;
       if (next) {
         peak = next;
         rebuild();
       }
-    } finally {
-      peakBusy = false;
-    }
-  };
+    },
+    () => !hasClaude || idle()
+  );
   const clearTimers = () => {
     clearInterval(summaryTimer);
     summaryTimer = void 0;
@@ -467,20 +437,20 @@ function createDataEngine(opts) {
   };
   const startTimers = () => {
     summaryTimer = setInterval(() => {
-      void refreshSummary();
+      runInBackground(refreshSummary.run());
     }, summaryIntervalMs);
     tableTimer = setInterval(() => {
-      void refreshTable();
+      runInBackground(refreshTable.run());
     }, TABLE_INTERVAL_MS);
     billingTimer = setInterval(() => {
-      void refreshBilling();
+      runInBackground(refreshBilling.run());
     }, billingIntervalMs);
     summaryTimer.unref?.();
     tableTimer.unref?.();
     billingTimer.unref?.();
     if (hasClaude) {
       peakTimer = setInterval(() => {
-        void refreshPeak();
+        runInBackground(refreshPeak.run());
       }, PEAK_INTERVAL_MS);
       peakTimer.unref?.();
     }
@@ -489,21 +459,23 @@ function createDataEngine(opts) {
   return {
     snapshot: () => current,
     start() {
-      void refreshSummary(true);
-      void refreshTable(true);
-      void refreshBilling(true);
-      if (hasClaude) void refreshPeak(true);
+      runInBackground(refreshSummary.run(true));
+      runInBackground(refreshTable.run(true));
+      runInBackground(refreshBilling.run(true));
+      if (hasClaude) runInBackground(refreshPeak.run(true));
       startTimers();
     },
     touch() {
       lastActivity = Date.now();
     },
     refresh(scope = "all") {
-      if (stopped) return;
-      if (scope === "all" || scope === "summary") void refreshSummary(true);
-      if (scope === "all" || scope === "table") void refreshTable(true);
-      if (scope === "all" || scope === "billing") void refreshBilling(true);
-      if ((scope === "all" || scope === "peak") && hasClaude) void refreshPeak(true);
+      if (stopped) return Promise.resolve();
+      const tasks = [];
+      if (scope === "all" || scope === "summary") tasks.push(refreshSummary.run(true));
+      if (scope === "all" || scope === "table") tasks.push(refreshTable.run(true));
+      if (scope === "all" || scope === "billing") tasks.push(refreshBilling.run(true));
+      if ((scope === "all" || scope === "peak") && hasClaude) tasks.push(refreshPeak.run(true));
+      return settleRefreshTasks(tasks);
     },
     setConfig(next) {
       if (stopped) return;
@@ -528,10 +500,10 @@ function createDataEngine(opts) {
         for (const id of [...map.keys()]) if (!survivors.has(id)) map.delete(id);
       }
       rebuild();
-      void refreshSummary(true);
-      void refreshTable(true);
-      void refreshBilling(true);
-      if (hasClaude) void refreshPeak(true);
+      runInBackground(refreshSummary.run(true));
+      runInBackground(refreshTable.run(true));
+      runInBackground(refreshBilling.run(true));
+      if (hasClaude) runInBackground(refreshPeak.run(true));
       startTimers();
     },
     broadcastConfig(config) {
@@ -554,8 +526,8 @@ function createDataEngine(opts) {
       snapshotSubscribers.add(onSnapshot);
       lastActivity = Date.now();
       if (!current || Date.now() - current.generatedAt > summaryIntervalMs) {
-        void refreshSummary(true);
-        void refreshTable(true);
+        runInBackground(refreshSummary.run(true));
+        runInBackground(refreshTable.run(true));
       }
       return () => {
         snapshotSubscribers.delete(onSnapshot);
@@ -574,6 +546,10 @@ function createDataEngine(opts) {
     stop() {
       stopped = true;
       clearTimers();
+      refreshSummary.stop();
+      refreshTable.stop();
+      refreshBilling.stop();
+      refreshPeak.stop();
       snapshotSubscribers.clear();
       configSubscribers.clear();
     }
@@ -585,6 +561,32 @@ var MIN_SUMMARY_INTERVAL_MS = 8e3;
 var BILLING_INTERVAL_FALLBACK_MIN = 5;
 var summaryIntervalFor = (config) => Math.max(MIN_SUMMARY_INTERVAL_MS, (config.interval || 2) * 1e3);
 var billingIntervalFor = (config) => Math.max(1, config.billingInterval || BILLING_INTERVAL_FALLBACK_MIN) * 6e4;
+function toConfigState(config) {
+  return {
+    protocol: {
+      version: TOKMON_PROTOCOL_VERSION,
+      capabilities: [...TOKMON_CAPABILITIES]
+    },
+    config
+  };
+}
+var ConfigConflictError = class extends Error {
+  constructor(state) {
+    super(`config changed on the daemon (current revision ${state.config.revision})`);
+    this.state = state;
+    this.name = "ConfigConflictError";
+  }
+  state;
+  kind = "conflict";
+};
+var ConfigPersistenceError = class extends Error {
+  kind = "persistence";
+  constructor(cause) {
+    super(cause instanceof Error ? cause.message : "config could not be persisted");
+    this.name = "ConfigPersistenceError";
+    this.cause = cause;
+  }
+};
 async function resolveEngineConfig(config) {
   return {
     resolved: await resolveAccounts(config),
@@ -593,27 +595,50 @@ async function resolveEngineConfig(config) {
     billingIntervalMs: billingIntervalFor(config)
   };
 }
-async function applyConfigUpdate(engine, state, input) {
-  const normalized = normalizeConfig(input);
+var updateQueues = /* @__PURE__ */ new WeakMap();
+async function applyConfigUpdateUnlocked(engine, state, input) {
+  if (input.expectedRevision !== state.config.revision) {
+    throw new ConfigConflictError(toConfigState(state.config));
+  }
+  const normalized = normalizeConfig({
+    ...input.config,
+    revision: state.config.revision + 1
+  });
+  const engineConfig = await resolveEngineConfig(normalized);
+  try {
+    await saveConfig(normalized);
+  } catch (error) {
+    throw new ConfigPersistenceError(error);
+  }
   state.config = normalized;
-  await saveConfig(normalized);
-  engine.setConfig(await resolveEngineConfig(normalized));
+  engine.setConfig(engineConfig);
   engine.broadcastConfig(normalized);
-  return normalized;
+  return toConfigState(normalized);
+}
+async function applyConfigUpdate(engine, state, input) {
+  const previous = updateQueues.get(state) ?? Promise.resolve();
+  const operation = previous.catch(() => void 0).then(() => applyConfigUpdateUnlocked(engine, state, input));
+  const settled = operation.then(() => void 0, () => void 0);
+  updateQueues.set(state, settled);
+  void settled.then(() => {
+    if (updateQueues.get(state) === settled) updateQueues.delete(state);
+  });
+  return operation;
 }
 
 // src/web/ws.ts
+import { timingSafeEqual } from "crypto";
 import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import { NodeWS } from "@effect/platform-node/NodeSocket";
 import { Effect, Exit, Layer, Queue, Scope, Stream } from "effect";
 import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
 
 // src/web/fs.ts
-import { readdir, stat as stat2, realpath } from "fs/promises";
+import { readdir, stat, realpath } from "fs/promises";
 import { homedir } from "os";
-import { join as join3, resolve as resolvePath, isAbsolute, sep as sep2 } from "path";
+import { join as join2, resolve as resolvePath, isAbsolute, sep } from "path";
 function isContained(root, target) {
-  return target === root || target.startsWith(root + sep2);
+  return target === root || target.startsWith(root + sep);
 }
 function parentFor(root, abs) {
   const parentResolved = resolvePath(abs, "..");
@@ -633,7 +658,7 @@ async function listHomeDirectory(rawPath) {
   const abs = isContained(root, real) ? real : root;
   let st;
   try {
-    st = await stat2(abs);
+    st = await stat(abs);
   } catch {
     return { path: abs, parent: parentFor(root, abs), entries: [] };
   }
@@ -648,7 +673,7 @@ async function listHomeDirectory(rawPath) {
   for (const d of dirents) {
     if (d.name.startsWith(".")) continue;
     let dir = d.isDirectory();
-    const full = join3(abs, d.name);
+    const full = join2(abs, d.name);
     if (d.isSymbolicLink()) {
       let real2;
       try {
@@ -658,7 +683,7 @@ async function listHomeDirectory(rawPath) {
       }
       if (!isContained(root, real2)) continue;
       try {
-        dir = (await stat2(full)).isDirectory();
+        dir = (await stat(full)).isDirectory();
       } catch {
         continue;
       }
@@ -670,41 +695,15 @@ async function listHomeDirectory(rawPath) {
 }
 
 // src/web/ws.ts
-var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "localhost", "::1"]);
 function header(req, name) {
   const value = req.headers[name.toLowerCase()];
   return Array.isArray(value) ? value[0] : value;
 }
-function hostOnly(value) {
-  if (!value) return null;
-  let host = value.trim().toLowerCase();
-  if (!host) return null;
-  if (host.startsWith("[")) {
-    const end = host.indexOf("]");
-    return end === -1 ? host.slice(1) : host.slice(1, end);
-  }
-  return host.split(":")[0] ?? null;
-}
 function isLoopbackHost(value) {
-  const host = hostOnly(value);
-  return host !== null && LOOPBACK_HOSTS.has(host);
-}
-function originHost(origin) {
-  if (!origin || origin === "null") return null;
-  try {
-    return new URL(origin).host;
-  } catch {
-    return null;
-  }
-}
-function isLoopbackOrigin(origin) {
-  if (!origin || origin === "null") return true;
-  return isLoopbackHost(originHost(origin) ?? void 0);
-}
-function isSameOrigin(req) {
-  const origin = originHost(header(req, "origin"));
-  if (!origin) return false;
-  return origin.toLowerCase() === (header(req, "host") ?? "").toLowerCase();
+  if (!value) return false;
+  const host = value.trim().toLowerCase();
+  if (!host) return false;
+  return /^(?:127\.0\.0\.1|localhost)(?::\d{1,5})?$/.test(host) || /^\[::1\](?::\d{1,5})?$/.test(host);
 }
 function isWsPath(req) {
   try {
@@ -720,12 +719,15 @@ function wsToken(req) {
     return null;
   }
 }
+function tokenMatches(actual, expected) {
+  if (!actual) return false;
+  const left = Buffer.from(actual);
+  const right = Buffer.from(expected);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
 function isAuthorized(req, token) {
-  const host = header(req, "host");
-  const origin = header(req, "origin");
-  if (!isLoopbackHost(host) || !isLoopbackOrigin(origin)) return false;
-  if (wsToken(req) === token) return true;
-  return isSameOrigin(req);
+  if (!isLoopbackHost(header(req, "host"))) return false;
+  return tokenMatches(wsToken(req), token);
 }
 function rejectUpgrade(socket, status = 403, message = "Forbidden") {
   try {
@@ -761,19 +763,29 @@ function configStream(engine) {
     yield* Scope.addFinalizer(scope, Effect.sync(unsubscribe));
   }), { bufferSize: 16, strategy: "sliding" });
 }
+function toConfigUpdateFailure(error) {
+  if (error instanceof ConfigConflictError) {
+    return { kind: "conflict", state: error.state };
+  }
+  if (error instanceof ConfigPersistenceError) {
+    return { kind: "persistence", message: error.message };
+  }
+  return { kind: "persistence", message: error instanceof Error ? error.message : "config update failed" };
+}
 async function mountWsRpc(server, deps) {
   const scope = await Effect.runPromise(Scope.make());
   const wss = new NodeWS.WebSocketServer({ noServer: true });
   const handlersLayer = TokmonRpcGroup.toLayer(
     TokmonRpcGroup.of({
-      [TOKMON_WS_METHODS.getConfig]: () => Effect.tryPromise(() => Promise.resolve(deps.state.config ?? loadConfig())),
-      [TOKMON_WS_METHODS.setConfig]: (config) => Effect.tryPromise(() => applyConfigUpdate(deps.engine, deps.state, config)),
-      [TOKMON_WS_METHODS.refresh]: ({ scope: scope2 }) => Effect.sync(() => {
-        deps.engine.refresh(scope2);
+      [TOKMON_WS_METHODS.getConfig]: () => Effect.tryPromise(() => Promise.resolve(deps.state.config ?? loadConfig()).then(toConfigState)),
+      [TOKMON_WS_METHODS.setConfig]: (config) => Effect.tryPromise({
+        try: () => applyConfigUpdate(deps.engine, deps.state, config),
+        catch: toConfigUpdateFailure
       }),
+      [TOKMON_WS_METHODS.refresh]: ({ scope: scope2 }) => Effect.promise(() => deps.engine.refresh(scope2)),
       [TOKMON_WS_METHODS.browseFs]: ({ path }) => Effect.tryPromise(() => listHomeDirectory(path)),
       [TOKMON_WS_METHODS.snapshot]: () => snapshotStream(deps.engine),
-      [TOKMON_WS_METHODS.config]: () => configStream(deps.engine)
+      [TOKMON_WS_METHODS.config]: () => configStream(deps.engine).pipe(Stream.map(toConfigState))
     })
   );
   const httpEffect = await Effect.runPromise(
@@ -794,6 +806,10 @@ async function mountWsRpc(server, deps) {
     )
   );
   const onUpgrade = (req, socket, head) => {
+    if (!isLoopbackHost(header(req, "host"))) {
+      rejectUpgrade(socket);
+      return;
+    }
     if (!isWsPath(req)) return;
     if (!isAuthorized(req, deps.wsToken)) {
       rejectUpgrade(socket);
@@ -801,13 +817,36 @@ async function mountWsRpc(server, deps) {
     }
     upgradeHandler(req, socket, head);
   };
-  server.on("upgrade", onUpgrade);
+  server.prependListener("upgrade", onUpgrade);
   return async () => {
     server.off("upgrade", onUpgrade);
+    for (const client of wss.clients) {
+      try {
+        client.terminate();
+      } catch {
+      }
+    }
     await new Promise((resolve) => {
-      wss.close(() => resolve());
+      const timer = setTimeout(resolve, 750);
+      timer.unref?.();
+      try {
+        wss.close(() => {
+          clearTimeout(timer);
+          resolve();
+        });
+      } catch {
+        clearTimeout(timer);
+        resolve();
+      }
     });
-    await Effect.runPromise(Scope.close(scope, Exit.void));
+    await Promise.race([
+      Effect.runPromise(Scope.close(scope, Exit.void)).catch(() => {
+      }),
+      new Promise((resolve) => {
+        const timer = setTimeout(resolve, 750);
+        timer.unref?.();
+      })
+    ]);
   };
 }
 
@@ -817,12 +856,10 @@ var DEFAULT_PORT = 4317;
 var MAX_PORT_TRIES = 20;
 function isLoopbackHostHeader(value) {
   if (!value) return false;
-  let host = value.trim().toLowerCase();
-  if (host.startsWith("[")) host = host.slice(1, host.indexOf("]") === -1 ? host.length : host.indexOf("]"));
-  else host = host.split(":")[0];
-  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+  const host = value.trim().toLowerCase();
+  return /^(?:127\.0\.0\.1|localhost)(?::\d{1,5})?$/.test(host) || /^\[::1\](?::\d{1,5})?$/.test(host);
 }
-function isLoopbackOrigin2(origin) {
+function isLoopbackOrigin(origin) {
   if (!origin || origin === "null") return true;
   try {
     const u = new URL(origin);
@@ -831,37 +868,59 @@ function isLoopbackOrigin2(origin) {
     return false;
   }
 }
-function guardPrivileged(req, res) {
-  const header2 = (n) => {
+function header2(req, name) {
+  const value = req.headers[name];
+  return Array.isArray(value) ? value[0] : value;
+}
+function tokenMatches2(given, expected) {
+  if (!given) return false;
+  const actual = Buffer.from(given);
+  const token = Buffer.from(expected);
+  return actual.length === token.length && timingSafeEqual2(actual, token);
+}
+function guardHost(req, res) {
+  if (isLoopbackHostHeader(header2(req, "host"))) return true;
+  sendJson(res, 403, { error: "forbidden" });
+  return false;
+}
+function guardPrivileged(req, res, wsToken2) {
+  const header3 = (n) => {
     const v = req.headers[n];
     return Array.isArray(v) ? v[0] : v;
   };
-  if (req.headers["x-tokmon-client"] !== "1") {
+  if (!tokenMatches2(header3("x-tokmon-token"), wsToken2)) {
     sendJson(res, 403, { error: "forbidden" });
     return false;
   }
-  if (!isLoopbackHostHeader(header2("host")) || !isLoopbackOrigin2(header2("origin"))) {
+  if (!isLoopbackOrigin(header3("origin"))) {
     sendJson(res, 403, { error: "forbidden" });
     return false;
   }
   return true;
 }
-function createRouter(engine, state, vite, webRoot) {
+function createRouter(engine, state, vite, webRoot, wsToken2, version) {
   return (req, res) => {
     const url = req.url || "/";
     const path = url.split("?")[0];
     const method = req.method || "GET";
+    if (!guardHost(req, res)) return;
     if (path === "/api/data") {
       engine.touch();
       sendJson(res, 200, engine.snapshot() ?? { pending: true });
       return;
     }
     if (path === "/healthz") {
-      sendJson(res, 200, { ok: true, ready: engine.snapshot() !== null });
+      sendJson(res, 200, {
+        ok: true,
+        ready: engine.snapshot() !== null,
+        version,
+        // Discovery requires this proof; public health checks retain their useful 200 response.
+        owner: tokenMatches2(header2(req, "x-tokmon-token"), wsToken2)
+      });
       return;
     }
     if (path === "/api/config") {
-      if (!guardPrivileged(req, res)) return;
+      if (!guardPrivileged(req, res, wsToken2)) return;
       if (method === "GET") {
         sendJson(res, 200, state.config);
         return;
@@ -888,51 +947,65 @@ async function startWebServer(opts) {
   const version = appVersion();
   const summaryIntervalMs = summaryIntervalFor(state.config);
   const billingIntervalMs = billingIntervalFor(state.config);
-  const wsToken2 = randomBytes(32).toString("base64url");
+  const wsToken2 = opts.wsToken ?? randomBytes(32).toString("base64url");
   const log = (msg) => {
     if (opts.log) process.stdout.write(msg + "\n");
   };
   const resolved = await resolveAccounts(state.config);
   const server = createServer();
   let vite = null;
-  if (isDevMode()) vite = await createViteDevServer(server, log);
-  const webRoot = vite ? null : findWebRoot();
-  if (!vite && !webRoot) log("  \u26A0 no dashboard available \u2014 see the page for build/dev instructions");
-  const engine = createDataEngine({ version, config: state.config, tz, summaryIntervalMs, billingIntervalMs, resolved });
-  server.addListener("request", createRouter(engine, state, vite, webRoot));
-  const closeWsRpc = await mountWsRpc(server, { engine, state, wsToken: wsToken2 });
-  const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT);
-  const serverUrl = `http://${HOST}:${port}`;
-  if (vite?.warmupRequest) {
-    try {
-      await Promise.race([vite.warmupRequest("/src/main.tsx"), delay(5e3)]);
-    } catch {
+  let engine = null;
+  let closeWsRpc = null;
+  try {
+    if (isDevMode()) vite = await createViteDevServer(server, log);
+    const webRoot = vite ? null : findWebRoot();
+    if (!vite && !webRoot) log("  \u26A0 no dashboard available \u2014 see the page for build/dev instructions");
+    engine = createDataEngine({ version, config: state.config, tz, summaryIntervalMs, billingIntervalMs, resolved });
+    server.addListener("request", createRouter(engine, state, vite, webRoot, wsToken2, version));
+    closeWsRpc = await mountWsRpc(server, { engine, state, wsToken: wsToken2 });
+    const port = await listenWithFallback(server, opts.port ?? DEFAULT_PORT);
+    const serverUrl = `http://${HOST}:${port}`;
+    if (vite?.warmupRequest) {
+      try {
+        await Promise.race([vite.warmupRequest("/src/main.tsx"), delay(5e3)]);
+      } catch {
+      }
     }
-  }
-  engine.start();
-  return {
-    url: serverUrl,
-    port,
-    wsToken: wsToken2,
-    snapshot: engine.snapshot,
-    config: () => state.config,
-    stop: async () => {
-      engine.stop();
-      await closeWsRpc().catch(() => {
-      });
-      const closeHttp = () => new Promise((resolve) => {
-        server.close(() => resolve());
+    engine.start();
+    let stopped = false;
+    return {
+      url: serverUrl,
+      browserUrl: browserUrl(serverUrl, wsToken2),
+      port,
+      wsToken: wsToken2,
+      snapshot: engine.snapshot,
+      config: () => state.config,
+      stop: async () => {
+        if (stopped) return;
+        stopped = true;
+        engine?.stop();
+        await closeWsRpc?.().catch(() => {
+        });
         server.closeAllConnections?.();
-      });
-      if (vite) {
+        await closeServer(server);
         try {
-          await vite.close();
+          await vite?.close();
         } catch {
         }
       }
-      await closeHttp();
+    };
+  } catch (error) {
+    engine?.stop();
+    await closeWsRpc?.().catch(() => {
+    });
+    server.closeAllConnections?.();
+    await closeServer(server);
+    try {
+      await vite?.close();
+    } catch {
     }
-  };
+    throw error;
+  }
 }
 function delay(ms) {
   return new Promise((resolve) => {
@@ -940,6 +1013,22 @@ function delay(ms) {
     t.unref?.();
   });
 }
+function closeServer(server, timeoutMs = 1e3) {
+  return new Promise((resolve) => {
+    const done = () => resolve();
+    const timer = setTimeout(done, timeoutMs);
+    timer.unref?.();
+    try {
+      server.close(() => {
+        clearTimeout(timer);
+        done();
+      });
+    } catch {
+      clearTimeout(timer);
+      done();
+    }
+  });
+}
 function listenWithFallback(server, startPort) {
   return new Promise((resolve, reject) => {
     if (startPort === 0) {
@@ -969,6 +1058,5 @@ function listenWithFallback(server, startPort) {
 }
 
 export {
-  appVersion,
   startWebServer
 };