@saadnvd1/agent-os 0.3.499 → 0.3.501

package/lib/usage/weights.ts

@@ -0,0 +1,64 @@
+/**
+ * Weighted tokens: the API's price ratios by token type and model family, as
+ * a proxy for how much of the plan's limits a call uses. Opus input = 1.
+ * An estimate, not what the plan charges.
+ */
+
+import { ANTHROPIC } from "../models/roles";
+
+export type Family = "opus" | "sonnet" | "haiku";
+
+export interface TokenRow {
+  model: string | null;
+  provider?: string | null;
+  input_tokens: number;
+  cache_read_tokens: number;
+  cache_write_5m_tokens: number;
+  cache_write_1h_tokens: number;
+  output_tokens: number;
+}
+
+// Unknown Claude ids weigh as Opus.
+export const family = (model: string | null | undefined): Family => {
+  const m = (model ?? "").toLowerCase();
+  return m.includes("sonnet")
+    ? "sonnet"
+    : m.includes("haiku")
+      ? "haiku"
+      : "opus";
+};
+
+const MULT: Record<Family, number> = { opus: 1, sonnet: 0.5, haiku: 0.25 };
+const READ: Record<Family, number> = { opus: 0.1, sonnet: 0.1, haiku: 0.05 };
+
+export const WEIGHTS = {
+  input: 1,
+  cacheWrite5m: 1.25,
+  cacheWrite1h: 2,
+  output: 5,
+} as const;
+
+export function weighted(r: TokenRow): number {
+  if (r.provider && r.provider !== ANTHROPIC) return 0;
+  const f = family(r.model);
+  return (
+    MULT[f] *
+      (WEIGHTS.input * r.input_tokens +
+        WEIGHTS.cacheWrite5m * r.cache_write_5m_tokens +
+        WEIGHTS.cacheWrite1h * r.cache_write_1h_tokens +
+        WEIGHTS.output * r.output_tokens) +
+    READ[f] * r.cache_read_tokens
+  );
+}
+
+export const CTX_LIMIT = 200_000;
+
+// What the call sent: fresh input, cache writes and cache reads.
+export const ctxOf = (r: TokenRow): number =>
+  r.input_tokens +
+  r.cache_read_tokens +
+  r.cache_write_5m_tokens +
+  r.cache_write_1h_tokens;
+
+export const overLimit = (ctx: number | null) =>
+  ctx !== null && ctx > CTX_LIMIT;

package/lib/usage/windows.ts

@@ -9,6 +9,7 @@ import os from "os";
 import { query, type SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
 import { InputQueue } from "../chat/queue";
 import { readUsage } from "../orchestrator/usage";
+import { currentWindow, type WindowReading } from "./rate-limits";
 
 export interface WindowView {
   pct: number;
@@ -17,6 +18,8 @@ export interface WindowView {
   // Seconds until it runs out at the current rate, when before it resets.
   capsIn?: number | null;
   burnPerMin?: number | null;
+  // Worked out from recorded usage, not read from the account.
+  estimated?: boolean;
 }
 
 export interface UsageWindows {
@@ -108,8 +111,30 @@ export function fromPlan(
   };
 }
 
+const fromReading = (
+  r: WindowReading | null,
+  nowMs: number
+): WindowView | null =>
+  r
+    ? {
+        pct: Math.round(r.pct),
+        resetsIn: r.resetsAt
+          ? Math.max(0, Math.round((r.resetsAt - nowMs) / 1000))
+          : null,
+        estimated: r.estimated || undefined,
+      }
+    : null;
+
 export async function usageWindows(): Promise<UsageWindows> {
   const sampled = readUsage();
+  const read = (w: "five_hour" | "seven_day") => {
+    try {
+      const now = Date.now();
+      return fromReading(currentWindow(w, now), now);
+    } catch {
+      return null;
+    }
+  };
   const plan = await planLimits();
   const fiveHour =
     "window" in sampled && sampled.window
@@ -119,8 +144,8 @@ export async function usageWindows(): Promise<UsageWindows> {
           capsIn: sampled.window.capsIn,
           burnPerMin: sampled.window.burnPerMin,
         }
-      : fromPlan(plan.limits?.five_hour);
-  const sevenDay = fromPlan(plan.limits?.seven_day);
+      : (fromPlan(plan.limits?.five_hour) ?? read("five_hour"));
+  const sevenDay = fromPlan(plan.limits?.seven_day) ?? read("seven_day");
   const note =
     !sevenDay || !fiveHour
       ? (plan.error ??

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.499",
+  "version": "0.3.501",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"
@@ -12,8 +12,7 @@
     "data/",
     "hooks/",
     "lib/",
-    "!lib/connect/test-pki.ts",
-    "!lib/connect/test-relay.ts",
+    "!lib/security/test-pki.ts",
     "!lib/**/*.test.ts",
     "mcp/",
     "public/",
@@ -121,7 +120,6 @@
     "@xterm/addon-webgl": "^0.19.0",
     "@xterm/headless": "6.0.0",
     "@xterm/xterm": "^6.0.0",
-    "acme-client": "^5.4.0",
     "better-sqlite3": "^13.0.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",

package/server.ts

@@ -13,6 +13,7 @@ import { stackStartGate } from "./lib/orchestrator/brakes";
 import { buildId } from "./lib/build";
 import { startOrchestratorWatcher } from "./lib/orchestrator/watcher";
 import { realDeps, schedulesEnabled, startScheduler } from "./lib/schedules";
+import { startUsageRollup, usageRollupEnabled } from "./lib/usage/nightly";
 import { resumePhoneOutbox } from "./lib/notify";
 import {
   bindAddresses,
@@ -39,6 +40,7 @@ import {
 } from "./lib/security/next-internals";
 import { lanEnabled } from "./lib/security/network-settings";
 import { startConnect } from "./lib/connect/serve";
+import { serverPort } from "./lib/connect/config";
 import { startTailnetHttps } from "./lib/security/tailnet-https";
 import {
   setStatusSource,
@@ -73,9 +75,7 @@ const dev = process.env.NODE_ENV !== "production";
 const hostname = "127.0.0.1";
 
 // Support: npm run dev -- -p 3012
-const pFlagIndex = process.argv.indexOf("-p");
-const portArg = pFlagIndex !== -1 ? process.argv[pFlagIndex + 1] : undefined;
-const port = parseInt(portArg || process.env.PORT || "3011", 10);
+const port = serverPort();
 claimAgentosEnv(port);
 // Demo mode: seeded data, nothing that runs code (lib/security/demo).
 const demo = demoMode();
@@ -313,7 +313,8 @@ app.prepare().then(async () => {
         : []),
     ];
   };
-  // AgentOS Connect: reachable at <id>.<machine domain> through the relay.
+  // AgentOS Connect: reachable at m-<16 hex>.runagentos.com through a
+  // Cloudflare tunnel, served on a listener of its own (lib/connect/serve).
   const connect = demo
     ? { hostname: () => null }
     : startConnect({ onRequest, onUpgrade }, port);
@@ -393,6 +394,8 @@ app.prepare().then(async () => {
   // Schedules tick here, once a minute, and nowhere else.
   if (schedulesEnabled(process.env)) startScheduler(realDeps);
   resumePhoneOutbox();
+  // The usage ledger's daily rollup and its ratchet alerts.
+  if (usageRollupEnabled(process.env)) startUsageRollup();
   // Machine load: a gauge, notes on heavy commands, one alert when red.
   if (loadEnabled()) startLoadMonitor();
 });

package/stores/usageUi.ts

@@ -1,14 +1,14 @@
 import { proxy } from "valtio";
 
-export type UsageTab = "spend" | "models" | "compare";
+export type UsageTab = "daily" | "spend" | "models" | "compare";
 
 export const usageUi = proxy<{ open: boolean; tab: UsageTab }>({
   open: false,
-  tab: "spend",
+  tab: "daily",
 });
 
 export const usageUiActions = {
-  open: (tab: UsageTab = "spend") => {
+  open: (tab: UsageTab = "daily") => {
     usageUi.tab = tab;
     usageUi.open = true;
   },

package/lib/connect/cert-check.ts

@@ -1,32 +0,0 @@
-import { X509Certificate } from "crypto";
-
-export interface CertStatus {
-  expiresAt: string;
-  daysLeft: number;
-  /** Set when it needs renewing, or can't be read. */
-  warning?: string;
-}
-
-const RENEW_AT_DAYS = 30;
-
-export function certStatus(pem: string, now = Date.now()): CertStatus {
-  try {
-    const expires = new Date(new X509Certificate(pem).validTo);
-    const daysLeft = Math.floor((expires.getTime() - now) / 86_400_000);
-    return {
-      expiresAt: expires.toISOString(),
-      daysLeft,
-      warning:
-        daysLeft <= RENEW_AT_DAYS
-          ? `The Connect certificate expires in ${daysLeft} days. Run agent-os connect --renew.`
-          : undefined,
-    };
-  } catch {
-    return {
-      expiresAt: "",
-      daysLeft: 0,
-      warning:
-        "The Connect certificate can't be read. Run agent-os connect --renew.",
-    };
-  }
-}

package/lib/connect/cloudflare-dns.ts

@@ -1,56 +0,0 @@
-/**
- * Dev and operator path only: write ACME TXT records straight to Cloudflare
- * with a zone-scoped token. Machines in the wild will go through the control
- * plane's broker instead, which only lets a machine touch its own name.
- */
-
-import type { DnsChallenge } from "./enrol";
-
-const API = "https://api.cloudflare.com/client/v4";
-
-export function cloudflareDns(token: string, zone: string): DnsChallenge {
-  const call = async (path: string, init: RequestInit = {}) => {
-    const res = await fetch(`${API}${path}`, {
-      ...init,
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json",
-      },
-    });
-    const body = (await res.json()) as {
-      success: boolean;
-      result: unknown;
-      errors: unknown;
-    };
-    if (!body.success)
-      throw new Error(`cloudflare: ${JSON.stringify(body.errors)}`);
-    return body.result;
-  };
-  let zoneId: string | null = null;
-  const zid = async () =>
-    (zoneId ??=
-      ((await call(`/zones?name=${zone}`)) as { id: string }[])[0]?.id ?? null);
-
-  return {
-    async set(name, value) {
-      await call(`/zones/${await zid()}/dns_records`, {
-        method: "POST",
-        body: JSON.stringify({ type: "TXT", name, content: value, ttl: 60 }),
-      });
-      // Give the authoritative servers a moment before Let's Encrypt looks.
-      await new Promise((r) => setTimeout(r, 15_000));
-    },
-    async clear(name, value) {
-      const records = (await call(
-        `/zones/${await zid()}/dns_records?type=TXT&name=${encodeURIComponent(name)}`
-      )) as { id: string; content: string }[];
-      for (const r of records.filter(
-        (r) => r.content.replace(/"/g, "") === value
-      )) {
-        await call(`/zones/${await zid()}/dns_records/${r.id}`, {
-          method: "DELETE",
-        });
-      }
-    },
-  };
-}

package/lib/connect/frames.ts

@@ -1,72 +0,0 @@
-/**
- * The Connect tunnel's wire format: one WebSocket from a machine to the
- * relay, carrying many TCP streams. Each binary message is one frame:
- *
- *   type (u8) | stream id (u32 BE) | payload
- *
- * The relay only ever moves the TLS bytes of user connections; it never
- * holds a key that could read them.
- */
-
-export const Frame = {
-  /** machine → relay: {machineId, ts, nonce, sig} */
-  HELLO: 0,
-  /** relay → machine: a phone connected; payload {remote} */
-  OPEN: 1,
-  DATA: 2,
-  /** either side: this stream is done */
-  CLOSE: 3,
-  /** relay → machine: {hostname} once HELLO checks out */
-  READY: 4,
-  /** either side: stop / start sending DATA for this stream */
-  PAUSE: 5,
-  RESUME: 6,
-  /** relay → machine: refused, payload {error}; the socket closes after */
-  DENIED: 7,
-} as const;
-
-export type FrameType = (typeof Frame)[keyof typeof Frame];
-
-export interface Decoded {
-  type: FrameType;
-  stream: number;
-  payload: Buffer;
-}
-
-export function encode(
-  type: FrameType,
-  stream = 0,
-  payload?: Buffer | string | object
-): Buffer {
-  const body =
-    payload === undefined
-      ? Buffer.alloc(0)
-      : Buffer.isBuffer(payload)
-        ? payload
-        : Buffer.from(
-            typeof payload === "string" ? payload : JSON.stringify(payload)
-          );
-  const head = Buffer.alloc(5);
-  head.writeUInt8(type, 0);
-  head.writeUInt32BE(stream, 1);
-  return Buffer.concat([head, body]);
-}
-
-export function decode(data: Buffer): Decoded | null {
-  if (data.length < 5) return null;
-  const type = data.readUInt8(0);
-  if (type > Frame.DENIED) return null;
-  return {
-    type: type as FrameType,
-    stream: data.readUInt32BE(1),
-    payload: data.subarray(5),
-  };
-}
-
-export const json = <T>(payload: Buffer): T | null => {
-  try {
-    return JSON.parse(payload.toString("utf8")) as T;
-  } catch {
-    return null;
-  }
-};

package/lib/connect/identity.ts

@@ -1,98 +0,0 @@
-/**
- * A machine proves who it is to the relay with an Ed25519 key that never
- * leaves it. HELLO signs (machine id, time, nonce); the relay checks the
- * signature against the public key registered for that id, the time
- * against its clock, and refuses a nonce it has already seen.
- */
-
-import crypto from "crypto";
-
-const SKEW_MS = 60_000;
-const CONTEXT = "agentos-connect-hello";
-
-export interface Hello {
-  machineId: string;
-  ts: number;
-  nonce: string;
-  sig: string;
-}
-
-export function generateMachineKey(): {
-  publicKey: string;
-  privateKey: string;
-} {
-  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
-  return {
-    publicKey: publicKey.export({ type: "spki", format: "pem" }).toString(),
-    privateKey: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
-  };
-}
-
-const message = (h: Omit<Hello, "sig">) =>
-  Buffer.from(`${CONTEXT}:${h.machineId}:${h.ts}:${h.nonce}`);
-
-export function signHello(
-  machineId: string,
-  privateKeyPem: string,
-  now = Date.now()
-): Hello {
-  const h = {
-    machineId,
-    ts: now,
-    nonce: crypto.randomBytes(16).toString("base64url"),
-  };
-  const sig = crypto
-    .sign(null, message(h), privateKeyPem)
-    .toString("base64url");
-  return { ...h, sig };
-}
-
-export class NonceCache {
-  private seen = new Map<string, number>();
-  /** False if this nonce was already used inside the window. */
-  remember(nonce: string, now = Date.now()): boolean {
-    for (const [n, at] of this.seen)
-      if (at < now - 2 * SKEW_MS) this.seen.delete(n);
-    if (this.seen.has(nonce)) return false;
-    this.seen.set(nonce, now);
-    return true;
-  }
-}
-
-export type HelloCheck =
-  | { ok: true; machineId: string }
-  | { ok: false; error: string };
-
-export function verifyHello(
-  hello: Partial<Hello> | null,
-  publicKeyPem: string | null,
-  nonces: NonceCache,
-  now = Date.now()
-): HelloCheck {
-  if (
-    !hello?.machineId ||
-    !hello.sig ||
-    !hello.nonce ||
-    typeof hello.ts !== "number"
-  ) {
-    return { ok: false, error: "malformed hello" };
-  }
-  if (!publicKeyPem) return { ok: false, error: "unknown machine" };
-  if (Math.abs(now - hello.ts) > SKEW_MS)
-    return { ok: false, error: "clock skew" };
-  let valid = false;
-  try {
-    valid = crypto.verify(
-      null,
-      message(hello as Hello),
-      publicKeyPem,
-      Buffer.from(hello.sig, "base64url")
-    );
-  } catch {
-    valid = false;
-  }
-  if (!valid) return { ok: false, error: "bad signature" };
-  if (!nonces.remember(hello.nonce, now))
-    return { ok: false, error: "replayed" };
-  return { ok: true, machineId: hello.machineId };
-}

package/lib/connect/mux.ts

@@ -1,110 +0,0 @@
-/**
- * Both ends of the tunnel: a map of TunnelStreams over one WebSocket. The
- * relay opens streams (a phone connected); the machine receives them.
- */
-
-import type WebSocket from "ws";
-import { decode, encode, Frame, json, type Decoded } from "./frames";
-import { TunnelStream } from "./stream";
-
-// Past this much unsent data, writers wait for the socket to drain.
-const HIGH_WATER = 1 << 20;
-export const MAX_STREAMS = 256;
-
-export interface OpenMeta {
-  remote?: string;
-}
-
-export class Mux {
-  readonly streams = new Map<number, TunnelStream>();
-  bytesIn = 0;
-  bytesOut = 0;
-  private next = 1;
-
-  constructor(
-    private readonly ws: WebSocket,
-    private readonly onOpen?: (stream: TunnelStream, meta: OpenMeta) => void
-  ) {}
-
-  private send = (frame: Buffer): boolean => {
-    if (this.ws.readyState !== this.ws.OPEN) return true;
-    if (frame[0] === Frame.DATA) this.bytesOut += frame.length - 5;
-    this.ws.send(frame);
-    return this.ws.bufferedAmount < HIGH_WATER;
-  };
-
-  private drained = (cb: () => void): void => {
-    const check = () => {
-      if (
-        this.ws.readyState !== this.ws.OPEN ||
-        this.ws.bufferedAmount < HIGH_WATER
-      )
-        cb();
-      else setTimeout(check, 20);
-    };
-    setTimeout(check, 20);
-  };
-
-  private stream(id: number): TunnelStream {
-    const s = new TunnelStream(
-      id,
-      this.send,
-      (done) => this.streams.delete(done),
-      this.drained
-    );
-    this.streams.set(id, s);
-    return s;
-  }
-
-  /** Relay side: a new client connection, or null if the tunnel is going away. */
-  open(meta: OpenMeta): TunnelStream | null {
-    if (this.ws.readyState !== this.ws.OPEN) return null;
-    const id = this.next++;
-    const s = this.stream(id);
-    s.remoteAddress = meta.remote;
-    this.ws.send(encode(Frame.OPEN, id, meta));
-    return s;
-  }
-
-  /** Feed one WebSocket message in. Returns frames this layer doesn't own. */
-  handle(data: Buffer): Decoded | null {
-    const f = decode(data);
-    if (!f) return null;
-    const s = this.streams.get(f.stream);
-    switch (f.type) {
-      case Frame.OPEN: {
-        if (!this.onOpen || this.streams.has(f.stream)) return null;
-        // The relay doesn't get to open unlimited connections into this machine.
-        if (this.streams.size >= MAX_STREAMS) {
-          this.ws.send(encode(Frame.CLOSE, f.stream));
-          return null;
-        }
-        const meta = json<OpenMeta>(f.payload) ?? {};
-        const created = this.stream(f.stream);
-        created.remoteAddress = meta.remote;
-        this.onOpen(created, meta);
-        return null;
-      }
-      case Frame.DATA:
-        this.bytesIn += f.payload.length;
-        s?.receive(Buffer.from(f.payload));
-        return null;
-      case Frame.CLOSE:
-        s?.remoteClosed();
-        return null;
-      case Frame.PAUSE:
-        s?.setRemotePaused(true);
-        return null;
-      case Frame.RESUME:
-        s?.setRemotePaused(false);
-        return null;
-      default:
-        return f;
-    }
-  }
-
-  closeAll(): void {
-    for (const s of this.streams.values()) s.remoteClosed();
-    this.streams.clear();
-  }
-}

package/lib/connect/stream.ts

@@ -1,106 +0,0 @@
-/**
- * One tunnelled TCP connection, as a Duplex. Writes become DATA frames; DATA
- * frames from the other side are pushed in. When our reader falls behind we
- * tell the other side to PAUSE that stream, so one slow terminal can't stall
- * the others sharing the WebSocket.
- */
-
-import { Duplex } from "stream";
-import { encode, Frame } from "./frames";
-
-export type Send = (frame: Buffer) => boolean;
-
-const MAX_FRAME = 64 * 1024;
-// PAUSE goes out at the 64 KB high-water mark; this is far past it.
-export const MAX_BUFFERED = 4 * 1024 * 1024;
-
-export class TunnelStream extends Duplex {
-  private paused = false;
-  private remotePaused = false;
-  private waiting: (() => void)[] = [];
-  private closedByRemote = false;
-  /** Where the far end says the connection came from; informational only. */
-  remoteAddress?: string;
-
-  constructor(
-    readonly id: number,
-    private readonly send: Send,
-    private readonly onDone: (id: number) => void,
-    private readonly drained: (cb: () => void) => void
-  ) {
-    super({ allowHalfOpen: false });
-    this.once("close", () => this.onDone(this.id));
-  }
-
-  /** DATA from the far end. */
-  receive(chunk: Buffer): void {
-    // A far end that ignores PAUSE can't make us buffer without limit.
-    if (this.readableLength + chunk.length > MAX_BUFFERED) {
-      // No error object: nothing listens for "error" on these streams, and an
-      // unheard error event would take the whole process down.
-      this.destroy();
-      return;
-    }
-    if (!this.push(chunk) && !this.paused) {
-      this.paused = true;
-      this.send(encode(Frame.PAUSE, this.id));
-    }
-  }
-
-  /** The far end asked us to stop or start sending. */
-  setRemotePaused(paused: boolean): void {
-    this.remotePaused = paused;
-    if (!paused) this.waiting.splice(0).forEach((go) => go());
-  }
-
-  /** The far end closed. */
-  remoteClosed(): void {
-    this.closedByRemote = true;
-    this.push(null);
-    this.destroy();
-  }
-
-  _read(): void {
-    if (this.paused) {
-      this.paused = false;
-      this.send(encode(Frame.RESUME, this.id));
-    }
-  }
-
-  _write(
-    chunk: Buffer,
-    _enc: BufferEncoding,
-    done: (err?: Error) => void
-  ): void {
-    // Frames stay well under the relay's 1 MB message limit.
-    const pieces: Buffer[] = [];
-    for (let i = 0; i < chunk.length; i += MAX_FRAME) {
-      pieces.push(chunk.subarray(i, i + MAX_FRAME));
-    }
-    const next = (): void => {
-      const piece = pieces.shift();
-      if (!piece) return done();
-      if (this.remotePaused) return void this.waiting.push(next);
-      // send() is false while the WebSocket's buffer is full; wait it out.
-      if (this.send(encode(Frame.DATA, this.id, piece))) next();
-      else this.drained(next);
-    };
-    next();
-  }
-
-  _destroy(err: Error | null, done: (err: Error | null) => void): void {
-    if (!this.closedByRemote) this.send(encode(Frame.CLOSE, this.id));
-    done(err);
-  }
-
-  // What http/tls expect of a socket.
-  setNoDelay(): this {
-    return this;
-  }
-  setKeepAlive(): this {
-    return this;
-  }
-  setTimeout(): this {
-    return this;
-  }
-}