refactor: decommission InsForge cloud backend from repo + CI (part of #71)

.env.example

@@ -1,25 +1,15 @@
 # Core runtime / CLI
 TOKENTRACKER_DEVICE_TOKEN=
-TOKENTRACKER_ACCESS_TOKEN=
-TOKENTRACKER_INSFORGE_BASE_URL=
 TOKENTRACKER_HTTP_TIMEOUT_MS=
 
 # Dashboard (Vite)
-VITE_INSFORGE_BASE_URL=
-VITE_INSFORGE_ANON_KEY=
 VITE_TOKENTRACKER_HTTP_TIMEOUT_MS=
 VITE_TOKENTRACKER_MOCK=
 VITE_TOKENTRACKER_MOCK_NOW=
 VITE_TOKENTRACKER_MOCK_TODAY=
 VITE_TOKENTRACKER_MOCK_SEED=
 VITE_TOKENTRACKER_MOCK_MISSING=
 
-# InsForge / service role
-INSFORGE_BASE_URL=
-INSFORGE_ANON_KEY=
-INSFORGE_SERVICE_ROLE_KEY=
-INSFORGE_API_KEY=
-
 # Pricing sync / external
 OPENROUTER_API_KEY=
 

.github/workflows/ci.yml

@@ -54,11 +54,4 @@ jobs:
         run: npm ci --prefix dashboard
 
       - name: Run local CI gate
-        env:
-          # Public client-side values inlined into the dashboard bundle at
-          # build time. Not secrets — they ship in every published bundle and
-          # must be present or Vite inlines empty strings and the build fails.
-          # Kept in sync with npm-publish.yml.
-          VITE_INSFORGE_BASE_URL: https://srctyff5.us-east.insforge.app
-          VITE_INSFORGE_ANON_KEY: ik_9f35735991b684f7cf57fa00bb4d0487
         run: npm run ci:local

.github/workflows/npm-publish.yml

@@ -34,9 +34,6 @@ jobs:
         run: npm ci --prefix dashboard
 
       - name: Run local CI gate
-        env:
-          VITE_INSFORGE_BASE_URL: https://srctyff5.us-east.insforge.app
-          VITE_INSFORGE_ANON_KEY: ik_9f35735991b684f7cf57fa00bb4d0487
         run: npm run ci:local
 
   publish:
@@ -72,15 +69,8 @@ jobs:
         if: steps.version-check.outputs.exists == 'false'
         run: npm ci --prefix dashboard
 
-      # InsForge URL + anon key are public client-side values shipped in every
-      # dashboard bundle. They MUST be present at build time or Vite inlines
-      # empty strings — breaks leaderboard fetch and disables cloud OAuth.
-      # `dashboard/.env.local` is gitignored so CI cannot read it.
       - name: Build dashboard
         if: steps.version-check.outputs.exists == 'false'
-        env:
-          VITE_INSFORGE_BASE_URL: https://srctyff5.us-east.insforge.app
-          VITE_INSFORGE_ANON_KEY: ik_9f35735991b684f7cf57fa00bb4d0487
         run: npm run dashboard:build
 
       - name: Publish to npm

.github/workflows/release-dmg.yml

@@ -87,15 +87,7 @@ jobs:
       - name: Install dashboard dependencies
         run: npm ci --prefix dashboard
 
-      # InsForge URL + anon key are public client-side values (shipped in every
-      # dashboard bundle). They MUST be present at build time or Vite inlines
-      # empty strings, which breaks the leaderboard page (no baseUrl → no fetch)
-      # and disables cloud OAuth (`isCloudInsforgeConfigured()` returns false).
-      # `dashboard/.env.local` is gitignored so CI cannot read it — inject here.
       - name: Build dashboard
-        env:
-          VITE_INSFORGE_BASE_URL: https://srctyff5.us-east.insforge.app
-          VITE_INSFORGE_ANON_KEY: ik_9f35735991b684f7cf57fa00bb4d0487
         run: npm run dashboard:build
 
       # 2. Bundle EmbeddedServer (Node.js + tokentracker source)

.github/workflows/release-windows.yml

@@ -63,17 +63,12 @@ jobs:
           }
           Write-Host "Version OK: $env:VERSION"
 
-      # 1. Build dashboard. InsForge URL + anon key are public client-side values
-      # (shipped in every dashboard bundle) but MUST be present at build time or
-      # Vite inlines empty strings — breaks the leaderboard fetch and disables
-      # cloud OAuth. `dashboard/.env.local` is gitignored so CI cannot read it.
+      # 1. Build dashboard.
       - name: Install dashboard dependencies
         run: npm ci --prefix dashboard
 
       - name: Build dashboard
         env:
-          VITE_INSFORGE_BASE_URL: https://srctyff5.us-east.insforge.app
-          VITE_INSFORGE_ANON_KEY: ik_9f35735991b684f7cf57fa00bb4d0487
           # Include the floating-pet entry (pet.html). Off by default so the macOS +
           # web builds stay byte-identical; only the Windows build opts in.
           TOKENTRACKER_BUILD_PET: "1"

CLAUDE.md

@@ -103,7 +103,7 @@ The macOS + Windows release is **one workflow**: `release-dmg.yml` (display name
 | `src/` or `dashboard/` | ✅ | ✅ | ✅ | ✅ |
 | `TokenTrackerBar/` Swift only | ✅ | ✅ | ✅ | ✅ |
 | `TokenTrackerWin/` only | ✅ | ✅ | ✅ | ✅ |
-| `dashboard/edge-patches/`, scripts, docs, CI | — | — | — | — |
+| scripts, docs, CI | — | — | — | — |
 
 All four version locations must match or the workflows' "Verify version" steps fail (DMG checks `package.json` + `project.yml`; Windows checks `package.json` + `csproj`).
 

SECURITY.md

@@ -31,7 +31,6 @@ TokenTracker is a local-first tool that reads AI CLI tool logs from your home di
 - **`src/lib/cursor-config.js`** — reads Cursor's local SQLite to extract auth tokens for the Cursor usage API. Tokens must never leave the user's machine.
 - **`src/lib/local-api.js`** — local HTTP server bound to `127.0.0.1`. Should not accept connections from other hosts.
 - **`TokenTrackerBar/`** — macOS app, ad-hoc signed. Has filesystem access via macOS TCC permissions; should never write outside its own data directories or the documented snapshot/queue paths.
-- **`insforge/`** — optional cloud edge functions. Only used if the user opts into the leaderboard.
 
 ## Out of Scope
 

dashboard/.env.example

@@ -1,7 +1,2 @@
-# InsForge：OAuth SDK 与排行榜 Edge（Leaderboard 用 getLeaderboardBaseUrl；仪表盘在 localhost 仍走相对路径 CLI API）。
-VITE_INSFORGE_BASE_URL=https://your-project.us-east.insforge.app
-VITE_INSFORGE_ANON_KEY=
-
-# 设为 1 时仪表盘/排行榜用本地假数据；真实排行榜需关闭 mock。
+# Set to 1 to render the dashboard with local mock data instead of the live CLI API.
 # VITE_TOKENTRACKER_MOCK=0
-