@aaa-sentinel/ai-usage 0.2.0 → 0.2.2

package/README.md

@@ -226,9 +226,11 @@ systemd=true
   usage. Remove or change it and the agent does not put it back; `logout` restores yours.
 - **GitHub Copilot.** Needs the [GitHub CLI](https://cli.github.com) signed in to the account that
   holds the Copilot plan: `gh auth login`, then `gh auth status` must show that account
-  (`winget install GitHub.cli` on Windows, `brew install gh` on macOS). Premium requests by model
+  (`winget install GitHub.cli` on Windows, `brew install gh` on macOS). The default `gh` login
+  cannot read billing usage: add the `user` scope once with `gh auth refresh -h github.com -s user`.
+  Premium requests by model
   are read through `gh`; GitHub does not report tokens. This is account usage, not device usage, so
-  two laptops do not double it. If `gh` answers 401 or 403, an empty row is not written. The
+  two laptops do not double it. If `gh` answers 401 or 403, or asks for the `user` scope, an empty row is not written. The
   month's AI credits are read the same way and only their total is sent, to compare with the
   credits the plan includes.
 - **Codex.** Session counters, only when Codex is signed in with the ChatGPT subscription
@@ -276,7 +278,7 @@ measures Codex, not the ChatGPT chat.
 | Exit code `3` — *No se pudo registrar el arranque* | Windows: a company policy may block Task Scheduler, ask IT. macOS: run `login` in the Terminal of your session, not over SSH. Linux/WSL: no systemd user instance, see [Automatic start](#automatic-start). Nothing is left installed |
 | Exit code `4` — *El servidor no reconoce el token* | The token was rotated or the connection was revoked or removed. Get a new token and repeat step 4 |
 | *El uso de esta herramienta no corresponde a esta conexión…* | The token was enrolled for a different tool. Use the token of the connection that matches this machine's tool |
-| Exit code `5` | Copilot: install `gh` and `gh auth login` to the account that holds Copilot |
+| Exit code `5` | Copilot: install `gh`, `gh auth login` to the account that holds Copilot, then `gh auth refresh -h github.com -s user` |
 | `sentinel-usage: fetch failed` | No route to `https://api.aaa-sentinel.com` on port 443: proxy or firewall. Ask IT. For npm behind a proxy: `npm config set proxy …` and `npm config set https-proxy …` |
 | The card stays on *Silent agent* | No usage this period yet. Use the tool, run `sentinel-usage report` and read its message |
 

package/dist/cli.js

@@ -63,7 +63,7 @@ ${args.map(cmdArg).join(" ")}\r
   <Actions Context="Author"><Exec><Command>${xmlEscape(windowsCmd)}</Command></Exec></Actions>\r
 </Task>\r
 `;
-          writeFileSync(logonXml, Buffer.from(`\uFEFF${xml}`, "utf16le"));
+          writeFileSync(logonXml, Buffer.from(`${String.fromCharCode(65279)}${xml}`, "utf16le"));
           try {
             await run(exec, "schtasks", ["/Create", "/F", "/TN", TASK_LOGON, "/XML", logonXml]);
           } finally {
@@ -190,6 +190,13 @@ WantedBy=timers.target
 
 // src/quota.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+
+// src/bom.ts
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+
+// src/quota.ts
 import { dirname } from "node:path";
 var MAX_RESETS_PER_DAY = 48;
 function num(value) {
@@ -279,7 +286,7 @@ function statusLineCommand(args, platform) {
 function parseSettings(text) {
   if (!text.trim()) return {};
   try {
-    return asRecord(JSON.parse(text));
+    return asRecord(JSON.parse(stripBom(text)));
   } catch {
     return null;
   }
@@ -387,7 +394,7 @@ function asRecord2(value) {
 }
 function mergeCursorHook(existing, command) {
   let parsed = {};
-  if (existing.trim()) parsed = JSON.parse(existing);
+  if (existing.trim()) parsed = JSON.parse(stripBom(existing));
   const root = asRecord2(parsed) ?? {};
   const hooks = asRecord2(root["hooks"]) ?? {};
   const stopRaw = hooks["stop"];
@@ -402,7 +409,7 @@ function mergeCursorHook(existing, command) {
 }
 function removeCursorHook(existing, command) {
   if (!existing.trim()) return existing;
-  const root = asRecord2(JSON.parse(existing));
+  const root = asRecord2(JSON.parse(stripBom(existing)));
   if (!root) return existing;
   const hooks = asRecord2(root["hooks"]);
   if (!hooks || !Array.isArray(hooks["stop"])) return existing;
@@ -952,6 +959,10 @@ function readCodexIncrement(dir, previous) {
 // src/copilot.ts
 var MODEL_PATTERN4 = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var API_VERSION = "2026-03-10";
+function missingUserScope(result) {
+  return result.code !== 0 && /needs the "user" scope/i.test(`${result.stdout}
+${result.stderr}`);
+}
 function authFailure(result) {
   if (result.code === 0) return false;
   const text = `${result.stdout}
@@ -1025,6 +1036,7 @@ async function ghJson(gh, path) {
     `X-GitHub-Api-Version: ${API_VERSION}`,
     path
   ]);
+  if (missingUserScope(result)) return { auth: true, scope: true, payload: null };
   if (authFailure(result)) return { auth: true, payload: null };
   if (result.code !== 0) return { auth: false, payload: null };
   try {
@@ -1070,6 +1082,7 @@ async function readCopilotDay(gh, day) {
   const query = `year=${year}&month=${Number(month)}&day=${Number(date)}`;
   const base = `/users/${login2}/settings/billing`;
   const premium = await ghJson(gh, `${base}/premium_request/usage?${query}`);
+  if (premium.scope) return { status: "scope" };
   if (premium.auth) return { status: "auth" };
   const rows = rowsFromCopilotUsage(premium.payload, day);
   return rows.length > 0 ? { status: "rows", rows } : { status: "empty" };
@@ -1242,7 +1255,7 @@ function forgetLocalState(paths, source) {
   if (source === "claude_code" && paths.quotaPath) rmSync2(paths.quotaPath, { force: true });
 }
 async function login(options) {
-  const token = options.token.replace(/^/, "").trim();
+  const token = stripBom(options.token).trim();
   if (!TOKEN_PATTERN.test(token)) {
     return { code: EXIT_USAGE, message: "El token no tiene el formato de un alta de uso." };
   }
@@ -1448,8 +1461,8 @@ async function reportConnection(options, connection, source, context) {
       const credits = await readCopilotMonthCredits(options.gh, today);
       for (const day of [previousUtcDay(today), today]) {
         const read = await readCopilotDay(options.gh, day);
-        if (read.status === "auth") {
-          copilotAuth = true;
+        if (read.status === "auth" || read.status === "scope") {
+          copilotAuth = read.status;
           break;
         }
         if (read.status === "unavailable") {
@@ -1497,7 +1510,8 @@ async function reportConnection(options, connection, source, context) {
   if (outcome.error) return run2({ code: EXIT_REPORT, message: outcome.error });
   if (outcome.mismatch) return run2({ code: 0, message: "El uso de esta herramienta no corresponde a esta conexi\xF3n y no se ha subido." });
   if (copilotAuth && !outcome.acceptedAny) {
-    return run2({ code: EXIT_COPILOT, message: "gh no tiene permiso para leer el uso de Copilot. No se ha escrito una fila vac\xEDa." });
+    const fix = copilotAuth === "scope" ? "ejecuta gh auth refresh -h github.com -s user" : "inicia sesi\xF3n con gh auth login en la cuenta de Copilot";
+    return run2({ code: EXIT_COPILOT, message: `gh no tiene permiso para leer el uso de Copilot: ${fix}. No se ha escrito una fila vac\xEDa.` });
   }
   if (copilotUnavailable) {
     return run2({ code: EXIT_COPILOT, message: "No se pudo usar gh. Hace falta GitHub CLI con gh auth login en la cuenta de Copilot." });
@@ -1603,7 +1617,7 @@ var runPreviousWithShell = (command, input) => {
 function statusLine(options) {
   let parsed = null;
   try {
-    parsed = JSON.parse(options.input);
+    parsed = JSON.parse(stripBom(options.input));
   } catch {
     parsed = null;
   }

package/dist/hook.js

@@ -1,8 +1,16 @@
 // src/hook.ts
+import { readFileSync } from "node:fs";
+
+// src/cursor.ts
 import { randomBytes } from "node:crypto";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
+// src/bom.ts
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+
 // src/cursor.ts
 var MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 var TOKEN_MAX = 1e12;
@@ -12,9 +20,9 @@ function finiteInt(value) {
   if (rounded > TOKEN_MAX) return void 0;
   return rounded;
 }
-function parseStopPayload(payload2, at) {
-  if (!payload2 || typeof payload2 !== "object" || Array.isArray(payload2)) return null;
-  const record = payload2;
+function parseStopPayload(payload, at) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const record = payload;
   if (record["hook_event_name"] !== "stop") return null;
   const modelRaw = record["model"];
   const model = typeof modelRaw === "string" && MODEL_PATTERN.test(modelRaw) ? modelRaw : void 0;
@@ -22,25 +30,45 @@ function parseStopPayload(payload2, at) {
   const output = finiteInt(record["output_tokens"]);
   const cacheRead = finiteInt(record["cache_read_tokens"]);
   const cacheWrite = finiteInt(record["cache_write_tokens"]);
-  const event2 = { at, tokensKnown: false };
-  if (model) event2.model = model;
+  const event = { at, tokensKnown: false };
+  if (model) event.model = model;
   if (input !== void 0 && output !== void 0 && cacheRead !== void 0 && cacheWrite !== void 0) {
-    event2.tokensKnown = true;
-    event2.inputTokens = Math.max(0, input - cacheRead - cacheWrite);
-    event2.outputTokens = output;
-    event2.cacheReadTokens = cacheRead;
-    event2.cacheWriteTokens = cacheWrite;
+    event.tokensKnown = true;
+    event.inputTokens = Math.max(0, input - cacheRead - cacheWrite);
+    event.outputTokens = output;
+    event.cacheReadTokens = cacheRead;
+    event.cacheWriteTokens = cacheWrite;
   }
-  return event2;
+  return event;
 }
-function serializeSpoolEvent(event2) {
-  const line = { at: event2.at, tokensKnown: event2.tokensKnown };
-  if (event2.model) line["model"] = event2.model;
-  if (event2.tokensKnown) {
-    line["inputTokens"] = event2.inputTokens ?? 0;
-    line["outputTokens"] = event2.outputTokens ?? 0;
-    line["cacheReadTokens"] = event2.cacheReadTokens ?? 0;
-    line["cacheWriteTokens"] = event2.cacheWriteTokens ?? 0;
+function recordStop(raw2, spool2, at) {
+  let payload;
+  try {
+    payload = JSON.parse(stripBom(raw2));
+  } catch {
+    return false;
+  }
+  const event = parseStopPayload(payload, at);
+  if (!event) return false;
+  try {
+    mkdirSync(spool2, { recursive: true, mode: 448 });
+    writeFileSync(join(spool2, `${Date.now()}-${randomBytes(4).toString("hex")}.json`), serializeSpoolEvent(event), {
+      flag: "wx",
+      mode: 384
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function serializeSpoolEvent(event) {
+  const line = { at: event.at, tokensKnown: event.tokensKnown };
+  if (event.model) line["model"] = event.model;
+  if (event.tokensKnown) {
+    line["inputTokens"] = event.inputTokens ?? 0;
+    line["outputTokens"] = event.outputTokens ?? 0;
+    line["cacheReadTokens"] = event.cacheReadTokens ?? 0;
+    line["cacheWriteTokens"] = event.cacheWriteTokens ?? 0;
   }
   return JSON.stringify(line);
 }
@@ -48,20 +76,10 @@ function serializeSpoolEvent(event2) {
 // src/hook.ts
 var spool = process.argv[2];
 if (!spool) process.exit(0);
-var payload;
-try {
-  payload = JSON.parse(readFileSync(0, "utf8"));
-} catch {
-  process.exit(0);
-}
-var event = parseStopPayload(payload, (/* @__PURE__ */ new Date()).toISOString());
-if (!event) process.exit(0);
+var raw;
 try {
-  mkdirSync(spool, { recursive: true, mode: 448 });
-  writeFileSync(join(spool, `${Date.now()}-${randomBytes(4).toString("hex")}.json`), serializeSpoolEvent(event), {
-    flag: "wx",
-    mode: 384
-  });
+  raw = readFileSync(0, "utf8");
 } catch {
   process.exit(0);
 }
+recordStop(raw, spool, (/* @__PURE__ */ new Date()).toISOString());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aaa-sentinel/ai-usage",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Report individual Cursor, Claude Code, Copilot and Codex usage to AAA Sentinel; prompts and tokens stay on the laptop",
   "license": "MIT",
   "type": "module",