@hystudio/dsh-quota-pill 0.2.7 → 0.2.12

package/AGENTS.md

@@ -9,6 +9,39 @@ the human only for things only they can supply (an API key, an OAuth login).
 
 ---
 
+## Before 1: install the bundle into DSH
+
+This guide assumes the **bundle** is installed and enabled, not just the sidecar.
+For a fresh DSH Desktop:
+
+1. If `dsh` is not on PATH: DSH Desktop → Settings → **Manage dsh Command**.
+2. Install a **pinned** build, never the bare name:
+   - GUI: **Plugins → Install** → `@hystudio/dsh-quota-pill@0.2.12`
+   - CLI: `dsh plugin add @hystudio/dsh-quota-pill@0.2.12 --profile desktop`
+   - If pnpm's minimumReleaseAge rejects the fresh 0.2.12 release, use the
+     branch until it ages: `github:598934321/dsh-quota-pill#master`
+3. Confirm the dependency and the bundle are present:
+
+   ```bash
+   python3 - <<'PY'
+   import json, os
+   p = os.path.expanduser('~/.dsh/profiles/desktop/package.json')
+   d = json.load(open(p))
+   print(d.get('dependencies', {}).get('@hystudio/dsh-quota-pill'))
+   print('enabled:', '@hystudio/dsh-quota-pill' in d.get('dsh', {}).get('profile', {}).get('bundles', []))
+   PY
+   ```
+
+**Why pinned:** pnpm's `minimumReleaseAge` can resolve an unpinned install to the
+broken 0.2.2 (its client half fails to import and the web GUI shows "Failed to
+load plugins"). 0.2.12 is the first version with all providers, Open Design
+Control Keys, sidecar auto-start, and user-defined adapters.
+
+The host half starts the sidecar when nothing is listening on :8319, so a normal
+desktop install does **not** need a separate `npx` or launchd unit.
+
+---
+
 ## 0. What this plugin does
 
 It shows how much quota is **left** for the LLM subscriptions the user has, in a
@@ -33,7 +66,7 @@ There are **two credential families**, and this matters for every step:
 | DSH Platform sign-in | `deepseek` | **nothing** — works if they are signed in to DeepSeek Platform in DSH |
 | API key | `kimi`, `opencode`, `commandcode` | a key pasted into `~/.dsh/.credentials.yaml` |
 | OAuth via CLIProxyAPI | `xai`, `codex`, `agy` | **CLIProxyAPI installed and logged in once** |
-| Console session cookie | `opendesign` | the `__Secure-better-auth.session_token` cookie from the Open Design cloud dashboard |
+| Open Design Control Key | `opendesign` | a `vela_ctrl_…` Control Key from the Open Design device sign-in, plus the workspace id (optional); a `__Secure-better-auth.session_token` console cookie is a fallback |
 
 **Check DeepSeek first.** It is the official account and needs no setup beyond a
 DSH Platform sign-in, so it is usually the one the user actually wants. If it
@@ -44,6 +77,10 @@ DSH account menu, then re-run step 5.
 
 ## 1. Verify the sidecar runs
 
+The 0.2.12 host plugin starts it automatically when :8319 is free. Give DSH a few
+seconds, then check. If the host half could not start it (or you opted out with
+`QUOTA_PILL_NO_AUTOSTART=1`), run it manually:
+
 ```bash
 npx @hystudio/dsh-quota-pill
 ```
@@ -60,7 +97,7 @@ Then, in another shell:
 
 ```bash
 curl -s http://127.0.0.1:8319/health
-# {"ok":true,"port":8319,"providers":["kimi","opencode","commandcode","xai","codex","agy"]}
+# {"ok":true,"port":8319,"providers":["deepseek","kimi","opencode","commandcode","xai","codex","agy","opendesign"]}
 ```
 
 If `CLIProxyAPI: not set up`, the three OAuth providers will report "needs
@@ -68,36 +105,114 @@ CLIProxyAPI". That is expected on a fresh machine — tell the human that
 `kimi` / `opencode` / `commandcode` work without it, and ask whether they want
 the OAuth three as well.
 
-**Keep it running.** Do not leave it in the foreground of a terminal the human
-will close. Offer a background service (launchd on macOS, systemd on Linux):
+**Auto-start is the default from 0.2.12**; do not add a service unless the human
+asks for one or DSH is headless. If you do add one, set
+`QUOTA_PILL_NO_AUTOSTART=1` so the plugin and the service do not race, and use
+the **absolute** Node path (launchd's PATH does not include nvm/homebrew):
 
 ```bash
 # macOS: ~/Library/LaunchAgents/dev.quota-pill.plist
-#   ProgramArguments: ["/usr/bin/env","node","<abs path>/bin/quota-pill-server.js"]
+#   ProgramArguments: ["/absolute/path/to/node","<abs path>/bin/quota-pill-server.js"]
 #   RunAtLoad: true
 #   KeepAlive: true
+#   EnvironmentVariables: { QUOTA_PILL_NO_AUTOSTART: "1" }
 ```
 
 Ask before installing a service — that is a persistent change to their machine.
 
 ---
 
-## 2. Ask which providers the user actually has
+## 2. Discover and configure automatically
+
+**Do not ask the user which providers they have.** Enumerate DSH's catalog
+yourself, build the worklist, and configure everything that is possible. The only
+things to ask for are secrets/approvals that the agent cannot supply.
+
+1. **DSH catalog + supported adapters + required refs:**
+
+   ```bash
+   curl -s 'http://127.0.0.1:8319/setup?fresh=1' | python3 -m json.tool
+   ```
+
+   Read catalog (DSH's live session/modelCatalog), unadaptedCatalog,
+   userAdapters, and each entry in providers (inCatalog, requires, credential).
+   This is the authoritative "what can DSH route to" list.
+
+2. **What is already readable:**
+
+   ```bash
+   curl -s 'http://127.0.0.1:8319/quota/all?fresh=1' | python3 -m json.tool
+   ```
+
+3. **Credential files** (names only; never print values):
+   ~/.dsh/.credentials.yaml refs, and ~/.cli-proxy-api/* token files.
+
+Then act on the classification — do not present a menu:
+
+| Situation | Agent action |
+|---|---|
+| Already readable | verify it, include the number in the report |
+| Supported + in catalog, missing credential | configure it; if a secret is required, ask for that exact ref only |
+| Unadapted catalog id / provider "unknown" | do not fake a reading; follow §2b and add it to the final report |
+| In catalog but not supported and user does not want to adapt | say so; leave it out |
+
+Only these need the human: paste a missing API key, install/login CLIProxyAPI,
+or approve the Open Design device page. DeepSeek needs nothing. Do not ask
+"which provider would you like me to set up?" — set up every available one.
+
+If the user truly has no providers at all: stop and say the plugin has nothing to
+show yet. Do not install a fake provider to "make it look working".
 
-Do **not** guess. Ask, in one message, listing the options with what each needs:
+---
+
+## 2b. Adapting a provider the plugin does not know
+
+When the Current page cannot read a model's provider, it shows a hint and a
+"复制提示词 / Copy prompt" button. That button copies the full instruction below
+into the clipboard; the human can paste it into a new session. As an agent, you
+can also start from this section directly.
+
+The adaptation is a **user adapter**, not a package edit:
+
+- Directory: ~/.dsh/quota-pill/adapters (created by the sidecar)
+- File: <provider>.mjs
+- It is outside the npm package, so **plugin updates never overwrite it**
+- The sidecar discovers it on the next request/Refresh; no restart
+
+Steps:
+
+1. curl /setup?fresh=1; find the unknown id in catalog / unadaptedCatalog, and
+   check existing files in ~/.dsh/quota-pill/adapters (do not overwrite a working
+   adapter for a different provider).
+2. Find the provider's real quota API and credential. An inference key is not a
+   quota key; never infer a number from model prices or a guess.
+3. Write ~/.dsh/quota-pill/adapters/<provider>.mjs:
+
+   ```js
+   export const provider = 'acme';
+   export const catalogIds = ['acme-go'];       // DSH catalog/model ids
+   export const displayName = 'Acme';
+   export const credential = { kind: 'api-key', refs: ['ACME_API_KEY'] };
+   export async function read(ctx) {
+     // ctx.model, ctx.readRef, ctx.readFirstRef, ctx.getJson,
+     // ctx.getJsonViaCurl, ctx.postJsonViaCurl, ctx.env, ctx.dshHome
+     const key = ctx.readFirstRef(['ACME_API_KEY']);
+     if (!key) return { kind: 'none', provider: 'acme', error: 'no ACME_API_KEY' };
+     const r = await ctx.getJson('https://api.acme.example/usage', { token: key });
+     if (!r.ok) return { kind: 'probe-failed', provider: 'acme', error: r.error };
+     return { kind: 'subscription-quota', provider: 'acme', remainingPct: 80, window: '5h' };
+   }
+   ```
 
-> I can read quota for six providers. Which do you have?
->
-> - **DeepSeek** — works already if you are signed in to DeepSeek Platform in DSH
-> - **Kimi Coding** — needs a `KIMI_CODING_API_KEY`
-> - **OpenCode Go** — needs an `OPENCODE_GO_API_KEY`
-> - **Command Code** — needs a `COMMANDCODE_API_KEY`
-> - **xAI / Grok**, **Codex / ChatGPT Plus**, **Antigravity** — need CLIProxyAPI installed and logged in
->
-> Tell me which ones, and paste the key for any of the first three.
+   Return the same kinds as built-ins: subscription-quota (with
+   remainingPct/windows), payg (with credits.remain), usage-only, none (missing
+   credential; explain in error) or probe-failed. Never invent a number.
+4. Verify with curl 'http://127.0.0.1:8319/quota?model=<model>&fresh=1'; if it
+   fails, say exactly what is missing.
+5. Run /quota/all?fresh=1 and /setup?fresh=1 and report adapted/unadapted.
 
-If they have none of them: stop and say the plugin has nothing to show yet.
-Do not install a fake provider to "make it look working".
+The user adapter contract is also documented in src/user-adapters.js; read it
+before writing the file. Do not put user adapters inside the installed package.
 
 ---
 
@@ -110,7 +225,7 @@ it usually already exists and contains other credentials that must not be lost.
 refs:
   KIMI_CODING_API_KEY: sk-...
   OPENCODE_GO_API_KEY: sk-...
-  COMMANDCODE_API_KEY: sk-...
+  COMMANDCODE_API_KEY: sk-...          # or reuse COMMANDCODE_GOAT_API_KEY
 ```
 
 Rules:
@@ -128,7 +243,7 @@ python3 - <<'PY'
 import yaml, os
 d = yaml.safe_load(open(os.path.expanduser('~/.dsh/.credentials.yaml')))
 refs = d.get('refs') or {}
-for k in ('KIMI_CODING_API_KEY','OPENCODE_GO_API_KEY','COMMANDCODE_API_KEY'):
+for k in ('KIMI_CODING_API_KEY','OPENCODE_GO_API_KEY','COMMANDCODE_API_KEY','COMMANDCODE_GOAT_API_KEY'):
     print(f'{k}: ' + ('present' if refs.get(k) else 'MISSING'))
 PY
 ```
@@ -163,6 +278,52 @@ the OAuth flow itself.
    reports the `X-Codex-*` headers CLIProxyAPI observed. Without it running, the
    fallback hits `chatgpt.com`, which blocks non-browser TLS and returns 403.
 
+### Open Design (optional)
+
+Open Design quota uses a **Control Key** (`vela_ctrl_…`), not the `sk-amr-…`
+inference key. Run the bundled device sign-in and approve its URL in the user's
+browser:
+
+```bash
+node bin/opendesign-login.js --write
+```
+
+That writes `OPENDESIGN_CONTROL_KEY` and `OPENDESIGN_WORKSPACE_ID` into
+`~/.dsh/.credentials.yaml`. A console session cookie
+(`OPENDESIGN_SESSION_COOKIE`) is still accepted as a fallback. If the user only
+has an inference key, skip Open Design — an inference key returns 401 on the
+control plane.
+
+---
+
+## 4b. Adding or removing a provider later
+
+No restart/reinstall is needed for supported providers:
+
+| Change | When it appears |
+|---|---|
+| New credential for a supported provider already in the DSH catalog | next `/quota/all` (All refresh); no sidecar restart |
+| New provider group added to DSH's catalog | within the 2-minute catalog TTL, or immediately with `/quota/all?fresh=1` / **Refresh** / reopening All |
+| Provider removed from DSH | same: next refresh removes it |
+| Brand-new provider **type** (not one of the eight adapters) | needs a user adapter in ~/.dsh/quota-pill/adapters (see §2b); the catalog alone is not enough |
+
+The All page reads fresh on open, on **Refresh**, and when DSH regains focus; it
+is not a background poll. /setup?fresh=1 is the quickest way for an agent to see
+the current catalog, `unadaptedCatalog`, and which supported provider it has no
+credential for.
+
+---
+
+## 4c. After a plugin update
+
+1. **Do not delete** ~/.dsh/quota-pill/adapters; it is outside the package and
+   is the user's adapted providers. An update must never overwrite it.
+2. Restart DSH/sidecar so the new code loads (the host half starts the sidecar).
+3. Run /setup?fresh=1 and compare catalog with the adapted/user providers.
+4. For every id still in unadaptedCatalog, run §2b (add or update the user
+   adapter). Do not remove a working adapter just because the package changed.
+5. Run /quota/all?fresh=1 and report the full provider list again.
+
 ---
 
 ## 5. Verify end to end
@@ -195,6 +356,13 @@ plainly:
 
 - which providers are working
 - which are skipped, and the single action that would enable each
+- the DSH catalog and which ids are still in `unadaptedCatalog` (if any)
+
+**Initial-install summary must include the unknown-provider path:** if
+`unadaptedCatalog` is non-empty (or a current model's provider is unknown), tell
+the user: "这些 provider 还没适配；打开（或重开）当前会话的额度面板，Current 页有
+「复制提示词」按钮，复制到新会话让 agent 按 §2b 适配即可。" The button copies the
+full adapter flow, so the user does not need to explain anything.
 
 Do not paste raw JSON. Do not claim a provider works if it returned `none` or
 `probe-failed`.

package/README.md

@@ -18,11 +18,11 @@ into the live number.
 | **DeepSeek** (official) | the Platform sign-in DSH already holds — nothing to add |
 | **Kimi Coding** | `refs.KIMI_CODING_API_KEY` in `~/.dsh/.credentials.yaml` |
 | **OpenCode Go** | `refs.OPENCODE_GO_API_KEY` |
-| **Command Code** | `refs.COMMANDCODE_API_KEY` |
+| **Command Code** | `refs.COMMANDCODE_API_KEY` or `refs.COMMANDCODE_GOAT_API_KEY` (DSH names it after its `apiKeyEnv`) |
 | **xAI (Grok)** | OAuth token from [CLIProxyAPI](https://github.com/router-for-me/CLIProxyAPI) |
 | **Codex (ChatGPT Plus)** | same — and CLIProxyAPI must be **running** |
 | **Antigravity** | same |
-| **Open Design** (optional) | `refs.OPENDESIGN_SESSION_COOKIE` — the cloud console's session cookie |
+| **Open Design** (optional) | `refs.OPENDESIGN_CONTROL_KEY` (`vela_ctrl_…`) + `refs.OPENDESIGN_WORKSPACE_ID`; a console session cookie (`OPENDESIGN_SESSION_COOKIE`) also works as a fallback |
 
 **DeepSeek works with no setup at all** if you are signed in to DeepSeek Platform
 in DSH — that is the official account, and it is the one most users care about.
@@ -36,22 +36,73 @@ the pill reads DSH's `session/modelCatalog` to learn which providers the app can
 route to, so removing a provider from DSH removes it from the pill too. A provider
 that is present but has no credential is skipped rather than shown as an empty row.
 
+### What "auto-detect" means
+
+- **A new key for a supported provider** (e.g. adding `OPENCODE_GO_API_KEY`)
+  appears on the next All refresh — no DSH restart, no sidecar restart.
+- **A provider newly added to DSH's catalog** appears within the 2-minute catalog
+  TTL, or immediately when you press **Refresh** / reopen the All page (a forced
+  read drops the catalog cache). The All page also re-reads when DSH regains focus.
+- **A brand-new provider type** that is not one of the eight adapters needs a
+  **user adapter** in `~/.dsh/quota-pill/adapters/` (see below); a catalog entry
+  alone cannot invent its quota API.
+
+### Unknown providers and user adapters
+
+If the Current page cannot read the session's provider, it shows a short hint and
+a **复制提示词 / Copy prompt** button. The copied prompt contains the whole
+adaptation flow; paste it into a new session and an agent can add the provider
+without touching package files.
+
+User adapters live in:
+
+```text
+~/.dsh/quota-pill/adapters/<provider>.mjs
+```
+
+They are outside the npm package, so **updating the plugin never overwrites
+them**. The sidecar discovers a new/changed file on the next Refresh (no restart).
+`/setup?fresh=1` reports `unadaptedCatalog` and `userAdapters`, and after a
+plugin update the same check tells the agent which providers still need an
+adapter. The module contract (exports, `read(ctx)`, standard kinds) is documented
+in [`src/user-adapters.js`](src/user-adapters.js) and in AGENTS.md §2b.
+
 ## Install
 
-```bash
-# 1. the DSH plugin
-dsh plugin add @hystudio/dsh-quota-pill
+**DSH Desktop (recommended).** Open **Plugins → Install**, paste a spec, enable
+the bundle. **Pin the version**: an unpinned install can resolve 0.2.2, which
+breaks web boot. 0.2.12 is the first version with every provider, Open Design
+Control Keys, sidecar auto-start, and **user-defined adapters** for providers the
+package does not ship.
 
-# 2. the sidecar (reads credentials, talks to upstream APIs)
-npx @hystudio/dsh-quota-pill
+```text
+@hystudio/dsh-quota-pill@0.2.12
+```
+
+0.2.12 is published on npm. If pnpm's minimumReleaseAge rejects this fresh
+release, install the branch until it ages:
+
+```text
+github:598934321/dsh-quota-pill#master
+```
+
+**CLI.** If `dsh` is not on PATH, open DSH Desktop → Settings → **Manage dsh
+Command** first. Then:
+
+```bash
+dsh plugin add @hystudio/dsh-quota-pill@0.2.12
 ```
 
 > The npm package is `@hystudio/...` while the repo lives at `598934321/...` —
 > they are the same author under two account names.
 
-The pill shows **"quota service is not running"** with that exact command until
-the sidecar is up. Keep it running in the background — see
+**The sidecar now starts automatically with the plugin** (the host half spawns it
+when nothing is listening on :8319), so there is no second command for a normal
+desktop install. If you prefer to manage it yourself, run
+`npx @hystudio/dsh-quota-pill` or a service unit — see
 [Running it as a service](#running-it-as-a-service).
+The pill says **"quota service is not running"** only if :8319 is still closed a
+few seconds after DSH starts.
 
 Then add whichever keys you have:
 
@@ -78,6 +129,10 @@ Read AGENTS.md in this repo and set up dsh-quota-pill for me.
 
 ## Running it as a service
 
+The host plugin already starts the sidecar; this section is only for users who
+want it independent of DSH (server, headless, multiple app profiles). Set
+`QUOTA_PILL_NO_AUTOSTART=1` so the plugin does not race the service.
+
 `npx` in a terminal dies with the terminal. Pick one:
 
 **macOS (launchd)** — `~/Library/LaunchAgents/dev.quota-pill.plist`
@@ -193,13 +248,27 @@ would flicker between models you do not even have configured.
 `monthlyCap = weekly.cap × 2`, an identity verified against two different plans
 (31.6 + 38.4 = 70 with `weekly.cap` 35; 0.225 + 9.775 = 10 with `weekly.cap` 6).
 
-**Open Design** keeps its allowance in the cloud console, not in the API key you
-use for inference. The `amr-link.open-design.ai/v1` gateway has no balance
-endpoint at all; the console's own `amr-api` does, and it authenticates with a
-`__Secure-better-auth.session_token` cookie. That cookie is HttpOnly, so grab it
-from devtools → Application → Cookies. The workspace id is discovered
-automatically. The request goes through system curl because Cloudflare rejects
-Node's TLS fingerprint on that host with `error code: 1010`.
+**Open Design** keeps its allowance in the cloud control plane, not in the
+`sk-amr-…` inference key. The preferred credential is a **Control Key**
+(`vela_ctrl_…`), which is accepted by the Bearer-only
+`/billing/preflight` and `/wallet/balance` endpoints alongside
+`x-vela-workspace-id`. Get one with the bundled device sign-in (the same flow
+as the official `vela login`):
+
+```bash
+npx -p @hystudio/dsh-quota-pill dsh-quota-pill-opendesign-login --write
+```
+
+It prints an activation URL, waits for you to approve it in a signed-in browser,
+then writes `OPENDESIGN_CONTROL_KEY` and `OPENDESIGN_WORKSPACE_ID` into
+`~/.dsh/.credentials.yaml`. The workspace id is optional when using a Control
+Key — it is otherwise resolved from `/workspaces/current`.
+
+The older console-session route (`__Secure-better-auth.session_token` cookie,
+browser-session-only `/billing/coding-plan-usage`) is still supported as a
+fallback; that cookie is HttpOnly, so copy it from devtools → Application →
+Cookies. Both routes go through system curl because Cloudflare rejects Node's
+TLS fingerprint on `amr-api` with `error code: 1010`.
 
 **DeepSeek** is a prepaid CNY wallet, so there is no percentage to show — the pill
 shows the balance and, separately, any bonus credit. Two traps worth recording:
@@ -221,7 +290,7 @@ down to wallet currency and balance. We never handle the Platform token ourselve
 ```bash
 git clone https://github.com/598934321/dsh-quota-pill
 cd dsh-quota-pill
-npm test              # 26 tests, offline
+npm test              # 70 tests, offline
 npm start             # sidecar on :8319
 ```
 

package/bin/opendesign-login.js

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Sign in to Open Design and write the Control Key the quota pill needs.
+ *
+ *   node bin/opendesign-login.js            # print the values and a YAML snippet
+ *   node bin/opendesign-login.js --write    # add/update the two refs in ~/.dsh/.credentials.yaml
+ *
+ * The browser approval page is the same one the Open Design CLI (`vela login`)
+ * and magpie use. Only the Control Key is stored by `--write`; the runtime key
+ * is not needed by the quota pill and is not written.
+ */
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { loginOpenDesign } from '../src/opendesign-auth.js';
+
+const write = process.argv.includes('--write');
+const credentialsFile = path.join(
+  process.env.DSH_HOME || path.join(os.homedir(), '.dsh'),
+  '.credentials.yaml',
+);
+
+function setRef(text, key, value) {
+  const lines = String(text || '').split('\n');
+  const lineRe = new RegExp('^(\\s*)' + key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + ':');
+  const existing = lines.findIndex((line) => lineRe.test(line));
+  if (existing >= 0) {
+    lines[existing] = lines[existing].replace(/^(\s*).*$/, '$1' + key + ': ' + value);
+    return lines.join('\n');
+  }
+  const refsAt = lines.findIndex((line) => /^refs:\s*$/.test(line));
+  if (refsAt >= 0) {
+    lines.splice(refsAt + 1, 0, '  ' + key + ': ' + value);
+    return lines.join('\n');
+  }
+  const base = text && !text.endsWith('\n') ? text + '\n' : String(text || '');
+  return base + 'refs:\n  ' + key + ': ' + value + '\n';
+}
+
+function mask(value) {
+  if (value.length <= 12) return value;
+  return value.slice(0, 10) + '…' + value.slice(-4);
+}
+
+const result = await loginOpenDesign({
+  onDevice(device) {
+    console.log('Open Design sign-in');
+    console.log('  1. Open: ' + (device.activationUrl || '(activation URL missing)'));
+    console.log('  2. Confirm code: ' + device.userCode);
+    console.log('  3. Approve the request in the browser.');
+    console.log('Waiting for approval…');
+  },
+  onPending() {},
+});
+
+console.log('');
+console.log('Signed in' + (result.email ? ' as ' + result.email : '') + '.');
+console.log('Control Key: ' + (write ? mask(result.controlKey) : result.controlKey));
+console.log('Workspace ID: ' + result.workspaceId);
+
+if (!write) {
+  console.log('');
+  console.log('Add these to ' + credentialsFile + ' (keep the others already there):');
+  console.log('refs:');
+  console.log('  OPENDESIGN_CONTROL_KEY: ' + result.controlKey);
+  console.log('  OPENDESIGN_WORKSPACE_ID: ' + result.workspaceId);
+} else {
+  let text = '';
+  try { text = fs.readFileSync(credentialsFile, 'utf8'); } catch { /* new file */ }
+  text = setRef(text, 'OPENDESIGN_CONTROL_KEY', result.controlKey);
+  text = setRef(text, 'OPENDESIGN_WORKSPACE_ID', result.workspaceId);
+  fs.mkdirSync(path.dirname(credentialsFile), { recursive: true });
+  fs.writeFileSync(credentialsFile, text, { mode: 0o600 });
+  try { fs.chmodSync(credentialsFile, 0o600); } catch { /* best effort */ }
+  console.log('');
+  console.log('Written to ' + credentialsFile);
+}
+
+console.log('');
+console.log('Restart the quota-pill sidecar (or launch it again) to pick up the new refs.');