@usagefleet/cli 1.2.80 → 1.2.82

package/README.md

@@ -16,9 +16,10 @@ usagefleet login uf_xxx
 ```
 
 Same two commands on macOS, Linux and Windows (in PowerShell chain them with
-`;` — 5.1 has no `&&`). `login` pairs the device, sets the collector to start
-with your session and writes `~/.config/usagefleet/config.json` (mode `600`).
-The dashboard fills in within a minute.
+`;` — 5.1 has no `&&`). `login` stores the token (the server checks it on the
+first report, not at login), sets the collector to start with your session and
+writes `~/.config/usagefleet/config.json` (mode `600`). The dashboard fills in
+within a minute.
 
 `login` takes the token and nothing else. The collector reports to
 `usagefleet.com` and there is no way to redirect it: the request carries your
@@ -87,7 +88,9 @@ WinRT toast via `powershell.exe`.
 
 A group can be set to **refuse new prompts** once it has burned its budget slice
 (1/N of the account limit) for a window — a switch per window on the Groups
-page, both off by default. `usagefleet login` registers a Claude Code `UserPromptSubmit` hook in
+page, both off by default. Each device also has its own blocking toggle on the
+Devices page: switched off, that machine is never refused, whatever its group
+says. `usagefleet login` registers a Claude Code `UserPromptSubmit` hook in
 `~/.claude/settings.json` (removed by `uninstall`, refreshed rather than stacked
 on re-install, and skipped entirely with `USAGEFLEET_HOOK=0`):
 

package/dist/claude-creds.js

@@ -56,7 +56,9 @@ function persist(blob, from) {
         return;
     }
     // The password must go in argv: `security`'s stdin prompt reads at most 128
-    // bytes and would silently store a truncated (unparseable) blob.
+    // bytes and would silently store a truncated (unparseable) blob. Argv is
+    // briefly visible in the process list, but only to the same user — who can
+    // read the Keychain item anyway. Accepted.
     execFileSync('security', ['add-generic-password', '-U', '-s', KEYCHAIN_SERVICE, '-a', userInfo().username, '-w', json], { stdio: 'ignore' });
     // Trust nothing: a partial write here means a broken Claude Code login.
     const stored = execFileSync('security', ['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w'], {

package/dist/claude-limits.js

@@ -21,7 +21,9 @@ export function parseReset(v) {
 /** Per-model utilization header: `anthropic-ratelimit-unified-<window>-<model>-utilization`
  *  (the account-wide headers have no `<model>` segment and don't match). */
 const MODEL_UTIL_RE = /^anthropic-ratelimit-unified-(\d+[hdwm])-([a-z0-9][a-z0-9_.-]*)-utilization$/;
-export function parseLimitsHeaders(source, get, names = []) {
+// Always reports source 'api': subscription logins never touch the header
+// path (see fetchLimits), so headers can only come from an API-key ping.
+export function parseLimitsHeaders(get, names = []) {
     const modelLimits = [];
     for (const raw of names) {
         const m = raw.toLowerCase().match(MODEL_UTIL_RE);
@@ -42,15 +44,17 @@ export function parseLimitsHeaders(source, get, names = []) {
         modelLimits,
         sevenDayPct: parsePct(get('anthropic-ratelimit-unified-7d-utilization')),
         sevenDayResetsAt: parseReset(get('anthropic-ratelimit-unified-7d-reset')),
-        source,
+        source: 'api',
     };
 }
 const OAUTH_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
 /**
  * The OAuth usage endpoint Claude Code queries for /usage — the source of both
  * the per-model caps its UI shows ("Fable · 24% used") and the account-wide
- * numbers we trust over the response headers. Undocumented — parse defensively
- * and return null on any surprise.
+ * numbers, the ONLY limits source for subscription logins. Undocumented —
+ * parse defensively, but keep failure causes apart: an HTTP error names its
+ * status (401/403 reads as "token expired, open Claude Code to refresh",
+ * anything else as an outage to wait out), junk JSON returns null.
  */
 async function fetchOauthUsage(token) {
     const res = await fetch(OAUTH_USAGE_URL, {
@@ -62,7 +66,10 @@ async function fetchOauthUsage(token) {
         signal: AbortSignal.timeout(15_000),
     });
     if (!res.ok) {
-        return null;
+        const hint = res.status === 401 || res.status === 403
+            ? 'Claude OAuth token expired or revoked · open Claude Code to refresh it'
+            : 'transient? retrying next cycle';
+        throw new Error(`oauth/usage HTTP ${res.status} · ${hint}`);
     }
     const body = await res.json().catch(() => null);
     if (process.env.USAGEFLEET_DEBUG_HEADERS) {
@@ -72,11 +79,10 @@ async function fetchOauthUsage(token) {
 }
 /**
  * Account-wide 5h/7d numbers from an oauth/usage payload: percentages
- * (`{utilization: 14}`), exactly what Claude's /usage screen shows.
- *
- * These beat the `-utilization` response headers, which now carry a 0–1
- * fraction (`0.13` for 13% used). Missing fields stay null so the header
- * values survive.
+ * (`{utilization: 14}`), exactly what Claude's /usage screen shows — unlike
+ * the `-utilization` response headers, which now carry a 0–1 fraction on sub
+ * accounts. Missing fields stay null so `oauthLimitsReport` can tell an empty
+ * payload from a real one and skip the cycle.
  */
 export function parseOauthAccount(body) {
     const root = (typeof body === 'object' && body !== null ? body : {});
@@ -125,7 +131,7 @@ function modelKeyOf(name) {
  * `{kind: "weekly_scoped", group: "weekly", percent, resets_at,
  * scope: {model: {display_name: "Fable"}}}`) are exactly the per-model bars
  * Claude's own UI renders. Account-wide entries have `scope: null` and are
- * skipped (the header ping covers them).
+ * skipped (`parseOauthAccount` reads those from `five_hour`/`seven_day`).
  *
  * Fallback: legacy top-level `seven_day_<model>` objects with a `utilization`
  * number (all null on current accounts, but cheap to keep).
@@ -151,7 +157,7 @@ export function parseOauthUsage(body) {
             if (!name || typeof l.percent !== 'number') {
                 continue;
             }
-            const window = l.group === 'session' ? '5h' : l.group === 'weekly' ? '7d' : '7d';
+            const window = l.group === 'session' ? '5h' : '7d';
             const key = modelKeyOf(name);
             out.push({
                 model: key,
@@ -186,7 +192,7 @@ export function parseOauthUsage(body) {
 }
 /** Assemble a full LimitsReport from an oauth/usage payload, or null when the
  *  payload carries no account-wide percentage (endpoint down, shape changed) —
- *  the caller then falls back to the header ping. */
+ *  the caller then skips this cycle rather than report degraded numbers. */
 export function oauthLimitsReport(body) {
     const account = parseOauthAccount(body);
     if (account.fiveHourPct == null && account.sevenDayPct == null) {
@@ -197,36 +203,26 @@ export function oauthLimitsReport(body) {
 /**
  * Read the account's real rate-limit utilization.
  *
- * Subscription logins ask the free OAuth usage endpoint first — it returns the
- * exact numbers Claude's own /usage screen shows (account-wide AND per-model)
- * and costs no tokens, so it can be polled often. Only when it yields nothing
- * (or for API keys, which can't call it) does this fall back to a 1-token ping
- * to the Messages API, whose response headers carry the unified utilization
- * (same approach as Claude-Usage-Tracker's OAuth path).
+ * Subscription logins use the free OAuth usage endpoint, and ONLY it — the
+ * exact numbers Claude's own /usage screen shows (account-wide AND per-model),
+ * no tokens spent. When it yields nothing, this throws instead of falling back
+ * to the Messages-API ping: on sub accounts those `-utilization` headers now
+ * carry a 0–1 fraction that parsePct reads 100× low, and one such POST would
+ * overwrite the server's last-good percentages for the whole account. Skipping
+ * the cycle keeps last-good everywhere (the guard has its own staleness rule).
+ *
+ * API keys can't call oauth/usage; their headers still read 0–100, so they
+ * keep the 1-token header ping (same approach as Claude-Usage-Tracker).
  */
 export async function fetchLimits(creds) {
     if (creds.source === 'sub') {
-        try {
-            const report = oauthLimitsReport(await fetchOauthUsage(creds.token));
-            if (report) {
-                return report;
-            }
-        }
-        catch {
-            /* fall through to the header ping */
+        // fetchOauthUsage already threw on an HTTP error with its status; reaching
+        // here with no report means a 200 whose body carried no percentages.
+        const report = oauthLimitsReport(await fetchOauthUsage(creds.token));
+        if (!report) {
+            throw new Error('oauth/usage answered without percentages · shape changed? keeping last-good');
         }
-    }
-    const headers = {
-        'anthropic-version': '2023-06-01',
-        'content-type': 'application/json',
-    };
-    if (creds.source === 'sub') {
-        headers['authorization'] = `Bearer ${creds.token}`;
-        headers['anthropic-beta'] = 'oauth-2025-04-20';
-        headers['user-agent'] = 'claude-code/2.1.5 (usagefleet)';
-    }
-    else {
-        headers['x-api-key'] = creds.token;
+        return report;
     }
     const res = await fetch(MESSAGES_URL, {
         body: JSON.stringify({
@@ -234,13 +230,17 @@ export async function fetchLimits(creds) {
             messages: [{ role: 'user', content: 'hi' }],
             model: 'claude-haiku-4-5-20251001',
         }),
-        headers,
+        headers: {
+            'anthropic-version': '2023-06-01',
+            'content-type': 'application/json',
+            'x-api-key': creds.token,
+        },
         method: 'POST',
         signal: AbortSignal.timeout(15_000),
     });
     // The unified rate-limit headers are (historically) present on success AND
-    // error responses — this OAuth/header-scraping path against the public
-    // Messages endpoint is undocumented and may break without notice. If a
+    // error responses — this header-scraping path against the public Messages
+    // endpoint is undocumented and may break without notice. If a
     // rejected response ALSO lacks the headers, the feature is unavailable; throw
     // so the caller logs it instead of POSTing an all-null report silently.
     // Diagnostic: dump every rate-limit header so unrecognized per-model names
@@ -252,7 +252,7 @@ export async function fetchLimits(creds) {
             }
         }
     }
-    const report = parseLimitsHeaders(creds.source, n => res.headers.get(n), res.headers.keys());
+    const report = parseLimitsHeaders(n => res.headers.get(n), res.headers.keys());
     const gotHeaders = report.fiveHourPct != null ||
         report.sevenDayPct != null ||
         report.fiveHourResetsAt != null ||

package/dist/collector.js

@@ -213,9 +213,10 @@ function planWall() {
     return `device outside your plan's device limit · free a slot or upgrade at ${ENDPOINT}/devices · nothing is lost, uploads resume once it fits`;
 }
 /**
- * Auto-detect the local Claude login, read the real 5h/weekly utilization from
- * Anthropic's rate-limit headers, and report it to the server. Best-effort —
- * returns null (and logs) when no login is found or the request fails.
+ * Auto-detect the local Claude login, read the real 5h/weekly utilization
+ * (oauth/usage for subscription logins, rate-limit headers for API keys), and
+ * report it to the server. Best-effort — returns null (and logs) when no login
+ * is found or the request fails.
  */
 export async function reportLimitsOnce(cfg, log = () => {
     /* empty */

package/dist/config.js

@@ -41,8 +41,8 @@ export function resolvePiDirs(env, fromFile) {
     }
     return [...new Set(raw.map(d => d.trim()).filter(d => d.length > 0))];
 }
-/** Optional scan root (USAGEFLEET_DESKTOP / USAGEFLEET_PI): env "off"/"0"
- *  disables, env or config-file path overrides, else the auto-detected default. */
+/** Optional scan root (USAGEFLEET_DESKTOP): env "off"/"0" disables, env or
+ *  config-file path overrides, else the auto-detected default. */
 function resolveOptionalDir(env, fromFile, fallback) {
     if (env === '0' || env?.toLowerCase() === 'off') {
         return null;

package/dist/notifier.js

@@ -46,10 +46,8 @@ export function evaluateWindow(prev, pct, resetsAt, thresholds) {
     if (top > lastBucket) {
         return { fire: top, next: { lastBucket: top, resetsAt } };
     }
-    if (top < lastBucket) {
-        return { fire: null, next: { lastBucket: top, resetsAt } };
-    }
-    return { fire: null, next: { lastBucket, resetsAt } };
+    // top <= lastBucket: the mark follows pct down (or holds); nothing fires.
+    return { fire: null, next: { lastBucket: top, resetsAt } };
 }
 /** Relative "resets in 12m" / "resets in 2h" suffix, or "" if unknown/past. */
 function resetSuffix(resetsAt) {

package/dist/paths.js

@@ -1,7 +1,10 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+// USAGEFLEET_PROJECTS is resolved in config.ts's precedence chain, not here —
+// a second env read (with `??` vs `||` drift) once made an empty env var
+// silently scan nothing.
 export function defaultProjectsDir() {
-    return process.env.USAGEFLEET_PROJECTS ?? join(homedir(), '.claude', 'projects');
+    return join(homedir(), '.claude', 'projects');
 }
 /** Claude Desktop's Electron userData dir, per-OS. Mirrors the app's own
  *  `app.getPath("userData")` (= platform appData + the "Claude" product name),

package/dist/release.js

@@ -1,2 +1,2 @@
 // Generated by .github/workflows/release.yml.
-export const RELEASE_VERSION = "1.2.80";
+export const RELEASE_VERSION = "1.2.82";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@usagefleet/cli",
-	"version": "1.2.80",
+	"version": "1.2.82",
 	"description": "Tails Claude Code, Claude Desktop, and pi agent JSONL logs and reports token usage to a UsageFleet server.",
 	"keywords": [
 		"claude",