@knpkv/agent-usage 0.1.0 → 0.2.0

package/dist/main.js

@@ -4,23 +4,36 @@
  *
  * - `agent-usage serve` ingests every minute, polls Claude limits every five, and prints the URL
  *   that gets you in.
+ * - `agent-usage login [--open]` asks the running server for a fresh one-time link and prints it.
  * - `agent-usage ingest [--json]` runs one ingest pass and reports what it found.
  *
  * @module
  */
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Console, Deferred, Effect, Fiber, Layer, Option, Schema } from "effect";
+import { ConfigProvider, Console, Deferred, Effect, Fiber, Layer, Option, Schema } from "effect";
 import { Command, Flag } from "effect/cli";
 import * as Stdio from "effect/Stdio";
 import * as Stream from "effect/Stream";
-import { hostname } from "node:os";
+import { hostname, platform, userInfo } from "node:os";
 import { databaseLayer } from "./core/Database.js";
 import { ingestOnce } from "./core/Ingest.js";
 import { loadConfig } from "./server/Config.js";
-import { makeOwnerSessionSecrets, ownerSessionOrigin, ownerSessionUrl } from "./server/OwnerSession.js";
+import { describeIngest } from "./server/IngestSummary.js";
+import { login as requestLogin } from "./server/Login.js";
+import { makeOwnerSessionSecrets, ownerSessionOrigin } from "./server/OwnerSession.js";
 import { makeServer, Port, PublicOrigin } from "./server/Server.js";
 import { IngestStatus as IngestStatusSchema } from "./shared/contracts.js";
-const config = loadConfig(hostname());
+/** The operating system's name for the user; Claude Code's own fallback when it cannot ask. */
+const osUserName = () => {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return "claude-code-user";
+    }
+};
+// Empty values kept, for the one variable where an empty value means something.
+const config = loadConfig(hostname(), ConfigProvider.fromEnv({ preserveEmptyStrings: true }), osUserName());
 const serve = Command.make("serve", {}, Effect.fn(function* () {
     const stdio = yield* Stdio.Stdio;
     const settings = yield* config;
@@ -29,21 +42,12 @@ const serve = Command.make("serve", {}, Effect.fn(function* () {
     const security = yield* makeOwnerSessionSecrets(ownerSessionOrigin("127.0.0.1", port), Option.getOrUndefined(configuredOrigin));
     const ready = yield* Deferred.make();
     const server = yield* Layer.launch(makeServer({ config: settings, port, ready, security })).pipe(Effect.forkChild({ startImmediately: true }));
-    yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(server));
+    // The server only ends this race by failing; until it is listening there is no link to print.
+    const url = yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(server).pipe(Effect.andThen(Effect.never)));
     // On stdout and nowhere else: this line is the credential, so it is never logged.
-    yield* Stream.make(`agent usage: ${ownerSessionUrl(security.browserOrigin, security)}\n`).pipe(Stream.run(stdio.stdout()));
+    yield* Stream.make(`agent usage: ${url}\n`).pipe(Stream.run(stdio.stdout()));
     return yield* Fiber.join(server);
 })).pipe(Command.withDescription("Record usage continuously and serve the browser view"));
-const describeSource = (name, status) => {
-    if (status.rootMissing)
-        return `${name}: no sessions directory`;
-    const skipped = status.skipped.unparseableLine + status.skipped.missingTimestamp + status.skipped.oversizedLine;
-    return [
-        `${name}: ${status.filesRead}/${status.filesScanned} files read, ${status.eventsAdded} events added`,
-        skipped > 0 ? `, ${skipped} lines skipped` : "",
-        status.unreadable.length > 0 ? `, ${status.unreadable.length} unreadable` : ""
-    ].join("");
-};
 const encodeStatus = Schema.encodeSync(Schema.fromJsonString(IngestStatusSchema));
 const ingest = Command.make("ingest", {
     json: Flag.Boolean("json").pipe(Flag.withDescription("Print the status as one JSON value"), Flag.withDefault(false))
@@ -55,11 +59,15 @@ const ingest = Command.make("ingest", {
     Effect.provide(databaseLayer(settings.storeDirectory)));
     if (json)
         return yield* Console.log(encodeStatus(status));
-    yield* Console.log(describeSource("claude", status.claude));
-    yield* Console.log(describeSource("codex", status.codex));
-    yield* Console.log(`took ${status.finishedAt - status.startedAt}ms`);
+    for (const line of describeIngest(status))
+        yield* Console.log(line);
 })).pipe(Command.withDescription("Run one ingest pass and report what it found"));
-const cli = Command.make("agent-usage").pipe(Command.withDescription("Claude and Codex subscription usage over time, per ticket and against limits"), Command.withSubcommands([serve, ingest]), Command.run({ version: "0.1.0" }));
+const login = Command.make("login", {
+    open: Flag.Boolean("open").pipe(Flag.withDescription("Open the link in the browser too"), Flag.withDefault(false))
+}, 
+// The user id `login` trusts the socket to belong to; -1 (no POSIX ids) matches no owner.
+({ open }) => requestLogin(config, open, platform(), process.geteuid?.() ?? -1)).pipe(Command.withDescription("Print a fresh one-time link to the running server"));
+const cli = Command.make("agent-usage").pipe(Command.withDescription("Claude and Codex subscription usage over time, per ticket and against limits"), Command.withSubcommands([serve, login, ingest]), Command.run({ version: "0.1.0" }));
 // Executable entry point: the host platform is provided once for this process.
 NodeRuntime.runMain(cli.pipe(Effect.provide(NodeServices.layer)));
 //# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAwC,MAAM,kBAAkB,CAAA;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AACvG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;AAErC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,OAAO,EACP,EAAE,EACF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAA;IACxB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC7C,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,EACrC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CACxC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,kFAAkF;IAClF,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,eAAe,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5F,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAA;AAEvF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,MAAoB,EAAU,EAAE;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,GAAG,IAAI,yBAAyB,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAC/G,OAAO;QACL,GAAG,IAAI,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,gBAAgB,MAAM,CAAC,WAAW,eAAe;QACpG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE;KAC/E,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAEjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,QAAQ,EACR;IACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;CACrH,EACD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAC,EAAE,IAAI,EAAE;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,MAAM,GAAiB,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI;IACjE,uFAAuF;IACvF,wDAAwD;IACxD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;IACD,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAA;AACtE,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAA;AAE/E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAC1C,OAAO,CAAC,eAAe,CAAC,8EAA8E,CAAC,EACvG,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EACxC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAClC,CAAA;AAED,+EAA+E;AAC/E,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1E,+FAA+F;AAC/F,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;AAE3G,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,OAAO,EACP,EAAE,EACF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAA;IACxB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC7C,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,EACrC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CACxC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAU,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;IACD,8FAA8F;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjH,kFAAkF;IAClF,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAA;AAEvF,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAEjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,QAAQ,EACR;IACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;CACrH,EACD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAC,EAAE,IAAI,EAAE;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,MAAM,GAAiB,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI;IACjE,uFAAuF;IACvF,wDAAwD;IACxD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;IACD,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACrE,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAA;AAE/E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,OAAO,EACP;IACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;CACnH;AACD,0FAA0F;AAC1F,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAChF,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,mDAAmD,CAAC,CAAC,CAAA;AAEpF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAC1C,OAAO,CAAC,eAAe,CAAC,8EAA8E,CAAC,EACvG,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAClC,CAAA;AAED,+EAA+E;AAC/E,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA"}

package/dist/server/Api.d.ts

@@ -30,14 +30,15 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
                 readonly usedPercent: import("effect/Schema").Finite;
                 readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
             }>, import("effect/Schema").TaggedStruct<"Unknown", {
-                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             }>]>;
         }>>;
     }>>;
     readonly latest: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
         readonly machine: import("effect/Schema").NonEmptyString;
-        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "codex-rollout"]>;
+        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "claude-statusline", "codex-rollout"]>;
         readonly label: import("effect/Schema").NonEmptyString;
         readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
         readonly observedAt: import("effect/Schema").Int;
@@ -45,7 +46,8 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
             readonly usedPercent: import("effect/Schema").Finite;
             readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
         }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         }>]>;
     }>>;
     readonly balances: import("effect/Schema").$Array<import("effect/Schema").Struct<{
@@ -62,7 +64,8 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
                 readonly credits: import("effect/Schema").Finite;
             }>, import("effect/Schema").TaggedStruct<"Unlimited", {}>, import("effect/Schema").TaggedStruct<"Exhausted", {}>, import("effect/Schema").TaggedStruct<"Disabled", {}>]>;
         }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         }>]>;
     }>>;
 }>>, import("effect/Schema").toCodecJson<typeof ApiError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/api/status", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -100,6 +103,21 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
                 readonly reason: import("effect/Schema").String;
             }>>;
         }>;
+        readonly claudeLimitSamples: import("effect/Schema").Struct<{
+            readonly rootMissing: import("effect/Schema").Boolean;
+            readonly filesScanned: import("effect/Schema").Int;
+            readonly filesRead: import("effect/Schema").Int;
+            readonly eventsAdded: import("effect/Schema").Int;
+            readonly skipped: import("effect/Schema").Struct<{
+                readonly unparseableLine: import("effect/Schema").Int;
+                readonly missingTimestamp: import("effect/Schema").Int;
+                readonly oversizedLine: import("effect/Schema").Int;
+            }>;
+            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly fileKey: import("effect/Schema").String;
+                readonly reason: import("effect/Schema").String;
+            }>>;
+        }>;
     }>>;
     readonly ingestFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
     readonly limitsFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
@@ -159,59 +177,7 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
 }>>, import("effect/Schema").toCodecJson<typeof ApiError>, never, never>, false>;
 export declare class UsageApiGroup extends UsageApiGroup_base {
 }
-declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.HttpApiGroup<"usage", HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/api/usage", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
-    readonly from: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
-    readonly to: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
-    readonly timeZone: import("effect/Schema").String;
-    readonly bucket: import("effect/Schema").Literals<readonly ["hour", "day", "week"]>;
-    readonly agent: import("effect/Schema").Literals<readonly ["all", "claude", "codex"]>;
-}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
-    readonly periods: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly key: import("effect/Schema").String;
-        readonly start: import("effect/Schema").Int;
-    }>>;
-    readonly bookings: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly id: import("effect/Schema").String;
-        readonly booking: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Ticket", {
-            readonly key: import("effect/Schema").String;
-        }>, import("effect/Schema").TaggedStruct<"Repo", {
-            readonly name: import("effect/Schema").String;
-        }>]>;
-        readonly title: import("effect/Schema").NullOr<import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
-            readonly summary: import("effect/Schema").String;
-        }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NotFound", "NotLookedUp"]>;
-        }>]>>;
-        readonly agents: import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["claude", "codex"]>>;
-        readonly requests: import("effect/Schema").Int;
-        readonly tokens: import("effect/Schema").Struct<{
-            readonly input: import("effect/Schema").Int;
-            readonly output: import("effect/Schema").Int;
-            readonly reasoning: import("effect/Schema").Int;
-            readonly cacheRead: import("effect/Schema").Int;
-            readonly cacheWrite5m: import("effect/Schema").Int;
-            readonly cacheWrite1h: import("effect/Schema").Int;
-        }>;
-        readonly costUsd: import("effect/Schema").Finite;
-        readonly unpricedTokens: import("effect/Schema").Int;
-        readonly unpricedModels: import("effect/Schema").$Array<import("effect/Schema").String>;
-    }>>;
-    readonly cells: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly period: import("effect/Schema").Int;
-        readonly booking: import("effect/Schema").String;
-        readonly tokens: import("effect/Schema").Int;
-        readonly costUsd: import("effect/Schema").Finite;
-        readonly unpricedTokens: import("effect/Schema").Int;
-    }>>;
-    readonly unpriced: import("effect/Schema").Struct<{
-        readonly tokens: import("effect/Schema").Int;
-        readonly models: import("effect/Schema").$Array<import("effect/Schema").String>;
-    }>;
-    readonly ignoredKeys: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly prefix: import("effect/Schema").String;
-        readonly requests: import("effect/Schema").Int;
-    }>>;
-}>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"limits", "GET", "/api/limits", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.HttpApiGroup<"usage", HttpApiEndpoint.HttpApiEndpoint<"limits", "GET", "/api/limits", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly from: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
     readonly to: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
 }>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -225,14 +191,15 @@ declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.
                 readonly usedPercent: import("effect/Schema").Finite;
                 readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
             }>, import("effect/Schema").TaggedStruct<"Unknown", {
-                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             }>]>;
         }>>;
     }>>;
     readonly latest: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
         readonly machine: import("effect/Schema").NonEmptyString;
-        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "codex-rollout"]>;
+        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "claude-statusline", "codex-rollout"]>;
         readonly label: import("effect/Schema").NonEmptyString;
         readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
         readonly observedAt: import("effect/Schema").Int;
@@ -240,7 +207,8 @@ declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.
             readonly usedPercent: import("effect/Schema").Finite;
             readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
         }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         }>]>;
     }>>;
     readonly balances: import("effect/Schema").$Array<import("effect/Schema").Struct<{
@@ -257,7 +225,8 @@ declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.
                 readonly credits: import("effect/Schema").Finite;
             }>, import("effect/Schema").TaggedStruct<"Unlimited", {}>, import("effect/Schema").TaggedStruct<"Exhausted", {}>, import("effect/Schema").TaggedStruct<"Disabled", {}>]>;
         }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         }>]>;
     }>>;
 }>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/api/status", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -295,10 +264,77 @@ declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.
                 readonly reason: import("effect/Schema").String;
             }>>;
         }>;
+        readonly claudeLimitSamples: import("effect/Schema").Struct<{
+            readonly rootMissing: import("effect/Schema").Boolean;
+            readonly filesScanned: import("effect/Schema").Int;
+            readonly filesRead: import("effect/Schema").Int;
+            readonly eventsAdded: import("effect/Schema").Int;
+            readonly skipped: import("effect/Schema").Struct<{
+                readonly unparseableLine: import("effect/Schema").Int;
+                readonly missingTimestamp: import("effect/Schema").Int;
+                readonly oversizedLine: import("effect/Schema").Int;
+            }>;
+            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly fileKey: import("effect/Schema").String;
+                readonly reason: import("effect/Schema").String;
+            }>>;
+        }>;
     }>>;
     readonly ingestFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
     readonly limitsFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
     readonly ticketLookupFailures: import("effect/Schema").$Array<import("effect/Schema").String>;
-}>>, never, OwnerSessionAuth, never>, false>>;
+}>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/api/usage", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    readonly from: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
+    readonly to: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
+    readonly timeZone: import("effect/Schema").String;
+    readonly bucket: import("effect/Schema").Literals<readonly ["hour", "day", "week"]>;
+    readonly agent: import("effect/Schema").Literals<readonly ["all", "claude", "codex"]>;
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly periods: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly key: import("effect/Schema").String;
+        readonly start: import("effect/Schema").Int;
+    }>>;
+    readonly bookings: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly id: import("effect/Schema").String;
+        readonly booking: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Ticket", {
+            readonly key: import("effect/Schema").String;
+        }>, import("effect/Schema").TaggedStruct<"Repo", {
+            readonly name: import("effect/Schema").String;
+        }>]>;
+        readonly title: import("effect/Schema").NullOr<import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
+            readonly summary: import("effect/Schema").String;
+        }>, import("effect/Schema").TaggedStruct<"Unknown", {
+            readonly reason: import("effect/Schema").Literals<readonly ["NotFound", "NotLookedUp"]>;
+        }>]>>;
+        readonly agents: import("effect/Schema").$Array<import("effect/Schema").Literals<readonly ["claude", "codex"]>>;
+        readonly requests: import("effect/Schema").Int;
+        readonly tokens: import("effect/Schema").Struct<{
+            readonly input: import("effect/Schema").Int;
+            readonly output: import("effect/Schema").Int;
+            readonly reasoning: import("effect/Schema").Int;
+            readonly cacheRead: import("effect/Schema").Int;
+            readonly cacheWrite5m: import("effect/Schema").Int;
+            readonly cacheWrite1h: import("effect/Schema").Int;
+        }>;
+        readonly costUsd: import("effect/Schema").Finite;
+        readonly unpricedTokens: import("effect/Schema").Int;
+        readonly unpricedModels: import("effect/Schema").$Array<import("effect/Schema").String>;
+    }>>;
+    readonly cells: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly period: import("effect/Schema").Int;
+        readonly booking: import("effect/Schema").String;
+        readonly tokens: import("effect/Schema").Int;
+        readonly costUsd: import("effect/Schema").Finite;
+        readonly unpricedTokens: import("effect/Schema").Int;
+    }>>;
+    readonly unpriced: import("effect/Schema").Struct<{
+        readonly tokens: import("effect/Schema").Int;
+        readonly models: import("effect/Schema").$Array<import("effect/Schema").String>;
+    }>;
+    readonly ignoredKeys: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly prefix: import("effect/Schema").String;
+        readonly requests: import("effect/Schema").Int;
+    }>>;
+}>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false>>;
 export declare class AgentUsageApi extends AgentUsageApi_base {
 }

package/dist/server/Config.d.ts

@@ -4,18 +4,32 @@
  * - `AGENT_USAGE_HOME` — the store directory (default `~/.local/share/agent-usage`)
  * - `AGENT_USAGE_MACHINE` — the Machine name (default: the short, lower-cased hostname)
  * - `CLAUDE_CONFIG_DIR` / `CODEX_HOME` — the agents' own roots (default `~/.claude`, `~/.codex`)
+ * - `CLAUDE_SECURESTORAGE_CONFIG_DIR` — where Claude Code keeps its credentials when it differs from
+ *   the config directory; with `CLAUDE_CONFIG_DIR` it decides the macOS Keychain item's name
+ * - `AGENT_USAGE_CLAUDE_LIMITS` — the Claude limit samples claude-statusline appends (default
+ *   `${XDG_STATE_HOME:-~/.local/state}/agent-usage/claude-limits.jsonl`)
  * - `AGENT_USAGE_PROJECTS` — extra Known Projects, comma-separated (`RPS,ABC`), for projects typed in
  *   sessions before any branch named them
  *
  * @module
  */
-import { Config, Effect, Path } from "effect";
+import { Config, ConfigProvider, Crypto, Effect, Path } from "effect";
 import type { SourceRoots } from "../core/Ingest.js";
+/** Where Claude Code keeps the OAuth credentials a limit poll reads. */
+export interface ClaudeCredentialsLocation {
+    /** Linux: `<secure storage dir>/.credentials.json`. */
+    readonly file: string;
+    /** macOS: the login Keychain item's service name… */
+    readonly keychainService: string;
+    /** …and its account, the user name. */
+    readonly keychainAccount: string;
+}
 export interface AgentUsageConfig {
     readonly storeDirectory: string;
     /** Known Projects from configuration, added to those branches and paths name. */
     readonly projects: ReadonlyArray<string>;
     readonly claudeConfigDir: string;
+    readonly claudeCredentials: ClaudeCredentialsLocation;
     readonly roots: SourceRoots;
 }
 /**
@@ -23,5 +37,10 @@ export interface AgentUsageConfig {
  * `Example-MacBook.local` and `Example-MacBook` name the same Machine.
  */
 export declare const machineName: (hostname: string) => string;
-/** Reads the configuration; `hostname` comes from the executable, the only place that may ask. */
-export declare const loadConfig: (hostname: string) => Effect.Effect<AgentUsageConfig, Config.ConfigError, Path.Path>;
+/**
+ * Reads the configuration; `hostname` comes from the executable, the only place that may ask.
+ * `exactEnvironment` is the environment with empty values kept, which the executable builds; it
+ * is read only where an empty value means something (`CLAUDE_SECURESTORAGE_CONFIG_DIR`).
+ * `osUser` is the operating system's name for the user, the Keychain account when `USER` is unset.
+ */
+export declare const loadConfig: (hostname: string, exactEnvironment?: ConfigProvider.ConfigProvider, osUser?: string) => Effect.Effect<AgentUsageConfig, Config.ConfigError | import("effect/PlatformError").PlatformError, Crypto.Crypto | Path.Path>;

package/dist/server/Config.js

@@ -4,12 +4,49 @@
  * - `AGENT_USAGE_HOME` — the store directory (default `~/.local/share/agent-usage`)
  * - `AGENT_USAGE_MACHINE` — the Machine name (default: the short, lower-cased hostname)
  * - `CLAUDE_CONFIG_DIR` / `CODEX_HOME` — the agents' own roots (default `~/.claude`, `~/.codex`)
+ * - `CLAUDE_SECURESTORAGE_CONFIG_DIR` — where Claude Code keeps its credentials when it differs from
+ *   the config directory; with `CLAUDE_CONFIG_DIR` it decides the macOS Keychain item's name
+ * - `AGENT_USAGE_CLAUDE_LIMITS` — the Claude limit samples claude-statusline appends (default
+ *   `${XDG_STATE_HOME:-~/.local/state}/agent-usage/claude-limits.jsonl`)
  * - `AGENT_USAGE_PROJECTS` — extra Known Projects, comma-separated (`RPS,ABC`), for projects typed in
  *   sessions before any branch named them
  *
  * @module
  */
-import { Config, Effect, Path, Schema, SchemaTransformation } from "effect";
+import { Config, ConfigProvider, Crypto, Effect, Path, Schema, SchemaTransformation } from "effect";
+import { Hex } from "effect/encoding";
+const KEYCHAIN_SERVICE = "Claude Code-credentials";
+/**
+ * Where Claude Code (2.1.289) keeps its credentials, named the way it names them. The secure-storage
+ * directory is `CLAUDE_SECURESTORAGE_CONFIG_DIR` when set (empty meaning the default `~/.claude`),
+ * else the config directory. The Keychain item is `Claude Code-credentials`, suffixed with the first
+ * eight hex digits of the directory's SHA-256 whenever a non-default directory was chosen, under the
+ * user's account. Asking for the bare name with a custom directory reads another account's item.
+ *
+ * An explicitly empty `CLAUDE_SECURESTORAGE_CONFIG_DIR` means the default directory and the bare
+ * item name, as in Claude Code, so it is read from an environment that keeps empty values.
+ */
+const claudeCredentialsLocation = (options) => Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const digests = yield* Crypto.Crypto;
+    const unsuffixed = options.secureStorageDir === undefined
+        ? !options.configDirChosen
+        : options.secureStorageDir === "";
+    const directory = (options.secureStorageDir === undefined
+        ? options.claudeConfigDir
+        : options.secureStorageDir === ""
+            ? path.join(options.home, ".claude")
+            : options.secureStorageDir).normalize("NFC");
+    const suffix = unsuffixed
+        ? ""
+        : `-${Hex.encode(yield* digests.digest("SHA-256", new TextEncoder().encode(directory))).slice(0, 8)}`;
+    const location = {
+        file: path.join(directory, ".credentials.json"),
+        keychainService: `${KEYCHAIN_SERVICE}${suffix}`,
+        keychainAccount: options.user
+    };
+    return location;
+});
 /**
  * The Machine name a hostname gives: the part before the first dot, lower-cased, so macOS's
  * `Example-MacBook.local` and `Example-MacBook` name the same Machine.
@@ -25,22 +62,47 @@ const Projects = Schema.String.pipe(Schema.decodeTo(Schema.Array(ProjectKey), Sc
     decode: (raw) => raw.split(",").map((entry) => entry.trim()).filter((entry) => entry !== ""),
     encode: (keys) => keys.join(",")
 })));
-/** Reads the configuration; `hostname` comes from the executable, the only place that may ask. */
-export const loadConfig = (hostname) => Effect.gen(function* () {
+/**
+ * Reads the configuration; `hostname` comes from the executable, the only place that may ask.
+ * `exactEnvironment` is the environment with empty values kept, which the executable builds; it
+ * is read only where an empty value means something (`CLAUDE_SECURESTORAGE_CONFIG_DIR`).
+ * `osUser` is the operating system's name for the user, the Keychain account when `USER` is unset.
+ */
+export const loadConfig = (hostname, exactEnvironment, osUser = "claude-code-user") => Effect.gen(function* () {
     const path = yield* Path.Path;
     const home = yield* Config.String("HOME");
     const storeDirectory = yield* Config.String("AGENT_USAGE_HOME").pipe(Config.withDefault(path.join(home, ".local", "share", "agent-usage")));
     const machine = yield* Config.NonEmptyString("AGENT_USAGE_MACHINE").pipe(Config.withDefault(machineName(hostname)));
-    const claudeConfigDir = yield* Config.String("CLAUDE_CONFIG_DIR").pipe(Config.withDefault(path.join(home, ".claude")));
+    const chosenConfigDir = yield* Config.option(Config.String("CLAUDE_CONFIG_DIR"));
+    const claudeConfigDir = chosenConfigDir._tag === "Some" ? chosenConfigDir.value : path.join(home, ".claude");
+    const secureStorageRead = Config.option(Config.String("CLAUDE_SECURESTORAGE_CONFIG_DIR"));
+    const secureStorageDir = yield* (exactEnvironment === undefined
+        ? secureStorageRead
+        : secureStorageRead.pipe(Effect.provideService(ConfigProvider.ConfigProvider, exactEnvironment)));
+    // The Keychain account, as Claude Code names it: USER, else the OS user, kept only when it is a
+    // plain name.
+    const named = yield* Config.String("USER").pipe(Config.withDefault(osUser));
+    const user = /^[a-zA-Z0-9._-]+$/u.test(named) ? named : "claude-code-user";
+    const claudeCredentials = yield* claudeCredentialsLocation({
+        home,
+        user,
+        claudeConfigDir,
+        configDirChosen: chosenConfigDir._tag === "Some",
+        secureStorageDir: secureStorageDir._tag === "Some" ? secureStorageDir.value : undefined
+    });
+    const stateHome = yield* Config.String("XDG_STATE_HOME").pipe(Config.withDefault(path.join(home, ".local", "state")));
+    const claudeLimitSamples = yield* Config.String("AGENT_USAGE_CLAUDE_LIMITS").pipe(Config.withDefault(path.join(stateHome, "agent-usage", "claude-limits.jsonl")));
     const codexHome = yield* Config.String("CODEX_HOME").pipe(Config.withDefault(path.join(home, ".codex")));
     const projects = yield* Config.schema(Projects, "AGENT_USAGE_PROJECTS").pipe(Config.withDefault([]));
     const config = {
         storeDirectory,
         projects,
         claudeConfigDir,
+        claudeCredentials,
         roots: {
             claudeProjects: path.join(claudeConfigDir, "projects"),
             codexHome,
+            claudeLimitSamples,
             machine
         }
     };

package/dist/server/Config.js.map

@@ -1 +1 @@
-{"version":3,"file":"Config.js","sourceRoot":"","sources":["../../src/server/Config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAA;AAW3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAA;AAC3C,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAEjF,iGAAiG;AACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EACxB,oBAAoB,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,CAAC,GAAW,EAAyB,EAAE,CAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;IAC7E,MAAM,EAAE,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;CACxD,CAAC,CACH,CACF,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CACtE,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAC1C,CAAA;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAC/C,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IACpG,MAAM,MAAM,GAAqB;QAC/B,cAAc;QACd,QAAQ;QACR,eAAe;QACf,KAAK,EAAE;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;YACtD,SAAS;YACT,OAAO;SACR;KACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAA"}
+{"version":3,"file":"Config.js","sourceRoot":"","sources":["../../src/server/Config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAA;AACnG,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAsBrC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AAElD;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,CAAC,OAMlC,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACvD,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe;QAC1B,CAAC,CAAC,OAAO,CAAC,gBAAgB,KAAK,EAAE,CAAA;IACnC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACvD,CAAC,CAAC,OAAO,CAAC,eAAe;QACzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,KAAK,EAAE;YACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACvG,MAAM,QAAQ,GAA8B;QAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC/C,eAAe,EAAE,GAAG,gBAAgB,GAAG,MAAM,EAAE;QAC/C,eAAe,EAAE,OAAO,CAAC,IAAI;KAC9B,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAA;AAC3C,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAEjF,iGAAiG;AACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EACxB,oBAAoB,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,CAAC,GAAW,EAAyB,EAAE,CAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;IAC7E,MAAM,EAAE,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;CACxD,CAAC,CACH,CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,QAAgB,EAChB,gBAAgD,EAChD,MAAM,GAAG,kBAAkB,EAC3B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CACtE,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAC1C,CAAA;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAChF,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC5G,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAA;IACzF,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS;QAC7D,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;IACnG,gGAAgG;IAChG,cAAc;IACd,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAA;IAC1E,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC;QACzD,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,eAAe,EAAE,eAAe,CAAC,IAAI,KAAK,MAAM;QAChD,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CACvD,CAAA;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAC/E,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IACpG,MAAM,MAAM,GAAqB;QAC/B,cAAc;QACd,QAAQ;QACR,eAAe;QACf,iBAAiB;QACjB,KAAK,EAAE;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;YACtD,SAAS;YACT,kBAAkB;YAClB,OAAO;SACR;KACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAA"}

package/dist/server/ControlSocket.d.ts

@@ -0,0 +1,73 @@
+import { Duration, Effect, FileSystem, Path, Schema } from "effect";
+import { type OwnerSessionSecretsContract } from "./OwnerSession.js";
+export declare const SOCKET_FILE = "serve.sock";
+export declare const LOCK_FILE = "serve.lock";
+/**
+ * The longest socket path, in bytes, that binds everywhere this runs: macOS holds 104 bytes
+ * including the terminating NUL, Linux 108.
+ */
+export declare const SOCKET_PATH_LIMIT = 103;
+/** How long either side waits for the other before giving up on one exchange. */
+export declare const EXCHANGE_DEADLINE: Duration.Duration;
+declare const ServerNotRunning_base: Schema.Class<ServerNotRunning, Schema.TaggedStruct<"ServerNotRunning", {
+    readonly path: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** No server is listening on this store: start `agent-usage serve`. */
+export declare class ServerNotRunning extends ServerNotRunning_base {
+    get message(): string;
+}
+declare const ServerAlreadyRunning_base: Schema.Class<ServerAlreadyRunning, Schema.TaggedStruct<"ServerAlreadyRunning", {
+    readonly path: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A server already runs on this store; a second one would fight it for the store. */
+export declare class ServerAlreadyRunning extends ServerAlreadyRunning_base {
+    get message(): string;
+}
+declare const SocketPathUnsafe_base: Schema.Class<SocketPathUnsafe, Schema.TaggedStruct<"SocketPathUnsafe", {
+    readonly path: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Something at the socket path is not this user's socket: a symlink, a plain file, a foreign owner. */
+export declare class SocketPathUnsafe extends SocketPathUnsafe_base {
+    get message(): string;
+}
+declare const SocketRefused_base: Schema.Class<SocketRefused, Schema.TaggedStruct<"SocketRefused", {
+    readonly path: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The socket or lock is there but could not be used: no permission, no answer in time, or another failure. */
+export declare class SocketRefused extends SocketRefused_base {
+    get message(): string;
+}
+declare const SocketPathTooLong_base: Schema.Class<SocketPathTooLong, Schema.TaggedStruct<"SocketPathTooLong", {
+    readonly path: Schema.String;
+    readonly bytes: Schema.Number;
+}>, import("effect/Cause").YieldableError>;
+/** The store directory is too deep for a Unix socket path, so this store has no `login`. */
+export declare class SocketPathTooLong extends SocketPathTooLong_base {
+    get message(): string;
+}
+declare const LoginReplyInvalid_base: Schema.Class<LoginReplyInvalid, Schema.TaggedStruct<"LoginReplyInvalid", {
+    readonly reply: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The server answered with something that is not a link. */
+export declare class LoginReplyInvalid extends LoginReplyInvalid_base {
+}
+/**
+ * Holds the store's lock and listens on `<directory>/serve.sock` for the life of the scope; returns
+ * the socket path, or nothing (and logs why) when the path is too long for a Unix socket. Requests
+ * wait for `listening` before a link is minted. Fails with {@link ServerAlreadyRunning} when another
+ * server runs on this store and {@link SocketPathUnsafe} when the path holds anything but this
+ * user's socket.
+ */
+export declare const controlSocket: (directory: string, secrets: OwnerSessionSecretsContract, listening: Effect.Effect<void, never, never>) => Effect.Effect<string | undefined, ServerAlreadyRunning | SocketPathUnsafe | SocketRefused | import("../core/Store.js").StoreError, import("effect/Crypto").Crypto | FileSystem.FileSystem | Path.Path | import("effect/reactivity/Reactivity").Reactivity | import("effect/Scope").Scope>;
+/**
+ * Asks the server running on this store for a fresh one-time link, trusting only a socket owned by
+ * `self`, the user id this process runs as. Fails with
+ * {@link ServerNotRunning} when nothing listens, {@link SocketPathTooLong} when the store has no
+ * control socket, {@link SocketPathUnsafe} when the path is not this user's socket,
+ * {@link SocketRefused} when the socket may not be used or does not answer within
+ * {@link EXCHANGE_DEADLINE}, and {@link LoginReplyInvalid} when the answer is not a link.
+ */
+export declare const requestLoginUrl: (directory: string, self: number) => Effect.Effect<string, LoginReplyInvalid | ServerNotRunning | SocketPathTooLong | SocketPathUnsafe | SocketRefused, FileSystem.FileSystem | Path.Path>;
+export {};