tokmon 0.27.0 → 0.28.1

package/dist/{chunk-RTGMDE7U.js → chunk-CVKCVHS7.js}

@@ -5,7 +5,7 @@ import {
   envDir,
   expandHome,
   isValidTimezone
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/async.ts
 var DEFAULT_TIMEOUT_MS = 3e4;
@@ -744,8 +744,8 @@ import { Schema } from "effect";
 import * as Rpc from "effect/unstable/rpc/Rpc";
 import * as RpcGroup from "effect/unstable/rpc/RpcGroup";
 var TOKMON_WS_PATH = "/ws";
-var TOKMON_PROTOCOL_VERSION = 2;
-var TOKMON_CAPABILITIES = ["config-cas", "config-revision"];
+var TOKMON_PROTOCOL_VERSION = 3;
+var TOKMON_CAPABILITIES = ["config-cas", "config-revision", "allowed-hosts"];
 var TOKMON_WS_METHODS = {
   getConfig: "tokmon.getConfig",
   setConfig: "tokmon.setConfig",
@@ -787,6 +787,7 @@ var ConfigSchema = Schema.Struct({
   defaultFocus: Schema.Literals(["all", "last"]),
   ascii: Schema.Literals(["auto", "on", "off"]),
   allowNetworkAccess: Schema.Boolean,
+  allowedHosts: Schema.Array(Schema.String),
   resetDisplay: Schema.Literals(["relative", "absolute"]),
   knownProviders: Schema.Array(ProviderIdSchema)
 });
@@ -892,7 +893,8 @@ var BillingResultSchema = Schema.Struct({
     name: Schema.String,
     usd: Schema.Finite,
     requests: Schema.Finite
-  }))))
+  })))),
+  asOfMs: Schema.optionalKey(Schema.Finite)
 });
 var WebAccountSchema = Schema.Struct({
   id: Schema.String,
@@ -1003,6 +1005,16 @@ function formatTime(date, tz) {
     timeZone: tz
   });
 }
+function formatAgo(ms, now) {
+  const seconds = Math.max(0, Math.round((now - ms) / 1e3));
+  if (seconds < 2) return "just now";
+  if (seconds < 60) return `${seconds}s ago`;
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60) return `${minutes}m ago`;
+  const hours = Math.round(minutes / 60);
+  if (hours < 24) return `${hours}h ago`;
+  return `${Math.round(hours / 24)}d ago`;
+}
 function formatShortDate(label, opts = {}) {
   const match = /^(\d{4})-(\d{2})-(\d{2})$/.exec(label);
   if (!match) return label;
@@ -1128,7 +1140,7 @@ async function detectClaude(homeDir) {
   return false;
 }
 function claudePriceFor(model, timestamp = Date.now()) {
-  const m = model.toLowerCase().trim();
+  const m = model.toLowerCase().trim().replace(/\[[^\]]*\]$/, "");
   for (const key of PRICE_KEYS) {
     if (!m.startsWith(key)) continue;
     const rest = m.slice(key.length);
@@ -2076,7 +2088,7 @@ async function fetchResetCredits(headers) {
     return void 0;
   }
 }
-async function liveBilling(auth) {
+async function liveBilling(auth, failure) {
   try {
     const headers = {
       "Authorization": `Bearer ${auth.accessToken}`,
@@ -2085,7 +2097,10 @@ async function liveBilling(auth) {
     };
     if (auth.accountId) headers["ChatGPT-Account-Id"] = auth.accountId;
     const res = await fetch(USAGE_URL, { headers, signal: AbortSignal.timeout(1e4) });
-    if (!res.ok) return null;
+    if (!res.ok) {
+      if (failure) failure.status = res.status;
+      return null;
+    }
     const data = await readJson(res);
     if (!data) return null;
     const headerPct = (name) => {
@@ -2186,19 +2201,19 @@ async function snapshotBilling(homeDir, auth = null) {
 }
 async function codexBilling(account) {
   const auth = await getAuth2(account.homeDir);
+  const failure = {};
   if (auth) {
-    const live = await liveBilling(auth);
+    const live = await liveBilling(auth, failure);
     if (live) return live;
   }
   const snap = await snapshotBilling(account.homeDir, auth);
   if (snap && Date.now() - snap.asOfMs < SNAPSHOT_STALE_MS) {
-    const { asOfMs: _asOfMs, ...result } = snap;
-    return result;
+    return snap;
   }
   return {
     plan: auth?.plan ?? snap?.plan ?? null,
     metrics: [],
-    error: auth ? "Usage API failed \u2014 run codex to refresh" : "Not logged in \u2014 run codex",
+    error: auth ? `Usage API failed${failure.status ? ` (HTTP ${failure.status})` : ""} \u2014 run codex to refresh` : "Not logged in \u2014 run codex",
     ...identityFields(auth)
   };
 }
@@ -2789,8 +2804,15 @@ async function fetchLocalEntries(tz, homeDir) {
 function overlayEntries(api, local, tz) {
   if (api.length === 0) return local.map((l) => l.entry);
   if (local.length === 0) return api;
-  const apiDays = new Set(api.map((e) => dayKey(e.ts, tz)));
-  return [...api, ...local.filter((l) => !apiDays.has(l.day)).map((l) => l.entry)];
+  let apiMin = Infinity;
+  let apiMax = -Infinity;
+  for (const e of api) {
+    if (e.ts < apiMin) apiMin = e.ts;
+    if (e.ts > apiMax) apiMax = e.ts;
+  }
+  const minDay = dayKey(apiMin, tz);
+  const maxDay = dayKey(apiMax, tz);
+  return [...api, ...local.filter((l) => l.day < minDay || l.day > maxDay).map((l) => l.entry)];
 }
 async function cursorEntries(since, tz, homeDir) {
   const [apiResult, local] = await Promise.all([fetchApiEntries(homeDir), fetchLocalEntries(tz, homeDir)]);
@@ -2833,6 +2855,33 @@ async function detectPi(homeDir) {
     return false;
   }
 }
+function recordToEntry(obj) {
+  if (obj?.type !== "message") return null;
+  const msg = obj.message;
+  if (msg?.role !== "assistant" || !msg?.usage) return null;
+  const u = msg.usage;
+  const ts = timestampMs(obj.timestamp ?? msg.timestamp);
+  if (ts === null) return null;
+  const input = safeNum(u.input);
+  const output = safeNum(u.output);
+  const cacheRead = safeNum(u.cacheRead);
+  const cacheCreate = safeNum(u.cacheWrite);
+  if (input + output + cacheRead + cacheCreate === 0) return null;
+  const c = u.cost ?? {};
+  const costInput = finitePositive(c.input);
+  const cacheSavings = input > 0 && cacheRead > 0 ? Math.max(0, cacheRead * (costInput / input) - finitePositive(c.cacheRead)) : 0;
+  const model = typeof msg.responseModel === "string" && msg.responseModel || typeof msg.model === "string" && msg.model || "unknown";
+  return {
+    ts,
+    model,
+    cost: finitePositive(c.total),
+    input,
+    output,
+    cacheCreate,
+    cacheRead,
+    cacheSavings
+  };
+}
 async function parseFile3(path) {
   const entries = [];
   const stream = createReadStream4(path);
@@ -2844,32 +2893,8 @@ async function parseFile3(path) {
       if (!rawLine.includes('"usage"')) continue;
       try {
         const line = rawLine.charCodeAt(0) === 65279 ? rawLine.slice(1) : rawLine;
-        const obj = JSON.parse(line);
-        if (obj?.type !== "message") continue;
-        const msg = obj.message;
-        if (msg?.role !== "assistant" || !msg?.usage) continue;
-        const u = msg.usage;
-        const ts = timestampMs(obj.timestamp ?? msg.timestamp);
-        if (ts === null) continue;
-        const input = safeNum(u.input);
-        const output = safeNum(u.output);
-        const cacheRead = safeNum(u.cacheRead);
-        const cacheCreate = safeNum(u.cacheWrite);
-        if (input + output + cacheRead + cacheCreate === 0) continue;
-        const c = u.cost ?? {};
-        const costInput = finitePositive(c.input);
-        const cacheSavings = input > 0 && cacheRead > 0 ? Math.max(0, cacheRead * (costInput / input) - finitePositive(c.cacheRead)) : 0;
-        const model = typeof msg.responseModel === "string" && msg.responseModel || typeof msg.model === "string" && msg.model || "unknown";
-        entries.push({
-          ts,
-          model,
-          cost: finitePositive(c.total),
-          input,
-          output,
-          cacheCreate,
-          cacheRead,
-          cacheSavings
-        });
+        const entry = recordToEntry(JSON.parse(line));
+        if (entry) entries.push(entry);
       } catch {
       }
     }
@@ -2951,31 +2976,35 @@ async function findDb(homeDir) {
 async function detectOpencode(homeDir) {
   return await findDb(homeDir) !== null;
 }
+function rowToEntry(row) {
+  const ts = finitePositive(row.ts);
+  if (!ts) return null;
+  const input = finitePositive(row.input);
+  const output = finitePositive(row.output);
+  const cacheRead = finitePositive(row.cacheRead);
+  const cacheCreate = finitePositive(row.cacheWrite);
+  if (input + output + cacheRead + cacheCreate === 0) return null;
+  return {
+    ts,
+    model: typeof row.model === "string" && row.model ? row.model : "unknown",
+    cost: finitePositive(row.cost),
+    input,
+    output,
+    cacheCreate,
+    cacheRead,
+    cacheSavings: 0
+  };
+}
 async function loadEntries4(since, homeDir) {
   const db = await findDb(homeDir);
   if (!db) return [];
-  const sql = "SELECT CASE WHEN time_created < 10000000000 THEN time_created * 1000 ELSE time_created END AS ts, json_extract(data,'$.modelID') AS model, json_extract(data,'$.cost') AS cost, json_extract(data,'$.tokens.input') AS input, json_extract(data,'$.tokens.output') AS output, json_extract(data,'$.tokens.reasoning') AS reasoning, json_extract(data,'$.tokens.cache.read') AS cacheRead, json_extract(data,'$.tokens.cache.write') AS cacheWrite FROM message WHERE json_valid(data) AND json_extract(data,'$.role')='assistant' AND json_type(data,'$.tokens')='object' AND (CASE WHEN time_created < 10000000000 THEN time_created * 1000 ELSE time_created END) >= ?;";
+  const sql = "SELECT CASE WHEN time_created < 10000000000 THEN time_created * 1000 ELSE time_created END AS ts, json_extract(data,'$.modelID') AS model, json_extract(data,'$.cost') AS cost, json_extract(data,'$.tokens.input') AS input, json_extract(data,'$.tokens.output') AS output, json_extract(data,'$.tokens.cache.read') AS cacheRead, json_extract(data,'$.tokens.cache.write') AS cacheWrite FROM message WHERE json_valid(data) AND json_extract(data,'$.role')='assistant' AND json_type(data,'$.tokens')='object' AND (CASE WHEN time_created < 10000000000 THEN time_created * 1000 ELSE time_created END) >= ?;";
   const res = await runSqlite(db, sql, [Math.floor(since)]);
   if (res.status !== "ok") return [];
   const entries = [];
   for (const row of res.rows) {
-    const ts = finitePositive(row.ts);
-    if (!ts) continue;
-    const input = finitePositive(row.input);
-    const output = finitePositive(row.output) + finitePositive(row.reasoning);
-    const cacheRead = finitePositive(row.cacheRead);
-    const cacheCreate = finitePositive(row.cacheWrite);
-    if (input + output + cacheRead + cacheCreate === 0) continue;
-    entries.push({
-      ts,
-      model: typeof row.model === "string" && row.model ? row.model : "unknown",
-      cost: finitePositive(row.cost),
-      input,
-      output,
-      cacheCreate,
-      cacheRead,
-      cacheSavings: 0
-    });
+    const entry = rowToEntry(row);
+    if (entry) entries.push(entry);
   }
   return entries;
 }
@@ -3442,11 +3471,16 @@ async function discoverGoogleOAuthClient() {
   }
   return null;
 }
+var discoverClient = discoverGoogleOAuthClient;
 async function resolveGoogleClient() {
   const envId = process.env.TOKMON_GOOGLE_CLIENT_ID?.trim();
   const envSecret = process.env.TOKMON_GOOGLE_CLIENT_SECRET?.trim();
   if (envId && envSecret) return { clientId: envId, clientSecret: envSecret };
-  if (cachedClient === void 0) cachedClient = await discoverGoogleOAuthClient();
+  if (cachedClient == null) {
+    const client = await discoverClient();
+    if (client) cachedClient = client;
+    return client;
+  }
   return cachedClient;
 }
 async function refreshAccessToken(refreshToken) {
@@ -3737,38 +3771,38 @@ import { createInterface as createInterface5 } from "readline";
 import { join as join16 } from "path";
 import { homedir as homedir12 } from "os";
 var PRICING3 = {
-  "gemini-3.1-pro-preview": { in: 2e-6, out: 12e-6, cr: 2e-7 },
-  "gemini-3.1-pro": { in: 2e-6, out: 12e-6, cr: 2e-7 },
-  "gemini-3-pro-preview": { in: 2e-6, out: 12e-6, cr: 2e-7 },
-  "gemini-3-pro": { in: 2e-6, out: 12e-6, cr: 2e-7 },
+  "gemini-3.1-pro-preview": { in: 2e-6, out: 12e-6, cr: 2e-7, long: { in: 4e-6, out: 18e-6, cr: 4e-7 } },
+  "gemini-3.1-pro": { in: 2e-6, out: 12e-6, cr: 2e-7, long: { in: 4e-6, out: 18e-6, cr: 4e-7 } },
+  "gemini-3-pro-preview": { in: 2e-6, out: 12e-6, cr: 2e-7, long: { in: 4e-6, out: 18e-6, cr: 4e-7 } },
+  "gemini-3-pro": { in: 2e-6, out: 12e-6, cr: 2e-7, long: { in: 4e-6, out: 18e-6, cr: 4e-7 } },
   "gemini-3.5-flash": { in: 75e-8, out: 45e-7, cr: 75e-9 },
   "gemini-3-flash-preview": { in: 5e-7, out: 3e-6, cr: 5e-8 },
   "gemini-3-flash": { in: 5e-7, out: 3e-6, cr: 5e-8 },
   "gemini-2.5-flash-lite": { in: 1e-7, out: 4e-7, cr: 1e-8 },
   "gemini-3.1-flash-lite": { in: 25e-8, out: 15e-7, cr: 25e-9 },
   "gemini-2.5-flash": { in: 3e-7, out: 25e-7, cr: 3e-8 },
-  "gemini-2.5-pro": { in: 125e-8, out: 1e-5, cr: 125e-9 },
+  "gemini-2.5-pro": { in: 125e-8, out: 1e-5, cr: 125e-9, long: { in: 25e-7, out: 15e-6, cr: 25e-8 } },
   "gemini-2.0-flash": { in: 1e-7, out: 4e-7, cr: 25e-9 }
 };
 var PRICE_KEYS3 = Object.keys(PRICING3).sort((a, b) => b.length - a.length);
-var ZERO_PRICE2 = { in: 0, out: 0, cr: 0 };
-var GEMINI_31_PRO_LONG_PRICE = { in: 4e-6, out: 18e-6, cr: 4e-7 };
+var FALLBACK_PRICE2 = PRICING3["gemini-3.1-pro"];
 var MAX_SESSION_FILE_BYTES = 16 * 1024 * 1024;
 var MAX_JSON_ENTRIES = 1e5;
 function geminiTmpDir(homeDir) {
   return join16(homeDir ?? homedir12(), ".gemini", "tmp");
 }
-function geminiPriceFor(model, promptTokens = 0) {
-  const m = model.toLowerCase().trim();
+function resolvePricing(m) {
   for (const key of PRICE_KEYS3) {
     if (!m.startsWith(key)) continue;
     const rest = m.slice(key.length);
-    if (rest === "" || rest[0] === "-") {
-      if (key.startsWith("gemini-3.1-pro") && promptTokens > 2e5) return GEMINI_31_PRO_LONG_PRICE;
-      return PRICING3[key];
-    }
+    if (rest === "" || rest[0] === "-") return PRICING3[key];
   }
-  return ZERO_PRICE2;
+  return FALLBACK_PRICE2;
+}
+function geminiPriceFor(model, promptTokens = 0) {
+  const p = resolvePricing(model.toLowerCase().trim());
+  if (promptTokens > 2e5 && p.long) return p.long;
+  return { in: p.in, out: p.out, cr: p.cr };
 }
 function shortModel2(model) {
   return model.replace(/(-preview|-customtools)+$/, "");
@@ -4242,7 +4276,7 @@ var PRICING4 = {
   "grok-code-fast": { in: 1e-6, cr: 2e-7, out: 2e-6 },
   "grok-build": { in: 1e-6, cr: 2e-7, out: 2e-6 }
 };
-var FALLBACK_PRICE2 = PRICING4["grok-4.5"];
+var FALLBACK_PRICE3 = PRICING4["grok-4.5"];
 var PRICE_KEYS4 = Object.keys(PRICING4).sort((a, b) => b.length - a.length);
 var MAX_SESSION_GROUPS = 128;
 var MAX_SESSIONS_PER_GROUP = 512;
@@ -4265,7 +4299,7 @@ function priceFor(model) {
   for (const key of PRICE_KEYS4) {
     if (modelKeyMatches2(m, key)) return PRICING4[key];
   }
-  return FALLBACK_PRICE2;
+  return FALLBACK_PRICE3;
 }
 async function detectGrok(homeDir) {
   for (const home of grokHomes(homeDir)) {
@@ -4279,6 +4313,14 @@ async function detectGrok(homeDir) {
   }
   return false;
 }
+async function byMtimeDesc(dir, names) {
+  const stated = await Promise.all(names.map(async (name) => {
+    const st = await fsStat6(join19(dir, name)).catch(() => null);
+    return { name, mtimeMs: st ? st.mtimeMs : -Infinity };
+  }));
+  stated.sort((a, b) => b.mtimeMs - a.mtimeMs || a.name.localeCompare(b.name));
+  return stated.map((s) => s.name);
+}
 async function loadSessionModels(home) {
   const out = /* @__PURE__ */ new Map();
   const sessionsRoot = join19(home, "sessions");
@@ -4288,8 +4330,9 @@ async function loadSessionModels(home) {
   } catch {
     return out;
   }
-  for (const group of groups.sort().reverse().slice(0, MAX_SESSION_GROUPS)) {
-    if (group === "session_search.sqlite" || group.startsWith(".")) continue;
+  const groupNames = groups.filter((g) => g !== "session_search.sqlite" && !g.startsWith("."));
+  const orderedGroups = (await byMtimeDesc(sessionsRoot, groupNames)).slice(0, MAX_SESSION_GROUPS);
+  for (const group of orderedGroups) {
     const groupDir = join19(sessionsRoot, group);
     let sessions;
     try {
@@ -4297,7 +4340,9 @@ async function loadSessionModels(home) {
     } catch {
       continue;
     }
-    for (const sid of sessions.sort().reverse().slice(0, MAX_SESSIONS_PER_GROUP)) {
+    const sessionNames = sessions.filter((s) => !s.startsWith("."));
+    const orderedSessions = (await byMtimeDesc(groupDir, sessionNames)).slice(0, MAX_SESSIONS_PER_GROUP);
+    for (const sid of orderedSessions) {
       try {
         const raw = JSON.parse(await readFile8(join19(groupDir, sid, "summary.json"), "utf-8"));
         const model = typeof raw?.current_model_id === "string" && raw.current_model_id ? raw.current_model_id : null;
@@ -4332,21 +4377,37 @@ function costOf2(model, input, cacheRead, output) {
   const cacheSavings = cacheRead * Math.max(0, p.in - p.cr);
   return { cost, cacheSavings };
 }
+var DEFAULT_MODEL = "grok-4.5";
+function modelChangeFrom(obj) {
+  if (obj?.msg !== "model changed" && obj?.msg !== "backend_search: model switch") return null;
+  const ctx = obj.ctx;
+  if (!ctx || typeof ctx !== "object") return null;
+  const c = ctx;
+  const model = typeof c.model === "string" ? c.model : typeof c.new_model === "string" ? c.new_model : null;
+  return model && model.trim() ? model : null;
+}
 async function parseUnifiedLog(path, models) {
   const entries = [];
+  const activeModel = /* @__PURE__ */ new Map();
   const input = createReadStream6(path);
   input.on("error", () => {
   });
   const rl = createInterface6({ input, crlfDelay: Infinity });
   try {
     for await (const line of rl) {
-      if (!line.includes("shell.turn.inference_done")) continue;
+      const isTurn = line.includes("shell.turn.inference_done");
+      if (!isTurn && !line.includes("model changed") && !line.includes("model switch")) continue;
       try {
         const obj = JSON.parse(line.charCodeAt(0) === 65279 ? line.slice(1) : line);
+        const sid = typeof obj.sid === "string" ? obj.sid : "unknown";
+        const switched = modelChangeFrom(obj);
+        if (switched) {
+          activeModel.set(sid, switched);
+          continue;
+        }
         if (obj?.msg !== "shell.turn.inference_done" || !obj.ctx) continue;
         const ts = Date.parse(String(obj.ts ?? ""));
         if (!Number.isFinite(ts)) continue;
-        const sid = typeof obj.sid === "string" ? obj.sid : "unknown";
         const ctx = obj.ctx;
         const prompt = safeNum(ctx.prompt_tokens);
         const cached = safeNum(ctx.cached_prompt_tokens);
@@ -4355,7 +4416,7 @@ async function parseUnifiedLog(path, models) {
         const cacheRead = cached;
         const output = completion;
         if (inputTokens + cacheRead + output <= 0) continue;
-        const model = models.get(sid) ?? "grok-4.5";
+        const model = activeModel.get(sid) ?? models.get(sid) ?? DEFAULT_MODEL;
         const { cost, cacheSavings } = costOf2(model, inputTokens, cacheRead, output);
         const loop = safeNum(ctx.loop_index);
         entries.push({
@@ -4398,7 +4459,7 @@ async function loadEntries6(since, homeDir) {
     files,
     async (path) => parseUnifiedLog(path, modelByHome.get(path) ?? /* @__PURE__ */ new Map()),
     since,
-    { fingerprint: { parser: `grok-unified-v2.${grokModelMapFingerprint(modelByHome)}` } }
+    { fingerprint: { parser: `grok-unified-v3.${grokModelMapFingerprint(modelByHome)}` } }
   );
 }
 async function grokDashboard(tz, homeDir) {
@@ -4579,6 +4640,7 @@ export {
   readClaudeIdentity,
   codexHomes,
   identityFromIdToken,
+  formatAgo,
   formatResetAt,
   currency,
   tokens,

package/dist/{chunk-VGYBQH5I.js → chunk-FMP3P2WV.js}

@@ -5,11 +5,11 @@ import {
   identityFromIdToken,
   readClaudeIdentity,
   readJson
-} from "./chunk-RTGMDE7U.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   expandHome,
   slugify
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/accounts.ts
 import { existsSync, readdirSync, readFileSync as readFileSync2, statSync } from "fs";

package/dist/{chunk-E2YXYU73.js → chunk-HP5UZCXP.js}

@@ -26,6 +26,7 @@ var DEFAULTS = {
   defaultFocus: "all",
   ascii: "auto",
   allowNetworkAccess: false,
+  allowedHosts: [],
   resetDisplay: "relative",
   knownProviders: []
 };
@@ -147,6 +148,27 @@ function sameJson(a, b) {
     return false;
   }
 }
+function normalizeAllowedHost(value) {
+  if (typeof value !== "string") return null;
+  const candidate = value.trim();
+  if (!candidate) return null;
+  try {
+    const url = new URL(`http://${candidate}`);
+    if (url.username || url.password || url.port || url.pathname !== "/" || url.search || url.hash) return null;
+    const hostname = url.hostname.toLowerCase().replace(/\.$/, "");
+    if (!hostname || hostname.length > 253 || hostname.includes("*")) return null;
+    const labels = hostname.split(".");
+    if (labels.some((label) => !label || label.length > 63 || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label))) return null;
+    return hostname;
+  } catch {
+    return null;
+  }
+}
+function normalizeAllowedHosts(value) {
+  if (!Array.isArray(value)) return [];
+  const hosts = value.map(normalizeAllowedHost).filter((host) => host !== null);
+  return [...new Set(hosts)];
+}
 function repairConfig(input) {
   const reasons = [];
   const parsed = isRecord(input) ? input : {};
@@ -192,6 +214,10 @@ function repairConfig(input) {
   if (parsed.knownProviders !== void 0 && !Array.isArray(parsed.knownProviders)) {
     reasons.push("knownProviders was not an array");
   }
+  const allowedHosts = normalizeAllowedHosts(parsed.allowedHosts);
+  if (parsed.allowedHosts !== void 0 && !sameJson(parsed.allowedHosts, allowedHosts)) {
+    reasons.push("allowedHosts contained invalid or duplicate hostnames");
+  }
   const activeAccountId = typeof parsed.activeAccountId === "string" && (accountIds.has(parsed.activeAccountId) || PROVIDER_IDS.includes(parsed.activeAccountId)) ? parsed.activeAccountId : null;
   if (parsed.activeAccountId !== void 0 && parsed.activeAccountId !== null && activeAccountId === null) {
     reasons.push("activeAccountId did not match a known account/provider");
@@ -217,6 +243,7 @@ function repairConfig(input) {
     defaultFocus: parsed.defaultFocus === "last" ? "last" : "all",
     ascii: parsed.ascii === "on" ? "on" : parsed.ascii === "off" ? "off" : "auto",
     allowNetworkAccess: parsed.allowNetworkAccess === true,
+    allowedHosts,
     resetDisplay: parsed.resetDisplay === "absolute" ? "absolute" : "relative",
     knownProviders
   };
@@ -389,6 +416,8 @@ export {
   getTrackedAccountRows,
   clampNum,
   isValidTimezone,
+  normalizeAllowedHost,
+  normalizeAllowedHosts,
   repairConfig,
   normalizeConfig,
   slugify,

package/dist/{chunk-OWPJUG4C.js → chunk-S33XIUAW.js}

@@ -11,7 +11,7 @@ import {
   colorHex,
   fetchPeak,
   namedHex
-} from "./chunk-VGYBQH5I.js";
+} from "./chunk-FMP3P2WV.js";
 import {
   PROVIDERS,
   TOKMON_CAPABILITIES,
@@ -22,7 +22,7 @@ import {
   detectProviders,
   resolveTimezone,
   withTimeout
-} from "./chunk-RTGMDE7U.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   cacheDir,
   expandHome,
@@ -30,7 +30,7 @@ import {
   normalizeConfig,
   saveConfig,
   snapshotCacheFile
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/server.ts
 import { createServer } from "http";
@@ -783,11 +783,11 @@ function isLoopbackHostHeader(value) {
   const hostname = hostnameFromHost(value);
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
 }
-function isAllowedHostHeader(value, allowNetworkAccess) {
+function isAllowedHostHeader(value, allowNetworkAccess, allowedHosts = []) {
   if (isLoopbackHostHeader(value)) return true;
   if (!allowNetworkAccess) return false;
   const hostname = hostnameFromHost(value);
-  return hostname !== null && isIP(hostname) !== 0;
+  return hostname !== null && (isIP(hostname) !== 0 || allowedHosts.includes(hostname));
 }
 function isSameOriginRequest(req) {
   const origin = header(req, "origin");
@@ -801,8 +801,8 @@ function isSameOriginRequest(req) {
     return false;
   }
 }
-function isAllowedLocalRequest(req, allowNetworkAccess) {
-  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess) && isSameOriginRequest(req);
+function isAllowedLocalRequest(req, allowNetworkAccess, allowedHosts = []) {
+  return isAllowedHostHeader(header(req, "host"), allowNetworkAccess, allowedHosts) && isSameOriginRequest(req);
 }
 
 // src/web/ws.ts
@@ -890,7 +890,7 @@ async function mountWsRpc(server, deps) {
     )
   );
   const onUpgrade = (req, socket, head) => {
-    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess)) {
+    if (!isAllowedLocalRequest(req, deps.state.config.allowNetworkAccess, deps.state.config.allowedHosts)) {
       rejectUpgrade(socket);
       return;
     }
@@ -945,8 +945,8 @@ function tokenMatches(given, expected) {
   const token = Buffer.from(expected);
   return actual.length === token.length && timingSafeEqual(actual, token);
 }
-function guardHost(req, res, allowNetworkAccess) {
-  if (isAllowedHostHeader(header2(req, "host"), allowNetworkAccess)) return true;
+function guardHost(req, res, config) {
+  if (isAllowedHostHeader(header2(req, "host"), config.allowNetworkAccess, config.allowedHosts)) return true;
   sendJson(res, 403, { error: "forbidden" });
   return false;
 }
@@ -962,7 +962,7 @@ function createRouter(engine, state, vite, webRoot, wsToken, version) {
     const url = req.url || "/";
     const path = url.split("?")[0];
     const method = req.method || "GET";
-    if (!guardHost(req, res, state.config.allowNetworkAccess)) return;
+    if (!guardHost(req, res, state.config)) return;
     if (path === "/api/data") {
       engine.touch();
       sendJson(res, 200, engine.snapshot() ?? { pending: true });

package/dist/{chunk-QM5E5RJZ.js → chunk-XDA5RJST.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   cacheDir
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/web/lockfile.ts
 import { closeSync, fchmodSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";

package/dist/{cli-command-U7RZ2GTD.js → cli-command-75LP4IDS.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   attachOrSpawn
-} from "./chunk-AMD4PXDG.js";
-import "./chunk-QM5E5RJZ.js";
+} from "./chunk-4HU4EI5T.js";
+import "./chunk-XDA5RJST.js";
 import "./chunk-SMPY52EV.js";
 import {
   createDaemonRpcClient
-} from "./chunk-4CY725NY.js";
+} from "./chunk-3RTWFGGD.js";
 import {
   PROVIDERS,
   antigravityStateDb,
@@ -26,11 +26,11 @@ import {
   startOfMonth,
   startOfWeek,
   withTimeout
-} from "./chunk-RTGMDE7U.js";
+} from "./chunk-CVKCVHS7.js";
 import {
   PROVIDER_IDS,
   configLocation
-} from "./chunk-E2YXYU73.js";
+} from "./chunk-HP5UZCXP.js";
 
 // src/provider-locations.ts
 import { access } from "fs/promises";