@kairyou/agent-tools 0.4.0 → 0.5.2

package/integrations/usage/lib/http.mjs

@@ -0,0 +1,186 @@
+// JSON-over-HTTP requests to gateways, including the anti-bot shield
+// challenge some NewAPI deployments serve before the real response.
+
+import { createContext, runInContext } from "node:vm";
+import { debugLog } from "./config.mjs";
+
+const REQUEST_TIMEOUT_MS = 5000;
+const SHIELD_USER_AGENT =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 " +
+  "(KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36";
+
+function shortPreview(text) {
+  return String(text || "")
+    .replace(/\s+/g, " ")
+    .trim()
+    .slice(0, 220);
+}
+
+function isShieldChallenge(contentType, text) {
+  const normalizedType = String(contentType || "").toLowerCase();
+  return (
+    (normalizedType.includes("text/html") && /var\s+arg1\s*=|acw_sc__v2|cdn_sec_tc|<script/i.test(text)) ||
+    /var\s+arg1\s*=/.test(text)
+  );
+}
+
+function parseChallengeArg1(html) {
+  const match = String(html).match(/var\s+arg1\s*=\s*['"]([0-9a-fA-F]+)['"]/);
+  return match?.[1]?.toUpperCase() || "";
+}
+
+function parseChallengeMapping(html) {
+  const match = String(html).match(/for\(var m=\[([^\]]+)\],p=L\(0x115\)/);
+  if (!match?.[1]) return null;
+  const values = match[1].split(",").map((raw) => {
+    const value = raw.trim().toLowerCase();
+    if (!value) return Number.NaN;
+    return value.startsWith("0x") ? Number.parseInt(value.slice(2), 16) : Number.parseInt(value, 10);
+  });
+  return values.some((value) => Number.isNaN(value)) ? null : values;
+}
+
+function parseChallengeXorSeed(html) {
+  const text = String(html);
+  const fnStart = text.indexOf("function a0i()");
+  const bStart = text.indexOf("function b(");
+  const rotateStart = text.indexOf("(function(a,c){");
+  const rotateEnd = text.indexOf("),!(function", rotateStart);
+  if (fnStart < 0 || bStart < 0 || bStart <= fnStart || rotateStart < 0 || rotateEnd < 0) {
+    return "";
+  }
+
+  const helperCode = text.slice(fnStart, bStart);
+  const rotateCode = `${text.slice(rotateStart, rotateEnd + 1)})`;
+  try {
+    const sandbox = { decodeURIComponent };
+    createContext(sandbox);
+    runInContext(helperCode, sandbox, { timeout: 100 });
+    runInContext(rotateCode, sandbox, { timeout: 100 });
+    const decoder = sandbox.a0j;
+    if (typeof decoder !== "function") return "";
+    const seed = decoder(0x115);
+    return typeof seed === "string" && /^[0-9a-f]+$/i.test(seed) ? seed : "";
+  } catch {
+    return "";
+  }
+}
+
+function solveNewApiAcwScV2(html) {
+  const arg1 = parseChallengeArg1(html);
+  const mapping = parseChallengeMapping(html);
+  const xorSeed = parseChallengeXorSeed(html);
+  if (!arg1 || !mapping || !xorSeed) return "";
+
+  const reordered = [];
+  for (let i = 0; i < arg1.length; i += 1) {
+    const ch = arg1[i];
+    for (let j = 0; j < mapping.length; j += 1) {
+      if (mapping[j] === i + 1) reordered[j] = ch;
+    }
+  }
+
+  const source = reordered.join("");
+  let out = "";
+  for (let i = 0; i < source.length && i < xorSeed.length; i += 2) {
+    const left = Number.parseInt(source.slice(i, i + 2), 16);
+    const right = Number.parseInt(xorSeed.slice(i, i + 2), 16);
+    if (Number.isNaN(left) || Number.isNaN(right)) return "";
+    out += (left ^ right).toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+function upsertCookie(cookieHeader, name, value) {
+  const parts = String(cookieHeader || "").split(";").map((part) => part.trim()).filter(Boolean);
+  let replaced = false;
+  const next = parts.map((part) => {
+    const eq = part.indexOf("=");
+    if (eq < 0) return part;
+    const key = part.slice(0, eq).trim();
+    if (key !== name) return part;
+    replaced = true;
+    return `${name}=${value}`;
+  });
+  if (!replaced) next.push(`${name}=${value}`);
+  return next.join("; ");
+}
+
+function collectSetCookieHeaders(headers) {
+  const getSetCookie = headers?.getSetCookie;
+  if (typeof getSetCookie === "function") return getSetCookie.call(headers) || [];
+  const single = headers?.get?.("set-cookie");
+  return single ? [single] : [];
+}
+
+function mergeSetCookiePairs(cookieHeader, setCookieHeaders) {
+  let merged = cookieHeader || "";
+  for (const raw of setCookieHeaders || []) {
+    const firstPair = String(raw || "").split(";")[0]?.trim();
+    if (!firstPair) continue;
+    const eq = firstPair.indexOf("=");
+    if (eq <= 0) continue;
+    merged = upsertCookie(merged, firstPair.slice(0, eq).trim(), firstPair.slice(eq + 1));
+  }
+  return merged;
+}
+
+export async function requestJson(url, key, options = {}) {
+  let cookieHeader = "";
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    const response = await fetch(url, {
+      headers: {
+        accept: "application/json",
+        authorization: `Bearer ${options.authKey || key}`,
+        "user-agent": SHIELD_USER_AGENT,
+        ...(cookieHeader ? { cookie: cookieHeader } : {}),
+        ...(options.headers || {}),
+      },
+      signal: controller.signal,
+    });
+
+    try {
+      const body = await response.text();
+      cookieHeader = mergeSetCookiePairs(cookieHeader, collectSetCookieHeaders(response.headers));
+      let json = {};
+      try {
+        json = body ? JSON.parse(body) : {};
+      } catch {
+        const contentType = response.headers.get("content-type") || "";
+        const acwScV2 = isShieldChallenge(contentType, body) ? solveNewApiAcwScV2(body) : "";
+        await debugLog({
+          source: options.name || "usage",
+          url,
+          status: response.status,
+          contentType,
+          shieldRetry: Boolean(acwScV2 && attempt === 0),
+          bodyPreview: shortPreview(body),
+        });
+        if (acwScV2 && attempt === 0) {
+          cookieHeader = upsertCookie(cookieHeader, "acw_sc__v2", acwScV2);
+          continue;
+        }
+        throw new Error(`${options.name || "usage"} returned non-JSON (${response.status})`);
+      }
+
+      if (!response.ok) {
+        const message = json?.error?.message || json?.message || response.statusText;
+        await debugLog({
+          source: options.name || "usage",
+          url,
+          status: response.status,
+          message,
+          bodyPreview: shortPreview(body),
+        });
+        throw new Error(`${options.name || "usage"} failed (${response.status} ${message})`);
+      }
+
+      return json;
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  throw new Error(`${options.name || "usage"} unavailable`);
+}

package/integrations/usage/lib/routes.mjs

@@ -0,0 +1,265 @@
+// Known gateway usage endpoints and the probing order for a given context.
+
+import { requestJson } from "./http.mjs";
+import {
+  usagePreset,
+  panelUserHeaders,
+  newApiQuotaScale,
+  providerUsageDays,
+  debugLog,
+} from "./config.mjs";
+import {
+  cleanBaseUrl,
+  serviceRoot,
+  joinUrl,
+  hostIncludes,
+  usageRouteCacheKey,
+} from "./urls.mjs";
+import {
+  pickNumber,
+  formatMoney,
+  usageRoot,
+  hasV1UsageFields,
+  formatQuota,
+  formatNewApiTokenLine,
+  formatOpenRouterLine,
+  formatPanelUserSelfLine,
+  panelQuotaScale,
+  panelQuotaLooksRemaining,
+} from "./format.mjs";
+import { readRouteCache } from "./cache.mjs";
+
+async function subscriptionUrl(baseUrl) {
+  const clean = baseUrl.replace(/\/+$/, "");
+  const url = clean.endsWith("/v1") ? `${clean}/usage` : `${clean}/v1/usage`;
+  return `${url}?days=${await providerUsageDays()}`;
+}
+
+function usageResult(context, source, text, raw) {
+  return {
+    updatedAt: new Date().toISOString(),
+    baseUrl: context.baseUrl,
+    provider: context.providerName,
+    source,
+    text,
+    raw,
+  };
+}
+
+// Sub2API and several private OpenAI-compatible gateways expose a lightweight
+// OpenAI-style endpoint at /v1/usage. This is intentionally probed first for
+// generic non-OpenAI base URLs because it does not require a management token.
+async function fetchV1Usage(context) {
+  const json = await requestJson(await subscriptionUrl(context.baseUrl), context.key, {
+    name: "v1 usage",
+  });
+  if (!hasV1UsageFields(usageRoot(json))) throw new Error("v1 usage payload has no usage fields");
+  return usageResult(context, "v1-usage", await formatQuota(context.label, json), json);
+}
+
+// NewAPI / OneAPI family panels: use the current API key as Bearer auth and
+// query token usage from the service root rather than the /v1 OpenAI-compatible
+// path.
+async function fetchNewApiTokenUsage(context) {
+  const json = await requestJson(joinUrl(serviceRoot(context.baseUrl), "/api/usage/token/"), context.key, {
+    name: "NewAPI token usage",
+  });
+  const root = usageRoot(json);
+  const quota = pickNumber(root, ["quota", "limit", "total_quota", "totalQuota"]);
+  const used = pickNumber(root, ["used_quota", "usedQuota", "used"]);
+  let remaining = pickNumber(root, ["remain_quota", "remainQuota", "remaining", "balance"]);
+  if (remaining === undefined && quota !== undefined && used !== undefined) {
+    remaining = Math.max(0, quota - used);
+  }
+  const scale = await newApiQuotaScale();
+  const quotaForWarning = scale ? quota / scale : quota;
+  const usedForWarning = scale ? used / scale : used;
+  const remainingForWarning = scale ? remaining / scale : remaining;
+  const normalized = {
+    mode: "quota_limited",
+    quota: {
+      limit: quotaForWarning,
+      used: usedForWarning,
+      remaining: remainingForWarning,
+    },
+    unit: scale ? "USD" : "quota",
+    source: "newapi-token",
+    raw: json,
+  };
+  return usageResult(context, "newapi-token", await formatNewApiTokenLine(context.label, json), normalized);
+}
+
+// NewAPI / OneAPI / OneHub / DoneHub / Veloera panel session endpoint, based on
+// Metapi's platform handling. This works when PROVIDER_USAGE_API_KEY is a panel
+// access/session token, or when the site accepts the API key for /api/user/self.
+async function fetchPanelUserSelfUsage(context) {
+  const preset = await usagePreset();
+  const kind = preset === "auto" ? "new-api" : preset;
+  const json = await requestJson(joinUrl(serviceRoot(context.baseUrl), "/api/user/self"), context.key, {
+    name: "panel /api/user/self",
+    headers: await panelUserHeaders(),
+  });
+  const root = usageRoot(json);
+  if (pickNumber(root, ["quota"]) === undefined && pickNumber(root, ["used_quota", "usedQuota"]) === undefined) {
+    await debugLog({
+      source: "panel /api/user/self",
+      payloadKeys: Object.keys(root || {}).slice(0, 20),
+      success: root?.success,
+      message: root?.message || root?.error?.message || "",
+    });
+  }
+  const scale = panelQuotaScale(kind);
+  const quota = pickNumber(root, ["quota"]);
+  const used = pickNumber(root, ["used_quota", "usedQuota"]);
+  const remaining = panelQuotaLooksRemaining(kind)
+    ? quota
+    : (quota === undefined || used === undefined ? quota : Math.max(0, quota - used));
+  const total = panelQuotaLooksRemaining(kind)
+    ? (quota === undefined || used === undefined ? quota : quota + used)
+    : quota;
+  const normalized = {
+    mode: "quota_limited",
+    quota: {
+      limit: total === undefined ? undefined : total / scale,
+      used: used === undefined ? undefined : used / scale,
+      remaining: remaining === undefined ? undefined : remaining / scale,
+    },
+    unit: "USD",
+    source: "panel-user-self",
+    raw: json,
+  };
+  return usageResult(
+    context,
+    "panel-user-self",
+    await formatPanelUserSelfLine(context.label, json, kind),
+    normalized
+  );
+}
+
+// Sub2API exposes user balance as USD at /api/v1/auth/me. Newer deployments may
+// also expose richer subscription summaries through /v1/usage, so this route is
+// a fallback for deployments where /v1/usage is unavailable.
+async function fetchSub2ApiAuthMeUsage(context) {
+  const json = await requestJson(joinUrl(serviceRoot(context.baseUrl), "/api/v1/auth/me"), context.key, {
+    name: "Sub2API auth/me",
+  });
+  const root = usageRoot(json);
+  const balance = pickNumber(root, ["balance"]);
+  if (balance === undefined) throw new Error("Sub2API auth/me payload has no balance field");
+  const normalized = {
+    mode: "unrestricted",
+    planName: root?.username || root?.email || context.label || "Sub2API",
+    balance,
+    unit: "USD",
+    source: "sub2api-auth-me",
+    raw: json,
+  };
+  return usageResult(
+    context,
+    "sub2api-auth-me",
+    `API | balance ${formatMoney(balance)}`,
+    normalized
+  );
+}
+
+// OpenRouter exposes normal API-key usage at /api/v1/key. Some accounts also
+// expose credits at /api/v1/credits; keep this route isolated because
+// OpenRouter's base URL already includes /api/v1, unlike NewAPI/OneAPI.
+async function fetchOpenRouterUsage(context) {
+  const base = cleanBaseUrl(context.baseUrl).includes("/api/v1")
+    ? cleanBaseUrl(context.baseUrl)
+    : joinUrl(serviceRoot(context.baseUrl), "/api/v1");
+  const endpoints = [
+    { source: "openrouter-key", url: joinUrl(base, "/key") },
+    { source: "openrouter-credits", url: joinUrl(base, "/credits") },
+  ];
+  let lastError;
+  for (const endpoint of endpoints) {
+    try {
+      const json = await requestJson(endpoint.url, context.key, { name: endpoint.source });
+      return usageResult(context, endpoint.source, formatOpenRouterLine("OpenRouter", json), json);
+    } catch (error) {
+      lastError = error;
+      await debugLog({ source: endpoint.source, error: error.message });
+    }
+  }
+  throw lastError || new Error("OpenRouter usage unavailable");
+}
+
+const USAGE_ROUTES = {
+  "v1-usage": {
+    id: "v1-usage",
+    path: "/v1/usage",
+    run: fetchV1Usage,
+  },
+  "sub2api-auth-me": {
+    id: "sub2api-auth-me",
+    path: "/api/v1/auth/me",
+    run: fetchSub2ApiAuthMeUsage,
+  },
+  "newapi-token": {
+    id: "newapi-token",
+    path: "/api/usage/token/",
+    run: fetchNewApiTokenUsage,
+  },
+  "panel-user-self": {
+    id: "panel-user-self",
+    path: "/api/user/self",
+    run: fetchPanelUserSelfUsage,
+  },
+  "openrouter": {
+    id: "openrouter",
+    path: "/api/v1/key",
+    run: fetchOpenRouterUsage,
+  },
+};
+
+// Presets are probe-order aliases over the routes above, not separate
+// protocols (e.g. anyrouter/agentrouter just try the NewAPI panel endpoints
+// and /v1/usage in a different order).
+// They do not provide panel session-cookie authentication; only endpoints that
+// accept the configured Bearer key can succeed.
+async function usageRouteIds(context) {
+  const preset = await usagePreset();
+  const routes = {
+    "sub2api": ["v1-usage", "sub2api-auth-me"],
+    "openai-compatible": ["v1-usage"],
+    "new-api": ["newapi-token", "panel-user-self"],
+    "one-api": ["newapi-token", "panel-user-self"],
+    "onehub": ["newapi-token", "panel-user-self"],
+    "one-hub": ["newapi-token", "panel-user-self"],
+    "donehub": ["newapi-token", "panel-user-self"],
+    "done-hub": ["newapi-token", "panel-user-self"],
+    "veloera": ["panel-user-self", "newapi-token"],
+    "anyrouter": ["newapi-token", "panel-user-self", "v1-usage"],
+    "agentrouter": ["newapi-token", "panel-user-self", "v1-usage"],
+    "openrouter": ["openrouter"],
+  };
+  if (routes[preset]) return routes[preset];
+
+  if (preset !== "auto") return [];
+  if (hostIncludes(context.baseUrl, "openrouter.ai")) return ["openrouter"];
+  return ["v1-usage", "sub2api-auth-me", "newapi-token", "panel-user-self"];
+}
+
+async function cachedUsageRoute(context) {
+  const cache = await readRouteCache();
+  const key = usageRouteCacheKey(context.baseUrl);
+  const route = cache.routes[key];
+  return route?.route && USAGE_ROUTES[route.route] ? route : null;
+}
+
+export async function orderedUsageRoutes(context) {
+  const routeIds = await usageRouteIds(context);
+  const cached = await cachedUsageRoute(context);
+  if (!cached || !routeIds.includes(cached.route)) return routeIds.map((id) => USAGE_ROUTES[id]).filter(Boolean);
+  await debugLog({
+    source: "route-cache",
+    key: usageRouteCacheKey(context.baseUrl),
+    route: cached.route,
+    path: cached.path || USAGE_ROUTES[cached.route]?.path || "",
+  });
+  return [cached.route, ...routeIds.filter((id) => id !== cached.route)]
+    .map((id) => USAGE_ROUTES[id])
+    .filter(Boolean);
+}

package/integrations/usage/lib/urls.mjs

@@ -0,0 +1,48 @@
+// Pure URL helpers for gateway base URLs and route cache keys.
+
+export function isOfficialBaseUrl(baseUrl) {
+  if (!baseUrl) return true;
+  const clean = baseUrl.replace(/\/+$/, "");
+  return [
+    "https://api.openai.com",
+    "https://api.openai.com/v1",
+    "https://api.anthropic.com",
+    "https://api.anthropic.com/v1",
+  ].includes(clean);
+}
+
+export function cleanBaseUrl(baseUrl) {
+  return String(baseUrl || "").replace(/\/+$/, "");
+}
+
+export function serviceRoot(baseUrl) {
+  const clean = cleanBaseUrl(baseUrl);
+  return clean.endsWith("/v1") ? clean.slice(0, -3) : clean;
+}
+
+export function usageRouteCacheKey(baseUrl) {
+  try {
+    const url = new URL(cleanBaseUrl(baseUrl));
+    url.hash = "";
+    url.search = "";
+    url.pathname = url.pathname
+      .replace(/\/+$/, "")
+      .replace(/\/api\/v1$/i, "")
+      .replace(/\/v1$/i, "");
+    return url.toString().replace(/\/$/, "");
+  } catch {
+    return serviceRoot(baseUrl);
+  }
+}
+
+export function joinUrl(baseUrl, path) {
+  return `${cleanBaseUrl(baseUrl)}${path.startsWith("/") ? path : `/${path}`}`;
+}
+
+export function hostIncludes(baseUrl, value) {
+  try {
+    return new URL(baseUrl).hostname.toLowerCase().includes(value);
+  } catch {
+    return false;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kairyou/agent-tools",
-  "version": "0.4.0",
+  "version": "0.5.2",
   "description": "Reusable Agent Skills and installable integrations (statusline, provider usage, vision) for Codex, Claude Code, and opencode.",
   "license": "MIT",
   "engines": {

package/scripts/install.mjs

@@ -102,40 +102,6 @@ function nodeCmd(absScript) {
   return `node "${fwd(absScript)}"`;
 }
 
-function stripJsonComments(input) {
-  let out = "";
-  let inString = false;
-  let escaped = false;
-  for (let i = 0; i < input.length; i++) {
-    const ch = input[i];
-    const next = input[i + 1];
-    if (inString) {
-      out += ch;
-      escaped = ch === "\\" ? !escaped : false;
-      if (ch === "\"" && !escaped) inString = false;
-      continue;
-    }
-    if (ch === "\"") {
-      inString = true;
-      out += ch;
-      continue;
-    }
-    if (ch === "/" && next === "/") {
-      while (i < input.length && input[i] !== "\n") i++;
-      out += "\n";
-      continue;
-    }
-    if (ch === "/" && next === "*") {
-      i += 2;
-      while (i < input.length && !(input[i] === "*" && input[i + 1] === "/")) i++;
-      i++;
-      continue;
-    }
-    out += ch;
-  }
-  return out;
-}
-
 function readJsonc(file) {
   if (!fs.existsSync(file)) return {};
   const raw = fs.readFileSync(file, "utf8").replace(/^\uFEFF/, "");
@@ -146,31 +112,6 @@ function readJsonc(file) {
   return parsed ?? {};
 }
 
-function headerComments(text) {
-  const lines = text.replace(/^\uFEFF/, "").split(/\r?\n/);
-  const header = [];
-  for (const line of lines) {
-    if (/^\s*(?:\/\/.*)?$/.test(line)) {
-      header.push(line);
-      continue;
-    }
-    break;
-  }
-  return header.length ? header.join("\n").replace(/\s+$/, "") + "\n" : "";
-}
-
-function mergeDefaults(target, defaults) {
-  if (Array.isArray(defaults)) return target === undefined ? defaults : target;
-  if (!defaults || typeof defaults !== "object") {
-    return target === undefined ? defaults : target;
-  }
-  const out = target && typeof target === "object" && !Array.isArray(target) ? { ...target } : {};
-  for (const [key, value] of Object.entries(defaults)) {
-    out[key] = mergeDefaults(out[key], value);
-  }
-  return out;
-}
-
 function writeText(file, text, dryRun) {
   if (dryRun) {
     console.log(`  [dry-run] would write ${file}:`);
@@ -215,23 +156,46 @@ function updateOpenCodeTuiConfig(file, { remove, dryRun }) {
   writeText(file, updated, dryRun);
 }
 
+// Keys present in defaults but absent in current, as jsonc-parser edit paths.
+function missingDefaultPaths(current, defaults, basePath = []) {
+  const out = [];
+  for (const [key, value] of Object.entries(defaults)) {
+    const existing = current?.[key];
+    if (existing === undefined) {
+      out.push({ path: [...basePath, key], value });
+    } else if (
+      value && typeof value === "object" && !Array.isArray(value) &&
+      existing && typeof existing === "object" && !Array.isArray(existing)
+    ) {
+      out.push(...missingDefaultPaths(existing, value, [...basePath, key]));
+    }
+  }
+  return out;
+}
+
+// Updates only add missing default keys via surgical jsonc-parser edits, so
+// the user's comments, formatting, and key order survive installer updates.
 function mergeJsoncFile(src, dest, dryRun) {
-  const defaults = readJsonc(src);
-  const defaultHeader = headerComments(fs.readFileSync(src, "utf8"));
-  if (!fs.existsSync(dest)) {
+  if (!fs.existsSync(dest) || !fs.readFileSync(dest, "utf8").trim()) {
     writeText(dest, fs.readFileSync(src, "utf8"), dryRun);
     return;
   }
+  const defaults = readJsonc(src);
   const currentText = fs.readFileSync(dest, "utf8");
-  const current = readJsonc(dest);
-  const merged = mergeDefaults(current, defaults);
-  const currentHeader = headerComments(currentText) || defaultHeader;
-  const mergedText = currentHeader + JSON.stringify(merged, null, 2) + "\n";
-  if (stripJsonComments(currentText).trim() === JSON.stringify(merged, null, 2)) {
+  const additions = missingDefaultPaths(readJsonc(dest), defaults);
+  if (additions.length === 0) {
     console.log(`  kept existing ${dest}`);
     return;
   }
-  writeText(dest, mergedText, dryRun);
+  const eol = currentText.includes("\r\n") ? "\r\n" : "\n";
+  let updated = currentText;
+  for (const { path: keyPath, value } of additions) {
+    const edits = modify(updated, keyPath, value, {
+      formattingOptions: { insertSpaces: true, tabSize: 2, eol },
+    });
+    updated = applyEdits(updated, edits);
+  }
+  writeText(dest, updated, dryRun);
 }
 
 function copyRuntimeFile(src, dest, dryRun, options = {}) {