ccm-account-manager 1.13.0

package/src/ui/server.js

@@ -0,0 +1,145 @@
+// ccm ui — the Solari board as a local web page. Zero-dep http server bound
+// to 127.0.0.1 with a Host allowlist (blocks DNS-rebinding). Launching an
+// account opens a new Windows Terminal tab running `ccm <name>`.
+
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { listProfiles, getProfile } from '../registry.js';
+import { getUsage, refreshAll, headroom, isStale } from '../usage.js';
+import { isRunning } from '../launch.js';
+import { authState } from '../oauth.js';
+import os from 'node:os';
+import { slugForPath, allSessions, listSessions, copySessionTo } from '../sessions.js';
+import { listAccountServers, copyServer, resolveCopyTarget } from '../mcp.js';
+import { collectDoctor } from '../doctor.js';
+import { HUES } from '../tui/theme.js';
+
+const PAGE = path.join(path.dirname(fileURLToPath(import.meta.url)), 'board.html');
+
+function json(res, obj, code = 200) {
+  res.writeHead(code, { 'content-type': 'application/json; charset=utf-8' });
+  res.end(JSON.stringify(obj));
+}
+
+function readBody(req) {
+  return new Promise((resolve) => {
+    let data = '';
+    req.on('data', (c) => { data += c; if (data.length > 65536) req.destroy(); });
+    req.on('end', () => resolve(data));
+  });
+}
+
+function shortDir(dir) {
+  if (!dir) return null;
+  return dir.startsWith(os.homedir()) ? '~' + dir.slice(os.homedir().length) : dir;
+}
+
+async function stateJson(cwd, scope = 'here') {
+  const profiles = await Promise.all(listProfiles().map(async (p) => {
+    const usage = await getUsage(p.name).catch(() => null);
+    return {
+      name: p.name, email: p.email, plan: p.plan, organization: p.organization,
+      color: p.color, hue: HUES[p.color] ?? '#C3C2B7',
+      running: isRunning(p.name), loggedOut: authState(p.name) === 'logged-out', headroom: headroom(usage),
+      windows: usage?.windows ?? null, usageError: usage?.error ?? null,
+      stale: !!usage && (!!usage.staleError || isStale(usage)),
+      staleError: usage?.staleError ?? null,
+      fetchedAt: usage?.fetchedAt ?? null,
+      lastUsed: p.lastUsed,
+    };
+  }));
+  profiles.sort((a, b) => (b.headroom ?? -1) - (a.headroom ?? -1));
+  const mcp = listProfiles().map((p) => ({
+    name: p.name, hue: HUES[p.color] ?? '#C3C2B7',
+    servers: listAccountServers(p.name).map((s) => ({
+      name: s.name, scope: s.scope, project: s.project ?? null,
+      projectShort: s.project ? shortDir(s.project) : null,
+    })),
+  }));
+  const sessions = listSessions(scope === 'all' ? null : slugForPath(cwd)).slice(0, scope === 'all' ? 200 : 20)
+    .map((s) => ({
+      id: s.id, mtime: s.mtime, title: s.title,
+      dir: s.cwd, dirShort: shortDir(s.cwd) ?? s.slug,
+      source: { kind: s.source.kind, label: s.source.label, hue: HUES[s.source.color] ?? null },
+    }));
+  return { profiles, mcp, sessions, scope, cwd, now: Date.now() };
+}
+
+function openTerminal(args, dir = null) {
+  const child = spawn('wt.exe', dir ? ['-d', dir, ...args] : args, { detached: true, stdio: 'ignore' });
+  child.on('error', () => {
+    spawn('cmd.exe', ['/c', 'start', '', 'cmd', '/k', ...args], {
+      detached: true, stdio: 'ignore', windowsHide: false, cwd: dir ?? undefined,
+    }).unref();
+  });
+  child.unref();
+}
+
+export function startUi({ port = 7788, open = true, cwd = process.cwd() } = {}) {
+  const server = http.createServer(async (req, res) => {
+    try {
+      const host = req.headers.host ?? '';
+      if (!/^(localhost|127\.0\.0\.1)(:\d+)?$/i.test(host)) return json(res, { error: 'forbidden' }, 403);
+      const u = new URL(req.url, 'http://localhost');
+
+      if (req.method === 'GET' && u.pathname === '/') {
+        res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
+        return res.end(fs.readFileSync(PAGE));
+      }
+      if (req.method === 'GET' && u.pathname === '/api/state') {
+        return json(res, await stateJson(cwd, u.searchParams.get('scope') === 'all' ? 'all' : 'here'));
+      }
+      if (req.method === 'GET' && u.pathname === '/api/doctor') return json(res, await collectDoctor());
+
+      if (req.method === 'POST') {
+        const body = JSON.parse(await readBody(req) || '{}');
+        if (u.pathname === '/api/refresh') {
+          await refreshAll(listProfiles().map((p) => p.name));
+          return json(res, await stateJson(cwd, body.scope === 'all' ? 'all' : 'here'));
+        }
+        if (u.pathname === '/api/launch') {
+          if (!getProfile(body.name)) return json(res, { error: `unknown profile "${body.name}"` }, 400);
+          // A logged-out account opens `ccm login <name>` (goes straight to the
+          // sign-in flow) instead of `ccm <name>` (which would refuse to launch).
+          const args = body.login ? ['ccm', 'login', body.name] : ['ccm', body.name];
+          if (!body.login && body.resume) args.push('--resume', String(body.resume));
+          openTerminal(args, body.dir && fs.existsSync(body.dir) ? body.dir : null);
+          return json(res, { ok: true });
+        }
+        if (u.pathname === '/api/mcp/copy') {
+          if (!getProfile(body.from)) return json(res, { error: `unknown profile "${body.from}"` }, 400);
+          if (!getProfile(body.to)) return json(res, { error: `unknown profile "${body.to}"` }, 400);
+          if (body.scope && body.scope !== 'user' && body.scope !== 'local') return json(res, { error: 'scope must be user or local' }, 400);
+          const t = resolveCopyTarget({ from: body.from, name: body.name, scope: body.scope, project: body.project }, cwd);
+          const r = copyServer({ from: body.from, name: body.name, sourceScope: t.sourceScope, sourceProject: t.sourceProject, to: body.to, targetScope: t.targetScope, targetProject: t.targetProject });
+          if (r.error) return json(res, { error: r.error }, 400);
+          return json(res, { ok: true, replaced: r.replaced, scope: r.scope, project: r.project });
+        }
+        if (u.pathname === '/api/move') {
+          if (!getProfile(body.to)) return json(res, { error: `unknown profile "${body.to}"` }, 400);
+          const found = allSessions(null).find((s) => s.id === body.id);
+          if (!found) return json(res, { error: 'session not found' }, 404);
+          copySessionTo(found, body.to, found.slug);
+          return json(res, { ok: true, resume: found.id, to: body.to });
+        }
+      }
+      json(res, { error: 'not found' }, 404);
+    } catch (e) {
+      json(res, { error: e.message }, 500);
+    }
+  });
+
+  server.listen(port, '127.0.0.1', () => {
+    const addr = `http://127.0.0.1:${port}`;
+    console.log(`ccm board: ${addr}   (ctrl+c to stop)`);
+    if (open) spawn('cmd.exe', ['/c', 'start', '', addr], { detached: true, stdio: 'ignore' }).unref();
+  });
+  server.on('error', (e) => {
+    console.error(e.code === 'EADDRINUSE' ? `port ${port} is busy — try: ccm ui --port ${port + 1}` : e.message);
+    process.exitCode = 1;
+  });
+  return server;
+}

package/src/usage.js

@@ -0,0 +1,144 @@
+import { USAGE_CACHE } from './paths.js';
+import { readJson, writeJson } from './util.js';
+import { resolveToken, readOauth } from './oauth.js';
+
+// Undocumented endpoint used by Claude Code's own /usage command. If Anthropic
+// changes it, only the quota columns degrade — everything else keeps working.
+const ENDPOINT = 'https://api.anthropic.com/api/oauth/usage';
+
+// Stale cache shown after a failed refresh/fetch is marked, never presented as
+// live: anything older than this reads as "as of …" instead of a fresh number.
+export const STALE_MS = 15 * 60_000;
+
+export const DEFAULT_MAX_AGE_MS = 5 * 60_000;
+
+export { readOauth };
+
+// Normalize the API response into [{label, percent, resetsAt, severity, active}].
+export function parseWindows(data) {
+  const windows = [];
+  const limits = Array.isArray(data?.limits) ? data.limits.filter((l) => l?.percent != null) : [];
+  if (limits.length) {
+    for (const l of limits) {
+      let label;
+      if (l.kind === 'session') label = 'session (5h)';
+      else if (l.kind === 'weekly_all') label = 'week (all models)';
+      else if (l.kind === 'weekly_scoped') label = `week (${l.scope?.model?.display_name ?? 'model'})`;
+      else label = String(l.kind ?? 'limit').replace(/_/g, ' ');
+      windows.push({
+        label,
+        percent: Math.max(0, Math.min(100, l.percent)),
+        resetsAt: l.resets_at ?? null,
+        severity: l.severity ?? 'normal',
+        active: !!l.is_active,
+      });
+    }
+    return windows;
+  }
+  const legacy = {
+    five_hour: 'session (5h)',
+    seven_day: 'week (all models)',
+    seven_day_opus: 'week (Opus)',
+    seven_day_sonnet: 'week (Sonnet)',
+  };
+  for (const [key, val] of Object.entries(data ?? {})) {
+    if (val && typeof val === 'object' && val.utilization != null) {
+      windows.push({
+        label: legacy[key] ?? key.replace(/_/g, ' '),
+        percent: Math.max(0, Math.min(100, val.utilization)),
+        resetsAt: val.resets_at ?? null,
+        severity: 'normal',
+        active: false,
+      });
+    }
+  }
+  return windows;
+}
+
+export async function fetchUsage(name) {
+  // Get a usable token: the profile's own (refreshed if needed), or a valid
+  // token borrowed from another source on the same account. Usage is
+  // per-account, so a borrowed token returns the same live numbers.
+  const auth = await resolveToken(name);
+  if (auth.error) return { error: auth.error };
+  try {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 8000);
+    const res = await fetch(ENDPOINT, {
+      headers: { Authorization: `Bearer ${auth.accessToken}`, 'anthropic-beta': 'oauth-2025-04-20' },
+      signal: ctrl.signal,
+    });
+    clearTimeout(timer);
+    if (res.status === 401 || res.status === 403) return { error: 'unauthorized' };
+    if (!res.ok) return { error: `http-${res.status}` };
+    return { windows: parseWindows(await res.json()), fetchedAt: Date.now(), borrowedFrom: auth.borrowedFrom ?? null };
+  } catch (e) {
+    return { error: e.name === 'AbortError' ? 'timeout' : 'network' };
+  }
+}
+
+export function loadCache() {
+  return readJson(USAGE_CACHE, {});
+}
+
+export function saveCache(cache) {
+  writeJson(USAGE_CACHE, cache);
+}
+
+export function isFresh(entry, maxAgeMs = DEFAULT_MAX_AGE_MS, now = Date.now()) {
+  return !!entry?.fetchedAt && now - entry.fetchedAt < maxAgeMs;
+}
+
+// Is this entry too old to present as a live reading?
+export function isStale(entry, now = Date.now()) {
+  return !!entry?.fetchedAt && now - entry.fetchedAt >= STALE_MS;
+}
+
+// Cached usage for a profile; fetches when stale unless cacheOnly.
+// On fetch failure, the last cached windows are still returned — but tagged
+// with `staleError` so the UI shows them as "as of …", never as live.
+export async function getUsage(name, { maxAgeMs = DEFAULT_MAX_AGE_MS, cacheOnly = false } = {}) {
+  const cache = loadCache();
+  const hit = cache[name];
+  if (cacheOnly || isFresh(hit, maxAgeMs)) return hit ?? null;
+  const fresh = await fetchUsage(name);
+  if (fresh.error) return hit?.windows ? { ...hit, staleError: fresh.error } : fresh;
+  cache[name] = fresh;
+  saveCache(cache);
+  return fresh;
+}
+
+export async function refreshAll(names, maxAgeMs = 0) {
+  await Promise.all(names.map((n) => getUsage(n, { maxAgeMs }).catch(() => null)));
+}
+
+// Remaining room on the account's tightest limit: 100 - max(percent), or null.
+export function headroom(entry) {
+  if (!entry?.windows?.length) return null;
+  return 100 - Math.max(...entry.windows.map((w) => w.percent));
+}
+
+// The other profile with the most headroom (from cache) — used to recommend
+// where to move a session when the current account nears its limit.
+export function bestAlternative(currentName, profileNames, cache = loadCache()) {
+  let best = null;
+  for (const name of profileNames) {
+    if (name === currentName) continue;
+    const h = headroom(cache[name]);
+    if (h != null && (!best || h > best.headroom)) best = { name, headroom: h };
+  }
+  return best;
+}
+
+export const ERROR_HINTS = {
+  'no-credentials': 'not logged in — launch this profile and run /login',
+  'token-expired': 'token expired — launch this profile once to refresh it',
+  'no-refresh-token': 'no refresh token — launch this profile and run /login',
+  'refresh-rejected': 'login expired — launch this profile to sign in again',
+  'refresh-malformed': 'unexpected refresh response — launch this profile to re-auth',
+  'refresh-timeout': 'timed out refreshing the login token',
+  'refresh-network': 'network error refreshing the login token',
+  unauthorized: 'token rejected — launch this profile and run /login',
+  timeout: 'usage API timed out',
+  network: 'network error reaching usage API',
+};

package/src/util.js

@@ -0,0 +1,107 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function readJson(file, fallback = null) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch {
+    return fallback;
+  }
+}
+
+export function writeJson(file, obj) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(obj, null, 2) + '\n');
+}
+
+const COLOR_CODES = {
+  cyan: '36', magenta: '35', yellow: '33', green: '32',
+  blue: '34', red: '31', gray: '90', white: '37',
+};
+
+function ansiEnabled() {
+  return !process.env.NO_COLOR;
+}
+
+export function paint(code, s) {
+  return ansiEnabled() ? `\x1b[${code}m${s}\x1b[0m` : String(s);
+}
+
+export const colorize = (color, s) => paint(COLOR_CODES[color] ?? '0', s);
+export const bold = (s) => paint('1', s);
+export const dim = (s) => paint('2', s);
+
+export function bar(percent, width = 20) {
+  const pct = Math.max(0, Math.min(100, percent ?? 0));
+  const filled = Math.round((pct / 100) * width);
+  return '█'.repeat(filled) + '░'.repeat(width - filled);
+}
+
+export function severityColor(percent, severity = 'normal') {
+  if (severity === 'exceeded' || percent >= 90) return 'red';
+  if (severity === 'warning' || percent >= 70) return 'yellow';
+  return 'green';
+}
+
+// "in how long" for a future ISO timestamp: "2h 05m", "3d 4h", "12m", "now"
+export function timeUntil(iso, now = Date.now()) {
+  if (!iso) return '?';
+  const ms = new Date(iso).getTime() - now;
+  if (Number.isNaN(ms)) return '?';
+  if (ms <= 0) return 'now';
+  const mins = Math.floor(ms / 60_000);
+  const d = Math.floor(mins / 1440);
+  const h = Math.floor((mins % 1440) / 60);
+  const m = mins % 60;
+  if (d > 0) return `${d}d ${h}h`;
+  if (h > 0) return `${h}h ${String(m).padStart(2, '0')}m`;
+  return `${m}m`;
+}
+
+// Plain objects merge recursively; arrays and scalars replace.
+export function deepMerge(base, override) {
+  if (override === undefined) return base;
+  const isObj = (v) => v && typeof v === 'object' && !Array.isArray(v);
+  if (isObj(base) && isObj(override)) {
+    const out = { ...base };
+    for (const [k, v] of Object.entries(override)) out[k] = deepMerge(base[k], v);
+    return out;
+  }
+  return override;
+}
+
+// set/unset a dotted path like "env.FOO" on a plain object
+export function setDotted(obj, dotted, value) {
+  const keys = dotted.split('.');
+  let cur = obj;
+  for (const k of keys.slice(0, -1)) {
+    if (!cur[k] || typeof cur[k] !== 'object') cur[k] = {};
+    cur = cur[k];
+  }
+  cur[keys.at(-1)] = value;
+  return obj;
+}
+
+export function unsetDotted(obj, dotted) {
+  const keys = dotted.split('.');
+  let cur = obj;
+  for (const k of keys.slice(0, -1)) {
+    if (!cur?.[k] || typeof cur[k] !== 'object') return obj;
+    cur = cur[k];
+  }
+  delete cur[keys.at(-1)];
+  return obj;
+}
+
+// "how long ago" for a past ISO timestamp: "5m ago", "3h ago", "2d ago", "—"
+export function timeAgo(iso, now = Date.now()) {
+  if (!iso) return '—';
+  const ms = now - new Date(iso).getTime();
+  if (Number.isNaN(ms)) return '—';
+  if (ms < 60_000) return 'just now';
+  const mins = Math.floor(ms / 60_000);
+  if (mins < 60) return `${mins}m ago`;
+  const h = Math.floor(mins / 60);
+  if (h < 24) return `${h}h ago`;
+  return `${Math.floor(h / 24)}d ago`;
+}

package/src/wt.js

@@ -0,0 +1,60 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { WT_FRAGMENT, WT_FRAGMENT_DIR } from './paths.js';
+import { readJson, writeJson } from './util.js';
+import { listProfiles } from './registry.js';
+
+// Windows Terminal "fragments" are the sanctioned way for apps to contribute
+// profiles without touching the user's settings.json (which allows comments
+// and is risky to rewrite). WT picks fragments up on its next launch.
+
+const COLOR_HEX = {
+  cyan: '#06B6D4', magenta: '#D946EF', yellow: '#EAB308',
+  green: '#22C55E', blue: '#3B82F6', red: '#EF4444',
+};
+
+export function buildFragment(profiles) {
+  return {
+    profiles: profiles.map((p) => ({
+      name: `Claude — ${p.name}`,
+      commandline: `ccm ${p.name}`,
+      tabColor: COLOR_HEX[p.color] ?? '#7C3AED',
+      suppressApplicationTitle: false,
+    })),
+  };
+}
+
+export function wtDetected() {
+  if (fs.existsSync(path.dirname(path.dirname(WT_FRAGMENT_DIR)))) return true;
+  // Store-packaged WT has no "Windows Terminal" folder under %LOCALAPPDATA%\Microsoft
+  // until first settings write — detect the package (or wt.exe shim) instead.
+  const local = path.dirname(path.dirname(path.dirname(WT_FRAGMENT_DIR)));
+  try {
+    if (fs.readdirSync(path.join(local, 'Packages')).some((n) => n.startsWith('Microsoft.WindowsTerminal_'))) return true;
+  } catch {}
+  return fs.existsSync(path.join(local, 'Microsoft', 'WindowsApps', 'wt.exe'));
+}
+
+export function installWt() {
+  writeJson(WT_FRAGMENT, buildFragment(listProfiles()));
+  return WT_FRAGMENT;
+}
+
+export function uninstallWt() {
+  if (!fs.existsSync(WT_FRAGMENT_DIR)) return false;
+  fs.rmSync(WT_FRAGMENT_DIR, { recursive: true, force: true });
+  return true;
+}
+
+export function wtInstalled() {
+  return fs.existsSync(WT_FRAGMENT);
+}
+
+export function wtInSync() {
+  return JSON.stringify(readJson(WT_FRAGMENT, null)) === JSON.stringify(buildFragment(listProfiles()));
+}
+
+// Keep the fragment current when profiles change, but only if it was installed.
+export function refreshWtIfInstalled() {
+  if (wtInstalled()) installWt();
+}