@knpkv/agent-usage 0.1.0 → 0.2.1

package/dist/main.js

@@ -4,23 +4,38 @@
  *
  * - `agent-usage serve` ingests every minute, polls Claude limits every five, and prints the URL
  *   that gets you in.
+ * - `agent-usage login [--open]` asks the running server for a fresh one-time link and prints it.
  * - `agent-usage ingest [--json]` runs one ingest pass and reports what it found.
  *
  * @module
  */
 import { NodeRuntime, NodeServices } from "@effect/platform-node";
-import { Console, Deferred, Effect, Fiber, Layer, Option, Schema } from "effect";
+import { ConfigProvider, Console, Deferred, Effect, Fiber, Layer, Option, Schema } from "effect";
 import { Command, Flag } from "effect/cli";
 import * as Stdio from "effect/Stdio";
 import * as Stream from "effect/Stream";
-import { hostname } from "node:os";
+import { hostname, platform, userInfo } from "node:os";
+// Read at run time from the package.json this file ships next to (`dist/../package.json`).
+import pkg from "../package.json" with { type: "json" };
 import { databaseLayer } from "./core/Database.js";
 import { ingestOnce } from "./core/Ingest.js";
 import { loadConfig } from "./server/Config.js";
-import { makeOwnerSessionSecrets, ownerSessionOrigin, ownerSessionUrl } from "./server/OwnerSession.js";
+import { describeIngest } from "./server/IngestSummary.js";
+import { login as requestLogin } from "./server/Login.js";
+import { makeOwnerSessionSecrets, ownerSessionOrigin } from "./server/OwnerSession.js";
 import { makeServer, Port, PublicOrigin } from "./server/Server.js";
 import { IngestStatus as IngestStatusSchema } from "./shared/contracts.js";
-const config = loadConfig(hostname());
+/** The operating system's name for the user; Claude Code's own fallback when it cannot ask. */
+const osUserName = () => {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return "claude-code-user";
+    }
+};
+// Empty values kept, for the one variable where an empty value means something.
+const config = loadConfig(hostname(), ConfigProvider.fromEnv({ preserveEmptyStrings: true }), osUserName());
 const serve = Command.make("serve", {}, Effect.fn(function* () {
     const stdio = yield* Stdio.Stdio;
     const settings = yield* config;
@@ -29,21 +44,12 @@ const serve = Command.make("serve", {}, Effect.fn(function* () {
     const security = yield* makeOwnerSessionSecrets(ownerSessionOrigin("127.0.0.1", port), Option.getOrUndefined(configuredOrigin));
     const ready = yield* Deferred.make();
     const server = yield* Layer.launch(makeServer({ config: settings, port, ready, security })).pipe(Effect.forkChild({ startImmediately: true }));
-    yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(server));
+    // The server only ends this race by failing; until it is listening there is no link to print.
+    const url = yield* Effect.raceFirst(Deferred.await(ready), Fiber.join(server).pipe(Effect.andThen(Effect.never)));
     // On stdout and nowhere else: this line is the credential, so it is never logged.
-    yield* Stream.make(`agent usage: ${ownerSessionUrl(security.browserOrigin, security)}\n`).pipe(Stream.run(stdio.stdout()));
+    yield* Stream.make(`agent usage: ${url}\n`).pipe(Stream.run(stdio.stdout()));
     return yield* Fiber.join(server);
 })).pipe(Command.withDescription("Record usage continuously and serve the browser view"));
-const describeSource = (name, status) => {
-    if (status.rootMissing)
-        return `${name}: no sessions directory`;
-    const skipped = status.skipped.unparseableLine + status.skipped.missingTimestamp + status.skipped.oversizedLine;
-    return [
-        `${name}: ${status.filesRead}/${status.filesScanned} files read, ${status.eventsAdded} events added`,
-        skipped > 0 ? `, ${skipped} lines skipped` : "",
-        status.unreadable.length > 0 ? `, ${status.unreadable.length} unreadable` : ""
-    ].join("");
-};
 const encodeStatus = Schema.encodeSync(Schema.fromJsonString(IngestStatusSchema));
 const ingest = Command.make("ingest", {
     json: Flag.Boolean("json").pipe(Flag.withDescription("Print the status as one JSON value"), Flag.withDefault(false))
@@ -55,11 +61,15 @@ const ingest = Command.make("ingest", {
     Effect.provide(databaseLayer(settings.storeDirectory)));
     if (json)
         return yield* Console.log(encodeStatus(status));
-    yield* Console.log(describeSource("claude", status.claude));
-    yield* Console.log(describeSource("codex", status.codex));
-    yield* Console.log(`took ${status.finishedAt - status.startedAt}ms`);
+    for (const line of describeIngest(status))
+        yield* Console.log(line);
 })).pipe(Command.withDescription("Run one ingest pass and report what it found"));
-const cli = Command.make("agent-usage").pipe(Command.withDescription("Claude and Codex subscription usage over time, per ticket and against limits"), Command.withSubcommands([serve, ingest]), Command.run({ version: "0.1.0" }));
+const login = Command.make("login", {
+    open: Flag.Boolean("open").pipe(Flag.withDescription("Open the link in the browser too"), Flag.withDefault(false))
+}, 
+// The user id `login` trusts the socket to belong to; -1 (no POSIX ids) matches no owner.
+({ open }) => requestLogin(config, open, platform(), process.geteuid?.() ?? -1)).pipe(Command.withDescription("Print a fresh one-time link to the running server"));
+const cli = Command.make("agent-usage").pipe(Command.withDescription("Claude and Codex subscription usage over time, per ticket and against limits"), Command.withSubcommands([serve, login, ingest]), Command.run({ version: pkg.version }));
 // Executable entry point: the host platform is provided once for this process.
 NodeRuntime.runMain(cli.pipe(Effect.provide(NodeServices.layer)));
 //# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAwC,MAAM,kBAAkB,CAAA;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AACvG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAA;AAErC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,OAAO,EACP,EAAE,EACF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAA;IACxB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC7C,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,EACrC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CACxC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAQ,CAAA;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;IACD,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;IAClE,kFAAkF;IAClF,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,eAAe,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAC5F,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAA;AAEvF,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,MAAoB,EAAU,EAAE;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,GAAG,IAAI,yBAAyB,CAAA;IAC/D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;IAC/G,OAAO;QACL,GAAG,IAAI,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,YAAY,gBAAgB,MAAM,CAAC,WAAW,eAAe;QACpG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE;QAC/C,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,EAAE;KAC/E,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAEjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,QAAQ,EACR;IACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;CACrH,EACD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAC,EAAE,IAAI,EAAE;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,MAAM,GAAiB,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI;IACjE,uFAAuF;IACvF,wDAAwD;IACxD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;IACD,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3D,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,CAAA;AACtE,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAA;AAE/E,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAC1C,OAAO,CAAC,eAAe,CAAC,8EAA8E,CAAC,EACvG,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EACxC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAClC,CAAA;AAED,+EAA+E;AAC/E,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACtD,2FAA2F;AAC3F,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAqB,MAAM,kBAAkB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACzD,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACtF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1E,+FAA+F;AAC/F,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,CAAC;QACH,OAAO,QAAQ,EAAE,CAAC,QAAQ,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAA;AAE3G,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,OAAO,EACP,EAAE,EACF,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC;IACjB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAA;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAA;IACxB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,YAAY,CAAA;IAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,uBAAuB,CAC7C,kBAAkB,CAAC,WAAW,EAAE,IAAI,CAAC,EACrC,MAAM,CAAC,cAAc,CAAC,gBAAgB,CAAC,CACxC,CAAA;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAU,CAAA;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9F,MAAM,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAC7C,CAAA;IACD,8FAA8F;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACjH,kFAAkF;IAClF,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC,IAAI,CAC9C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAC3B,CAAA;IACD,OAAO,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAClC,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,sDAAsD,CAAC,CAAC,CAAA;AAEvF,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC,CAAA;AAEjF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,QAAQ,EACR;IACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;CACrH,EACD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAC,EAAE,IAAI,EAAE;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAA;IAC9B,MAAM,MAAM,GAAiB,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI;IACjE,uFAAuF;IACvF,wDAAwD;IACxD,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACvD,CAAA;IACD,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IACzD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACrE,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,8CAA8C,CAAC,CAAC,CAAA;AAE/E,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CACxB,OAAO,EACP;IACE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,kCAAkC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;CACnH;AACD,0FAA0F;AAC1F,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAChF,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,mDAAmD,CAAC,CAAC,CAAA;AAEpF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAC1C,OAAO,CAAC,eAAe,CAAC,8EAA8E,CAAC,EACvG,OAAO,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,EAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CACtC,CAAA;AAED,+EAA+E;AAC/E,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA"}

package/dist/server/Api.d.ts

@@ -30,14 +30,15 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
                 readonly usedPercent: import("effect/Schema").Finite;
                 readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
             }>, import("effect/Schema").TaggedStruct<"Unknown", {
-                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
             }>]>;
         }>>;
     }>>;
     readonly latest: import("effect/Schema").$Array<import("effect/Schema").Struct<{
         readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
         readonly machine: import("effect/Schema").NonEmptyString;
-        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "codex-rollout"]>;
+        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "claude-statusline", "codex-rollout"]>;
         readonly label: import("effect/Schema").NonEmptyString;
         readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
         readonly observedAt: import("effect/Schema").Int;
@@ -45,7 +46,8 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
             readonly usedPercent: import("effect/Schema").Finite;
             readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
         }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         }>]>;
     }>>;
     readonly balances: import("effect/Schema").$Array<import("effect/Schema").Struct<{
@@ -62,7 +64,8 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
                 readonly credits: import("effect/Schema").Finite;
             }>, import("effect/Schema").TaggedStruct<"Unlimited", {}>, import("effect/Schema").TaggedStruct<"Exhausted", {}>, import("effect/Schema").TaggedStruct<"Disabled", {}>]>;
         }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
         }>]>;
     }>>;
 }>>, import("effect/Schema").toCodecJson<typeof ApiError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/api/status", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
@@ -100,6 +103,21 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
                 readonly reason: import("effect/Schema").String;
             }>>;
         }>;
+        readonly claudeLimitSamples: import("effect/Schema").Struct<{
+            readonly rootMissing: import("effect/Schema").Boolean;
+            readonly filesScanned: import("effect/Schema").Int;
+            readonly filesRead: import("effect/Schema").Int;
+            readonly eventsAdded: import("effect/Schema").Int;
+            readonly skipped: import("effect/Schema").Struct<{
+                readonly unparseableLine: import("effect/Schema").Int;
+                readonly missingTimestamp: import("effect/Schema").Int;
+                readonly oversizedLine: import("effect/Schema").Int;
+            }>;
+            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly fileKey: import("effect/Schema").String;
+                readonly reason: import("effect/Schema").String;
+            }>>;
+        }>;
     }>>;
     readonly ingestFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
     readonly limitsFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
@@ -159,7 +177,113 @@ declare const UsageApiGroup_base: HttpApiGroup.HttpApiGroup<"usage", HttpApiEndp
 }>>, import("effect/Schema").toCodecJson<typeof ApiError>, never, never>, false>;
 export declare class UsageApiGroup extends UsageApiGroup_base {
 }
-declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.HttpApiGroup<"usage", HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/api/usage", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.HttpApiGroup<"usage", HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/api/status", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly machine: import("effect/Schema").String;
+    readonly ingest: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+        readonly startedAt: import("effect/Schema").Int;
+        readonly finishedAt: import("effect/Schema").Int;
+        readonly claude: import("effect/Schema").Struct<{
+            readonly rootMissing: import("effect/Schema").Boolean;
+            readonly filesScanned: import("effect/Schema").Int;
+            readonly filesRead: import("effect/Schema").Int;
+            readonly eventsAdded: import("effect/Schema").Int;
+            readonly skipped: import("effect/Schema").Struct<{
+                readonly unparseableLine: import("effect/Schema").Int;
+                readonly missingTimestamp: import("effect/Schema").Int;
+                readonly oversizedLine: import("effect/Schema").Int;
+            }>;
+            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly fileKey: import("effect/Schema").String;
+                readonly reason: import("effect/Schema").String;
+            }>>;
+        }>;
+        readonly codex: import("effect/Schema").Struct<{
+            readonly rootMissing: import("effect/Schema").Boolean;
+            readonly filesScanned: import("effect/Schema").Int;
+            readonly filesRead: import("effect/Schema").Int;
+            readonly eventsAdded: import("effect/Schema").Int;
+            readonly skipped: import("effect/Schema").Struct<{
+                readonly unparseableLine: import("effect/Schema").Int;
+                readonly missingTimestamp: import("effect/Schema").Int;
+                readonly oversizedLine: import("effect/Schema").Int;
+            }>;
+            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly fileKey: import("effect/Schema").String;
+                readonly reason: import("effect/Schema").String;
+            }>>;
+        }>;
+        readonly claudeLimitSamples: import("effect/Schema").Struct<{
+            readonly rootMissing: import("effect/Schema").Boolean;
+            readonly filesScanned: import("effect/Schema").Int;
+            readonly filesRead: import("effect/Schema").Int;
+            readonly eventsAdded: import("effect/Schema").Int;
+            readonly skipped: import("effect/Schema").Struct<{
+                readonly unparseableLine: import("effect/Schema").Int;
+                readonly missingTimestamp: import("effect/Schema").Int;
+                readonly oversizedLine: import("effect/Schema").Int;
+            }>;
+            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+                readonly fileKey: import("effect/Schema").String;
+                readonly reason: import("effect/Schema").String;
+            }>>;
+        }>;
+    }>>;
+    readonly ingestFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
+    readonly limitsFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
+    readonly ticketLookupFailures: import("effect/Schema").$Array<import("effect/Schema").String>;
+}>>, never, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"limits", "GET", "/api/limits", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    readonly from: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
+    readonly to: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
+}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly series: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
+        readonly label: import("effect/Schema").String;
+        readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
+        readonly points: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+            readonly at: import("effect/Schema").Int;
+            readonly reading: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
+                readonly usedPercent: import("effect/Schema").Finite;
+                readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
+            }>, import("effect/Schema").TaggedStruct<"Unknown", {
+                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+                readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+            }>]>;
+        }>>;
+    }>>;
+    readonly latest: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
+        readonly machine: import("effect/Schema").NonEmptyString;
+        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "claude-statusline", "codex-rollout"]>;
+        readonly label: import("effect/Schema").NonEmptyString;
+        readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
+        readonly observedAt: import("effect/Schema").Int;
+        readonly reading: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
+            readonly usedPercent: import("effect/Schema").Finite;
+            readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
+        }>, import("effect/Schema").TaggedStruct<"Unknown", {
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+        }>]>;
+    }>>;
+    readonly balances: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly kind: import("effect/Schema").Literals<readonly ["claude-extra-usage", "codex-credits"]>;
+        readonly machine: import("effect/Schema").NonEmptyString;
+        readonly observedAt: import("effect/Schema").Int;
+        readonly value: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
+            readonly balance: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Amount", {
+                readonly leftMinor: import("effect/Schema").Finite;
+                readonly limitMinor: import("effect/Schema").Finite;
+                readonly decimals: import("effect/Schema").Int;
+                readonly currency: import("effect/Schema").String;
+            }>, import("effect/Schema").TaggedStruct<"Credits", {
+                readonly credits: import("effect/Schema").Finite;
+            }>, import("effect/Schema").TaggedStruct<"Unlimited", {}>, import("effect/Schema").TaggedStruct<"Exhausted", {}>, import("effect/Schema").TaggedStruct<"Disabled", {}>]>;
+        }>, import("effect/Schema").TaggedStruct<"Unknown", {
+            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "KeychainDenied", "NotSupported", "Fetch", "Parse", "NoData"]>;
+            readonly detail: import("effect/Schema").optionalKey<import("effect/Schema").String>;
+        }>]>;
+    }>>;
+}>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/api/usage", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     readonly from: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
     readonly to: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
     readonly timeZone: import("effect/Schema").String;
@@ -211,94 +335,6 @@ declare const AgentUsageApi_base: HttpApi.HttpApi<"AgentUsageApi", HttpApiGroup.
         readonly prefix: import("effect/Schema").String;
         readonly requests: import("effect/Schema").Int;
     }>>;
-}>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"limits", "GET", "/api/limits", never, import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
-    readonly from: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
-    readonly to: import("effect/Schema").compose<import("effect/Schema").Int, import("effect/Schema").NumberFromString>;
-}>>, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
-    readonly series: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
-        readonly label: import("effect/Schema").String;
-        readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
-        readonly points: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-            readonly at: import("effect/Schema").Int;
-            readonly reading: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
-                readonly usedPercent: import("effect/Schema").Finite;
-                readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
-            }>, import("effect/Schema").TaggedStruct<"Unknown", {
-                readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
-            }>]>;
-        }>>;
-    }>>;
-    readonly latest: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly agent: import("effect/Schema").Literals<readonly ["claude", "codex"]>;
-        readonly machine: import("effect/Schema").NonEmptyString;
-        readonly source: import("effect/Schema").Literals<readonly ["claude-oauth-usage", "codex-rollout"]>;
-        readonly label: import("effect/Schema").NonEmptyString;
-        readonly windowMinutes: import("effect/Schema").NullOr<import("effect/Schema").Int>;
-        readonly observedAt: import("effect/Schema").Int;
-        readonly reading: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
-            readonly usedPercent: import("effect/Schema").Finite;
-            readonly resetsAt: import("effect/Schema").NullOr<import("effect/Schema").Int>;
-        }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
-        }>]>;
-    }>>;
-    readonly balances: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-        readonly kind: import("effect/Schema").Literals<readonly ["claude-extra-usage", "codex-credits"]>;
-        readonly machine: import("effect/Schema").NonEmptyString;
-        readonly observedAt: import("effect/Schema").Int;
-        readonly value: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Known", {
-            readonly balance: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Amount", {
-                readonly leftMinor: import("effect/Schema").Finite;
-                readonly limitMinor: import("effect/Schema").Finite;
-                readonly decimals: import("effect/Schema").Int;
-                readonly currency: import("effect/Schema").String;
-            }>, import("effect/Schema").TaggedStruct<"Credits", {
-                readonly credits: import("effect/Schema").Finite;
-            }>, import("effect/Schema").TaggedStruct<"Unlimited", {}>, import("effect/Schema").TaggedStruct<"Exhausted", {}>, import("effect/Schema").TaggedStruct<"Disabled", {}>]>;
-        }>, import("effect/Schema").TaggedStruct<"Unknown", {
-            readonly reason: import("effect/Schema").Literals<readonly ["NoAuth", "AuthExpired", "NotSupported", "Fetch", "Parse", "NoData"]>;
-        }>]>;
-    }>>;
-}>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never> | HttpApiEndpoint.HttpApiEndpoint<"status", "GET", "/api/status", never, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
-    readonly machine: import("effect/Schema").String;
-    readonly ingest: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
-        readonly startedAt: import("effect/Schema").Int;
-        readonly finishedAt: import("effect/Schema").Int;
-        readonly claude: import("effect/Schema").Struct<{
-            readonly rootMissing: import("effect/Schema").Boolean;
-            readonly filesScanned: import("effect/Schema").Int;
-            readonly filesRead: import("effect/Schema").Int;
-            readonly eventsAdded: import("effect/Schema").Int;
-            readonly skipped: import("effect/Schema").Struct<{
-                readonly unparseableLine: import("effect/Schema").Int;
-                readonly missingTimestamp: import("effect/Schema").Int;
-                readonly oversizedLine: import("effect/Schema").Int;
-            }>;
-            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-                readonly fileKey: import("effect/Schema").String;
-                readonly reason: import("effect/Schema").String;
-            }>>;
-        }>;
-        readonly codex: import("effect/Schema").Struct<{
-            readonly rootMissing: import("effect/Schema").Boolean;
-            readonly filesScanned: import("effect/Schema").Int;
-            readonly filesRead: import("effect/Schema").Int;
-            readonly eventsAdded: import("effect/Schema").Int;
-            readonly skipped: import("effect/Schema").Struct<{
-                readonly unparseableLine: import("effect/Schema").Int;
-                readonly missingTimestamp: import("effect/Schema").Int;
-                readonly oversizedLine: import("effect/Schema").Int;
-            }>;
-            readonly unreadable: import("effect/Schema").$Array<import("effect/Schema").Struct<{
-                readonly fileKey: import("effect/Schema").String;
-                readonly reason: import("effect/Schema").String;
-            }>>;
-        }>;
-    }>>;
-    readonly ingestFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
-    readonly limitsFailure: import("effect/Schema").NullOr<import("effect/Schema").String>;
-    readonly ticketLookupFailures: import("effect/Schema").$Array<import("effect/Schema").String>;
-}>>, never, OwnerSessionAuth, never>, false>>;
+}>>, import("effect/Schema").toCodecJson<typeof ApiError>, OwnerSessionAuth, never>, false>>;
 export declare class AgentUsageApi extends AgentUsageApi_base {
 }

package/dist/server/Config.d.ts

@@ -4,18 +4,32 @@
  * - `AGENT_USAGE_HOME` — the store directory (default `~/.local/share/agent-usage`)
  * - `AGENT_USAGE_MACHINE` — the Machine name (default: the short, lower-cased hostname)
  * - `CLAUDE_CONFIG_DIR` / `CODEX_HOME` — the agents' own roots (default `~/.claude`, `~/.codex`)
+ * - `CLAUDE_SECURESTORAGE_CONFIG_DIR` — where Claude Code keeps its credentials when it differs from
+ *   the config directory; with `CLAUDE_CONFIG_DIR` it decides the macOS Keychain item's name
+ * - `AGENT_USAGE_CLAUDE_LIMITS` — the Claude limit samples claude-statusline appends (default
+ *   `${XDG_STATE_HOME:-~/.local/state}/agent-usage/claude-limits.jsonl`)
  * - `AGENT_USAGE_PROJECTS` — extra Known Projects, comma-separated (`RPS,ABC`), for projects typed in
  *   sessions before any branch named them
  *
  * @module
  */
-import { Config, Effect, Path } from "effect";
+import { Config, ConfigProvider, Crypto, Effect, Path } from "effect";
 import type { SourceRoots } from "../core/Ingest.js";
+/** Where Claude Code keeps the OAuth credentials a limit poll reads. */
+export interface ClaudeCredentialsLocation {
+    /** Linux: `<secure storage dir>/.credentials.json`. */
+    readonly file: string;
+    /** macOS: the login Keychain item's service name… */
+    readonly keychainService: string;
+    /** …and its account, the user name. */
+    readonly keychainAccount: string;
+}
 export interface AgentUsageConfig {
     readonly storeDirectory: string;
     /** Known Projects from configuration, added to those branches and paths name. */
     readonly projects: ReadonlyArray<string>;
     readonly claudeConfigDir: string;
+    readonly claudeCredentials: ClaudeCredentialsLocation;
     readonly roots: SourceRoots;
 }
 /**
@@ -23,5 +37,10 @@ export interface AgentUsageConfig {
  * `Example-MacBook.local` and `Example-MacBook` name the same Machine.
  */
 export declare const machineName: (hostname: string) => string;
-/** Reads the configuration; `hostname` comes from the executable, the only place that may ask. */
-export declare const loadConfig: (hostname: string) => Effect.Effect<AgentUsageConfig, Config.ConfigError, Path.Path>;
+/**
+ * Reads the configuration; `hostname` comes from the executable, the only place that may ask.
+ * `exactEnvironment` is the environment with empty values kept, which the executable builds; it
+ * is read only where an empty value means something (`CLAUDE_SECURESTORAGE_CONFIG_DIR`).
+ * `osUser` is the operating system's name for the user, the Keychain account when `USER` is unset.
+ */
+export declare const loadConfig: (hostname: string, exactEnvironment?: ConfigProvider.ConfigProvider, osUser?: string) => Effect.Effect<AgentUsageConfig, Config.ConfigError | import("effect/PlatformError").PlatformError, Crypto.Crypto | Path.Path>;

package/dist/server/Config.js

@@ -4,12 +4,49 @@
  * - `AGENT_USAGE_HOME` — the store directory (default `~/.local/share/agent-usage`)
  * - `AGENT_USAGE_MACHINE` — the Machine name (default: the short, lower-cased hostname)
  * - `CLAUDE_CONFIG_DIR` / `CODEX_HOME` — the agents' own roots (default `~/.claude`, `~/.codex`)
+ * - `CLAUDE_SECURESTORAGE_CONFIG_DIR` — where Claude Code keeps its credentials when it differs from
+ *   the config directory; with `CLAUDE_CONFIG_DIR` it decides the macOS Keychain item's name
+ * - `AGENT_USAGE_CLAUDE_LIMITS` — the Claude limit samples claude-statusline appends (default
+ *   `${XDG_STATE_HOME:-~/.local/state}/agent-usage/claude-limits.jsonl`)
  * - `AGENT_USAGE_PROJECTS` — extra Known Projects, comma-separated (`RPS,ABC`), for projects typed in
  *   sessions before any branch named them
  *
  * @module
  */
-import { Config, Effect, Path, Schema, SchemaTransformation } from "effect";
+import { Config, ConfigProvider, Crypto, Effect, Path, Schema, SchemaTransformation } from "effect";
+import { Hex } from "effect/encoding";
+const KEYCHAIN_SERVICE = "Claude Code-credentials";
+/**
+ * Where Claude Code (2.1.289) keeps its credentials, named the way it names them. The secure-storage
+ * directory is `CLAUDE_SECURESTORAGE_CONFIG_DIR` when set (empty meaning the default `~/.claude`),
+ * else the config directory. The Keychain item is `Claude Code-credentials`, suffixed with the first
+ * eight hex digits of the directory's SHA-256 whenever a non-default directory was chosen, under the
+ * user's account. Asking for the bare name with a custom directory reads another account's item.
+ *
+ * An explicitly empty `CLAUDE_SECURESTORAGE_CONFIG_DIR` means the default directory and the bare
+ * item name, as in Claude Code, so it is read from an environment that keeps empty values.
+ */
+const claudeCredentialsLocation = (options) => Effect.gen(function* () {
+    const path = yield* Path.Path;
+    const digests = yield* Crypto.Crypto;
+    const unsuffixed = options.secureStorageDir === undefined
+        ? !options.configDirChosen
+        : options.secureStorageDir === "";
+    const directory = (options.secureStorageDir === undefined
+        ? options.claudeConfigDir
+        : options.secureStorageDir === ""
+            ? path.join(options.home, ".claude")
+            : options.secureStorageDir).normalize("NFC");
+    const suffix = unsuffixed
+        ? ""
+        : `-${Hex.encode(yield* digests.digest("SHA-256", new TextEncoder().encode(directory))).slice(0, 8)}`;
+    const location = {
+        file: path.join(directory, ".credentials.json"),
+        keychainService: `${KEYCHAIN_SERVICE}${suffix}`,
+        keychainAccount: options.user
+    };
+    return location;
+});
 /**
  * The Machine name a hostname gives: the part before the first dot, lower-cased, so macOS's
  * `Example-MacBook.local` and `Example-MacBook` name the same Machine.
@@ -25,22 +62,47 @@ const Projects = Schema.String.pipe(Schema.decodeTo(Schema.Array(ProjectKey), Sc
     decode: (raw) => raw.split(",").map((entry) => entry.trim()).filter((entry) => entry !== ""),
     encode: (keys) => keys.join(",")
 })));
-/** Reads the configuration; `hostname` comes from the executable, the only place that may ask. */
-export const loadConfig = (hostname) => Effect.gen(function* () {
+/**
+ * Reads the configuration; `hostname` comes from the executable, the only place that may ask.
+ * `exactEnvironment` is the environment with empty values kept, which the executable builds; it
+ * is read only where an empty value means something (`CLAUDE_SECURESTORAGE_CONFIG_DIR`).
+ * `osUser` is the operating system's name for the user, the Keychain account when `USER` is unset.
+ */
+export const loadConfig = (hostname, exactEnvironment, osUser = "claude-code-user") => Effect.gen(function* () {
     const path = yield* Path.Path;
     const home = yield* Config.String("HOME");
     const storeDirectory = yield* Config.String("AGENT_USAGE_HOME").pipe(Config.withDefault(path.join(home, ".local", "share", "agent-usage")));
     const machine = yield* Config.NonEmptyString("AGENT_USAGE_MACHINE").pipe(Config.withDefault(machineName(hostname)));
-    const claudeConfigDir = yield* Config.String("CLAUDE_CONFIG_DIR").pipe(Config.withDefault(path.join(home, ".claude")));
+    const chosenConfigDir = yield* Config.option(Config.String("CLAUDE_CONFIG_DIR"));
+    const claudeConfigDir = chosenConfigDir._tag === "Some" ? chosenConfigDir.value : path.join(home, ".claude");
+    const secureStorageRead = Config.option(Config.String("CLAUDE_SECURESTORAGE_CONFIG_DIR"));
+    const secureStorageDir = yield* (exactEnvironment === undefined
+        ? secureStorageRead
+        : secureStorageRead.pipe(Effect.provideService(ConfigProvider.ConfigProvider, exactEnvironment)));
+    // The Keychain account, as Claude Code names it: USER, else the OS user, kept only when it is a
+    // plain name.
+    const named = yield* Config.String("USER").pipe(Config.withDefault(osUser));
+    const user = /^[a-zA-Z0-9._-]+$/u.test(named) ? named : "claude-code-user";
+    const claudeCredentials = yield* claudeCredentialsLocation({
+        home,
+        user,
+        claudeConfigDir,
+        configDirChosen: chosenConfigDir._tag === "Some",
+        secureStorageDir: secureStorageDir._tag === "Some" ? secureStorageDir.value : undefined
+    });
+    const stateHome = yield* Config.String("XDG_STATE_HOME").pipe(Config.withDefault(path.join(home, ".local", "state")));
+    const claudeLimitSamples = yield* Config.String("AGENT_USAGE_CLAUDE_LIMITS").pipe(Config.withDefault(path.join(stateHome, "agent-usage", "claude-limits.jsonl")));
     const codexHome = yield* Config.String("CODEX_HOME").pipe(Config.withDefault(path.join(home, ".codex")));
     const projects = yield* Config.schema(Projects, "AGENT_USAGE_PROJECTS").pipe(Config.withDefault([]));
     const config = {
         storeDirectory,
         projects,
         claudeConfigDir,
+        claudeCredentials,
         roots: {
             claudeProjects: path.join(claudeConfigDir, "projects"),
             codexHome,
+            claudeLimitSamples,
             machine
         }
     };

package/dist/server/Config.js.map

@@ -1 +1 @@
-{"version":3,"file":"Config.js","sourceRoot":"","sources":["../../src/server/Config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAA;AAW3E;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAA;AAC3C,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAEjF,iGAAiG;AACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EACxB,oBAAoB,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,CAAC,GAAW,EAAyB,EAAE,CAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;IAC7E,MAAM,EAAE,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;CACxD,CAAC,CACH,CACF,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,EAAE,CAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CACtE,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAC1C,CAAA;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACpE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAC/C,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IACpG,MAAM,MAAM,GAAqB;QAC/B,cAAc;QACd,QAAQ;QACR,eAAe;QACf,KAAK,EAAE;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;YACtD,SAAS;YACT,OAAO;SACR;KACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAA"}
+{"version":3,"file":"Config.js","sourceRoot":"","sources":["../../src/server/Config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAA;AACnG,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAsBrC,MAAM,gBAAgB,GAAG,yBAAyB,CAAA;AAElD;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,CAAC,OAMlC,EAAE,EAAE,CACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACvD,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe;QAC1B,CAAC,CAAC,OAAO,CAAC,gBAAgB,KAAK,EAAE,CAAA;IACnC,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;QACvD,CAAC,CAAC,OAAO,CAAC,eAAe;QACzB,CAAC,CAAC,OAAO,CAAC,gBAAgB,KAAK,EAAE;YACjC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;YACpC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IACvG,MAAM,QAAQ,GAA8B;QAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAC/C,eAAe,EAAE,GAAG,gBAAgB,GAAG,MAAM,EAAE;QAC/C,eAAe,EAAE,OAAO,CAAC,IAAI;KAC9B,CAAA;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAC,CAAA;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAA;IAChE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAA;AAC3C,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAA;AAEjF,iGAAiG;AACjG,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CACjC,MAAM,CAAC,QAAQ,CACb,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EACxB,oBAAoB,CAAC,SAAS,CAAC;IAC7B,MAAM,EAAE,CAAC,GAAW,EAAyB,EAAE,CAC7C,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;IAC7E,MAAM,EAAE,CAAC,IAA2B,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;CACxD,CAAC,CACH,CACF,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,QAAgB,EAChB,gBAAgD,EAChD,MAAM,GAAG,kBAAkB,EAC3B,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAClE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CACtE,CAAA;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,qBAAqB,CAAC,CAAC,IAAI,CACtE,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAC1C,CAAA;IACD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAA;IAChF,MAAM,eAAe,GAAG,eAAe,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC5G,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iCAAiC,CAAC,CAAC,CAAA;IACzF,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS;QAC7D,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAA;IACnG,gGAAgG;IAChG,cAAc;IACd,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAA;IAC1E,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC;QACzD,IAAI;QACJ,IAAI;QACJ,eAAe;QACf,eAAe,EAAE,eAAe,CAAC,IAAI,KAAK,MAAM;QAChD,gBAAgB,EAAE,gBAAgB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACxF,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CACvD,CAAA;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAC/E,CAAA;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACxG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IACpG,MAAM,MAAM,GAAqB;QAC/B,cAAc;QACd,QAAQ;QACR,eAAe;QACf,iBAAiB;QACjB,KAAK,EAAE;YACL,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;YACtD,SAAS;YACT,kBAAkB;YAClB,OAAO;SACR;KACF,CAAA;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAC,CAAA"}