@cad0p/pi-usage 0.0.0-stage → 0.11.2

package/src/cli/commands/auth.js

@@ -0,0 +1,216 @@
+/**
+ * Auth subcommands: OpenCode session capture and credential status inspection.
+ */
+
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+import { describeStore, resolveAuthPaths } from "../../auth/pi-auth.js";
+import { discoverCookieStores, findCookie } from "../../browser/cookies.js";
+import { humanReset } from "../../model.js";
+import {
+  OPENCODE_COOKIE_NAME,
+  OPENCODE_COOKIE_NAMES,
+  configPaths,
+  discoverWorkspaceId,
+  readGoPlan,
+  resolveCookie,
+  writeSecretFile,
+} from "../../opencode/session.js";
+import { err, out, sleep } from "../output.js";
+
+const OPENCODE_LOGIN_URL = "https://opencode.ai/auth";
+const WINDOWS_FIREFOX = [
+  "/mnt/c/Program Files/Mozilla Firefox/firefox.exe",
+  "/mnt/c/Program Files (x86)/Mozilla Firefox/firefox.exe",
+];
+
+/**
+ * Launch Firefox at the login URL. Returns how it was launched.
+ *
+ * @param {string} url
+ * @returns {{ launched: boolean, via: string, error?: string }}
+ */
+export function openLogin(url) {
+  for (const candidate of WINDOWS_FIREFOX) {
+    if (!existsSync(candidate)) continue;
+    const result = spawnSync(candidate, [url], { stdio: "ignore", detached: true });
+    if (!result.error) return { launched: true, via: `Windows Firefox (${candidate})` };
+  }
+  if (process.platform === "darwin" || existsSync("/Applications/Firefox.app")) {
+    const launched = spawnSync("open", ["-a", "Firefox", url], { stdio: "ignore", detached: true });
+    if (!launched.error && launched.status === 0) return { launched: true, via: "macOS Firefox (open -a Firefox)" };
+  }
+  for (const command of ["firefox", "firefox-esr", "firefox-bin"]) {
+    const result = spawnSync("which", [command], { encoding: "utf-8" });
+    if (result.status !== 0) continue;
+    const launched = spawnSync(command, [url], { stdio: "ignore", detached: true });
+    if (!launched.error) return { launched: true, via: `Firefox (${command})` };
+  }
+  return { launched: false, via: "none", error: "no Firefox binary found" };
+}
+
+/**
+ * @param {{ stores?: import("../../browser/cookies.js").CookieStore[] }} [options]
+ * @returns {Promise<number>}
+ */
+export async function verifyGoPlan(options = {}) {
+  const cookie = resolveCookie({ stores: options.stores, allowBrowser: true });
+  if (!cookie.found) {
+    err(`no opencode.ai session found (${cookie.detail})`);
+    return 1;
+  }
+
+  const workspace = await discoverWorkspaceId({ cookie: cookie.value, stores: options.stores });
+  if (!workspace.workspaceId) {
+    err(`session found but no workspace id (${workspace.error})`);
+    return 1;
+  }
+  out(`  workspace: ${workspace.workspaceId}${workspace.origin ? ` (from ${workspace.origin})` : ""}`);
+
+  const plan = await readGoPlan({ cookie: cookie.value, workspaceId: workspace.workspaceId });
+  if (!plan.ok) {
+    err(`  dashboard read failed: ${plan.error}`);
+    return 1;
+  }
+  out("  Go plan windows:");
+  for (const window of plan.windows) {
+    const remaining = window.remainingPercent === null ? "n/a" : `${Math.round(window.remainingPercent)}% left`;
+    const reset = window.resetsInSec === null ? "" : ` · ${humanReset(window.resetsInSec)}`;
+    out(`    ${window.label.padEnd(16)} ${remaining}${reset}`);
+  }
+  return 0;
+}
+
+/**
+ * @param {string[]} argv
+ * @returns {Promise<number>}
+ */
+export async function authOpenCode(argv) {
+  const paste = argv.includes("--paste");
+  const noBrowser = argv.includes("--no-browser");
+  const waitIndex = argv.indexOf("--wait");
+  const waitSeconds = waitIndex >= 0 ? Number(argv[waitIndex + 1]) || 180 : 180;
+
+  const paths = configPaths({});
+  out("OpenCode Go session");
+  out(`  config file: ${paths.path}`);
+
+  if (paste) {
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const value = Buffer.concat(chunks).toString("utf-8").trim();
+    if (value === "") {
+      err("no cookie received on stdin");
+      return 2;
+    }
+    const written = writeSecretFile(paths.path, value);
+    if (!written.ok) {
+      err(`could not write ${paths.path}: ${written.error}`);
+      return 2;
+    }
+    out(`  stored (0600): ${paths.path}`);
+    return verifyGoPlan({});
+  }
+
+  const stores = discoverCookieStores({});
+  out("  browser stores found:");
+  if (stores.length === 0) {
+    out("    (none)");
+  }
+  for (const store of stores) {
+    const readable = store.readability === "plaintext";
+    out(`    ${readable ? "readable " : "ENCRYPTED"} ${store.browser} ${store.profile}`);
+    if (!readable && store.note) out(`              ${store.note}`);
+  }
+
+  const before = resolveCookie({ allowBrowser: false });
+  if (before.found) {
+    out(`  a session is already available via ${before.origin} (${before.detail})`);
+  }
+
+  const readableFirefox = stores.filter((store) => store.browser === "firefox" && store.readability === "plaintext");
+  if (readableFirefox.length === 0) {
+    err("");
+    err("No readable Firefox cookie store found. Log in with Firefox, or paste the cookie:");
+    err("  piquota auth opencode --paste   (get `auth` for opencode.ai from your browser devtools)");
+    return 2;
+  }
+
+  out("");
+  if (!noBrowser) {
+    const opened = openLogin(OPENCODE_LOGIN_URL);
+    out(opened.launched ? `  opened ${OPENCODE_LOGIN_URL} in ${opened.via}` : `  could not launch a browser (${opened.error})`);
+    if (!opened.launched) out(`  open manually: ${OPENCODE_LOGIN_URL}`);
+  } else {
+    out(`  open this URL in Firefox: ${OPENCODE_LOGIN_URL}`);
+  }
+  out("  log in with GitHub, Google or Apple, then click Authorize on the consent screen.");
+  out(`  Waiting up to ${waitSeconds}s for the session...`);
+
+  const deadline = Date.now() + waitSeconds * 1000;
+  let found = null;
+  while (Date.now() < deadline) {
+    await sleep(3);
+    for (const name of OPENCODE_COOKIE_NAMES) {
+      const hit = findCookie({ host: "opencode.ai", name, stores: readableFirefox });
+      if (hit.found && hit.value) {
+        found = hit;
+        break;
+      }
+    }
+    if (found) break;
+  }
+
+  if (!found) {
+    err("");
+    err(`No "${OPENCODE_COOKIE_NAME}" cookie for opencode.ai appeared within ${waitSeconds}s.`);
+    err("Check that you completed the login in Firefox, then re-run this command.");
+    return 1;
+  }
+
+  out(`  session captured from ${found.store?.browser} ${found.store?.profile}`);
+  out("  the cookie is read live from the browser store; it is not copied anywhere");
+  const code = await verifyGoPlan({ stores: readableFirefox });
+  if (code !== 0) {
+    out("");
+    out("If the workspace id could not be found, open https://opencode.ai/ once in Firefox");
+    out("(the app lands on /workspace/<id>), then run: piquota auth opencode");
+  }
+  return code;
+}
+
+/**
+ * @returns {Promise<number>}
+ */
+export async function authStatus() {
+  out("Credential sources");
+  const paths = resolveAuthPaths({});
+  for (const path of paths) {
+    const store = describeStore(path);
+    out(`  pi store   ${path} (${store.sizeBytes ?? "?"} bytes)`);
+  }
+  const cookie = resolveCookie({});
+  out(`  opencode   ${cookie.found ? `session via ${cookie.origin} — ${cookie.detail}` : `no session — ${cookie.detail}`}`);
+  const workspace = configPaths({}).workspacePath;
+  out(`  workspace  ${existsSync(workspace) ? "cached" : "not cached"}`);
+
+  const stores = discoverCookieStores({});
+  out("  browser stores:");
+  for (const store of stores) {
+    out(`    ${store.readability === "plaintext" ? "readable " : "ENCRYPTED"} ${store.browser} ${store.profile}`);
+  }
+  return 0;
+}
+
+/**
+ * @param {string} sub
+ * @param {string[]} argv
+ * @returns {Promise<number>}
+ */
+export async function runAuthCommand(sub, argv) {
+  if (sub === "opencode") return authOpenCode(argv);
+  if (sub === "status") return authStatus();
+  err(`unknown auth action: ${sub}`);
+  return 2;
+}

package/src/cli/commands/gentle-pi.js

@@ -0,0 +1,44 @@
+/**
+ * Gentle-pi subcommands: inspect, apply, or revert rail patch.
+ */
+
+import {
+  applyRailPatch,
+  inspectRailPatch,
+  resolveGentlePiLayout,
+  revertRailPatch,
+} from "../../gentle-pi/rail-patch.js";
+import { err, out } from "../output.js";
+
+/**
+ * @param {string} sub
+ * @returns {number}
+ */
+export function runGentlePiCommand(sub) {
+  if (sub !== "status" && sub !== "apply" && sub !== "revert") {
+    err(`unknown gentle-pi action: ${sub}`);
+    err("expected one of: status, apply, revert");
+    return 2;
+  }
+  const layout = resolveGentlePiLayout();
+  if (!layout.present) {
+    out("gentle-pi: not installed");
+    out("nothing to do: piQuota renders its own widget without the rail");
+    return 0;
+  }
+  out(`gentle-pi: ${layout.layoutPath}`);
+  if (sub === "status") {
+    const inspected = inspectRailPatch({ layoutPath: layout.layoutPath });
+    out(`rail patch: ${inspected.state} (${inspected.detail})`);
+    if (inspected.state !== "patched") {
+      out("run `piquota gentle-pi apply`, or let the extension repair it at session start");
+    }
+    return inspected.state === "unknown" ? 1 : 0;
+  }
+  const result = sub === "revert"
+    ? revertRailPatch({ layoutPath: layout.layoutPath })
+    : applyRailPatch({ layoutPath: layout.layoutPath });
+  out(`rail patch: ${result.state} — ${result.detail}`);
+  if (result.backupPath) out(`backup: ${result.backupPath}`);
+  return result.ok ? 0 : 1;
+}

package/src/cli/commands/omarchy.js

@@ -0,0 +1,75 @@
+/**
+ * `piquota omarchy`: publish the quota as Omarchy agent usage records.
+ *
+ * One shot, opt-in, never throws: a provider that fails becomes a record that
+ * says so, and a write failure is reported with a non-zero exit code.
+ */
+
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+import { redact } from "../../http.js";
+import { publishRecords, resolveOmarchyDir } from "../../omarchy/publish.js";
+import { buildRecords } from "../../omarchy/record.js";
+import { err, out } from "../output.js";
+
+/**
+ * Families to leave out, e.g. PI_QUOTA_OMARCHY_SKIP=claude when Omarchy's own
+ * collector already covers that provider. Their stale pi-*.json is removed.
+ *
+ * Defaults to skipping `claude` when Omarchy's native `claude.json` exists in
+ * the destination directory, avoiding duplicate Claude cards in the bar panel.
+ *
+ * @param {Record<string, string | undefined>} env
+ * @param {string} [dir]
+ * @returns {Set<string>}
+ */
+export function skippedFamilies(env, dir) {
+  if (env.PI_QUOTA_OMARCHY_SKIP !== undefined) {
+    return new Set(
+      String(env.PI_QUOTA_OMARCHY_SKIP)
+        .split(",")
+        .map((value) => value.trim().toLowerCase())
+        .filter(Boolean),
+    );
+  }
+  const skip = new Set();
+  const targetDir = dir ?? resolveOmarchyDir({ env });
+  try {
+    if (existsSync(join(targetDir, "claude.json"))) {
+      skip.add("claude");
+    }
+  } catch {}
+  return skip;
+}
+
+/**
+ * @param {{ load: () => Promise<import("../../engine.js").PiQuotaReport>, dir?: string, env?: Record<string, string | undefined>, quiet?: boolean }} options
+ * @returns {Promise<number>}
+ */
+export async function runOmarchyCommand(options) {
+  let report;
+  try {
+    report = await options.load();
+  } catch (error) {
+    err(`omarchy: could not collect quota: ${redact(/** @type {{ message?: string }} */ (error)?.message ?? error)}`);
+    return 1;
+  }
+
+  const skip = skippedFamilies(options.env ?? process.env, options.dir);
+  const records = buildRecords(skip.size > 0 ? { ...report, providers: (report.providers ?? []).filter((p) => !skip.has(p?.family)) } : report);
+  let result;
+  try {
+    result = publishRecords(records, { dir: options.dir, env: options.env });
+  } catch (error) {
+    err(`omarchy: could not write records: ${redact(/** @type {{ message?: string }} */ (error)?.message ?? error)}`);
+    return 1;
+  }
+
+  if (!options.quiet) {
+    out(`omarchy: wrote ${result.written.length} record(s) to ${result.dir}`);
+    for (const path of result.written) out(`  ${path}`);
+    for (const path of result.removed) out(`  removed stale ${path}`);
+  }
+  return 0;
+}

package/src/cli/explain.js

@@ -0,0 +1,99 @@
+/**
+ * Family aliases, family resolution and diagnostic explain formatting.
+ */
+
+import { describeClaudeCodeSource } from "../auth/claude-code-auth.js";
+import { describeStore, loadPiCredentials, resolveAuthPaths } from "../auth/pi-auth.js";
+import { describeCache, resolveCachePath } from "../cache.js";
+import { FAMILIES } from "../engine.js";
+import { redact } from "../http.js";
+import { resolveCookie } from "../opencode/session.js";
+
+export const FAMILY_ALIASES = {
+  claude: "claude",
+  anthropic: "claude",
+  codex: "codex",
+  "openai-codex": "codex",
+  chatgpt: "codex",
+  antigravity: "antigravity",
+  google: "antigravity",
+  agy: "antigravity",
+  "opencode-go": "opencode-go",
+  opencode: "opencode-go",
+  go: "opencode-go",
+  zen: "opencode-go",
+  "github-actions": "github-actions",
+  gh: "github-actions",
+  actions: "github-actions",
+};
+
+/**
+ * @param {string[]} positionals
+ * @returns {{ families: string[], unknown: string[], explicit: boolean }}
+ */
+export function resolveFamilies(positionals) {
+  /** @type {string[]} */
+  const families = [];
+  /** @type {string[]} */
+  const unknown = [];
+  for (const positional of positionals) {
+    if (positional === "all") continue;
+    const family = FAMILY_ALIASES[positional.toLowerCase()];
+    if (!family) {
+      unknown.push(positional);
+      continue;
+    }
+    if (!families.includes(family)) families.push(family);
+  }
+  return { families, unknown, explicit: families.length > 0 };
+}
+
+/**
+ * @param {string[]} families
+ * @returns {string[]}
+ */
+export function explainLines(families) {
+  const paths = resolveAuthPaths({});
+  const lines = ["", "Credential resolution:"];
+  if (paths.length === 0) {
+    lines.push("  no Pi auth store found (looked for $PI_AUTH_PATH, ~/.pi/agent/auth.json, /mnt/c/Users/*/.pi/agent/auth.json)");
+  }
+  for (const path of paths) {
+    const store = describeStore(path);
+    lines.push(`  store  ${path}  exists=${store.exists} file=${store.isFile} bytes=${store.sizeBytes ?? "?"}`);
+  }
+
+  const loaded = loadPiCredentials({});
+  const counts = new Map();
+  for (const credential of loaded.credentials) counts.set(credential.family, (counts.get(credential.family) ?? 0) + 1);
+  lines.push("  credentials: " + FAMILIES.map((family) => `${family}=${counts.get(family) ?? 0}`).join(" "));
+  lines.push("  fields read from auth.json: type, access, refresh, expires, accountId, projectId, email, key");
+  lines.push("  derived from the Codex JWT (payload only): chatgpt_account_id, chatgpt_plan_type, email");
+
+  const cookie = resolveCookie({});
+  lines.push(`  opencode.ai cookie: ${cookie.found ? `found via ${cookie.origin} (${cookie.detail})` : `not found (${cookie.detail})`}`);
+  // Claude has two sources, and which one is in use is the single most useful
+  // diagnostic for a provider that answers 400 or "not configured".
+  const claudeCode = describeClaudeCodeSource({});
+  lines.push("");
+  lines.push("Claude source resolution:");
+  lines.push(`  preference: ${process.env.PI_QUOTA_CLAUDE_SOURCE ?? "auto"} (auto prefers the Claude Code CLI)`);
+  lines.push(`  Claude Code store: ${claudeCode.path ?? "none found"}`);
+  if (claudeCode.path) {
+    lines.push(
+      `    access token: ${claudeCode.hasAccessToken ? "yes" : "no"}` +
+        ` · refresh token present: ${claudeCode.hasRefreshToken ? "yes (never read, never used)" : "no"}` +
+        ` · expires in: ${claudeCode.expiresInMin === null ? "unknown" : `${claudeCode.expiresInMin}m`}` +
+        ` · plan: ${claudeCode.plan ?? "unknown"}`,
+    );
+  } else if (claudeCode.error) {
+    lines.push(`    ${redact(claudeCode.error)}`);
+  }
+  lines.push("  fields read from that store: claudeAiOauth.accessToken, expiresAt, subscriptionType, rateLimitTier");
+  lines.push("  never read from that store: the refresh token value, and nothing is ever written back");
+  lines.push(`  cache: ${resolveCachePath({})} (${describeCache({}).exists ? "present" : "absent"})`);
+  lines.push(`  families requested: ${families.join(", ")}`);
+  for (const warning of loaded.warnings) lines.push(`  warn: ${redact(warning)}`);
+  lines.push("");
+  return lines;
+}

package/src/cli/output.js

@@ -0,0 +1,34 @@
+/**
+ * CLI output and timing helpers.
+ */
+
+/**
+ * @param {string} text
+ */
+export function out(text) {
+  process.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+}
+
+/**
+ * @param {string} text
+ */
+export function err(text) {
+  process.stderr.write(text.endsWith("\n") ? text : `${text}\n`);
+}
+
+/**
+ * A non-fatal problem worth showing without hiding the rest of the output.
+ *
+ * @param {string} text
+ */
+export function warn(text) {
+  process.stderr.write(`warning: ${text.endsWith("\n") ? text : `${text}\n`}`);
+}
+
+/**
+ * @param {number} seconds
+ * @returns {Promise<void>}
+ */
+export function sleep(seconds) {
+  return new Promise((resolve) => setTimeout(resolve, seconds * 1000));
+}