@songsid/agend 2.2.0-beta.2 → 2.2.0-beta.20

package/dist/usage/providers.js

@@ -20,13 +20,15 @@
  */
 import { readFile, writeFile, access, constants } from "node:fs/promises";
 import { readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve, sep } from "node:path";
+import { execFile } from "node:child_process";
 import { getAgendHome } from "../paths.js";
 import { loadFleetConfig } from "../config.js";
 import { classicProfile, profileName, readClassicBindings } from "../classic-bindings.js";
-import { credentialHomeSpec, credentialProfileStoreHome, instanceCredentialProfile, } from "../backend/credential-profile.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS, credentialHomeSpec, credentialProfileLoginCommand, credentialProfileStoreHome, instanceCredentialProfile, } from "../backend/credential-profile.js";
+import { claudeKeychainService } from "../backend/claude-code.js";
 import { readKiroAuthTokens } from "../backend/kiro-auth-store.js";
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { getProviderRateLimit } from "./provider-alerts.js";
 import { MUSE_USAGE_STALE_MS, readMuseUsageSnapshot } from "../muse-usage-relay.js";
 import { readStatuslineRateLimits, } from "./statusline-usage.js";
@@ -216,43 +218,163 @@ export function statuslineUsage(reading, plan, now = Date.now()) {
         metrics,
     };
 }
+/** `claudeAiOauth` of a credentials document (the `.credentials.json` file, or the same JSON in a Keychain item). */
+function claudeOAuthOf(json) {
+    try {
+        const value = JSON.parse(json)?.claudeAiOauth;
+        return value && typeof value === "object" ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function readClaudeCredentialsFile(dir) {
+    try {
+        return claudeOAuthOf(await readFile(join(dir, ".credentials.json"), "utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+const readKeychainItem = (service, account) => new Promise(done => {
+    execFile("security", ["find-generic-password", "-a", account, "-w", "-s", service], { timeout: 5_000 }, (err, stdout) => {
+        done(err ? null : String(stdout).trim() || null);
+    });
+});
+const defaultKeychain = () => ({ platform: process.platform, read: readKeychainItem, username: () => userInfo().username });
+let claudeKeychain = defaultKeychain();
+/** Test seam (#1699): the platform, the Keychain read and the OS user name; null restores all three. */
+export function setClaudeKeychainForTests(seam) {
+    claudeKeychain = seam ? { ...claudeKeychain, ...seam } : defaultKeychain();
+}
 /**
- * Best-effort OAuth access token for direct Anthropic API calls (the /model
- * catalog probe). Same resolution order as the usage panel: credentials file →
- * CLAUDE_CODE_OAUTH_TOKEN → shell rc. Null when nothing usable exists.
+ * The account claude files its Keychain item under (2.1.296, as Prism read it from the official darwin bundle, #1713
+ * review): `$USER`, else the OS user name; one that cannot be read or is not `[a-zA-Z0-9._-]+` is "claude-code-user".
  */
-export async function getClaudeOAuthToken() {
-    const home = process.env.CLAUDE_HOME || join(homedir(), ".claude");
-    let file;
+function claudeKeychainAccount() {
+    let name;
     try {
-        file = JSON.parse(await readFile(join(home, ".credentials.json"), "utf8")).claudeAiOauth ?? null;
+        name = process.env.USER || claudeKeychain.username();
     }
     catch {
-        file = null;
+        name = undefined;
     }
-    const auth = resolveClaudeAuth(file);
-    return auth && "token" in auth ? auth.token : null;
+    return name && /^[a-zA-Z0-9._-]+$/.test(name) ? name : "claude-code-user";
 }
-/** Exported for tests — the statusline/API preference order is the subject. */
-export async function fetchClaudeUsage() {
-    const home = process.env.CLAUDE_HOME || join(homedir(), ".claude");
-    let file;
+/**
+ * A credential profile's own Claude login (#1699) — and nothing else: on macOS the Keychain item claude keeps for
+ * exactly this config dir (claudeKeychainService; the account is $USER, as claude names it), else — or when that has
+ * none — the dir's `.credentials.json`. Never the shared login, `CLAUDE_CODE_OAUTH_TOKEN` or a shell rc: those are
+ * another account's, and their numbers on this row would be a lie about this subscription.
+ */
+async function readClaudeProfileLogin(configDir) {
+    if (claudeKeychain.platform === "darwin") {
+        // As claude: a credentials document in the Keychain is THE login — one with no OAuth in it (say only MCP
+        // logins) means no OAuth login, and an older `.credentials.json` beside it is not consulted (#1713 review).
+        const secret = await claudeKeychain.read(claudeKeychainService(configDir), claudeKeychainAccount());
+        const document = secret ? credentialsDocument(secret) : null;
+        if (document)
+            return claudeOAuthOf(secret);
+    }
+    return readClaudeCredentialsFile(configDir);
+}
+/** A credentials document (any JSON object), or null — unparseable is no document, as claude reads its storage. */
+function credentialsDocument(json) {
     try {
-        file = JSON.parse(await readFile(join(home, ".credentials.json"), "utf8")).claudeAiOauth ?? null;
+        const v = JSON.parse(json);
+        return v && typeof v === "object" ? v : null;
     }
     catch {
-        file = null;
+        return null;
+    }
+}
+/**
+ * Whether a token the profile's own login does not control can reach claude in a profile's pane: AgEnD sets only
+ * `CLAUDE_CONFIG_DIR` for a profile, so `CLAUDE_CODE_OAUTH_TOKEN` from the fleet's environment, or set in a shell rc
+ * the pane's shell reads, still signs it in — and outranks the stored login (#1713 review).
+ */
+function envTokenReachesClaude() {
+    return !!process.env.CLAUDE_CODE_OAUTH_TOKEN?.trim() || shellRcSetsClaudeToken((path) => readFileSync(path, "utf-8"));
+}
+/**
+ * Whether a shell rc sets `CLAUDE_CODE_OAUTH_TOKEN` at all — any assignment, export or declaration that is not a
+ * comment, whatever its value: `"$OTHER"` or `${OTHER}` is a token once the pane's shell expands it, so unlike
+ * tokenFromShellRc (which must hand the API a literal bearer) this never discounts one it cannot read (#1713 review).
+ * Files those rcs `source` are not followed.
+ */
+export function shellRcSetsClaudeToken(read, home = homedir(), files = SHELL_RC_FILES) {
+    const sets = [
+        /^[ \t]*(?:(?:export|readonly|local|declare|typeset)(?:[ \t]+-[a-zA-Z]+)*[ \t]+(?:[^#\n]*[ \t])?)?CLAUDE_CODE_OAUTH_TOKEN[ \t]*=/m,
+        /^[ \t]*(?:export|declare[ \t]+-[a-zA-Z]*x[a-zA-Z]*|typeset[ \t]+-[a-zA-Z]*x[a-zA-Z]*)[ \t]+(?:[^#\n]*[ \t])?CLAUDE_CODE_OAUTH_TOKEN\b/m,
+        /^[ \t]*setenv[ \t]+CLAUDE_CODE_OAUTH_TOKEN\b/m,
+    ];
+    for (const file of files) {
+        let content;
+        try {
+            content = read(join(home, file));
+        }
+        catch {
+            continue;
+        }
+        if (sets.some((re) => re.test(content)))
+            return true;
     }
+    return false;
+}
+/** `path` is `dir` or inside it. */
+const isWithin = (path, dir) => { const p = resolve(path); return p === dir || p.startsWith(dir + sep); };
+/**
+ * Best-effort OAuth access token for direct Anthropic API calls (the /model
+ * catalog probe). Same resolution order as the usage panel: credentials file →
+ * CLAUDE_CODE_OAUTH_TOKEN → shell rc. Null when nothing usable exists. With
+ * `storeHome` (a credential profile's config dir, #1699): that profile's login only.
+ */
+export async function getClaudeOAuthToken(storeHome) {
+    const auth = storeHome !== undefined
+        ? resolveClaudeAuth(await readClaudeProfileLogin(storeHome), {}, () => null)
+        : resolveClaudeAuth(await readClaudeCredentialsFile(process.env.CLAUDE_HOME || join(homedir(), ".claude")));
+    return auth && "token" in auth ? auth.token : null;
+}
+/**
+ * Exported for tests — the statusline/API preference order is the subject.
+ *
+ * `storeHome` (#1699): a credential profile's config dir — the row reads that profile's login and only the rate
+ * limits its own instances wrote (their conversations are under its `projects/`); a profile with no login says so,
+ * with the line that signs it in, and never shows the shared account's numbers. Without it: the shared login as
+ * always; beside profiles (`besideProfiles`), its statusline fallback leaves the profiles' instances out.
+ */
+export async function fetchClaudeUsage(storeHome, scope = {}) {
+    const profileHome = storeHome !== undefined ? resolve(storeHome) : null;
+    const file = profileHome !== null
+        ? await readClaudeProfileLogin(profileHome)
+        : await readClaudeCredentialsFile(process.env.CLAUDE_HOME || join(homedir(), ".claude"));
     // Read before anything else: it costs one stat per instance, needs no token,
     // and it is what keeps the panel useful when the API path cannot run at all.
-    const statusline = readStatuslineRateLimits();
-    const auth = resolveClaudeAuth(file);
+    // A profile's: only readings written under its own `projects/` — and only when nothing but its own login can
+    // have signed those instances in. Where the conversation is says which config dir, not whose subscription: with
+    // a token in the environment the readings may be another account's, so none is this row's (#1713 review).
+    const profilesRoot = resolve(getAgendHome(), "credential-profiles", "claude-code");
+    const statusline = profileHome !== null
+        ? (envTokenReachesClaude() ? null : readStatuslineRateLimits(undefined, undefined, (path) => path !== null && isWithin(path, join(profileHome, "projects"))))
+        : readStatuslineRateLimits(undefined, undefined, scope.besideProfiles ? (path) => path === null || !isWithin(path, profilesRoot) : undefined);
+    const auth = profileHome !== null ? resolveClaudeAuth(file, {}, () => null) : resolveClaudeAuth(file);
     if (auth === null) {
         // No token anywhere — but the CLI itself is logged in somehow (including an
         // API key, which the usage endpoint rejects outright), and it wrote its
         // limits down. This is the case the whole statusline source exists for.
         if (statusline)
             return statuslineUsage(statusline, null);
+        if (profileHome !== null) {
+            // On screen (`ok`, as kiro's signed-out row), with what signs this profile in — never a fallback: from chat
+            // (`/login claude-code <profile>`, #1699 part 2), or the exact line on the host — the same words as the auth alert.
+            const host = (scope.profile && credentialProfileLoginCommand(getAgendHome(), "claude-code", scope.profile))
+                || `CLAUDE_CONFIG_DIR=${JSON.stringify(profileHome)} claude auth login`;
+            if (scope.profile && CHAT_PROFILE_LOGIN_BACKENDS.has("claude-code")) {
+                const chat = `/login claude-code ${scope.profile}`;
+                return { status: "ok", hint: `Not logged in — sign in with \`${chat}\` (or run \`${host}\` on the host).`, hintI18n: i18n("usage.hint.claude_profile_signed_out_chat", chat, host), metrics: [] };
+            }
+            return { status: "ok", hint: `Not logged in — sign in with: ${host}`, hintI18n: i18n("usage.hint.claude_profile_signed_out", host), metrics: [] };
+        }
         const hint = process.env.ANTHROPIC_API_KEY
             ? "API-key login has no subscription usage. Use `claude /login` or set CLAUDE_CODE_OAUTH_TOKEN (from `claude setup-token`)."
             : "Log in with the Claude Code CLI (`claude`).";
@@ -427,42 +549,96 @@ function agyOAuthClient(env = process.env) {
 /** Refreshed bearer, cached until shortly before expiry. The CLI's token file is
  * never written back — it belongs to agy; refresh tokens are reusable. */
 let agyTokenCache = null;
+/** The summary's buckets, each tagged with its group's name. The top-level list (deprecated in the proto) only counts
+ * when no group carries any bucket. */
+export function agyQuotaBuckets(body) {
+    const grouped = (body.groups ?? []).flatMap(g => (g.buckets ?? []).map(b => ({ ...b, group: g.displayName?.trim() || undefined })));
+    return grouped.length ? grouped : (body.buckets ?? []);
+}
+const AGY_POOLED = {
+    "gemini-5h": { pool: "Gemini", window: "session" },
+    "gemini-weekly": { pool: "Gemini", window: "weekly" },
+    "3p-5h": { pool: "Claude & others", window: "session" },
+    "3p-weekly": { pool: "Claude & others", window: "weekly" },
+};
+/** The pool a bucket belongs to: its group when the summary names one (#1898), else a guess from the bucket id. */
+function agyPool(b, id) {
+    const pooled = AGY_POOLED[id];
+    if (pooled)
+        return pooled.pool;
+    const group = b.group;
+    if (group) {
+        if (/gemini/i.test(group))
+            return "Gemini";
+        if (/claude|gpt|third.?party|\b3p\b/i.test(group))
+            return "Claude & others";
+        return group;
+    }
+    return id.startsWith("gemini") ? "Gemini" : "Claude & others";
+}
+/** The limit a bucket counts against ("Five Hour Limit", window "5h" …), or null for a per-model bucket. */
+function agyWindow(b, id) {
+    const pooled = AGY_POOLED[id];
+    if (pooled)
+        return pooled.window;
+    // One source at a time, the most specific first: the bucket's own window, then its id, then — only inside a named
+    // group, where a per-model name ("Gemini 2.5 High") cannot occur — its display name. A word that merely appears in an
+    // opaque id never overrides a window the bucket states.
+    for (const text of [b.window, id, b.group ? b.displayName : undefined]) {
+        const window = text ? agyWindowOf(text) : null;
+        if (window)
+            return window;
+    }
+    return null;
+}
+/** "5h", "5 h", "5-hour", "5_hours", "Five Hour Limit", "session" → session; "weekly", "7d", "7 days" → weekly. */
+function agyWindowOf(text) {
+    if (/(^|[^0-9.])5[\s_-]*h(ours?|rs?)?\b|five[\s_-]*h(ours?|rs?)\b|\bsession\b/i.test(text))
+        return "session";
+    if (/week|(^|[^0-9.])7[\s_-]*d(ays?)?\b|seven[\s_-]*days?\b/i.test(text))
+        return "weekly";
+    return null;
+}
+function agyLabel(pool, window) {
+    if (pool === "Claude & others") {
+        return window === "session" ? { text: "Claude & others (session)", i18n: i18n("usage.metric.agy_claude_others_session") }
+            : window === "weekly" ? { text: "Claude & others (weekly)", i18n: i18n("usage.metric.agy_claude_others_weekly") }
+                : { text: pool, i18n: i18n("usage.metric.agy_claude_others") };
+    }
+    return window === "session" ? { text: `${pool} (session)`, i18n: i18n("usage.metric.named_session", pool) }
+        : window === "weekly" ? { text: `${pool} (weekly)`, i18n: i18n("usage.metric.named_weekly", pool) }
+            : { text: pool, i18n: i18n("usage.metric.named", pool) };
+}
 /**
- * Pool the summary's buckets into at most four metrics.
+ * Pool the summary's buckets into one metric per pool and limit.
  *
- * Two payload shapes exist. Older accounts report pooled ids (`gemini-5h`,
- * `gemini-weekly`, `3p-5h`, `3p-weekly`), which map 1:1. This machine's live
- * response instead lists PER-MODEL buckets (`gemini-3.6-flash-high`,
- * `claude-sonnet-4-6`, `gpt-oss-120b-medium`, …) — those aggregate into a
- * Gemini pool and an everything-else pool, keeping each pool's WORST remaining
- * fraction, because eleven per-model meters is noise and the binding constraint
- * is the one that runs out first.
+ * Three payload shapes exist:
+ * - pooled ids (`gemini-5h`, `gemini-weekly`, `3p-5h`, `3p-weekly`), which map 1:1;
+ * - PER-MODEL buckets (`gemini-3.6-flash-high`, `claude-sonnet-4-6`, …), aggregated into a Gemini pool and an
+ *   everything-else pool;
+ * - (#1898, agy 2026-10) named groups ("Gemini Models", "Claude and GPT Models") whose buckets are the group's
+ *   five-hour and weekly limits. The group decides the pool; the bucket's window, id or name decides the limit.
+ *
+ * Every metric keeps the WORST remaining fraction of its buckets, because the binding constraint is the one that runs
+ * out first. Within one pool a bucket with a known limit is authoritative over per-model buckets; one pool never hides
+ * another. Disabled buckets (agy dims them, no number) are left out.
  */
 export function agyPoolMetrics(buckets) {
-    const POOLED = {
-        "gemini-5h": { text: "Gemini (session)", i18n: i18n("usage.metric.named_session", "Gemini") },
-        "gemini-weekly": { text: "Gemini (weekly)", i18n: i18n("usage.metric.named_weekly", "Gemini") },
-        "3p-5h": { text: "Claude & others (session)", i18n: i18n("usage.metric.agy_claude_others_session") },
-        "3p-weekly": { text: "Claude & others (weekly)", i18n: i18n("usage.metric.agy_claude_others_weekly") },
-    };
-    const direct = [];
-    const pools = new Map();
+    const entries = new Map();
     for (const b of buckets) {
-        if (!b.bucketId || typeof b.remainingFraction !== "number" || !Number.isFinite(b.remainingFraction))
+        const id = b.bucketId?.trim() || (b.group ? b.displayName?.trim() : undefined);
+        if (!id || b.disabled === true || typeof b.remainingFraction !== "number" || !Number.isFinite(b.remainingFraction))
             continue;
+        const pool = agyPool(b, id);
+        const window = agyWindow(b, id);
+        const key = `${pool}\u0000${window ?? ""}`;
         const reset = b.resetTime ?? null;
-        const pooledLabel = POOLED[b.bucketId];
-        if (pooledLabel) {
-            direct.push({ label: pooledLabel.text, labelI18n: pooledLabel.i18n, type: "percent", used: (1 - b.remainingFraction) * 100, resetsAt: reset });
-            continue;
-        }
-        const pool = b.bucketId.startsWith("gemini") ? "Gemini" : "Claude & others";
-        const existing = pools.get(pool);
+        const existing = entries.get(key);
         if (!existing) {
-            pools.set(pool, { fraction: b.remainingFraction, resetsAt: reset, models: 1 });
+            entries.set(key, { pool, window, fraction: b.remainingFraction, resetsAt: reset, models: 1 });
             continue;
         }
-        // Count every model in the pool; track the worst separately. Replacing the
+        // Count every bucket in the entry; track the worst separately. Replacing the
         // whole entry on a new worst would restart the count at that bucket.
         existing.models += 1;
         if (b.remainingFraction < existing.fraction) {
@@ -470,22 +646,24 @@ export function agyPoolMetrics(buckets) {
             existing.resetsAt = reset;
         }
     }
-    if (direct.length)
-        return direct;
-    return [...pools.entries()].map(([label, p]) => ({
-        label,
-        labelI18n: label === "Claude & others"
-            ? i18n("usage.metric.agy_claude_others")
-            : i18n("usage.metric.named", label),
-        type: "percent",
-        used: (1 - p.fraction) * 100,
-        resetsAt: p.resetsAt,
+    const limited = new Set([...entries.values()].filter(e => e.window).map(e => e.pool));
+    const order = (w) => (w === "session" ? 0 : w === "weekly" ? 1 : 2);
+    const pools = [...new Set([...entries.values()].map(e => e.pool))];
+    return [...entries.values()]
+        .filter(e => e.window || !limited.has(e.pool))
+        .sort((a, b) => pools.indexOf(a.pool) - pools.indexOf(b.pool) || order(a.window) - order(b.window))
+        .map(e => {
+        const label = agyLabel(e.pool, e.window);
+        const metric = { label: label.text, labelI18n: label.i18n, type: "percent", used: (1 - e.fraction) * 100, resetsAt: e.resetsAt };
         // Which number this is: the highest usage across the pool's models. Without
         // it a flat 0% right after a weekly rollover is indistinguishable from a
         // broken reading — which is exactly how it was reported.
-        note: `busiest of ${p.models} model${p.models === 1 ? "" : "s"}`,
-        noteI18n: i18n(p.models === 1 ? "usage.note.busiest_model" : "usage.note.busiest_models", p.models),
-    }));
+        if (!e.window || e.models > 1) {
+            metric.note = `busiest of ${e.models} model${e.models === 1 ? "" : "s"}`;
+            metric.noteI18n = i18n(e.models === 1 ? "usage.note.busiest_model" : "usage.note.busiest_models", e.models);
+        }
+        return metric;
+    });
 }
 /**
  * agy's token file, in either shape.
@@ -613,8 +791,7 @@ async function fetchAntigravityUsage() {
         catch {
             continue;
         }
-        const buckets = (body.groups ?? []).flatMap(g => g.buckets ?? []);
-        const metrics = agyPoolMetrics(buckets);
+        const metrics = agyPoolMetrics(agyQuotaBuckets(body ?? {}));
         return metrics.length
             ? { status: "ok", plan: null, metrics }
             : { status: "ok", plan: null, hint: "No quota information reported for this account.", hintI18n: i18n("usage.hint.no_quota"), metrics: [] };
@@ -1274,13 +1451,14 @@ export function providersForConfig(config, base = DEFAULT_PROVIDERS) {
             rows.push({
                 id: provider.id,
                 name: provider.id === "codex" ? `${provider.name} (default)` : provider.name,
-                fetch: () => provider.fetch(),
+                // Claude's shared row keeps its statusline fallback to the shared instances (#1699); others ignore the scope.
+                fetch: () => provider.fetch(undefined, { besideProfiles: true }),
             });
         }
         rows.push(...profiles.map(profile => ({
             id: `${provider.id}:${profile}`,
             name: `${provider.name} (${profile})`,
-            fetch: () => provider.fetch(credentialProfileStoreHome(getAgendHome(), backendName, profile)),
+            fetch: () => provider.fetch(credentialProfileStoreHome(getAgendHome(), backendName, profile), { profile }),
         })));
         return rows;
     });
@@ -1302,7 +1480,7 @@ function hasEffectiveSharedBinding(config, backendName) {
     const instances = config.instances ?? {};
     let sawEffectiveBinding = false;
     for (const instance of Object.values(instances)) {
-        const backend = instance.backend ?? defaults?.backend;
+        const backend = instance.backend ?? defaultBackend(defaults);
         if (backend !== backendName)
             continue;
         sawEffectiveBinding = true;
@@ -1313,12 +1491,20 @@ function hasEffectiveSharedBinding(config, backendName) {
     // backend is this provider and no profile was configured.  With no known
     // binding at all, preserve the pre-profile shared-provider behaviour.
     if (!sawEffectiveBinding) {
-        if (defaults?.backend === backendName && !instanceCredentialProfile(undefined, defaults, backendName))
+        if (defaultBackend(defaults) === backendName && !instanceCredentialProfile(undefined, defaults, backendName))
             return true;
         return Object.keys(instances).length === 0;
     }
     return false;
 }
+/**
+ * The backend an instance without one runs: the fleet default, else Claude Code — as the fleet launches it
+ * (fleet-manager's bindings). Claude Code is the backend instances most often leave unnamed, so without this a
+ * Claude profile on such an instance had no row of its own (#1699).
+ */
+function defaultBackend(defaults) {
+    return defaults?.backend ?? "claude-code";
+}
 /** Profiles on effective bindings only (not dormant backend_options on another backend). */
 function effectiveCredentialProfiles(config, backendName) {
     if (!config)
@@ -1326,14 +1512,14 @@ function effectiveCredentialProfiles(config, backendName) {
     const found = new Set();
     const defaults = config.defaults;
     for (const instance of Object.values(config.instances ?? {})) {
-        const backend = instance.backend ?? defaults?.backend;
+        const backend = instance.backend ?? defaultBackend(defaults);
         if (backend !== backendName)
             continue;
         const profile = bindingProfile(instance, defaults, backendName);
         if (profile)
             found.add(profile);
     }
-    if (Object.keys(config.instances ?? {}).length === 0 && defaults?.backend === backendName) {
+    if (Object.keys(config.instances ?? {}).length === 0 && defaultBackend(defaults) === backendName) {
         const profile = instanceCredentialProfile(undefined, defaults, backendName);
         if (profile)
             found.add(profile);
@@ -1387,6 +1573,8 @@ function usageBackendForProviderId(id) {
         return "kiro-cli";
     if (id === "codex")
         return "codex";
+    if (id === "claude")
+        return "claude-code";
     return null;
 }
 let PROVIDERS = DEFAULT_PROVIDERS;