@ours.network/fleet 1.2.0-nightly.21 → 1.2.0-nightly.23

package/dist/subscriptions/launch.js

@@ -0,0 +1,93 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { FleetError } from '../application/errors.js';
+import { DEFAULT_PROFILE_ID, profileHome, readSubscriptionState, writePin, } from './store.js';
+/** The subscription provider a harness authenticates with, if Fleet manages it. */
+export function providerForHarness(harness) {
+    if (harness === 'claude-code')
+        return 'claude';
+    if (harness === 'codex')
+        return 'codex';
+    return undefined;
+}
+/** Env var that selects the CLI home for each provider. */
+export const HOME_ENV = {
+    claude: 'CLAUDE_CONFIG_DIR',
+    codex: 'CODEX_HOME',
+};
+/**
+ * Credential sources that would silently outrank the fleet-wide active profile
+ * (see Claude Code's documented authentication precedence and Codex's
+ * API-key login). While a non-default profile is active they are refused.
+ */
+export const CONFLICTING_AUTH_ENV = {
+    claude: [
+        'CLAUDE_CONFIG_DIR', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN',
+        'CLAUDE_CODE_OAUTH_REFRESH_TOKEN', 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR',
+        'CLAUDE_CODE_USE_BEDROCK', 'CLAUDE_CODE_USE_VERTEX', 'CLAUDE_CODE_USE_FOUNDRY', 'ANTHROPIC_PROFILE',
+        'ANTHROPIC_FEDERATION_RULE_ID', 'ANTHROPIC_ORGANIZATION_ID', 'ANTHROPIC_IDENTITY_TOKEN_FILE',
+    ],
+    codex: ['CODEX_HOME', 'OPENAI_API_KEY', 'CODEX_API_KEY'],
+};
+/** Claude managed-settings file (Linux), which outranks user settings. */
+export const CLAUDE_MANAGED_SETTINGS = '/etc/claude-code/managed-settings.json';
+/**
+ * Competing Claude credential sources declared in settings files: an `env`
+ * block entry from CONFLICTING_AUTH_ENV, or an `apiKeyHelper`. Settings are
+ * shared into profiles, so they can silently outrank a profile's login.
+ */
+export function claudeSettingsAuthSources(home, managed = CLAUDE_MANAGED_SETTINGS) {
+    const found = [];
+    for (const file of [join(home, 'settings.json'), managed]) {
+        let settings;
+        try {
+            settings = JSON.parse(readFileSync(file, 'utf8'));
+        }
+        catch {
+            continue;
+        }
+        for (const key of CONFLICTING_AUTH_ENV.claude)
+            if (settings?.env && typeof settings.env === 'object' && key in settings.env)
+                found.push(`${key} (${file})`);
+        if (settings?.apiKeyHelper)
+            found.push(`apiKeyHelper (${file})`);
+    }
+    return found;
+}
+/**
+ * Resolve the provider's active profile for a launch and record it in the
+ * agent's state dir. Resolution happens once, here: a later switch never
+ * changes what this session uses.
+ */
+export function pinSubscriptionForLaunch(role, stateDir, inherited = process.env, now = () => new Date()) {
+    const provider = providerForHarness(role.harness);
+    // A loopback auth proxy supplies credentials itself; it is not managed here.
+    if (!provider || role.auth_proxy)
+        return undefined;
+    const profileId = readSubscriptionState().providers[provider].activeProfileId;
+    const pin = { provider, profileId, pinnedAt: now().toISOString() };
+    if (profileId === DEFAULT_PROFILE_ID) {
+        // The adopted default launches exactly as before; credential env that points
+        // elsewhere is recorded so the panel can say this session is not managed.
+        const unmanaged = CONFLICTING_AUTH_ENV[provider].filter(key => role.env?.[key] !== undefined || inherited[key]);
+        if (unmanaged.length)
+            pin.unmanaged = unmanaged;
+        writePin(stateDir, pin);
+        return { pin, env: {} };
+    }
+    const conflicts = CONFLICTING_AUTH_ENV[provider].filter(key => role.env?.[key] !== undefined || (key !== HOME_ENV[provider] && inherited[key]));
+    if (conflicts.length) {
+        throw new FleetError('invalid_request', `role '${role.name}': ${conflicts.join(', ')} would bypass the active ${provider} subscription profile; ` +
+            'remove it from the role env / supervisor environment or switch back to the default profile');
+    }
+    const home = profileHome(provider, profileId);
+    if (provider === 'claude') {
+        const settings = claudeSettingsAuthSources(home);
+        if (settings.length) {
+            throw new FleetError('invalid_request', `role '${role.name}': Claude settings declare ${settings.join(', ')}, which would bypass the active subscription profile`);
+        }
+    }
+    pin.home = home;
+    writePin(stateDir, pin);
+    return { pin, env: { [HOME_ENV[provider]]: home }, writablePath: home };
+}

package/dist/subscriptions/login.d.ts

@@ -0,0 +1,75 @@
+import { type SubscriptionBinaries } from './cli.js';
+import type { SubscriptionProvider } from './store.js';
+/**
+ * A short-lived, browser-owned login. The URL comes from the official CLI and
+ * is shown only if its origin is on the provider's allowlist; the user's code
+ * goes to the CLI's stdin exactly once and is never stored.
+ */
+export type LoginState = 'starting' | 'awaiting_user' | 'verifying' | 'succeeded' | 'failed' | 'cancelled' | 'expired';
+export interface LoginView {
+    loginId: string;
+    provider: SubscriptionProvider;
+    kind: 'paste_code' | 'device_code';
+    state: LoginState;
+    url?: string;
+    /** Device code to type at `url`; only exposed while the user still needs it. */
+    userCode?: string;
+    expiresAt: string;
+    error?: string;
+}
+export declare const LOGIN_TTL_MS: number;
+export declare const LOGIN_URL_ALLOWLIST: Record<SubscriptionProvider, string[]>;
+export declare function allowedLoginUrl(provider: SubscriptionProvider, raw: string): string | undefined;
+export interface LoginHandle {
+    view(): LoginView;
+    /** Browser session that started the login; only it may act on it. */
+    readonly owner: string;
+    submitCode(code: string): void;
+    cancel(): void;
+    /** Resolves when the CLI has finished (success or not). */
+    readonly done: Promise<boolean>;
+}
+declare abstract class BaseLogin implements LoginHandle {
+    readonly provider: SubscriptionProvider;
+    readonly owner: string;
+    readonly kind: LoginView['kind'];
+    readonly loginId: string;
+    readonly expiresAt: number;
+    state: LoginState;
+    url?: string;
+    userCode?: string;
+    error?: string;
+    done: Promise<boolean>;
+    protected finish: (ok: boolean) => void;
+    private readonly timer;
+    constructor(provider: SubscriptionProvider, owner: string, kind: LoginView['kind'], now?: number);
+    view(): LoginView;
+    abstract submitCode(code: string): void;
+    protected abstract stop(): void;
+    cancel(): void;
+    protected end(state: LoginState, error?: string): void;
+    /** Called by the service after verifying the new home. */
+    complete(ok: boolean, error?: string): void;
+}
+/** `claude auth login` inside script(1): prints an authorize URL, then reads a paste code. */
+export declare class ClaudeLogin extends BaseLogin {
+    private child?;
+    private output;
+    private submitted;
+    /** Resolves with the CLI exit status once it exits. */
+    exited: Promise<number | null>;
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    submitCode(code: string): void;
+    protected stop(): void;
+}
+/** Codex device-code login through the app-server's supported account API. */
+export declare class CodexDeviceLogin extends BaseLogin {
+    private server?;
+    private codexLoginId?;
+    /** Resolves true when the app-server reports a successful login. */
+    completed: Promise<boolean>;
+    constructor(owner: string, bins: SubscriptionBinaries, home: string, profileId: string);
+    submitCode(): void;
+    protected stop(): void;
+}
+export {};

package/dist/subscriptions/login.js

@@ -0,0 +1,182 @@
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { FleetError } from '../application/errors.js';
+import { CodexAppServer, profileEnv } from './cli.js';
+export const LOGIN_TTL_MS = 10 * 60_000;
+export const LOGIN_URL_ALLOWLIST = {
+    claude: ['claude.com', 'claude.ai', 'platform.claude.com', 'console.anthropic.com'],
+    codex: ['auth.openai.com'],
+};
+export function allowedLoginUrl(provider, raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.port)
+        return undefined;
+    return LOGIN_URL_ALLOWLIST[provider].includes(url.hostname) ? url.toString() : undefined;
+}
+/** Claude paste codes are opaque `code#state` strings; refuse anything else. */
+const PASTE_CODE_RE = /^[A-Za-z0-9._~#-]{8,512}$/;
+const URL_RE = /https:\/\/[^\s\x07\x1b"'<>\\]+/;
+class BaseLogin {
+    provider;
+    owner;
+    kind;
+    loginId = randomBytes(16).toString('hex');
+    expiresAt;
+    state = 'starting';
+    url;
+    userCode;
+    error;
+    done;
+    finish;
+    timer;
+    constructor(provider, owner, kind, now = Date.now()) {
+        this.provider = provider;
+        this.owner = owner;
+        this.kind = kind;
+        this.expiresAt = now + LOGIN_TTL_MS;
+        this.done = new Promise(resolve => { this.finish = resolve; });
+        this.timer = setTimeout(() => this.end('expired', 'login timed out'), LOGIN_TTL_MS);
+        this.timer.unref?.();
+    }
+    view() {
+        const live = this.state === 'starting' || this.state === 'awaiting_user';
+        return {
+            loginId: this.loginId, provider: this.provider, kind: this.kind, state: this.state,
+            url: live ? this.url : undefined,
+            userCode: this.state === 'awaiting_user' ? this.userCode : undefined,
+            expiresAt: new Date(this.expiresAt).toISOString(),
+            error: this.error,
+        };
+    }
+    cancel() { this.end('cancelled'); }
+    end(state, error) {
+        if (['succeeded', 'failed', 'cancelled', 'expired'].includes(this.state))
+            return;
+        this.state = state;
+        this.error = error?.slice(0, 200);
+        this.userCode = undefined;
+        clearTimeout(this.timer);
+        this.stop();
+        this.finish(state === 'succeeded');
+    }
+    /** Called by the service after verifying the new home. */
+    complete(ok, error) { this.end(ok ? 'succeeded' : 'failed', error); }
+}
+/** `claude auth login` inside script(1): prints an authorize URL, then reads a paste code. */
+export class ClaudeLogin extends BaseLogin {
+    child;
+    output = '';
+    submitted = false;
+    /** Resolves with the CLI exit status once it exits. */
+    exited;
+    constructor(owner, bins, home, profileId) {
+        super('claude', owner, 'paste_code');
+        const child = spawn(bins.script, ['-qefc', `${shellQuote(bins.claude)} auth login`, '/dev/null'], {
+            env: profileEnv('CLAUDE_CONFIG_DIR', profileId, home), stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        this.child = child;
+        child.stdin.on('error', () => { });
+        const onData = (chunk) => {
+            if (this.output.length < 64 * 1024)
+                this.output += chunk.toString('utf8');
+            if (!this.url) {
+                const match = URL_RE.exec(this.output);
+                if (match) {
+                    const url = allowedLoginUrl('claude', match[0]);
+                    if (!url) {
+                        this.end('failed', 'the CLI returned an unexpected sign-in address');
+                        return;
+                    }
+                    this.url = url;
+                    this.state = 'awaiting_user';
+                }
+            }
+            // Claude asks for Enter after success; the answer carries no secret.
+            if (this.submitted && /press enter/i.test(this.output))
+                child.stdin.write('\r');
+        };
+        child.stdout.on('data', onData);
+        child.stderr.on('data', onData);
+        this.exited = new Promise(resolve => {
+            child.once('error', () => { this.end('failed', 'could not start the sign-in'); resolve(null); });
+            child.once('close', code => resolve(code));
+        });
+    }
+    submitCode(code) {
+        if (this.state !== 'awaiting_user' || this.submitted)
+            throw new FleetError('conflict', 'this login is not waiting for a code');
+        if (!PASTE_CODE_RE.test(code))
+            throw new FleetError('invalid_request', 'that does not look like a sign-in code');
+        this.submitted = true;
+        this.state = 'verifying';
+        this.output = '';
+        this.child?.stdin.write(`${code}\r`);
+    }
+    stop() { this.child?.kill('SIGTERM'); }
+}
+/** Codex device-code login through the app-server's supported account API. */
+export class CodexDeviceLogin extends BaseLogin {
+    server;
+    codexLoginId;
+    /** Resolves true when the app-server reports a successful login. */
+    completed;
+    constructor(owner, bins, home, profileId) {
+        super('codex', owner, 'device_code');
+        this.completed = (async () => {
+            try {
+                this.server = await CodexAppServer.start(bins.codex, profileEnv('CODEX_HOME', profileId, home));
+                if (this.state !== 'starting') {
+                    this.server.close();
+                    return false;
+                }
+                const completion = new Promise(resolve => {
+                    this.server.onNotification((method, params) => {
+                        const p = params;
+                        if (method === 'account/login/completed' && (!p.loginId || p.loginId === this.codexLoginId)) {
+                            if (!p.success)
+                                this.error = 'sign-in was not completed';
+                            resolve(Boolean(p.success));
+                        }
+                    });
+                });
+                const started = await this.server.call('account/login/start', { type: 'chatgptDeviceCode' });
+                if (this.state !== 'starting') {
+                    this.server.close();
+                    return false;
+                }
+                const url = started.verificationUrl && allowedLoginUrl('codex', started.verificationUrl);
+                if (!url || !started.userCode) {
+                    this.end('failed', 'the CLI returned an unexpected sign-in address');
+                    return false;
+                }
+                this.codexLoginId = started.loginId;
+                this.url = url;
+                this.userCode = String(started.userCode).slice(0, 32);
+                this.state = 'awaiting_user';
+                const ok = await Promise.race([completion, this.done.then(() => false)]);
+                if (this.state === 'awaiting_user')
+                    this.state = 'verifying';
+                return ok;
+            }
+            catch {
+                this.end('failed', 'could not start the sign-in');
+                return false;
+            }
+        })();
+    }
+    submitCode() { throw new FleetError('invalid_request', 'device-code logins need no code from Fleet'); }
+    stop() {
+        if (this.server && this.codexLoginId && this.state === 'cancelled')
+            void this.server.call('account/login/cancel', { loginId: this.codexLoginId }, 3_000).catch(() => { });
+        setTimeout(() => this.server?.close(), 500).unref?.();
+    }
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/dist/subscriptions/observed.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Persist the Claude subscription rate-limit snapshot an agent session just
+ * received (SDK `rate_limit_event`, forwarded by claude-agent-acp as
+ * `usage_update._meta["_claude/rateLimit"]`). Only numbers and window names
+ * are kept. The web backend attributes it to the agent's pinned profile.
+ */
+export declare function recordClaudeRateLimit(stateDir: string, info: unknown, now?: Date): boolean;

package/dist/subscriptions/observed.js

@@ -0,0 +1,44 @@
+import { join } from 'node:path';
+import { replaceFileAtomically } from '../atomic-file.js';
+import { OBSERVED_USAGE_FILE } from './store.js';
+const WINDOW_LABELS = {
+    five_hour: { label: '5h', mins: 300 },
+    seven_day: { label: 'weekly', mins: 10_080 },
+    seven_day_opus: { label: 'weekly · Opus', mins: 10_080 },
+    seven_day_sonnet: { label: 'weekly · Sonnet', mins: 10_080 },
+};
+/**
+ * Persist the Claude subscription rate-limit snapshot an agent session just
+ * received (SDK `rate_limit_event`, forwarded by claude-agent-acp as
+ * `usage_update._meta["_claude/rateLimit"]`). Only numbers and window names
+ * are kept. The web backend attributes it to the agent's pinned profile.
+ */
+export function recordClaudeRateLimit(stateDir, info, now = new Date()) {
+    if (!info || typeof info !== 'object')
+        return false;
+    const raw = info;
+    const entries = raw.unifiedWindows && typeof raw.unifiedWindows === 'object'
+        ? Object.entries(raw.unifiedWindows)
+        : typeof raw.rateLimitType === 'string' ? [[raw.rateLimitType, raw]] : [];
+    const windows = [];
+    for (const [id, w] of entries) {
+        if (!/^[a-z0-9_]{1,40}$/.test(id) || !w || typeof w.utilization !== 'number' || !Number.isFinite(w.utilization))
+            continue;
+        const known = WINDOW_LABELS[id];
+        windows.push({
+            id, label: known?.label ?? id.replace(/_/g, ' '),
+            usedPercent: Math.round(Math.max(0, w.utilization) * 1000) / 10,
+            windowMins: known?.mins,
+            resetsAt: typeof w.resetsAt === 'number' ? new Date(w.resetsAt * 1000).toISOString() : undefined,
+        });
+    }
+    if (!windows.length)
+        return false;
+    try {
+        replaceFileAtomically(join(stateDir, OBSERVED_USAGE_FILE), `${JSON.stringify({ windows, observedAt: now.toISOString(), source: 'agent' })}\n`, 0o600);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/subscriptions/probe.d.ts

@@ -0,0 +1,10 @@
+export interface ClaudeProbeResult {
+    rateLimit?: unknown;
+    exhausted: boolean;
+}
+/**
+ * Ask Haiku for one short reply in the selected Claude home. The JSONL stream
+ * can contain a rate_limit_event; prompts, replies and CLI stderr are discarded.
+ * This runs only after an explicit UI action and has a time and spend bound.
+ */
+export declare function probeClaudeRateLimit(bin: string, profileId: string, timeoutMs?: number): Promise<ClaudeProbeResult | undefined>;

package/dist/subscriptions/probe.js

@@ -0,0 +1,73 @@
+import { spawn } from 'node:child_process';
+import { mkdirSync } from 'node:fs';
+import { profileEnv } from './cli.js';
+import { profileHome, subscriptionsRoot } from './store.js';
+const LIMIT_ERROR = /\b(?:hit (?:your |the )?limit|reached (?:your |the )?(?:usage )?limit|usage limits? (?:reached|exceeded)|rate limits? (?:reached|exceeded)|rate_limit_error|quota exceeded|out of (?:usage|credits)|too many requests|429)\b/i;
+/**
+ * Ask Haiku for one short reply in the selected Claude home. The JSONL stream
+ * can contain a rate_limit_event; prompts, replies and CLI stderr are discarded.
+ * This runs only after an explicit UI action and has a time and spend bound.
+ */
+export function probeClaudeRateLimit(bin, profileId, timeoutMs = 75_000) {
+    const cwd = subscriptionsRoot();
+    mkdirSync(cwd, { recursive: true, mode: 0o700 });
+    return new Promise(resolve => {
+        const child = spawn(bin, [
+            '-p', 'Reply OK.', '--model', 'haiku', '--output-format', 'stream-json', '--verbose',
+            '--no-session-persistence', '--strict-mcp-config', '--tools', '',
+            '--system-prompt', 'Reply OK.', '--max-budget-usd', '0.05',
+        ], {
+            cwd, env: profileEnv('CLAUDE_CONFIG_DIR', profileId, profileHome('claude', profileId)),
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let pending = '';
+        let rateLimit;
+        let exhausted = false;
+        let done = false;
+        const finish = (value) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        const timer = setTimeout(() => { child.kill('SIGKILL'); finish(); }, timeoutMs);
+        child.stdout.on('data', chunk => {
+            pending += String(chunk);
+            if (pending.length > 64 * 1024 && !pending.includes('\n')) {
+                child.kill('SIGKILL');
+                finish();
+                return;
+            }
+            for (let end = pending.indexOf('\n'); end >= 0; end = pending.indexOf('\n')) {
+                const line = pending.slice(0, end);
+                pending = pending.slice(end + 1);
+                if (line.length > 64 * 1024)
+                    continue;
+                try {
+                    const event = JSON.parse(line);
+                    if (event.type === 'rate_limit_event')
+                        rateLimit = event.rate_limit_info ?? event.rateLimitInfo ?? event.rate_limit ?? event.rateLimit ?? event;
+                    if ((event.type === 'result' && event.is_error === true) || event.type === 'error') {
+                        const error = event.error && typeof event.error === 'object' ? event.error : undefined;
+                        const message = typeof event.result === 'string' ? event.result
+                            : typeof event.error === 'string' ? event.error : error?.message;
+                        if (typeof message === 'string' && LIMIT_ERROR.test(message.slice(0, 4000)))
+                            exhausted = true;
+                    }
+                }
+                catch { /* Other CLI output is never retained. */ }
+            }
+        });
+        // Some CLI failures are reported only on stderr. Inspect a small rolling
+        // fragment for a limit signal; never retain or return the raw text.
+        let stderrTail = '';
+        child.stderr.on('data', chunk => {
+            stderrTail = (stderrTail + String(chunk)).slice(-4000);
+            if (LIMIT_ERROR.test(stderrTail))
+                exhausted = true;
+        });
+        child.once('error', () => finish());
+        child.once('close', () => finish(rateLimit !== undefined || exhausted ? { rateLimit, exhausted } : undefined));
+    });
+}

package/dist/subscriptions/service.d.ts

@@ -0,0 +1,102 @@
+import { type SubscriptionBinaries, type UsageWindow } from './cli.js';
+import { type LoginHandle, type LoginView } from './login.js';
+import { type SubscriptionProvider } from './store.js';
+export type HealthState = 'ok' | 'expiring' | 'expired' | 'signed_out' | 'error' | 'unknown';
+export interface ProfileHealth {
+    state: HealthState;
+    checkedAt?: string;
+    detail?: string;
+    /** When the stored login stops refreshing (Claude, observed field). */
+    loginExpiresAt?: string;
+}
+export interface ProfileUsage {
+    windows: UsageWindow[];
+    observedAt?: string;
+    /** `pull`: asked the provider. `agent`: last value an agent session reported. */
+    source: 'pull' | 'agent' | 'probe' | 'none';
+    /** A probe received an explicit limit error, even if no percentages were sent. */
+    exhausted?: boolean;
+}
+export interface ProfileView {
+    id: string;
+    label: string;
+    active: boolean;
+    account?: {
+        email?: string;
+        plan?: string;
+        org?: string;
+    };
+    health: ProfileHealth;
+    usage: ProfileUsage;
+    /** Running agents whose session is pinned to this profile. */
+    agents: string[];
+}
+export interface ProviderView {
+    provider: SubscriptionProvider;
+    activeProfileId: string;
+    profiles: ProfileView[];
+    /** Running agents still on a profile other than the active one: restart to switch. */
+    staleAgents: Array<{
+        roleId: string;
+        profileId: string;
+    }>;
+    /** Running agents whose credentials come from env, not a Fleet profile. */
+    unmanagedAgents: Array<{
+        roleId: string;
+        via: string[];
+    }>;
+}
+export interface AgentRef {
+    roleId: string;
+    stateDir?: string;
+    running: boolean;
+}
+export interface SubscriptionServiceOptions {
+    agents(): Promise<AgentRef[]>;
+    binaries?: SubscriptionBinaries;
+    now?: () => number;
+    onChange?: () => void;
+}
+interface CheckResult {
+    health: ProfileHealth;
+    account?: ProfileView['account'];
+    usage?: ProfileUsage;
+}
+export declare class SubscriptionService {
+    private readonly options;
+    private readonly bins;
+    private readonly now;
+    private readonly checks;
+    private readonly running;
+    private readonly logins;
+    private readonly probes;
+    constructor(options: SubscriptionServiceOptions);
+    list(): Promise<ProviderView[]>;
+    /** Health + account + (Codex) usage for one profile. Concurrent calls share one run. */
+    check(provider: SubscriptionProvider, profileId: string): Promise<CheckResult>;
+    private checkClaude;
+    private checkCodex;
+    startLogin(provider: SubscriptionProvider, owner: string): Promise<LoginView>;
+    private completeLogin;
+    /** Query the official CLI for each existing profile, including the adopted default. */
+    private accountAlreadyAdded;
+    login(loginId: string, owner: string): LoginHandle;
+    setActive(provider: SubscriptionProvider, profileId: string): Promise<ProviderView>;
+    rename(provider: SubscriptionProvider, profileId: string, label: string): Promise<void>;
+    /**
+     * Remove a profile and its login. Refused while it is active or while any
+     * running agent is still pinned to it; the adopted default is never removed.
+     */
+    remove(provider: SubscriptionProvider, profileId: string): Promise<void>;
+    private profile;
+    /** An explicit, bounded Haiku request can refresh Claude usage for an idle profile. */
+    probeClaudeUsage(profileId: string): Promise<ProfileUsage>;
+    private probeUsageDir;
+    private probedUsage;
+    private pins;
+    /** Latest Claude rate-limit snapshot any agent on this profile reported. */
+    private observedUsage;
+}
+/** Read what `recordClaudeRateLimit` stored, dropping windows that already reset. */
+export declare function readObservedClaudeUsage(stateDir: string, now?: number): ProfileUsage | undefined;
+export {};