@jameslovespancakes/pi-plus 1.0.0

package/src/core/oauth/pkce.ts

@@ -0,0 +1,88 @@
+/**
+ * PKCE (RFC 7636) helpers.
+ *
+ * Provider-agnostic: nothing here knows about Anthropic. Any OAuth provider we
+ * add later shares this file, and only its endpoints and scopes differ.
+ */
+
+function base64UrlEncode(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+export interface PkcePair {
+  verifier: string;
+  challenge: string;
+  method: "S256";
+}
+
+/** 64 random bytes as the verifier, SHA-256 as the challenge. */
+export async function generatePkce(): Promise<PkcePair> {
+  const buffer = new Uint8Array(64);
+  crypto.getRandomValues(buffer);
+  const verifier = base64UrlEncode(buffer);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: base64UrlEncode(new Uint8Array(digest)), method: "S256" };
+}
+
+/** Opaque anti-CSRF value echoed back by the authorization server. */
+export function generateState(): string {
+  return crypto.randomUUID().replace(/-/g, "");
+}
+
+/**
+ * Accepts whatever the user pasted back: a full callback URL, a bare
+ * `code#state` pair, or a raw query string. Returns undefined when none match.
+ */
+export function parseCallback(input: string): { code: string; state: string } | undefined {
+  const trimmed = input.trim();
+
+  try {
+    const url = new URL(trimmed);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (code && state) return { code, state };
+  } catch {
+    // Not a URL; fall through to the manual formats.
+  }
+
+  const [head, tail] = trimmed.split("#");
+  if (head && tail) return { code: head, state: tail };
+
+  const params = new URLSearchParams(trimmed);
+  const code = params.get("code");
+  const state = params.get("state");
+  return code && state ? { code, state } : undefined;
+}
+
+const TRANSIENT_CODES = new Set([
+  "EAI_AGAIN", "ECONNREFUSED", "ECONNRESET", "EHOSTUNREACH",
+  "ENETUNREACH", "ENOTFOUND", "ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT",
+]);
+
+/** Worth retrying: a dropped connection rather than a rejected credential. */
+export function isTransientNetworkError(error: unknown): boolean {
+  const field = (name: string) =>
+    error && typeof error === "object" && typeof (error as any)[name] === "string"
+      ? (error as any)[name] as string
+      : undefined;
+
+  const code = field("code");
+  if (code && TRANSIENT_CODES.has(code)) return true;
+
+  const message = error instanceof Error ? error.message : (field("message") ?? String(error));
+  if (message.includes("fetch failed")) return true;
+  return [...TRANSIENT_CODES].some((candidate) => message.includes(candidate));
+}
+
+/** `Retry-After` as seconds, accepting both the numeric and HTTP-date forms. */
+export function parseRetryAfter(value: string | null | undefined): number | undefined {
+  if (!value) return undefined;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds > 0) return Math.ceil(seconds);
+  const date = Date.parse(value);
+  if (!Number.isFinite(date)) return undefined;
+  const delta = Math.ceil((date - Date.now()) / 1000);
+  return delta > 0 ? delta : undefined;
+}

package/src/core/policy/policy.ts

@@ -0,0 +1,183 @@
+import { readConfig, updateConfig } from "../config.ts";
+
+/**
+ * Approval policy for model selection.
+ *
+ * Subscription providers are free to use. Metered providers (OpenRouter and
+ * anything else that bills per token) require an explicit approval before a
+ * request is allowed to leave the machine.
+ */
+
+export interface PolicyFile {
+  autoApprove: string[];
+  requireApproval: string[];
+  deny: string[];
+}
+
+const DEFAULT_POLICY: PolicyFile = {
+  autoApprove: ["anthropic/*", "openai-codex/*"],
+  requireApproval: ["openrouter/*", "google/*", "openai/*", "xai/*"],
+  deny: [],
+};
+
+export type Decision =
+  | { allowed: true; reason: "auto" | "approved" }
+  | { allowed: false; reason: "denied" | "needs-approval"; message: string };
+
+const approvals = new Map<string, number>();
+
+export function loadPolicy(): PolicyFile {
+  return readConfig().policy;
+}
+
+export function savePolicy(next: PolicyFile): void {
+  updateConfig((config) => {
+    config.policy = {
+      autoApprove: next.autoApprove ?? DEFAULT_POLICY.autoApprove,
+      requireApproval: next.requireApproval ?? DEFAULT_POLICY.requireApproval,
+      deny: next.deny ?? DEFAULT_POLICY.deny,
+    };
+  });
+}
+
+function matches(pattern: string, value: string): boolean {
+  const escaped = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${escaped}$`).test(value);
+}
+
+function matchesAny(patterns: string[], value: string): boolean {
+  return patterns.some((pattern) => matches(pattern, value));
+}
+
+/**
+ * Provider ids that require approval, derived from the policy patterns so the
+ * toggle list always reflects the configured file rather than a hardcoded set.
+ */
+export function gatedProviders(): string[] {
+  const names = loadPolicy().requireApproval
+    .map((pattern) => pattern.split("/")[0])
+    .filter((name) => name && !name.includes("*"));
+  return [...new Set(names)].sort();
+}
+
+export type ProviderState = "auto" | "approved" | "blocked" | "denied";
+
+/** How the policy currently treats a provider, for display and toggling. */
+export function providerState(provider: string): ProviderState {
+  const current = loadPolicy();
+  if (matchesAny(current.deny, `${provider}/*`) || matchesAny(current.deny, provider)) return "denied";
+  if (matchesAny(current.requireApproval, `${provider}/*`)) {
+    return isApproved(provider) ? "approved" : "blocked";
+  }
+  return "auto";
+}
+
+/**
+ * Flips whether a provider may be used.
+ *
+ * Auto-approved providers are moved into `requireApproval` so the switch is
+ * reversible; gated ones just gain or lose their session grant. Denied
+ * providers are left alone; `deny` is an explicit, deliberate block.
+ */
+export function toggleProvider(provider: string): ProviderState {
+  const state = providerState(provider);
+  if (state === "denied") return state;
+
+  if (state === "auto") {
+    const current = loadPolicy();
+    savePolicy({
+      ...current,
+      autoApprove: current.autoApprove.filter((pattern) => !matches(pattern, `${provider}/*`) && pattern !== `${provider}/*`),
+      requireApproval: [...new Set([...current.requireApproval, `${provider}/*`])],
+    });
+    revoke(provider);
+    return "blocked";
+  }
+
+  if (state === "approved") {
+    revoke(provider);
+    return "blocked";
+  }
+
+  approve(provider);
+  return "approved";
+}
+
+/** Grant approval for a provider until `untilMs` (omitted means this session). */
+export function approve(provider: string, durationMs?: number): void {
+  approvals.set(provider, durationMs ? Date.now() + durationMs : Number.MAX_SAFE_INTEGER);
+}
+
+export function revoke(provider: string): void {
+  approvals.delete(provider);
+}
+
+export function isApproved(provider: string): boolean {
+  const until = approvals.get(provider);
+  return until !== undefined && Date.now() < until;
+}
+
+/** Flips a provider's approval and reports the resulting state. */
+export function toggleApproval(provider: string): boolean {
+  if (isApproved(provider)) {
+    revoke(provider);
+    return false;
+  }
+  approve(provider);
+  return true;
+}
+
+export interface ProviderApproval {
+  provider: string;
+  approved: boolean;
+  until?: number;
+}
+
+/** Current approval state for every gated provider, for display. */
+export function approvalStates(): ProviderApproval[] {
+  return gatedProviders().map((provider) => {
+    const until = approvals.get(provider);
+    const approved = until !== undefined && Date.now() < until;
+    return { provider, approved, until: approved && until !== Number.MAX_SAFE_INTEGER ? until : undefined };
+  });
+}
+
+export function checkModel(provider: string, modelId: string): Decision {
+  const current = loadPolicy();
+  const ref = `${provider}/${modelId}`;
+
+  if (matchesAny(current.deny, ref) || matchesAny(current.deny, `${provider}/*`)) {
+    return { allowed: false, reason: "denied", message: `${ref} is denied by model policy.` };
+  }
+  if (matchesAny(current.autoApprove, ref)) return { allowed: true, reason: "auto" };
+
+  const gated = matchesAny(current.requireApproval, ref);
+  if (!gated) return { allowed: true, reason: "auto" };
+
+  if (!isApproved(provider)) {
+    return {
+      allowed: false,
+      reason: "needs-approval",
+      message:
+        `${ref} is a metered (pay-per-token) model and is not approved in this session. `
+        + `Use a subscription model such as anthropic/* or openai-codex/*, or ask the user to run `
+        + `/provider approve ${provider}.`,
+    };
+  }
+
+  return { allowed: true, reason: "approved" };
+}
+
+export function policySummary(): string {
+  const current = loadPolicy();
+  const active = approvalStates()
+    .filter((entry) => entry.approved)
+    .map((entry) => `${entry.provider}${entry.until ? ` (until ${new Date(entry.until).toLocaleTimeString()})` : " (session)"}`);
+  return [
+    "Model approval policy",
+    `  auto-approved:    ${current.autoApprove.join(", ") || "none"}`,
+    `  needs approval:   ${current.requireApproval.join(", ") || "none"}`,
+    `  denied:           ${current.deny.join(", ") || "none"}`,
+    `  approved now:     ${active.join(", ") || "none"}`,
+  ].join("\n");
+}

package/src/core/quota/pool.ts

@@ -0,0 +1,64 @@
+export type UsageRow = {
+  group: string;
+  label: string;
+  remaining: number;
+  resetAt?: number;
+  checkedAt?: number;
+  stale?: boolean;
+  capacity?: number;
+};
+
+/*
+ * How old a usage sample may be and still be poolable.
+ *
+ * This was 6 minutes when every refresh fetched the usage endpoint live.
+ * Quota now comes from response headers, backed by a poll at most once per
+ * 10 minutes, so a 6 minute bound marked idle accounts stale almost all the
+ * time. It must stay comfortably above that poll interval; the underlying
+ * windows are 5 hours and 7 days, so a sample minutes old is still accurate.
+ */
+export const CLAUDE_FRESH_MS = 12 * 60_000;
+export const isClaudeAccount = (row: UsageRow) => row.group.startsWith("Claude ") && !row.group.startsWith("Claude pool ×");
+export const isFresh = (row: UsageRow, now = Date.now()) => !row.stale && !!row.checkedAt
+  && now - row.checkedAt < CLAUDE_FRESH_MS && (!row.resetAt || row.resetAt > now);
+
+/** Percent of combined capacity, not a claim that quota transfers between accounts.
+ * Without published capacities this is explicitly an equal-account estimate.
+ */
+export function combinedWindow(rows: UsageRow[], label: string, expected: number, now = Date.now(), allowPartial = false) {
+  const matching = rows.filter((r) => isClaudeAccount(r) && r.label === label && isFresh(r, now));
+  const partial = matching.length !== expected;
+  if (!expected || !matching.length || (partial && !allowPartial)) return undefined;
+  const weighted = matching.every((r) => typeof r.capacity === "number" && r.capacity > 0);
+  const total = matching.reduce((sum, r) => sum + (weighted ? r.capacity! : 1), 0);
+  const remaining = matching.reduce((sum, r) => sum + r.remaining * (weighted ? r.capacity! : 1), 0) / total;
+  const resets = matching.map((r) => r.resetAt).filter((t): t is number => !!t && t > now);
+  return { label, remaining, resetAt: resets.length ? Math.min(...resets) : undefined, estimated: !weighted, partial };
+}
+
+export function scopedLabels(rows: UsageRow[], modelId?: string): string[] {
+  const labels = [...new Set(rows.filter(isClaudeAccount).map((r) => r.label).filter((l) => l.startsWith("7d ")))];
+  const model = modelId?.toLowerCase() ?? "";
+  return labels.sort((a, b) => Number(matchesScope(b, model)) - Number(matchesScope(a, model)) || a.localeCompare(b));
+}
+
+function matchesScope(label: string, model: string): boolean {
+  const family = label.slice(3).toLowerCase();
+  return model.includes(family) || (family === "fable" && model.includes("mythos"));
+}
+
+/** An account must pass ALL applicable windows; independent averages cannot answer this. */
+export function poolAvailability(rows: UsageRow[], expected: number, modelId?: string, now = Date.now()) {
+  const groups = [...new Set(rows.filter(isClaudeAccount).map((r) => r.group))];
+  let ready = 0;
+  let unknown = Math.max(0, expected - groups.length);
+  for (const group of groups) {
+    const account = rows.filter((r) => r.group === group);
+    const required = ["5h", "7d", ...scopedLabels(account).filter((l) => matchesScope(l, modelId?.toLowerCase() ?? ""))];
+    const windows = required.map((label) => account.find((r) => r.label === label));
+    if (windows.some((r) => r && isFresh(r, now) && r.remaining <= 0)) continue;
+    if (windows.some((r) => !r || !isFresh(r, now))) { unknown++; continue; }
+    ready++;
+  }
+  return { ready, unknown, total: expected };
+}

package/src/core/quota/usage-source.ts

@@ -0,0 +1,289 @@
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { loadAccounts, saveAccount, type Account as AnthropicAccount } from "../anthropic/store.ts";
+import { refreshToken } from "../anthropic/oauth.ts";
+import { loadCodexAccounts } from "../codex/store.ts";
+import type { UsageRow } from "./pool.ts";
+
+/**
+ * Fetches subscription quota from the Claude and Codex endpoints.
+ *
+ * Pure data access: no pi imports, no module-level mutable state, no rendering.
+ * Everything here returns values so it can be tested without a live agent.
+ * Scheduling, caching and retention belong to services/usage-service.ts.
+ */
+
+const TIMEOUT_MS = 10_000;
+
+export interface SourceResult {
+  rows: UsageRow[];
+  errors: string[];
+  groups: string[];
+  codexPlan?: string;
+}
+
+function pct(value: unknown): number | undefined {
+  if (value == null || typeof value === "boolean" || (typeof value === "string" && !value.trim())) return undefined;
+  const n = typeof value === "number" ? value : Number(value);
+  return Number.isFinite(n) ? Math.min(100, Math.max(0, n)) : undefined;
+}
+
+function resetToMs(value: unknown): number | undefined {
+  if (typeof value === "number" && Number.isFinite(value)) return value < 1e12 ? value * 1000 : value;
+  if (typeof value === "string") {
+    const parsed = Date.parse(value);
+    if (!Number.isNaN(parsed)) return parsed;
+  }
+  return undefined;
+}
+
+async function claudeUsage(group: string, token: string): Promise<{ rows: UsageRow[]; error?: string }> {
+  const response = await fetch("https://api.anthropic.com/api/oauth/usage", {
+    headers: { Authorization: `Bearer ${token}`, "anthropic-beta": "oauth-2025-04-20", Accept: "application/json" },
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  });
+  if (!response.ok) return { rows: [], error: `${group}: HTTP ${response.status}` };
+  const body = await response.json() as any;
+
+  const rows: UsageRow[] = [];
+  const push = (label: string, window: any) => {
+    const used = pct(window?.utilization);
+    if (used === undefined) return;
+    rows.push({
+      group,
+      label,
+      remaining: 100 - used,
+      resetAt: resetToMs(window?.resets_at),
+      capacity: typeof window?.limit_dollars === "number" && window.limit_dollars > 0 ? window.limit_dollars : undefined,
+    });
+  };
+  push("5h", body.five_hour);
+  push("7d", body.seven_day);
+  push("7d Opus", body.seven_day_opus ?? body.seven_day_omelette);
+  push("7d Sonnet", body.seven_day_sonnet);
+
+  for (const limit of Array.isArray(body.limits) ? body.limits : []) {
+    const scoped = limit?.scope?.model?.display_name;
+    const used = pct(limit?.percent);
+    if (!scoped || used === undefined) continue;
+    const label = `7d ${scoped}`;
+    if (rows.some((row) => row.label === label)) continue;
+    rows.push({ group, label, remaining: 100 - used, resetAt: resetToMs(limit?.resets_at) });
+  }
+
+  const extra = body.extra_usage;
+  if (extra?.is_enabled && pct(extra?.utilization) !== undefined) {
+    rows.push({ group, label: "Extra", remaining: 100 - pct(extra.utilization)! });
+  }
+
+  return rows.length
+    ? { rows: rows.map((row) => ({ ...row, checkedAt: Date.now() })) }
+    : { rows: [], error: `${group}: usage windows unavailable` };
+}
+
+/**
+ * HUD polling must never wait indefinitely on OAuth refresh or retry it behind
+ * a live agent turn. The provider owns request-time refresh/retry policy.
+ */
+async function fallbackAccountToken(account: AnthropicAccount): Promise<string | undefined> {
+  const valid = typeof account.expires === "number" && Date.now() + 60_000 < account.expires;
+  if (valid && account.access) return account.access;
+  if (!account.refresh) return account.access;
+
+  const refreshed = await refreshToken({ refreshToken: account.refresh, maxRetries: 0 });
+  saveAccount({
+    ...account,
+    access: refreshed.access,
+    refresh: refreshed.refresh,
+    expires: refreshed.expires,
+    lastRefreshedAt: Date.now(),
+  });
+  return refreshed.access;
+}
+
+
+/**
+ * Builds usage rows from a stored quota snapshot.
+ *
+ * Snapshots are refreshed for free from response headers on every request, so
+ * serving the HUD from them avoids touching `/api/oauth/usage` at all. That
+ * endpoint rate limits aggressively, and /usage polling several accounts was a
+ * reliable way to get 429s and then show nothing.
+ *
+ * Returns undefined when there is no snapshot yet, so the caller can fetch.
+ */
+function rowsFromSnapshot(group: string, quota: any): UsageRow[] | undefined {
+  if (!quota) return undefined;
+  const rows: UsageRow[] = [];
+  const push = (label: string, window: any) => {
+    if (typeof window?.remainingPercent !== "number") return;
+    rows.push({
+      group,
+      label,
+      remaining: window.remainingPercent,
+      resetAt: resetToMs(window.resetsAt),
+      // Required: pool.isFresh discards any row without it, which would make
+      // every cached row pool as "n/a".
+      checkedAt: window.checkedAt ?? quota.checkedAt ?? Date.now(),
+    });
+  };
+  push("5h", quota.five_hour);
+  push("7d", quota.seven_day);
+  for (const scoped of Array.isArray(quota.scoped) ? quota.scoped : []) {
+    if (typeof scoped?.remainingPercent !== "number" || !scoped?.id) continue;
+    push(`7d ${scoped.id}`, scoped);
+  }
+  return rows.length ? rows : undefined;
+}
+
+export async function fetchClaudeRows(ctx: any): Promise<{ rows: UsageRow[]; errors: string[]; groups: string[] }> {
+  const rows: UsageRow[] = [];
+  const errors: string[] = [];
+  const accounts: Array<{ group: string; token?: string; account?: AnthropicAccount }> = [];
+
+  try {
+    const token = (await ctx.modelRegistry.getProviderAuth("anthropic"))?.auth?.apiKey;
+    if (token) accounts.push({ group: "Claude Personal", token });
+    else errors.push("Claude Personal: not logged in");
+  } catch (error) {
+    errors.push(`Claude Personal: ${error instanceof Error ? error.message : String(error)}`);
+  }
+
+  try {
+    const storage = loadAccounts();
+    for (const account of storage?.accounts ?? []) {
+      if (account.type !== "oauth" || account.enabled === false) continue;
+      accounts.push({ group: `Claude ${account.label ?? account.id.slice(0, 8)}`, account });
+    }
+  } catch (error) {
+    errors.push(`Claude accounts: ${error instanceof Error ? error.message : String(error)}`);
+  }
+
+  for (const entry of accounts) {
+    try {
+      // Cached snapshot first: it is free, current, and cannot be throttled.
+      const cached = rowsFromSnapshot(entry.group, entry.account?.quota);
+      if (cached) {
+        rows.push(...cached);
+        continue;
+      }
+
+      const token = entry.token ?? (entry.account ? await fallbackAccountToken(entry.account) : undefined);
+      if (!token) {
+        errors.push(`${entry.group}: no token`);
+        continue;
+      }
+      const result = await claudeUsage(entry.group, token);
+      rows.push(...result.rows);
+      if (result.error) errors.push(result.error);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      errors.push(/invalid_grant/i.test(message)
+        ? `${entry.group}: login expired, run /accounts reauth ${entry.account?.label ?? entry.account?.id ?? ""}`.trim()
+        : `${entry.group}: ${message}`);
+    }
+  }
+
+  return { rows, errors, groups: [...new Set(["Claude Personal", ...accounts.map((entry) => entry.group)])] };
+}
+
+function codexAccountId(): string | undefined {
+  // Prefer an enabled account from our own pool, so /usage reflects the
+  // accounts /accounts manages rather than only pi's single credential.
+  try {
+    const pooled = loadCodexAccounts().accounts.find((a) => a.enabled !== false && a.accountId);
+    if (pooled?.accountId) return pooled.accountId;
+  } catch { /* fall through */ }
+  try {
+    const auth = JSON.parse(readFileSync(join(homedir(), ".pi", "agent", "auth.json"), "utf8"));
+    const credential = auth["openai-codex"];
+    if (credential?.accountId) return credential.accountId;
+    if (credential?.account_id) return credential.account_id;
+  } catch { /* fall through */ }
+  try {
+    const codex = JSON.parse(readFileSync(join(homedir(), ".codex", "auth.json"), "utf8"));
+    return codex?.tokens?.account_id ?? codex?.tokens?.accountId;
+  } catch {
+    return undefined;
+  }
+}
+
+export async function fetchCodexRows(ctx: any): Promise<{ rows: UsageRow[]; error?: string; plan?: string }> {
+  try {
+    const token = (await ctx.modelRegistry.getProviderAuth("openai-codex"))?.auth?.apiKey;
+    const accountId = codexAccountId();
+    if (!token) return { rows: [], error: "Codex: not logged in" };
+    if (!accountId) return { rows: [], error: "Codex: no ChatGPT account id" };
+
+    const response = await fetch("https://chatgpt.com/backend-api/wham/usage", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "ChatGPT-Account-Id": accountId,
+        Accept: "application/json",
+        Origin: "https://chatgpt.com",
+        Referer: "https://chatgpt.com/",
+        "User-Agent": "Mozilla/5.0",
+      },
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    if (!response.ok) return { rows: [], error: `Codex: HTTP ${response.status}` };
+    const body = await response.json() as any;
+
+    const rows: UsageRow[] = [];
+    const push = (label: string, window: any) => {
+      const used = pct(window?.used_percent);
+      if (used === undefined) return;
+      rows.push({ group: "Codex", label, remaining: 100 - used, resetAt: resetToMs(window?.reset_at), checkedAt: Date.now() });
+    };
+
+    const kindOf = (window: any): string | undefined => {
+      const seconds = Number(window?.limit_window_seconds);
+      if (!Number.isFinite(seconds)) return undefined;
+      if (seconds <= 21_600) return "5h";
+      if (seconds >= 500_000) return "weekly";
+      return `${Math.round(seconds / 86400)}d`;
+    };
+
+    for (const window of [body.rate_limit?.primary_window, body.rate_limit?.secondary_window]) {
+      const kind = kindOf(window);
+      if (kind) push(kind, window);
+    }
+
+    for (const extra of Array.isArray(body.additional_rate_limits) ? body.additional_rate_limits : []) {
+      const name = String(extra?.limit_name ?? "extra").replace(/^GPT-[\d.]+-Codex-/i, "");
+      for (const window of [extra?.rate_limit?.primary_window, extra?.rate_limit?.secondary_window]) {
+        const kind = kindOf(window);
+        const used = pct(window?.used_percent);
+        if (!kind || used === undefined) continue;
+        rows.push({
+          group: "Codex",
+          label: `${name} ${kind}`,
+          remaining: 100 - used,
+          resetAt: resetToMs(window?.reset_at),
+          checkedAt: Date.now(),
+        });
+      }
+    }
+
+    const credits = body.credits;
+    if (credits?.has_credits && credits?.balance) {
+      rows.push({ group: "Codex", label: `credits ${credits.balance}`, remaining: 100, checkedAt: Date.now() });
+    }
+
+    return { rows, plan: typeof body.plan_type === "string" ? body.plan_type : undefined };
+  } catch (error) {
+    return { rows: [], error: `Codex: ${error instanceof Error ? error.message : String(error)}` };
+  }
+}
+
+/** One full poll of every configured subscription source. */
+export async function fetchAll(ctx: any): Promise<SourceResult> {
+  const [claude, codex] = await Promise.all([fetchClaudeRows(ctx), fetchCodexRows(ctx)]);
+  return {
+    rows: [...claude.rows, ...codex.rows],
+    errors: [...claude.errors, codex.error].filter((error): error is string => !!error),
+    groups: claude.groups,
+    codexPlan: codex.plan,
+  };
+}

package/src/core/store.ts

@@ -0,0 +1,43 @@
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Small JSON config helper shared by every domain.
+ *
+ * Writes go through a temp file + rename so a crash mid-write cannot leave a
+ * truncated config behind; several of these files hold auth state.
+ */
+
+export function agentDir(): string {
+  return process.env.PI_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+}
+
+export function agentPath(...parts: string[]): string {
+  return join(agentDir(), ...parts);
+}
+
+export function readJson<T>(path: string, fallback: T): T {
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as T;
+  } catch {
+    return fallback;
+  }
+}
+
+/** Best-effort atomic write. Returns false instead of throwing. */
+export function writeJson(path: string, value: unknown, pretty = false): boolean {
+  const temp = `${path}.${process.pid}.tmp`;
+  try {
+    writeFileSync(temp, JSON.stringify(value, undefined, pretty ? 2 : undefined), "utf8");
+    renameSync(temp, path);
+    return true;
+  } catch {
+    try {
+      writeFileSync(path, JSON.stringify(value, undefined, pretty ? 2 : undefined), "utf8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}