@vantran-se/openchamber-web 2.1.1 → 2.2.0

package/server/lib/quota/providers/kimi.test.js

@@ -12,9 +12,11 @@ const mockResponse = (body, init = {}) => ({
 });
 
 describe('Kimi for Coding quota provider', () => {
-  it('computes weekly usedPercent from the used field (live API shape, no remaining field)', async () => {
-    // Captured from GET https://api.kimi.com/coding/v1/usages — the weekly
-    // `usage` block only ever includes `used`, never `remaining`.
+  it('computes weekly usedPercent from the used field (pre-migration payload, no remaining field)', async () => {
+    // Captured from GET https://api.kimi.com/coding/v1/usages before Kimi
+    // migrated plans to the ratio-based `usages` map. Plans that have not
+    // migrated still answer this way: the weekly `usage` block only ever
+    // includes `used`, never `remaining`.
     const fetchImpl = async () => (
       mockResponse({
         usage: { limit: '100', used: '100', resetTime: '2026-08-04T06:21:48.514003Z' },
@@ -103,6 +105,129 @@ describe('Kimi for Coding quota provider', () => {
     expect(result.error).toBe('API error: 401');
   });
 
+  it('shows the pay-as-you-go balance when the Kimi Code address refuses a platform key', async () => {
+    const urls = [];
+    const fetchImpl = async (url, init) => {
+      urls.push({ url, authorization: init.headers.Authorization });
+      return url === 'https://api.moonshot.ai/v1/users/me/balance'
+        ? Response.json({ code: 0, data: { available_balance: 12.345 }, status: true })
+        : new Response('{}', { status: 401 });
+    };
+
+    const result = await fetchQuota({ readAuth, fetchImpl });
+
+    expect(urls.map((call) => call.url)).toEqual([
+      'https://api.kimi.com/coding/v1/usages',
+      'https://api.moonshot.ai/v1/users/me/balance',
+    ]);
+    expect(urls[1].authorization).toBe('Bearer test-token');
+    expect(result.ok).toBe(true);
+    expect(result.providerId).toBe('kimi-for-coding');
+    expect(result.providerName).toBe('Kimi for Coding');
+    expect(result.usage.windows.credits_balance.valueLabel).toBe('$12.35');
+  });
+
+  it('keeps the original 401 when the balance read fails too', async () => {
+    const urls = [];
+    const fetchImpl = async (url) => {
+      urls.push(url);
+      return new Response('{}', { status: 401 });
+    };
+
+    const result = await fetchQuota({ readAuth, fetchImpl });
+
+    expect(urls).toEqual(['https://api.kimi.com/coding/v1/usages', 'https://api.moonshot.ai/v1/users/me/balance']);
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe('API error: 401');
+  });
+
+  it('treats a 403 from the Kimi Code address like a 401', async () => {
+    const fetchImpl = async (url) => (
+      url === 'https://api.moonshot.ai/v1/users/me/balance'
+        ? Response.json({ data: { available_balance: 5 } })
+        : new Response('{}', { status: 403 })
+    );
+
+    const result = await fetchQuota({ readAuth, fetchImpl });
+
+    expect(result.ok).toBe(true);
+    expect(result.usage.windows.credits_balance.valueLabel).toBe('$5.00');
+  });
+
+  it('does not try the balance address for errors other than authorisation', async () => {
+    const urls = [];
+    const fetchImpl = async (url) => {
+      urls.push(url);
+      return new Response('{}', { status: 500 });
+    };
+
+    const result = await fetchQuota({ readAuth, fetchImpl });
+
+    expect(urls).toEqual(['https://api.kimi.com/coding/v1/usages']);
+    expect(result.error).toBe('API error: 500');
+  });
+
+  describe('ratio-based usages payload', () => {
+    // Captured live from GET https://api.kimi.com/coding/v1/usages on
+    // 2026-10-08. Migrated plans answer with a ratio-based `usages` map instead
+    // of the counted `usage` block, and keep a coarser `limits[]` entry for the
+    // same 5-hour window. `limit_month_code` is the code-typed share of
+    // `limit_month_total`, not a second allowance, and is not shown.
+    const migratedPlan = {
+      limits: [{
+        window: { duration: 300, timeUnit: 'TIME_UNIT_MINUTE' },
+        detail: { limit: '100', used: '50', remaining: '50', resetTime: '2026-10-08T11:50:22.234058Z' },
+      }],
+      usages: {
+        limit_5h: { used_ratio: 0.495422, reset_time: '2026-10-08T11:50:22Z' },
+        limit_month_total: { used_ratio: 0.2636, reset_time: '2026-10-18T00:00:00Z' },
+        limit_month_code: { used_ratio: 0.1907, reset_time: '2026-10-18T00:00:00Z' },
+      },
+    };
+
+    const run = (body) => fetchQuota({ readAuth, fetchImpl: async () => mockResponse(body) });
+
+    it('reads the 5h and monthly ratios and ignores the duplicate limits[] entry', async () => {
+      const result = await run(migratedPlan);
+
+      expect(result.ok).toBe(true);
+      expect(Object.keys(result.usage.windows)).toEqual(['5h', 'monthly']);
+      expect(result.usage.windows['5h'].usedPercent).toBeCloseTo(49.5422, 9);
+      expect(result.usage.windows['5h'].windowSeconds).toBe(18000);
+      expect(result.usage.windows['5h'].resetAt).toBe(Date.parse('2026-10-08T11:50:22Z'));
+    });
+
+    it('reports the monthly row as a plain percent so it follows the used/remaining setting', async () => {
+      const result = await run(migratedPlan);
+
+      expect(result.usage.windows.monthly.usedPercent).toBeCloseTo(26.36, 9);
+      expect(result.usage.windows.monthly.remainingPercent).toBeCloseTo(73.64, 9);
+      expect(result.usage.windows.monthly.valueLabel).toBeUndefined();
+      expect(result.usage.windows.monthly.windowSeconds).toBeNull();
+      expect(result.usage.windows.monthly.resetAt).toBe(Date.parse('2026-10-18T00:00:00Z'));
+    });
+
+    it('maps limit_7d to the weekly window when the plan still serves it', async () => {
+      const result = await run({ usages: { limit_7d: { used_ratio: 0.25, reset_time: null } } });
+
+      expect(result.usage.windows.weekly.usedPercent).toBe(25);
+      expect(result.usage.windows.weekly.windowSeconds).toBe(604800);
+      expect(result.usage.windows.weekly.valueLabel).toBeUndefined();
+    });
+
+    it('keeps a zero ratio and skips an entry without one', async () => {
+      const result = await run({
+        usages: {
+          limit_5h: { used_ratio: 0, reset_time: null },
+          limit_month_total: { used_ratio: 'not-a-number', reset_time: null }
+        }
+      });
+
+      expect(result.usage.windows['5h'].usedPercent).toBe(0);
+      expect(Object.keys(result.usage.windows)).toEqual(['5h']);
+    });
+  });
+
   describe('credential lookup', () => {
     const sentKey = async (auth) => {
       let authorization;

package/server/lib/quota/providers/opencode-go.js

@@ -1,31 +1,94 @@
 import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import { deleteLegacyOpenCodeGoCredential } from '../credentials/store.js';
-import { buildResult, getAuthEntry, normalizeAuthEntry, toUsageWindow } from '../utils/index.js';
+import {
+  asNonEmptyString,
+  asObject,
+  buildResult,
+  getAuthEntry,
+  normalizeAuthEntry,
+  toNumber,
+  toTimestamp,
+  toUsageWindow,
+} from '../utils/index.js';
 
 export const providerId = 'opencode-go';
 export const providerName = 'OpenCode Go';
-export const aliases = ['opencode-go'];
+const aliases = ['opencode-go'];
 
-const windowsByApiKey = {
+// OpenCode Go has two credential shapes. A service-account key stored under the
+// `opencode-go` integration uses the legacy usage API. A Console sign-in lives
+// on the shared `opencode` integration and its OAuth access token is not
+// interchangeable with that key, so it uses the Console Go status endpoint.
+const API_KEY_USAGE_URL = 'https://opencode.ai/zen/go/v1/usage';
+const CONSOLE_STATUS_URL = 'https://opencode.ai/console/api/go/status';
+const CONSOLE_SERVER = 'https://opencode.ai/console';
+const CONSOLE_INTEGRATION_ID = 'opencode';
+const ORGANIZATION_ID_PATTERN = /^org_[A-Za-z0-9]+$/;
+const CONSOLE_PRODUCTS = new Set(['go', 'go-plus']);
+const REQUEST_TIMEOUT_MS = 15_000;
+
+const API_KEY_WINDOW_FIELDS = {
   '5h': 'rolling',
   weekly: 'weekly',
   monthly: 'monthly',
 };
 
+// The Console page meters. `week` maps to the existing `weekly` window key the
+// UI already labels, matching the API-key path.
+const CONSOLE_WINDOW_METERS = {
+  '5h': 'fiveHour',
+  weekly: 'week',
+  monthly: 'month',
+};
+
+const clampPercent = (value) => Math.min(100, Math.max(0, value));
+
 export const parseOpenCodeGoUsage = (payload) => {
-  const usage = payload && typeof payload === 'object' ? payload.usage : null;
-  if (!usage || typeof usage !== 'object') return {};
+  const usage = asObject(payload) ? asObject(payload.usage) : null;
+  if (!usage) return {};
   const windows = {};
-  for (const [key, apiKey] of Object.entries(windowsByApiKey)) {
-    const entry = usage[apiKey];
-    if (!entry || typeof entry !== 'object') continue;
-    const usedPercent = entry.percent;
-    const resetAt = entry.resetsAt;
-    if (typeof usedPercent !== 'number' || !Number.isFinite(usedPercent)) continue;
-    if (typeof resetAt !== 'string' || !Number.isFinite(new Date(resetAt).getTime())) continue;
+  for (const [key, field] of Object.entries(API_KEY_WINDOW_FIELDS)) {
+    const entry = asObject(usage[field]);
+    if (!entry) continue;
+    const usedPercent = toNumber(entry.percent);
+    const resetAt = toTimestamp(entry.resetsAt);
+    if (usedPercent === null || resetAt === null) continue;
     windows[key] = toUsageWindow({
-      usedPercent: Math.min(100, Math.max(0, usedPercent)),
-      resetAt: new Date(resetAt).getTime(),
+      usedPercent: clampPercent(usedPercent),
+      resetAt,
+      windowSeconds: null,
+    });
+  }
+  return windows;
+};
+
+/**
+ * The Console meters report integer micro-cents as decimal strings. A missing,
+ * negative, or unparseable amount is not usable data, and a zero limit would
+ * divide by zero, so each is rejected on its own without discarding the other
+ * windows.
+ */
+const toMicroCents = (value) => {
+  const amount = toNumber(value);
+  if (amount === null || amount < 0) return null;
+  return amount;
+};
+
+export const parseConsoleGoUsage = (payload) => {
+  const access = asObject(payload) ? asObject(payload.access) : null;
+  const meters = access ? asObject(access.meters) : null;
+  if (!meters) return {};
+  const windows = {};
+  for (const [key, meterName] of Object.entries(CONSOLE_WINDOW_METERS)) {
+    const meter = asObject(meters[meterName]);
+    if (!meter) continue;
+    const limit = toMicroCents(meter.limitMicroCents);
+    const used = toMicroCents(meter.usedMicroCents);
+    const resetAt = toTimestamp(meter.resetsAt);
+    if (limit === null || limit <= 0 || used === null || resetAt === null) continue;
+    windows[key] = toUsageWindow({
+      usedPercent: clampPercent((used / limit) * 100),
+      resetAt,
       windowSeconds: null,
     });
   }
@@ -33,14 +96,14 @@ export const parseOpenCodeGoUsage = (payload) => {
 };
 
 export const fetchOpenCodeGoUsage = async (apiKey, fetchImpl = fetch) => {
-  const response = await fetchImpl('https://opencode.ai/zen/go/v1/usage', {
+  const response = await fetchImpl(API_KEY_USAGE_URL, {
     headers: {
       Accept: 'application/json',
       Authorization: `Bearer ${apiKey}`,
       'x-opencode-session': 'openchamber-usage',
       'User-Agent': 'OpenChamber quota provider',
     },
-    signal: AbortSignal.timeout(15_000),
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
   });
   if (response.status === 401 || response.status === 403) {
     throw new Error('OpenCode Go authentication failed');
@@ -51,19 +114,79 @@ export const fetchOpenCodeGoUsage = async (apiKey, fetchImpl = fetch) => {
   return windows;
 };
 
+export const fetchConsoleGoUsage = async ({ access, orgID, expires }, fetchImpl = fetch) => {
+  if (expires !== null && expires > 0 && expires <= Date.now()) {
+    throw new Error('OpenCode Console sign-in expired. Sign in again in Providers.');
+  }
+  const response = await fetchImpl(CONSOLE_STATUS_URL, {
+    headers: {
+      Accept: 'application/json',
+      Authorization: `Bearer ${access}`,
+      'x-org-id': orgID,
+      'User-Agent': 'OpenChamber quota provider',
+    },
+    // The bearer token belongs to opencode.ai/console; never follow a redirect
+    // that would forward it to another origin.
+    redirect: 'error',
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (response.status === 401 || response.status === 403) {
+    throw new Error('OpenCode Console sign-in expired. Sign in again in Providers.');
+  }
+  if (!response.ok) throw new Error(`OpenCode Console Go status API returned HTTP ${response.status}`);
+  const payload = await response.json().catch(() => null);
+  if (!asObject(payload)) throw new Error('OpenCode Console Go status returned an unreadable response');
+  if (!CONSOLE_PRODUCTS.has(payload.product)) {
+    throw new Error('No active OpenCode Go subscription on the selected Console account');
+  }
+  const windows = parseConsoleGoUsage(payload);
+  if (Object.keys(windows).length === 0) throw new Error('OpenCode Go usage data could not be parsed');
+  return windows;
+};
+
 const getApiKey = (auth) => {
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
-  return entry?.key ?? entry?.token ?? null;
+  return asNonEmptyString(entry?.key) ?? asNonEmptyString(entry?.token);
+};
+
+/**
+ * The active OpenCode Console OAuth credential, only when it is a Console
+ * sign-in (`server` is the Console origin and an organization is selected).
+ * OpenCode marks exactly one credential active per integration and credentials
+ * are global, so this is the selected account and organization; reading it per
+ * call follows a switch instead of caching the previous account.
+ */
+const getConsoleCredential = (auth) => {
+  const entry = normalizeAuthEntry(getAuthEntry(auth, [CONSOLE_INTEGRATION_ID]));
+  if (!entry || entry.type !== 'oauth') return null;
+  const access = asNonEmptyString(entry.access);
+  const orgID = asNonEmptyString(entry.orgID);
+  if (!access || entry.server !== CONSOLE_SERVER || !orgID || !ORGANIZATION_ID_PATTERN.test(orgID)) return null;
+  const expires = toNumber(entry.expires);
+  return { access, orgID, expires };
 };
 
-export const isConfigured = (auth) => Boolean(getApiKey(auth));
+export const isConfigured = (auth) => Boolean(getConsoleCredential(auth) || getApiKey(auth));
 
-export const fetchQuota = async () => {
+export const fetchQuota = async ({ readAuth = readOpenCodeCredentials, fetchImpl = fetch } = {}) => {
   try {
     deleteLegacyOpenCodeGoCredential();
-    const apiKey = getApiKey(await readOpenCodeCredentials());
+    const auth = await readAuth();
+    // A Console sign-in serves OpenCode Go once it exists; the `opencode-go`
+    // service key is the fallback for accounts without one, and for a Console
+    // read that fails (no Go in that org, an endpoint change, a hiccup).
+    const consoleCredential = getConsoleCredential(auth);
+    const apiKey = getApiKey(auth);
+    if (consoleCredential) {
+      try {
+        const windows = await fetchConsoleGoUsage(consoleCredential, fetchImpl);
+        return buildResult({ providerId, providerName, ok: true, configured: true, usage: { windows } });
+      } catch (consoleError) {
+        if (!apiKey) throw consoleError;
+      }
+    }
     if (!apiKey) return buildResult({ providerId, providerName, ok: false, configured: false, error: 'Not configured' });
-    const windows = await fetchOpenCodeGoUsage(apiKey);
+    const windows = await fetchOpenCodeGoUsage(apiKey, fetchImpl);
     return buildResult({ providerId, providerName, ok: true, configured: true, usage: { windows } });
   } catch (error) {
     return buildResult({ providerId, providerName, ok: false, configured: true, error: error instanceof Error ? error.message : 'Request failed' });

package/server/lib/quota/providers/opencode-go.test.js

@@ -7,11 +7,16 @@ const previousDataDirectory = process.env.OPENCHAMBER_DATA_DIR;
 const temporaryDataDirectory = fs.mkdtempSync(path.join(os.tmpdir(), 'openchamber-opencode-go-'));
 process.env.OPENCHAMBER_DATA_DIR = temporaryDataDirectory;
 
-vi.mock('../../opencode/auth.js', () => ({
-  readOpenCodeCredentials: async () => ({ 'opencode-go': { key: 'test-key' } }),
-}));
+import {
+  fetchConsoleGoUsage,
+  fetchOpenCodeGoUsage,
+  fetchQuota,
+  isConfigured,
+  parseConsoleGoUsage,
+  parseOpenCodeGoUsage,
+} from './opencode-go.js';
 
-import { fetchOpenCodeGoUsage, fetchQuota, parseOpenCodeGoUsage } from './opencode-go.js';
+const apiKeyAuth = () => ({ 'opencode-go': { key: 'test-key' } });
 
 afterEach(() => {
   vi.unstubAllGlobals();
@@ -23,7 +28,33 @@ afterAll(() => {
   fs.rmSync(temporaryDataDirectory, { recursive: true, force: true });
 });
 
-describe('OpenCode Go quota provider', () => {
+const CONSOLE_SERVER = 'https://opencode.ai/console';
+const CONSOLE_STATUS_URL = `${CONSOLE_SERVER}/api/go/status`;
+
+const consoleAuth = (overrides = {}) => ({
+  opencode: {
+    type: 'oauth',
+    access: 'console-access',
+    refresh: 'console-refresh',
+    expires: Date.now() + 3_600_000,
+    server: CONSOLE_SERVER,
+    orgID: 'org_TESTORG123',
+    ...overrides,
+  },
+});
+
+const consolePayload = ({ product = 'go', meters } = {}) => ({
+  product,
+  access: {
+    meters: meters ?? {
+      fiveHour: { resetsAt: '2026-08-12T12:00:00.000Z', limitMicroCents: '1000000000', usedMicroCents: '250000000' },
+      week: { resetsAt: '2026-08-19T12:00:00.000Z', limitMicroCents: '2000000000', usedMicroCents: '800000000' },
+      month: { resetsAt: '2026-09-01T00:00:00.000Z', limitMicroCents: '6000000000', usedMicroCents: '3000000000' },
+    },
+  },
+});
+
+describe('OpenCode Go quota provider — legacy API key', () => {
   it('parses partial API usage windows', () => {
     const windows = parseOpenCodeGoUsage({ usage: { rolling: { percent: 25, resetsAt: '2026-08-12T12:00:00.000Z' }, weekly: { percent: 40, resetsAt: '2026-08-19T12:00:00.000Z' } } });
     expect(windows['5h'].usedPercent).toBe(25);
@@ -83,9 +114,201 @@ describe('OpenCode Go quota provider', () => {
     fs.writeFileSync(legacyPath, '{not valid json', { mode: 0o600 });
     const fetchMock = vi.fn().mockResolvedValue(new Response(JSON.stringify({ usage: { rolling: { percent: 25, resetsAt: '2026-08-12T12:00:00.000Z' } } })));
     vi.stubGlobal('fetch', fetchMock);
-    const result = await fetchQuota();
+    const result = await fetchQuota({ readAuth: async () => apiKeyAuth() });
     expect(result).toMatchObject({ providerId: 'opencode-go', ok: true, configured: true });
     expect(fetchMock.mock.calls[0][1].headers.Authorization).toBe('Bearer test-key');
     expect(fs.existsSync(legacyPath)).toBe(false);
   });
+
+  it('still uses the API-key path when the Console integration is not a Console sign-in', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(new Response(JSON.stringify({ usage: { rolling: { percent: 10, resetsAt: '2026-08-12T12:00:00.000Z' } } })));
+    const result = await fetchQuota({
+      readAuth: async () => ({
+        ...consoleAuth({ server: 'https://example.com/console' }),
+        'opencode-go': { key: 'test-key' },
+      }),
+      fetchImpl,
+    });
+    expect(result.ok).toBe(true);
+    expect(fetchImpl.mock.calls[0][0]).toBe('https://opencode.ai/zen/go/v1/usage');
+  });
+});
+
+describe('OpenCode Go quota provider — Console OAuth', () => {
+  it('maps fiveHour, week, and month to the existing windows from decimal strings', () => {
+    const windows = parseConsoleGoUsage(consolePayload());
+    expect(Object.keys(windows)).toEqual(['5h', 'weekly', 'monthly']);
+    expect(windows['5h'].usedPercent).toBe(25);
+    expect(windows.weekly.usedPercent).toBe(40);
+    expect(windows.monthly.usedPercent).toBe(50);
+    expect(windows['5h'].resetAt).toBe(Date.parse('2026-08-12T12:00:00.000Z'));
+  });
+
+  it('supports Go Plus', async () => {
+    const result = await fetchQuota({
+      readAuth: async () => consoleAuth(),
+      fetchImpl: async () => new Response(JSON.stringify(consolePayload({ product: 'go-plus' }))),
+    });
+    expect(result.ok).toBe(true);
+    expect(result.usage.windows['5h'].usedPercent).toBe(25);
+  });
+
+  it('skips only the unusable meters and keeps the rest', () => {
+    const windows = parseConsoleGoUsage(consolePayload({ meters: {
+      fiveHour: { resetsAt: '2026-08-12T12:00:00.000Z', limitMicroCents: '0', usedMicroCents: '10' },
+      week: { resetsAt: '2026-08-19T12:00:00.000Z', limitMicroCents: 'not-a-number', usedMicroCents: '10' },
+      month: { resetsAt: '2026-09-01T00:00:00.000Z', limitMicroCents: '1000', usedMicroCents: '250' },
+    } }));
+    expect(Object.keys(windows)).toEqual(['monthly']);
+    expect(windows.monthly.usedPercent).toBe(25);
+  });
+
+  it('skips a window with an invalid reset timestamp and handles missing meters', () => {
+    const windows = parseConsoleGoUsage(consolePayload({ meters: {
+      fiveHour: { resetsAt: 'not-a-date', limitMicroCents: '1000', usedMicroCents: '250' },
+      week: { resetsAt: '2026-08-19T12:00:00.000Z', limitMicroCents: '1000', usedMicroCents: '250' },
+    } }));
+    expect(Object.keys(windows)).toEqual(['weekly']);
+    expect(parseConsoleGoUsage({ product: 'go', access: {} })).toEqual({});
+    expect(parseConsoleGoUsage(null)).toEqual({});
+  });
+
+  it('calls the Console Go status endpoint with the Console token and organization', async () => {
+    let request;
+    const windows = await fetchConsoleGoUsage(
+      { access: 'console-access', orgID: 'org_TESTORG123', expires: Date.now() + 60_000 },
+      async (url, options) => {
+        request = { url, options };
+        return new Response(JSON.stringify(consolePayload()));
+      },
+    );
+    expect(request.url).toBe(CONSOLE_STATUS_URL);
+    expect(request.options.headers).toMatchObject({
+      Accept: 'application/json',
+      Authorization: 'Bearer console-access',
+      'x-org-id': 'org_TESTORG123',
+    });
+    expect(request.options.headers['x-opencode-session']).toBeUndefined();
+    expect(request.options.redirect).toBe('error');
+    expect(windows.weekly.usedPercent).toBe(40);
+  });
+
+  it('prefers the selected Console account and organization over the legacy key', async () => {
+    const fetchImpl = vi.fn().mockResolvedValue(new Response(JSON.stringify(consolePayload())));
+    const result = await fetchQuota({
+      readAuth: async () => ({ ...consoleAuth(), 'opencode-go': { key: 'stale-key' } }),
+      fetchImpl,
+    });
+    expect(result.ok).toBe(true);
+    expect(fetchImpl.mock.calls[0][0]).toBe(CONSOLE_STATUS_URL);
+    expect(fetchImpl.mock.calls[0][1].headers['x-org-id']).toBe('org_TESTORG123');
+  });
+
+  it('falls back to the legacy key when the Console read fails', async () => {
+    const fetchImpl = vi.fn(async (url) => (url === CONSOLE_STATUS_URL
+      ? new Response(JSON.stringify(consolePayload({ product: 'zen' })))
+      : new Response(JSON.stringify({ usage: { rolling: { percent: 10, resetsAt: '2026-08-12T12:00:00.000Z' } } }))));
+    const result = await fetchQuota({
+      readAuth: async () => ({ ...consoleAuth(), 'opencode-go': { key: 'test-key' } }),
+      fetchImpl,
+    });
+    expect(result.ok).toBe(true);
+    expect(result.usage.windows['5h'].usedPercent).toBe(10);
+    expect(fetchImpl.mock.calls.map((call) => call[0])).toEqual([CONSOLE_STATUS_URL, 'https://opencode.ai/zen/go/v1/usage']);
+  });
+
+  it('reports the Console error when there is no key to fall back to', async () => {
+    const result = await fetchQuota({
+      readAuth: async () => consoleAuth(),
+      fetchImpl: async () => new Response(JSON.stringify(consolePayload({ product: 'zen' }))),
+    });
+    expect(result.ok).toBe(false);
+    expect(result.configured).toBe(true);
+  });
+
+  it('reports an unconfigured provider without requesting', async () => {
+    const fetchImpl = vi.fn();
+    const result = await fetchQuota({ readAuth: async () => ({}), fetchImpl });
+    expect(result).toEqual(expect.objectContaining({ ok: false, configured: false, error: 'Not configured' }));
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('reports an unconfigured provider when the Console sign-in is for another server or has no organization', async () => {
+    expect(isConfigured(consoleAuth({ server: 'https://example.com/console' }))).toBe(false);
+    expect(isConfigured(consoleAuth({ orgID: 'not-an-org' }))).toBe(false);
+    expect(isConfigured(consoleAuth())).toBe(true);
+    expect(isConfigured({ 'opencode-go': { key: 'test-key' } })).toBe(true);
+  });
+
+  it('distinguishes an expired sign-in without sending the stale token', async () => {
+    const fetchImpl = vi.fn();
+    const result = await fetchQuota({
+      readAuth: async () => consoleAuth({ expires: Date.now() - 1_000 }),
+      fetchImpl,
+    });
+    expect(fetchImpl).not.toHaveBeenCalled();
+    expect(result.configured).toBe(true);
+    expect(result.error).toMatch(/sign-in expired/i);
+  });
+
+  it('surfaces a 401 as an expired sign-in', async () => {
+    const result = await fetchQuota({
+      readAuth: async () => consoleAuth(),
+      fetchImpl: async () => new Response('', { status: 401 }),
+    });
+    expect(result.configured).toBe(true);
+    expect(result.error).toMatch(/sign-in expired/i);
+  });
+
+  it('distinguishes an absent subscription from a malformed response', async () => {
+    const absent = await fetchQuota({
+      readAuth: async () => consoleAuth(),
+      fetchImpl: async () => new Response(JSON.stringify({ product: 'free', access: { meters: {} } })),
+    });
+    expect(absent.configured).toBe(true);
+    expect(absent.error).toMatch(/subscription/i);
+
+    const malformed = await fetchQuota({
+      readAuth: async () => consoleAuth(),
+      fetchImpl: async () => new Response('not json', { status: 200 }),
+    });
+    expect(malformed.configured).toBe(true);
+    expect(malformed.error).toMatch(/unreadable/i);
+  });
+
+  it('reports a temporary request failure as configured', async () => {
+    const result = await fetchQuota({
+      readAuth: async () => consoleAuth(),
+      fetchImpl: async () => new Response('', { status: 502 }),
+    });
+    expect(result.configured).toBe(true);
+    expect(result.error).toMatch(/HTTP 502/);
+  });
+
+  it('follows the selected account on every read instead of caching usage', async () => {
+    let call = 0;
+    const seen = [];
+    const result = await fetchQuota({
+      readAuth: async () => {
+        call += 1;
+        return consoleAuth({ orgID: call === 1 ? 'org_FIRST123' : 'org_SECOND123' });
+      },
+      fetchImpl: async (_url, options) => {
+        seen.push(options.headers['x-org-id']);
+        return new Response(JSON.stringify(consolePayload({ meters: {
+          fiveHour: { resetsAt: '2026-08-12T12:00:00.000Z', limitMicroCents: '1000', usedMicroCents: call === 1 ? '250' : '900' },
+        } })));
+      },
+    });
+    expect(seen).toEqual(['org_FIRST123']);
+    expect(result.usage.windows['5h'].usedPercent).toBe(25);
+
+    const second = await fetchQuota({
+      readAuth: async () => consoleAuth({ orgID: 'org_SECOND123' }),
+      fetchImpl: async () => new Response(JSON.stringify(consolePayload({ meters: {
+        fiveHour: { resetsAt: '2026-08-12T12:00:00.000Z', limitMicroCents: '1000', usedMicroCents: '900' },
+      } }))),
+    });
+    expect(second.usage.windows['5h'].usedPercent).toBe(90);
+  });
 });

package/server/lib/quota/providers/openrouter.js

@@ -14,7 +14,7 @@ import {
 
 export const providerId = 'openrouter';
 export const providerName = 'OpenRouter';
-export const aliases = ['openrouter'];
+const aliases = ['openrouter'];
 const OPENROUTER_API_BASE = 'https://openrouter.ai/api/v1';
 const PERIOD_SECONDS = { daily: 86400, weekly: 604800, monthly: 30 * 86400 };
 

package/server/lib/quota/providers/zenmux.js

@@ -10,7 +10,7 @@ import {
 
 export const providerId = 'zenmux';
 export const providerName = 'ZenMux';
-export const aliases = ['zenmux'];
+const aliases = ['zenmux'];
 const ZENMUX_BALANCE_URL = 'https://zenmux.ai/api/v1/management/payg/balance';
 
 const readStoredCredential = () => readManagedCredential(providerId);

package/server/lib/quota/utils/auth.js

@@ -75,3 +75,4 @@ export const resolveConfigApiKey = (value, { configDir = OPENCODE_CONFIG_DIR, ho
     return null;
   }
 };
+

package/server/lib/quota/utils/transformers.js

@@ -1,10 +1,6 @@
-export const asObject = (value) => (value && typeof value === 'object' ? value : null);
+export { asNonEmptyString } from '../../shared/guards.js';
 
-export const asNonEmptyString = (value) => {
-  if (typeof value !== 'string') return null;
-  const trimmed = value.trim();
-  return trimmed ? trimmed : null;
-};
+export const asObject = (value) => (value && typeof value === 'object' ? value : null);
 
 export const toNumber = (value) => {
   if (typeof value === 'number' && Number.isFinite(value)) {