tokmon 0.27.0 → 0.28.1

package/README.md

@@ -105,7 +105,7 @@ tokmon serve --port 8080
 tokmon serve --no-open  # don't auto-open the browser
 ```
 
-It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Press `R` or use the visible **Refresh** control to update it. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
+It binds to `127.0.0.1` by default and reads the same local daemon state — nothing leaves your machine. The browser connects directly over a same-origin WebSocket; dashboard URLs have no token or login step. Optional LAN access can be enabled in settings, with an explicit unsafe-access warning, and takes effect after the daemon restarts. When publishing the dashboard through an ingress or reverse proxy, add each exact DNS name to **Allowed hosts** in settings (for example, `tokmon.example.com`); IP hosts remain allowed in LAN mode. The dashboard renders instantly from a cached snapshot, then streams live updates and goes idle when no tab is open. Press `R` or use the visible **Refresh** control to update it. Filter by provider, model, account, and period, flip between dark and light, and export any panel — or a summary card — as a PNG with the **Share** button.
 
 ### Overview
 

package/dist/{bootstrap-ink-3YNJFKCW.js → bootstrap-ink-L7QSJBMS.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   createDaemonRpcClient
-} from "./chunk-4CY725NY.js";
+} from "./chunk-3RTWFGGD.js";
 import {
   accountsByProvider,
   buildAccounts,
   fetchPeak,
   modelColor
-} from "./chunk-VGYBQH5I.js";
+} from "./chunk-FMP3P2WV.js";
 import {
   PROVIDERS,
   PROVIDER_ORDER,
@@ -15,6 +15,7 @@ import {
   col,
   currency,
   detectProviders,
+  formatAgo,
   formatResetAt,
   resetAt,
   resolveTimezone,
@@ -23,7 +24,7 @@ import {
   time,
   tokens,
   withTimeout
-} from "./chunk-RTGMDE7U.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   COLOR_PALETTE,
   DEFAULTS,
@@ -32,13 +33,14 @@ import {
   getTrackedAccountRows,
   isValidTimezone,
   loadConfig,
+  normalizeAllowedHost,
   normalizeConfig,
   pickAccentColor,
   redactEmail,
   sanitizeTyped,
   saveConfigSync,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 import {
   glyphs
 } from "./chunk-RF4GGQGM.js";
@@ -219,6 +221,12 @@ import { memo as memo2 } from "react";
 import { Box as Box2, Text as Text2 } from "ink";
 
 // src/ui/provider-card.logic.ts
+var BILLING_STALE_AFTER_MS = 30 * 6e4;
+function billingStaleLabel(billingUpdatedAt, now) {
+  if (billingUpdatedAt == null || billingUpdatedAt <= 0) return null;
+  if (now - billingUpdatedAt < BILLING_STALE_AFTER_MS) return null;
+  return `as of ${formatAgo(billingUpdatedAt, now)}`;
+}
 function normalizePlan(plan) {
   if (plan == null) return null;
   const t = plan.trim();
@@ -253,7 +261,9 @@ function estimateCardHeights(groups, stats) {
       if (meta.hasUsage) h += 1;
       const multi = g.accounts.length > 1;
       g.accounts.forEach((a, i) => {
-        const metricRows = stats.get(a.id)?.billing?.metrics.length || 1;
+        const s = stats.get(a.id);
+        const staleRow = s?.billing && !s.billing.error && s.billing.metrics.length > 0 && billingStaleLabel(s.billing.asOfMs ?? s.billingUpdatedAt, Date.now()) ? 1 : 0;
+        const metricRows = (s?.billing?.metrics.length || 1) + staleRow;
         h += metricRows + (multi ? 1 : 0) + (multi && i > 0 ? 1 : 0);
       });
     }
@@ -460,6 +470,7 @@ function LimitsBlock({ items, inner, showRowPlans, privacyMode, resetDisplay, tz
   const barW = Math.max(10, Math.min(46, inner - labelW - resetW - 5));
   return /* @__PURE__ */ jsx2(Box2, { flexDirection: "column", children: items.map(({ account, s }, idx) => {
     const billing = s?.billing;
+    const staleLabel = billing && !billing.error && billing.metrics.length > 0 ? billingStaleLabel(billing.asOfMs ?? s?.billingUpdatedAt, Date.now()) : null;
     return /* @__PURE__ */ jsxs2(Box2, { flexDirection: "column", marginTop: showName && idx > 0 ? 1 : 0, children: [
       showName && (() => {
         const rowPlan = showRowPlans ? normalizePlan(billing?.plan) : null;
@@ -482,7 +493,16 @@ function LimitsBlock({ items, inner, showRowPlans, privacyMode, resetDisplay, tz
       !billing ? /* @__PURE__ */ jsxs2(Text2, { dimColor: true, children: [
         "Fetching",
         glyphs().ellipsis
-      ] }) : billing.error ? /* @__PURE__ */ jsx2(Text2, { color: "red", wrap: "truncate-end", children: privacyMode ? redactEmail(billing.error) : billing.error }) : billing.metrics.length === 0 ? /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "No data" }) : billing.metrics.map((m, i) => /* @__PURE__ */ jsx2(MetricRow, { m, color: account.color, barW, labelW, resetW, resetDisplay, tz }, `${m.label}${i}`))
+      ] }) : billing.error ? /* @__PURE__ */ jsx2(Text2, { color: "red", wrap: "truncate-end", children: privacyMode ? redactEmail(billing.error) : billing.error }) : billing.metrics.length === 0 ? /* @__PURE__ */ jsx2(Text2, { dimColor: true, children: "No data" }) : billing.metrics.map((m, i) => /* @__PURE__ */ jsx2(MetricRow, { m, color: account.color, barW, labelW, resetW, resetDisplay, tz }, `${m.label}${i}`)),
+      staleLabel && /* @__PURE__ */ jsxs2(Text2, { color: "yellow", dimColor: true, children: [
+        glyphs().warn,
+        " ",
+        staleLabel,
+        " ",
+        glyphs().middot,
+        " refreshing",
+        glyphs().ellipsis
+      ] })
     ] }, account.id);
   }) });
 }
@@ -570,7 +590,7 @@ import { Box as Box4, Text as Text4 } from "ink";
 import { memo as memo3 } from "react";
 import { Box as Box3, Text as Text3 } from "ink";
 import { Fragment as Fragment2, jsx as jsx3, jsxs as jsxs3 } from "react/jsx-runtime";
-var GENERAL_ROWS = 10;
+var GENERAL_ROWS = 11;
 var SETTINGS_TABS = ["general", "providers", "accounts"];
 var SETTINGS_TAB_LABELS = {
   general: "General",
@@ -585,6 +605,9 @@ var SettingsView = memo3(function SettingsView2({
   tzEdit,
   tzCaret,
   tzError,
+  allowedHostsEdit,
+  allowedHostsCaret,
+  allowedHostsError,
   resolvedTz,
   accountForm,
   activeAccountId,
@@ -593,6 +616,7 @@ var SettingsView = memo3(function SettingsView2({
 }) {
   if (accountForm) return /* @__PURE__ */ jsx3(AccountFormView, { form: accountForm, accounts: config.accounts });
   const editingTz = tzEdit !== null;
+  const editingAllowedHosts = allowedHostsEdit !== null;
   const tzDisplay = config.timezone === null ? `System (${resolvedTz})` : config.timezone;
   const tabFocused = cursor < 0;
   return /* @__PURE__ */ jsxs3(Box3, { flexDirection: "column", marginTop: 1, children: [
@@ -666,8 +690,17 @@ var SettingsView = memo3(function SettingsView2({
         ] })
       ] }),
       /* @__PURE__ */ jsx3(Row, { cursor, idx: 8, label: "Network access", children: /* @__PURE__ */ jsx3(Text3, { bold: true, color: config.allowNetworkAccess ? "red" : "green", children: config.allowNetworkAccess ? "LAN (unsafe)" : "local only" }) }),
+      /* @__PURE__ */ jsx3(Row, { cursor, idx: 9, label: "Allowed hosts", children: editingAllowedHosts ? /* @__PURE__ */ jsxs3(Fragment2, { children: [
+        /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "[" }),
+        /* @__PURE__ */ jsx3(CaretText, { value: allowedHostsEdit ?? "", caret: allowedHostsCaret, color: "cyan" }),
+        /* @__PURE__ */ jsx3(Text3, { dimColor: true, children: "]" })
+      ] }) : /* @__PURE__ */ jsx3(Text3, { bold: true, color: "yellow", children: config.allowedHosts.join(", ") || "none" }) }),
+      cursor === 9 && allowedHostsError && /* @__PURE__ */ jsxs3(Text3, { color: "red", children: [
+        "  ",
+        allowedHostsError
+      ] }),
       config.allowNetworkAccess && /* @__PURE__ */ jsx3(Text3, { color: "red", children: "  Warning: dashboard data and settings will be exposed to your local network after daemon restart." }),
-      /* @__PURE__ */ jsxs3(Row, { cursor, idx: 9, label: "Reset times", children: [
+      /* @__PURE__ */ jsxs3(Row, { cursor, idx: 10, label: "Reset times", children: [
         /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
           glyphs().caretL,
           " "
@@ -760,6 +793,12 @@ var SettingsView = memo3(function SettingsView2({
       " Enter save ",
       glyphs().middot,
       " Esc cancel"
+    ] }) : editingAllowedHosts ? /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
+      "comma-separated exact DNS names ",
+      glyphs().middot,
+      " Enter save ",
+      glyphs().middot,
+      " Esc cancel"
     ] }) : activeTab === "providers" ? /* @__PURE__ */ jsxs3(Text3, { dimColor: true, children: [
       glyphs().arrowU,
       glyphs().arrowD,
@@ -1711,7 +1750,8 @@ function toStatsMap(snapshot, accounts) {
     out.set(account.id, {
       account,
       dashboard: wa?.dashboard ?? null,
-      billing: wa?.billing ?? null
+      billing: wa?.billing ?? null,
+      billingUpdatedAt: wa?.billingUpdatedAt ?? null
     });
   }
   return out;
@@ -1972,6 +2012,56 @@ function handleTimezoneEditor(input, key, editor, text, updateConfig) {
     if (clean) text.insert(clean);
   }
 }
+function handleAllowedHostsEditor(input, key, editor, text, updateConfig) {
+  const { value, setValue, setError, setCaret, valueRef, caretRef } = editor;
+  if (value === null) return;
+  if (key.escape) {
+    setValue(null);
+    setError(null);
+    return;
+  }
+  if (key.return) {
+    const parts = value.split(",").map((part) => part.trim()).filter(Boolean);
+    const normalized = parts.map(normalizeAllowedHost);
+    if (normalized.some((host) => host === null)) {
+      setError("Use exact DNS names without a scheme, port, path, or wildcard");
+      return;
+    }
+    updateConfig((config) => ({ ...config, allowedHosts: [...new Set(normalized)] }));
+    setValue(null);
+    setError(null);
+    return;
+  }
+  if (key.leftArrow) {
+    setCaret((caret) => clampCaret(caret - 1, value.length));
+    return;
+  }
+  if (key.rightArrow) {
+    setCaret((caret) => clampCaret(caret + 1, value.length));
+    return;
+  }
+  if (key.ctrl && input === "a") {
+    setCaret(0);
+    return;
+  }
+  if (key.ctrl && input === "e") {
+    setCaret(value.length);
+    return;
+  }
+  if (key.backspace || key.delete) {
+    const result = spliceBackspace(valueRef.current, caretRef.current);
+    valueRef.current = result.value;
+    caretRef.current = result.caret;
+    setValue(result.value);
+    setCaret(result.caret);
+    setError(null);
+    return;
+  }
+  if (text.isPrintable(input, key)) {
+    const clean = sanitizeTyped(input);
+    if (clean) text.insert(clean);
+  }
+}
 function handleSearchEditor(input, key, table, text) {
   const { search, setSearch, setSearchMode, setSearchCaret, searchValueRef, searchCaretRef } = table;
   if (key.return || key.escape) {
@@ -2044,6 +2134,8 @@ function handleSettings(input, key, ctx) {
     setCursor(-1);
     timezoneEditor.setValue(null);
     timezoneEditor.setError(null);
+    ctx.allowedHostsEditor.setValue(null);
+    ctx.allowedHostsEditor.setError(null);
   };
   const rowCount = tab === "general" ? GENERAL_ROWS : tab === "providers" ? PROVIDER_ORDER.length : trackedAccounts.length + 1;
   if (key.tab) {
@@ -2174,7 +2266,14 @@ function handleSettings(input, key, ctx) {
       updateConfig((current) => ({ ...current, allowNetworkAccess: !current.allowNetworkAccess }));
       return;
     }
-    if (index === 9 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
+    if (index === 9 && inputKey.return) {
+      const initial = config.allowedHosts.join(", ");
+      context.allowedHostsEditor.setValue(initial);
+      context.allowedHostsEditor.setCaret(initial.length);
+      context.allowedHostsEditor.setError(null);
+      return;
+    }
+    if (index === 10 && (inputKey.leftArrow || inputKey.rightArrow || inputKey.return)) {
       updateConfig((current) => ({ ...current, resetDisplay: current.resetDisplay === "relative" ? "absolute" : "relative" }));
     }
   }
@@ -2337,7 +2436,7 @@ function handleTerminalFocusInput(input) {
   return true;
 }
 function isRefreshAllShortcut(input, mode) {
-  return (input === "r" || input === "R") && !mode.unavailable && !mode.showPicker && !mode.editingAccount && !mode.editingTimezone && !mode.editingSearch;
+  return (input === "r" || input === "R") && !mode.unavailable && !mode.showPicker && !mode.editingAccount && !mode.editingTimezone && !mode.editingAllowedHosts && !mode.editingSearch;
 }
 function handleOnboarding(input, key, ctx) {
   const { onboarding, global } = ctx;
@@ -2366,11 +2465,13 @@ function handleOnboarding(input, key, ctx) {
 function handleKey(input, key, ctx) {
   const editingAccount = ctx.settings.show && ctx.accountEditor.form !== null;
   const editingTimezone = ctx.settings.show && ctx.timezoneEditor.value !== null;
+  const editingAllowedHosts = ctx.settings.show && ctx.allowedHostsEditor.value !== null;
   const editingSearch = ctx.table.tab === 1 && ctx.table.searchMode;
   if (isRefreshAllShortcut(input, {
     showPicker: ctx.onboarding.show,
     editingAccount,
     editingTimezone,
+    editingAllowedHosts,
     editingSearch,
     unavailable: !ctx.global.configReady
   })) {
@@ -2389,6 +2490,10 @@ function handleKey(input, key, ctx) {
     handleTimezoneEditor(input, key, ctx.timezoneEditor, ctx.textInput, ctx.global.updateConfig);
     return;
   }
+  if (editingAllowedHosts) {
+    handleAllowedHostsEditor(input, key, ctx.allowedHostsEditor, ctx.textInput, ctx.global.updateConfig);
+    return;
+  }
   if (editingSearch) {
     handleSearchEditor(input, key, ctx.table, ctx.textInput);
     return;
@@ -3122,6 +3227,9 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   const [tzEdit, setTzEdit] = useState10(null);
   const [tzError, setTzError] = useState10(null);
   const [tzCaret, setTzCaret] = useState10(0);
+  const [allowedHostsEdit, setAllowedHostsEdit] = useState10(null);
+  const [allowedHostsError, setAllowedHostsError] = useState10(null);
+  const [allowedHostsCaret, setAllowedHostsCaret] = useState10(0);
   const [searchCaret, setSearchCaret] = useState10(0);
   const [onboardSel, setOnboardSel] = useState10(null);
   const [onboardCursor, setOnboardCursor] = useState10(0);
@@ -3149,6 +3257,8 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   const dashPageCountRef = useRef8(1);
   const tzValueRef = useRef8("");
   const tzCaretRef = useRef8(0);
+  const allowedHostsValueRef = useRef8("");
+  const allowedHostsCaretRef = useRef8(0);
   const searchValueRef = useRef8("");
   const searchCaretRef = useRef8(0);
   const accountsKey = useMemo2(() => accounts.map(acctKey).join("|"), [accounts]);
@@ -3254,6 +3364,8 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
   dashPageCountRef.current = dashPageCount;
   tzValueRef.current = tzEdit ?? "";
   tzCaretRef.current = clampCaret(tzCaret, (tzEdit ?? "").length);
+  allowedHostsValueRef.current = allowedHostsEdit ?? "";
+  allowedHostsCaretRef.current = clampCaret(allowedHostsCaret, (allowedHostsEdit ?? "").length);
   searchValueRef.current = search;
   searchCaretRef.current = clampCaret(searchCaret, search.length);
   const isPrintable = (input, key) => !!input && !key.ctrl && !key.meta && !isPasteInput(input);
@@ -3271,6 +3383,13 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
       setTzEdit(r.value);
       setTzCaret(r.caret);
       setTzError(null);
+    } else if (showSettings && allowedHostsEdit !== null) {
+      const r = spliceInsert(allowedHostsValueRef.current, allowedHostsCaretRef.current, text);
+      allowedHostsValueRef.current = r.value;
+      allowedHostsCaretRef.current = r.caret;
+      setAllowedHostsEdit(r.value);
+      setAllowedHostsCaret(r.caret);
+      setAllowedHostsError(null);
     } else if (tab === 1 && searchMode) {
       const r = spliceInsert(searchValueRef.current, searchCaretRef.current, text);
       searchValueRef.current = r.value;
@@ -3441,7 +3560,7 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
     if (webStartingRef.current) return;
     webStartingRef.current = true;
     try {
-      const { startWebServer } = await import("./server-5WIWS27N.js");
+      const { startWebServer } = await import("./server-EUO7CWYH.js");
       const ctrl = await startWebServer({ config: cfg, log: false });
       webRef.current = ctrl;
       openUrl(ctrl.url);
@@ -3515,6 +3634,14 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
         valueRef: tzValueRef,
         caretRef: tzCaretRef
       },
+      allowedHostsEditor: {
+        value: allowedHostsEdit,
+        setValue: setAllowedHostsEdit,
+        setError: setAllowedHostsError,
+        setCaret: setAllowedHostsCaret,
+        valueRef: allowedHostsValueRef,
+        caretRef: allowedHostsCaretRef
+      },
       textInput: { isPrintable, insert: insertText },
       settings: {
         show: showSettings,
@@ -3654,6 +3781,9 @@ function App({ interval: cliInterval, initialConfig, baseUrl = null, mode = "deg
         tzEdit,
         tzCaret,
         tzError,
+        allowedHostsEdit,
+        allowedHostsCaret,
+        allowedHostsError,
         resolvedTz: tz,
         accountForm,
         activeAccountId: cfg.activeAccountId,

package/dist/{chunk-4CY725NY.js → chunk-3RTWFGGD.js}

@@ -3,7 +3,7 @@ import {
   TOKMON_WS_METHODS,
   TOKMON_WS_PATH,
   TokmonRpcGroup
-} from "./chunk-RTGMDE7U.js";
+} from "./chunk-CVKCVHS7.js";
 
 // src/client/daemon-rpc-client.ts
 import { Cause, Context, Duration, Effect, Exit, Fiber, Layer, ManagedRuntime, Schedule, Stream } from "effect";

package/dist/{chunk-AMD4PXDG.js → chunk-4HU4EI5T.js}

@@ -5,7 +5,7 @@ import {
   readLock,
   reclaimDeadLock,
   verifyLock
-} from "./chunk-QM5E5RJZ.js";
+} from "./chunk-XDA5RJST.js";
 import {
   appVersion
 } from "./chunk-SMPY52EV.js";