@algosuite/vo-mcp 0.2.0-beta.26 → 0.2.0-beta.28

package/dist/runner-cli.js

@@ -3026,23 +3026,42 @@ function isTruthyFlag(v) {
   const s = String(v ?? "").trim().toLowerCase();
   return s === "1" || s === "true" || s === "yes" || s === "on";
 }
-function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey } = {}) {
-  if (isTruthyFlag(baseEnv[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(baseEnv[PREFER_LOGIN_ENV])) {
+function wantsLogin(env2) {
+  return isTruthyFlag(env2[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(env2[PREFER_LOGIN_ENV]);
+}
+function wantsKey(env2) {
+  return isTruthyFlag(env2[CLAUDE_PREFER_KEY_ENV]) || isTruthyFlag(env2[PREFER_KEY_ENV]);
+}
+function withAnthropicKey(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
     const next = { ...baseEnv };
     delete next.ANTHROPIC_API_KEY;
     return next;
   }
   if (baseEnv.ANTHROPIC_API_KEY) return { ...baseEnv };
   const key = getKey();
-  return key ? { ...baseEnv, ANTHROPIC_API_KEY: key } : { ...baseEnv };
+  if (!key) return { ...baseEnv };
+  if (!preferKey && probeLogin() === true) return { ...baseEnv };
+  return { ...baseEnv, ANTHROPIC_API_KEY: key };
+}
+function claudeCostBasis(env2 = process.env) {
+  return String(env2.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
 }
-function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey } = {}) {
-  if (isTruthyFlag(baseEnv[CLAUDE_PREFER_LOGIN_ENV]) || isTruthyFlag(baseEnv[PREFER_LOGIN_ENV])) {
+function describeAnthropicAuthSource(baseEnv = {}, { getKey = getAnthropicKey, probeLogin = probeClaudeLoginState } = {}) {
+  const preferKey = wantsKey(baseEnv);
+  if (!preferKey && wantsLogin(baseEnv)) {
     return "claude auth login (VO_RUNNER_PREFER_LOGIN set \u2014 any API key ignored)";
   }
   if (baseEnv.ANTHROPIC_API_KEY) return "ANTHROPIC_API_KEY from environment";
-  if (getKey()) return "ANTHROPIC_API_KEY from OS keychain";
-  return "claude auth login session (no API key set)";
+  if (!getKey()) return "claude auth login session (no API key set)";
+  if (preferKey) {
+    return "ANTHROPIC_API_KEY from OS keychain (VO_RUNNER_PREFER_KEY set \u2014 subscription ignored)";
+  }
+  if (probeLogin() === true) {
+    return "claude auth login session (subscription beats the stored keychain key)";
+  }
+  return "ANTHROPIC_API_KEY from OS keychain";
 }
 function augmentAuthError(summary) {
   const s = String(summary ?? "");
@@ -3064,7 +3083,7 @@ function probeClaudeLoginState({
     return null;
   }
 }
-var require2, KEY_SERVICE, KEY_ACCOUNT, _entryCtor, _loadTried, PREFER_LOGIN_ENV, CLAUDE_PREFER_LOGIN_ENV, AUTH_ERROR_RE;
+var require2, KEY_SERVICE, KEY_ACCOUNT, _entryCtor, _loadTried, PREFER_LOGIN_ENV, CLAUDE_PREFER_LOGIN_ENV, PREFER_KEY_ENV, CLAUDE_PREFER_KEY_ENV, AUTH_ERROR_RE;
 var init_anthropic_key_store = __esm({
   "../../scripts/virtual-office/code-runner/anthropic-key-store.mjs"() {
     "use strict";
@@ -3075,6 +3094,8 @@ var init_anthropic_key_store = __esm({
     _loadTried = false;
     PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
     CLAUDE_PREFER_LOGIN_ENV = "VO_RUNNER_CLAUDE_PREFER_LOGIN";
+    PREFER_KEY_ENV = "VO_RUNNER_PREFER_KEY";
+    CLAUDE_PREFER_KEY_ENV = "VO_RUNNER_CLAUDE_PREFER_KEY";
     AUTH_ERROR_RE = /\b401\b|invalid[^.]{0,24}(authentication|credential)|authentication_error|unauthorized|not[ _-]?authenticated/i;
   }
 });
@@ -3734,6 +3755,46 @@ var init_claude_stream_event = __esm({
   }
 });
 
+// ../../scripts/virtual-office/code-runner/agent-auth-tier.mjs
+function authTierFromCostBasis(costBasis) {
+  return COST_BASIS_TO_TIER[String(costBasis ?? "")] ?? AUTH_TIER_UNKNOWN;
+}
+function safeAuthTier(compute) {
+  try {
+    return normalizeAuthTier(compute());
+  } catch {
+    return AUTH_TIER_UNKNOWN;
+  }
+}
+function normalizeAuthTier(value) {
+  return AUTH_TIERS.includes(value) ? value : AUTH_TIER_UNKNOWN;
+}
+function resolveReportedAuthTier({ authTier, installed, authenticated } = {}) {
+  if (installed !== true || authenticated !== true) return AUTH_TIER_UNKNOWN;
+  return normalizeAuthTier(authTier);
+}
+var AUTH_TIER_SUBSCRIPTION, AUTH_TIER_API_KEY, AUTH_TIER_LOCAL, AUTH_TIER_UNKNOWN, AUTH_TIERS, COST_BASIS_TO_TIER;
+var init_agent_auth_tier = __esm({
+  "../../scripts/virtual-office/code-runner/agent-auth-tier.mjs"() {
+    "use strict";
+    AUTH_TIER_SUBSCRIPTION = "subscription";
+    AUTH_TIER_API_KEY = "api_key";
+    AUTH_TIER_LOCAL = "local";
+    AUTH_TIER_UNKNOWN = "unknown";
+    AUTH_TIERS = Object.freeze([
+      AUTH_TIER_SUBSCRIPTION,
+      AUTH_TIER_API_KEY,
+      AUTH_TIER_LOCAL,
+      AUTH_TIER_UNKNOWN
+    ]);
+    COST_BASIS_TO_TIER = Object.freeze({
+      subscription_api_equivalent: AUTH_TIER_SUBSCRIPTION,
+      vendor_billed: AUTH_TIER_API_KEY,
+      local_zero: AUTH_TIER_LOCAL
+    });
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/cli-version-floor.mjs
 function parseCliVersion(output) {
   const match = /\b(\d+)\.(\d+)\.(\d+)(?:-[0-9A-Za-z.-]+)?\b/.exec(String(output ?? ""));
@@ -3803,9 +3864,22 @@ function isTimeout(probe) {
 function notFound(probe) {
   return errorCode(probe?.error) === "ENOENT";
 }
+function resolveClaudeAuthTier({
+  env: env2 = process.env,
+  loggedIn = null,
+  getStoredKey = getAnthropicKey
+} = {}) {
+  return safeAuthTier(() => {
+    const spawnEnv = withAnthropicKey(env2, { getKey: getStoredKey, probeLogin: () => loggedIn });
+    const tier = authTierFromCostBasis(claudeCostBasis(spawnEnv));
+    if (tier === AUTH_TIER_SUBSCRIPTION && loggedIn !== true) return AUTH_TIER_UNKNOWN;
+    return tier;
+  });
+}
 async function checkClaudeAuth({
   spawnVersion = spawnClaudeSync,
   probeLogin = probeClaudeLoginState,
+  getStoredKey = getAnthropicKey,
   env: env2 = process.env
 } = {}) {
   try {
@@ -3855,6 +3929,10 @@ async function checkClaudeAuth({
     return {
       installed: true,
       authenticated: true,
+      // Dispatch-time billing signal, carried on the same probe that already
+      // paid for the login read. Never sent for a non-authenticated result:
+      // there is no tier without a working credential.
+      authTier: resolveClaudeAuthTier({ env: env2, loggedIn, getStoredKey }),
       message: loggedIn === true ? "claude CLI installed and logged in (claude auth status)" : "claude binary found (login state unknown \u2014 auth check is best-effort)"
     };
   } catch (error) {
@@ -3870,6 +3948,7 @@ var init_claude_auth_check = __esm({
   "../../scripts/virtual-office/code-runner/claude-auth-check.mjs"() {
     "use strict";
     init_anthropic_key_store();
+    init_agent_auth_tier();
     init_cli_version_floor();
     init_windows_claude_launch();
     FIRST_VERSION_TIMEOUT_MS = 4500;
@@ -4134,7 +4213,7 @@ var init_claude_runner = __esm({
         return withAnthropicKey(env2);
       }
       costBasis(env2 = process.env) {
-        return String(env2.ANTHROPIC_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
+        return claudeCostBasis(env2);
       }
       /** Describe which Anthropic auth source the spawn will use (for runner logs). */
       describeAuth(env2 = process.env) {
@@ -4369,6 +4448,7 @@ var init_codex_runner = __esm({
   "../../scripts/virtual-office/code-runner/codex-runner.mjs"() {
     "use strict";
     init_agent_key_store();
+    init_agent_auth_tier();
     init_flat_token_usage();
     CODEX_PREFER_LOGIN_ENV = "VO_RUNNER_CODEX_PREFER_LOGIN";
     LEGACY_PREFER_LOGIN_ENV = "VO_RUNNER_PREFER_LOGIN";
@@ -4426,6 +4506,19 @@ var init_codex_runner = __esm({
       costBasis(env2 = process.env) {
         return String(env2.OPENAI_API_KEY || env2.CODEX_API_KEY || "").trim() ? "vendor_billed" : "subscription_api_equivalent";
       }
+      /**
+       * Dispatch-time billing tier for the NEXT codex spawn, from the SAME facts
+       * checkAuth() already gathered — no extra subprocess. applyAuthEnv() is a
+       * keychain read in this process (@napi-rs/keyring), not a spawn.
+       *
+       * Codex is the agent where this signal was already computed and then thrown
+       * away: checkAuth() distinguished "API key available (no persisted ChatGPT
+       * login)" from a real login, but only inside a `message` string that the
+       * heartbeat schema strips before storage. This gives that fact a typed home.
+       */
+      authTier(env2 = this.env) {
+        return safeAuthTier(() => authTierFromCostBasis(this.costBasis(this.applyAuthEnv(env2))));
+      }
       /** Best-effort binary + persisted-login probe. Never throws or spends tokens. */
       async checkAuth() {
         try {
@@ -4459,6 +4552,7 @@ ${login.stderr || ""}`.trim();
                 installed: true,
                 authenticated: true,
                 ...versionField,
+                authTier: this.authTier(),
                 message: "codex API key available (no persisted ChatGPT login)"
               };
             }
@@ -4473,6 +4567,7 @@ ${login.stderr || ""}`.trim();
             installed: true,
             authenticated: true,
             ...versionField,
+            authTier: this.authTier(),
             message: output || "codex login status succeeded"
           };
         } catch (err) {
@@ -4539,6 +4634,7 @@ var init_cursor_runner = __esm({
   "../../scripts/virtual-office/code-runner/cursor-runner.mjs"() {
     "use strict";
     init_agent_key_store();
+    init_agent_auth_tier();
     init_flat_token_usage();
     CursorRunner = class {
       get binary() {
@@ -4583,6 +4679,16 @@ var init_cursor_runner = __esm({
       costBasis(env2 = process.env) {
         return env2.CURSOR_API_KEY ? "vendor_billed" : "unknown";
       }
+      /**
+       * Dispatch-time billing tier. Inherits costBasis()'s deliberate refusal to
+       * guess: a prior interactive `cursor-agent login` has undocumented
+       * subscription semantics, so it reports 'unknown' rather than claiming a
+       * flat-cost seat the runner cannot actually prove. Keychain read only — the
+       * heartbeat never pays for a subprocess to answer this.
+       */
+      authTier(env2 = process.env) {
+        return safeAuthTier(() => authTierFromCostBasis(this.costBasis(this.applyAuthEnv(env2))));
+      }
       /** Best-effort: is `cursor-agent` on PATH? Never throws. */
       async checkAuth() {
         try {
@@ -4608,6 +4714,7 @@ var init_cursor_runner = __esm({
           return {
             installed: true,
             authenticated: true,
+            authTier: this.authTier(),
             message: "cursor-agent found (EXPERIMENTAL: headless mode may need a TTY; auth check is best-effort)"
           };
         } catch (err) {
@@ -4704,6 +4811,7 @@ var init_local_model_runner = __esm({
     "use strict";
     init_codex_runner();
     init_agent_key_store();
+    init_agent_auth_tier();
     LOCAL_API_KEY_ENV = "VO_CODE_RUNNER_LOCAL_API_KEY";
     LOCAL_PROVIDERS = ["ollama", "lmstudio"];
     DEFAULT_LOCAL_PROVIDER = "ollama";
@@ -4756,6 +4864,10 @@ var init_local_model_runner = __esm({
       costBasis() {
         return "local_zero";
       }
+      /** Dispatch-time billing tier: local inference is never billed by a vendor. */
+      authTier() {
+        return safeAuthTier(() => authTierFromCostBasis(this.costBasis()));
+      }
       describeAuth(env2 = process.env) {
         const authEnv = this.applyAuthEnv(env2);
         const provider = resolveLocalProvider(this.env);
@@ -4813,6 +4925,7 @@ var init_local_model_runner = __esm({
         return {
           installed: true,
           authenticated: true,
+          authTier: this.authTier(),
           message: `${provider} reachable; model "${model}" configured (local-only, no cloud spend)`
         };
       }
@@ -4901,7 +5014,7 @@ var init_openai_compatible_runner = __esm({
       buildArgs(opts = {}) {
         void opts;
         throw new Error(
-          "OpenAI-compatible full-repository coding is disabled. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
+          "OpenAI-compatible full-repository coding is disabled. The `oai` runner lane is RETIRED (PR #8742) and executes nothing. Set VO_CODE_RUNNER_AGENT to claude, codex, cursor, local, or meta. Use an explicit sanitized task capsule through the AlgoSuite Model Firewall."
         );
       }
       /** Codex JSONL events map identically → reuse the proven parser. */
@@ -4924,14 +5037,14 @@ var init_openai_compatible_runner = __esm({
       describeAuth(env2 = process.env) {
         const hasKey = Boolean(String(env2[OAI_API_KEY_ENV] || "").trim());
         const baseUrl = resolveOaiBaseUrl(env2);
-        return `oai-compat endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
+        return `oai-compat RETIRED endpoint=${baseUrl || "<unset>"} key=${hasKey ? "set" : "MISSING"}`;
       }
-      /** Best-effort: base URL chosen AND the codex transport is installed. */
+      /** Always unavailable: the lane is retired, so nothing can authenticate it. */
       async checkAuth() {
         return {
           installed: false,
           authenticated: false,
-          message: "OpenAI-compatible coding is disabled; sanitized Model Firewall task capsules only"
+          message: "the `oai` lane is RETIRED (PR #8742); OpenAI-compatible coding is disabled \u2014 sanitized Model Firewall task capsules only"
         };
       }
     };
@@ -7080,11 +7193,18 @@ async function collectAgentAvailability({
         new Promise((resolve2) => setTimeout(() => resolve2(null), probeTimeoutMs))
       ]);
       if (!r) return degraded;
+      const installed = Boolean(r?.installed);
+      const authenticated = Boolean(r?.authenticated);
+      const authTier = resolveReportedAuthTier({ authTier: r?.authTier, installed, authenticated });
       return {
         agent,
-        installed: Boolean(r?.installed),
-        authenticated: Boolean(r?.authenticated),
-        ...typeof r?.version === "string" && r.version ? { version: r.version } : {}
+        installed,
+        authenticated,
+        ...typeof r?.version === "string" && r.version ? { version: r.version } : {},
+        // Omitted when unknown, which is what an older daemon's silence already
+        // means — the control-plane schema resolves BOTH to 'unknown'. Never
+        // invent a tier to fill the gap.
+        ...authTier !== AUTH_TIER_UNKNOWN ? { auth_tier: authTier } : {}
       };
     } catch {
       return { agent, installed: false, authenticated: false };
@@ -7147,6 +7267,7 @@ var init_agent_availability = __esm({
     "use strict";
     init_resolve_runner();
     init_agent_auth_probe_process();
+    init_agent_auth_tier();
     DEFAULT_TTL_MS = 5 * 60 * 1e3;
     PROBE_TIMEOUT_MS = 1e4;
   }
@@ -7273,26 +7394,183 @@ var init_local_model_remote_config = __esm({
   }
 });
 
-// ../../scripts/virtual-office/code-runner/account-usage.mjs
-import { spawn as spawn4 } from "node:child_process";
+// ../../scripts/virtual-office/code-runner/account-usage/shared.mjs
+import crypto from "node:crypto";
 import fs6 from "node:fs";
+function accountKey(agent, rawId) {
+  const id = typeof rawId === "string" ? rawId.trim() : "";
+  if (!id) return null;
+  try {
+    return crypto.scryptSync(`${agent}:${id}`, ACCOUNT_KEY_SALT, 8).toString("hex");
+  } catch {
+    return null;
+  }
+}
+function makeUsageRow({
+  agent,
+  sevenDay,
+  fiveHour,
+  monthly,
+  source,
+  capturedAt,
+  accountId,
+  sevenDayResetsAt,
+  fiveHourResetsAt,
+  monthlyResetsAt
+}) {
+  const seven = clampPct(sevenDay);
+  const five = clampPct(fiveHour);
+  const month = clampPct(monthly);
+  if (seven === null && five === null && month === null) return null;
+  const row = {
+    agent,
+    seven_day_used_pct: seven,
+    five_hour_used_pct: five,
+    source
+  };
+  if (month !== null) row.monthly_used_pct = month;
+  if (typeof monthlyResetsAt === "string" && monthlyResetsAt) {
+    row.monthly_resets_at = monthlyResetsAt;
+  }
+  if (typeof capturedAt === "string" && capturedAt) row.captured_at = capturedAt;
+  const key = accountKey(agent, accountId);
+  if (key) row.account_key = key;
+  if (typeof sevenDayResetsAt === "string" && sevenDayResetsAt) {
+    row.seven_day_resets_at = sevenDayResetsAt;
+  }
+  if (typeof fiveHourResetsAt === "string" && fiveHourResetsAt) {
+    row.five_hour_resets_at = fiveHourResetsAt;
+  }
+  return row;
+}
+var clampPct, readJson, ACCOUNT_KEY_SALT;
+var init_shared = __esm({
+  "../../scripts/virtual-office/code-runner/account-usage/shared.mjs"() {
+    "use strict";
+    clampPct = (v) => {
+      const n = typeof v === "number" ? v : typeof v === "string" && v.trim() !== "" ? Number(v) : NaN;
+      return Number.isFinite(n) ? Math.min(100, Math.max(0, Math.round(n))) : null;
+    };
+    readJson = (p) => {
+      try {
+        return JSON.parse(fs6.readFileSync(p, "utf8"));
+      } catch {
+        return null;
+      }
+    };
+    ACCOUNT_KEY_SALT = "algohq/account-usage/v1";
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/account-usage/claude.mjs
 import os3 from "node:os";
 import path14 from "node:path";
-function snapshotAgeMs(payload, filePath, now, mtimeMs) {
-  const iso = typeof payload?.capturedAt === "string" ? payload.capturedAt : null;
-  if (iso) {
-    const capturedMs = new Date(iso).getTime();
-    if (Number.isFinite(capturedMs)) return now - capturedMs;
+function usageBaseUrl(env2 = process.env) {
+  const raw = env2.ANTHROPIC_BASE_URL || "https://api.anthropic.com";
+  return String(raw).replace(/\/+$/, "");
+}
+function readOAuthToken({ homeDir = os3.homedir(), read = readJson, now = Date.now() } = {}) {
+  const creds = read(path14.join(homeDir, ".claude", ".credentials.json"));
+  const oauth = creds && typeof creds === "object" ? creds.claudeAiOauth : null;
+  if (!oauth || typeof oauth !== "object") return null;
+  const token2 = typeof oauth.accessToken === "string" ? oauth.accessToken.trim() : "";
+  if (!token2) return null;
+  const expiresAt = Number(oauth.expiresAt);
+  if (Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= now) return null;
+  return token2;
+}
+function readAccountId({ homeDir = os3.homedir(), read = readJson } = {}) {
+  const cfg = read(path14.join(homeDir, ".claude.json"));
+  const account = cfg && typeof cfg === "object" ? cfg.oauthAccount : null;
+  return account && typeof account.accountUuid === "string" ? account.accountUuid : null;
+}
+function entryPct(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  for (const field of ["used_percentage", "utilization", "percent"]) {
+    const pct = clampPct(entry[field]);
+    if (pct !== null) return pct;
   }
-  const fileMs = mtimeMs(filePath);
-  return Number.isFinite(fileMs) ? now - fileMs : null;
+  return null;
+}
+function entryResetsAt(entry) {
+  if (!entry || typeof entry !== "object") return null;
+  for (const field of ["resets_at", "reset_at", "resetsAt"]) {
+    const value = entry[field];
+    if (typeof value === "string" && value) return value;
+    if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+      return new Date(value * 1e3).toISOString();
+    }
+  }
+  return null;
 }
-function readClaudeUsage({
+function parseOAuthUsage(body) {
+  if (!body || typeof body !== "object") return null;
+  let fiveHour = null;
+  let sevenDay = null;
+  const list = Array.isArray(body) ? body : Array.isArray(body.limits) ? body.limits : null;
+  if (list) {
+    for (const entry of list) {
+      const kind = entry && typeof entry.kind === "string" ? entry.kind : "";
+      if ((kind === "five_hour" || kind === "session") && !fiveHour) fiveHour = entry;
+      else if ((kind === "seven_day" || kind === "weekly_all") && !sevenDay) sevenDay = entry;
+    }
+  }
+  if (!fiveHour && body.five_hour) fiveHour = body.five_hour;
+  if (!sevenDay && body.seven_day) sevenDay = body.seven_day;
+  const five = entryPct(fiveHour);
+  const seven = entryPct(sevenDay);
+  if (five === null && seven === null) return null;
+  return {
+    five_hour_used_pct: five,
+    seven_day_used_pct: seven,
+    five_hour_resets_at: entryResetsAt(fiveHour),
+    seven_day_resets_at: entryResetsAt(sevenDay)
+  };
+}
+async function readClaudeOAuthUsage({
+  fetchImpl = fetch,
+  env: env2 = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
   homeDir = os3.homedir(),
-  read: rawRead = readJson,
-  now = Date.now(),
-  mtimeMs = mtimeMsOf
+  read = readJson,
+  now = () => Date.now()
 } = {}) {
+  const token2 = readOAuthToken({ homeDir, read, now: now() });
+  if (!token2) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetchImpl(`${usageBaseUrl(env2)}${USAGE_PATH}`, {
+      method: "GET",
+      headers: {
+        authorization: `Bearer ${token2}`,
+        "anthropic-beta": OAUTH_BETA,
+        "content-type": "application/json",
+        accept: "application/json"
+      },
+      signal: controller.signal
+    });
+    if (!res || !res.ok) return null;
+    const parsed = parseOAuthUsage(await res.json());
+    if (!parsed) return null;
+    return makeUsageRow({
+      agent: "claude",
+      source: "oauth",
+      // The response describes the account AS OF NOW, so the reading time is now.
+      capturedAt: new Date(now()).toISOString(),
+      accountId: readAccountId({ homeDir, read }),
+      sevenDay: parsed.seven_day_used_pct,
+      fiveHour: parsed.five_hour_used_pct,
+      sevenDayResetsAt: parsed.seven_day_resets_at,
+      fiveHourResetsAt: parsed.five_hour_resets_at
+    });
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function readClaudeFileUsage({ homeDir = os3.homedir(), read: rawRead = readJson } = {}) {
   const read = (p) => {
     try {
       return rawRead(p);
@@ -7300,55 +7578,89 @@ function readClaudeUsage({
       return null;
     }
   };
-  const statusPath = path14.join(homeDir, ".claude", "claude-usage.json");
-  const status = read(statusPath);
-  if (status && (status.seven_day || status.five_hour) && isFresh(snapshotAgeMs(status, statusPath, now, mtimeMs))) {
-    const entry = {
+  const accountId = readAccountId({ homeDir, read });
+  const status = read(path14.join(homeDir, ".claude", "claude-usage.json"));
+  if (status && (status.seven_day || status.five_hour)) {
+    const row = makeUsageRow({
       agent: "claude",
-      seven_day_used_pct: clampPct(status.seven_day?.used_percentage),
-      five_hour_used_pct: clampPct(status.five_hour?.used_percentage)
-    };
-    if (entry.seven_day_used_pct !== null || entry.five_hour_used_pct !== null) return entry;
+      source: "statusline",
+      capturedAt: typeof status.capturedAt === "string" ? status.capturedAt : null,
+      accountId,
+      sevenDay: status.seven_day?.used_percentage,
+      fiveHour: status.five_hour?.used_percentage,
+      sevenDayResetsAt: status.seven_day?.resets_at ?? null,
+      fiveHourResetsAt: status.five_hour?.resets_at ?? null
+    });
+    if (row) return row;
   }
-  const weeklyPath = path14.join(homeDir, ".claude", "claude-weekly-usage.json");
-  const weekly = read(weeklyPath);
-  if (weekly && isFresh(snapshotAgeMs(weekly, weeklyPath, now, mtimeMs))) {
-    const entry = {
+  const weekly = read(path14.join(homeDir, ".claude", "claude-weekly-usage.json"));
+  if (weekly) {
+    const row = makeUsageRow({
       agent: "claude",
-      seven_day_used_pct: clampPct(weekly.sevenDayPct),
-      five_hour_used_pct: clampPct(weekly.fiveHourPct)
-    };
-    if (entry.seven_day_used_pct !== null || entry.five_hour_used_pct !== null) return entry;
+      source: "file",
+      capturedAt: typeof weekly.capturedAt === "string" ? weekly.capturedAt : null,
+      accountId,
+      sevenDay: weekly.sevenDayPct,
+      fiveHour: weekly.fiveHourPct,
+      sevenDayResetsAt: weekly.sevenDayResetsAt ?? null
+    });
+    if (row) return row;
   }
   return null;
 }
-function collectAccountUsage(opts = {}) {
-  const claude = readClaudeUsage(opts);
-  return claude ? [claude] : [];
+async function readClaudeUsage(opts = {}) {
+  try {
+    const live = await readClaudeOAuthUsage(opts);
+    if (live) return live;
+  } catch {
+  }
+  return readClaudeFileUsage(opts);
 }
+var USAGE_PATH, OAUTH_BETA, DEFAULT_TIMEOUT_MS;
+var init_claude = __esm({
+  "../../scripts/virtual-office/code-runner/account-usage/claude.mjs"() {
+    "use strict";
+    init_shared();
+    USAGE_PATH = "/api/oauth/usage";
+    OAUTH_BETA = "oauth-2025-04-20";
+    DEFAULT_TIMEOUT_MS = 5e3;
+  }
+});
+
+// ../../scripts/virtual-office/code-runner/account-usage/codex.mjs
+import { spawn as spawn4 } from "node:child_process";
 function weeklyWindow(snapshot2) {
   if (!snapshot2 || typeof snapshot2 !== "object") return null;
   const windows = [snapshot2.primary, snapshot2.secondary].filter(Boolean);
   return windows.find((window) => Number(window?.windowDurationMins) === 7 * 24 * 60) ?? windows.find((window) => Number(window?.windowDurationMins) >= 6 * 24 * 60) ?? null;
 }
-function parseCodexUsage(response) {
+function resetsAtIso(window) {
+  const raw = Number(window?.resetsAt);
+  if (!Number.isFinite(raw) || raw <= 0) return null;
+  return new Date(raw * 1e3).toISOString();
+}
+function parseCodexUsage(response, { now = () => Date.now() } = {}) {
   const result = response?.result;
   const snapshot2 = result?.rateLimitsByLimitId?.codex ?? result?.rateLimits;
   const weekly = weeklyWindow(snapshot2);
   const used = clampPct(weekly?.usedPercent);
   if (used === null) return null;
-  return {
+  return makeUsageRow({
     agent: "codex",
-    seven_day_used_pct: used,
-    five_hour_used_pct: null
-  };
+    source: "app-server",
+    capturedAt: new Date(now()).toISOString(),
+    sevenDay: used,
+    fiveHour: null,
+    sevenDayResetsAt: resetsAtIso(weekly)
+  });
 }
 function readCodexUsage({
   spawnImpl = spawn4,
   resolveBinary = resolveCodexBinary,
   timeoutMs = 8e3,
   env: env2 = process.env,
-  platform = process.platform
+  platform = process.platform,
+  now = () => Date.now()
 } = {}) {
   return new Promise((resolve2) => {
     let child;
@@ -7370,7 +7682,8 @@ function readCodexUsage({
       child = spawnImpl(binary, ["app-server", "--stdio"], {
         env: env2,
         windowsHide: true,
-        shell: platform === "win32" && !/\.exe$/iu.test(String(binary)),
+        shell: false,
+        windowsVerbatimArguments: false,
         stdio: ["pipe", "pipe", "ignore"]
       });
       child.on("error", () => finish(null));
@@ -7394,7 +7707,7 @@ function readCodexUsage({
             child.stdin?.write(`${JSON.stringify({ method: "account/rateLimits/read", id: 2 })}
 `);
           } else if (message?.id === 2) {
-            finish(parseCodexUsage(message));
+            finish(parseCodexUsage(message, { now }));
           }
         }
       });
@@ -7412,14 +7725,29 @@ function readCodexUsage({
     }
   });
 }
-async function collectConnectedAccountUsage({ readCodex = readCodexUsage, ...claudeOptions } = {}) {
-  const claude = readClaudeUsage(claudeOptions);
-  let codex = null;
-  try {
-    codex = await readCodex();
-  } catch {
+var init_codex = __esm({
+  "../../scripts/virtual-office/code-runner/account-usage/codex.mjs"() {
+    "use strict";
+    init_shared();
+    init_codex_runner();
   }
-  return [claude, codex].filter(Boolean);
+});
+
+// ../../scripts/virtual-office/code-runner/account-usage/index.mjs
+function collectAccountUsage(opts = {}) {
+  const claude = readClaudeFileUsage(opts);
+  return claude ? [claude] : [];
+}
+async function collectConnectedAccountUsage({
+  readClaude = readClaudeUsage,
+  readCodex = readCodexUsage,
+  ...agentOptions
+} = {}) {
+  const settled = await Promise.allSettled([
+    readClaude(agentOptions),
+    readCodex(agentOptions)
+  ]);
+  return settled.map((outcome) => outcome.status === "fulfilled" ? outcome.value : null).filter(Boolean);
 }
 function makeAccountUsageProvider({
   ttlMs = DEFAULT_TTL_MS2,
@@ -7447,35 +7775,31 @@ function makeAccountUsageProvider({
     }
   };
 }
-var clampPct, readJson, STALE_AFTER_MS, mtimeMsOf, isFresh, DEFAULT_TTL_MS2;
+var AGENT_USAGE_CAPABILITY, DEFAULT_TTL_MS2;
 var init_account_usage = __esm({
-  "../../scripts/virtual-office/code-runner/account-usage.mjs"() {
+  "../../scripts/virtual-office/code-runner/account-usage/index.mjs"() {
     "use strict";
-    init_codex_runner();
-    clampPct = (v) => {
-      const n = Number(v);
-      return Number.isFinite(n) ? Math.min(100, Math.max(0, Math.round(n))) : null;
-    };
-    readJson = (p) => {
-      try {
-        return JSON.parse(fs6.readFileSync(p, "utf8"));
-      } catch {
-        return null;
-      }
-    };
-    STALE_AFTER_MS = 2 * 60 * 60 * 1e3;
-    mtimeMsOf = (p) => {
-      try {
-        return fs6.statSync(p).mtimeMs;
-      } catch {
-        return null;
-      }
-    };
-    isFresh = (ageMs) => ageMs !== null && ageMs <= STALE_AFTER_MS;
+    init_claude();
+    init_codex();
+    init_shared();
+    AGENT_USAGE_CAPABILITY = Object.freeze({
+      claude: Object.freeze({ five_hour: true, seven_day: true, monthly: false }),
+      codex: Object.freeze({ five_hour: false, seven_day: true, monthly: false }),
+      cursor: Object.freeze({ five_hour: false, seven_day: false, monthly: false }),
+      gemini: Object.freeze({ five_hour: false, seven_day: false, monthly: false })
+    });
     DEFAULT_TTL_MS2 = 5 * 60 * 1e3;
   }
 });
 
+// ../../scripts/virtual-office/code-runner/account-usage.mjs
+var init_account_usage2 = __esm({
+  "../../scripts/virtual-office/code-runner/account-usage.mjs"() {
+    "use strict";
+    init_account_usage();
+  }
+});
+
 // ../../scripts/virtual-office/code-runner/ci-repair-evidence.mjs
 function extractWorkflowRunIds(links = []) {
   const ids = [];
@@ -8268,7 +8592,6 @@ function makeWatchRunner({
             repairAttempt: chain.attempt + 1
           }),
           ...operatorId && operatorId !== "admin" ? { on_behalf_of_operator_id: operatorId } : {},
-          agent: "claude",
           dispatch_mode: "fast",
           max_turns: 80,
           max_budget_usd: chain.per_attempt_budget_usd,
@@ -10180,7 +10503,15 @@ var init_agent_process_env = __esm({
       "WINDIR",
       "VO_RUNNER_PREFER_LOGIN",
       "VO_RUNNER_CLAUDE_PREFER_LOGIN",
-      "VO_RUNNER_CODEX_PREFER_LOGIN"
+      "VO_RUNNER_CODEX_PREFER_LOGIN",
+      // The tier-1 opt-out (PR #9242). Auth-preference flags are only visible to a
+      // runner's applyAuthEnv() if they are listed HERE: the daemon builds the child
+      // env with buildAgentProcessEnv(process.env) (code-runner-daemon.mjs:117), so
+      // anything absent from this set is stripped before withAnthropicKey ever sees
+      // it. #9242 added VO_RUNNER_PREFER_KEY without this line, which left the
+      // escape hatch inert — an operator who set it still got the subscription.
+      "VO_RUNNER_PREFER_KEY",
+      "VO_RUNNER_CLAUDE_PREFER_KEY"
     ]);
   }
 });
@@ -12444,7 +12775,7 @@ var init_code_runner_daemon = __esm({
     init_runner_capacity();
     init_agent_availability();
     init_local_model_remote_config();
-    init_account_usage();
+    init_account_usage2();
     init_pr_watcher();
     init_existing_pr_target();
     init_watch_cycle_coordinator();