@stage-labs/metro 0.1.0-beta.221 → 0.1.0-beta.223

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stage-labs/metro",
-  "version": "0.1.0-beta.221",
+  "version": "0.1.0-beta.223",
   "description": "The metro command line: run your agent on this machine, relaying its chat channels and connectors to Claude Code.",
   "license": "MIT",
   "repository": {

package/runtime/marketplace/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "metro",
-  "version": "0.1.0-beta.221",
+  "version": "0.1.0-beta.223",
   "description": "Metro for Claude Code, installed by the metro daemon on this machine: every connector the agent holds as its own MCP server relayed through the daemon, the orchestrator-only guard on the main thread, and the standing rules loaded at each session start. No vendor credential ever sits in a config file.",
   "author": {
     "name": "Bonustrack",

package/runtime/node_modules/@metro-labs/daemon/src/boot/boot.ts

@@ -50,6 +50,7 @@ import { materializeFrom, reloadFrom } from '../stations/materialize.js';
 import type { StationName } from '@metro-labs/core/station-names';
 import { startUploadReaper } from '../files/upload-store.js';
 import { startAttachReaper } from '../files/attach-reaper.js';
+import { startResourceSampler } from '../server/resources.js';
 
 installCrashGuard();
 acquireLock(join(STATE_DIR, '.tail-lock'));
@@ -142,6 +143,7 @@ installBearerSessions(agentsDir(), localOwner);
   syncPluginServers(readLocalConnectors());
   startUploadReaper();
   startAttachReaper();
+  startResourceSampler();
   announceLocalEndpoint();
   tunnel?.start();
   log.info(

package/runtime/node_modules/@metro-labs/daemon/src/claude/usage-probe.ts

@@ -0,0 +1,127 @@
+import { spawn } from 'node:child_process';
+import { isRecord } from '@metro-labs/core/is-record';
+import { errMsg, log } from '@metro-labs/core/log';
+import { agentCommand, agentUser, agentUserExpected, claudeBin } from '../agent-user/user.js';
+import { runningAsRoot } from '../metro-user/privilege.js';
+import { PRIVACY_ENV } from './setup.js';
+
+const REQUEST_ID = 'metro-usage';
+const REQUEST = `${JSON.stringify({ type: 'control_request', request_id: REQUEST_ID, request: { subtype: 'get_usage', skip_behaviors: true } })}\n`;
+const ARGS = [
+  '-p',
+  '--setting-sources',
+  'project',
+  '--strict-mcp-config',
+  '--mcp-config',
+  '{"mcpServers":{}}',
+  '--no-session-persistence',
+  '--input-format',
+  'stream-json',
+  '--output-format',
+  'stream-json',
+  '--verbose',
+];
+const BLOCKS_USAGE = 'CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC';
+const PROBE_ENV: Record<string, string> = {
+  ...Object.fromEntries(Object.entries(PRIVACY_ENV).filter(([name]) => name !== BLOCKS_USAGE)),
+  DISABLE_AUTOUPDATER: '1',
+  DISABLE_BUG_COMMAND: '1',
+  ENABLE_CLAUDEAI_MCP_SERVERS: 'false',
+};
+const TIMEOUT_MS = 20_000;
+const KILL_GRACE_MS = 2_000;
+const LINE_MAX = 1024 * 1024;
+
+export interface UsageProbeDeps {
+  command?: string[];
+  timeoutMs?: number;
+}
+
+export function usageProbeCommand(): string[] | null {
+  if (runningAsRoot() || (agentUserExpected() && agentUser() === null)) return null;
+  return agentCommand([claudeBin(), ...ARGS], PROBE_ENV);
+}
+
+function answerOf(line: string): Record<string, unknown> | null {
+  try {
+    const parsed: unknown = JSON.parse(line);
+    if (!isRecord(parsed) || parsed.type !== 'control_response' || !isRecord(parsed.response)) return null;
+    return parsed.response.request_id === REQUEST_ID ? parsed.response : null;
+  } catch {
+    return null;
+  }
+}
+
+function limitsOf(answer: Record<string, unknown>): unknown {
+  if (answer.subtype !== 'success') throw new Error(`Claude Code refused the usage request: ${typeof answer.error === 'string' ? answer.error : 'no reason given'}`);
+  return isRecord(answer.response) ? (answer.response.rate_limits ?? null) : null;
+}
+
+export function usageIn(output: string): unknown {
+  const answer = output
+    .split('\n')
+    .map(answerOf)
+    .find((found) => found !== null);
+  if (answer === undefined || answer === null) throw new Error('Claude Code gave no usage answer');
+  return limitsOf(answer);
+}
+
+export function readClaudeUsage(deps: UsageProbeDeps = {}): Promise<unknown> {
+  const command = deps.command ?? usageProbeCommand();
+  if (command === null) return Promise.reject(new Error('Claude Code runs only as the agent user, and this box has none'));
+  const [file = '', ...args] = command;
+  return new Promise((resolve, reject) => {
+    const child = spawn(file, args, { cwd: '/', stdio: ['pipe', 'pipe', 'ignore'], env: { ...process.env, ...PROBE_ENV } });
+    let carry = '';
+    let settled = false;
+    let hardKill: ReturnType<typeof setTimeout> | undefined;
+    const settle = (run: () => void): void => {
+      if (settled) return;
+      settled = true;
+      run();
+    };
+    const overdue = setTimeout(() => {
+      settle(() => {
+        reject(new Error('Claude Code did not report the usage in time'));
+      });
+      child.stdout.destroy();
+      child.kill('SIGTERM');
+      hardKill = setTimeout(() => child.kill('SIGKILL'), KILL_GRACE_MS);
+    }, deps.timeoutMs ?? TIMEOUT_MS);
+    const take = (line: string): void => {
+      const answer = answerOf(line);
+      if (answer === null) return;
+      settle(() => {
+        try {
+          resolve(limitsOf(answer));
+        } catch (err) {
+          reject(err instanceof Error ? err : new Error(errMsg(err)));
+        }
+      });
+    };
+    child.stdout.on('data', (chunk: Buffer) => {
+      const lines = (carry + chunk.toString('utf8')).split('\n');
+      carry = lines.pop() ?? '';
+      if (carry.length > LINE_MAX) carry = '';
+      lines.forEach(take);
+    });
+    child.stdin.on('error', (err) => {
+      log.debug({ err: errMsg(err) }, 'claude-usage: Claude Code closed its input early');
+    });
+    child.on('error', (err) => {
+      clearTimeout(overdue);
+      settle(() => {
+        reject(err);
+      });
+    });
+    child.on('close', () => {
+      clearTimeout(overdue);
+      clearTimeout(hardKill);
+      take(carry);
+      settle(() => {
+        reject(new Error('Claude Code gave no usage answer'));
+      });
+    });
+    child.stdin.end(REQUEST);
+  });
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex-auth.ts

@@ -10,6 +10,7 @@ export const CODEX_ISSUER = 'https://auth.openai.com';
 export const CODEX_REDIRECT = 'http://localhost:1455/auth/callback';
 const SCOPE = 'openid profile email offline_access api.connectors.read api.connectors.invoke';
 const AUTH_CLAIM = 'https://api.openai.com/auth';
+const PROFILE_CLAIM = 'https://api.openai.com/profile';
 const ACCESS_TOKEN_TTL_MS = 55 * 60_000;
 
 export interface CodexTokens {
@@ -76,7 +77,12 @@ function decodeJwtPayload(jwt: string): Record<string, unknown> {
 export function claimsOf(idToken: string): { accountId: string | null; email: string | null; plan: string | null } {
   const payload = decodeJwtPayload(idToken);
   const auth = isRecord(payload[AUTH_CLAIM]) ? payload[AUTH_CLAIM] : {};
-  return { accountId: nonEmpty(auth.chatgpt_account_id), email: nonEmpty(payload.email), plan: nonEmpty(auth.chatgpt_plan_type) };
+  const profile = isRecord(payload[PROFILE_CLAIM]) ? payload[PROFILE_CLAIM] : {};
+  return {
+    accountId: nonEmpty(auth.chatgpt_account_id),
+    email: nonEmpty(payload.email) ?? nonEmpty(profile.email),
+    plan: nonEmpty(auth.chatgpt_plan_type),
+  };
 }
 
 interface TokenResponse {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/codex.ts

@@ -10,10 +10,11 @@ import { parseEvent, SseParser, type SseEvent } from './frames.js';
 import type { Connection } from './model-config.js';
 import { listCache } from './model-lists.js';
 import { answerWhole, currentOf, errorKind, reach, refreshed, relayTranslated, sessionHeader, type TokenSource, type TokenState } from './subscription.js';
-import { noteUsageHeaders } from './usage.js';
+import { codexUsageBody, noteUsageHeaders, type Reported } from './usage.js';
 
 const CODEX_BASE = 'https://chatgpt.com/backend-api/codex';
 const INVALID = [400, 404, 422];
+const USAGE_TIMEOUT_MS = 10_000;
 
 export interface CodexDeps {
   base?: string;
@@ -110,6 +111,24 @@ export async function codexMessages(
   answerWhole(res, frames + translator.close(), conn.id);
 }
 
+const jsonHeaders = (tokens: CodexTokens): Record<string, string> => ({ ...headersFor(tokens, randomUUID()), accept: 'application/json' });
+
+export const codexUsageUrl = (base = CODEX_BASE): string => `${base.replace(/\/codex\/?$/, '')}/wham/usage`;
+
+export async function codexUsageNow(conn: Connection, deps: CodexDeps, state: CodexState): Promise<Reported | null> {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const res = await reach(
+    () => currentTokens(conn, deps, state),
+    (tokens) => refreshed(state, conn.id, tokens, sourceOf(deps)),
+    (tokens) => fetchImpl(codexUsageUrl(deps.base), { headers: jsonHeaders(tokens), redirect: 'manual', signal: AbortSignal.timeout(USAGE_TIMEOUT_MS) }),
+  );
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not report its usage (${String(res.status)})`);
+  }
+  return codexUsageBody(await res.json());
+}
+
 export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'save'>): Promise<string[]> {
   const version = await learnCodexVersion();
   const base = deps.base ?? CODEX_BASE;
@@ -118,7 +137,7 @@ export async function codexModels(tokens: CodexTokens, deps: Omit<CodexDeps, 'sa
 
 async function listCodex(tokens: CodexTokens, version: string, base: string, fetchImpl: typeof fetch): Promise<string[]> {
   const res = await fetchImpl(`${base}/models?client_version=${version}`, {
-    headers: { ...headersFor(tokens, randomUUID()), accept: 'application/json' },
+    headers: jsonHeaders(tokens),
     redirect: 'manual',
   });
   if (!res.ok) throw new GatewayError(res.status, errorKind(res.status, INVALID), `Codex would not list models (${String(res.status)})`);

package/runtime/node_modules/@metro-labs/daemon/src/gateway/gateway.ts

@@ -22,7 +22,7 @@ import {
   withEffort,
   withThinkingFor,
 } from './effort.js';
-import { notReady, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
+import { notReady, PASSTHROUGH_ID, readModelConfig, resolveRoute, routeLabel, setCodexAuth, setGeminiAuth, writeModelConfig, type Connection, type ModelConfig, type Route } from './model-config.js';
 import { codexMessages, sharedCodexState } from './codex.js';
 import { geminiMessages, sharedGeminiState } from './gemini.js';
 import { countTokens } from './subscription.js';
@@ -87,7 +87,7 @@ function modelsBody(cfg: ModelConfig): Record<string, unknown> {
   return { data, has_more: false, first_id: data[0]?.id ?? null, last_id: data.at(-1)?.id ?? null };
 }
 
-const PASSTHROUGH: Connection = { id: 'passthrough', provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
+const PASSTHROUGH: Connection = { id: PASSTHROUGH_ID, provider: 'anthropic', label: 'Claude Code login', model: '', apiKey: '', region: '', zdr: false, codex: null, gemini: null };
 
 const passthrough = (body: Record<string, unknown>): Route => ({ connection: PASSTHROUGH, model: requestedModel(body) });
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-api.ts

@@ -7,9 +7,10 @@ import { openrouterModels, openrouterZdrModels } from './openrouter.js';
 import { anthropicModels, bedrockModels } from './provider-models.js';
 import { routeOf, syncAvailableModelsQuietly } from '../claude/setup.js';
 import { sessionRunning, stopSession } from '../claude/session.js';
-import { forgetOne } from './usage.js';
+import { forgetOne, forgetReported } from './usage.js';
 import {
   addConnection,
+  connectionOf,
   parseModelConfig,
   readModelConfig,
   removeConnection,
@@ -19,7 +20,8 @@ import {
   type ModelConfig,
 } from './model-config.js';
 import { asApiError, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES, refreshUsage } from './model-signin.js';
+import { CODEX_ROUTES, codexDeviceRoute, GEMINI_ROUTES } from './model-signin.js';
+import { refreshUsage } from './usage-refresh.js';
 
 const PATH = '/api/model';
 const CONNECTIONS = '/api/model/connections';
@@ -73,7 +75,9 @@ async function create(req: IncomingMessage, deps: ModelApiDeps, store: Store): P
 }
 
 async function change(req: IncomingMessage, deps: ModelApiDeps, store: Store, id: string): Promise<unknown> {
+  const before = connectionOf(store.read(), id)?.apiKey;
   const next = await withBody(req, (body) => updateConnection(store.read(), id, body));
+  if (connectionOf(next, id)?.apiKey !== before) forgetReported(id);
   return kept(store, next, deps, 'model-api: connection changed', { connection: id });
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-config.ts

@@ -3,7 +3,7 @@ import { newId } from '@metro-labs/core/ids';
 import { readJson, writeSecure } from '@metro-labs/core/secure-fs';
 import { agentsDir } from '../agents/files.js';
 import { isRecord } from '@metro-labs/core/is-record';
-import type { CodexTokens } from './codex-auth.js';
+import { claimsOf, type CodexTokens } from './codex-auth.js';
 import { tokensFromDisk as geminiTokensFromDisk, type GeminiTokens } from './gemini-auth.js';
 
 export const PROVIDERS = ['anthropic', 'bedrock', 'openrouter', 'codex', 'gemini'] as const;
@@ -189,6 +189,14 @@ export function resolveRoute(requested: string, cfg: ModelConfig): Route | null
 export const routeLabel = (route: Route): string =>
   route.connection.provider === 'anthropic' ? route.model : `${route.connection.provider}:${route.model}`;
 
+export const PASSTHROUGH_ID = 'passthrough';
+
+function signedInAs(c: Connection): { account: string | null; plan: string | null } {
+  if (c.codex === null) return { account: c.gemini?.email ?? null, plan: c.gemini?.tier ?? null };
+  const claims = claimsOf(c.codex.idToken);
+  return { account: c.codex.email ?? claims.email, plan: c.codex.plan ?? claims.plan };
+}
+
 function publicConnection(c: Connection): Record<string, unknown> {
   return {
     id: c.id,
@@ -199,8 +207,7 @@ function publicConnection(c: Connection): Record<string, unknown> {
     region: c.region,
     zdr: c.zdr,
     signedIn: c.codex !== null || c.gemini !== null,
-    account: c.codex?.email ?? c.gemini?.email ?? null,
-    plan: c.codex?.plan ?? c.gemini?.tier ?? null,
+    ...signedInAs(c),
   };
 }
 

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-signin.ts

@@ -2,17 +2,15 @@ import type { IncomingMessage } from 'node:http';
 import { ApiError } from '@metro-labs/http/api-error';
 import { readJsonBody } from '@metro-labs/http/api-http';
 import { isRecord } from '@metro-labs/core/is-record';
-import { errMsg, log } from '@metro-labs/core/log';
+import { log } from '@metro-labs/core/log';
 import { beginLogin, finishLogin, readCodexCliAuth, type CodexTokens } from './codex-auth.js';
 import { beginDeviceLogin, pollDeviceLogin } from './codex-device.js';
 import { codexModels, currentTokens, sharedCodexState } from './codex.js';
 import { beginLogin as beginGeminiLogin, exchangeCode as exchangeGeminiCode, userEmail, type GeminiTokens } from './gemini-auth.js';
 import { onboard, parseGeminiProject } from './gemini-setup.js';
 import { currentGeminiTokens, listGeminiModels, sharedGeminiState, type GeminiDeps } from './gemini.js';
-import { openrouterCredits } from './openrouter.js';
-import { lastServed } from './served.js';
 import { listCache } from './model-lists.js';
-import { geminiUsage, noteUsage, openrouterUsage, usageOf } from './usage.js';
+import { forgetReported } from './usage.js';
 import {
   addConnection,
   connectionOf,
@@ -22,8 +20,7 @@ import {
   type ModelConfig,
   type Provider,
 } from './model-config.js';
-import { asApiError, askedConnection, BODY_MAX, connectionFor, CREDITS_TTL_MS, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
-
+import { asApiError, askedConnection, BODY_MAX, connectionFor, settingsBody, type ModelApiDeps, type Route, type Store } from './model-store.js';
 
 function connectionToFill(store: Store, req: IncomingMessage, provider: Provider): { cfg: ModelConfig; id: string } {
   const asked = askedConnection(req);
@@ -36,8 +33,9 @@ function connectionToFill(store: Store, req: IncomingMessage, provider: Provider
   return { cfg, id: cfg.connections.at(-1)?.id ?? '' };
 }
 
-const saved = (store: Store, cfg: ModelConfig, note: string, fields: Record<string, unknown>): unknown => {
+const saved = (store: Store, cfg: ModelConfig, note: string, fields: { connection: string } & Record<string, unknown>): unknown => {
   store.write(cfg);
+  forgetReported(fields.connection);
   log.info(fields, note);
   return settingsBody(cfg);
 };
@@ -54,7 +52,7 @@ async function pollDevice(id: string, req: IncomingMessage, deps: ModelApiDeps,
   return { status: 'done', settings: keepCodex(store, req, result.tokens, 'model-api: Codex connected by device code') };
 }
 
-const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
+export const codexDepsFor = (deps: ModelApiDeps, store: Store, id: string): { issuer?: string; fetchImpl?: typeof fetch; base?: string; save: (connId: string, t: CodexTokens) => void } => ({
   issuer: deps.issuer,
   fetchImpl: deps.fetchImpl,
   base: deps.codexBase,
@@ -114,7 +112,7 @@ const geminiDeps = (deps: ModelApiDeps, store: Store): GeminiDeps => ({
   },
 });
 
-async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
+export async function geminiModelsOf(conn: Connection, deps: ModelApiDeps, store: Store): Promise<Awaited<ReturnType<typeof listGeminiModels>>> {
   if (conn.gemini === null) throw new ApiError('this connection is not signed in yet', 400);
   const tokens = await currentGeminiTokens(conn, geminiDeps(deps, store), sharedGeminiState);
   return listGeminiModels(tokens, geminiDeps(deps, store));
@@ -161,42 +159,3 @@ export const GEMINI_ROUTES: Record<string, Route> = {
 export function codexDeviceRoute(id: string, method: string | undefined): Route | number {
   return method === 'GET' ? { method: 'GET', run: (req, deps, store) => pollDevice(id, req, deps, store) } : 405;
 }
-
-async function refreshOne(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
-  if (conn.apiKey === '') return;
-  const seen = usageOf(conn.id);
-  if (seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
-  try {
-    const credits = await openrouterCredits(conn.apiKey, deps.openrouterBase, deps.fetchImpl);
-    noteUsage(conn.id, openrouterUsage(credits.total, credits.spent, new Date(now)));
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'model-api: could not read the OpenRouter credits');
-  }
-}
-
-const modelsInUse = (conn: Connection): Set<string> => {
-  const served = lastServed();
-  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
-};
-
-async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
-  if (conn.gemini === null) return;
-  const inUse = modelsInUse(conn);
-  const seen = usageOf(conn.id);
-  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
-  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
-  try {
-    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
-    const usage = geminiUsage(rows, new Date(now));
-    if (usage !== null) noteUsage(conn.id, usage);
-  } catch (err) {
-    log.warn({ err: errMsg(err) }, 'model-api: could not read the Gemini quota');
-  }
-}
-
-export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
-  for (const conn of store.read().connections) {
-    if (conn.provider === 'openrouter') await refreshOne(conn, deps, now);
-    if (conn.provider === 'gemini') await refreshQuota(conn, deps, store, now);
-  }
-}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/model-store.ts

@@ -24,6 +24,8 @@ export interface ModelApiDeps {
   bedrockControlBase?: string;
   setup?: SetupDeps;
   restartSession?: () => boolean;
+  claudeUsage?: () => Promise<unknown>;
+  usageWaitMs?: number;
 }
 
 export interface Store {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/openrouter.ts

@@ -2,9 +2,11 @@ import { isRecord } from '@metro-labs/core/is-record';
 import { GatewayError } from './forward.js';
 import { listCache } from './model-lists.js';
 import { stringOf } from '@metro-labs/http/api-http';
+import type { KeySpend } from './usage.js';
 
 export const OPENROUTER_BASE = 'https://openrouter.ai/api';
 const MODELS_MAX = 2000;
+const KEY_TIMEOUT_MS = 10_000;
 
 export interface OpenRouterModel {
   id: string;
@@ -69,27 +71,23 @@ async function listModels(base: string, fetchImpl: typeof fetch): Promise<OpenRo
 export const openrouterModels = (base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<OpenRouterModel[]> =>
   modelLists.get(base, () => listModels(base, fetchImpl));
 
-export interface OpenRouterCredits {
-  total: number;
-  spent: number;
-}
+const nullableAmount = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
 
-export async function openrouterCredits(
-  apiKey: string,
-  base = OPENROUTER_BASE,
-  fetchImpl: typeof fetch = fetch,
-): Promise<OpenRouterCredits> {
-  const res = await fetchImpl(`${base}/v1/credits`, {
+export async function openrouterKey(apiKey: string, base = OPENROUTER_BASE, fetchImpl: typeof fetch = fetch): Promise<KeySpend> {
+  const res = await fetchImpl(`${base}/v1/key`, {
     headers: { accept: 'application/json', authorization: `Bearer ${apiKey}` },
     redirect: 'manual',
+    signal: AbortSignal.timeout(KEY_TIMEOUT_MS),
   });
-  if (!res.ok) throw new GatewayError(res.status, 'api_error', `OpenRouter would not report the credits (${String(res.status)})`);
+  if (!res.ok) {
+    await res.body?.cancel();
+    throw new GatewayError(res.status, 'api_error', `OpenRouter would not describe the stored key (${String(res.status)})`);
+  }
   const body: unknown = await res.json();
   const data = isRecord(body) && isRecord(body.data) ? body.data : {};
-  const total = Number(data.total_credits);
-  const spent = Number(data.total_usage);
-  if (!Number.isFinite(total) || !Number.isFinite(spent)) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no credit figures');
-  return { total, spent };
+  const spent = nullableAmount(data.usage);
+  if (spent === null) throw new GatewayError(502, 'api_error', 'OpenRouter answered with no spend for the key');
+  return { limit: nullableAmount(data.limit), remaining: nullableAmount(data.limit_remaining), spent };
 }
 
 async function listZdr(base: string, fetchImpl: typeof fetch): Promise<string[]> {

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage-refresh.ts

@@ -0,0 +1,102 @@
+import { errMsg, log } from '@metro-labs/core/log';
+import { readClaudeUsage } from '../claude/usage-probe.js';
+import { codexUsageNow, sharedCodexState } from './codex.js';
+import { openrouterKey } from './openrouter.js';
+import { lastServed } from './served.js';
+import { claudeLoginUsage, geminiUsage, keepProbeAnswer, mayProbe, noteUsage, openrouterUsage, probeAnswer, usageOf, type Reported } from './usage.js';
+import { PASSTHROUGH_ID, routedConnection, type Connection, type ModelConfig } from './model-config.js';
+import { codexDepsFor, geminiModelsOf } from './model-signin.js';
+import { CREDITS_TTL_MS, type ModelApiDeps, type Store } from './model-store.js';
+
+const WAIT_MS = 4_000;
+const LOGIN_PROBE = 'claude-login';
+
+const fresh = (id: string, now: number): boolean => {
+  const seen = usageOf(id);
+  return seen !== undefined && now - Date.parse(seen.at) < CREDITS_TTL_MS;
+};
+
+const due = (id: string, now: number): boolean => !fresh(id, now) && mayProbe(id, now, CREDITS_TTL_MS);
+
+async function probe(what: string, run: () => Promise<void>): Promise<void> {
+  try {
+    await run();
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, `model-api: could not read the ${what}`);
+  }
+}
+
+async function refreshKey(conn: Connection, deps: ModelApiDeps, now: number): Promise<void> {
+  if (conn.apiKey === '' || !due(conn.id, now)) return;
+  await probe('OpenRouter key spend', async () => {
+    noteUsage(conn.id, openrouterUsage(await openrouterKey(conn.apiKey, deps.openrouterBase, deps.fetchImpl), new Date(now)));
+  });
+}
+
+async function refreshCodex(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.codex === null || !due(conn.id, now)) return;
+  await probe('Codex usage', async () => {
+    const usage = await codexUsageNow(conn, codexDepsFor(deps, store, conn.id), sharedCodexState);
+    if (usage !== null) noteUsage(conn.id, usage);
+  });
+}
+
+const modelsInUse = (conn: Connection): Set<string> => {
+  const served = lastServed();
+  return new Set([conn.model, served?.connection === conn.id ? served.model : ''].filter((m) => m !== ''));
+};
+
+async function refreshQuota(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.gemini === null) return;
+  const inUse = modelsInUse(conn);
+  const seen = usageOf(conn.id);
+  const covers = seen !== undefined && [...inUse].every((id) => seen.windows.some((w) => w.label === id));
+  if (seen !== undefined && covers && now - Date.parse(seen.at) < CREDITS_TTL_MS) return;
+  await probe('Gemini quota', async () => {
+    const rows = (await geminiModelsOf(conn, deps, store)).filter((m) => inUse.has(m.id));
+    const usage = geminiUsage(rows, new Date(now));
+    if (usage !== null) noteUsage(conn.id, usage);
+  });
+}
+
+const loginIds = (cfg: ModelConfig): string[] => [
+  ...(routedConnection(cfg) === null ? [PASSTHROUGH_ID] : []),
+  ...cfg.connections.filter((c) => c.provider === 'anthropic' && c.apiKey === '').map((c) => c.id),
+];
+
+const olderThan = (seen: Reported | undefined, usage: Reported): boolean => seen === undefined || Date.parse(seen.at) < Date.parse(usage.at);
+
+async function refreshLogin(cfg: ModelConfig, deps: ModelApiDeps, now: number): Promise<void> {
+  const stale = loginIds(cfg).filter((id) => !fresh(id, now));
+  if (stale.length === 0) return;
+  if (mayProbe(LOGIN_PROBE, now, CREDITS_TTL_MS))
+    await probe('usage of the Claude Code login', async () => {
+      const usage = claudeLoginUsage(await (deps.claudeUsage ?? readClaudeUsage)(), new Date(now));
+      if (usage !== null) keepProbeAnswer(LOGIN_PROBE, usage);
+    });
+  const usage = probeAnswer(LOGIN_PROBE);
+  if (usage === undefined || now - Date.parse(usage.at) >= CREDITS_TTL_MS) return;
+  for (const id of stale) if (olderThan(usageOf(id), usage)) noteUsage(id, usage);
+}
+
+function refreshOne(conn: Connection, deps: ModelApiDeps, store: Store, now: number): Promise<void> {
+  if (conn.provider === 'openrouter') return refreshKey(conn, deps, now);
+  if (conn.provider === 'codex') return refreshCodex(conn, deps, store, now);
+  if (conn.provider === 'gemini') return refreshQuota(conn, deps, store, now);
+  return Promise.resolve();
+}
+
+async function within(ms: number, work: Promise<unknown>): Promise<void> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const waited = new Promise<void>((resolve) => {
+    timer = setTimeout(resolve, ms);
+  });
+  await Promise.race([work, waited]);
+  clearTimeout(timer);
+}
+
+export async function refreshUsage(deps: ModelApiDeps, store: Store, now = Date.now()): Promise<void> {
+  const cfg = store.read();
+  const work = Promise.all([...cfg.connections.map((conn) => refreshOne(conn, deps, store, now)), refreshLogin(cfg, deps, now)]);
+  await within(deps.usageWaitMs ?? WAIT_MS, work);
+}

package/runtime/node_modules/@metro-labs/daemon/src/gateway/usage.ts

@@ -1,3 +1,6 @@
+import { isRecord } from '@metro-labs/core/is-record';
+import { stringOf } from '@metro-labs/http/api-http';
+
 type Key = string;
 
 interface UsageWindow {
@@ -22,10 +25,12 @@ export interface ProviderUsage {
   tally: Tally | null;
 }
 
-type Reported = Omit<ProviderUsage, 'tally'>;
+export type Reported = Omit<ProviderUsage, 'tally'>;
 
 const latest = new Map<Key, Reported>();
 const tallies = new Map<Key, Tally>();
+const probed = new Map<Key, number>();
+const answers = new Map<Key, Reported>();
 
 export const noteUsage = (key: Key, usage: Reported): void => {
   latest.set(key, usage);
@@ -46,11 +51,31 @@ export const usageOf = (key: Key): Reported | undefined => latest.get(key);
 export const forgetOne = (key: Key): void => {
   latest.delete(key);
   tallies.delete(key);
+  probed.delete(key);
+};
+
+export const forgetReported = (key: Key): void => {
+  latest.delete(key);
+  probed.delete(key);
 };
 
 export const forgetUsage = (): void => {
   latest.clear();
   tallies.clear();
+  probed.clear();
+  answers.clear();
+};
+
+export function mayProbe(key: Key, now: number, every: number): boolean {
+  if (now - (probed.get(key) ?? Number.NEGATIVE_INFINITY) < every) return false;
+  probed.set(key, now);
+  return true;
+}
+
+export const probeAnswer = (key: Key): Reported | undefined => answers.get(key);
+
+export const keepProbeAnswer = (key: Key, usage: Reported): void => {
+  answers.set(key, usage);
 };
 
 export interface Counted {
@@ -198,13 +223,16 @@ function codexWindow(headers: Headers, kind: 'primary' | 'secondary', now: Date)
   return { label: windowLabel(Number.isFinite(minutes) ? minutes : null), used, resetAt, detail: null };
 }
 
-function codexCredits(headers: Headers): UsageWindow | null {
-  if (headers.get('x-codex-credits-has-credits') !== 'true') return null;
-  const balance = Number(headers.get('x-codex-credits-balance') ?? 'none');
+function creditsLeft(hasCredits: boolean, raw: string | null): UsageWindow | null {
+  if (!hasCredits) return null;
+  const balance = Number(raw ?? 'none');
   if (!Number.isFinite(balance)) return null;
   return { label: 'Credits', used: null, resetAt: null, detail: `${balance.toLocaleString('en-US')} left` };
 }
 
+const codexCredits = (headers: Headers): UsageWindow | null =>
+  creditsLeft(headers.get('x-codex-credits-has-credits') === 'true', headers.get('x-codex-credits-balance'));
+
 export function codexUsage(headers: Headers, now = new Date()): Reported | null {
   const windows = [codexWindow(headers, 'primary', now), codexWindow(headers, 'secondary', now), codexCredits(headers)].filter(
     (w): w is UsageWindow => w !== null,
@@ -214,6 +242,77 @@ export function codexUsage(headers: Headers, now = new Date()): Reported | null
   return { windows, note: reached === null || reached === '' ? null : reached.replaceAll('_', ' '), at: now.toISOString() };
 }
 
+const present = (w: UsageWindow | null): w is UsageWindow => w !== null;
+
+const textOf = (raw: unknown): string | null => (typeof raw === 'number' || typeof raw === 'string' ? String(raw) : null);
+
+const numberOf = (raw: unknown): number | null => (typeof raw === 'number' && Number.isFinite(raw) ? raw : null);
+
+const SECONDS_PER_MINUTE = 60;
+
+function codexBodyWindow(raw: unknown, now: Date): UsageWindow | null {
+  if (!isRecord(raw)) return null;
+  const percent = numberOf(raw.used_percent);
+  if (percent === null) return null;
+  const seconds = numberOf(raw.limit_window_seconds);
+  const minutes = seconds === null || seconds <= 0 ? null : Math.ceil(seconds / SECONDS_PER_MINUTE);
+  const resetAt = whenFrom(textOf(raw.reset_at), now) ?? whenFrom(textOf(raw.reset_after_seconds), now, true);
+  return { label: windowLabel(minutes), used: clamp(percent / 100), resetAt, detail: null };
+}
+
+function codexWall(limit: Record<string, unknown>, reached: unknown): string | null {
+  if (limit.limit_reached !== true && limit.allowed !== false) return null;
+  const kind = isRecord(reached) ? stringOf(reached.type) : '';
+  return kind === '' ? 'limit reached' : kind.replaceAll('_', ' ');
+}
+
+export function codexUsageBody(body: unknown, now = new Date()): Reported | null {
+  if (!isRecord(body)) return null;
+  const limit = isRecord(body.rate_limit) ? body.rate_limit : {};
+  const credits = isRecord(body.credits) ? body.credits : {};
+  const windows = [
+    codexBodyWindow(limit.primary_window, now),
+    codexBodyWindow(limit.secondary_window, now),
+    creditsLeft(credits.has_credits === true, textOf(credits.balance)),
+  ].filter(present);
+  return windows.length === 0 ? null : { windows, note: codexWall(limit, body.rate_limit_reached_type), at: now.toISOString() };
+}
+
+const CLAUDE_WINDOWS: [string, string][] = [
+  ['five_hour', '5-hour window'],
+  ['seven_day', 'Weekly'],
+  ['seven_day_sonnet', 'Weekly, Sonnet'],
+  ['seven_day_opus', 'Weekly, Opus'],
+];
+
+function percentWindow(label: string, raw: unknown, now: Date): UsageWindow | null {
+  if (!isRecord(raw)) return null;
+  const percent = numberOf(raw.utilization) ?? numberOf(raw.percent);
+  if (percent === null) return null;
+  return { label, used: clamp(percent / 100), resetAt: whenFrom(textOf(raw.resets_at), now), detail: null };
+}
+
+function scopedName(entry: Record<string, unknown>): string {
+  if (stringOf(entry.display_name) !== '') return stringOf(entry.display_name);
+  if (entry.kind !== 'weekly_scoped' || !isRecord(entry.scope) || !isRecord(entry.scope.model)) return '';
+  return stringOf(entry.scope.model.display_name);
+}
+
+function scopedWindows(limits: Record<string, unknown>, now: Date): (UsageWindow | null)[] {
+  const listed = [limits.model_scoped, limits.limits].flatMap((list): unknown[] => (Array.isArray(list) ? (list as unknown[]) : []));
+  return listed.map((entry) => {
+    const name = isRecord(entry) ? scopedName(entry) : '';
+    return name === '' ? null : percentWindow(`Weekly, ${name}`, entry, now);
+  });
+}
+
+export function claudeLoginUsage(limits: unknown, now = new Date()): Reported | null {
+  if (!isRecord(limits)) return null;
+  const all = [...CLAUDE_WINDOWS.map(([key, label]) => percentWindow(label, limits[key], now)), ...scopedWindows(limits, now)].filter(present);
+  const windows = all.filter((w, index) => all.findIndex((other) => other.label === w.label) === index);
+  return windows.length === 0 ? null : { windows, note: null, at: now.toISOString() };
+}
+
 export function noteUsageHeaders(kind: 'anthropic' | 'codex', key: Key, headers: Headers, now = new Date()): void {
   const usage = kind === 'anthropic' ? anthropicUsage(headers, now) : codexUsage(headers, now);
   if (usage !== null) noteUsage(key, usage);
@@ -234,11 +333,16 @@ export function geminiUsage(rows: QuotaRow[], now = new Date()): Reported | null
   return windows.length === 0 ? null : { windows, note: null, at: now.toISOString() };
 }
 
-export function openrouterUsage(total: number, spent: number, now = new Date()): Reported {
-  const used = total > 0 ? clamp(spent / total) : null;
-  return {
-    windows: [{ label: 'Credits', used, resetAt: null, detail: `${dollars(spent)} of ${dollars(total)} used` }],
-    note: null,
-    at: now.toISOString(),
-  };
+export interface KeySpend {
+  limit: number | null;
+  remaining: number | null;
+  spent: number;
+}
+
+function keyWindow(key: KeySpend): UsageWindow {
+  if (key.limit === null || key.limit <= 0) return { label: 'Credits', used: null, resetAt: null, detail: `${dollars(key.spent)} used, no limit on this key` };
+  const spent = key.remaining === null ? key.spent : Math.max(0, key.limit - key.remaining);
+  return { label: 'Credits', used: clamp(spent / key.limit), resetAt: null, detail: `${dollars(spent)} of ${dollars(key.limit)} used` };
 }
+
+export const openrouterUsage = (key: KeySpend, now = new Date()): Reported => ({ windows: [keyWindow(key)], note: null, at: now.toISOString() });

package/runtime/node_modules/@metro-labs/daemon/src/routes/local-mode.ts

@@ -44,6 +44,7 @@ import {
   readLocalAgentFile,
 } from '../agents/file-admin.js';
 import { readModelConfig } from '../gateway/model-config.js';
+import { resourcesFor } from '../server/resources.js';
 import type { StationName } from '@metro-labs/core/station-names';
 
 export interface LocalModeDeps {
@@ -197,7 +198,7 @@ export function localSessionApis(deps: LocalModeDeps): SessionApis {
     updateApi: { restart: deps.restart },
     controlApi: { restart: deps.restart, stop: deps.stop },
     ownerApi: { setOwner: (owner) => setLocalOwner(owner) },
-    machineApi: {},
+    machineApi: { resources: resourcesFor },
     modelApi: {},
     gateway: { config: readModelConfig },
     terminalApi: {},

package/runtime/node_modules/@metro-labs/daemon/src/server/machine.ts

@@ -13,6 +13,7 @@ const PATH = '/api/server';
 
 export interface MachineApiDeps {
   startedAt?: string;
+  resources?: (range: string) => unknown;
 }
 
 const bootedAt = new Date(Date.now() - process.uptime() * 1000).toISOString();
@@ -23,7 +24,7 @@ interface Disk {
   freeBytes: number;
 }
 
-async function diskInfo(path = homedir()): Promise<Disk | null> {
+export async function diskInfo(path = homedir()): Promise<Disk | null> {
   try {
     const s = await statfs(path);
     return { path, totalBytes: s.bsize * s.blocks, freeBytes: s.bsize * s.bavail };
@@ -54,5 +55,9 @@ export async function machineInfo(startedAt = bootedAt): Promise<Record<string,
 }
 
 export function handleMachineRequest(req: IncomingMessage, res: ServerResponse, deps: MachineApiDeps): boolean {
-  return sessionRoute(req, res, { methods: { [PATH]: ['GET'] }, admin: false, label: 'machine-api' }, () => machineInfo(deps.startedAt));
+  return sessionRoute(req, res, { methods: { [PATH]: ['GET'] }, admin: false, label: 'machine-api' }, async () => {
+    const info = await machineInfo(deps.startedAt);
+    const range = new URL(req.url ?? '', 'http://localhost').searchParams.get('range');
+    return range === null || deps.resources === undefined ? info : { ...info, resources: deps.resources(range) };
+  });
 }

package/runtime/node_modules/@metro-labs/daemon/src/server/resources.ts

@@ -0,0 +1,160 @@
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { cpus, freemem, homedir, totalmem } from 'node:os';
+import { dirname, join } from 'node:path';
+import { errMsg, log } from '@metro-labs/core/log';
+import { ApiError } from '@metro-labs/http/api-error';
+import { diskInfo } from './machine.js';
+
+const SAMPLE_MS = 60_000;
+const HOUR_MS = 3_600_000;
+const KEEP_MS = 7 * 24 * HOUR_MS;
+const POINTS = 240;
+const COMPACT_EVERY = 1_440;
+const RANGES: Readonly<Record<string, number>> = { '1h': HOUR_MS, '24h': 24 * HOUR_MS, '7d': KEEP_MS };
+const FIELDS = ['at', 'cpu', 'memUsed', 'memTotal', 'diskUsed', 'diskTotal'] as const;
+
+export type ResourceSample = Record<(typeof FIELDS)[number], number>;
+
+interface CpuTicks {
+  busy: number;
+  total: number;
+}
+
+const state: { samples: ResourceSample[]; appended: number } = { samples: [], appended: 0 };
+
+const resourcesFile = (): string => join(homedir(), '.metro', 'resources.jsonl');
+
+function cpuTicks(): CpuTicks {
+  let busy = 0;
+  let total = 0;
+  for (const { times } of cpus()) {
+    const sum = times.user + times.nice + times.sys + times.idle + times.irq;
+    total += sum;
+    busy += sum - times.idle;
+  }
+  return { busy, total };
+}
+
+export function cpuPercent(before: CpuTicks, after: CpuTicks): number {
+  const total = after.total - before.total;
+  if (total <= 0) return 0;
+  return Math.min(100, Math.max(0, ((after.busy - before.busy) / total) * 100));
+}
+
+function toSample(value: unknown): ResourceSample | null {
+  if (typeof value !== 'object' || value === null) return null;
+  const out: Partial<ResourceSample> = {};
+  for (const field of FIELDS) {
+    const v: unknown = (value as Record<string, unknown>)[field];
+    if (typeof v !== 'number' || !Number.isFinite(v)) return null;
+    out[field] = v;
+  }
+  return out as ResourceSample;
+}
+
+function parseLine(line: string): ResourceSample | null {
+  if (line.trim() === '') return null;
+  try {
+    return toSample(JSON.parse(line));
+  } catch {
+    return null;
+  }
+}
+
+const toLine = (sample: ResourceSample): string => `${JSON.stringify(sample)}\n`;
+
+export function readSamples(file = resourcesFile(), now = Date.now()): ResourceSample[] {
+  let text: string;
+  try {
+    text = readFileSync(file, 'utf8');
+  } catch {
+    return [];
+  }
+  return text.split('\n').flatMap((line) => parseLine(line) ?? []).filter((s) => s.at > now - KEEP_MS);
+}
+
+function rewrite(file: string): void {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, state.samples.map(toLine).join(''));
+  state.appended = 0;
+}
+
+export function recordSample(sample: ResourceSample, file = resourcesFile()): void {
+  state.samples.push(sample);
+  const first = state.samples.findIndex((s) => s.at > sample.at - KEEP_MS);
+  if (first > 0) state.samples.splice(0, first);
+  if (state.appended >= COMPACT_EVERY) {
+    rewrite(file);
+    return;
+  }
+  mkdirSync(dirname(file), { recursive: true });
+  appendFileSync(file, toLine(sample));
+  state.appended += 1;
+}
+
+export function loadSamples(file = resourcesFile()): void {
+  state.samples = readSamples(file);
+  state.appended = 0;
+}
+
+export async function takeSample(before: CpuTicks): Promise<{ sample: ResourceSample; ticks: CpuTicks }> {
+  const ticks = cpuTicks();
+  const disk = await diskInfo();
+  const memTotal = totalmem();
+  return {
+    ticks,
+    sample: {
+      at: Date.now(),
+      cpu: cpuPercent(before, ticks),
+      memUsed: memTotal - freemem(),
+      memTotal,
+      diskUsed: disk === null ? 0 : disk.totalBytes - disk.freeBytes,
+      diskTotal: disk?.totalBytes ?? 0,
+    },
+  };
+}
+
+export function startResourceSampler(): void {
+  try {
+    loadSamples();
+    rewrite(resourcesFile());
+  } catch (err) {
+    log.warn({ err: errMsg(err) }, 'resources: could not load the history');
+  }
+  let ticks = cpuTicks();
+  const run = (): void => {
+    takeSample(ticks)
+      .then((next) => {
+        ticks = next.ticks;
+        recordSample(next.sample);
+      })
+      .catch((err: unknown) => {
+        log.warn({ err: errMsg(err) }, 'resources: could not record a sample');
+      });
+  };
+  setInterval(run, SAMPLE_MS).unref?.();
+}
+
+function average(at: number, group: ResourceSample[]): ResourceSample {
+  const mean = (field: (typeof FIELDS)[number]): number => group.reduce((sum, s) => sum + s[field], 0) / group.length;
+  return { at, cpu: mean('cpu'), memUsed: mean('memUsed'), memTotal: mean('memTotal'), diskUsed: mean('diskUsed'), diskTotal: mean('diskTotal') };
+}
+
+export function resourceSeries(samples: ResourceSample[], rangeMs: number, now = Date.now()): { stepMs: number; samples: ResourceSample[] } {
+  const stepMs = Math.max(1, Math.ceil(rangeMs / POINTS / SAMPLE_MS)) * SAMPLE_MS;
+  const buckets = new Map<number, ResourceSample[]>();
+  for (const sample of samples) {
+    if (sample.at <= now - rangeMs || sample.at > now) continue;
+    const key = Math.floor(sample.at / stepMs) * stepMs;
+    const group = buckets.get(key);
+    if (group === undefined) buckets.set(key, [sample]);
+    else group.push(sample);
+  }
+  return { stepMs, samples: [...buckets].map(([at, group]) => average(at, group)) };
+}
+
+export function resourcesFor(range: string): { range: string; sampleMs: number; stepMs: number; samples: ResourceSample[] } {
+  const rangeMs = Object.hasOwn(RANGES, range) ? RANGES[range] : undefined;
+  if (rangeMs === undefined) throw new ApiError('range must be 1h, 24h or 7d', 400);
+  return { range, sampleMs: SAMPLE_MS, ...resourceSeries(state.samples, rangeMs) };
+}

package/runtime/runtime.json

@@ -1,3 +1,3 @@
 {
-  "version": "0.1.0-beta.221"
+  "version": "0.1.0-beta.223"
 }