@stage-labs/metro 0.1.0-beta.221 → 0.1.0-beta.222

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.221",
+  "version": "0.1.0-beta.222",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.221",
+  "version": "0.1.0-beta.222",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -0,0 +1,127 @@
+import { spawn } from 'node:child_process';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentCommand, agentUser, agentUserExpected, claudeBin } from '../agent-user/user.js';
+import { runningAsRoot } from '../metro-user/privilege.js';
+import { PRIVACY_ENV } from './setup.js';
+
+const REQUEST_ID = 'metro-usage';
+const REQUEST = `${JSON.stringify({ type: 'control_request', request_id: REQUEST_ID, request: { subtype: 'get_usage', skip_behaviors: true } })}\n`;
+const ARGS = [
+  '-p',
+  '--setting-sources',
+  'project',
+  '--strict-mcp-config',
+  '--mcp-config',
+  '{"mcpServers":{}}',
+  '--no-session-persistence',
+  '--input-format',
+  'stream-json',
+  '--output-format',
+  'stream-json',
+  '--verbose',
+];
+const BLOCKS_USAGE = 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC';
+const PROBE_ENV: Record<string, string> = {
+  ...Object.fromEntries(Object.entries(PRIVACY_ENV).filter(([name]) => name !== BLOCKS_USAGE)),
+  DISABLE_AUTOUPDATER: '1',
+  DISABLE_BUG_COMMAND: '1',
+  ENABLE_CLAUDEAI_MCP_SERVERS: 'false',
+};
+const TIMEOUT_MS = 20_000;
+const KILL_GRACE_MS = 2_000;
+const LINE_MAX = 1024 * 1024;
+
+export interface UsageProbeDeps {
+  command?: string[];
+  timeoutMs?: number;
+}
+
+export function usageProbeCommand(): string[] | null {
+  if (runningAsRoot() || (agentUserExpected() && agentUser() === null)) return null;
+  return agentCommand([claudeBin(), ...ARGS], PROBE_ENV);
+}
+
+function answerOf(line: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(line);
+    if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response)) return null;
+    return parsed.response.request_id === REQUEST_ID ? parsed.response : null;
+  } catch {
+    return null;
+  }
+}
+
+function limitsOf(answer: Record<string, unknown>): unknown {
+  if (answer.subtype !== 'success') throw new Error(`Claude Code refused the usage request: ${typeof answer.error === 'string' ? answer.error : 'no reason given'}`);
+  return isRecord(answer.response) ? (answer.response.rate_limits ?? null) : null;
+}
+
+export function usageIn(output: string): unknown {
+  const answer = output
+    .split('\n')
+    .map(answerOf)
+    .find((found) => found !== null);
+  if (answer === undefined || answer === null) throw new Error('Claude Code gave no usage answer');
+  return limitsOf(answer);
+}
+
+export function readClaudeUsage(deps: UsageProbeDeps = {}): Promise<unknown> {
+  const command = deps.command ?? usageProbeCommand();
+  if (command === null) return Promise.reject(new Error('Claude Code runs only as the agent user, and this box has none'));
+  const [file = '', ...args] = command;
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV } });
+    let carry = '';
+    let settled = false;
+    let hardKill: ReturnType<typeof setTimeout> | undefined;
+    const settle = (run: () => void): void => {
+      if (settled) return;
+      settled = true;
+      run();
+    };
+    const overdue = setTimeout(() => {
+      settle(() => {
+        reject(new Error('Claude Code did not report the usage in time'));
+      });
+      child.stdout.destroy();
+      child.kill('SIGTERM');
+      hardKill = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS);
+    }, deps.timeoutMs ?? TIMEOUT_MS);
+    const take = (line: string): void => {
+      const answer = answerOf(line);
+      if (answer === null) return;
+      settle(() => {
+        try {
+          resolve(limitsOf(answer));
+        } catch (err) {
+          reject(err instanceof Error ? err : new Error(errMsg(err)));
+        }
+      });
+    };
+    child.stdout.on('data', (chunk: Buffer) => {
+      const lines = (carry + chunk.toString('utf8')).split('\n');
+      carry = lines.pop() ?? '';
+      if (carry.length > LINE_MAX) carry = '';
+      lines.forEach(take);
+    });
+    child.stdin.on('error', (err) => {
+      log.debug({ err: errMsg(err) }, 'claude-usage: Claude Code closed its input early');
+    });
+    child.on('error', (err) => {
+      clearTimeout(overdue);
+      settle(() => {
+        reject(err);
+      });
+    });
+    child.on('close', () => {
+      clearTimeout(overdue);
+      clearTimeout(hardKill);
+      take(carry);
+      settle(() => {
+        reject(new Error('Claude Code gave no usage answer'));
+      });
+    });
+    child.stdin.end(REQUEST);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -10,6 +10,7 @@ export const CODEX_ISSUER = 'https://auth.openai.com';
 export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
 const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
 const AUTH_CLAIM = 'https://api.openai.com/auth';
+const PROFILE_CLAIM = 'https://api.openai.com/profile';
 const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
 
 export interface CodexTokens {
@@ -76,7 +77,12 @@ function decodeJwtPayload(jwt: string): Record<string, unknown> {
 export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
   const payload = decodeJwtPayload(idToken);
   const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
-  return { accountId: nonEmpty(auth.chatgpt_account_id), email: nonEmpty(payload.email), plan: nonEmpty(auth.chatgpt_plan_type) };
+  const profile = isRecord(payload[PROFILE_CLAIM]) ? payload[PROFILE_CLAIM] : {};
+  return {
+    accountId: nonEmpty(auth.chatgpt_account_id),
+    email: nonEmpty(payload.email) ?? nonEmpty(profile.email),
+    plan: nonEmpty(auth.chatgpt_plan_type),
+  };
 }
 
 interface TokenResponse {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -10,10 +10,11 @@ import { parseEvent, SseParser, type SseEvent } from './frames.js';
 import type { Connection } from './model-config.js';
 import { listCache } from './model-lists.js';
 import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
-import { noteUsageHeaders } from './usage.js';
+import { codexUsageBody, noteUsageHeaders, type Reported } from './usage.js';
 
 const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
 const INVALID = [400, 404, 422];
+const USAGE_TIMEOUT_MS = 10_000;
 
 export interface CodexDeps {
   base?: string;
@@ -110,6 +111,24 @@ export async function codexMessages(
   answerWhole(res, frames + translator.close(), conn.id);
 }
 
+const jsonHeaders = (tokens: CodexTokens): Record<string, string> => ({ ...headersFor(tokens, randomUUID()), accept: 'application/json' });
+
+export const codexUsageUrl = (base = CODEX_BASE): string => `${base.replace(/\/codex\/?$/, '')}/wham/usage`;
+
+export async function codexUsageNow(conn: Connection, deps: CodexDeps, state: CodexState): Promise<Reported | null> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const res = await reach(
+    () => currentTokens(conn, deps, state),
+    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
+    (tokens) => fetchImpl(codexUsageUrl(deps.base), { headers: jsonHeaders(tokens), redirect: 'manual', signal: AbortSignal.timeout(USAGE_TIMEOUT_MS) }),
+  );
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not report its usage (${String(res.status)})`);
+  }
+  return codexUsageBody(await res.json());
+}
+
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
   const version = await learnCodexVersion();
   const base = deps.base ?? CODEX_BASE;
@@ -118,7 +137,7 @@ export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'sa
 
 async function listCodex(tokens: CodexTokens, version: string, base: string, fetchImpl: typeof fetch): Promise<string[]> {
   const res = await fetchImpl(`${base}/models?client_version=${version}`, {
-    headers: { ...headersFor(tokens, randomUUID()), accept: 'application/json' },
+    headers: jsonHeaders(tokens),
     redirect: 'manual',
   });
   if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not list models (${String(res.status)})`);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -22,7 +22,7 @@ import {
   withEffort,
   withThinkingFor,
 } from './effort.js';
-import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
+import { notReady, PASSTHROUGH_ID, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
 import { codexMessages, sharedCodexState } from './codex.js';
 import { geminiMessages, sharedGeminiState } from './gemini.js';
 import { countTokens } from './subscription.js';
@@ -87,7 +87,7 @@ function modelsBody(cfg: ModelConfig): Record<string, unknown> {
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
-const PASSTHROUGH: Connection = { id: 'passthrough', provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
+const PASSTHROUGH: Connection = { id: PASSTHROUGH_ID, provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
 
 const passthrough = (body: Record<string, unknown>): Route => ({ connection: PASSTHROUGH, model: requestedModel(body) });
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -7,9 +7,10 @@ import { openrouterModels, openrouterZdrModels } from './openrouter.js';
 import { anthropicModels, bedrockModels } from './provider-models.js';
 import { routeOf, syncAvailableModelsQuietly } from '../claude/setup.js';
 import { sessionRunning, stopSession } from '../claude/session.js';
-import { forgetOne } from './usage.js';
+import { forgetOne, forgetReported } from './usage.js';
 import {
   addConnection,
+  connectionOf,
   parseModelConfig,
   readModelConfig,
   removeConnection,
@@ -19,7 +20,8 @@ import {
   type ModelConfig,
 } from './model-config.js';
 import { asApiError, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES, refreshUsage } from './model-signin.js';
+import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES } from './model-signin.js';
+import { refreshUsage } from './usage-refresh.js';
 
 const PATH = '/api/model';
 const CONNECTIONS = '/api/model/connections';
@@ -73,7 +75,9 @@ async function create(req: IncomingMessage, deps: ModelApiDeps, store: Store): P
 }
 
 async function change(req: IncomingMessage, deps: ModelApiDeps, store: Store, id: string): Promise<unknown> {
+  const before = connectionOf(store.read(), id)?.apiKey;
   const next = await withBody(req, (body) => updateConnection(store.read(), id, body));
+  if (connectionOf(next, id)?.apiKey !== before) forgetReported(id);
   return kept(store, next, deps, 'model-api: connection changed', { connection: id });
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,7 +3,7 @@ import { newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
-import type { CodexTokens } from './codex-auth.js';
+import { claimsOf, type CodexTokens } from './codex-auth.js';
 import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
@@ -189,6 +189,14 @@ export function resolveRoute(requested: string, cfg: ModelConfig): Route | null
 export const routeLabel = (route: Route): string =>
   route.connection.provider === 'anthropic' ? route.model : `${route.connection.provider}:${route.model}`;
 
+export const PASSTHROUGH_ID = 'passthrough';
+
+function signedInAs(c: Connection): { account: string | null; plan: string | null } {
+  if (c.codex === null) return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
+  const claims = claimsOf(c.codex.idToken);
+  return { account: c.codex.email ?? claims.email, plan: c.codex.plan ?? claims.plan };
+}
+
 function publicConnection(c: Connection): Record<string, unknown> {
   return {
     id: c.id,
@@ -199,8 +207,7 @@ function publicConnection(c: Connection): Record<string, unknown> {
     region: c.region,
     zdr: c.zdr,
     signedIn: c.codex !== null || c.gemini !== null,
-    account: c.codex?.email ?? c.gemini?.email ?? null,
-    plan: c.codex?.plan ?? c.gemini?.tier ?? null,
+    ...signedInAs(c),
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -2,17 +2,15 @@ import type { IncomingMessage } from 'node:http';
 import { ApiError } from '@metro-labs/http/api-error';
 import { readJsonBody } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
+import { log } from '@metro-labs/core/log';
 import { beginLogin, finishLogin, readCodexCliAuth, type CodexTokens } from './codex-auth.js';
 import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
 import { codexModels, currentTokens, sharedCodexState } from './codex.js';
 import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
 import { onboard, parseGeminiProject } from './gemini-setup.js';
 import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
-import { openrouterCredits } from './openrouter.js';
-import { lastServed } from './served.js';
 import { listCache } from './model-lists.js';
-import { geminiUsage, noteUsage, openrouterUsage, usageOf } from './usage.js';
+import { forgetReported } from './usage.js';
 import {
   addConnection,
   connectionOf,
@@ -22,8 +20,7 @@ import {
   type ModelConfig,
   type Provider,
 } from './model-config.js';
-import { asApiError, askedConnection, BODY_MAX, connectionFor, CREDITS_TTL_MS, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-
+import { asApiError, askedConnection, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
 
 function connectionToFill(store: Store, req: IncomingMessage, provider: Provider): { cfg: ModelConfig; id: string } {
   const asked = askedConnection(req);
@@ -36,8 +33,9 @@ function connectionToFill(store: Store, req: IncomingMessage, provider: Provider
   return { cfg, id: cfg.connections.at(-1)?.id ?? '' };
 }
 
-const saved = (store: Store, cfg: ModelConfig, note: string, fields: Record<string, unknown>): unknown => {
+const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connection: string } & Record<string, unknown>): unknown => {
   store.write(cfg);
+  forgetReported(fields.connection);
   log.info(fields, note);
   return settingsBody(cfg);
 };
@@ -54,7 +52,7 @@ async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps,
   return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected by device code') };
 }
 
-const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
+export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
   issuer: deps.issuer,
   fetchImpl: deps.fetchImpl,
   base: deps.codexBase,
@@ -114,7 +112,7 @@ const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
   },
 });
 
-async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
+export async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
   if (conn.gemini === null) throw new ApiError('this connection is not signed in yet', 400);
   const tokens = await currentGeminiTokens(conn, geminiDeps(deps, store), sharedGeminiState);
   return listGeminiModels(tokens, geminiDeps(deps, store));
@@ -161,42 +159,3 @@ export const GEMINI_ROUTES: Record<string, Route> = {
 export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
   return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
 }
-
-async function refreshOne(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
-  if (conn.apiKey === '') return;
-  const seen = usageOf(conn.id);
-  if (seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
-  try {
-    const credits = await openrouterCredits(conn.apiKey, deps.openrouterBase, deps.fetchImpl);
-    noteUsage(conn.id, openrouterUsage(credits.total, credits.spent, new Date(now)));
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'model-api: could not read the OpenRouter credits');
-  }
-}
-
-const modelsInUse = (conn: Connection): Set<string> => {
-  const served = lastServed();
-  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
-};
-
-async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
-  if (conn.gemini === null) return;
-  const inUse = modelsInUse(conn);
-  const seen = usageOf(conn.id);
-  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
-  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
-  try {
-    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
-    const usage = geminiUsage(rows, new Date(now));
-    if (usage !== null) noteUsage(conn.id, usage);
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'model-api: could not read the Gemini quota');
-  }
-}
-
-export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
-  for (const conn of store.read().connections) {
-    if (conn.provider === 'openrouter') await refreshOne(conn, deps, now);
-    if (conn.provider === 'gemini') await refreshQuota(conn, deps, store, now);
-  }
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -24,6 +24,8 @@ export interface ModelApiDeps {
   bedrockControlBase?: string;
   setup?: SetupDeps;
   restartSession?: () => boolean;
+  claudeUsage?: () => Promise<unknown>;
+  usageWaitMs?: number;
 }
 
 export interface Store {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -2,9 +2,11 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { GatewayError } from './forward.js';
 import { listCache } from './model-lists.js';
 import { stringOf } from '@metro-labs/http/api-http';
+import type { KeySpend } from './usage.js';
 
 export const OPENROUTER_BASE = 'https://openrouter.ai/api';
 const MODELS_MAX = 2000;
+const KEY_TIMEOUT_MS = 10_000;
 
 export interface OpenRouterModel {
   id: string;
@@ -69,27 +71,23 @@ async function listModels(base: string, fetchImpl: typeof fetch): Promise<OpenRo
 export const openrouterModels = (base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> =>
   modelLists.get(base, () => listModels(base, fetchImpl));
 
-export interface OpenRouterCredits {
-  total: number;
-  spent: number;
-}
+const nullableAmount = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
 
-export async function openrouterCredits(
-  apiKey: string,
-  base = OPENROUTER_BASE,
-  fetchImpl: typeof fetch = fetch,
-): Promise<OpenRouterCredits> {
-  const res = await fetchImpl(`${base}/v1/credits`, {
+export async function openrouterKey(apiKey: string, base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<KeySpend> {
+  const res = await fetchImpl(`${base}/v1/key`, {
     headers: { accept: 'application/json', authorization: `Bearer ${apiKey}` },
     redirect: 'manual',
+    signal: AbortSignal.timeout(KEY_TIMEOUT_MS),
   });
-  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not report the credits (${String(res.status)})`);
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, 'api_error', `OpenRouter would not describe the stored key (${String(res.status)})`);
+  }
   const body: unknown = await res.json();
   const data = isRecord(body) && isRecord(body.data) ? body.data : {};
-  const total = Number(data.total_credits);
-  const spent = Number(data.total_usage);
-  if (!Number.isFinite(total) || !Number.isFinite(spent)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no credit figures');
-  return { total, spent };
+  const spent = nullableAmount(data.usage);
+  if (spent === null) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no spend for the key');
+  return { limit: nullableAmount(data.limit), remaining: nullableAmount(data.limit_remaining), spent };
 }
 
 async function listZdr(base: string, fetchImpl: typeof fetch): Promise<string[]> {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage-refresh.ts

@@ -0,0 +1,102 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { readClaudeUsage } from '../claude/usage-probe.js';
+import { codexUsageNow, sharedCodexState } from './codex.js';
+import { openrouterKey } from './openrouter.js';
+import { lastServed } from './served.js';
+import { claudeLoginUsage, geminiUsage, keepProbeAnswer, mayProbe, noteUsage, openrouterUsage, probeAnswer, usageOf, type Reported } from './usage.js';
+import { PASSTHROUGH_ID, routedConnection, type Connection, type ModelConfig } from './model-config.js';
+import { codexDepsFor, geminiModelsOf } from './model-signin.js';
+import { CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
+
+const WAIT_MS = 4_000;
+const LOGIN_PROBE = 'claude-login';
+
+const fresh = (id: string, now: number): boolean => {
+  const seen = usageOf(id);
+  return seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS;
+};
+
+const due = (id: string, now: number): boolean => !fresh(id, now) && mayProbe(id, now, CREDITS_TTL_MS);
+
+async function probe(what: string, run: () => Promise<void>): Promise<void> {
+  try {
+    await run();
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, `model-api: could not read the ${what}`);
+  }
+}
+
+async function refreshKey(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
+  if (conn.apiKey === '' || !due(conn.id, now)) return;
+  await probe('OpenRouter key spend', async () => {
+    noteUsage(conn.id, openrouterUsage(await openrouterKey(conn.apiKey, deps.openrouterBase, deps.fetchImpl), new Date(now)));
+  });
+}
+
+async function refreshCodex(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.codex === null || !due(conn.id, now)) return;
+  await probe('Codex usage', async () => {
+    const usage = await codexUsageNow(conn, codexDepsFor(deps, store, conn.id), sharedCodexState);
+    if (usage !== null) noteUsage(conn.id, usage);
+  });
+}
+
+const modelsInUse = (conn: Connection): Set<string> => {
+  const served = lastServed();
+  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
+};
+
+async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.gemini === null) return;
+  const inUse = modelsInUse(conn);
+  const seen = usageOf(conn.id);
+  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
+  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
+  await probe('Gemini quota', async () => {
+    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
+    const usage = geminiUsage(rows, new Date(now));
+    if (usage !== null) noteUsage(conn.id, usage);
+  });
+}
+
+const loginIds = (cfg: ModelConfig): string[] => [
+  ...(routedConnection(cfg) === null ? [PASSTHROUGH_ID] : []),
+  ...cfg.connections.filter((c) => c.provider === 'anthropic' && c.apiKey === '').map((c) => c.id),
+];
+
+const olderThan = (seen: Reported | undefined, usage: Reported): boolean => seen === undefined || Date.parse(seen.at) < Date.parse(usage.at);
+
+async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number): Promise<void> {
+  const stale = loginIds(cfg).filter((id) => !fresh(id, now));
+  if (stale.length === 0) return;
+  if (mayProbe(LOGIN_PROBE, now, CREDITS_TTL_MS))
+    await probe('usage of the Claude Code login', async () => {
+      const usage = claudeLoginUsage(await (deps.claudeUsage ?? readClaudeUsage)(), new Date(now));
+      if (usage !== null) keepProbeAnswer(LOGIN_PROBE, usage);
+    });
+  const usage = probeAnswer(LOGIN_PROBE);
+  if (usage === undefined || now - Date.parse(usage.at) >= CREDITS_TTL_MS) return;
+  for (const id of stale) if (olderThan(usageOf(id), usage)) noteUsage(id, usage);
+}
+
+function refreshOne(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.provider === 'openrouter') return refreshKey(conn, deps, now);
+  if (conn.provider === 'codex') return refreshCodex(conn, deps, store, now);
+  if (conn.provider === 'gemini') return refreshQuota(conn, deps, store, now);
+  return Promise.resolve();
+}
+
+async function within(ms: number, work: Promise<unknown>): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const waited = new Promise<void>((resolve) => {
+    timer = setTimeout(resolve, ms);
+  });
+  await Promise.race([work, waited]);
+  clearTimeout(timer);
+}
+
+export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
+  const cfg = store.read();
+  const work = Promise.all([...cfg.connections.map((conn) => refreshOne(conn, deps, store, now)), refreshLogin(cfg, deps, now)]);
+  await within(deps.usageWaitMs ?? WAIT_MS, work);
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -1,3 +1,6 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
+
 type Key = string;
 
 interface UsageWindow {
@@ -22,10 +25,12 @@ export interface ProviderUsage {
   tally: Tally | null;
 }
 
-type Reported = Omit<ProviderUsage, 'tally'>;
+export type Reported = Omit<ProviderUsage, 'tally'>;
 
 const latest = new Map<Key, Reported>();
 const tallies = new Map<Key, Tally>();
+const probed = new Map<Key, number>();
+const answers = new Map<Key, Reported>();
 
 export const noteUsage = (key: Key, usage: Reported): void => {
   latest.set(key, usage);
@@ -46,11 +51,31 @@ export const usageOf = (key: Key): Reported | undefined => latest.get(key);
 export const forgetOne = (key: Key): void => {
   latest.delete(key);
   tallies.delete(key);
+  probed.delete(key);
+};
+
+export const forgetReported = (key: Key): void => {
+  latest.delete(key);
+  probed.delete(key);
 };
 
 export const forgetUsage = (): void => {
   latest.clear();
   tallies.clear();
+  probed.clear();
+  answers.clear();
+};
+
+export function mayProbe(key: Key, now: number, every: number): boolean {
+  if (now - (probed.get(key) ?? Number.NEGATIVE_INFINITY) < every) return false;
+  probed.set(key, now);
+  return true;
+}
+
+export const probeAnswer = (key: Key): Reported | undefined => answers.get(key);
+
+export const keepProbeAnswer = (key: Key, usage: Reported): void => {
+  answers.set(key, usage);
 };
 
 export interface Counted {
@@ -198,13 +223,16 @@ function codexWindow(headers: Headers, kind: 'primary' | 'secondary', now: Date)
   return { label: windowLabel(Number.isFinite(minutes) ? minutes : null), used, resetAt, detail: null };
 }
 
-function codexCredits(headers: Headers): UsageWindow | null {
-  if (headers.get('x-codex-credits-has-credits') !== 'true') return null;
-  const balance = Number(headers.get('x-codex-credits-balance') ?? 'none');
+function creditsLeft(hasCredits: boolean, raw: string | null): UsageWindow | null {
+  if (!hasCredits) return null;
+  const balance = Number(raw ?? 'none');
   if (!Number.isFinite(balance)) return null;
   return { label: 'Credits', used: null, resetAt: null, detail: `${balance.toLocaleString('en-US')} left` };
 }
 
+const codexCredits = (headers: Headers): UsageWindow | null =>
+  creditsLeft(headers.get('x-codex-credits-has-credits') === 'true', headers.get('x-codex-credits-balance'));
+
 export function codexUsage(headers: Headers, now = new Date()): Reported | null {
   const windows = [codexWindow(headers, 'primary', now), codexWindow(headers, 'secondary', now), codexCredits(headers)].filter(
     (w): w is UsageWindow => w !== null,
@@ -214,6 +242,77 @@ export function codexUsage(headers: Headers, now = new Date()): Reported | null
   return { windows, note: reached === null || reached === '' ? null : reached.replaceAll('_', ' '), at: now.toISOString() };
 }
 
+const present = (w: UsageWindow | null): w is UsageWindow => w !== null;
+
+const textOf = (raw: unknown): string | null => (typeof raw === 'number' || typeof raw === 'string' ? String(raw) : null);
+
+const numberOf = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
+
+const SECONDS_PER_MINUTE = 60;
+
+function codexBodyWindow(raw: unknown, now: Date): UsageWindow | null {
+  if (!isRecord(raw)) return null;
+  const percent = numberOf(raw.used_percent);
+  if (percent === null) return null;
+  const seconds = numberOf(raw.limit_window_seconds);
+  const minutes = seconds === null || seconds <= 0 ? null : Math.ceil(seconds / SECONDS_PER_MINUTE);
+  const resetAt = whenFrom(textOf(raw.reset_at), now) ?? whenFrom(textOf(raw.reset_after_seconds), now, true);
+  return { label: windowLabel(minutes), used: clamp(percent / 100), resetAt, detail: null };
+}
+
+function codexWall(limit: Record<string, unknown>, reached: unknown): string | null {
+  if (limit.limit_reached !== true && limit.allowed !== false) return null;
+  const kind = isRecord(reached) ? stringOf(reached.type) : '';
+  return kind === '' ? 'limit reached' : kind.replaceAll('_', ' ');
+}
+
+export function codexUsageBody(body: unknown, now = new Date()): Reported | null {
+  if (!isRecord(body)) return null;
+  const limit = isRecord(body.rate_limit) ? body.rate_limit : {};
+  const credits = isRecord(body.credits) ? body.credits : {};
+  const windows = [
+    codexBodyWindow(limit.primary_window, now),
+    codexBodyWindow(limit.secondary_window, now),
+    creditsLeft(credits.has_credits === true, textOf(credits.balance)),
+  ].filter(present);
+  return windows.length === 0 ? null : { windows, note: codexWall(limit, body.rate_limit_reached_type), at: now.toISOString() };
+}
+
+const CLAUDE_WINDOWS: [string, string][] = [
+  ['five_hour', '5-hour window'],
+  ['seven_day', 'Weekly'],
+  ['seven_day_sonnet', 'Weekly, Sonnet'],
+  ['seven_day_opus', 'Weekly, Opus'],
+];
+
+function percentWindow(label: string, raw: unknown, now: Date): UsageWindow | null {
+  if (!isRecord(raw)) return null;
+  const percent = numberOf(raw.utilization) ?? numberOf(raw.percent);
+  if (percent === null) return null;
+  return { label, used: clamp(percent / 100), resetAt: whenFrom(textOf(raw.resets_at), now), detail: null };
+}
+
+function scopedName(entry: Record<string, unknown>): string {
+  if (stringOf(entry.display_name) !== '') return stringOf(entry.display_name);
+  if (entry.kind !== 'weekly_scoped' || !isRecord(entry.scope) || !isRecord(entry.scope.model)) return '';
+  return stringOf(entry.scope.model.display_name);
+}
+
+function scopedWindows(limits: Record<string, unknown>, now: Date): (UsageWindow | null)[] {
+  const listed = [limits.model_scoped, limits.limits].flatMap((list): unknown[] => (Array.isArray(list) ? (list as unknown[]) : []));
+  return listed.map((entry) => {
+    const name = isRecord(entry) ? scopedName(entry) : '';
+    return name === '' ? null : percentWindow(`Weekly, ${name}`, entry, now);
+  });
+}
+
+export function claudeLoginUsage(limits: unknown, now = new Date()): Reported | null {
+  if (!isRecord(limits)) return null;
+  const all = [...CLAUDE_WINDOWS.map(([key, label]) => percentWindow(label, limits[key], now)), ...scopedWindows(limits, now)].filter(present);
+  const windows = all.filter((w, index) => all.findIndex((other) => other.label === w.label) === index);
+  return windows.length === 0 ? null : { windows, note: null, at: now.toISOString() };
+}
+
 export function noteUsageHeaders(kind: 'anthropic' | 'codex', key: Key, headers: Headers, now = new Date()): void {
   const usage = kind === 'anthropic' ? anthropicUsage(headers, now) : codexUsage(headers, now);
   if (usage !== null) noteUsage(key, usage);
@@ -234,11 +333,16 @@ export function geminiUsage(rows: QuotaRow[], now = new Date()): Reported | null
   return windows.length === 0 ? null : { windows, note: null, at: now.toISOString() };
 }
 
-export function openrouterUsage(total: number, spent: number, now = new Date()): Reported {
-  const used = total > 0 ? clamp(spent / total) : null;
-  return {
-    windows: [{ label: 'Credits', used, resetAt: null, detail: `${dollars(spent)} of ${dollars(total)} used` }],
-    note: null,
-    at: now.toISOString(),
-  };
+export interface KeySpend {
+  limit: number | null;
+  remaining: number | null;
+  spent: number;
+}
+
+function keyWindow(key: KeySpend): UsageWindow {
+  if (key.limit === null || key.limit <= 0) return { label: 'Credits', used: null, resetAt: null, detail: `${dollars(key.spent)} used, no limit on this key` };
+  const spent = key.remaining === null ? key.spent : Math.max(0, key.limit - key.remaining);
+  return { label: 'Credits', used: clamp(spent / key.limit), resetAt: null, detail: `${dollars(spent)} of ${dollars(key.limit)} used` };
 }
+
+export const openrouterUsage = (key: KeySpend, now = new Date()): Reported => ({ windows: [keyWindow(key)], note: null, at: now.toISOString() });

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.221"
+  "version": "0.1.0-beta.222"
 }