@hanamorilabs/tab 0.1.4 → 0.1.6

package/README.md

@@ -38,6 +38,25 @@ is keyed, and keeps it in the config file so `tab claude` is one command.
 Set `FLOCKTAB_PROXY_URL`, `FLOCKTAB_KEY` and `FLOCKTAB_UNLOCK` instead when
 you would rather not have a file or a folder, for example in CI.
 
+## On a subscription (Claude Max, ChatGPT)
+
+```
+tab use --subscription --plan "Claude Max 5x" --price 100
+tab claude        # your own Claude login through the tab
+tab codex         # your own ChatGPT login (codex login once, inside tab codex)
+tab quota         # 5h / 7d windows the vendor reported on the last call
+tab use --api-key # back to the metered tab
+```
+
+The plan pays for the tokens; the tab still gates every call (kill switch,
+velocity, model and tool policy) and records it at list price as a
+`SUBSCRIPTION` row that never touches the cap. Claude Code gets
+`ANTHROPIC_BASE_URL=<proxy>/t/<key>/anthropic` and no API key; Codex gets a
+home whose `chatgpt_base_url` is `<proxy>/t/<key>/openai/backend-api/`, with
+your existing `~/.codex/auth.json` copied in once (never written back). The
+mode is the Agent's, read on every launch, so the console's **Runs on** panel
+and `tab use` agree. `docs/subscriptions.md` has the wire.
+
 ## Self-hosted
 
 The proxy runs on your box and holds the provider keys; the ledger, tabs and
@@ -45,8 +64,8 @@ kill switch stay on flocktab.com. It is one small Rust binary. `tab up` asks
 for the keys once (typed without echo, saved owner-only to
 `~/.flocktab/proxy.env`), fetches `flocktab-proxy` for this machine into
 `~/.flocktab/bin`, and starts it in the background (log: `~/.flocktab/proxy.log`).
-`tab down` stops it; `tab update` fetches the newest proxy and restarts;
-`tab claude` starts it when it is down. No Docker, no Rust, no checkout: the
+`tab down` stops it; `tab update` installs the newest tab, which brings the
+newest proxy, and restarts it; `tab claude` starts it when it is down. No Docker, no Rust, no checkout: the
 binary comes with `tab` as the `@hanamorilabs/flocktab-proxy-<platform>`
 package for your machine. Then
 `tab login`, pick **2 Self-hosted**: the proxy says which console it settles
@@ -59,12 +78,14 @@ Codex shows `FlockTab - Self-hosted` as its provider.
 tab login            approve this machine in the console, once
 tab <agent> [args]   claude, codex, grok, kimi, gemini, or any command, on the tab
 tab use              pick or change the Agent this folder runs as (.flocktab)
+tab use --subscription | --api-key   this Agent on your Claude Max / ChatGPT plan, or back on the meter
+tab quota [agent]    what the subscription has left: 5h and 7d windows
 tab alias setup <name>...   make plain `codex` run `tab codex` (shims in ~/.flocktab/bin)
 tab alias remove <name>...  undo that; `tab alias list` shows them
 tab status           flock, folder Agent, proxy health, provider key state
 tab version          tab and proxy versions
 tab up | down        self-hosted: start or stop the local proxy
-tab update           self-hosted: newest proxy (npm i -g @hanamorilabs/tab@latest)
+tab update           the newest tab and proxy from npm; restarts a running local proxy
 tab logout           forget the session and keys on this machine
 tab help             this list
 ```
@@ -76,20 +97,20 @@ session from `tab login`. An Agent is named by slug or name; left out, it is
 this folder's Agent. Every read takes `--json`.
 
 ```
-tab list                                 every Agent: state, spent of cap, window, project
-tab close crawler        tab open crawler   the kill switch (402 tab_closed on the next call)
-tab cap crawler 25 --window week         cap in dollars, and the window
-tab rename crawler "Nightly crawler"     the slug stays
-tab policy crawler --velocity 60 --models gpt-5,claude-sonnet-5 --allow email.send
-tab project crawler Foley --create       attribute to a project (--repo owner/name; none clears)
+tab list                                 every Agent: state, mode (meter | plan), spent of cap, window, project
+tab close my-project        tab open my-project   the kill switch (402 tab_closed on the next call)
+tab cap my-project 25 --window week         cap in dollars, and the window
+tab rename my-project "My project (nightly)"     the slug stays
+tab policy my-project --velocity 60 --models gpt-5,claude-sonnet-5 --allow email.send
+tab project my-project Foley --create       attribute to a project (--repo owner/name; none clears)
 tab projects add Foley                   projects
-tab key rotate crawler [--show]          new key, kept on this machine; --show prints it once
-tab archive crawler                      closes for good, leaves the bill (asks first; -y skips)
-tab ledger [crawler] --limit 20 --blocked   one row per call: settled of held, status, reason
+tab key rotate my-project [--show]          new key, kept on this machine; --show prints it once
+tab archive my-project                      closes for good, leaves the bill (asks first; -y skips)
+tab ledger [my-project] --limit 20 --blocked   one row per call: settled of held, status, reason
 tab spend [agent|project|day] --since 7d    meter and outside spend, the console's numbers
 tab outside                              connections, per-project outside spend, unattributed
 tab live --watch 4                       who is working now, refreshed every 4 seconds
-tab web [crawler]                        the Agent's console page in the browser
+tab web [my-project]                        the Agent's console page in the browser
 ```
 
 ## Aliases: plain `codex` on the tab
@@ -121,5 +142,6 @@ proxy   http://127.0.0.1:8787  (self-hosted)  up
 flock   Hanamori Labs
 folder  flocktab-codex
 plan    team
+mode    metered (the flock's provider key, charged to the tab)
 byok    provider keys on this box
 ```

package/dist/cli.js

@@ -7,11 +7,14 @@
  *   tab codex  [...args]   Codex on the tab
  *   tab <cmd>  [...args]   anything else, both APIs pointed at the tab
  *   tab use                pick (or change) the Agent this folder runs as
+ *   tab use --subscription this folder's Agent runs on your Claude Max / ChatGPT plan
+ *   tab quota              what the plan has left (5h / 7d windows) for this Agent
  *   tab alias setup codex  make plain `codex` run `tab codex` (shims in ~/.flocktab/bin)
  *   tab alias remove codex undo that; `tab alias list` shows them
  *   tab status             which flock, which Agent here, is the proxy up
  *   tab version            tab and proxy versions
- *   tab up | down | update self-hosted: start, stop, or fetch the newest proxy
+ *   tab up | down          self-hosted: start or stop the local proxy
+ *   tab update             the newest tab and proxy from npm
  *   tab logout             forget the session and keys
  *
  * Login is per machine. The Agent is per folder: the first `tab claude` in
@@ -52,6 +55,9 @@ function usage() {
         cmd(others.join(" | tab "), "the same, for those agents"),
         cmd("<command> [args]", "any other agent, both APIs pointed at the tab"),
         cmd("use", "pick or change the Agent this folder runs as (.flocktab)"),
+        cmd("use --subscription", "this Agent runs on your Claude Max / ChatGPT plan (--plan \"Max 5x\" --price 100)"),
+        cmd("use --api-key", "back to the metered tab with the flock's provider key"),
+        cmd("quota [agent]", "what the subscription has left: 5h and 7d windows"),
         cmd("alias setup <name>...", "make plain `codex` run `tab codex` (shims in ~/.flocktab/bin)"),
         cmd("alias remove <name>...", "undo that; `tab alias list` shows them"),
         cmd("status", "which flock, which Agent here, is the proxy up"),
@@ -73,7 +79,7 @@ function usage() {
         cmd("... --json", "every read command as JSON, for scripts and agents"),
         cmd("up", "self-hosted: start the local proxy (fetches it the first time)"),
         cmd("down", "self-hosted: stop the local proxy"),
-        cmd("update", "self-hosted: fetch the newest proxy and restart it"),
+        cmd("update", "the newest tab (and proxy) from npm; restarts a running local proxy"),
         cmd("logout", "forget the session and keys"),
     ].map(([k, v]) => [cyan(k), v])));
     say(`
@@ -479,6 +485,7 @@ async function status() {
         }
         else {
             pairs.push(["plan", me.flock.plan]);
+            pairs.push(["mode", me.authMode === "subscription" ? `${bold("subscription")} ${dim("(your Claude Max / ChatGPT login; FlockTab keeps the record)")}` : `metered ${dim("(the flock's provider key, charged to the tab)")}`]);
             const byok = !me.byok
                 ? dim("no provider key on this flock")
                 : me.unlock === "none"
@@ -505,9 +512,21 @@ async function runAgent(name, args) {
     const agent = await resolveAgent(config);
     if (!agent)
         return 1;
-    const key = presentedKey({ key: agent.key, unlock: config.unlock });
+    // The Agent's mode is the console's call, read fresh on every launch so a
+    // switch there (or `tab use --subscription`) applies to the next run.
+    const me = await whoami(config.proxyUrl, { key: agent.key, unlock: config.unlock });
+    const auth = !("error" in me) && me.authMode === "subscription" ? "subscription" : "key";
+    // On a subscription there is no provider key to unlock; the bare key rides in the URL.
+    const key = auth === "subscription" ? agent.key : presentedKey({ key: agent.key, unlock: config.unlock });
     reportFolder(config.proxyUrl, key);
-    const { spec, env } = envFor({ name, proxyUrl: config.proxyUrl, presentedKey: key });
+    const { spec, env } = envFor({ name, proxyUrl: config.proxyUrl, presentedKey: key, auth });
+    if (auth === "subscription") {
+        if (spec.shape === "openai" && spec.isolatedHome !== "codex") {
+            fail(`${spec.label} has no subscription route. Only Claude Code and Codex can run on a plan; switch this Agent back with ${bold("tab use --api-key")}.`);
+            return 2;
+        }
+        say(dim(`${agent.agentName} runs on your own ${spec.isolatedHome === "codex" ? "ChatGPT" : "Claude"} login; FlockTab keeps the record and the kill switch.`));
+    }
     // An alias shim named like the agent must not be what we spawn.
     env.PATH = pathWithoutShims();
     if (spec.isolatedHome === "codex") {
@@ -516,6 +535,7 @@ async function runAgent(name, args) {
             proxyUrl: config.proxyUrl,
             presentedKey: key,
             mode: config.mode,
+            auth,
         });
     }
     const child = spawn(spec.command, [...(spec.args ?? []), ...args], { stdio: "inherit", env });
@@ -587,15 +607,39 @@ function pathHint() {
     say(`  ${bold(pathLine())}`);
     return 0;
 }
-/** `tab use`: pick or change the Agent for this folder. */
-async function use() {
+/**
+ * `tab use`: pick or change the Agent for this folder. With `--subscription`
+ * or `--api-key` the folder's Agent (picked first if there is none) is
+ * switched in the console; `--plan` and `--price` label the seat.
+ */
+async function use(args) {
     const config = await ensureLogin();
     if (!config)
         return 2;
+    const flags = manage.parseFlags(args);
+    const wantsSubscription = flags.opts.subscription !== undefined;
+    const wantsKey = flags.opts["api-key"] !== undefined || flags.opts.apikey !== undefined;
+    if (wantsSubscription && wantsKey) {
+        fail("Pick one: tab use --subscription or tab use --api-key.");
+        return 2;
+    }
     if (!(await ensureProxy(config)))
         return 1;
-    const agent = await resolveAgent(config, { pick: true });
-    return agent ? 0 : 1;
+    if (!wantsSubscription && !wantsKey) {
+        const agent = await resolveAgent(config, { pick: true });
+        return agent ? 0 : 1;
+    }
+    const agent = await resolveAgent(config);
+    if (!agent)
+        return 1;
+    try {
+        const project = await readProject(process.cwd());
+        return await manage.setAuthMode(config, flags, project?.agent ?? agent.agentName, wantsSubscription ? "subscription" : "api_key");
+    }
+    catch (err) {
+        fail(err instanceof Error ? err.message : String(err));
+        return 1;
+    }
 }
 /**
  * First `tab up` on a box: the provider keys the proxy will spend, typed
@@ -621,6 +665,48 @@ async function collectProviderKeys() {
     ok(`Saved to ${dim(file)} ${dim("(owner-only)")}`);
     return true;
 }
+/**
+ * `tab update`: the newest tab from npm, which carries the newest proxy as
+ * its platform package. A self-hosted proxy that was running is restarted
+ * on the new binary; a hosted machine just gets the new tab.
+ */
+async function update() {
+    const config = await loadConfig();
+    const wasUp = config?.mode === "self-hosted" && (await proxyHealth(config.proxyUrl)).ok;
+    say(dim(`tab ${TAB_VERSION} now; asking npm for the newest.`));
+    const code = await new Promise((resolve) => {
+        const child = spawn(process.platform === "win32" ? "npm.cmd" : "npm", ["i", "-g", "@hanamorilabs/tab@latest"], {
+            stdio: ["ignore", "ignore", "inherit"],
+            shell: process.platform === "win32",
+        });
+        child.on("error", () => resolve(1));
+        child.on("close", (c) => resolve(c ?? 1));
+    });
+    if (code !== 0) {
+        fail(`npm could not update tab. Try: ${bold("npm i -g @hanamorilabs/tab@latest")}`);
+        return 1;
+    }
+    // The version now on PATH is the new install's, not this process's.
+    const installed = await new Promise((resolve) => {
+        const child = spawn(process.platform === "win32" ? "tab.cmd" : "tab", ["version"], { shell: process.platform === "win32" });
+        let text = "";
+        child.stdout?.on("data", (d) => (text += d.toString()));
+        child.stderr?.on("data", (d) => (text += d.toString()));
+        child.on("close", () => resolve(text.trim()));
+        child.on("error", () => resolve(""));
+    });
+    ok(installed ? `Updated.
+${installed}` : "Updated.");
+    if (!wasUp) {
+        if (!packagedBinPath() && config?.mode === "self-hosted") {
+            const fetched = await downloadProxy((t) => say(dim(t)));
+            (fetched.ok ? ok : fail)(fetched.ok ? `Fetched flocktab-proxy ${PROXY_VERSION}.` : fetched.message);
+        }
+        return 0;
+    }
+    await stopProxy();
+    return (await bringUp(config.proxyUrl)) ? 0 : 1;
+}
 async function selfHosted(action) {
     const config = await loadConfig();
     const proxyUrl = config?.mode === "self-hosted" ? config.proxyUrl : LOCAL_PROXY;
@@ -629,30 +715,6 @@ async function selfHosted(action) {
         (stopped ? ok : warn)(stopped ? "Proxy stopped." : "Proxy was not running.");
         return 0;
     }
-    if (action === "update") {
-        await stopProxy();
-        if (packagedBinPath()) {
-            // The binary is part of the npm install; the newest one comes with the newest tab.
-            say(`The proxy ships with tab. Updating tab updates it: ${bold("npm i -g @hanamorilabs/tab@latest")}`);
-            const code = await new Promise((resolve) => {
-                const child = spawn(process.platform === "win32" ? "npm.cmd" : "npm", ["i", "-g", "@hanamorilabs/tab@latest"], { stdio: "inherit" });
-                child.on("error", () => resolve(1));
-                child.on("close", (c) => resolve(c ?? 1));
-            });
-            if (code !== 0) {
-                fail("npm could not update tab.");
-                return 1;
-            }
-        }
-        else {
-            const fetched = await downloadProxy((t) => say(dim(t)));
-            if (!fetched.ok) {
-                fail(fetched.message);
-                return 1;
-            }
-            ok(`Fetched flocktab-proxy ${PROXY_VERSION}.`);
-        }
-    }
     if (!(await hasProxyEnv())) {
         const written = await collectProviderKeys();
         if (!written)
@@ -701,6 +763,8 @@ async function managed(command, rest) {
                 return await manage.outside(config, flags);
             case "live":
                 return await manage.live(config, flags);
+            case "quota":
+                return await manage.quota(config, flags);
             default:
                 return await manage.web(config, flags);
         }
@@ -726,7 +790,7 @@ async function main(argv) {
             ok("Forgot the session and keys on this machine.");
             return 0;
         case "use":
-            return use();
+            return use(rest);
         case "alias":
             return alias(rest);
         case "unalias":
@@ -750,6 +814,7 @@ async function main(argv) {
         case "spend":
         case "outside":
         case "live":
+        case "quota":
         case "web":
             return managed(command, rest);
         case "status":
@@ -759,7 +824,7 @@ async function main(argv) {
         case "down":
             return selfHosted("down");
         case "update":
-            return selfHosted("update");
+            return update();
         default:
             return runAgent(command, rest);
     }

package/dist/clients.js

@@ -72,11 +72,27 @@ export function openaiBase(proxyUrl, provider) {
  * overridden on purpose: a stray `OPENAI_BASE_URL` from another tool would
  * otherwise route around the tab, which is the one thing this must not do.
  */
+/** `<proxy>/t/<key>/<provider>`: the subscription passthrough base for a vendor. */
+export function passthroughBase(proxyUrl, key, provider) {
+    return `${proxyUrl}/t/${key}/${provider}`;
+}
 export function envFor(input) {
-    const spec = clientFor(input.name);
+    const base = clientFor(input.name);
     const known = input.name in KNOWN;
+    const auth = input.auth ?? "key";
     const env = { ...(input.base ?? process.env) };
+    // Codex: pinned to the API key on a metered tab, to the ChatGPT login on a subscription.
+    const spec = base.isolatedHome === "codex"
+        ? { ...base, args: ["-c", auth === "subscription" ? 'preferred_auth_method="chatgpt"' : 'preferred_auth_method="apikey"'] }
+        : base;
     const setAnthropic = () => {
+        if (auth === "subscription") {
+            // Claude Code signs in with its own Claude account; FlockTab only moves the base URL.
+            env.ANTHROPIC_BASE_URL = passthroughBase(input.proxyUrl, input.presentedKey, "anthropic");
+            delete env.ANTHROPIC_API_KEY;
+            delete env.ANTHROPIC_AUTH_TOKEN;
+            return;
+        }
         env.ANTHROPIC_BASE_URL = input.proxyUrl;
         env.ANTHROPIC_API_KEY = input.presentedKey;
         // Claude Code prefers an auth token when one is set; make sure a stale
@@ -84,6 +100,13 @@ export function envFor(input) {
         delete env.ANTHROPIC_AUTH_TOKEN;
     };
     const setOpenAI = () => {
+        if (auth === "subscription") {
+            // Only Codex has a subscription route (its own home points at it); a
+            // plain OpenAI key would bypass the plan, so none is set.
+            delete env.OPENAI_BASE_URL;
+            delete env.OPENAI_API_KEY;
+            return;
+        }
         env.OPENAI_BASE_URL = openaiBase(input.proxyUrl, spec.provider);
         env.OPENAI_API_KEY = input.presentedKey;
     };
@@ -99,5 +122,6 @@ export function envFor(input) {
     }
     // So the child, and anything it spawns, can tell it is on a tab.
     env.FLOCKTAB_PROXY_URL = input.proxyUrl;
+    env.FLOCKTAB_AUTH_MODE = auth;
     return { spec, env };
 }

package/dist/codex-home.js

@@ -10,8 +10,10 @@
  *
  * The person's own `~/.codex` is never read or written.
  */
-import { chmod, mkdir, writeFile } from "node:fs/promises";
+import { chmod, copyFile, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
 import path from "node:path";
+import { passthroughBase } from "./clients.js";
 export function codexAuthJson(presentedKey) {
     return `${JSON.stringify({ auth_mode: "apikey", OPENAI_API_KEY: presentedKey })}\n`;
 }
@@ -19,6 +21,20 @@ export function codexAuthJson(presentedKey) {
 export function codexProviderId(mode) {
     return mode === "self-hosted" ? "FlockTab - Self-hosted" : "FlockTab - Hosted";
 }
+/**
+ * On a ChatGPT subscription Codex talks to `chatgpt_base_url` with its own
+ * login, so that is what moves: to the passthrough, where the tab keeps the
+ * record. No provider block; the default OpenAI provider is the ChatGPT one.
+ */
+export function codexSubscriptionToml(proxyUrl, presentedKey, model) {
+    const lines = [
+        `preferred_auth_method = "chatgpt"`,
+        `chatgpt_base_url = ${JSON.stringify(`${passthroughBase(proxyUrl, presentedKey, "openai")}/backend-api/`)}`,
+        ...(model ? [`model = ${JSON.stringify(model)}`] : []),
+        ``,
+    ];
+    return lines.join("\n");
+}
 export function codexConfigToml(proxyUrl, model, mode = "hosted") {
     const id = codexProviderId(mode);
     const lines = [
@@ -41,9 +57,46 @@ export async function prepareCodexHome(input) {
     await chmod(home, 0o700);
     const auth = path.join(home, "auth.json");
     const config = path.join(home, "config.toml");
-    await writeFile(auth, codexAuthJson(input.presentedKey), { mode: 0o600 });
-    await writeFile(config, codexConfigToml(input.proxyUrl, input.model, input.mode ?? "hosted"), { mode: 0o600 });
-    await chmod(auth, 0o600);
+    if (input.auth === "subscription") {
+        await adoptChatGptLogin(auth, input.userCodexHome ?? path.join(homedir(), ".codex"));
+        await writeFile(config, codexSubscriptionToml(input.proxyUrl, input.presentedKey, input.model), { mode: 0o600 });
+    }
+    else {
+        await writeFile(auth, codexAuthJson(input.presentedKey), { mode: 0o600 });
+        await chmod(auth, 0o600);
+        await writeFile(config, codexConfigToml(input.proxyUrl, input.model, input.mode ?? "hosted"), { mode: 0o600 });
+    }
     await chmod(config, 0o600);
     return home;
 }
+/**
+ * The ChatGPT login for the tab's Codex home. A login already there (from
+ * `codex login` run through `tab codex`) stays. Otherwise the person's own
+ * `~/.codex/auth.json` is copied, owner-only: same machine, same person,
+ * and `~/.codex` itself is still never written. A leftover API-key auth
+ * file from metered mode is replaced; with nothing to copy, Codex asks the
+ * person to sign in and keeps that login in the tab home.
+ */
+async function adoptChatGptLogin(auth, userCodexHome) {
+    const isApiKey = async (file) => {
+        try {
+            const parsed = JSON.parse(await readFile(file, "utf8"));
+            return parsed.auth_mode === "apikey" || (typeof parsed.OPENAI_API_KEY === "string" && parsed.OPENAI_API_KEY.startsWith("ft_"));
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const existing = await isApiKey(auth);
+    if (existing === false)
+        return "kept";
+    if (existing === true)
+        await unlink(auth).catch(() => undefined);
+    const theirs = path.join(userCodexHome, "auth.json");
+    if ((await isApiKey(theirs)) === false) {
+        await copyFile(theirs, auth);
+        await chmod(auth, 0o600);
+        return "copied";
+    }
+    return "none";
+}

package/dist/manage.js

@@ -59,6 +59,7 @@ export function parseFlags(argv) {
     }
     return flags;
 }
+const mode = (t) => (t.authMode === "subscription" ? `${yellow("plan")}${t.subscriptionPlan ? dim(` ${t.subscriptionPlan}`) : ""}` : "meter");
 async function tabsOf(call) {
     return (await call("GET", "/api/cli/tabs")).tabs;
 }
@@ -92,7 +93,7 @@ export async function list(config, flags) {
     const tabs = await tabsOf(api(config));
     emit(flags.json, { tabs }, () => tabs.length === 0
         ? dim("No Agents yet. Run tab claude or tab codex in a project folder.")
-        : table(["agent", "state", "spent", "cap", "used", "window", "project"], tabs.map((t) => [t.name === t.slug ? t.slug : `${t.name} ${dim(t.slug)}`, state(t.state), money(t.spentCents), money(t.capCents), pct(t.spentCents, t.capCents), t.window, t.projectName ?? dim("-")]), { right: [2, 3, 4] }));
+        : table(["agent", "state", "mode", "spent", "cap", "used", "window", "project"], tabs.map((t) => [t.name === t.slug ? t.slug : `${t.name} ${dim(t.slug)}`, state(t.state), mode(t), money(t.spentCents), money(t.capCents), pct(t.spentCents, t.capCents), t.window, t.projectName ?? dim("-")]), { right: [3, 4, 5] }));
     return 0;
 }
 export async function setState(config, flags, next) {
@@ -139,6 +140,49 @@ export async function archive(config, flags, ask) {
     emit(flags.json, { tab, archived: true }, () => `${bold(tab.name)} archived.`);
     return 0;
 }
+/**
+ * `tab use --subscription [--plan "Claude Max 5x"] [--price 100]` and
+ * `tab use --api-key`: which login the Agent runs on. On a subscription the
+ * vendor's plan pays; the tab still gates every call and records it at list
+ * price as a shadow row, and the seat's monthly price sits beside the meter
+ * in the project rollup.
+ */
+export async function setAuthMode(config, flags, given, authMode) {
+    const call = api(config);
+    const slug = await resolveSlug(call, given);
+    const body = { authMode };
+    if (flags.opts.plan !== undefined)
+        body.subscriptionPlan = flags.opts.plan;
+    if (flags.opts.price !== undefined)
+        body.subscriptionMonthlyDollars = flags.opts.price.replace(/^\$/, "");
+    const { tab } = await call("PATCH", `/api/cli/tabs/${encodeURIComponent(slug)}`, body);
+    emit(flags.json, { tab }, () => authMode === "subscription"
+        ? `${bold(tab.name)} runs on a subscription${tab.subscriptionPlan ? ` (${tab.subscriptionPlan}${tab.subscriptionMonthlyCents ? `, ${money(tab.subscriptionMonthlyCents)}/mo` : ""})` : ""}.\n` +
+            `${dim("tab claude uses your own Claude login, tab codex your ChatGPT login. The kill switch and policies still apply; calls land in the ledger at list price, never on the tab's spend.")}`
+        : `${bold(tab.name)} is back on the metered tab: the flock's provider key, charged to the cap.`);
+    return 0;
+}
+/** `tab quota [agent]`: what the vendor said the plan has left, on the last call. */
+export async function quota(config, flags) {
+    const call = api(config);
+    const slug = await resolveSlug(call, flags.args[0]);
+    const { tab, quota: windows } = await call("GET", `/api/cli/tabs/${encodeURIComponent(slug)}/quota`);
+    emit(flags.json, { tab, quota: windows }, () => {
+        if (tab.authMode !== "subscription")
+            return `${bold(tab.name)} is on the metered tab; ${dim("tab use --subscription")} puts it on a plan.`;
+        if (windows.length === 0)
+            return `${bold(tab.name)}: no quota reported yet. It shows after the first call through tab claude or tab codex.`;
+        const left = (w) => {
+            const pctLeft = Math.max(0, 100 - w.usedPct);
+            const paint = pctLeft <= 10 ? red : pctLeft <= 30 ? yellow : green;
+            return paint(`${pctLeft}% left`);
+        };
+        const when = (iso) => (iso ? new Date(iso).toLocaleString() : dim("-"));
+        return (`${bold(tab.name)}${tab.subscriptionPlan ? dim(`  ${tab.subscriptionPlan}`) : ""}\n` +
+            table(["provider", "window", "used", "left", "resets", "seen"], windows.map((w) => [w.provider, w.window, `${w.usedPct}%`, left(w), when(w.resetsAt), when(w.observedAt)]), { right: [2] }));
+    });
+    return 0;
+}
 function listOpt(raw) {
     if (raw === undefined)
         return undefined;

package/dist/proxy-bin.js

@@ -13,7 +13,7 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { configDir } from "./config.js";
 /** The proxy release `tab up` fetches. Bump with each proxy tag. */
-export const PROXY_VERSION = "0.1.1";
+export const PROXY_VERSION = "0.1.3";
 export const RELEASES = "https://github.com/joseairosa/flocktab/releases/download";
 export function targetFor(platform = process.platform, arch = process.arch) {
     if (platform === "darwin")

package/dist/version.js

@@ -1,2 +1,2 @@
 /** Written by scripts/write-version.mjs from package.json at build; `tab version` prints it. */
-export const TAB_VERSION = "0.1.4";
+export const TAB_VERSION = "0.1.6";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanamorilabs/tab",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Run any AI agent on a FlockTab tab: tab claude, tab codex, tab <command>.",
   "license": "MIT",
   "type": "module",
@@ -22,11 +22,11 @@
     "prepublishOnly": "pnpm build"
   },
   "optionalDependencies": {
-    "@hanamorilabs/flocktab-proxy-darwin-arm64": "0.1.1",
-    "@hanamorilabs/flocktab-proxy-darwin-x64": "0.1.1",
-    "@hanamorilabs/flocktab-proxy-linux-x64": "0.1.1",
-    "@hanamorilabs/flocktab-proxy-linux-arm64": "0.1.1",
-    "@hanamorilabs/flocktab-proxy-win-x64": "0.1.1"
+    "@hanamorilabs/flocktab-proxy-darwin-arm64": "0.1.3",
+    "@hanamorilabs/flocktab-proxy-darwin-x64": "0.1.3",
+    "@hanamorilabs/flocktab-proxy-linux-x64": "0.1.3",
+    "@hanamorilabs/flocktab-proxy-linux-arm64": "0.1.3",
+    "@hanamorilabs/flocktab-proxy-win-x64": "0.1.3"
   },
   "devDependencies": {
     "@types/node": "^22.18.6",