clauddy 1.29.1 → 2.0.0

package/auth.js

@@ -1,300 +0,0 @@
-// Claude OAuth (same flow as Claude Code) + the authoritative usage endpoint.
-const crypto = require('node:crypto')
-const fs = require('node:fs')
-const path = require('node:path')
-const os = require('node:os')
-
-const CLIENT_ID = '9d1c250a-e61b-44d9-88ed-5944d1962f5e'
-const REDIRECT = 'https://platform.claude.com/oauth/code/callback'
-const AUTHORIZE = 'https://claude.ai/oauth/authorize'
-const TOKEN_URL = 'https://platform.claude.com/v1/oauth/token'
-const USAGE_URL = 'https://api.anthropic.com/api/oauth/usage'
-const PROFILE_URL = 'https://api.anthropic.com/api/oauth/profile'
-const SCOPE = 'org:create_api_key user:profile user:inference'
-const UA = 'claude-cli/2.1.181 (external, cli)'
-// when CLAUDE_CONFIG_DIR is set (e.g. via direnv for multi-account setups),
-// keep the widget's data alongside that account's Claude config
-const DATA_DIR = process.env.CLAUDE_CONFIG_DIR
-  ? path.join(process.env.CLAUDE_CONFIG_DIR, 'usage-monitor')
-  : path.join(os.homedir(), '.claude-usage-monitor')
-// mutable: with several accounts configured, each one keeps its token in its
-// own dir and the widget switches between them at runtime
-let tokenPath = path.join(DATA_DIR, 'auth.json')
-
-const b64url = (buf) =>
-  buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
-
-let tokens = null // { access_token, refresh_token, expires_at }
-let pending = null // { verifier, state }
-let profile = null // { email, name, plan } — cached account identity
-
-// point the module at another account's dir — the cached token and profile
-// belong to the previous one, so both are dropped
-function setDataDir(dir) {
-  tokenPath = path.join(dir || DATA_DIR, 'auth.json')
-  tokens = null
-  profile = null
-  pending = null
-  unreadable = false
-}
-
-// Set when the file itself could not be read for a reason other than "it is not
-// there" — a disk still waking up, say. That must not read as a logout, or the
-// widget asks for a login it doesn't need and every account looks gone. A file
-// we did read but cannot parse is a different matter: that one really is dead.
-let unreadable = false
-function load() {
-  if (tokens) return tokens
-  let raw = null
-  try {
-    raw = fs.readFileSync(tokenPath, 'utf8')
-    unreadable = false
-  } catch (e) {
-    unreadable = e?.code !== 'ENOENT'
-  }
-  try {
-    tokens = raw == null ? null : JSON.parse(raw)
-  } catch {
-    tokens = null
-  }
-  return tokens
-}
-function save(t) {
-  tokens = t
-  try {
-    fs.mkdirSync(path.dirname(tokenPath), { recursive: true })
-    fs.writeFileSync(tokenPath, JSON.stringify(t, null, 2), { mode: 0o600 })
-  } catch {}
-}
-function clear() {
-  tokens = null
-  profile = null
-  unreadable = false
-  try {
-    fs.unlinkSync(tokenPath)
-  } catch {}
-}
-function isConnected() {
-  // a token we merely failed to read still counts: the account is connected,
-  // we just couldn't see it this instant
-  return !!load() || unreadable
-}
-
-// Step 1: build the authorize URL (opens in the browser)
-function begin() {
-  const verifier = b64url(crypto.randomBytes(32))
-  const challenge = b64url(crypto.createHash('sha256').update(verifier).digest())
-  const state = b64url(crypto.randomBytes(32))
-  pending = { verifier, state }
-  const params = {
-    code: 'true',
-    client_id: CLIENT_ID,
-    response_type: 'code',
-    redirect_uri: REDIRECT,
-    scope: SCOPE,
-    code_challenge: challenge,
-    code_challenge_method: 'S256',
-    state,
-  }
-  const query = Object.entries(params)
-    .map(([k, v]) => `${k}=${encodeURIComponent(v)}`)
-    .join('&')
-  return `${AUTHORIZE}?${query}`
-}
-
-// Step 2: exchange the pasted "code#state" for tokens
-async function complete(pasted) {
-  const raw = String(pasted).trim()
-  // A directly-pasted long-lived token (e.g. from `claude setup-token`) skips
-  // the rate-limited code exchange entirely.
-  if (!raw.includes('#')) {
-    save({ access_token: raw, refresh_token: null, expires_at: Date.now() + 365 * 864e5 })
-    pending = null
-    return
-  }
-  if (!pending) throw new Error('no pending auth')
-  const [code, returnedState] = raw.split('#')
-  const res = await fetch(TOKEN_URL, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'User-Agent': UA },
-    body: JSON.stringify({
-      grant_type: 'authorization_code',
-      code,
-      state: returnedState || pending.state,
-      code_verifier: pending.verifier,
-      client_id: CLIENT_ID,
-      redirect_uri: REDIRECT,
-    }),
-  })
-  if (!res.ok) {
-    const body = await res.text().catch(() => '')
-    throw new Error(`exchange ${res.status}: ${body.slice(0, 150)}`)
-  }
-  const j = await res.json()
-  save({
-    access_token: j.access_token,
-    refresh_token: j.refresh_token,
-    expires_at: Date.now() + (j.expires_in || 3600) * 1000,
-  })
-  pending = null
-}
-
-// Usage and profile both ask for a valid token at once. Two refreshes would
-// rotate the refresh token twice, and the loser's grant comes back rejected —
-// so callers share the one in flight.
-let refreshing = null
-function refresh() {
-  if (!refreshing) refreshing = doRefresh().finally(() => (refreshing = null))
-  return refreshing
-}
-async function doRefresh() {
-  const t = load()
-  if (!t?.refresh_token) throw Object.assign(new Error('no refresh token'), { status: 401 })
-  const res = await fetch(TOKEN_URL, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', 'User-Agent': UA },
-    body: JSON.stringify({
-      grant_type: 'refresh_token',
-      refresh_token: t.refresh_token,
-      client_id: CLIENT_ID,
-    }),
-  })
-  if (!res.ok) {
-    // a rejected grant (expired/revoked refresh token) means the session is
-    // dead — surface it as 401 so callers clear the token and prompt login.
-    // transient failures (429, 5xx) keep their status so we retry, not logout.
-    const dead = res.status === 400 || res.status === 403
-    throw Object.assign(new Error('refresh failed'), { status: dead ? 401 : res.status })
-  }
-  const j = await res.json()
-  save({
-    access_token: j.access_token,
-    refresh_token: j.refresh_token || t.refresh_token,
-    expires_at: Date.now() + (j.expires_in || 3600) * 1000,
-  })
-}
-
-async function validToken() {
-  const t = load()
-  // status 0 is "try again later", not "log in again": only a token that is
-  // genuinely absent should send the user back through the browser
-  if (!t) {
-    throw Object.assign(new Error(unreadable ? 'token unreadable' : 'not connected'), {
-      status: unreadable ? 0 : 401,
-    })
-  }
-  if (!t.expires_at || t.expires_at - Date.now() < 60000) await refresh()
-  return load().access_token
-}
-
-function win(o) {
-  return o && typeof o.utilization === 'number'
-    ? { pct: o.utilization, resetMs: o.resets_at ? Date.parse(o.resets_at) - Date.now() : null }
-    : null
-}
-
-// Weekly limits scoped to one model (e.g. "Fable" on Max) live in the `limits`
-// array. The older seven_day_<model> windows are kept as a fallback for plans
-// that still report them that way.
-function scopedWeeks(j) {
-  const out = []
-  for (const l of Array.isArray(j.limits) ? j.limits : []) {
-    if (l?.kind !== 'weekly_scoped' || typeof l.percent !== 'number') continue
-    const label = l.scope?.model?.display_name
-    if (!label) continue
-    out.push({
-      label,
-      pct: l.percent,
-      resetMs: l.resets_at ? Date.parse(l.resets_at) - Date.now() : null,
-    })
-  }
-  if (out.length) return out
-  for (const [key, label] of [
-    ['seven_day_opus', 'Opus'],
-    ['seven_day_sonnet', 'Sonnet'],
-  ]) {
-    const w = win(j[key])
-    if (w) out.push({ label, ...w })
-  }
-  return out
-}
-
-// What the endpoint says its own budget is. Undocumented, so we only ever read
-// it — nothing depends on it yet. Knowing the real numbers is what tells us how
-// close the activity poll's floor can get.
-let rateLimit = null
-function readRateLimit(res) {
-  const out = {}
-  try {
-    for (const [k, v] of res.headers) {
-      if (k.startsWith('anthropic-ratelimit-')) out[k.slice(20)] = v
-    }
-  } catch {
-    return // no headers to read — nothing here is worth failing a fetch over
-  }
-  if (!Object.keys(out).length) return
-  if (JSON.stringify(out) !== JSON.stringify(rateLimit)) console.log('usage rate limit', out)
-  rateLimit = out
-}
-
-// Step 3: fetch the authoritative usage
-async function fetchUsage() {
-  const token = await validToken()
-  const res = await fetch(USAGE_URL, {
-    headers: {
-      Authorization: `Bearer ${token}`,
-      'anthropic-beta': 'oauth-2025-04-20',
-      'anthropic-version': '2023-06-01',
-      'User-Agent': UA,
-    },
-  })
-  if (!res.ok) {
-    const body = await res.text().catch(() => '')
-    throw Object.assign(new Error(`usage ${res.status}: ${body.slice(0, 150)}`), {
-      status: res.status,
-    })
-  }
-  readRateLimit(res)
-  const j = await res.json()
-  return {
-    session: win(j.five_hour) || { pct: 0, resetMs: null },
-    week: win(j.seven_day) || { pct: 0, resetMs: null },
-    scoped: scopedWeeks(j),
-  }
-}
-
-// The logged-in account's identity (email + plan tier). Cached for the session;
-// only changes on logout/login, so we don't re-fetch on every usage poll.
-async function fetchProfile() {
-  if (profile) return profile
-  const token = await validToken()
-  const res = await fetch(PROFILE_URL, {
-    headers: {
-      Authorization: `Bearer ${token}`,
-      'anthropic-beta': 'oauth-2025-04-20',
-      'anthropic-version': '2023-06-01',
-      'User-Agent': UA,
-    },
-  })
-  if (!res.ok) {
-    throw Object.assign(new Error(`profile ${res.status}`), { status: res.status })
-  }
-  const a = (await res.json()).account || {}
-  profile = {
-    email: a.email || null,
-    name: a.display_name || a.full_name || null,
-    plan: a.has_claude_max ? 'Max' : a.has_claude_pro ? 'Pro' : null,
-  }
-  return profile
-}
-
-module.exports = {
-  rateLimit: () => rateLimit,
-  begin,
-  complete,
-  fetchUsage,
-  fetchProfile,
-  clear,
-  isConnected,
-  setDataDir,
-}

package/codex.js

@@ -1,345 +0,0 @@
-const { spawn } = require('node:child_process')
-const fs = require('node:fs')
-const path = require('node:path')
-const os = require('node:os')
-
-// Codex (CLI and the desktop app alike) writes one `rollout-*.jsonl` per
-// session under ~/.codex/sessions/YYYY/MM/DD. Its `token_count` events carry
-// both the token totals and the account's rate limits, so the tokens and history
-// come from local files. Other ChatGPT products share those limits without
-// writing rollouts, so the % also comes from Codex's own app-server.
-let codexDir = process.env.CODEX_HOME || path.join(os.homedir(), '.codex')
-
-function setCodexDir(dir) {
-  codexDir = dir || process.env.CODEX_HOME || path.join(os.homedir(), '.codex')
-  fileCache.clear()
-  liveLimits = null
-  lastLiveTry = 0
-  lastLiveFailed = false
-}
-
-// tests point this at a stub; false turns the live read off
-function setCodexBin(bin) {
-  codexBin = bin
-}
-
-const DAY = 86400000
-const DAYS = 30
-const WEEK = 7 * DAY
-const ACTIVE_MS = 60000 // a rollout touched within the last minute = Codex working
-const DAY_MIN = 24 * 60
-const TOP_PROJECTS = 5 // same fold as Claude's panel
-const LIVE_MS = 2 * 60000 // how often to ask the app-server for the limits
-const LIVE_RETRY_MS = 5 * 60000 // a process spawn per try: back off when it fails
-const LIVE_TIMEOUT_MS = 15000
-
-let codexBin
-let liveLimits = null
-let lastLiveTry = 0
-let lastLiveFailed = false
-
-// per file: how far we've read, plus what we got out of it. Rollouts only ever
-// grow, so a poll reads just the bytes appended since the last one.
-const fileCache = new Map()
-
-function blankSummary() {
-  return { offset: 0, rest: '', lastTotal: 0, events: [], limits: null, model: null, cwd: null }
-}
-
-// a token_count's rate limits. Codex reports several buckets; some (the
-// `premium` one on Plus, say) come with null windows — only a bucket with a
-// real window is worth showing.
-function limitsOf(rl, ts) {
-  if (!rl || (!rl.primary && !rl.secondary)) return null
-  const win = (w) =>
-    w && typeof w.used_percent === 'number'
-      ? { pct: w.used_percent, resetsAt: w.resets_at ? w.resets_at * 1000 : null }
-      : null
-  // Plus reports a 5-hour window and a weekly one; some plans (Pro Lite, say)
-  // only the weekly one, in the `primary` slot. Sort by length, not by slot.
-  let session = null
-  let weekly = null
-  for (const w of [rl.primary, rl.secondary]) {
-    const v = win(w)
-    if (!v) continue
-    const long = w.window_minutes != null ? w.window_minutes >= DAY_MIN : w === rl.secondary
-    if (long) weekly = v
-    else session = v
-  }
-  return { ts, plan: rl.plan_type || null, session, weekly }
-}
-
-// the app-server reports the same windows as the rollouts, in camelCase
-function limitsFromLive(result, ts) {
-  const rl = result?.rateLimitsByLimitId?.codex || result?.rateLimits
-  if (!rl) return null
-  const win = (w) =>
-    w && {
-      used_percent: w.usedPercent,
-      window_minutes: w.windowDurationMins,
-      resets_at: w.resetsAt,
-    }
-  return limitsOf(
-    { primary: win(rl.primary), secondary: win(rl.secondary), plan_type: rl.planType },
-    ts,
-  )
-}
-
-// the desktop app's bundled CLI first: a GUI app doesn't get the shell's PATH
-function findCodexBin() {
-  if (codexBin !== undefined) return codexBin
-  const home = os.homedir()
-  const bundled = ['/Applications', path.join(home, 'Applications')].flatMap((dir) => [
-    path.join(dir, 'ChatGPT.app/Contents/Resources/codex-cli/CodexCLI.app/Contents/MacOS/codex'),
-    path.join(dir, 'Codex.app/Contents/Resources/codex'),
-  ])
-  return bundled.find((f) => fs.existsSync(f)) || 'codex'
-}
-
-// One `account/rateLimits/read` over the app-server's stdio JSON-RPC. Codex keeps
-// its own login and token refresh: Clauddy never touches the token.
-function readLiveLimits(bin, ts) {
-  return new Promise((resolve) => {
-    let child
-    try {
-      child = spawn(bin, ['app-server'], {
-        env: { ...process.env, CODEX_HOME: codexDir },
-        stdio: ['pipe', 'pipe', 'ignore'],
-      })
-    } catch {
-      resolve(null)
-      return
-    }
-    const finish = (limits) => {
-      clearTimeout(timer)
-      child.kill()
-      resolve(limits)
-    }
-    const timer = setTimeout(() => finish(null), LIVE_TIMEOUT_MS)
-    const send = (msg) => child.stdin.write(`${JSON.stringify(msg)}\n`)
-    child.on('error', () => finish(null))
-    child.on('exit', () => finish(null))
-    child.stdin.on('error', () => finish(null))
-    let rest = ''
-    child.stdout.on('data', (chunk) => {
-      const lines = (rest + chunk).split('\n')
-      rest = lines.pop()
-      for (const line of lines) {
-        let msg
-        try {
-          msg = JSON.parse(line)
-        } catch {
-          continue
-        }
-        if (msg.id === 1) {
-          send({ method: 'initialized' })
-          send({ id: 2, method: 'account/rateLimits/read' })
-        } else if (msg.id === 2) finish(limitsFromLive(msg.result, ts))
-      }
-    })
-    send({
-      id: 1,
-      method: 'initialize',
-      params: { clientInfo: { name: 'clauddy', version: '0' } },
-    })
-  })
-}
-
-// A failed read keeps the last good one: it ages into stale, never into zero.
-async function refreshLimits(now = Date.now()) {
-  const bin = findCodexBin()
-  if (!bin) return
-  lastLiveTry = now
-  const dir = codexDir
-  const limits = await readLiveLimits(bin, now)
-  if (dir !== codexDir) return // the source changed while this one was running
-  lastLiveFailed = !limits
-  if (limits) liveLimits = limits
-}
-
-function ingestLine(sum, line) {
-  // cheap filter before JSON.parse — rollouts are mostly message bodies
-  if (!line.includes('"token_count"') && !line.includes('"turn_context"')) return
-  let o
-  try {
-    o = JSON.parse(line)
-  } catch {
-    return
-  }
-  const p = o.payload || {}
-  const ts = Date.parse(o.timestamp) || 0
-  if (o.type === 'turn_context') {
-    if (p.model) sum.model = p.model
-    if (p.cwd) sum.cwd = p.cwd
-    return
-  }
-  if (p.type !== 'token_count') return
-  // totals are cumulative per session, and the same count is often emitted
-  // twice — the delta is what this event actually spent. The model and project
-  // are the ones in effect *now*, so a mid-session switch is attributed right.
-  const total = p.info?.total_token_usage?.total_tokens
-  if (typeof total === 'number' && total > sum.lastTotal) {
-    sum.events.push({ ts, tokens: total - sum.lastTotal, model: sum.model, cwd: sum.cwd })
-    sum.lastTotal = total
-  }
-  const lim = limitsOf(p.rate_limits, ts)
-  if (lim && (!sum.limits || lim.ts >= sum.limits.ts)) sum.limits = lim
-}
-
-function readFile(file, st) {
-  let sum = fileCache.get(file)
-  // shrunk or replaced: start over
-  if (!sum || st.size < sum.offset) sum = blankSummary()
-  if (st.size > sum.offset) {
-    const fd = fs.openSync(file, 'r')
-    try {
-      const buf = Buffer.alloc(st.size - sum.offset)
-      fs.readSync(fd, buf, 0, buf.length, sum.offset)
-      sum.offset = st.size
-      const lines = (sum.rest + buf.toString('utf8')).split('\n')
-      // the last piece may be a line still being written
-      sum.rest = lines.pop()
-      for (const line of lines) ingestLine(sum, line)
-    } finally {
-      fs.closeSync(fd)
-    }
-  }
-  sum.mtime = st.mtimeMs
-  fileCache.set(file, sum)
-  return sum
-}
-
-// every rollout, with its stat; `since` drops the ones untouched since then
-function rollouts(since) {
-  const out = []
-  const walk = (dir, depth) => {
-    let kids
-    try {
-      kids = fs.readdirSync(dir, { withFileTypes: true })
-    } catch {
-      return
-    }
-    for (const k of kids) {
-      const full = path.join(dir, k.name)
-      if (k.isDirectory() && depth < 3) walk(full, depth + 1)
-      else if (k.isFile() && k.name.endsWith('.jsonl')) {
-        try {
-          const st = fs.statSync(full)
-          if (st.mtimeMs >= since) out.push({ file: full, st })
-        } catch {}
-      }
-    }
-  }
-  walk(path.join(codexDir, 'sessions'), 0)
-  return out
-}
-
-// Is there a Codex session on this machine? The folder alone is not enough.
-function detectCodex() {
-  const files = rollouts(0)
-  if (!files.length) return { found: false, plan: null }
-  files.sort((a, b) => b.st.mtimeMs - a.st.mtimeMs)
-  let plan = null
-  for (const { file, st } of files.slice(0, 5)) {
-    const lim = readFile(file, st).limits
-    if (lim?.plan) {
-      plan = lim.plan
-      break
-    }
-  }
-  return { found: true, plan }
-}
-
-// A window whose reset has passed tells us nothing about today: the log is
-// older than the window, so the % is unknown until Codex writes a fresh one.
-function windowNow(w, now) {
-  if (!w) return null
-  const expired = w.resetsAt != null && w.resetsAt <= now
-  return {
-    pct: expired ? null : w.pct,
-    resetMs: w.resetsAt != null && !expired ? w.resetsAt - now : null,
-    expired,
-  }
-}
-
-function ranked(map) {
-  return [...map.entries()]
-    .map(([label, tokens]) => ({ label, tokens }))
-    .sort((a, b) => b.tokens - a.tokens)
-}
-
-function getCodexUsage(now = Date.now()) {
-  if (!fs.existsSync(path.join(codexDir, 'sessions'))) return null
-  if (now - lastLiveTry >= (lastLiveFailed ? LIVE_RETRY_MS : LIVE_MS)) refreshLimits(now)
-  const startOfDay = new Date(now).setHours(0, 0, 0, 0)
-  const start30 = startOfDay - (DAYS - 1) * DAY
-  const files = rollouts(start30)
-  const seen = new Set()
-  let limits = null
-  let latest = null
-  let tokensToday = 0
-  let tokens5h = 0
-  let tokensWeek = 0
-  let monthTokens = 0
-  const days30 = new Array(DAYS).fill(0)
-  const byModel = new Map()
-  const byProject = new Map()
-  for (const { file, st } of files) {
-    seen.add(file)
-    const sum = readFile(file, st)
-    if (sum.limits && (!limits || sum.limits.ts > limits.ts)) limits = sum.limits
-    if (!latest || sum.mtime > latest.mtime) latest = sum
-    for (const e of sum.events) {
-      if (e.ts < start30) continue
-      monthTokens += e.tokens
-      days30[Math.min(DAYS - 1, Math.floor((e.ts - start30) / DAY))] += e.tokens
-      if (e.ts >= startOfDay) tokensToday += e.tokens
-      if (now - e.ts < 5 * 3600000) tokens5h += e.tokens
-      if (now - e.ts < WEEK) {
-        tokensWeek += e.tokens
-        const m = e.model || 'unknown'
-        byModel.set(m, (byModel.get(m) || 0) + e.tokens)
-        if (e.cwd) {
-          const p = path.basename(e.cwd)
-          byProject.set(p, (byProject.get(p) || 0) + e.tokens)
-        }
-      }
-    }
-  }
-  // whichever is newer: a rollout written after the last live read beats it
-  if (liveLimits && (!limits || liveLimits.ts >= limits.ts)) limits = liveLimits
-  // forget files that aged out of the window
-  for (const f of fileCache.keys()) if (!seen.has(f)) fileCache.delete(f)
-
-  const projects = ranked(byProject)
-  const byProjectArr = projects.slice(0, TOP_PROJECTS)
-  const rest = projects.slice(TOP_PROJECTS)
-  if (rest.length) {
-    byProjectArr.push({
-      label: `other · ${rest.length}`,
-      tokens: rest.reduce((n, p) => n + p.tokens, 0),
-    })
-  }
-
-  const weeklyOnly = !!limits?.weekly && !limits.session
-  return {
-    active: !!latest && now - latest.mtime < ACTIVE_MS,
-    lastSeen: latest ? latest.mtime : null,
-    plan: limits?.plan || null,
-    // with no 5-hour window, the week is the budget that binds: it takes the
-    // session's place, the way Cursor's month does
-    session: limits ? windowNow(weeklyOnly ? limits.weekly : limits.session, now) : null,
-    weekly: limits && !weeklyOnly ? windowNow(limits.weekly, now) : null,
-    weeklyOnly,
-    limitsAt: limits?.ts || null,
-    tokensToday,
-    tokens5h,
-    tokensWeek,
-    byModel: ranked(byModel),
-    byProject: byProjectArr,
-    days30,
-    monthTokens,
-  }
-}
-
-module.exports = { getCodexUsage, refreshLimits, detectCodex, setCodexDir, setCodexBin }

package/config.json

@@ -1,11 +0,0 @@
-{
-  "_note": "Defaults bundled with the app. User settings are saved to ~/.claude-usage-monitor/config.json. Session/weekly % come from your account (log in via Settings).",
-  "mode": "floating",
-  "alerts": true,
-  "alertThresholds": [80, 95],
-  "fireThreshold": 90,
-  "zoom": 100,
-  "pollIntervalMs": 4000,
-  "activeThresholdMs": 20000,
-  "sleepThresholdMs": 300000
-}