@usagefleet/cli 1.2.75 → 1.2.77

package/README.md

@@ -12,15 +12,17 @@ then, on that machine:
 
 ```bash
 npm i -g @usagefleet/cli
-usagefleet install --token uf_xxx
+usagefleet login uf_xxx
 ```
 
 Same two commands on macOS, Linux and Windows (in PowerShell chain them with
-`;` — 5.1 has no `&&`). `install` sets the collector to start at login and
-writes `~/.config/usagefleet/config.json` (mode `600`). The dashboard fills in
-within a minute.
+`;` — 5.1 has no `&&`). `login` pairs the device, sets the collector to start
+with your session and writes `~/.config/usagefleet/config.json` (mode `600`).
+The dashboard fills in within a minute.
 
-Running your own server? Add `--endpoint https://track.example.com`.
+`login` takes the token and nothing else. The collector reports to
+`usagefleet.com` and there is no way to redirect it: the request carries your
+device token and a log of what this machine is working on.
 
 If `npm i -g` fails with EACCES your global prefix is root-owned: use a Node
 version manager (nvm, fnm, volta) or `npm config set prefix ~/.local` with
@@ -38,12 +40,12 @@ usagefleet guard          # exit 2 if this device's group is over a blocking lim
 usagefleet notify-test    # fire a sample desktop notification
 usagefleet update         # upgrade now (it also self-updates every 6h)
 usagefleet config         # config file location + every env override
-usagefleet install        # (re)install the background service, idempotent
+usagefleet login <token>  # pair this device + (re)install the service, idempotent
 usagefleet uninstall      # remove it
 usagefleet completion zsh # print a shell completion script (zsh, fish)
 ```
 
-`install` sets up completions for you, for each shell you actually use — zsh
+`login` sets up completions for you, for each shell you actually use — zsh
 gets `~/.zsh/completions/_usagefleet` plus an `fpath` block appended to
 `.zshrc`, fish gets `~/.config/fish/completions/usagefleet.fish`. Restart the
 shell once. `uninstall` removes both again, and self-update keeps them current.
@@ -61,7 +63,7 @@ shell once. `uninstall` removes both again, and self-update keeps them current.
   is at-least-once — the server dedups on `uuid`.
 - **Your real limit %** — the collector uses the Claude login already on the
   machine (subscription OAuth from `claude`: macOS login Keychain, elsewhere
-  `~/.claude/.credentials.json`; falling back to `ANTHROPIC_API_KEY`), sends a
+  `<config dir>/.credentials.json`; falling back to `ANTHROPIC_API_KEY`), sends a
   1-token ping to the Messages API, and reads Anthropic's
   `anthropic-ratelimit-unified-5h/7d-utilization` headers. Credentials never
   leave the machine — only the percentages do. `usagefleet status` shows which
@@ -85,7 +87,7 @@ WinRT toast via `powershell.exe`.
 
 A group can be set to **refuse new prompts** once it has burned its budget slice
 (1/N of the account limit) for a window — a switch per window on the Groups
-page, both off by default. `usagefleet install` registers a Claude Code `UserPromptSubmit` hook in
+page, both off by default. `usagefleet login` registers a Claude Code `UserPromptSubmit` hook in
 `~/.claude/settings.json` (removed by `uninstall`, refreshed rather than stacked
 on re-install, and skipped entirely with `USAGEFLEET_HOOK=0`):
 
@@ -109,13 +111,12 @@ finishes.
 `~/.config/usagefleet/config.json` (honours `XDG_CONFIG_HOME`) holds everything
 the CLI persists: your settings plus two machine-managed sections, `state` (tail
 offsets) and `notify` (which thresholds already fired). Delete it to start
-clean. Re-running `install` merges, so rotating a token doesn't reset offsets.
+clean. Re-running `login` merges, so rotating a token doesn't reset offsets.
 
 Env vars override the file:
 
 | Variable | Meaning |
 |----------|---------|
-| `USAGEFLEET_ENDPOINT` | server base URL (default `https://usagefleet.com`). Must be `https://`, loopback may be `http://` |
 | `USAGEFLEET_TOKEN` | device token |
 | `USAGEFLEET_PROJECTS` | override `~/.claude/projects` |
 | `USAGEFLEET_DESKTOP` | override the Claude Desktop sessions dir; `off` to skip it |
@@ -129,17 +130,36 @@ Env vars override the file:
 | `USAGEFLEET_UPDATE` | `0` turns the self-update check off |
 | `USAGEFLEET_UPDATE_INTERVAL` | seconds between update checks (default `21600` = 6h) |
 | `USAGEFLEET_HOOK` | `0` keeps the prompt-blocking hook out of `~/.claude/settings.json` |
+| `CLAUDE_CONFIG_DIR` | Claude Code's own knob: which login to watch (default `~/.claude`) |
 
-When run as a service, `install` bakes every `USAGEFLEET_*` value currently set
-(plus `ANTHROPIC_API_KEY`) into the launchd/systemd unit, written mode `600`.
+When run as a service, `login` bakes every `USAGEFLEET_*` value currently set
+(plus `ANTHROPIC_API_KEY` and `CLAUDE_CONFIG_DIR`) into the launchd/systemd
+unit, written mode `600`.
+
+### Two Claude accounts on one machine
+
+One collector watches one login. To report a second subscription from the same
+machine, run a second collector against Claude Code's other config dir, with its
+own device token and its own state:
+
+```sh
+CLAUDE_CONFIG_DIR=~/.claude-work \
+  USAGEFLEET_CONFIG=~/.config/usagefleet/work.json \
+  USAGEFLEET_PROJECTS=~/.claude-work/projects \
+  usagefleet login uf_...
+```
+
+Each reports its own account, and the dashboard keeps their limits apart. With a
+relocated config dir the macOS Keychain is skipped on purpose: that item belongs
+to the default login.
 
 ## Background service
 
-`install` is idempotent and reload-safe: re-running it rewrites the service
+`login` is idempotent and reload-safe: re-running it rewrites the service
 definition and restarts it, so it doubles as the update step. It launches an
 absolute `node` plus the installed package path, so an empty service PATH is
 fine — but removing that Node version (`nvm uninstall`) stops the collector
-until you re-run `usagefleet install` under the new one.
+until you re-run `usagefleet login` under the new one.
 
 - **macOS** — a LaunchAgent (`~/Library/LaunchAgents`, RunAtLoad + KeepAlive),
   booted immediately. Logs in `~/Library/Logs/usagefleet/`. Plist is mode `600`:
@@ -156,12 +176,12 @@ until you re-run `usagefleet install` under the new one.
 > the login Keychain for the real limit % may be denied to a non-interactive
 > agent — the collector logs a clear hint. Either approve `/usr/bin/security`
 > access to the `Claude Code-credentials` item once, or set `ANTHROPIC_API_KEY`
-> before `usagefleet install` so limits use the API key.
+> before `usagefleet login` so limits use the API key.
 
 ## Updates
 
 `watch` checks the npm registry at startup and every 6 hours; on a new version
-it runs `npm install -g @usagefleet/cli@<version>` and re-runs `install` to
+it runs `npm install -g @usagefleet/cli@<version>` and re-runs `login` to
 restart the service on it. `usagefleet update` does the same on demand. npm is
 called through the absolute path next to the running `node`, because a
 launchd/systemd service gets a minimal PATH.

package/dist/claude-creds.js

@@ -1,17 +1,14 @@
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
-import { homedir, userInfo } from 'node:os';
-import { join } from 'node:path';
+import { userInfo } from 'node:os';
 import { writeFileAtomic } from './atomic-write.js';
+import { claudeCredentialsPath } from './paths.js';
 import { dim, line, yellow } from './ui.js';
 const KEYCHAIN_SERVICE = 'Claude Code-credentials';
-function credentialsFilePath() {
-    return join(homedir(), '.claude', '.credentials.json');
-}
-/** Linux/Windows (and sometimes macOS): ~/.claude/.credentials.json */
+/** Linux/Windows (and sometimes macOS): <config dir>/.credentials.json */
 function fromCredentialsFile() {
     try {
-        return JSON.parse(readFileSync(credentialsFilePath(), 'utf-8'));
+        return JSON.parse(readFileSync(claudeCredentialsPath(), 'utf-8'));
     }
     catch {
         return null;
@@ -55,7 +52,7 @@ function persist(blob, from) {
     if (from === 'file') {
         // Atomic: an interrupted write here truncates the user's live credentials
         // and logs them out of Claude Code entirely.
-        writeFileAtomic(credentialsFilePath(), json, 0o600);
+        writeFileAtomic(claudeCredentialsPath(), json, 0o600);
         return;
     }
     // The password must go in argv: `security`'s stdin prompt reads at most 128
@@ -130,7 +127,11 @@ async function refreshOauth(blob, from) {
  */
 export async function detectClaudeCreds() {
     const fileBlob = fromCredentialsFile();
-    const blob = fileBlob ?? fromMacKeychain();
+    // The Keychain item is global, so it belongs to whoever owns the default
+    // config dir. A collector watching a relocated one is a different login and
+    // must not fall back to it: it would report that login's limits under this
+    // account's uuid.
+    const blob = fileBlob ?? (process.env.CLAUDE_CONFIG_DIR ? null : fromMacKeychain());
     const from = fileBlob ? 'file' : 'keychain';
     const oauth = blob?.claudeAiOauth;
     // Only use the OAuth token if it isn't expired (60s skew margin).

package/dist/collector.js

@@ -4,6 +4,7 @@ import { sep } from 'node:path';
 import { detectClaudeAccount } from './claude-account.js';
 import { detectClaudeCreds, macKeychainDenied } from './claude-creds.js';
 import { fetchLimits } from './claude-limits.js';
+import { ENDPOINT } from './config.js';
 import { maybeNotify } from './notifier.js';
 import { detectOs } from './os.js';
 import { RELEASE_VERSION } from './release.js';
@@ -96,14 +97,14 @@ export async function runOnce(cfg, log = () => {
             // Token revoked/expired. The data is valid and must NOT be skipped — keep
             // the offset so it uploads once a fresh token is configured. Retrying the
             // remaining files would 401 identically, so stop this cycle and surface.
-            log('warn', 'auth rejected · device token invalid or revoked · re-run `usagefleet install --token <t>` with a fresh token');
+            log('warn', 'auth rejected · device token invalid or revoked · re-run `usagefleet login --token <t>` with a fresh token');
             result.failed = true;
             break;
         }
         else if (outcome === 'plan') {
             // The device sits outside the account's device limit (402). Every other
             // file gets the same answer, so stop and say what unblocks it once.
-            log('warn', planWall(cfg.endpoint));
+            log('warn', planWall());
             result.failed = true;
             break;
         }
@@ -126,7 +127,7 @@ export async function runOnce(cfg, log = () => {
     // One durable write per cycle rather than one per file: the store is fsynced
     // on every save, and a crash mid-cycle only costs a re-upload the server
     // dedups. Only our own section is replaced, so a token written by a
-    // concurrent `usagefleet install` survives.
+    // concurrent `usagefleet login` survives.
     if (pruneMissingFiles(state, files) || advanced) {
         updateStore(cfg.storePath, store => {
             store.state.files = state.files;
@@ -208,8 +209,8 @@ function pruneMissingFiles(state, scanned) {
 }
 /** The one thing that unblocks a device parked outside the account's device limit.
  *  Shared by both upload legs so the wording cannot drift between them. */
-function planWall(endpoint) {
-    return `device outside your plan's device limit · free a slot or upgrade at ${endpoint}/devices · nothing is lost, uploads resume once it fits`;
+function planWall() {
+    return `device outside your plan's device limit · free a slot or upgrade at ${ENDPOINT}/devices · nothing is lost, uploads resume once it fits`;
 }
 /**
  * Auto-detect the local Claude login, read the real 5h/weekly utilization from
@@ -250,10 +251,10 @@ export async function reportLimitsOnce(cfg, log = () => {
     const account = report.source === 'sub' ? detectClaudeAccount() : null;
     const outcome = await postLimits({ ...report, account }, cfg);
     if (outcome === 'plan') {
-        log('warn', planWall(cfg.endpoint));
+        log('warn', planWall());
     }
     else if (outcome === 'auth') {
-        log('warn', 'limits rejected · device token invalid or revoked · re-run `usagefleet install --token <device-token>`');
+        log('warn', 'limits rejected · device token invalid or revoked · re-run `usagefleet login --token <device-token>`');
     }
     else if (outcome === 'invalid') {
         log('warn', 'limits rejected as malformed · this is a bug, please report it');

package/dist/completion.js

@@ -8,7 +8,8 @@ import { writeFileAtomic } from './atomic-write.js';
  *
  *  `watch` is deliberately absent: it is the entrypoint the installed service
  *  runs, not something to type. It still dispatches — every plist and unit on
- *  disk names it — it just isn't advertised. */
+ *  disk names it — it just isn't advertised. So are `install`/`init`, the former
+ *  names of `login`, kept dispatching for commands already pasted into scripts. */
 export const commands = [
     { name: 'run', meaning: 'scan once, upload usage + report limits' },
     { name: 'limits', meaning: 'report only your real 5h/weekly usage' },
@@ -18,10 +19,43 @@ export const commands = [
     { name: 'status', meaning: 'service health, limits, resolved config' },
     { name: 'config', meaning: 'config file location and env overrides' },
     { name: 'completion', args: '<zsh|fish>', meaning: 'print a shell completion script' },
-    { name: 'install', args: '--token <t>', meaning: 'configure + install the service and prompt guard' },
+    { name: 'login', args: '<token>', meaning: 'pair this device, install the service and prompt guard' },
     { name: 'uninstall', meaning: 'remove the service and the guard' },
 ];
 export const shells = ['zsh', 'fish'];
+/** Everything `main` dispatches, advertised or not — the pool a mistyped command
+ *  is matched against. Kept next to `commands` so a new case in the switch has
+ *  one obvious place to be listed. */
+const dispatchable = [...commands.map(c => c.name), 'watch', 'install', 'init', 'help'];
+/** The command a typo probably meant, or undefined when nothing is close enough
+ *  to guess: `statu` → `status`, `frobnicate` → nothing. */
+export function suggest(input) {
+    const typed = input.toLowerCase().replace(/^-+/, '');
+    // Scales with the input so short words don't match everything: at most two
+    // edits for a normal command, more only for the long ones.
+    const cutoff = Math.max(2, Math.floor(typed.length / 3));
+    let best;
+    for (const name of dispatchable) {
+        const d = distance(typed, name);
+        if (d <= cutoff && (!best || d < best.d)) {
+            best = { name, d };
+        }
+    }
+    return best?.name;
+}
+/** Plain Levenshtein, two rows at a time. Ten commands of ten characters: not
+ *  worth a dependency. */
+function distance(a, b) {
+    let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+    for (let i = 1; i <= a.length; i++) {
+        const row = [i];
+        for (let j = 1; j <= b.length; j++) {
+            row[j] = Math.min(prev[j] + 1, row[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        prev = row;
+    }
+    return prev[b.length];
+}
 /** A completion script for `shell`, on stdout. `install` writes these to the
  *  right place automatically; this command stays for piping one somewhere else. */
 export function completionScript(shell) {

package/dist/config.js

@@ -2,23 +2,19 @@ import { defaultDesktopSessionsDir, defaultPiSessionsDirs, defaultProjectsDir }
 import { readStore, storePath } from './store.js';
 /** Matches the server's BatchSchema `.max(1000)`. */
 const MAX_BATCH = 1000;
-/** The hosted service. Only self-hosted deployments have to name an endpoint,
- *  so setup on the hosted one is a token and nothing else. */
-export const DEFAULT_ENDPOINT = 'https://usagefleet.com';
-const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+/** The only server a collector talks to. Not configurable: the request carries
+ *  a device token and a log of what this machine is working on, so there is one
+ *  https destination and no way to redirect it. */
+export const ENDPOINT = 'https://usagefleet.com';
 /** Resolve config from env first, then the stored settings (see store.ts). */
 export function loadConfig() {
     const file = readStore();
     // Use `||` (not `??`) so an empty-string env var falls back to the config
     // file — launchd/systemd units may inject empty USAGEFLEET_* values.
-    const endpoint = (process.env.USAGEFLEET_ENDPOINT || file.endpoint || DEFAULT_ENDPOINT).replace(/\/+$/, '');
     const token = process.env.USAGEFLEET_TOKEN || file.token || '';
     if (!token) {
         throw new Error('USAGEFLEET_TOKEN is not set');
     }
-    if (!isSecureEndpoint(endpoint)) {
-        throw new Error(`endpoint must be https (got ${endpoint}). It carries the device token on every request. Set --endpoint or USAGEFLEET_ENDPOINT.`);
-    }
     // Guard batch size: "0" (infinite loop), NaN (silent drop), fractional → 100.
     // Clamped to the server's own 1000-record cap, since a larger batch is
     // rejected as malformed and would cost the whole chunk a bisect to discover.
@@ -27,7 +23,6 @@ export function loadConfig() {
     return {
         batchSize,
         desktopDir: resolveOptionalDir(process.env.USAGEFLEET_DESKTOP, file.desktopDir, defaultDesktopSessionsDir()),
-        endpoint,
         piDirs: resolvePiDirs(process.env.USAGEFLEET_PI, file.piDir),
         projectsDir: process.env.USAGEFLEET_PROJECTS || file.projectsDir || defaultProjectsDir(),
         storePath: storePath(),
@@ -54,21 +49,3 @@ function resolveOptionalDir(env, fromFile, fallback) {
     }
     return env || fromFile || fallback;
 }
-/**
- * The endpoint must be https: it carries the device token on every request, and
- * the payload is a log of what this machine is working on. Loopback is exempt so
- * local development keeps working.
- */
-export function isSecureEndpoint(endpoint) {
-    let url;
-    try {
-        url = new URL(endpoint);
-    }
-    catch {
-        return false;
-    }
-    if (url.protocol === 'https:') {
-        return true;
-    }
-    return url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname);
-}

package/dist/guard.js

@@ -1,4 +1,4 @@
-import { loadConfig } from './config.js';
+import { ENDPOINT, loadConfig } from './config.js';
 /** Hooks run on the interactive path — a slow/hung server must not stall a
  *  prompt for long. On timeout we fail open (see {@link runGuard}). */
 const TIMEOUT_MS = 5000;
@@ -38,7 +38,7 @@ export async function runGuard() {
     }
     let view;
     try {
-        const res = await fetch(`${cfg.endpoint}/api/v1/limits`, {
+        const res = await fetch(`${ENDPOINT}/api/v1/limits`, {
             headers: { 'x-api-key': cfg.token },
             signal: AbortSignal.timeout(TIMEOUT_MS),
         });

package/dist/hook.js

@@ -89,7 +89,7 @@ function editSettings(transform, onWrite) {
 /**
  * Register `usagefleet guard` as a Claude Code UserPromptSubmit hook, so a
  * group with blocking enabled actually refuses prompts. Called by
- * `usagefleet install`; set USAGEFLEET_HOOK=0 to keep settings.json
+ * `usagefleet login`; set USAGEFLEET_HOOK=0 to keep settings.json
  * untouched.
  */
 export function installPromptHook(program) {

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { detectClaudeCreds } from './claude-creds.js';
 import { reportLimitsOnce, runOnce } from './collector.js';
-import { commands, completionScript, installCompletions, removeCompletions, shells } from './completion.js';
-import { loadConfig } from './config.js';
+import { commands, completionScript, installCompletions, removeCompletions, shells, suggest } from './completion.js';
+import { ENDPOINT, loadConfig } from './config.js';
 import { runGuard } from './guard.js';
 import { loadNotifyConfig } from './notifier.js';
 import { sendNotification } from './notify.js';
@@ -84,7 +84,7 @@ async function cmdWatch() {
     let lastUpdateAt = 0;
     const watching = [cfg.projectsDir, cfg.desktopDir, ...cfg.piDirs].filter((d) => !!d);
     console.log(header(`watching every ${interval / 1000}s`));
-    console.log(hint(`${watching.map(tilde).join(' · ')} → ${host(cfg.endpoint)}`));
+    console.log(hint(`${watching.map(tilde).join(' · ')} → ${host(ENDPOINT)}`));
     console.log('');
     let stopping = false;
     let timer = null;
@@ -167,7 +167,7 @@ async function cmdStatus() {
     console.log('');
     console.log(svc.state === 'running'
         ? stateLine('ok', 'service', `running${svc.pid ? dim(` · pid ${svc.pid}`) : ''}`)
-        : stateLine('bad', 'service', `${svc.state} ${dim(svc.state === 'stopped' ? '· check the log' : '· run `usagefleet install`')}`));
+        : stateLine('bad', 'service', `${svc.state} ${dim(svc.state === 'stopped' ? '· check the log' : '· run `usagefleet login`')}`));
     console.log(creds
         ? stateLine('ok', 'claude', `${creds.source}${dim(creds.subscriptionType ? ` · ${creds.subscriptionType}` : '')}`)
         : stateLine('warn', 'claude', `no login ${dim('· sign in with `claude` or set ANTHROPIC_API_KEY')}`));
@@ -175,7 +175,7 @@ async function cmdStatus() {
         ? stateLine(limitHealth(limits.fiveHourPct, limits.sevenDayPct), 'limits', `5h ${bar(limits.fiveHourPct)} ${pct(limits.fiveHourPct)} · weekly ${bar(limits.sevenDayPct)} ${pct(limits.sevenDayPct)} ${dim(ago(limits.at))}`)
         : stateLine('warn', 'limits', `no reading yet ${dim('· run `usagefleet limits`')}`));
     console.log('');
-    console.log(row('endpoint', host(cfg.endpoint)));
+    console.log(row('endpoint', host(ENDPOINT)));
     console.log(row('device', `${state.deviceId} · token ${cfg.token.slice(0, 8)}…`));
     const watching = [cfg.projectsDir, cfg.desktopDir, ...cfg.piDirs].filter((d) => !!d);
     for (const [i, dir] of watching.entries()) {
@@ -189,30 +189,35 @@ function limitHealth(fiveHour, sevenDay) {
     const worst = Math.max(fiveHour ?? 0, sevenDay ?? 0);
     return worst >= 95 ? 'bad' : worst >= 80 ? 'warn' : 'ok';
 }
-/** Setup in one command: persist the flags (when given), then install the
+/** Setup in one command: `usagefleet login <device-token>`, then install the
  *  background service, which refuses to install without a resolvable token.
- *  The write merges over the existing store, so re-running install rotates the
- *  token without resetting tail offsets. Endpoint only matters when
- *  self-hosting; unset keeps whatever is configured. */
-async function cmdInstall() {
-    // Apply the flags to the env loadConfig() reads rather than writing them to the
-    // store, so there is exactly one precedence chain and install() persists its
-    // single winner. Writing to the store first inverted the precedence: loadConfig
-    // prefers the env, so a stale USAGEFLEET_TOKEN in the install shell beat the
-    // flag and got written back over it, silently voiding token rotation. It also
-    // means a rejected value never reaches disk.
-    const endpoint = flag('endpoint');
-    const token = flag('token');
-    if (endpoint) {
-        process.env.USAGEFLEET_ENDPOINT = endpoint;
+ *  The write merges over the existing store, so re-running login rotates the
+ *  token without resetting tail offsets. Omitting the token re-runs setup with
+ *  whatever is already configured, which is what self-update does. */
+async function cmdLogin() {
+    // Rejected loudly rather than ignored: a collector that used to report to a
+    // self-hosted server would otherwise start shipping this device's usage to the
+    // hosted one on the next self-update, silently.
+    if (process.argv.some(a => a === '--endpoint' || a.startsWith('--endpoint='))) {
+        console.error(fail('endpoint', 'no longer configurable · this collector reports to usagefleet.com'));
+        return process.exit(1);
     }
+    // Positional, with the retired `--token` flag still accepted: it is printed by
+    // every collector older than the rename and pasted into provisioning scripts.
+    // Apply it to the env loadConfig() reads rather than writing it to the store,
+    // so there is exactly one precedence chain and install() persists its single
+    // winner. Writing to the store first inverted the precedence: loadConfig
+    // prefers the env, so a stale USAGEFLEET_TOKEN in the login shell beat the
+    // argument and got written back over it, silently voiding token rotation. It
+    // also means a rejected value never reaches disk.
+    const token = process.argv.slice(3).find(a => !a.startsWith('-')) ?? flag('token');
     if (token) {
         process.env.USAGEFLEET_TOKEN = token;
     }
     const { install } = await import('./service.js');
     install();
     // After the service, so a completion problem can never fail the part that
-    // matters. Self-update re-runs `install`, which keeps completions in step with
+    // matters. Self-update re-runs `login`, which keeps completions in step with
     // new commands without the user doing anything.
     try {
         for (const { shell, path, rc } of installCompletions()) {
@@ -238,7 +243,6 @@ function print(rows) {
  *  it must work before a token exists, when the config is what you're fixing. */
 function cmdConfig() {
     const env = [
-        ['USAGEFLEET_ENDPOINT', 'server base URL (self-hosting only)'],
         ['USAGEFLEET_TOKEN', 'device token from the Devices page'],
         ['USAGEFLEET_PROJECTS', 'override ~/.claude/projects'],
         ['USAGEFLEET_DESKTOP', 'override the Claude Desktop dir ("off" disables)'],
@@ -330,10 +334,13 @@ async function main() {
             console.log(RELEASE_VERSION);
             return;
         }
-        // `init` was the separate config step; it now just does the whole setup.
+        // `install` (and `init` before it) named this step until it became `login`.
+        // Both still dispatch: they are pasted into scripts and printed by every
+        // collector old enough to predate the rename.
+        case 'login':
         case 'init':
         case 'install': {
-            return cmdInstall();
+            return cmdLogin();
         }
         case 'uninstall': {
             const { uninstall } = await import('./service.js');
@@ -341,9 +348,20 @@ async function main() {
             removeCompletions();
             return;
         }
-        default: {
+        case 'help':
+        case '--help':
+        case '-h': {
             return help();
         }
+        // Anything else is a mistake, not a request for help: say so, guess what was
+        // meant, and exit non-zero so a script notices the typo instead of reading a
+        // help screen as success.
+        default: {
+            const near = suggest(cmd);
+            console.error(fail('unknown', `${cmd}${near ? ` · did you mean \`${near}\`?` : ''}`));
+            console.error(hint('`usagefleet help` lists every command'));
+            process.exitCode = 1;
+        }
     }
 }
 main().catch(error => {

package/dist/paths.js

@@ -41,10 +41,20 @@ export function defaultPiSessionsDirs() {
     }
     return [...new Set(dirs)];
 }
-/** Claude Code's user settings file, where the prompt guard hook is registered.
- *  CLAUDE_CONFIG_DIR is Claude Code's own relocation knob. */
+/** Claude Code's config dir. CLAUDE_CONFIG_DIR is Claude Code's own relocation
+ *  knob, and a relocated dir is a second, independent login: its own settings,
+ *  its own credentials, its own Anthropic account. */
+export function claudeConfigDir() {
+    return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude');
+}
+/** Claude Code's user settings file, where the prompt guard hook is registered. */
 export function claudeSettingsPath() {
-    return join(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'), 'settings.json');
+    return join(claudeConfigDir(), 'settings.json');
+}
+/** Where Claude Code keeps its OAuth blob on Linux and Windows — and on macOS
+ *  too when the login Keychain is unavailable. */
+export function claudeCredentialsPath() {
+    return join(claudeConfigDir(), '.credentials.json');
 }
 /** Claude Code's global state file (`~/.claude.json`), which records which
  *  Anthropic account this machine is logged into. Unlike settings.json it sits

package/dist/release.js

@@ -1,2 +1,2 @@
 // Generated by .github/workflows/release.yml.
-export const RELEASE_VERSION = "1.2.75";
+export const RELEASE_VERSION = "1.2.77";

package/dist/service.js

@@ -2,15 +2,17 @@ import { execFileSync } from 'node:child_process';
 import { chmodSync, existsSync, mkdirSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { delimiter, join } from 'node:path';
-import { DEFAULT_ENDPOINT, loadConfig } from './config.js';
+import { ENDPOINT, loadConfig } from './config.js';
 import { installPromptHook, uninstallPromptHook } from './hook.js';
 import { readStore, storePath, updateStore } from './store.js';
 import { fail, header, hint, host, row, step, tilde, warn } from './ui.js';
 const LABEL = 'dev.usagefleet.collector';
 /** Scheduled Task name on Windows (mirrors the launchd label / systemd unit). */
 const TASK = 'usagefleet';
-/** Extra env var the service needs that does not carry the USAGEFLEET_ prefix. */
-const EXTRA_PASSTHROUGH_ENV = 'ANTHROPIC_API_KEY';
+/** Extra env the service needs that does not carry the USAGEFLEET_ prefix.
+ *  CLAUDE_CONFIG_DIR picks which Claude login this collector watches, so a
+ *  service that lost it would silently report the default account instead. */
+const EXTRA_PASSTHROUGH_ENV = new Set(['ANTHROPIC_API_KEY', 'CLAUDE_CONFIG_DIR']);
 /** Per-user dir for the collector's own runtime files: the Windows launcher and
  *  its log, plus the binary copy that pre-npm releases left there. */
 function stableBinDir() {
@@ -106,7 +108,7 @@ function systemdUnitPath() {
  *  USAGEFLEET_PI, USAGEFLEET_DESKTOP and USAGEFLEET_LIMITS_INTERVAL, so a
  *  documented override did nothing once the collector ran as a service. */
 function presentEnv() {
-    return Object.entries(process.env).filter((entry) => !!entry[1] && (entry[0].startsWith('USAGEFLEET_') || entry[0] === EXTRA_PASSTHROUGH_ENV));
+    return Object.entries(process.env).filter((entry) => !!entry[1] && (entry[0].startsWith('USAGEFLEET_') || EXTRA_PASSTHROUGH_ENV.has(entry[0])));
 }
 /** Escape a string for a VBScript double-quoted literal (only `"` is special). */
 function vbs(s) {
@@ -129,7 +131,7 @@ export function windowsLauncherVbs(prog, env, logPath) {
         .filter(([, v]) => !/[\r\n]/.test(v))
         .map(([k, v]) => `env(${vbs(k)}) = ${vbs(v)}`);
     return [
-        "' usagefleet background launcher — generated by `usagefleet install`.",
+        "' usagefleet background launcher — generated by `usagefleet login`.",
         'Set sh = CreateObject("WScript.Shell")',
         'Set env = sh.Environment("Process")',
         ...envLines,
@@ -220,36 +222,31 @@ export function install() {
     // every launch, because the service manager crash-loops it invisibly (only the
     // log file shows it). Resolving through loadConfig() is what makes this a real
     // pre-flight rather than a lookalike: it is the same call `watch` makes, so a
-    // missing token or a non-https endpoint fails here or not at all.
+    // missing token fails here or not at all.
     let cfg;
     try {
         cfg = loadConfig();
     }
     catch (error) {
         console.error(fail('config', error.message));
-        console.error(hint('  usagefleet install --endpoint <url> --token <device-token>'));
+        console.error(hint('  usagefleet login <device-token>'));
         return process.exit(1);
     }
-    // Config that only ever lived in this shell's env is lost to every later
+    // A token that only ever lived in this shell's env is lost to every later
     // invocation: `usagefleet guard` runs from Claude Code's environment, which
-    // carries no USAGEFLEET_* vars (hook.ts bakes the command, not the env). The
-    // endpoint would fall back to the hosted default and send this device's token
-    // there; the token would be missing outright and the guard would fail open. So
-    // pin both to disk. The default endpoint is stored as absent rather than
-    // written out, so it can still move under an existing install.
-    const desiredEndpoint = cfg.endpoint === DEFAULT_ENDPOINT ? undefined : cfg.endpoint;
+    // carries no USAGEFLEET_* vars (hook.ts bakes the command, not the env), so the
+    // token would be missing outright and the guard would fail open. Pin it to disk.
     const stored = readStore();
-    if (stored.token !== cfg.token || stored.endpoint !== desiredEndpoint) {
+    if (stored.token !== cfg.token) {
         // Only on a real change: `update` re-runs install every six hours, and this
         // file is shared with the running collector's offset writes.
         updateStore(storePath(), store => {
             store.token = cfg.token;
-            store.endpoint = desiredEndpoint;
         });
     }
     console.log(header());
     console.log('');
-    console.log(step('configured', host(cfg.endpoint)));
+    console.log(step('configured', host(ENDPOINT)));
     // Windows: stop a running task first, or `schtasks /run` below is ignored (the
     // task is IgnoreNew) — leaving the OLD version resident after an "update".
     if (process.platform === 'win32') {

package/dist/store.js

@@ -45,7 +45,6 @@ export function freshWindow() {
 function normalize(raw) {
     return {
         desktopDir: raw.desktopDir,
-        endpoint: raw.endpoint,
         limits: raw.limits,
         notify: {
             fiveHour: { ...freshWindow(), ...raw.notify?.fiveHour },
@@ -86,7 +85,7 @@ export function readStore(path = storePath()) {
 }
 /**
  * Read-modify-write the store atomically. Re-reading inside the call is what
- * lets `usagefleet install` change the token while the service is mid-cycle: the
+ * lets `usagefleet login` change the token while the service is mid-cycle: the
  * service's next save picks up the new token instead of overwriting it with the
  * copy it loaded minutes ago.
  *

package/dist/update.js

@@ -94,10 +94,10 @@ export async function checkForUpdate(log, force = false) {
             : `npm install failed (exit ${code}) · if the global prefix needs root, run it yourself`);
         return null;
     }
-    // Detached: `install` rewrites the service definition and restarts it, which
+    // Detached: `login` rewrites the service definition and restarts it, which
     // kills this process tree. npm replaced the file behind `self`, so this is
     // already the new version.
-    spawn(process.execPath, [self, 'install'], { detached: true, stdio: 'ignore' }).unref();
+    spawn(process.execPath, [self, 'login'], { detached: true, stdio: 'ignore' }).unref();
     log('ok', `installed ${latest} · restarting service`);
     return latest;
 }

package/dist/uploader.js

@@ -1,3 +1,4 @@
+import { ENDPOINT } from './config.js';
 const MAX_ATTEMPTS = 6;
 const REQUEST_TIMEOUT_MS = 15_000;
 function sleep(ms) {
@@ -14,7 +15,7 @@ export async function uploadBatch(payload, cfg) {
     for (let attempt = 0; attempt <= MAX_ATTEMPTS; attempt++) {
         let res = null;
         try {
-            res = await fetch(`${cfg.endpoint}/api/v1/usage`, {
+            res = await fetch(`${ENDPOINT}/api/v1/usage`, {
                 body: JSON.stringify(payload),
                 headers: {
                     'content-type': 'application/json',
@@ -85,7 +86,7 @@ function retryAfterMs(header, fallback) {
  *  reading is worth less than the next cycle's fresh one. */
 export async function postLimits(report, cfg) {
     try {
-        const res = await fetch(`${cfg.endpoint}/api/v1/limits`, {
+        const res = await fetch(`${ENDPOINT}/api/v1/limits`, {
             body: JSON.stringify(report),
             headers: {
                 'content-type': 'application/json',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@usagefleet/cli",
-	"version": "1.2.75",
+	"version": "1.2.77",
 	"description": "Tails Claude Code, Claude Desktop, and pi agent JSONL logs and reports token usage to a UsageFleet server.",
 	"keywords": [
 		"claude",