@indigoai-us/hq-cli 5.345.92 → 5.345.94

package/dist/lib/capacity/collect.js

@@ -0,0 +1,164 @@
+/**
+ * One-shot capacity collection (US-011).
+ *
+ * The daemon is the resident collector. This runs the same readers once
+ * into whatever ledger root the caller passes, so a check never writes
+ * ~/.hq/capacity unless that root is requested.
+ */
+import { execFile } from "node:child_process";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { listCapacityAccounts } from "./accounts.js";
+import { ingestCodexResult, isCodexProcessRunning, latestCodexSessionWriteAt, readCodexAppServer, readInstalledCodexVersion, shouldReadAppServer, tailCodexSessions, } from "./collectors/codex.js";
+import { collectClaudeOAuth, } from "./collectors/claude-oauth.js";
+import { consumeClaudeStatuslineSpool } from "./collectors/claude-statusline.js";
+import { collectGrok } from "./collectors/grok.js";
+import { capacityRoot, rebuildNow, } from "./ledger.js";
+export async function collectCapacityOnce(options = {}) {
+    const env = options.env ?? process.env;
+    const root = options.root ?? capacityRoot(env, options.home);
+    const ledger = {
+        root,
+        env,
+        home: options.home,
+        ...(options.now ? { now: options.now } : {}),
+    };
+    const accounts = options.accounts
+        ? [...options.accounts]
+        : listCapacityAccounts({
+            home: options.home,
+            hqRoot: options.hqRoot,
+            hostname: options.hostname,
+            env,
+        });
+    const claude = accounts.filter((account) => account.provider === "claude");
+    const codex = accounts.filter((account) => account.provider === "codex");
+    const grok = accounts.filter((account) => account.provider === "grok");
+    await collectClaudeOAuth({
+        ledger,
+        now: options.now,
+        allowDisabled: true,
+        accounts: claude.map((account) => ({ label: account.label, home: account.home })),
+        ...options.claude,
+    });
+    await collectCodexHomes(codex, ledger, options);
+    await collectGrok({
+        ledger,
+        now: options.now,
+        allowDisabled: true,
+        accounts: grok.map((account) => ({ label: account.label, home: account.home })),
+        ...options.grok,
+    });
+    if (options.includeSpool !== false) {
+        consumeClaudeStatuslineSpool({
+            root,
+            now: options.now ? options.now() : new Date(),
+            accounts: claude.map((account) => ({ label: account.label, home: account.home })),
+        });
+    }
+    return rebuildNow(ledger);
+}
+async function collectCodexHomes(accounts, ledger, options) {
+    const groups = new Map();
+    for (const account of accounts) {
+        const key = path.resolve(account.home);
+        const group = groups.get(key) ?? { home: account.home, labels: [] };
+        if (!group.labels.includes(account.label))
+            group.labels.push(account.label);
+        groups.set(key, group);
+    }
+    let cliVersion = options.codex?.cliVersion;
+    if (!cliVersion) {
+        try {
+            cliVersion = await readInstalledCodexVersion(options.codex?.spawn);
+        }
+        catch {
+            cliVersion = "unknown";
+        }
+    }
+    const now = options.now ? options.now() : new Date();
+    const processes = options.codex?.skipAppServer ? "codex" : await processListAsync();
+    const root = ledger.root;
+    let state = root ? readTailState(root) : undefined;
+    for (const group of groups.values()) {
+        const label = group.labels.find((item) => item !== "default") ?? group.labels[0] ?? "default";
+        const sessionsDir = path.join(group.home, "sessions");
+        try {
+            const tailed = tailCodexSessions({
+                sessionsDir,
+                state,
+                cliVersion,
+                now,
+                recentDays: 2,
+                accountId: `home:${path.resolve(group.home)}`,
+                accountLabel: label,
+                accountLabels: group.labels,
+                accountHome: group.home,
+            });
+            ingestCodexResult(tailed, ledger);
+            state = tailed.state;
+            if (root)
+                writeTailState(root, state);
+        }
+        catch {
+            // One home's tail must not stop the others.
+        }
+        if (options.codex?.skipAppServer)
+            continue;
+        const lastWrite = latestCodexSessionWriteAt(sessionsDir);
+        if (!shouldReadAppServer({
+            lastSessionWriteAt: lastWrite,
+            codexProcessRunning: isCodexProcessRunning(processes),
+            now: now.getTime(),
+        }))
+            continue;
+        try {
+            const result = await readCodexAppServer({
+                cliVersion,
+                now,
+                home: group.home,
+                accountId: `home:${path.resolve(group.home)}`,
+                accountLabel: label,
+                accountLabels: group.labels,
+                accountHome: group.home,
+                spawn: options.codex?.spawn,
+                timeoutMs: 20_000,
+            });
+            ingestCodexResult(result, ledger);
+        }
+        catch {
+            // A refused or busy app-server is not a credential read.
+        }
+    }
+}
+const TAIL_STATE_FILE = "codex-tail-state.json";
+function readTailState(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(root, TAIL_STATE_FILE), "utf8"));
+        if (!parsed || typeof parsed !== "object" || !parsed.files)
+            return undefined;
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeTailState(root, state) {
+    const dest = path.join(root, TAIL_STATE_FILE);
+    const tmp = `${dest}.${process.pid}.tmp`;
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(tmp, `${JSON.stringify(state)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, dest);
+    fs.chmodSync(dest, 0o600);
+}
+function processListAsync() {
+    return new Promise((resolve) => {
+        execFile("ps", ["-ax", "-o", "command="], { timeout: 5_000, encoding: "utf8" }, (error, stdout) => {
+            if (error)
+                resolve("");
+            else
+                resolve(typeof stdout === "string" ? stdout : "");
+        });
+    });
+}
+//# sourceMappingURL=collect.js.map

package/dist/lib/capacity/collectors/claude-oauth.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Claude OAuth usage collector (US-005).
+ *
+ * Reads the Claude Code credential read-only (macOS Keychain item
+ * `Claude Code-credentials`, plus `Claude Code-credentials-<hash>` seats,
+ * or the credentials JSON under ~/.claude/ on Linux). GETs
+ * https://api.anthropic.com/api/oauth/usage with the oauth-2025-04-20 beta
+ * header. This module does not refresh the token, write the Keychain or
+ * ~/.claude, call an OAuth token endpoint, or invoke the claude CLI except
+ * `claude --version` when the caller does not pass cliVersion.
+ *
+ * The legacy shape (seven_day_opus populated, no limits[]) is drift.
+ * observedAt is the response time. One collect appends every account's
+ * readings and failures in one rebuild.
+ */
+import { type LedgerOptions, type NowView, type ParserFailureEvent, type ReadingInput } from "../ledger.js";
+export declare const CLAUDE_OAUTH_PARSER_VERSION = "claude-oauth-usage.1";
+export declare const CLAUDE_OAUTH_PROVIDER = "claude";
+export declare const CLAUDE_OAUTH_SOURCE: "oauth-usage";
+export declare const CLAUDE_OAUTH_URL = "https://api.anthropic.com/api/oauth/usage";
+export declare const CLAUDE_OAUTH_PROFILE_URL = "https://api.anthropic.com/api/oauth/profile";
+export declare const CLAUDE_OAUTH_BETA = "oauth-2025-04-20";
+export declare const CLAUDE_ORG_CACHE_MS: number;
+export declare const CLAUDE_ORG_CACHE_FILE = "claude-org-cache.json";
+export declare const CLAUDE_OAUTH_POLL_MS: number;
+/** Freshness is shorter than the 5 minute tick so the next tick is not skipped. */
+export declare const CLAUDE_OAUTH_FRESH_MS: number;
+export declare const CLAUDE_OAUTH_KEYCHAIN_BACKOFF_MS: number;
+export declare const CLAUDE_OAUTH_FETCH_TIMEOUT_MS = 10000;
+export declare const CLAUDE_OAUTH_SECURITY_TIMEOUT_MS = 5000;
+export declare const CLAUDE_OAUTH_POLL_FILE = "claude-oauth-last-call.json";
+export declare const CLAUDE_KEYCHAIN_SERVICE = "Claude Code-credentials";
+export interface ClaudeOAuthFetchInit {
+    method: "GET";
+    headers: Record<string, string>;
+    redirect: "manual";
+    signal?: AbortSignal;
+}
+export type ClaudeOAuthFetch = (url: string, init: ClaudeOAuthFetchInit) => Promise<{
+    status: number;
+    text: () => Promise<string>;
+    headers?: {
+        get(name: string): string | null;
+    };
+}>;
+export interface SecurityExecResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+export type SecurityExec = (args: readonly string[], timeoutMs: number) => SecurityExecResult;
+export type ClaudeKeychainStatus = "no-prompt" | "prompt" | "timeout" | "error";
+export interface ClaudeCredentialAccount {
+    token: string;
+    /** Already hashed. Raw org ids and keychain account names are not accepted here. */
+    accountId: string;
+    expiresAt?: number | null;
+    scopes?: readonly string[] | null;
+    planType?: string | null;
+}
+export interface ReadClaudeCredentialsResult {
+    keychain: ClaudeKeychainStatus;
+    accounts: ClaudeCredentialAccount[];
+}
+export type ReadClaudeCredentials = () => ReadClaudeCredentialsResult;
+export interface ClaudeOAuthCollectResult {
+    readings: ReadingInput[];
+    failures: ParserFailureEvent[];
+    view: NowView | null;
+    skipped?: "disabled" | "rate-limit" | "keychain-backoff";
+    keychain: ClaudeKeychainStatus;
+    httpStatus: number | null;
+    accountIds: string[];
+}
+export interface CollectClaudeOAuthOptions {
+    /** Linux credentials JSON. When set, the Keychain is not read. */
+    credentialsPath?: string;
+    /** Replaces Keychain and credentials-file discovery. */
+    readCredentials?: ReadClaudeCredentials;
+    /** Replaces `security`. Used by the default Keychain reader. */
+    securityExec?: SecurityExec;
+    endpoint?: string;
+    cliVersion?: string;
+    readVersion?: () => string;
+    now?: () => Date;
+    fetchImpl?: ClaudeOAuthFetch;
+    ledger?: LedgerOptions;
+    platform?: NodeJS.Platform;
+    /** Keychain account attribute used when discovery is not available. */
+    keychainAccount?: string;
+    /**
+     * When set, read each home instead of the unscoped keychain dump.
+     * One entry per label. Homes that resolve to the same path are one read.
+     */
+    accounts?: readonly {
+        label: string;
+        home: string;
+    }[];
+    /** One-shot collect reads while the resident collector stays disabled. */
+    allowDisabled?: boolean;
+}
+interface MapOptions {
+    observedAt: string;
+    cliVersion: string;
+    accountId: string;
+    planType: string | null;
+    accountLabel?: string;
+    accountLabels?: string[];
+    organization?: string | null;
+    accountHome?: string;
+}
+export declare function claudeOAuthPollPath(root: string): string;
+export declare function defaultClaudeCredentialsPath(home?: string): string;
+/**
+ * Claude Code's keychain service for a config dir.
+ * The default home uses `Claude Code-credentials`. Any other resolved
+ * path uses that name plus the first 8 hex chars of SHA-256(utf8 path).
+ */
+export declare function claudeKeychainServiceName(configDir: string, defaultConfigDir?: string): string;
+export declare function parseClaudeCliVersion(text: string): string | null;
+/** Map a usage JSON body. Does not read credentials or call the network. */
+export declare function mapClaudeOAuthUsage(body: unknown, options: MapOptions): {
+    readings: ReadingInput[];
+    failures: ParserFailureEvent[];
+};
+export declare function collectClaudeOAuth(options?: CollectClaudeOAuthOptions): Promise<ClaudeOAuthCollectResult>;
+/**
+ * Ledger account id → hashed profile account id. Rows with no captured
+ * identity are omitted. The raw uuid is never returned.
+ */
+export declare function claudeIdentityKeys(root: string): ReadonlyMap<string, string>;
+/**
+ * Claude names an individual plan's organization "<email>'s Organization".
+ * The ledger never stores an email, so such a name becomes the email's
+ * domain (for example "getindigo.ai"), or "Personal" for a consumer mail
+ * domain. Any other name containing "@" is dropped.
+ */
+export declare function displayOrganization(name: string): string | null;
+export declare function claudeSeatAccountId(seat: string, orgId: string | null): string;
+export declare function readInstalledClaudeVersion(readVersion?: () => string): string;
+/** Async `claude --version` for the daemon. The sync reader stays for one-shot callers. */
+export declare function readInstalledClaudeVersionAsync(): Promise<string>;
+export {};
+//# sourceMappingURL=claude-oauth.d.ts.map