@efoo/ccprofile 0.2.0 → 0.4.0

package/dist/commands/completion.js

@@ -7,6 +7,7 @@ export const SUBCOMMANDS = [
     { name: "token", description: "Print the stored token" },
     { name: "remove", description: "Delete a profile and its Keychain entry" },
     { name: "doctor", description: "Diagnose configuration problems" },
+    { name: "usage", description: "Show claude.ai usage per account" },
     { name: "completion", description: "Print a shell completion script" },
     { name: "help", description: "Show help" },
 ];
@@ -41,7 +42,7 @@ complete -c ccprofile -n "__fish_seen_subcommand_from add" -l expires-at -r -d "
 complete -c ccprofile -n "__fish_seen_subcommand_from add" -l token -r -d "Provide the token directly"
 complete -c ccprofile -n "__fish_seen_subcommand_from add" -l force -d "Overwrite an existing profile"
 complete -c ccprofile -n "__fish_seen_subcommand_from add" -l no-setup -d "Skip launching claude setup-token"
-complete -c ccprofile -n "__fish_seen_subcommand_from list" -l json -d "JSON output"
+complete -c ccprofile -n "__fish_seen_subcommand_from list usage" -l json -d "JSON output"
 complete -c ccprofile -n "__fish_seen_subcommand_from remove" -l force -d "Skip confirmation"
 complete -c ccprofile -n __fish_use_subcommand -l help -d "Show help"
 complete -c ccprofile -n __fish_use_subcommand -l version -d "Show version"
@@ -82,7 +83,7 @@ ${describeLines}
     add)
       compadd -- --email --expires-at --token --force --no-setup
       ;;
-    list)
+    list|usage)
       compadd -- --json
       ;;
   esac
@@ -119,7 +120,7 @@ _ccprofile() {
       COMPREPLY=( \$(compgen -W "fish zsh bash" -- "\$cur") ) ;;
     add)
       COMPREPLY=( \$(compgen -W "--email --expires-at --token --force --no-setup" -- "\$cur") ) ;;
-    list)
+    list|usage)
       COMPREPLY=( \$(compgen -W "--json" -- "\$cur") ) ;;
   esac
 }

package/dist/commands/usage.js

@@ -0,0 +1,198 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+import { assertDarwin } from "../lib/keychain.js";
+import { chromeUserAgent, chromeUserDataDir, parseProfiles, readSessionCookies, safeStorageKey, } from "../lib/chrome.js";
+import { fetchAccountUsage, NOT_SIGNED_IN, } from "../lib/claudeai.js";
+import { loadConfig } from "../lib/config.js";
+import { bold, cyan, dim, fail, red, table, warn, yellow } from "../lib/format.js";
+/**
+ * Maps a claude.ai account email to the ccprofile name registered for it, so a
+ * signed-in Chrome account that matches a stored profile is labelled with that
+ * profile's name. Matching is case-insensitive.
+ */
+function profileNamesByEmail() {
+    const byEmail = new Map();
+    try {
+        for (const [name, entry] of Object.entries(loadConfig().profiles)) {
+            if (entry.email)
+                byEmail.set(entry.email.toLowerCase(), name);
+        }
+    }
+    catch {
+        // A malformed/unsupported config.json shouldn't sink the usage table;
+        // profile labelling is auxiliary, so degrade to unlabelled accounts.
+    }
+    return byEmail;
+}
+function matchedProfileName(email, byEmail) {
+    if (email === null)
+        return null;
+    return byEmail.get(email.toLowerCase()) ?? null;
+}
+export async function usageCommand(argv) {
+    const { values } = parseArgs({
+        args: argv,
+        options: { json: { type: "boolean", default: false } },
+    });
+    assertDarwin();
+    const userDataDir = chromeUserDataDir();
+    const localStatePath = join(userDataDir, "Local State");
+    if (!existsSync(localStatePath)) {
+        console.error(fail("Google Chrome data not found. `ccprofile usage` reads claude.ai session cookies from Chrome."));
+        return 1;
+    }
+    let key;
+    try {
+        key = await safeStorageKey();
+    }
+    catch (error) {
+        console.error(fail(error instanceof Error ? error.message : String(error)));
+        return 1;
+    }
+    const userAgent = chromeUserAgent(userDataDir);
+    const profiles = parseProfiles(readFileSync(localStatePath, "utf8")).filter((p) => existsSync(join(userDataDir, p.dir, "Cookies")));
+    const spinner = values.json
+        ? { stop: () => { } }
+        : startSpinner(`querying claude.ai for ${profiles.length} Chrome profile(s)…`);
+    const results = await Promise.all(profiles.map((profile) => loadUsage(profile, userDataDir, key, userAgent)));
+    spinner.stop();
+    const byEmail = profileNamesByEmail();
+    if (values.json) {
+        console.log(JSON.stringify(results.map((r) => toJson(r, byEmail)), null, 2));
+        return hasRealFailure(results) ? 1 : 0;
+    }
+    return render(results, byEmail);
+}
+/**
+ * A profile that was never signed in is expected and not a failure; anything
+ * else (expired session, Cloudflare block, decrypt/read error) is, so the
+ * command exits non-zero for scripts even though the table still prints.
+ */
+function hasRealFailure(results) {
+    return results.some((r) => !r.usage.ok && r.usage.detail !== NOT_SIGNED_IN);
+}
+/** Decrypts one profile's cookies and fetches its usage; never throws. */
+async function loadUsage(profile, userDataDir, key, userAgent) {
+    try {
+        const cookies = await readSessionCookies(join(userDataDir, profile.dir, "Cookies"), key);
+        return { profile, usage: await fetchAccountUsage(cookies, userAgent) };
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return { profile, usage: { ok: false, status: 0, detail } };
+    }
+}
+function render(results, byEmail) {
+    const signedIn = [];
+    const problems = [];
+    for (const { profile, usage } of results) {
+        if (usage.ok) {
+            signedIn.push({ profile, usage });
+        }
+        else if (usage.detail !== NOT_SIGNED_IN) {
+            // A missing session is expected for stray Chrome profiles; only real
+            // failures (expired session, Cloudflare block) are worth surfacing.
+            problems.push(warn(`${profile.name}: ${usage.detail}`));
+        }
+    }
+    const header = ["PROFILE", "ACCOUNT", "CHROME", "5-HOUR", "WEEK · ALL", "FABLE · WEEK"].map(bold);
+    const rows = [header];
+    for (const { profile, usage } of sortByWeeklyReset(signedIn)) {
+        const name = matchedProfileName(usage.email, byEmail);
+        rows.push([
+            name === null ? dim("-") : cyan(name),
+            usage.email ?? dim("(unknown)"),
+            dim(profile.name),
+            windowCell(usage.report.session),
+            windowCell(usage.report.weeklyAll),
+            windowCell(usage.report.fable),
+        ]);
+    }
+    if (rows.length === 1 && problems.length === 0) {
+        console.log(dim("No claude.ai sessions found in Chrome. Sign in at https://claude.ai and retry."));
+        return 0;
+    }
+    if (rows.length > 1)
+        console.log(table(rows));
+    for (const problem of problems)
+        console.log(problem);
+    return problems.length > 0 ? 1 : 0;
+}
+/**
+ * Orders accounts by how soon their weekly (all-models) limit resets — the
+ * nearest reset first, the furthest last. Accounts with no weekly window sort
+ * to the end so a resolved figure never sits below a blank one.
+ */
+function sortByWeeklyReset(results) {
+    const resetKey = (r) => r.usage.report.weeklyAll?.resetsAt?.getTime() ?? Number.MAX_SAFE_INTEGER;
+    return [...results].sort((a, b) => resetKey(a) - resetKey(b));
+}
+function windowCell(window) {
+    if (window === null)
+        return dim("-");
+    const reset = window.resetsAt === null ? "" : `  ${dim(formatReset(window.resetsAt))}`;
+    return `${percent(window)}${reset}`;
+}
+function percent(window) {
+    // Right-align to 3 digits so the reset time lines up down the column.
+    const text = `${String(window.percent).padStart(3, " ")}%`;
+    if (window.severity === "critical" || window.percent >= 90)
+        return red(text);
+    if (window.severity === "warning" || window.percent >= 80)
+        return yellow(text);
+    return text;
+}
+/**
+ * Local-time reset as `M/D HH:mm` (respects the machine's timezone). The date
+ * is right-padded to a fixed width so the clock times align down the column.
+ */
+function formatReset(date) {
+    const pad = (n) => String(n).padStart(2, "0");
+    const md = `${date.getMonth() + 1}/${date.getDate()}`.padStart(5, " ");
+    return `${md} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
+}
+function toJson(result, byEmail) {
+    const { profile, usage } = result;
+    const email = usage.ok ? usage.email : null;
+    return {
+        profile: matchedProfileName(email, byEmail),
+        chromeProfile: profile.name,
+        chromeDir: profile.dir,
+        email,
+        error: usage.ok ? null : usage.detail,
+        usage: usage.ok ? serializeReport(usage.report) : null,
+    };
+}
+function serializeReport(report) {
+    const win = (w) => w === null
+        ? null
+        : { percent: w.percent, resetsAt: w.resetsAt?.toISOString() ?? null, severity: w.severity };
+    return {
+        session: win(report.session),
+        weeklyAll: win(report.weeklyAll),
+        fable: win(report.fable),
+    };
+}
+/**
+ * Minimal TTY-only spinner for the network wait; stays silent when output is
+ * piped so scripted/`--json` runs keep clean output.
+ */
+function startSpinner(text) {
+    if (!process.stdout.isTTY)
+        return { stop: () => { } };
+    const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+    let i = 0;
+    const paint = () => {
+        process.stdout.write(`\r\u001B[2K${dim(`${frames[i % frames.length] ?? ""} ${text}`)}`);
+        i += 1;
+    };
+    paint();
+    const timer = setInterval(paint, 100);
+    return {
+        stop: () => {
+            clearInterval(timer);
+            process.stdout.write("\r\u001B[2K");
+        },
+    };
+}

package/dist/index.js

@@ -26,6 +26,9 @@ ${bold("Commands")}
       --offline           usage limits (real inference probe), and broken links
       --model <alias>     --offline skips probes; --model pins the probe model
                           (default: fable, then haiku to isolate fable limits)
+  usage [--json]          Show claude.ai usage per account: 5-hour, weekly, and
+                          Fable-weekly percent + reset. Reads Chrome session
+                          cookies — no browser open or switch required
   completion <shell>      Print a completion script (fish, zsh, bash)
 
 ${bold("Typical flow")}
@@ -52,6 +55,8 @@ async function main() {
             return (await import("./commands/token.js")).tokenCommand(rest);
         case "doctor":
             return (await import("./commands/doctor.js")).doctorCommand(rest);
+        case "usage":
+            return (await import("./commands/usage.js")).usageCommand(rest);
         case "completion":
             return (await import("./commands/completion.js")).completionCommand(rest);
         // Hidden helper for shell completions: prints profile names, one per line.

package/dist/lib/chrome.js

@@ -0,0 +1,162 @@
+import { createDecipheriv, pbkdf2Sync } from "node:crypto";
+import { copyFileSync, existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import { defaultRunner } from "./keychain.js";
+/** claude.ai cookies needed to authenticate and clear the Cloudflare bot check. */
+export const SESSION_COOKIE_NAMES = [
+    "sessionKey",
+    "lastActiveOrg",
+    "cf_clearance",
+    "__cf_bm",
+];
+const SAFE_STORAGE_SERVICE = "Chrome Safe Storage";
+// Chrome's fixed KDF parameters for the "v10" Keychain-wrapped cookie scheme.
+const KDF_SALT = "saltysalt";
+const KDF_ITERATIONS = 1003;
+const KEY_LENGTH = 16;
+// AES-128-CBC with an all-spaces IV; the encrypted blob is prefixed with "v10".
+const COOKIE_IV = Buffer.alloc(16, 0x20);
+const COOKIE_PREFIX = "v10";
+// Chrome 130+ prepends a 32-byte SHA-256 of the cookie's host to the plaintext.
+const DOMAIN_HASH_LENGTH = 32;
+export function chromeUserDataDir() {
+    return join(homedir(), "Library", "Application Support", "Google", "Chrome");
+}
+export function parseProfiles(localStateJson) {
+    const data = JSON.parse(localStateJson);
+    const cache = data.profile?.info_cache ?? {};
+    return Object.entries(cache)
+        .map(([dir, info]) => ({ dir, name: info.name?.trim() || dir }))
+        .sort((a, b) => a.dir.localeCompare(b.dir, undefined, { numeric: true }));
+}
+/**
+ * Builds a Chrome-matching User-Agent from the installed version. Cloudflare
+ * ties cf_clearance to the exact UA, so the string must track the same Chrome
+ * that solved the challenge — hence reading the local "Last Version" file
+ * rather than hard-coding a version.
+ */
+export function buildUserAgent(version) {
+    const major = version?.split(".")[0]?.trim();
+    const m = major !== undefined && /^\d+$/.test(major) ? major : "140";
+    return `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${m}.0.0.0 Safari/537.36`;
+}
+export function chromeUserAgent(userDataDir) {
+    let version = null;
+    try {
+        version = readFileSync(join(userDataDir, "Last Version"), "utf8");
+    }
+    catch {
+        version = null;
+    }
+    return buildUserAgent(version);
+}
+export function deriveKey(password) {
+    return pbkdf2Sync(password, KDF_SALT, KDF_ITERATIONS, KEY_LENGTH, "sha1");
+}
+/**
+ * Fetches the Chrome cookie-encryption key from the login Keychain. The
+ * service name contains a space, so this cannot reuse the Keychain class
+ * (its assertSafe rejects spaces); a direct spawn with an argv array is safe.
+ */
+export async function safeStorageKey(run = defaultRunner) {
+    const result = await run("security", [
+        "find-generic-password",
+        "-w",
+        "-s",
+        SAFE_STORAGE_SERVICE,
+    ]);
+    if (result.code !== 0) {
+        throw new Error('Could not read the "Chrome Safe Storage" key from the Keychain. Is Google Chrome installed and set up?');
+    }
+    return deriveKey(result.stdout.trim());
+}
+export function decryptCookieValue(encHex, key) {
+    if (encHex.length === 0)
+        return null;
+    const buf = Buffer.from(encHex, "hex");
+    if (buf.subarray(0, 3).toString("latin1") !== COOKIE_PREFIX) {
+        // v20 (app-bound) cookies use a different key path we do not support.
+        return null;
+    }
+    try {
+        const decipher = createDecipheriv("aes-128-cbc", key, COOKIE_IV);
+        const plain = Buffer.concat([decipher.update(buf.subarray(3)), decipher.final()]);
+        return decodePlaintext(plain);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Newer Chrome builds prefix the value with a 32-byte host hash; older ones
+ * store the bare value. The hash is binary, so a plaintext that is not clean
+ * printable text is treated as prefixed and the leading 32 bytes are dropped.
+ */
+function decodePlaintext(plain) {
+    if (isPrintable(plain))
+        return plain.toString("utf8");
+    return plain.subarray(DOMAIN_HASH_LENGTH).toString("utf8");
+}
+function isPrintable(buf) {
+    for (const b of buf) {
+        if (b < 0x20 || b > 0x7e)
+            return false;
+    }
+    return true;
+}
+/**
+ * Copies the (Chrome-locked) cookie DB to a temp file and reads the claude.ai
+ * rows as hex via the macOS-bundled sqlite3, avoiding a native SQLite binding.
+ */
+export async function readRawClaudeCookies(cookiesDbPath, run = defaultRunner) {
+    const dir = mkdtempSync(join(tmpdir(), "ccprofile-cookies-"));
+    const copy = join(dir, "Cookies");
+    try {
+        copyFileSync(cookiesDbPath, copy);
+        // Chrome keeps the store in WAL mode; without the sidecars, recently
+        // refreshed cookies (notably the short-lived Cloudflare ones) stay
+        // invisible until Chrome checkpoints.
+        for (const suffix of ["-wal", "-shm"]) {
+            const sidecar = `${cookiesDbPath}${suffix}`;
+            if (existsSync(sidecar))
+                copyFileSync(sidecar, `${copy}${suffix}`);
+        }
+        // Only cookies a browser would send to https://claude.ai/: the apex
+        // host-only cookie and `.claude.ai` domain cookies. A subdomain host-only
+        // cookie (e.g. foo.claude.ai) is not sent there and could otherwise shadow
+        // the real sessionKey/cf_clearance.
+        const result = await run("/usr/bin/sqlite3", [
+            "-json",
+            copy,
+            "SELECT name, hex(encrypted_value) AS enc FROM cookies " +
+                "WHERE host_key = 'claude.ai' OR host_key = '.claude.ai'",
+        ]);
+        // A non-zero exit means sqlite3 itself failed (locked DB, unsupported
+        // option). Surface it so loadUsage reports a per-profile error instead of
+        // silently rendering the profile as "not signed in".
+        if (result.code !== 0) {
+            throw new Error(`sqlite3 failed to read Chrome cookies (exit ${result.code})${result.stderr.trim() ? `: ${result.stderr.trim()}` : ""}`);
+        }
+        const out = result.stdout.trim();
+        if (out === "")
+            return [];
+        return JSON.parse(out);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+export async function readSessionCookies(cookiesDbPath, key, run = defaultRunner) {
+    const raw = await readRawClaudeCookies(cookiesDbPath, run);
+    const wanted = new Set(SESSION_COOKIE_NAMES);
+    const cookies = {};
+    for (const { name, enc } of raw) {
+        if (!wanted.has(name))
+            continue;
+        const value = decryptCookieValue(enc, key);
+        if (value !== null)
+            cookies[name] = value;
+    }
+    return cookies;
+}

package/dist/lib/claudeai.js

@@ -0,0 +1,148 @@
+/**
+ * Minimal client for the claude.ai web API. ccprofile's own setup-token
+ * cannot read usage (the api.anthropic.com/api/oauth/usage endpoint requires a
+ * scope setup-tokens lack — see src/lib/usage.ts), so `ccprofile usage` speaks
+ * to the same endpoints the web app uses, authenticated with the browser's
+ * session cookies.
+ */
+/** Per-request ceiling so one stalled account cannot hang the whole command. */
+const REQUEST_TIMEOUT_MS = 15_000;
+export const defaultJsonFetcher = async (url, headers) => {
+    const res = await fetch(url, { headers, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+    const text = await res.text();
+    let body = null;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        body = null;
+    }
+    return { status: res.status, body };
+};
+export function buildHeaders(cookieHeader, userAgent) {
+    return {
+        Cookie: cookieHeader,
+        "User-Agent": userAgent,
+        "anthropic-client-platform": "web_claude_ai",
+        Referer: "https://claude.ai/",
+        Accept: "*/*",
+    };
+}
+function isRecord(v) {
+    return typeof v === "object" && v !== null;
+}
+function toDate(v) {
+    if (typeof v !== "string")
+        return null;
+    const d = new Date(v);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+function toSeverity(v) {
+    return v === "normal" || v === "warning" || v === "critical" ? v : "unknown";
+}
+function toPercent(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+/** A `limits[]` entry carries percent/severity/resets_at directly. */
+function windowFromLimit(limit) {
+    return {
+        percent: toPercent(limit.percent),
+        resetsAt: toDate(limit.resets_at),
+        severity: toSeverity(limit.severity),
+    };
+}
+/** The top-level five_hour/seven_day objects use `utilization` and lack severity. */
+function windowFromTopLevel(obj) {
+    if (!isRecord(obj))
+        return null;
+    return {
+        percent: toPercent(obj.utilization),
+        resetsAt: toDate(obj.resets_at),
+        severity: "unknown",
+    };
+}
+function isFableScoped(limit) {
+    if (limit.kind !== "weekly_scoped")
+        return false;
+    const scope = limit.scope;
+    if (!isRecord(scope))
+        return false;
+    const model = scope.model;
+    return isRecord(model) && model.display_name === "Fable";
+}
+/**
+ * Normalizes an /organizations/{id}/usage response. The Fable window only ever
+ * appears inside `limits[]` (the top-level seven_day_* fields are null), so
+ * limits[] is the primary source; five_hour/seven_day are fallbacks for the
+ * session and weekly-all windows when limits[] is absent.
+ */
+export function parseUsage(json) {
+    const root = isRecord(json) ? json : {};
+    const limits = Array.isArray(root.limits) ? root.limits.filter(isRecord) : [];
+    const byKind = (kind) => limits.find((l) => l.kind === kind);
+    const session = byKind("session");
+    const weeklyAll = byKind("weekly_all");
+    const fable = limits.find(isFableScoped);
+    return {
+        session: session ? windowFromLimit(session) : windowFromTopLevel(root.five_hour),
+        weeklyAll: weeklyAll ? windowFromLimit(weeklyAll) : windowFromTopLevel(root.seven_day),
+        fable: fable ? windowFromLimit(fable) : null,
+    };
+}
+function extractEmail(body) {
+    if (!isRecord(body))
+        return null;
+    const account = body.account;
+    if (!isRecord(account))
+        return null;
+    return typeof account.email_address === "string" ? account.email_address : null;
+}
+/** Detail set when a profile simply has no claude.ai session (not an error). */
+export const NOT_SIGNED_IN = "not signed in to claude.ai";
+function describeStatus(status) {
+    if (status === 401)
+        return "session expired — sign in again in Chrome";
+    if (status === 403)
+        return "blocked (session expired or Cloudflare challenge)";
+    if (status === 429)
+        return "rate limited by claude.ai";
+    return `claude.ai returned HTTP ${status}`;
+}
+/**
+ * Resolves one account's email and usage from its cookies. Uses lastActiveOrg
+ * (the org the browser last viewed) for the usage URL so the numbers match
+ * what the web UI shows. Never throws — network/HTTP failures come back as
+ * `{ ok: false }` so callers can render one bad profile without aborting.
+ */
+export async function fetchAccountUsage(cookies, userAgent, fetcher = defaultJsonFetcher) {
+    if (cookies.sessionKey === undefined) {
+        return { ok: false, status: 0, detail: NOT_SIGNED_IN };
+    }
+    const org = cookies.lastActiveOrg;
+    if (org === undefined) {
+        return { ok: false, status: 0, detail: "no active organization cookie" };
+    }
+    const cookieHeader = Object.entries(cookies)
+        .map(([name, value]) => `${name}=${value}`)
+        .join("; ");
+    const headers = buildHeaders(cookieHeader, userAgent);
+    try {
+        const boot = await fetcher("https://claude.ai/api/bootstrap", headers);
+        if (boot.status !== 200) {
+            return { ok: false, status: boot.status, detail: describeStatus(boot.status) };
+        }
+        const email = extractEmail(boot.body);
+        const usage = await fetcher(`https://claude.ai/api/organizations/${encodeURIComponent(org)}/usage`, headers);
+        if (usage.status !== 200) {
+            return { ok: false, status: usage.status, detail: describeStatus(usage.status) };
+        }
+        return { ok: true, email, report: parseUsage(usage.body) };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: 0,
+            detail: error instanceof Error ? error.message : String(error),
+        };
+    }
+}

package/dist/lib/format.js

@@ -15,18 +15,42 @@ export const fail = (s) => `${red("✗")} ${s}`;
 export function stripAnsi(s) {
     return s.replaceAll(new RegExp(`${ESC}\\[[0-9;]*m`, "g"), "");
 }
+/** East Asian Wide/Fullwidth code points that occupy two terminal columns. */
+function isWide(cp) {
+    return ((cp >= 0x1100 && cp <= 0x115f) ||
+        (cp >= 0x2e80 && cp <= 0x303e) ||
+        (cp >= 0x3041 && cp <= 0x33ff) ||
+        (cp >= 0x3400 && cp <= 0x4dbf) ||
+        (cp >= 0x4e00 && cp <= 0x9fff) ||
+        (cp >= 0xa000 && cp <= 0xa4cf) ||
+        (cp >= 0xac00 && cp <= 0xd7a3) ||
+        (cp >= 0xf900 && cp <= 0xfaff) ||
+        (cp >= 0xfe30 && cp <= 0xfe4f) ||
+        (cp >= 0xff00 && cp <= 0xff60) ||
+        (cp >= 0xffe0 && cp <= 0xffe6) ||
+        (cp >= 0x1f300 && cp <= 0x1faff) ||
+        (cp >= 0x20000 && cp <= 0x3fffd));
+}
+/** Rendered column count of a string, ANSI-stripped and wide-char aware. */
+export function displayWidth(s) {
+    let width = 0;
+    for (const ch of stripAnsi(s)) {
+        width += isWide(ch.codePointAt(0) ?? 0) ? 2 : 1;
+    }
+    return width;
+}
 export function table(rows) {
     if (rows.length === 0)
         return "";
     const widths = [];
     for (const row of rows) {
         row.forEach((cell, i) => {
-            widths[i] = Math.max(widths[i] ?? 0, stripAnsi(cell).length);
+            widths[i] = Math.max(widths[i] ?? 0, displayWidth(cell));
         });
     }
     return rows
         .map((row) => row
-        .map((cell, i) => cell + " ".repeat((widths[i] ?? 0) - stripAnsi(cell).length))
+        .map((cell, i) => cell + " ".repeat((widths[i] ?? 0) - displayWidth(cell)))
         .join("  ")
         .trimEnd())
         .join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efoo/ccprofile",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Per-directory Claude Code account routing via ANTHROPIC_AUTH_TOKEN, direnv, and macOS Keychain",
   "type": "module",
   "packageManager": "pnpm@10.33.4",