@efoo/ccprofile 0.3.0 → 0.5.0

package/README.md

@@ -63,6 +63,22 @@ claude        # /status shows "Auth token: ANTHROPIC_AUTH_TOKEN"
 
 Repeat with `ccprofile add personal` etc. Different terminals in different directories run different accounts concurrently.
 
+### Checking status
+
+```sh
+ccprofile which   # which account does *this* shell/directory resolve to? (instant, no network)
+ccprofile usage   # per-account plan utilization + reset times, straight from claude.ai
+```
+
+`ccprofile which` (alias `whoami`) answers "who am I running as here?" from local
+signals only, in Claude Code's own precedence order: a provider override
+(`CLAUDE_CODE_USE_{BEDROCK,VERTEX,FOUNDRY}`) wins first if set, otherwise the
+exported `ANTHROPIC_AUTH_TOKEN` matched against your registered profiles, then the
+directory's `.envrc` link — so it returns immediately. `ccprofile usage` decrypts your Chrome claude.ai session cookies
+to fetch the real 5-hour / weekly / Fable-weekly utilization for every signed-in
+account, ordered by whichever weekly limit resets soonest — without opening or
+switching the browser (you just need to be signed in to claude.ai in Chrome).
+
 ## Commands
 
 | Command | Description |
@@ -71,9 +87,11 @@ Repeat with `ccprofile add personal` etc. Different terminals in different direc
 | `ccprofile list [--json]` | Profiles with token presence and expiry countdown |
 | `ccprofile link <name> [dir]` | Write the managed `.envrc` block and `direnv allow` |
 | `ccprofile unlink [dir]` | Remove the managed block (deletes `.envrc` if nothing else remains) |
+| `ccprofile which` | Show which account this shell/directory resolves to right now — instant, no probes (alias: `whoami`) |
 | `ccprofile token <name>` | Print the stored token to stdout (for scripting — handle with care) |
 | `ccprofile remove <name>` | Delete the profile and its Keychain entry |
 | `ccprofile doctor [dir]` | Diagnose provider overrides, stale/missing active token env, expiry, token liveness, usage limits (a minimal real inference per profile — fable first, haiku fallback), broken links. `--model <alias>` pins the probe model; `--offline` skips all server probes |
+| `ccprofile usage [--json]` | Per-account plan utilization (5-hour, weekly, and Fable-weekly) with reset times, read from claude.ai via your Chrome session — no browser open or switch needed |
 | `ccprofile completion <shell>` | Print a completion script for fish, zsh, or bash |
 
 ## Shell completion
@@ -118,9 +136,9 @@ Notes:
 
 ccprofile is built on `claude setup-token`, whose long-lived tokens are **deliberately scoped to inference only** ("for security reasons", per Claude Code's own `/doctor`). Several conveniences of a normal `/login` session are therefore unavailable in linked directories:
 
-- **No account identity introspection.** The token cannot answer "whose token is this?" — the OAuth profile endpoint rejects it (`user:profile` scope missing, see [#11985](https://github.com/anthropics/claude-code/issues/11985)). The `--email` you record is a self-declared label, not verified.
+- **No account identity introspection.** The token cannot answer "whose token is this?" — the OAuth profile endpoint rejects it (`user:profile` scope missing, see [#11985](https://github.com/anthropics/claude-code/issues/11985)). The `--email` you record is a self-declared label, not verified. (`ccprofile which` still names the *active* account, but locally — by matching the exported token against your registered profiles, never asking the server.)
   *Verify identity once, at registration time:* make sure the browser is logged into the intended claude.ai account before `claude setup-token`, then send a couple of prompts from a linked directory and confirm on claude.ai (web) that the intended account's usage moved.
-- **`/status` → Usage tab shows no plan utilization** in token-authenticated sessions (same scope restriction — the usage endpoint also requires `user:profile`). Check usage on claude.ai, or run `ccprofile doctor`: it detects exhausted usage limits the only way these tokens allow, by sending one minimal real inference per profile (fable first; on a fable limit it retries with haiku to tell "fable's separate budget exhausted" from "subscription window exhausted"). The probe consumes a negligible amount of quota and starts the 5-hour window of an idle profile; use `--offline` if you don't want that.
+- **`/status` → Usage tab shows no plan utilization** in token-authenticated sessions (same scope restriction — the usage endpoint also requires `user:profile`). Check usage on claude.ai, or run `ccprofile doctor`: it detects exhausted usage limits the only way these tokens allow, by sending one minimal real inference per profile (fable first; on a fable limit it retries with haiku to tell "fable's separate budget exhausted" from "subscription window exhausted"). The probe consumes a negligible amount of quota and starts the 5-hour window of an idle profile; use `--offline` if you don't want that. To read *real* remaining quota without spending any, run `ccprofile usage`, which pulls per-account utilization straight from claude.ai using your signed-in Chrome session (no token probe, no window started).
 - **Remote Control is unavailable** in linked directories. Claude Code treats `ANTHROPIC_AUTH_TOKEN` sessions as API-key authentication, while Remote Control requires claude.ai subscription authentication.
 - **Tokens last up to 1 year but can die earlier** (password change, logout-all). The recorded expiry is a hint, not a guarantee — `ccprofile doctor` probes the server and tells live tokens apart from revoked ones.
 - **Routing only applies to shell-launched processes.** direnv activates the token when a hooked shell enters the directory; apps launched outside a hooked shell (GUI launchers) bypass it.

package/dist/commands/completion.js

@@ -4,6 +4,7 @@ export const SUBCOMMANDS = [
     { name: "list", description: "Show profiles, token presence, and expiry" },
     { name: "link", description: "Route a directory to a profile" },
     { name: "unlink", description: "Remove the managed .envrc block" },
+    { name: "which", description: "Show which account this shell resolves to" },
     { name: "token", description: "Print the stored token" },
     { name: "remove", description: "Delete a profile and its Keychain entry" },
     { name: "doctor", description: "Diagnose configuration problems" },

package/dist/commands/doctor.js

@@ -51,6 +51,13 @@ export async function doctorCommand(argv) {
             problems += 1;
         }
     }
+    const config = loadConfig();
+    const keychain = new Keychain();
+    // Answer "which account is active here?" up front — it is cheap (one .envrc
+    // read plus at most one Keychain lookup) and is the thing users most often
+    // open doctor to check, so it must not sit behind the slow per-profile
+    // inference probes further down.
+    problems += await reportCurrentLink(dir, config, keychain);
     for (const envVar of OVERRIDING_ENV_VARS) {
         if (process.env[envVar] !== undefined) {
             console.log(fail(`${envVar} is set: it overrides ANTHROPIC_AUTH_TOKEN and bypasses ccprofile routing.`));
@@ -72,8 +79,6 @@ export async function doctorCommand(argv) {
             warnings += 1;
         }
     }
-    const config = loadConfig();
-    const keychain = new Keychain();
     const profiles = Object.entries(config.profiles);
     if (profiles.length > 0) {
         const ctx = {
@@ -105,44 +110,6 @@ export async function doctorCommand(argv) {
         }
         spinner.stop();
     }
-    const envrcPath = join(dir, ".envrc");
-    if (existsSync(envrcPath)) {
-        console.log();
-        const linked = parseLinkedProfile(readFileSync(envrcPath, "utf8"));
-        if (linked === null) {
-            console.log(ok(`${envrcPath} exists but has no ccprofile block (not managed here).`));
-        }
-        else if (config.profiles[linked]) {
-            if (dir !== resolve(process.cwd())) {
-                console.log(ok(`${bold(dir)} → profile "${linked}"`));
-            }
-            else {
-                const linkedProfile = config.profiles[linked];
-                const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
-                if (exportedToken === undefined) {
-                    console.log(fail(`This directory → profile "${linked}", but ANTHROPIC_AUTH_TOKEN is not exported in this shell. Run: direnv reload`));
-                    problems += 1;
-                }
-                else {
-                    const linkedToken = await keychain.getToken(linkedProfile.keychain.service, linkedProfile.keychain.account);
-                    if (linkedToken !== null && exportedToken !== linkedToken) {
-                        console.log(fail(`This directory → profile "${linked}", but this shell exports a different ANTHROPIC_AUTH_TOKEN. Run: direnv reload, then restart Claude Code.`));
-                        problems += 1;
-                    }
-                    else if (linkedToken !== null) {
-                        console.log(ok(`This directory → profile "${linked}" (ANTHROPIC_AUTH_TOKEN exported)`));
-                    }
-                    else {
-                        console.log(ok(`This directory → profile "${linked}"`));
-                    }
-                }
-            }
-        }
-        else {
-            console.log(fail(`${envrcPath} references unknown profile "${linked}". Run: ccprofile link <profile> ${dir}`));
-            problems += 1;
-        }
-    }
     console.log();
     if (problems > 0) {
         console.log(fail(`${problems} problem(s), ${warnings} warning(s).`));
@@ -151,6 +118,63 @@ export async function doctorCommand(argv) {
     console.log(ok(`No problems found (${warnings} warning(s)).`));
     return 0;
 }
+/**
+ * Prints the "which account does this directory resolve to?" summary and
+ * returns how many problems it found. Kept intentionally cheap — one .envrc
+ * read plus at most one Keychain lookup — so it can run before the inference
+ * probes and give an instant answer.
+ */
+async function reportCurrentLink(dir, config, keychain) {
+    const envrcPath = join(dir, ".envrc");
+    let content;
+    try {
+        if (!existsSync(envrcPath))
+            return 0;
+        content = readFileSync(envrcPath, "utf8");
+    }
+    catch {
+        // The .envrc vanished between the check and the read, or is unreadable —
+        // nothing to report, and doctor must not crash over a transient FS error.
+        return 0;
+    }
+    console.log();
+    const linked = parseLinkedProfile(content);
+    if (linked === null) {
+        console.log(ok(`${envrcPath} exists but has no ccprofile block (not managed here).`));
+        return 0;
+    }
+    const linkedProfile = config.profiles[linked];
+    if (linkedProfile === undefined) {
+        console.log(fail(`${envrcPath} references unknown profile "${linked}". Run: ccprofile link <profile> ${dir}`));
+        return 1;
+    }
+    if (dir !== resolve(process.cwd())) {
+        console.log(ok(`${bold(dir)} → profile "${linked}"`));
+        return 0;
+    }
+    const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
+    if (exportedToken === undefined) {
+        console.log(fail(`This directory → profile "${linked}", but ANTHROPIC_AUTH_TOKEN is not exported in this shell. Run: direnv reload`));
+        return 1;
+    }
+    let linkedToken = null;
+    try {
+        linkedToken = await keychain.getToken(linkedProfile.keychain.service, linkedProfile.keychain.account);
+    }
+    catch {
+        // A Keychain hiccup (e.g. `security` failing) must not abort doctor; fall
+        // back to reporting the link without the token-match confirmation.
+        linkedToken = null;
+    }
+    if (linkedToken !== null && exportedToken !== linkedToken) {
+        console.log(fail(`This directory → profile "${linked}", but this shell exports a different ANTHROPIC_AUTH_TOKEN. Run: direnv reload, then restart Claude Code.`));
+        return 1;
+    }
+    console.log(linkedToken !== null
+        ? ok(`This directory → profile "${linked}" (ANTHROPIC_AUTH_TOKEN exported)`)
+        : ok(`This directory → profile "${linked}"`));
+    return 0;
+}
 const HEADER = ["PROFILE", "TOKEN", "EXPIRES", "FABLE", "OTHERS", "NOTE"];
 // The cell vocabulary is fixed, so column widths are known before any check
 // resolves — rows can stream in as profiles finish, without a barrier.

package/dist/commands/usage.js

@@ -4,7 +4,32 @@ import { parseArgs } from "node:util";
 import { assertDarwin } from "../lib/keychain.js";
 import { chromeUserAgent, chromeUserDataDir, parseProfiles, readSessionCookies, safeStorageKey, } from "../lib/chrome.js";
 import { fetchAccountUsage, NOT_SIGNED_IN, } from "../lib/claudeai.js";
-import { bold, dim, fail, red, table, warn, yellow } from "../lib/format.js";
+import { loadConfig } from "../lib/config.js";
+import { bold, cyan, dim, fail, red, table, warn, yellow } from "../lib/format.js";
+/**
+ * Maps a claude.ai account email to the ccprofile name registered for it, so a
+ * signed-in Chrome account that matches a stored profile is labelled with that
+ * profile's name. Matching is case-insensitive.
+ */
+function profileNamesByEmail() {
+    const byEmail = new Map();
+    try {
+        for (const [name, entry] of Object.entries(loadConfig().profiles)) {
+            if (entry.email)
+                byEmail.set(entry.email.toLowerCase(), name);
+        }
+    }
+    catch {
+        // A malformed/unsupported config.json shouldn't sink the usage table;
+        // profile labelling is auxiliary, so degrade to unlabelled accounts.
+    }
+    return byEmail;
+}
+function matchedProfileName(email, byEmail) {
+    if (email === null)
+        return null;
+    return byEmail.get(email.toLowerCase()) ?? null;
+}
 export async function usageCommand(argv) {
     const { values } = parseArgs({
         args: argv,
@@ -32,11 +57,12 @@ export async function usageCommand(argv) {
         : startSpinner(`querying claude.ai for ${profiles.length} Chrome profile(s)…`);
     const results = await Promise.all(profiles.map((profile) => loadUsage(profile, userDataDir, key, userAgent)));
     spinner.stop();
+    const byEmail = profileNamesByEmail();
     if (values.json) {
-        console.log(JSON.stringify(results.map(toJson), null, 2));
+        console.log(JSON.stringify(results.map((r) => toJson(r, byEmail)), null, 2));
         return hasRealFailure(results) ? 1 : 0;
     }
-    return render(results);
+    return render(results, byEmail);
 }
 /**
  * A profile that was never signed in is expected and not a failure; anything
@@ -57,19 +83,12 @@ async function loadUsage(profile, userDataDir, key, userAgent) {
         return { profile, usage: { ok: false, status: 0, detail } };
     }
 }
-function render(results) {
-    const header = ["ACCOUNT", "CHROME", "5-HOUR", "WEEK · ALL", "FABLE · WEEK"].map(bold);
-    const rows = [header];
+function render(results, byEmail) {
+    const signedIn = [];
     const problems = [];
     for (const { profile, usage } of results) {
         if (usage.ok) {
-            rows.push([
-                usage.email ?? dim("(unknown)"),
-                dim(profile.name),
-                windowCell(usage.report.session),
-                windowCell(usage.report.weeklyAll),
-                windowCell(usage.report.fable),
-            ]);
+            signedIn.push({ profile, usage });
         }
         else if (usage.detail !== NOT_SIGNED_IN) {
             // A missing session is expected for stray Chrome profiles; only real
@@ -77,6 +96,19 @@ function render(results) {
             problems.push(warn(`${profile.name}: ${usage.detail}`));
         }
     }
+    const header = ["PROFILE", "ACCOUNT", "CHROME", "5-HOUR", "WEEK · ALL", "FABLE · WEEK"].map(bold);
+    const rows = [header];
+    for (const { profile, usage } of sortByWeeklyReset(signedIn)) {
+        const name = matchedProfileName(usage.email, byEmail);
+        rows.push([
+            name === null ? dim("-") : cyan(name),
+            usage.email ?? dim("(unknown)"),
+            dim(profile.name),
+            windowCell(usage.report.session),
+            windowCell(usage.report.weeklyAll),
+            windowCell(usage.report.fable),
+        ]);
+    }
     if (rows.length === 1 && problems.length === 0) {
         console.log(dim("No claude.ai sessions found in Chrome. Sign in at https://claude.ai and retry."));
         return 0;
@@ -87,6 +119,15 @@ function render(results) {
         console.log(problem);
     return problems.length > 0 ? 1 : 0;
 }
+/**
+ * Orders accounts by how soon their weekly (all-models) limit resets — the
+ * nearest reset first, the furthest last. Accounts with no weekly window sort
+ * to the end so a resolved figure never sits below a blank one.
+ */
+function sortByWeeklyReset(results) {
+    const resetKey = (r) => r.usage.report.weeklyAll?.resetsAt?.getTime() ?? Number.MAX_SAFE_INTEGER;
+    return [...results].sort((a, b) => resetKey(a) - resetKey(b));
+}
 function windowCell(window) {
     if (window === null)
         return dim("-");
@@ -111,12 +152,14 @@ function formatReset(date) {
     const md = `${date.getMonth() + 1}/${date.getDate()}`.padStart(5, " ");
     return `${md} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
 }
-function toJson(result) {
+function toJson(result, byEmail) {
     const { profile, usage } = result;
+    const email = usage.ok ? usage.email : null;
     return {
+        profile: matchedProfileName(email, byEmail),
         chromeProfile: profile.name,
         chromeDir: profile.dir,
-        email: usage.ok ? usage.email : null,
+        email,
         error: usage.ok ? null : usage.detail,
         usage: usage.ok ? serializeReport(usage.report) : null,
     };

package/dist/commands/which.js

@@ -0,0 +1,114 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+import { loadConfig } from "../lib/config.js";
+import { parseLinkedProfile } from "../lib/envrc.js";
+import { assertDarwin, Keychain } from "../lib/keychain.js";
+import { OVERRIDING_ENV_VARS } from "../lib/usage.js";
+import { bold, cyan, dim, fail, ok, warn } from "../lib/format.js";
+/**
+ * `ccprofile which` answers one question fast: which account will Claude Code
+ * use in this shell, right now? Unlike `doctor` it runs no inference probes and
+ * no liveness checks — just the local signals (env vars, the exported token,
+ * and the current directory's link) — so it returns effectively instantly.
+ */
+export async function whichCommand(argv) {
+    parseArgs({ args: argv, allowPositionals: true, options: {} });
+    assertDarwin();
+    const config = loadConfig();
+    const overrideVar = OVERRIDING_ENV_VARS.find((v) => process.env[v] !== undefined);
+    const exportedToken = process.env.ANTHROPIC_AUTH_TOKEN;
+    const linkName = readCwdLink();
+    const linkIsKnown = linkName !== null && config.profiles[linkName] !== undefined;
+    // The Keychain read is the only I/O with a cost, and only when a token is
+    // actually exported — resolving it back to a profile name.
+    let matchedProfile = null;
+    if (overrideVar === undefined && exportedToken !== undefined && exportedToken !== "") {
+        matchedProfile = await findProfileByToken(config, exportedToken);
+    }
+    const result = classifyActiveAccount({
+        overrideVar,
+        exportedToken,
+        linkName,
+        linkIsKnown,
+        matchedProfile,
+    });
+    return printResult(result, config);
+}
+/**
+ * Pure resolution of "who am I running as" from the local signals, mirroring
+ * Claude Code's own precedence: an override env var wins; otherwise the
+ * exported ANTHROPIC_AUTH_TOKEN decides; with no token, a directory link is
+ * merely configured (not active) and bare shells use /login.
+ */
+export function classifyActiveAccount(input) {
+    if (input.overrideVar !== undefined) {
+        return { kind: "override", envVar: input.overrideVar };
+    }
+    if (input.exportedToken === undefined || input.exportedToken === "") {
+        if (input.linkName !== null && input.linkIsKnown) {
+            return { kind: "link-inactive", profile: input.linkName };
+        }
+        return { kind: "none" };
+    }
+    if (input.matchedProfile === null) {
+        return { kind: "foreign" };
+    }
+    return {
+        kind: "active",
+        profile: input.matchedProfile,
+        viaLink: input.linkName === input.matchedProfile,
+        linkMismatch: input.linkName !== null && input.linkName !== input.matchedProfile ? input.linkName : null,
+    };
+}
+function printResult(result, config) {
+    switch (result.kind) {
+        case "override":
+            console.log(fail(`${result.envVar} is set — Claude Code ignores ccprofile routing and uses it instead.`));
+            return 1;
+        case "active": {
+            const email = config.profiles[result.profile]?.email;
+            console.log(`${cyan(bold(result.profile))}${email ? `  ${dim(`(${email})`)}` : ""}`);
+            const sources = result.viaLink
+                ? [".envrc link", "ANTHROPIC_AUTH_TOKEN exported"]
+                : ["ANTHROPIC_AUTH_TOKEN exported"];
+            console.log(dim(`  source: ${sources.join(" · ")}`));
+            if (result.linkMismatch !== null) {
+                console.log(warn(`  This directory links "${result.linkMismatch}", but the exported token is "${result.profile}". Run: direnv reload`));
+            }
+            return 0;
+        }
+        case "foreign":
+            console.log(warn("An ANTHROPIC_AUTH_TOKEN is exported, but it matches no ccprofile profile."));
+            console.log(dim("  It was likely set manually or by another tool."));
+            return 0;
+        case "link-inactive":
+            console.log(warn(`This directory links profile ${bold(result.profile)}, but no token is exported here.`));
+            console.log(dim("  Run: direnv reload  (or re-enter the directory) to activate it."));
+            return 1;
+        case "none":
+            console.log(ok(dim("No ccprofile account active — Claude Code uses your /login (subscription) session.")));
+            return 0;
+    }
+}
+function readCwdLink() {
+    const envrcPath = join(resolve(process.cwd()), ".envrc");
+    if (!existsSync(envrcPath))
+        return null;
+    try {
+        return parseLinkedProfile(readFileSync(envrcPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+/** Finds the profile whose stored Keychain token equals the exported one. */
+async function findProfileByToken(config, token) {
+    const keychain = new Keychain();
+    for (const [name, profile] of Object.entries(config.profiles)) {
+        const stored = await keychain.getToken(profile.keychain.service, profile.keychain.account);
+        if (stored !== null && stored === token)
+            return name;
+    }
+    return null;
+}

package/dist/index.js

@@ -20,6 +20,8 @@ ${bold("Commands")}
   list [--json]           Show profiles, token presence, and expiry
   link <name> [dir]       Route a directory to a profile (writes .envrc, direnv allow)
   unlink [dir]            Remove the managed block from a directory's .envrc
+  which                   Show which account this shell/directory resolves to,
+                          instantly (no probes). Alias: whoami
   token <name>            Print the stored token (for scripting; handle with care)
   remove <name> [--force] Delete a profile and its Keychain entry
   doctor [dir]            Diagnose overriding env vars, expiry, token liveness,
@@ -51,6 +53,9 @@ async function main() {
             return (await import("./commands/link.js")).linkCommand(rest);
         case "unlink":
             return (await import("./commands/unlink.js")).unlinkCommand(rest);
+        case "which":
+        case "whoami":
+            return (await import("./commands/which.js")).whichCommand(rest);
         case "token":
             return (await import("./commands/token.js")).tokenCommand(rest);
         case "doctor":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@efoo/ccprofile",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Per-directory Claude Code account routing via ANTHROPIC_AUTH_TOKEN, direnv, and macOS Keychain",
   "type": "module",
   "packageManager": "pnpm@10.33.4",