fix: harden prompt cache telemetry and masking

Author: ndycode

index.ts

@@ -2036,6 +2036,11 @@ export const OpenAIOAuthPlugin: Plugin = async ({ client }: PluginInput) => {
 							);
 							runtimeMetrics.lastRequestAt = Date.now();
 							runtimeMetrics.lastPromptCacheKey = promptCacheKey ?? null;
+							if (promptCacheKey) {
+								runtimeMetrics.promptCacheEnabledRequests++;
+							} else {
+								runtimeMetrics.promptCacheMissingRequests++;
+							}
 							const retryBudget = new RetryBudgetTracker(retryBudgetLimits);
 							const consumeRetryBudget = (
 								bucket: RetryBudgetClass,
@@ -2336,17 +2341,19 @@ while (attempted.size < Math.max(1, accountCount)) {
 								// in-memory only and run on Node's single-threaded event loop, so no
 								// filesystem locking or token-redaction concerns are introduced here.
 								runtimeMetrics.totalRequests++;
-								if (promptCacheKey) {
-									runtimeMetrics.promptCacheEnabledRequests++;
-								} else {
-									runtimeMetrics.promptCacheMissingRequests++;
-								}
 								response = await fetch(url, {
 									...requestInit,
 									headers,
 									signal: fetchController.signal,
 								});
 							} catch (networkError) {
+								if (abortSignal?.aborted && fetchController.signal.aborted) {
+									accountManager.refundToken(account, modelFamily, model);
+									if (networkError instanceof Error) {
+										throw networkError;
+									}
+									throw new Error(String(networkError));
+								}
 								const errorMsg = networkError instanceof Error ? networkError.message : String(networkError);
 								logWarn(`Network error for account ${account.index + 1}: ${errorMsg}`);
 								if (

lib/ui/beginner.ts

@@ -1,3 +1,5 @@
+import { createHash } from "node:crypto";
+
 export type BeginnerDiagnosticSeverity = "ok" | "warning" | "error";
 
 export interface BeginnerAccountSnapshot {
@@ -53,7 +55,8 @@ export interface BeginnerAccountSummary {
 export function formatPromptCacheKey(value: string | null | undefined): string {
 	const normalized = value?.trim();
 	if (!normalized) return "none";
-	return `${normalized.slice(0, 8)}...`;
+	const fingerprint = createHash("sha256").update(normalized).digest("hex").slice(0, 12);
+	return `masked-${fingerprint}`;
 }
 
 export function formatPromptCacheSnapshot(runtime: Pick<

test/beginner-ui.test.ts

@@ -1,4 +1,6 @@
 import { describe, it, expect } from "vitest";
+import { createHash } from "node:crypto";
+
 import {
 	buildBeginnerChecklist,
 	buildBeginnerDoctorFindings,
@@ -238,11 +240,15 @@ describe("formatPromptCacheKey", () => {
 	});
 
 	it("redacts short values too", () => {
-		expect(formatPromptCacheKey("ses_1234")).toBe("ses_1234...");
+		expect(formatPromptCacheKey("ses_1234")).toBe(
+			`masked-${createHash("sha256").update("ses_1234").digest("hex").slice(0, 12)}`,
+		);
 	});
 
-	it("redacts longer values to an 8-char prefix", () => {
-		expect(formatPromptCacheKey("ses_prompt_cache_key_123")).toBe("ses_prom...");
+	it("redacts longer values to a stable masked fingerprint", () => {
+		expect(formatPromptCacheKey("ses_prompt_cache_key_123")).toBe(
+			`masked-${createHash("sha256").update("ses_prompt_cache_key_123").digest("hex").slice(0, 12)}`,
+		);
 	});
 });
 
@@ -254,7 +260,9 @@ describe("formatPromptCacheSnapshot", () => {
 			lastPromptCacheKey: "ses_prompt_cache_key_123",
 		});
 
-		expect(rendered).toBe("enabled=4, missing=1, lastKey=ses_prom...");
+		expect(rendered).toBe(
+			`enabled=4, missing=1, lastKey=masked-${createHash("sha256").update("ses_prompt_cache_key_123").digest("hex").slice(0, 12)}`,
+		);
 		expect(rendered).not.toContain("ses_prompt_cache_key_123");
 	});
 });