@scrylog/cli 0.1.0

package/src/usage/resolvers/browser-cookies.ts

@@ -0,0 +1,198 @@
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { createDecipheriv, pbkdf2Sync } from "node:crypto";
+import { join } from "node:path";
+import { Database } from "bun:sqlite";
+import { IS_MAC, IS_WINDOWS } from "../../shared/platform";
+
+export interface BrowserCookie {
+  name: string;
+  value: string;
+}
+
+const CHROME_COOKIE_PATHS = ((): string[] => {
+  const home = homedir();
+  if (IS_MAC) {
+    return [
+      join(home, "Library", "Application Support", "Google", "Chrome", "Default", "Cookies"),
+      join(home, "Library", "Application Support", "Google", "Chrome", "Profile 1", "Cookies"),
+    ];
+  }
+  if (IS_WINDOWS) {
+    return [
+      join(home, "AppData", "Local", "Google", "Chrome", "User Data", "Default", "Cookies"),
+    ];
+  }
+  // Linux / WSL
+  return [
+    join(home, ".config", "google-chrome", "Default", "Cookies"),
+    join(home, ".config", "chromium", "Default", "Cookies"),
+  ];
+})();
+
+const SAFARI_COOKIE_PATH = join(homedir(), "Library", "Cookies", "Cookies.binarycookies");
+
+function getChromeSafeStorageKey(): Buffer | null {
+  try {
+    if (IS_MAC) {
+      const password = execSync('security find-generic-password -s "Chrome Safe Storage" -w', {
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+      }).trim();
+      if (!password) return null;
+      return pbkdf2Sync(password, "saltysalt", 1003, 16, "sha1");
+    }
+
+    if (IS_WINDOWS) {
+      return null;
+    }
+    return pbkdf2Sync("peanuts", "saltysalt", 1003, 16, "sha1");
+  } catch {
+    return null;
+  }
+}
+
+function decryptChromeCookie(encrypted: Buffer, key: Buffer, dbVersion = 0): string | null {
+  if (encrypted.length < 3) return null;
+  // v10 or v11 prefix
+  const prefix = encrypted.slice(0, 3).toString("ascii");
+  if (prefix !== "v10" && prefix !== "v11") {
+    // Possibly plain text (older Chrome versions)
+    return encrypted.toString("utf8");
+  }
+  const iv = Buffer.alloc(16, 32); // space character (0x20) repeated 16 times
+  try {
+    const decipher = createDecipheriv("aes-128-cbc", key, iv);
+    let decrypted = Buffer.concat([decipher.update(encrypted.slice(3)), decipher.final()]);
+    // Remove PKCS#7 padding
+    const padLen = decrypted[decrypted.length - 1];
+    if (padLen > 0 && padLen <= 16) {
+      decrypted = decrypted.slice(0, decrypted.length - padLen);
+    }
+    // Chrome v24+ prepends a SHA256 hash of the domain (32 bytes) to encrypted values
+    if (dbVersion >= 24 && decrypted.length >= 32) {
+      decrypted = decrypted.slice(32);
+    }
+    return decrypted.toString("utf8");
+  } catch {
+    return null;
+  }
+}
+
+function readChromeCookies(domain: string): BrowserCookie[] {
+  const cookies: BrowserCookie[] = [];
+  const key = getChromeSafeStorageKey();
+  if (!key) return cookies;
+
+  for (const dbPath of CHROME_COOKIE_PATHS) {
+    if (!existsSync(dbPath)) continue;
+    let db: Database | undefined;
+    try {
+      db = new Database(dbPath, { readonly: true });
+
+      // Chrome v24+ prepends a SHA256 hash (32 bytes) to encrypted cookie values
+      let dbVersion = 0;
+      try {
+        const versionStmt = db.query("SELECT value FROM meta WHERE key = 'version'");
+        const versionRow = versionStmt.get() as { value: number } | null;
+        if (versionRow) dbVersion = Number(versionRow.value);
+      } catch {
+        // meta table may not exist in older DBs
+      }
+
+      const stmt = db.query(
+        "SELECT name, encrypted_value, host_key FROM cookies WHERE host_key LIKE ? AND expires_utc > ?"
+      );
+      const now = (Date.now() + 11644473600000) * 1000; // Chrome epoch offset
+      const rows = stmt.all(`%${domain}%`, now) as Array<{
+        name: string;
+        encrypted_value: Uint8Array;
+        host_key: string;
+      }>;
+      for (const row of rows) {
+        const value = decryptChromeCookie(Buffer.from(row.encrypted_value), key, dbVersion);
+        if (value !== null) {
+          cookies.push({ name: row.name, value });
+        }
+      }
+    } catch {
+      // Ignore permission errors or locked DB
+    } finally {
+      db?.close();
+    }
+  }
+
+  return cookies;
+}
+
+function readSafariCookies(domain: string): BrowserCookie[] {
+  const cookies: BrowserCookie[] = [];
+  if (process.platform !== "darwin") return cookies;
+  if (!existsSync(SAFARI_COOKIE_PATH)) return cookies;
+
+  try {
+    const data = readFileSync(SAFARI_COOKIE_PATH);
+    // Simple binarycookies parser
+    // Header: 4 bytes magic "cook", 4 bytes page size, then pages
+    if (data.length < 8 || data.toString("ascii", 0, 4) !== "cook") return cookies;
+
+    const numPages = data.readUInt32BE(4);
+    let offset = 8;
+    const pageSizes: number[] = [];
+    for (let i = 0; i < numPages; i++) {
+      pageSizes.push(data.readUInt32BE(offset));
+      offset += 4;
+    }
+
+    for (const pageSize of pageSizes) {
+      const pageEnd = offset + pageSize;
+      if (pageEnd > data.length) break;
+      // Page header: "page" + 4 bytes count
+      if (data.toString("ascii", offset, offset + 4) !== "page") {
+        offset += pageSize;
+        continue;
+      }
+      const numCookies = data.readUInt32BE(offset + 4);
+      let cookieOffset = offset + 8;
+      for (let i = 0; i < numCookies; i++) {
+        // Each cookie record: size (4) + unknown (4) + flags (4) + hasPort (4)
+        // + port (4) + urlOffset (4) + nameOffset (4) + pathOffset (4) + valueOffset (4)
+        // + tail (8) = 40 bytes header, then strings
+        const size = data.readUInt32BE(cookieOffset);
+        const urlOffset = data.readUInt32BE(cookieOffset + 20);
+        const nameOffset = data.readUInt32BE(cookieOffset + 24);
+        const pathOffset = data.readUInt32BE(cookieOffset + 28);
+        const valueOffset = data.readUInt32BE(cookieOffset + 32);
+
+        const url = data.toString("utf8", cookieOffset + urlOffset, cookieOffset + nameOffset - 1);
+        const name = data.toString("utf8", cookieOffset + nameOffset, cookieOffset + pathOffset - 1);
+        const value = data.toString("utf8", cookieOffset + valueOffset, cookieOffset + size);
+
+        if (url.includes(domain)) {
+          cookies.push({ name, value });
+        }
+
+        cookieOffset += size;
+        if (cookieOffset > pageEnd) break;
+      }
+      offset += pageSize;
+    }
+  } catch {
+    // Ignore errors
+  }
+
+  return cookies;
+}
+
+export function extractCookies(domain: string): BrowserCookie[] {
+  const chrome = readChromeCookies(domain);
+  if (chrome.length > 0) return chrome;
+  // Safari is only available on macOS.
+  if (IS_MAC) return readSafariCookies(domain);
+  return [];
+}
+
+export function buildCookieHeader(cookies: BrowserCookie[]): string {
+  return cookies.map((c) => `${c.name}=${c.value}`).join("; ");
+}

package/src/usage/resolvers/claude-auth.ts

@@ -0,0 +1,99 @@
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { TokenResolver } from "../resolver";
+import type { ClaudeOAuthCredentials } from "../types";
+import { IS_MAC } from "../../shared/platform";
+
+export class ClaudeAuthResolver implements TokenResolver<ClaudeOAuthCredentials> {
+  private readonly debug = (message: string, meta?: Record<string, unknown>) => {
+    // Avoid coupling to logger; stderr debug line is acceptable for resolver diagnostics.
+    if (process.env.SCRYLOG_DEBUG_AUTH) {
+      process.stderr.write(`[scrylog:claude-auth] ${message}${meta ? ` ${JSON.stringify(meta)}` : ""}\n`);
+    }
+  };
+
+  async resolve(): Promise<ClaudeOAuthCredentials | null> {
+    // 1. macOS Keychain is the primary store on macOS.
+    if (IS_MAC) {
+      const services = ["claude-api-oauth", "Claude Code-credentials"];
+      for (const service of services) {
+        const creds = this.tryService(service);
+        if (creds) return creds;
+      }
+    } else {
+      this.debug("Keychain not available on this platform", { platform: process.platform });
+    }
+
+    // 2. Linux/WSL/Windows: Claude Code stores credentials in ~/.claude/.credentials.json
+    const fileCreds = this.tryCredentialsFile();
+    if (fileCreds) return fileCreds;
+
+    // 3. Universal env-var fallback
+    const envToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+    if (envToken) {
+      return { accessToken: envToken };
+    }
+
+    return null;
+  }
+
+  async isAvailable(): Promise<boolean> {
+    return (await this.resolve()) !== null;
+  }
+
+  private tryService(service: string): ClaudeOAuthCredentials | null {
+    try {
+      const output = execSync(
+        `security find-generic-password -s "${service}" -w`,
+        { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }
+      ).trim();
+      if (!output) return null;
+      return this.parseCredentialsJson(output);
+    } catch (error) {
+      this.debug("Keychain lookup failed", { service, error: error instanceof Error ? error.message : String(error) });
+      return null;
+    }
+  }
+
+  private tryCredentialsFile(): ClaudeOAuthCredentials | null {
+    // On macOS, Keychain is authoritative; skip the file unless explicitly requested.
+    if (IS_MAC && !process.env.CLAUDE_CODE_USE_CREDENTIALS_FILE) return null;
+
+    const claudeDir = process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+    const path = join(claudeDir, ".credentials.json");
+    if (!existsSync(path)) return null;
+
+    try {
+      const raw = readFileSync(path, "utf8");
+      return this.parseCredentialsJson(raw);
+    } catch (error) {
+      this.debug("Failed to read credentials file", { path, error: error instanceof Error ? error.message : String(error) });
+      return null;
+    }
+  }
+
+  private parseCredentialsJson(input: string): ClaudeOAuthCredentials | null {
+    try {
+      const parsed = JSON.parse(input) as Record<string, unknown>;
+      // Handle nested structure: { claudeAiOauth: { accessToken, ... } }
+      const inner = parsed.claudeAiOauth && typeof parsed.claudeAiOauth === "object"
+        ? parsed.claudeAiOauth as Record<string, unknown>
+        : parsed;
+      const accessToken = inner.accessToken ?? inner.access_token;
+      if (!accessToken) return null;
+      return {
+        accessToken: String(accessToken),
+        refreshToken: inner.refreshToken ? String(inner.refreshToken) : undefined,
+        expiresAt: inner.expiresAt ? String(inner.expiresAt) : undefined,
+        scopes: Array.isArray(inner.scopes) ? inner.scopes.map(String) : undefined,
+        rateLimitTier: inner.rateLimitTier ? String(inner.rateLimitTier) : undefined,
+        subscriptionType: inner.subscriptionType ? String(inner.subscriptionType) : undefined,
+      };
+    } catch {
+      // Not JSON — treat the raw string as an access token.
+      return { accessToken: input.trim() };
+    }
+  }
+}

package/src/usage/resolvers/claude-cli.ts

@@ -0,0 +1,24 @@
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { whichCommand } from "../../shared/platform";
+import type { TokenResolver } from "../resolver";
+
+export class ClaudeCliResolver implements TokenResolver<string> {
+  async resolve(): Promise<string | null> {
+    const paths = [
+      process.env.CLAUDE_BIN_OVERRIDE,
+      `${homedir()}/.claude/local/claude`,
+      "/usr/local/bin/claude",
+    ];
+    for (const p of paths) {
+      if (p && existsSync(p)) return p;
+    }
+    const which = whichCommand("claude");
+    if (which) return which;
+    return null;
+  }
+
+  async isAvailable(): Promise<boolean> {
+    return (await this.resolve()) !== null;
+  }
+}

package/src/usage/resolvers/claude-web.ts

@@ -0,0 +1,16 @@
+import type { TokenResolver } from "../resolver";
+import type { ClaudeWebSession } from "../types";
+import { extractCookies, buildCookieHeader } from "./browser-cookies";
+
+export class ClaudeWebResolver implements TokenResolver<ClaudeWebSession> {
+  async resolve(): Promise<ClaudeWebSession | null> {
+    const cookies = extractCookies("claude.ai");
+    const sessionKey = cookies.find((c) => c.name === "sessionKey");
+    if (!sessionKey) return null;
+    return { cookieHeader: buildCookieHeader(cookies) };
+  }
+
+  async isAvailable(): Promise<boolean> {
+    return (await this.resolve()) !== null;
+  }
+}

package/src/usage/resolvers/codex-auth.ts

@@ -0,0 +1,117 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import type { TokenResolver } from "../resolver";
+import type { CodexOAuthCredentials } from "../types";
+
+function getCodexDir(): string {
+  if (process.env.CODEX_HOME) return process.env.CODEX_HOME;
+  return join(homedir(), ".codex");
+}
+
+function readConfigToml(codexDir: string): string | undefined {
+  const path = join(codexDir, "config.toml");
+  if (!existsSync(path)) return undefined;
+  try {
+    const content = readFileSync(path, "utf8");
+    for (const line of content.split(/\r?\n/)) {
+      const match = line.match(/^chatgpt_base_url\s*=\s*"(.+)"\s*$/);
+      if (match) return match[1];
+    }
+  } catch {
+    // ignore
+  }
+  return undefined;
+}
+
+function decodeJwtClaims(token: string): { email?: string; sub?: string; org_id?: string } {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return {};
+    const json = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<string, unknown>;
+    return {
+      email: typeof json["email"] === "string" ? json["email"] : undefined,
+      sub: typeof json["sub"] === "string" ? json["sub"] : undefined,
+      org_id: typeof json["org_id"] === "string" ? json["org_id"] : undefined,
+    };
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Extract access_token and related fields from Codex auth.json.
+ * Codex CLI writes credentials in a nested "tokens" object, e.g.:
+ *   { "tokens": { "access_token": "...", "refresh_token": "...", "account_id": "..." } }
+ * Some versions may write flat keys. This helper supports both formats.
+ */
+function extractTokens(raw: Record<string, unknown>): {
+  accessToken: string | undefined;
+  accountId: string | undefined;
+  refreshToken: string | undefined;
+} {
+  const tokens =
+    typeof raw["tokens"] === "object" && raw["tokens"] !== null
+      ? (raw["tokens"] as Record<string, unknown>)
+      : undefined;
+
+  const accessToken =
+    typeof raw["access_token"] === "string"
+      ? raw["access_token"]
+      : typeof tokens?.["access_token"] === "string"
+        ? tokens["access_token"]
+        : undefined;
+
+  const accountId =
+    typeof tokens?.["account_id"] === "string" ? tokens["account_id"] : undefined;
+
+  const refreshToken =
+    typeof raw["refresh_token"] === "string"
+      ? raw["refresh_token"]
+      : typeof tokens?.["refresh_token"] === "string"
+        ? tokens["refresh_token"]
+        : undefined;
+
+  return { accessToken, accountId, refreshToken };
+}
+
+export class CodexAuthResolver implements TokenResolver<CodexOAuthCredentials> {
+  async resolve(): Promise<CodexOAuthCredentials | null> {
+    const codexDir = getCodexDir();
+    const authPath = join(codexDir, "auth.json");
+    if (!existsSync(authPath)) return null;
+
+    try {
+      const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, unknown>;
+      const tokens = extractTokens(raw);
+      if (!tokens.accessToken) return null;
+
+      const claims = decodeJwtClaims(tokens.accessToken);
+      const chatgptBaseUrl = readConfigToml(codexDir);
+
+      return {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: typeof raw["expires_at"] === "string" ? raw["expires_at"] : undefined,
+        accountEmail: claims.email ?? null,
+        accountId: tokens.accountId ?? claims.sub ?? claims.org_id ?? null,
+        ...(chatgptBaseUrl ? { chatgptBaseUrl } : {}),
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  async isAvailable(): Promise<boolean> {
+    const codexDir = getCodexDir();
+    const authPath = join(codexDir, "auth.json");
+    if (!existsSync(authPath)) return false;
+    try {
+      const raw = JSON.parse(readFileSync(authPath, "utf8")) as Record<string, unknown>;
+      const { accessToken } = extractTokens(raw);
+      return typeof accessToken === "string" && accessToken.length > 0;
+    } catch {
+      return false;
+    }
+  }
+}

package/src/usage/resolvers/opencode-go-web.ts

@@ -0,0 +1,14 @@
+import type { TokenResolver } from "../resolver";
+import { extractCookies, buildCookieHeader } from "./browser-cookies";
+
+export class OpenCodeGoWebResolver implements TokenResolver<{ cookies: string }> {
+  async resolve(): Promise<{ cookies: string } | null> {
+    const cookies = extractCookies("opencode.ai");
+    if (cookies.length === 0) return null;
+    return { cookies: buildCookieHeader(cookies) };
+  }
+
+  async isAvailable(): Promise<boolean> {
+    return (await this.resolve()) !== null;
+  }
+}

package/src/usage/types.ts

@@ -0,0 +1,190 @@
+// Standardized unified types for usage limits — all providers share the same structure
+
+export interface UsageWindow {
+  /** Machine-readable identifier, e.g. "session", "weekly", "monthly", "designs" */
+  id: string;
+  /** Human-readable label, e.g. "Current Session", "Weekly", "Monthly" */
+  title: string;
+  /** Percentage used (0-100) */
+  usedPercent: number;
+  /** Absolute usage count (requests, tokens, credits) — optional */
+  used?: number;
+  /** Absolute limit — optional */
+  limit?: number;
+  /** Window duration in minutes — optional */
+  windowMinutes?: number;
+  /** Reset timestamp (ISO 8601) — preferred */
+  resetsAt?: string | null;
+  /** Seconds until reset — computed if not provided by provider */
+  resetInSec?: number;
+}
+
+export interface ProviderCostSnapshot {
+  /** Amount used */
+  used: number;
+  /** Limit amount */
+  limit: number;
+  /** Currency code, e.g. "USD" */
+  currency: string;
+  /** Billing period label, e.g. "Monthly" */
+  period: string;
+  /** Reset timestamp (ISO 8601) */
+  resetsAt?: string | null;
+  /** Last update timestamp (ISO 8601) */
+  updatedAt: string;
+}
+
+export interface UsageProviderEntry {
+  /** Provider identifier, e.g. "claude", "opencode-go" */
+  provider: string;
+
+  /** Account identifier — stable across hosts for grouping. null only when provider is unavailable or identity could not be determined. */
+  accountId: string | null;
+
+  /** Whether this provider is available on this machine (credentials detected) */
+  available: boolean;
+
+  /** Status of this provider */
+  status: "ok" | "error" | "unavailable" | "pending";
+
+  /** Metadata about the data source and account */
+  metadata?: {
+    /** How the data was obtained, e.g. "oauth", "web", "cli" */
+    dataSource?: string;
+    /** Account email if known */
+    accountEmail?: string | null;
+    /** Organization/account name if known */
+    accountOrganization?: string | null;
+    /** Subscription type, e.g. "pro", "free" */
+    subscriptionType?: string | null;
+    /** Rate limit tier */
+    rateLimitTier?: string | null;
+    /** Workspace ID (OpenCode Go) */
+    workspaceId?: string | null;
+    /** Workspace name (OpenCode Go) */
+    workspaceName?: string | null;
+  };
+
+  /** Errors specific to this provider (only present when status === "error") */
+  errors?: string[];
+
+  /** Usage windows — standardized for all providers */
+  windows?: UsageWindow[];
+
+  /** Cost/overage snapshot if available */
+  cost?: ProviderCostSnapshot | null;
+
+  /** Last update timestamp (ISO 8601) */
+  updatedAt?: string;
+}
+
+export interface UsageState {
+  /** All configured providers, including unavailable ones */
+  providers: UsageProviderEntry[];
+  /** Global refresh timestamp */
+  lastRefreshedAt: number;
+}
+
+// Legacy provider-specific snapshots (internal use only, mapped to UsageProviderEntry)
+
+export interface ClaudeUsageSnapshot {
+  source: "oauth" | "web" | "cli";
+  primary: RateWindowLegacy;
+  secondary: RateWindowLegacy | null;
+  opus: RateWindowLegacy | null;
+  extraRateWindows: NamedRateWindowLegacy[];
+  providerCost: ProviderCostSnapshotLegacy | null;
+  updatedAt: Date;
+  accountEmail: string | null;
+  accountOrganization: string | null;
+  loginMethod: string | null;
+  subscriptionType: string | null;
+  rateLimitTier: string | null;
+}
+
+export interface OpenCodeGoUsageSnapshot {
+  source: "web";
+  hasMonthlyUsage: boolean;
+  rollingUsagePercent: number;
+  weeklyUsagePercent: number;
+  monthlyUsagePercent: number;
+  rollingResetInSec: number;
+  weeklyResetInSec: number;
+  monthlyResetInSec: number;
+  updatedAt: Date;
+  workspaceId: string | null;
+  workspaceName: string | null;
+}
+
+// Legacy internal types (used by providers before mapping to unified model)
+
+export interface RateWindowLegacy {
+  usedPercent: number;
+  windowMinutes: number;
+  resetsAt: Date | null;
+  resetDescription: string | null;
+}
+
+export interface NamedRateWindowLegacy {
+  id: string;
+  title: string;
+  window: RateWindowLegacy;
+}
+
+export interface ProviderCostSnapshotLegacy {
+  used: number;
+  limit: number;
+  currencyCode: string;
+  period: string;
+  resetsAt: Date | null;
+  updatedAt: Date;
+}
+
+// Credential types
+
+export interface ClaudeOAuthCredentials {
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: string;
+  scopes?: string[];
+  rateLimitTier?: string;
+  subscriptionType?: string;
+}
+
+export interface CodexOAuthCredentials {
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: string;
+  accountEmail?: string | null;
+  accountId?: string | null;
+  chatgptBaseUrl?: string;
+}
+
+export interface ClaudeWebSession {
+  cookieHeader: string;
+}
+
+export type ClaudeDataSource = "oauth" | "web" | "cli" | "auto";
+
+export interface ClaudePlannerDecision {
+  primary: ClaudeDataSource;
+  fallback: ClaudeDataSource[];
+  webExtras: boolean;
+}
+
+export type CodexDataSource = "oauth" | "auto";
+
+export interface CodexUsageSnapshot {
+  source: "oauth";
+  planType: string | null;
+  primaryWindow: RateWindowLegacy | null;
+  secondaryWindow: RateWindowLegacy | null;
+  credits: {
+    hasCredits: boolean;
+    unlimited: boolean;
+    balance: number | null;
+  } | null;
+  updatedAt: Date;
+  accountEmail: string | null;
+  accountId: string | null;
+}