@prohost/cli 0.8.3 → 0.10.0

package/dist/usage/command.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `prohost usage …` — observer mode: report this machine's Claude Code and
+ * Codex capacity and token totals to ProhostAI without pairing an agent.
+ *
+ * Flag plumbing only; the work lives in `discovery.ts`, `quota.ts`,
+ * `scanner.ts` and `service.ts`.
+ */
+import type { DiscoveryResult } from './discovery.js';
+type Flags = Record<string, string | boolean>;
+export interface UsageIO {
+    out: (line: string) => void;
+    err: (line: string) => void;
+    env?: NodeJS.ProcessEnv;
+}
+/** launchd label prefix for the usage reporter — distinct from the agent daemon's. */
+export declare const USAGE_LAUNCHD_PREFIX = "ai.prohost.usage";
+/** Label for the usage daemon serving one `$PROHOST_HOME`. Same digest as the agent's, other prefix. */
+export declare function usageLaunchdLabel(home: string): string;
+export declare function usageLogPath(env?: NodeJS.ProcessEnv): string;
+/** `prohost usage start` argv for a supervisor. */
+export declare function usageDaemonArguments(options: {
+    execPath: string;
+    scriptPath: string;
+    machine?: string;
+}): string[];
+/** Dispatch a `usage` subcommand. Returns the exit code. */
+export declare function runUsage(subcommand: string | undefined, flags: Flags, printHelp: () => void, io?: UsageIO): Promise<number>;
+export declare function renderDiscovery(result: DiscoveryResult, env: NodeJS.ProcessEnv, dryRun: boolean): string[];
+/** `1234567` → `1.2M`. */
+export declare function compactTokens(n: number): string;
+export {};

package/dist/usage/command.js

@@ -0,0 +1,269 @@
+/**
+ * `prohost usage …` — observer mode: report this machine's Claude Code and
+ * Codex capacity and token totals to ProhostAI without pairing an agent.
+ *
+ * Flag plumbing only; the work lives in `discovery.ts`, `quota.ts`,
+ * `scanner.ts` and `service.ts`.
+ */
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { DEFAULT_ACCOUNT_LABEL, loadAccounts, runtimeName } from '../agent/accounts.js';
+import { daemonEnvironment } from '../agent/command.js';
+import { maskSecret, prohostHome } from '../agent/credentials.js';
+import { buildSystemdUnit, installLaunchdDaemon, launchdLabel, launchdPlistPath, uninstallLaunchdDaemon, } from '../agent/daemon.js';
+import { acquireRunLock } from '../agent/lock.js';
+import { ensurePrivateDir, resolveUsageKey, saveUsageCredentials, usageStateDir } from './config.js';
+import { accountConfigDir, discoverAccounts } from './discovery.js';
+import { RETENTION_DAYS, dayKey, loadScanState, localTotals, pendingDays } from './scanner.js';
+import { UsageService, loadStatus, runUsageLoop, scanStatePath } from './service.js';
+const defaultIO = {
+    out: (line) => process.stdout.write(`${line}\n`),
+    err: (line) => process.stderr.write(`${line}\n`),
+};
+/** launchd label prefix for the usage reporter — distinct from the agent daemon's. */
+export const USAGE_LAUNCHD_PREFIX = 'ai.prohost.usage';
+/** Label for the usage daemon serving one `$PROHOST_HOME`. Same digest as the agent's, other prefix. */
+export function usageLaunchdLabel(home) {
+    const digest = launchdLabel(home).split('.').pop();
+    return `${USAGE_LAUNCHD_PREFIX}.${digest}`;
+}
+export function usageLogPath(env = process.env) {
+    return path.join(prohostHome(env), 'usage.log');
+}
+/** `prohost usage start` argv for a supervisor. */
+export function usageDaemonArguments(options) {
+    return [options.execPath, options.scriptPath, 'usage', 'start', ...(options.machine ? ['--machine', options.machine] : [])];
+}
+function flagString(flags, name) {
+    const value = flags[name];
+    return typeof value === 'string' ? value : undefined;
+}
+function tildify(dir, env) {
+    const home = env.HOME || os.homedir();
+    return dir === home || dir.startsWith(home + path.sep) ? `~${dir.slice(home.length)}` : dir;
+}
+/** Dispatch a `usage` subcommand. Returns the exit code. */
+export async function runUsage(subcommand, flags, printHelp, io = defaultIO) {
+    if (subcommand === 'connect')
+        return connectCommand(flags, io);
+    if (subcommand === 'discover')
+        return discoverCommand(flags, io);
+    if (subcommand === 'start')
+        return startCommand(flags, io);
+    if (subcommand === 'status')
+        return statusCommand(io);
+    if (subcommand === 'install-daemon')
+        return installCommand(flags, io);
+    if (subcommand === 'uninstall-daemon')
+        return uninstallCommand(io);
+    io.err(subcommand
+        ? `Unknown usage subcommand: ${subcommand}\n`
+        : 'Missing usage subcommand — expected `connect`, `discover`, `start`, `status`, `install-daemon` or `uninstall-daemon`.\n');
+    printHelp();
+    return 1;
+}
+export function renderDiscovery(result, env, dryRun) {
+    const lines = [];
+    const total = result.added.length + result.known.length + result.skipped.length;
+    if (total === 0) {
+        return [
+            'No Claude Code or Codex logins found (looked for ~/.claude*, ~/.codex*, $CLAUDE_CONFIG_DIR and $CODEX_HOME).',
+        ];
+    }
+    lines.push(`Found ${total} login${total === 1 ? '' : 's'}:`);
+    const row = (mark, label, runtime, dir, note) => `  ${mark} ${label.padEnd(16)} ${runtimeName(runtime).padEnd(12)} ${tildify(dir, env)}${note ? `  (${note})` : ''}`;
+    for (const a of result.added)
+        lines.push(row('+', a.label, a.runtime, a.dir, dryRun ? 'would add' : 'added'));
+    for (const k of result.known)
+        lines.push(row('=', k.label, k.runtime, k.dir, 'already registered'));
+    for (const s of result.skipped)
+        lines.push(row('!', s.label, s.runtime, s.dir, `skipped: ${s.reason}`));
+    return lines;
+}
+async function connectCommand(flags, io) {
+    const env = io.env ?? process.env;
+    if (flags.key === true) {
+        io.err('--key needs a value. Create a key with the usage:write scope in ProhostAI → Settings → API keys.');
+        return 1;
+    }
+    const key = flagString(flags, 'key') ?? env.PROHOST_API_KEY;
+    if (key) {
+        const file = saveUsageCredentials({ apiKey: key.trim(), baseUrl: flagString(flags, 'base-url') }, env);
+        io.out(`✓ Saved key ${maskSecret(key.trim())} to ${file} (owner-only).`);
+    }
+    else {
+        const existing = resolveUsageKey(env);
+        if (!existing) {
+            io.err('✗ No API key. Pass --key <key> (scope usage:write) or set $PROHOST_API_KEY. ' +
+                'A machine with a paired agent can skip this — its credential is used.');
+            return 1;
+        }
+        io.out(existing.source === 'agent'
+            ? `✓ Using this machine's paired agent credential (${maskSecret(existing.apiKey)}).`
+            : `✓ Already connected (${maskSecret(existing.apiKey)}).`);
+    }
+    io.out('');
+    for (const line of renderDiscovery(discoverAccounts({}, env), env, false))
+        io.out(line);
+    io.out('');
+    io.out('Report now and every 5 minutes: prohost usage start   (or keep it running: prohost usage install-daemon)');
+    return 0;
+}
+function discoverCommand(flags, io) {
+    const env = io.env ?? process.env;
+    const dryRun = flags['dry-run'] === true;
+    for (const line of renderDiscovery(discoverAccounts({ dryRun }, env), env, dryRun))
+        io.out(line);
+    return 0;
+}
+async function startCommand(flags, io) {
+    const env = io.env ?? process.env;
+    if (!resolveUsageKey(env)) {
+        io.err('✗ Not connected. Run: prohost usage connect --key <api key>');
+        return 1;
+    }
+    // Its own lock, under $PROHOST_HOME/usage — `agent run` holds the home's.
+    const stateDir = ensurePrivateDir(usageStateDir(env));
+    const lock = acquireRunLock({ ...env, PROHOST_HOME: stateDir });
+    if (!lock.ok) {
+        io.err(`✗ Another \`prohost usage start\` (pid ${lock.holder.pid}) is already reporting for ${prohostHome(env)}. ` +
+            'Stop it first — or, if it is the daemon, use `prohost usage uninstall-daemon`.');
+        return 1;
+    }
+    const controller = new AbortController();
+    const onSig = () => controller.abort();
+    process.on('SIGINT', onSig);
+    process.on('SIGTERM', onSig);
+    try {
+        // New logins since the last start are picked up without a separate step.
+        const found = discoverAccounts({}, env);
+        for (const a of found.added)
+            io.out(`+ Registered ${runtimeName(a.runtime)} login "${a.label}" (${tildify(a.dir, env)})`);
+        const service = new UsageService({ env, machine: flagString(flags, 'machine') });
+        if (flags.once === true) {
+            const result = await service.tick();
+            io.out(`Report ${result.reported ? 'sent' : 'not sent'}; ${result.uploadedRows} token row(s) uploaded.`);
+            return 0;
+        }
+        io.out(`Reporting ${loadAccounts(env).length} login(s) every 5 minutes. Ctrl-C to stop.`);
+        await runUsageLoop(service, { signal: controller.signal });
+        return 0;
+    }
+    finally {
+        process.off('SIGINT', onSig);
+        process.off('SIGTERM', onSig);
+        lock.release();
+    }
+}
+function cliEntrypoint() {
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', 'index.js');
+}
+function installCommand(flags, io) {
+    const env = io.env ?? process.env;
+    if (!resolveUsageKey(env)) {
+        io.err('✗ Not connected. Run: prohost usage connect --key <api key>');
+        return 1;
+    }
+    const workdir = ensurePrivateDir(usageStateDir(env));
+    const spec = {
+        label: usageLaunchdLabel(prohostHome(env)),
+        programArguments: usageDaemonArguments({
+            execPath: process.execPath,
+            scriptPath: cliEntrypoint(),
+            machine: flagString(flags, 'machine'),
+        }),
+        workdir,
+        logPath: usageLogPath(env),
+        env: daemonEnvironment(),
+    };
+    if (os.platform() !== 'darwin') {
+        io.out(`Automatic install is macOS-only. On Linux, save this as ~/.config/systemd/user/${spec.label}.service and run:\n` +
+            `  systemctl --user daemon-reload && systemctl --user enable --now ${spec.label}\n` +
+            '  loginctl enable-linger "$USER"   # so it survives logout\n\n' +
+            buildSystemdUnit(spec).replace('ProhostAI paired agent', 'ProhostAI usage reporter'));
+        return 0;
+    }
+    const result = installLaunchdDaemon(spec);
+    if (!result.ok) {
+        io.err(result.message);
+        return 1;
+    }
+    io.out(`✓ Installed ${spec.label}`);
+    io.out(`  plist: ${result.plistPath}`);
+    io.out(`  logs:  ${spec.logPath}`);
+    io.out('  Usage is reported every 5 minutes from login on, and the reporter restarts if it exits.');
+    io.out('  Stop it with: prohost usage uninstall-daemon');
+    return 0;
+}
+function uninstallCommand(io) {
+    const env = io.env ?? process.env;
+    const label = usageLaunchdLabel(prohostHome(env));
+    if (os.platform() !== 'darwin') {
+        io.out(`Automatic removal is macOS-only. On Linux:\n  systemctl --user disable --now ${label}`);
+        return 0;
+    }
+    const existed = existsSync(launchdPlistPath(label));
+    uninstallLaunchdDaemon(label);
+    io.out(existed ? `✓ Removed ${label}` : `No usage reporter was installed for ${prohostHome(env)}. Nothing to remove.`);
+    return 0;
+}
+/** `1234567` → `1.2M`. */
+export function compactTokens(n) {
+    if (n >= 1e9)
+        return `${(n / 1e9).toFixed(1)}B`;
+    if (n >= 1e6)
+        return `${(n / 1e6).toFixed(1)}M`;
+    if (n >= 1e3)
+        return `${(n / 1e3).toFixed(1)}k`;
+    return String(n);
+}
+function sum(t) {
+    return t ? t[0] + t[1] + t[2] + t[3] : 0;
+}
+function describeCall(call) {
+    if (!call)
+        return 'never';
+    const outcome = call.ok ? '✓' : `✗ ${call.status === 0 ? 'no response' : `HTTP ${call.status}`}`;
+    return `${call.at}  ${outcome}${call.count !== undefined ? `  (${call.count})` : ''}`;
+}
+function statusCommand(io) {
+    const env = io.env ?? process.env;
+    const key = resolveUsageKey(env);
+    io.out(key
+        ? `Connected   ${maskSecret(key.apiKey)} → ${key.baseUrl}${key.source === 'agent' ? '  (paired agent credential)' : ''}`
+        : 'Connected   no — run: prohost usage connect --key <api key>');
+    const plist = launchdPlistPath(usageLaunchdLabel(prohostHome(env)));
+    io.out(`Daemon      ${os.platform() === 'darwin' ? (existsSync(plist) ? `installed (${tildify(plist, env)})` : 'not installed') : 'see systemd'}`);
+    const status = loadStatus(env);
+    io.out(`Last tick   ${status.lastTickAt ?? 'never'}`);
+    io.out(`Report      ${describeCall(status.lastReport)}`);
+    io.out(`Totals      ${describeCall(status.lastTotals)}`);
+    const scan = loadScanState(scanStatePath(env));
+    if (scan.dirty.length > 0)
+        io.out(`Pending     ${pendingDays(scan).length} day(s) not yet uploaded`);
+    const accounts = loadAccounts(env);
+    io.out('');
+    if (accounts.length === 0) {
+        io.out('No logins registered. Run: prohost usage discover');
+        return 0;
+    }
+    const now = Date.now();
+    const week = localTotals(scan, dayKey(now - 6 * 86_400_000));
+    const month = localTotals(scan, dayKey(now - (RETENTION_DAYS - 1) * 86_400_000));
+    io.out('Logins (tokens: last 7 days / 30 days, from local logs)');
+    for (const record of accounts) {
+        const seen = status.accounts[record.key];
+        const auth = seen?.authState === 'ok' ? 'signed in' : seen?.authState === 'expired' ? 'signed out' : 'unknown';
+        const windows = (seen?.windows ?? [])
+            .map((w) => `${w.kind === 'weekly_model' ? `weekly ${w.model_label ?? ''}`.trim() : w.kind} ${w.used_percent}%`)
+            .join(', ');
+        io.out(`  ${record.label.padEnd(16)} ${runtimeName(record.runtime).padEnd(12)} ${auth.padEnd(10)} ` +
+            `${compactTokens(sum(week.get(record.key)))} / ${compactTokens(sum(month.get(record.key)))}` +
+            `${windows ? `  ·  ${windows}` : ''}` +
+            `${record.label === DEFAULT_ACCOUNT_LABEL ? '' : `  ·  ${tildify(accountConfigDir(record, env), env)}`}`);
+    }
+    return 0;
+}

package/dist/usage/config.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Where `prohost usage` keeps its own state, and which API key it reports with.
+ *
+ * Observer mode needs no paired agent: `prohost usage connect --key …` stores
+ * a key (scope `usage:write`) in `$PROHOST_HOME/usage.json`, written `0600`
+ * inside a `0700` directory exactly like `agent.json`. A machine that already
+ * paired an agent needs nothing new — its `agent_runs:write` key is accepted
+ * too, so without a usage key the agent's credential is used.
+ *
+ * The key is never printed; {@link maskSecret} is the only form that reaches
+ * the terminal.
+ */
+export interface UsageCredentials {
+    version: 1;
+    base_url: string;
+    api_key: string;
+    connected_at: string;
+}
+export interface ResolvedKey {
+    baseUrl: string;
+    apiKey: string;
+    /** `usage` — `usage.json`; `agent` — the paired agent's `agent.json`. */
+    source: 'usage' | 'agent';
+}
+export declare function usageCredentialsPath(env?: NodeJS.ProcessEnv): string;
+/** Directory for the scanner cursor and reporter status. */
+export declare function usageStateDir(env?: NodeJS.ProcessEnv): string;
+/** Create a `0700` directory (tightening one that already exists). */
+export declare function ensurePrivateDir(dir: string): string;
+/** Write a file `0600` via write-then-rename, so a crash never leaves half a file. */
+export declare function writePrivateFile(file: string, content: string): void;
+export declare function saveUsageCredentials(options: {
+    apiKey: string;
+    baseUrl?: string;
+}, env?: NodeJS.ProcessEnv): string;
+export declare function loadUsageCredentials(env?: NodeJS.ProcessEnv): UsageCredentials | null;
+/** The key reports go out with: `usage.json` first, then a paired agent's. */
+export declare function resolveUsageKey(env?: NodeJS.ProcessEnv): ResolvedKey | null;

package/dist/usage/config.js

@@ -0,0 +1,75 @@
+/**
+ * Where `prohost usage` keeps its own state, and which API key it reports with.
+ *
+ * Observer mode needs no paired agent: `prohost usage connect --key …` stores
+ * a key (scope `usage:write`) in `$PROHOST_HOME/usage.json`, written `0600`
+ * inside a `0700` directory exactly like `agent.json`. A machine that already
+ * paired an agent needs nothing new — its `agent_runs:write` key is accepted
+ * too, so without a usage key the agent's credential is used.
+ *
+ * The key is never printed; {@link maskSecret} is the only form that reaches
+ * the terminal.
+ */
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { DEFAULT_API_BASE_URL } from '../agent/contract.js';
+import { prohostHome, tryLoadCredentials } from '../agent/credentials.js';
+export function usageCredentialsPath(env = process.env) {
+    return path.join(prohostHome(env), 'usage.json');
+}
+/** Directory for the scanner cursor and reporter status. */
+export function usageStateDir(env = process.env) {
+    return path.join(prohostHome(env), 'usage');
+}
+/** Create a `0700` directory (tightening one that already exists). */
+export function ensurePrivateDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    return dir;
+}
+/** Write a file `0600` via write-then-rename, so a crash never leaves half a file. */
+export function writePrivateFile(file, content) {
+    ensurePrivateDir(path.dirname(file));
+    const temp = `${file}.${process.pid}.tmp`;
+    writeFileSync(temp, content, { mode: 0o600 });
+    chmodSync(temp, 0o600);
+    renameSync(temp, file);
+}
+export function saveUsageCredentials(options, env = process.env) {
+    ensurePrivateDir(prohostHome(env));
+    const file = usageCredentialsPath(env);
+    const record = {
+        version: 1,
+        base_url: options.baseUrl || DEFAULT_API_BASE_URL,
+        api_key: options.apiKey,
+        connected_at: new Date().toISOString(),
+    };
+    writePrivateFile(file, `${JSON.stringify(record, null, 2)}\n`);
+    return file;
+}
+export function loadUsageCredentials(env = process.env) {
+    try {
+        const parsed = JSON.parse(readFileSync(usageCredentialsPath(env), 'utf8'));
+        if (typeof parsed?.api_key !== 'string' || !parsed.api_key)
+            return null;
+        return {
+            version: 1,
+            base_url: typeof parsed.base_url === 'string' && parsed.base_url ? parsed.base_url : DEFAULT_API_BASE_URL,
+            api_key: parsed.api_key,
+            connected_at: typeof parsed.connected_at === 'string' ? parsed.connected_at : '',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** The key reports go out with: `usage.json` first, then a paired agent's. */
+export function resolveUsageKey(env = process.env) {
+    const usage = loadUsageCredentials(env);
+    if (usage)
+        return { baseUrl: usage.base_url, apiKey: usage.api_key, source: 'usage' };
+    const agent = tryLoadCredentials(env);
+    if (agent)
+        return { baseUrl: agent.base_url || DEFAULT_API_BASE_URL, apiKey: agent.api_key, source: 'agent' };
+    return null;
+}

package/dist/usage/discovery.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Find the Claude Code and Codex logins already on this machine.
+ *
+ * People who juggle several subscriptions keep each one in its own config
+ * directory — `~/.claude-work`, `~/.codex-personal`, or whatever
+ * `$CLAUDE_CONFIG_DIR` / `$CODEX_HOME` points at. Observer mode reports all of
+ * them, so instead of asking for each one to be re-created under
+ * `~/.prohost-accounts`, it registers the directories that are already there.
+ *
+ * Only directory names and the presence of a few non-secret markers
+ * (`projects/`, `settings.json`, `sessions/`, `config.toml`…) are looked at —
+ * never a file's contents, and never anything that holds a credential.
+ * Whether a login is signed in is asked of the unmodified agent CLI later,
+ * exactly as `accounts.ts` already does.
+ */
+import type { AccountRecord, AccountRuntime } from '../agent/accounts.js';
+export interface DiscoveredDir {
+    runtime: AccountRuntime;
+    /** Absolute, symlinks resolved. */
+    dir: string;
+    /** The label it would be registered under. */
+    label: string;
+    /** `~/.claude` / `~/.codex` — the agent CLI's own default login. */
+    isDefault: boolean;
+    /** Why it was found: a home-directory entry or an environment variable. */
+    via: 'home' | 'CLAUDE_CONFIG_DIR' | 'CODEX_HOME';
+}
+export interface DiscoveryResult {
+    /** Newly registered (or, on a dry run, that would be). */
+    added: Array<DiscoveredDir & {
+        record?: AccountRecord;
+    }>;
+    /** Found but already in the registry. */
+    known: Array<DiscoveredDir & {
+        record: AccountRecord;
+    }>;
+    /** Found but not registered, and why. */
+    skipped: Array<DiscoveredDir & {
+        reason: string;
+    }>;
+}
+/** The directory an account's logs live in: its own, or the CLI's default under `$HOME`. */
+export declare function accountConfigDir(record: AccountRecord, env?: NodeJS.ProcessEnv): string;
+/**
+ * A registry label from a directory name: `~/.claude-baxy` → `baxy`,
+ * `~/.codex_work` → `work`, `~/.claude` → `default`. Anything a label can't
+ * hold becomes `-`; an empty result falls back to the runtime's name.
+ */
+export declare function deriveLabel(dirName: string, runtime: AccountRuntime): string;
+/**
+ * Every config directory on this machine, before any registry comparison:
+ * `~/.claude*` / `~/.codex*` that look like config directories, plus
+ * `$CLAUDE_CONFIG_DIR` / `$CODEX_HOME`. Deduplicated by real path.
+ */
+export declare function findConfigDirs(env?: NodeJS.ProcessEnv): DiscoveredDir[];
+/**
+ * Register every login found by {@link findConfigDirs} that the machine-wide
+ * registry doesn't already know. `dryRun` reports the same answer and writes
+ * nothing.
+ */
+export declare function discoverAccounts(options?: {
+    dryRun?: boolean;
+}, env?: NodeJS.ProcessEnv): DiscoveryResult;

package/dist/usage/discovery.js

@@ -0,0 +1,187 @@
+/**
+ * Find the Claude Code and Codex logins already on this machine.
+ *
+ * People who juggle several subscriptions keep each one in its own config
+ * directory — `~/.claude-work`, `~/.codex-personal`, or whatever
+ * `$CLAUDE_CONFIG_DIR` / `$CODEX_HOME` points at. Observer mode reports all of
+ * them, so instead of asking for each one to be re-created under
+ * `~/.prohost-accounts`, it registers the directories that are already there.
+ *
+ * Only directory names and the presence of a few non-secret markers
+ * (`projects/`, `settings.json`, `sessions/`, `config.toml`…) are looked at —
+ * never a file's contents, and never anything that holds a credential.
+ * Whether a login is signed in is asked of the unmodified agent CLI later,
+ * exactly as `accounts.ts` already does.
+ */
+import { existsSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { AccountError, DEFAULT_ACCOUNT_LABEL, MAX_REPORTED_ACCOUNTS, ensureDefaultAccount, isValidLabel, loadAccounts, registerAccountDir, } from '../agent/accounts.js';
+/** Entries whose presence says "this is a Claude Code config directory". None of them hold a login. */
+const CLAUDE_MARKERS = ['projects', 'settings.json', '.claude.json', 'history.jsonl', 'todos', 'statsig', 'shell-snapshots'];
+/** Same for Codex. `auth.json` is deliberately not one of them. */
+const CODEX_MARKERS = ['sessions', 'archived_sessions', 'config.toml', 'history.jsonl', 'log', 'version.json'];
+const CLAUDE_NAME = /^\.claude(?:[-_.](.+))?$/;
+const CODEX_NAME = /^\.codex(?:[-_.](.+))?$/;
+function homeDir(env) {
+    return env.HOME || os.homedir();
+}
+function resolveReal(dir) {
+    try {
+        return realpathSync(dir);
+    }
+    catch {
+        return path.resolve(dir);
+    }
+}
+function isDirectory(p) {
+    try {
+        return statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function looksLikeConfigDir(dir, runtime) {
+    const markers = runtime === 'claude_code' ? CLAUDE_MARKERS : CODEX_MARKERS;
+    return isDirectory(dir) && markers.some((m) => existsSync(path.join(dir, m)));
+}
+/** The directory an account's logs live in: its own, or the CLI's default under `$HOME`. */
+export function accountConfigDir(record, env = process.env) {
+    if (record.dir)
+        return record.dir;
+    return path.join(homeDir(env), record.runtime === 'claude_code' ? '.claude' : '.codex');
+}
+/**
+ * A registry label from a directory name: `~/.claude-baxy` → `baxy`,
+ * `~/.codex_work` → `work`, `~/.claude` → `default`. Anything a label can't
+ * hold becomes `-`; an empty result falls back to the runtime's name.
+ */
+export function deriveLabel(dirName, runtime) {
+    const base = path.basename(dirName);
+    const match = (runtime === 'claude_code' ? CLAUDE_NAME : CODEX_NAME).exec(base);
+    if (match && match[1] === undefined)
+        return DEFAULT_ACCOUNT_LABEL;
+    const raw = match ? match[1] : base.replace(/^\.+/, '');
+    const cleaned = raw
+        .replace(/[^A-Za-z0-9_-]+/g, '-')
+        .replace(/^[^A-Za-z0-9]+/, '')
+        .replace(/-+$/, '')
+        .slice(0, 32);
+    if (cleaned && isValidLabel(cleaned))
+        return cleaned;
+    return runtime === 'claude_code' ? 'claude' : 'codex';
+}
+/** Make `label` unique among `taken` by appending `-2`, `-3`… (and never `default`). */
+function uniqueLabel(label, taken) {
+    if (!taken.has(label) && label !== DEFAULT_ACCOUNT_LABEL)
+        return label;
+    for (let n = 2;; n += 1) {
+        const suffix = `-${n}`;
+        const candidate = `${label.slice(0, 32 - suffix.length)}${suffix}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+}
+/**
+ * Every config directory on this machine, before any registry comparison:
+ * `~/.claude*` / `~/.codex*` that look like config directories, plus
+ * `$CLAUDE_CONFIG_DIR` / `$CODEX_HOME`. Deduplicated by real path.
+ */
+export function findConfigDirs(env = process.env) {
+    const home = homeDir(env);
+    const found = new Map();
+    const defaults = {
+        claude_code: resolveReal(path.join(home, '.claude')),
+        codex: resolveReal(path.join(home, '.codex')),
+    };
+    const consider = (dir, runtime, via) => {
+        if (!looksLikeConfigDir(dir, runtime))
+            return;
+        const real = resolveReal(dir);
+        const key = `${runtime}:${real}`;
+        if (found.has(key))
+            return;
+        const isDefault = real === defaults[runtime];
+        found.set(key, {
+            runtime,
+            dir: real,
+            label: isDefault ? DEFAULT_ACCOUNT_LABEL : deriveLabel(dir, runtime),
+            isDefault,
+            via,
+        });
+    };
+    let entries = [];
+    try {
+        entries = readdirSync(home).sort();
+    }
+    catch {
+        /* no readable home: only the env vars below */
+    }
+    for (const name of entries) {
+        if (CLAUDE_NAME.test(name))
+            consider(path.join(home, name), 'claude_code', 'home');
+        else if (CODEX_NAME.test(name))
+            consider(path.join(home, name), 'codex', 'home');
+    }
+    if (env.CLAUDE_CONFIG_DIR)
+        consider(path.resolve(env.CLAUDE_CONFIG_DIR), 'claude_code', 'CLAUDE_CONFIG_DIR');
+    if (env.CODEX_HOME)
+        consider(path.resolve(env.CODEX_HOME), 'codex', 'CODEX_HOME');
+    return [...found.values()];
+}
+/**
+ * Register every login found by {@link findConfigDirs} that the machine-wide
+ * registry doesn't already know. `dryRun` reports the same answer and writes
+ * nothing.
+ */
+export function discoverAccounts(options = {}, env = process.env) {
+    const result = { added: [], known: [], skipped: [] };
+    const registry = loadAccounts(env);
+    const byDir = new Map();
+    for (const record of registry) {
+        // The implicit default (dir null) compares on the CLI's own directory.
+        byDir.set(`${record.runtime}:${resolveReal(accountConfigDir(record, env))}`, record);
+    }
+    const taken = { claude_code: new Set(), codex: new Set() };
+    for (const record of registry)
+        taken[record.runtime].add(record.label);
+    let room = MAX_REPORTED_ACCOUNTS - 2 - registry.filter((a) => a.label !== DEFAULT_ACCOUNT_LABEL).length;
+    for (const found of findConfigDirs(env)) {
+        const existing = byDir.get(`${found.runtime}:${found.dir}`);
+        if (existing) {
+            result.known.push({ ...found, label: existing.label, record: existing });
+            continue;
+        }
+        if (found.isDefault) {
+            if (options.dryRun)
+                result.added.push(found);
+            else
+                result.added.push({ ...found, record: ensureDefaultAccount(found.runtime, env) });
+            continue;
+        }
+        if (room <= 0) {
+            result.skipped.push({ ...found, reason: `this machine already has ${MAX_REPORTED_ACCOUNTS - 2} accounts` });
+            continue;
+        }
+        const label = uniqueLabel(found.label, taken[found.runtime]);
+        taken[found.runtime].add(label);
+        const candidate = { ...found, label };
+        if (options.dryRun) {
+            result.added.push(candidate);
+            room -= 1;
+            continue;
+        }
+        try {
+            const record = registerAccountDir({ label, runtime: found.runtime, dir: found.dir }, env);
+            result.added.push({ ...candidate, label: record.label, record });
+            room -= 1;
+        }
+        catch (err) {
+            if (!(err instanceof AccountError))
+                throw err;
+            result.skipped.push({ ...candidate, reason: err.message });
+        }
+    }
+    return result;
+}