gemix-dash 0.0.0-stage → 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Aditya Thummar
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# gemix-dash
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Local web dashboard for [gemix](https://www.npmjs.com/package/gemix) accounts (`~/.gemix`).
+
+## Installation
+
+```sh
+npm install -g gemix-dash
+```
+
+## CLI usage
+
+```sh
+gemix-dash              # start the server and open the dashboard in your browser
+gemix-dash stop         # stop the running server
+gemix-dash status       # check whether the server is running
+gemix-dash -p 8080      # start on a custom port
+gemix-dash --help       # show all options
+```
+
+> The dashboard binds to `127.0.0.1` only. A PID file is written to the OS temp directory so `gemix-dash stop` can find and terminate the process.
+
+## Development
+
+```sh
+npm start        # http://127.0.0.1:4577  (PORT env to change)
+npm test         # smoke test
+```
+
+## Features
+
+- Cards per account with real per-model limits (same source as `agy` `/usage`: Cloud Code `fetchAvailableModels`), cached 60s.
+- Add (Google link + paste code), Use (same as `gemix use`), Rename, Remove, all with confirmations.
+- Binds to 127.0.0.1 only, rejects non-loopback Host/Origin, never sends tokens to the browser.
+- `lib/` is copied from gemix's `dist/`; `oauth.js` is split into `buildAuthUrl` / `exchangeCode` for the web flow.
+- Token refreshes are written back to `~/.gemix/accounts/<name>/tokens.json`.

package/bin/gemix-dash.js

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+import { createServer } from 'node:net';
+import { spawn } from 'node:child_process';
+import { readFileSync, writeFileSync, rmSync, existsSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+// ── helpers ──────────────────────────────────────────────────────────────────
+
+const PID_FILE = path.join(tmpdir(), 'gemix-dash.pid');
+
+function readPid() {
+  try { return JSON.parse(readFileSync(PID_FILE, 'utf8')); } catch { return null; }
+}
+
+function writePid(pid, port) {
+  writeFileSync(PID_FILE, JSON.stringify({ pid, port }), 'utf8');
+}
+
+function removePid() {
+  try { rmSync(PID_FILE); } catch { /* already gone */ }
+}
+
+/** Open a URL in the default browser (cross-platform). */
+function openBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open'
+            : process.platform === 'win32'  ? 'start'
+            : 'xdg-open';
+  spawn(cmd, [url], { detached: true, stdio: 'ignore' }).unref();
+}
+
+/** Check whether a port is already listening. */
+function portInUse(port) {
+  return new Promise((resolve) => {
+    const s = createServer();
+    s.once('error', () => resolve(true));
+    s.once('listening', () => { s.close(); resolve(false); });
+    s.listen(port, '127.0.0.1');
+  });
+}
+
+// ── arg parsing ───────────────────────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+const cmd  = args[0];    // 'stop' | 'status' | undefined
+
+const portIndex = args.findIndex((a) => a === '-p' || a === '--port');
+const cliPort   = portIndex !== -1 ? Number(args[portIndex + 1]) : undefined;
+
+if (args.includes('-h') || args.includes('--help')) {
+  console.log(`
+Usage: gemix-dash [stop|status] [-p <port>]
+
+Local web dashboard for gemix accounts (~/.gemix)
+
+Commands:
+  (none)    Start the server and open the dashboard in your browser
+  stop      Stop a running gemix-dash server
+  status    Show whether gemix-dash is running
+
+Options:
+  -p, --port <number>   Port to listen on (default: 4577 or PORT env)
+  -h, --help            Show this help message
+`);
+  process.exit(0);
+}
+
+// ── stop ──────────────────────────────────────────────────────────────────────
+
+if (cmd === 'stop') {
+  const info = readPid();
+  if (!info) {
+    console.log('gemix-dash is not running.');
+    process.exit(0);
+  }
+  try {
+    process.kill(info.pid, 'SIGTERM');
+    removePid();
+    console.log(`gemix-dash (pid ${info.pid}) stopped.`);
+  } catch {
+    console.log(`Process ${info.pid} not found – cleaning up stale PID file.`);
+    removePid();
+  }
+  process.exit(0);
+}
+
+// ── status ────────────────────────────────────────────────────────────────────
+
+if (cmd === 'status') {
+  const info = readPid();
+  if (!info) {
+    console.log('gemix-dash is not running.');
+    process.exit(0);
+  }
+  try {
+    process.kill(info.pid, 0); // throws if process is gone
+    console.log(`gemix-dash is running  pid=${info.pid}  http://127.0.0.1:${info.port}`);
+  } catch {
+    console.log('gemix-dash is not running (stale PID file removed).');
+    removePid();
+  }
+  process.exit(0);
+}
+
+// ── start ─────────────────────────────────────────────────────────────────────
+
+// Dynamic import so we only load the server when we actually start.
+const { server, PORT: DEFAULT_PORT } = await import('../server.mjs');
+const port = cliPort || Number(process.env.PORT || DEFAULT_PORT);
+
+// Check if already running on this port
+if (await portInUse(port)) {
+  // If there's a PID file for this port, just open the browser
+  const info = readPid();
+  if (info && info.port === port) {
+    console.log(`gemix-dash is already running at http://127.0.0.1:${port}`);
+    openBrowser(`http://127.0.0.1:${port}`);
+    process.exit(0);
+  }
+  console.error(`Error: port ${port} is already in use by another process.`);
+  process.exit(1);
+}
+
+server.listen(port, '127.0.0.1', () => {
+  const url = `http://127.0.0.1:${port}`;
+  console.log(`gemix-dash running at ${url}`);
+  console.log(`Run 'gemix-dash stop' to shut it down.`);
+  writePid(process.pid, port);
+  openBrowser(url);
+});
+
+// Clean up PID file on exit
+function cleanup() {
+  const info = readPid();
+  if (info && info.pid === process.pid) removePid();
+}
+process.on('exit', cleanup);
+process.on('SIGINT',  () => { cleanup(); process.exit(0); });
+process.on('SIGTERM', () => { cleanup(); process.exit(0); });

package/lib/accounts.js

@@ -0,0 +1,209 @@
+import { promises as fs } from 'node:fs';
+import { execSync } from 'node:child_process';
+import { getAccountsFilePath, getActiveFilePath, getAccountTokensPath, getAccountDir, ensureGemxDir, ensureAccountDir, getGeminiOAuthCredsPath, getGeminiGoogleAccountsPath, getAntigravityOAuthTokenPath, } from './paths.js';
+import { refreshTokens } from './oauth.js';
+const DEFAULT_LIMITS = {
+    requestsPerDay: 500,
+    tokensPerDay: 1000000,
+};
+export async function loadAccounts() {
+    await ensureGemxDir();
+    const filePath = getAccountsFilePath();
+    try {
+        const content = await fs.readFile(filePath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return { accounts: {}, active: null };
+    }
+}
+export async function saveAccounts(data) {
+    await ensureGemxDir();
+    const filePath = getAccountsFilePath();
+    await fs.writeFile(filePath, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+export async function loadTokens(username) {
+    const tokensPath = getAccountTokensPath(username);
+    try {
+        const content = await fs.readFile(tokensPath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveTokens(username, tokens) {
+    await ensureAccountDir(username);
+    const tokensPath = getAccountTokensPath(username);
+    await fs.writeFile(tokensPath, JSON.stringify(tokens, null, 2), { mode: 0o600 });
+}
+export async function loadGoogleAccounts() {
+    const filePath = getGeminiGoogleAccountsPath();
+    try {
+        const content = await fs.readFile(filePath, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return { active: '', old: [] };
+    }
+}
+export async function saveGoogleAccounts(data) {
+    const filePath = getGeminiGoogleAccountsPath();
+    const dir = filePath.substring(0, filePath.lastIndexOf('/'));
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(filePath, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+export async function updateGoogleAccountsActive(email) {
+    const data = await loadGoogleAccounts();
+    if (data.active && data.active !== email) {
+        data.old = [...(data.old || []), data.active];
+    }
+    data.active = email;
+    await saveGoogleAccounts(data);
+}
+export async function copyTokensToAntigravity(tokens) {
+    try {
+        const antigravityPath = getAntigravityOAuthTokenPath();
+        const dir = antigravityPath.substring(0, antigravityPath.lastIndexOf('/'));
+        await fs.mkdir(dir, { recursive: true });
+        const antigravityData = {
+            token: {
+                access_token: tokens.access_token,
+                token_type: tokens.token_type,
+                refresh_token: tokens.refresh_token,
+                expiry: new Date(tokens.expiry_date).toISOString(),
+            },
+            auth_method: 'consumer',
+        };
+        await fs.writeFile(antigravityPath, JSON.stringify(antigravityData, null, 2), { mode: 0o600 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function copyTokensToKeychain(tokens) {
+    try {
+        const keychainData = {
+            token: {
+                access_token: tokens.access_token,
+                token_type: tokens.token_type,
+                refresh_token: tokens.refresh_token,
+                expiry: new Date(tokens.expiry_date).toISOString(),
+            },
+            auth_method: 'consumer',
+        };
+        const password = `go-keyring-base64:${Buffer.from(JSON.stringify(keychainData)).toString('base64')}`;
+        try {
+            execSync(`security delete-generic-password -s "gemini" -a "antigravity" 2>/dev/null`, { stdio: 'ignore' });
+        }
+        catch {
+            // Ignore if entry doesn't exist
+        }
+        execSync(`security add-generic-password -s "gemini" -a "antigravity" -w "${password}" -U`, { stdio: 'ignore' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function getActiveUsername() {
+    const activePath = getActiveFilePath();
+    try {
+        return await fs.readFile(activePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+export async function setActiveUsername(username) {
+    await ensureGemxDir();
+    const activePath = getActiveFilePath();
+    await fs.writeFile(activePath, username, { mode: 0o600 });
+}
+export async function copyTokensToGemini(username) {
+    const tokens = await loadTokens(username);
+    if (!tokens)
+        return false;
+    const geminiPath = getGeminiOAuthCredsPath();
+    const geminiDir = geminiPath.substring(0, geminiPath.lastIndexOf('/'));
+    await fs.mkdir(geminiDir, { recursive: true });
+    await fs.writeFile(geminiPath, JSON.stringify(buildGeminiCredsObject(tokens), null, 2), { mode: 0o600 });
+    return true;
+}
+export async function addAccount(username, email, name, picture, tokens, limits = DEFAULT_LIMITS) {
+    const accounts = await loadAccounts();
+    accounts.accounts[username] = {
+        email,
+        name,
+        picture,
+        limits,
+        created: new Date().toISOString(),
+        lastUsed: null,
+    };
+    await saveTokens(username, tokens);
+    await saveAccounts(accounts);
+    if (!accounts.active) {
+        await setActiveUsername(username);
+        accounts.active = username;
+        await saveAccounts(accounts);
+        await updateGoogleAccountsActive(email);
+    }
+}
+export async function removeAccount(username) {
+    const accounts = await loadAccounts();
+    if (!accounts.accounts[username])
+        return false;
+    delete accounts.accounts[username];
+    if (accounts.active === username) {
+        const remaining = Object.keys(accounts.accounts);
+        accounts.active = remaining.length > 0 ? remaining[0] : null;
+    }
+    await fs.rm(getAccountDir(username), { recursive: true, force: true });
+    await saveAccounts(accounts);
+    return true;
+}
+export function buildGeminiCredsObject(tokens) {
+    const creds = {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        scope: tokens.scope,
+        token_type: tokens.token_type,
+        expiry_date: tokens.expiry_date,
+    };
+    if (tokens.id_token) {
+        creds.id_token = tokens.id_token;
+    }
+    return creds;
+}
+export async function switchAccount(username) {
+    const accounts = await loadAccounts();
+    if (!accounts.accounts[username])
+        return false;
+    let tokens = await loadTokens(username);
+    if (!tokens)
+        return false;
+    // Refresh tokens if expired
+    const now = Date.now();
+    const fiveMinutes = 5 * 60 * 1000;
+    if (tokens.expiry_date && tokens.expiry_date - now < fiveMinutes) {
+        const refreshed = await refreshTokens(tokens);
+        if (refreshed) {
+            tokens = refreshed;
+            await saveTokens(username, tokens);
+        }
+    }
+    await fs.mkdir(getGeminiOAuthCredsPath().substring(0, getGeminiOAuthCredsPath().lastIndexOf('/')), { recursive: true });
+    await fs.writeFile(getGeminiOAuthCredsPath(), JSON.stringify(buildGeminiCredsObject(tokens), null, 2), { mode: 0o600 });
+    await copyTokensToAntigravity(tokens);
+    await copyTokensToKeychain(tokens);
+    await updateGoogleAccountsActive(accounts.accounts[username].email);
+    accounts.active = username;
+    accounts.accounts[username].lastUsed = new Date().toISOString();
+    await saveAccounts(accounts);
+    await setActiveUsername(username);
+    return true;
+}
+export function validateUsername(username) {
+    return /^[a-zA-Z0-9]([a-zA-Z0-9-]{1,28}[a-zA-Z0-9])?$/.test(username);
+}

package/lib/oauth.js

@@ -0,0 +1,102 @@
+import * as crypto from 'node:crypto';
+const OAUTH_CLIENT_ID = '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com';
+const OAUTH_CLIENT_SECRET = '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';
+const OAUTH_SCOPE = [
+    'openid',
+    'https://www.googleapis.com/auth/cloud-platform',
+    'https://www.googleapis.com/auth/userinfo.email',
+    'https://www.googleapis.com/auth/userinfo.profile',
+    'https://www.googleapis.com/auth/cclog',
+    'https://www.googleapis.com/auth/experimentsandconfigs',
+];
+const REDIRECT_URI = 'https://antigravity.google/oauth-callback';
+function generateCodeVerifier() {
+    return crypto.randomBytes(32).toString('base64url');
+}
+function generateCodeChallenge(verifier) {
+    return crypto.createHash('sha256').update(verifier).digest('base64url');
+}
+// Split of gemix's interactive authenticateWithGoogle: build URL now, exchange pasted code later.
+export function buildAuthUrl() {
+    const state = crypto.randomBytes(32).toString('hex');
+    const codeVerifier = generateCodeVerifier();
+    const params = new URLSearchParams({
+        client_id: OAUTH_CLIENT_ID,
+        response_type: 'code',
+        redirect_uri: REDIRECT_URI,
+        scope: OAUTH_SCOPE.join(' '),
+        access_type: 'offline',
+        prompt: 'consent',
+        state,
+        code_challenge: generateCodeChallenge(codeVerifier),
+        code_challenge_method: 'S256',
+    });
+    return { url: `https://accounts.google.com/o/oauth2/auth?${params}`, codeVerifier };
+}
+export async function exchangeCode(code, codeVerifier) {
+    const startTime = Date.now();
+    const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' },
+        body: new URLSearchParams({
+            client_id: OAUTH_CLIENT_ID,
+            client_secret: OAUTH_CLIENT_SECRET,
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: REDIRECT_URI,
+            code_verifier: codeVerifier,
+        }),
+    });
+    if (!tokenResponse.ok) {
+        throw new Error(`Token exchange failed: ${tokenResponse.status} ${await tokenResponse.text()}`);
+    }
+    const t = await tokenResponse.json();
+    const userInfoResponse = await fetch('https://www.googleapis.com/oauth2/v2/userinfo', {
+        headers: { Authorization: `Bearer ${t.access_token}` },
+    });
+    if (!userInfoResponse.ok) throw new Error(`Failed to fetch user info: ${userInfoResponse.status}`);
+    const u = await userInfoResponse.json();
+    return {
+        tokens: {
+            access_token: t.access_token,
+            refresh_token: t.refresh_token,
+            id_token: '',
+            scope: t.scope || OAUTH_SCOPE.join(' '),
+            token_type: t.token_type || 'Bearer',
+            expiry_date: startTime + t.expires_in * 1000,
+        },
+        email: u.email,
+        name: u.name,
+        picture: u.picture,
+    };
+}
+export async function refreshTokens(tokens) {
+    try {
+        const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
+            },
+            body: new URLSearchParams({
+                client_id: OAUTH_CLIENT_ID,
+                client_secret: OAUTH_CLIENT_SECRET,
+                refresh_token: tokens.refresh_token,
+                grant_type: 'refresh_token',
+            }),
+        });
+        if (!tokenResponse.ok)
+            return null;
+        const tokenPayload = (await tokenResponse.json());
+        return {
+            access_token: tokenPayload.access_token,
+            refresh_token: tokens.refresh_token,
+            id_token: tokens.id_token || '',
+            scope: tokens.scope,
+            token_type: tokenPayload.token_type || 'Bearer',
+            expiry_date: Date.now() + tokenPayload.expires_in * 1000,
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/lib/paths.js

@@ -0,0 +1,44 @@
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { promises as fs } from 'node:fs';
+const GEMX_DIR = '.gemix';
+const GEMINI_DIR = '.gemini';
+const ACCOUNTS_FILE = 'accounts.json';
+const ACTIVE_FILE = 'active';
+const ACCOUNTS_DIR = 'accounts';
+const OAUTH_CREDS_FILE = 'oauth_creds.json';
+const GOOGLE_ACCOUNTS_FILE = 'google_accounts.json';
+export function getGemxDir() {
+    return path.join(os.homedir(), GEMX_DIR);
+}
+export function getAccountsFilePath() {
+    return path.join(getGemxDir(), ACCOUNTS_FILE);
+}
+export function getActiveFilePath() {
+    return path.join(getGemxDir(), ACTIVE_FILE);
+}
+export function getAccountsDir() {
+    return path.join(getGemxDir(), ACCOUNTS_DIR);
+}
+export function getAccountDir(username) {
+    return path.join(getAccountsDir(), username);
+}
+export function getAccountTokensPath(username) {
+    return path.join(getAccountDir(username), 'tokens.json');
+}
+export function getGeminiOAuthCredsPath() {
+    return path.join(os.homedir(), GEMINI_DIR, OAUTH_CREDS_FILE);
+}
+export function getGeminiGoogleAccountsPath() {
+    return path.join(os.homedir(), GEMINI_DIR, GOOGLE_ACCOUNTS_FILE);
+}
+export function getAntigravityOAuthTokenPath() {
+    return path.join(os.homedir(), GEMINI_DIR, 'antigravity-cli', 'antigravity-oauth-token');
+}
+export async function ensureGemxDir() {
+    await fs.mkdir(getGemxDir(), { recursive: true });
+    await fs.mkdir(getAccountsDir(), { recursive: true });
+}
+export async function ensureAccountDir(username) {
+    await fs.mkdir(getAccountDir(username), { recursive: true });
+}

package/lib/quota.js

@@ -0,0 +1,46 @@
+// Same data agy's /usage shows: Cloud Code retrieveUserQuota -> weekly buckets per model.
+// (fetchAvailableModels.quotaInfo is only the short ~5h window, so it does not match /usage.)
+import { loadTokens, saveTokens } from './accounts.js';
+import { refreshTokens } from './oauth.js';
+
+const HOST = 'https://daily-cloudcode-pa.googleapis.com/v1internal:';
+
+async function call(method, token, body) {
+  const r = await fetch(HOST + method, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', 'User-Agent': 'antigravity' },
+    body: JSON.stringify(body),
+  });
+  if (!r.ok) throw new Error(`${method} ${r.status}`);
+  return r.json();
+}
+
+// Returns a usable access token, refreshing (and persisting) if near expiry. null = dead login.
+export async function freshToken(username) {
+  let t = await loadTokens(username);
+  if (!t) return null;
+  if (!t.expiry_date || t.expiry_date - Date.now() < 5 * 60 * 1000) {
+    const n = await refreshTokens(t);
+    if (!n) return null;
+    t = n;
+    await saveTokens(username, t);
+  }
+  return t;
+}
+
+export async function fetchQuota(username) {
+  const t = await freshToken(username);
+  if (!t) return { status: 'relogin' };
+  try {
+    const a = await call('loadCodeAssist', t.access_token, {
+      metadata: { ideType: 'ANTIGRAVITY', platform: 'PLATFORM_UNSPECIFIED', pluginType: 'GEMINI' },
+    });
+    const q = await call('retrieveUserQuota', t.access_token, { project: a.cloudaicompanionProject });
+    const models = (q.buckets || [])
+      .filter((b) => /^(gemini|claude|gpt)/i.test(b.modelId)) // skips chat_*/tab_* internal buckets
+      .map((b) => ({ id: b.modelId, remaining: b.remainingFraction ?? 0, resetTime: b.resetTime || null }));
+    return { status: 'ok', tier: a.currentTier?.id || null, tokenExpiry: t.expiry_date, models };
+  } catch (e) {
+    return { status: 'error', error: e.message, tokenExpiry: t.expiry_date };
+  }
+}

package/lib/validation.js

@@ -0,0 +1,21 @@
+export function validateUsername(username) {
+    if (!username || username.length < 3) {
+        return { valid: false, error: 'Username must be at least 3 characters' };
+    }
+    if (username.length > 30) {
+        return { valid: false, error: 'Username must be at most 30 characters' };
+    }
+    if (!/^[a-zA-Z0-9]/.test(username)) {
+        return { valid: false, error: 'Username must start with a letter or number' };
+    }
+    if (!/[a-zA-Z0-9]$/.test(username)) {
+        return { valid: false, error: 'Username must end with a letter or number' };
+    }
+    if (!/^[a-zA-Z0-9-]+$/.test(username)) {
+        return { valid: false, error: 'Username can only contain letters, numbers, and hyphens' };
+    }
+    if (username.includes('--')) {
+        return { valid: false, error: 'Username cannot contain consecutive hyphens' };
+    }
+    return { valid: true };
+}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "gemix-dash",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.2",
+  "description": "Local web dashboard for gemix accounts (~/.gemix)",
+  "type": "module",
+  "main": "server.mjs",
+  "bin": {
+    "gemix-dash": "./bin/gemix-dash.js"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "public",
+    "server.mjs"
+  ],
+  "scripts": {
+    "start": "node server.mjs",
+    "test": "node test/smoke.mjs",
+    "prepublishOnly": "npm test"
+  },
+  "keywords": [
+    "gemix",
+    "gemini",
+    "dashboard",
+    "google-accounts",
+    "cli",
+    "webui"
+  ],
+  "author": "Aditya Thummar",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AdityaThummar/gemix-dash.git"
+  },
+  "bugs": {
+    "url": "https://github.com/AdityaThummar/gemix-dash/issues"
+  },
+  "homepage": "https://github.com/AdityaThummar/gemix-dash#readme",
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}

package/public/app.js

@@ -0,0 +1,181 @@
+const $ = (s) => document.querySelector(s);
+const grid = $('#grid');
+let authSession = null;
+
+const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+async function api(method, url, body) {
+  const r = await fetch(url, { method, headers: { 'Content-Type': 'application/json' }, body: body && JSON.stringify(body) });
+  const j = await r.json().catch(() => ({}));
+  if (!r.ok) throw new Error(j.error || r.statusText);
+  return j;
+}
+
+function toast(msg, err) {
+  const t = document.createElement('div');
+  t.className = 'toast' + (err ? ' err' : '');
+  t.textContent = msg;
+  $('#toasts').append(t);
+  setTimeout(() => t.remove(), 4000);
+}
+
+function confirmDialog(title, body, okLabel, destructive) {
+  $('#c-title').textContent = title;
+  $('#c-body').textContent = body;
+  const ok = $('#c-ok');
+  ok.textContent = okLabel;
+  ok.className = 'btn ' + (destructive ? 'destructive' : 'default');
+  const d = $('#dlg-confirm');
+  d.showModal();
+  return new Promise((res) => {
+    ok.onclick = () => { d.close(); res(true); };
+    d.onclose = () => res(false);
+  });
+}
+
+const fmtReset = (iso) => {
+  if (!iso) return '';
+  const ms = new Date(iso) - Date.now();
+  if (ms <= 0) return 'Resets now';
+  const t = Math.ceil(ms / 6e4), h = Math.floor(t / 60), m = t % 60;
+  return 'Resets in ' + (h >= 24 ? `${Math.floor(h / 24)}d ${h % 24}h` : h ? `${h}h ${m}m` : `${m}m`);
+};
+const barColor = (f) => (f > 0.5 ? 'var(--ok)' : f > 0.2 ? 'var(--warn)' : 'var(--destructive)');
+
+const SEGS = 24;
+function modelRow(m) {
+  const pct = Math.round(m.remaining * 100);
+  const on = Math.ceil(m.remaining * SEGS);
+  const cells = Array.from({ length: SEGS }, (_, i) => `<i${i < on ? ` style="background:${barColor(m.remaining)}"` : ''}></i>`).join('');
+  return `<div class="model" title="${esc(m.id)}">
+    <span class="lbl">${esc(m.name)}</span>
+    <span class="pct">${pct}<small>%</small></span>
+    <div class="seg">${cells}</div>
+    <span class="reset">${fmtReset(m.resetTime) || '&nbsp;'}</span></div>`;
+}
+
+function health(q) {
+  if (q.status === 'relogin') return '<span class="badge bad">Re-login needed</span>';
+  if (q.status === 'error') return `<span class="badge warn" title="${esc(q.error)}">Quota unavailable</span>`;
+  return '<span class="badge ok">Token OK</span>';
+}
+
+function card(a) {
+  const q = a.quota;
+  // Two pools: Gemini vs third-party (Claude, GPT-OSS). Show the tightest model of each.
+  const pool = (test) => (q.models || []).filter((m) => test(m.id)).sort((x, y) => x.remaining - y.remaining)[0];
+  const rows = [
+    ['Gemini', pool((n) => /^gemini/i.test(n))],
+    ['Claude & GPT', pool((n) => !/^gemini/i.test(n))],
+  ].filter(([, m]) => m).map(([label, m]) => modelRow({ ...m, name: label }));
+  const body = q.status === 'ok' ? rows.join('') || '<span class="muted">No quota data</span>'
+    : q.status === 'relogin' ? '<span class="muted">Remove and add this account again.</span>'
+    : '<span class="muted">Could not load limits. Try Refresh.</span>';
+  return `<article class="card${a.active ? ' active' : ''}" data-u="${esc(a.username)}">
+    <div class="card-head">
+      <img class="avatar" src="${esc(a.picture)}" alt="" referrerpolicy="no-referrer">
+      <div class="who"><b>${esc(a.username)}</b><span>${esc(a.email)}</span></div>
+      ${a.active ? '<span class="badge primary">Active</span>' : ''}
+    </div>
+    <div class="badges">${q.tier ? `<span class="badge">${esc(q.tier)}</span>` : ''}${health(q)}</div>
+    <div class="card-body">${body}</div>
+    <div class="card-foot">
+      <button class="btn ghost sm" data-act="rename">Rename</button>
+      <button class="btn ghost sm danger" data-act="remove">Remove</button>
+      <span class="grow"></span>
+      ${a.active ? '<span class="in-use">In use</span>' : '<button class="btn outline sm use" data-act="switch">Use account</button>'}
+    </div></article>`;
+}
+
+async function load(force) {
+  if (!grid.children.length) grid.innerHTML = '<div class="skeleton"></div>'.repeat(3);
+  try {
+    const { accounts } = await api('GET', '/api/accounts' + (force ? '?refresh=1' : ''));
+    document.getElementById('summary').textContent = `${accounts.length} account${accounts.length === 1 ? '' : 's'}`;
+    grid.innerHTML = accounts.length ? accounts.map(card).join('') : '<div class="empty">No accounts yet. Click “Add account”.</div>';
+  } catch (e) { toast(e.message, true); }
+}
+
+grid.addEventListener('click', async (e) => {
+  const b = e.target.closest('[data-act]');
+  if (!b) return;
+  const u = b.closest('.card').dataset.u;
+  const act = b.dataset.act;
+  try {
+    if (act === 'switch') {
+      if (!(await confirmDialog(`Switch to ${u}?`, 'Replaces the login used by Gemini CLI and Antigravity. Running sessions may need a restart.', 'Switch'))) return;
+      await api('POST', `/api/accounts/${encodeURIComponent(u)}/switch`);
+      toast(`Switched to ${u}`);
+    }
+    if (act === 'remove') {
+      if (!(await confirmDialog(`Remove ${u}?`, 'Deletes the saved login from gemix. You can add it again later.', 'Remove', true))) return;
+      await api('DELETE', `/api/accounts/${encodeURIComponent(u)}`);
+      toast(`Removed ${u}`);
+    }
+    if (act === 'rename') {
+      $('#rn-name').value = u;
+      const d = $('#dlg-rename');
+      d.showModal();
+      $('#rn-ok').onclick = async () => {
+        try {
+          await api('PATCH', `/api/accounts/${encodeURIComponent(u)}`, { name: $('#rn-name').value.trim() });
+          d.close(); toast('Renamed'); // Theme: Auto follows the OS, Light/Dark pin it (remembered per browser).
+function setTheme(t) {
+  if (t === 'system') delete document.documentElement.dataset.theme; else document.documentElement.dataset.theme = t;
+  try { t === 'system' ? localStorage.removeItem('theme') : localStorage.setItem('theme', t); } catch {}
+  document.querySelectorAll('[data-theme-set]').forEach((b) => b.setAttribute('aria-pressed', String(b.dataset.themeSet === t)));
+}
+document.querySelectorAll('[data-theme-set]').forEach((b) => (b.onclick = () => setTheme(b.dataset.themeSet)));
+setTheme(document.documentElement.dataset.theme || 'system');
+
+load();
+        } catch (err) { toast(err.message, true); }
+      };
+      return;
+    }
+    load(true);
+  } catch (err) { toast(err.message, true); }
+});
+
+document.addEventListener('click', (e) => { if (e.target.matches('[data-close]')) e.target.closest('dialog').close(); });
+$('#refresh').onclick = () => load(true);
+
+// Add flow: name -> link -> paste code
+$('#add').onclick = () => {
+  authSession = null;
+  $('#add-name').value = ''; $('#add-code').value = '';
+  $('#add-link').classList.add('hidden');
+  $('#add-go').textContent = 'Get login link';
+  $('#dlg-add').showModal();
+};
+$('#copy-url').onclick = () => navigator.clipboard.writeText($('#add-url').value).then(() => toast('Link copied'));
+$('#open-url').onclick = () => window.open($('#add-url').value, '_blank', 'noopener');
+$('#add-go').onclick = async () => {
+  const name = $('#add-name').value.trim();
+  const btn = $('#add-go');
+  btn.disabled = true;
+  try {
+    if (!authSession) {
+      if (!name) throw new Error('Enter a name');
+      authSession = await api('POST', '/api/auth-url');
+      $('#add-url').value = authSession.url;
+      $('#add-link').classList.remove('hidden');
+      btn.textContent = 'Register';
+    } else {
+      await api('POST', '/api/accounts', { name, code: $('#add-code').value, id: authSession.id });
+      $('#dlg-add').close(); toast(`Added ${name}`); load(true);
+    }
+  } catch (e) { toast(e.message, true); }
+  btn.disabled = false;
+};
+
+// Theme: Auto follows the OS, Light/Dark pin it (remembered per browser).
+function setTheme(t) {
+  if (t === 'system') delete document.documentElement.dataset.theme; else document.documentElement.dataset.theme = t;
+  try { t === 'system' ? localStorage.removeItem('theme') : localStorage.setItem('theme', t); } catch {}
+  document.querySelectorAll('[data-theme-set]').forEach((b) => b.setAttribute('aria-pressed', String(b.dataset.themeSet === t)));
+}
+document.querySelectorAll('[data-theme-set]').forEach((b) => (b.onclick = () => setTheme(b.dataset.themeSet)));
+setTheme(document.documentElement.dataset.theme || 'system');
+
+load();

package/public/index.html

@@ -0,0 +1,77 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>gemix dashboard</title>
+<script>try { const t = localStorage.getItem('theme'); if (t) document.documentElement.dataset.theme = t; } catch {}</script>
+<link rel="stylesheet" href="style.css">
+</head>
+<body>
+<header class="topbar"><div class="wrap">
+  <span class="wordmark">gemix</span>
+  <div class="right">
+    <span class="muted mono">local · 127.0.0.1</span>
+    <div class="theme-toggle" role="group" aria-label="Theme">
+      <button data-theme-set="system">Auto</button><button data-theme-set="light">Light</button><button data-theme-set="dark">Dark</button>
+    </div>
+  </div>
+</div></header>
+<div class="wrap">
+  <section class="pagehead">
+    <div>
+      <h1>Accounts</h1>
+      <p class="muted">Weekly limits per Google login. Same numbers as <code>agy /usage</code>.</p>
+    </div>
+    <div class="actions">
+      <span class="muted mono" id="summary"></span>
+      <button class="btn outline" id="refresh">Refresh limits</button>
+      <button class="btn default" id="add">Add account</button>
+    </div>
+  </section>
+  <main id="grid" class="grid"></main>
+</div>
+
+<dialog id="dlg-add" class="dialog">
+  <h2>Add account</h2>
+  <p class="muted">Name it, sign in with Google, then paste the code shown after login.</p>
+  <label class="label" for="add-name">Name</label>
+  <input class="input" id="add-name" placeholder="e.g. work" autocomplete="off">
+  <div id="add-link" class="hidden">
+    <label class="label">Login link</label>
+    <div class="row">
+      <input class="input mono" id="add-url" readonly>
+      <button class="btn outline" id="copy-url">Copy</button>
+      <button class="btn outline" id="open-url">Open</button>
+    </div>
+    <label class="label" for="add-code">Authorization code</label>
+    <input class="input mono" id="add-code" placeholder="Paste code here" autocomplete="off">
+  </div>
+  <div class="footer">
+    <button class="btn ghost" data-close>Cancel</button>
+    <button class="btn default" id="add-go">Get login link</button>
+  </div>
+</dialog>
+
+<dialog id="dlg-confirm" class="dialog">
+  <h2 id="c-title"></h2>
+  <p class="muted" id="c-body"></p>
+  <div class="footer">
+    <button class="btn ghost" data-close>Cancel</button>
+    <button class="btn default" id="c-ok">Confirm</button>
+  </div>
+</dialog>
+
+<dialog id="dlg-rename" class="dialog">
+  <h2>Rename account</h2>
+  <input class="input" id="rn-name" autocomplete="off">
+  <div class="footer">
+    <button class="btn ghost" data-close>Cancel</button>
+    <button class="btn default" id="rn-ok">Save</button>
+  </div>
+</dialog>
+
+<div id="toasts" class="toasts"></div>
+<script src="app.js"></script>
+</body>
+</html>

package/public/style.css

@@ -0,0 +1,132 @@
+/* Square corners, roomy spacing. Colors = Gemini app's Material 3 palette, dark + light. */
+:root, :root[data-theme="dark"] {
+  color-scheme: dark;
+  --background: #131314; --card: #1b1c1d; --panel: #232425;
+  --foreground: #e3e3e3; --muted-foreground: #a8abae;
+  --border: #2f3133; --border-strong: #444746; --track: #303234;
+  --primary: #a8c7fa; --primary-hover: #c2d7fb; --on-primary: #062e6f;
+  --destructive: #f2b8b5; --ok: #6dd58c; --warn: #fdd663;
+  --gemini: linear-gradient(90deg, #4285f4, #9b72cb, #d96570);
+  --mono: ui-monospace, "SF Mono", Menlo, Consolas, monospace;
+}
+:root[data-theme="light"] {
+  color-scheme: light;
+  --background: #f8fafd; --card: #ffffff; --panel: #f0f4f9;
+  --foreground: #1f1f1f; --muted-foreground: #5f6368;
+  --border: #e1e5ea; --border-strong: #c4c7c5; --track: #e3e8ef;
+  --primary: #0b57d0; --primary-hover: #0842a0; --on-primary: #ffffff;
+  --destructive: #b3261e; --ok: #146c2e; --warn: #8a5a00;
+}
+@media (prefers-color-scheme: light) {
+  :root:not([data-theme]) {
+    color-scheme: light;
+    --background: #f8fafd; --card: #ffffff; --panel: #f0f4f9;
+    --foreground: #1f1f1f; --muted-foreground: #5f6368;
+    --border: #e1e5ea; --border-strong: #c4c7c5; --track: #e3e8ef;
+    --primary: #0b57d0; --primary-hover: #0842a0; --on-primary: #ffffff;
+    --destructive: #b3261e; --ok: #146c2e; --warn: #8a5a00;
+  }
+}
+* { box-sizing: border-box; border-radius: 0; }
+body { margin: 0; background: var(--background); color: var(--foreground);
+  font: 14px/1.55 Inter, system-ui, -apple-system, sans-serif; -webkit-font-smoothing: antialiased; }
+.wrap { max-width: 1240px; margin: 0 auto; padding: 0 32px; }
+.muted { color: var(--muted-foreground); }
+.mono { font-family: var(--mono); font-size: 12px; }
+.hidden { display: none; }
+code { font-family: var(--mono); font-size: 12px; padding: 1px 6px; background: var(--panel); border: 1px solid var(--border); }
+
+.topbar { border-bottom: 1px solid var(--border); }
+.topbar .wrap { display: flex; justify-content: space-between; align-items: center; height: 60px; }
+.wordmark { display: flex; align-items: center; gap: 10px; font: 700 15px var(--mono); letter-spacing: .18em; text-transform: uppercase; }
+.wordmark::before { content: ""; width: 14px; height: 14px; background: var(--gemini); }
+
+.pagehead { display: flex; justify-content: space-between; align-items: flex-end; gap: 24px; flex-wrap: wrap; padding: 48px 0 28px; }
+.pagehead h1 { margin: 0 0 6px; font-size: 30px; font-weight: 650; letter-spacing: -.02em; }
+.pagehead p { margin: 0; }
+.actions { display: flex; align-items: center; gap: 10px; }
+.actions .mono { margin-right: 8px; }
+
+.grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(360px, 1fr)); gap: 20px; padding-bottom: 64px; }
+
+.card { position: relative; display: flex; flex-direction: column; background: var(--card); border: 1px solid var(--border);
+  transition: border-color .15s, box-shadow .15s; }
+.card:hover { border-color: var(--border-strong); }
+.card.active { border-color: color-mix(in srgb, var(--primary) 55%, transparent); box-shadow: 0 0 0 1px color-mix(in srgb, var(--primary) 25%, transparent); }
+.card.active::before { content: ""; position: absolute; left: -1px; right: -1px; top: -1px; height: 3px; background: var(--gemini); }
+.card-head { display: flex; gap: 14px; align-items: center; padding: 24px 24px 0; }
+.avatar { width: 44px; height: 44px; flex: none; object-fit: cover; background: var(--panel); }
+.who { min-width: 0; flex: 1; }
+.who b { display: block; font-size: 16px; font-weight: 600; }
+.who span { display: block; font-size: 13px; color: var(--muted-foreground); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+
+.badges { display: flex; gap: 6px; flex-wrap: wrap; padding: 14px 24px 0; }
+.badge { font: 600 10px var(--mono); letter-spacing: .08em; text-transform: uppercase; padding: 4px 8px;
+  border: 1px solid var(--border-strong); color: var(--muted-foreground); }
+.badge.primary { align-self: flex-start; background: var(--primary); border-color: var(--primary); color: var(--on-primary); }
+.badge.ok { color: var(--ok); border-color: color-mix(in srgb, var(--ok) 35%, transparent); background: color-mix(in srgb, var(--ok) 8%, transparent); }
+.badge.warn { color: var(--warn); border-color: color-mix(in srgb, var(--warn) 35%, transparent); background: color-mix(in srgb, var(--warn) 8%, transparent); }
+.badge.bad { color: var(--destructive); border-color: color-mix(in srgb, var(--destructive) 35%, transparent); background: color-mix(in srgb, var(--destructive) 8%, transparent); }
+
+.card-body { flex: 1; display: grid; grid-template-columns: 1fr 1fr; gap: 12px; padding: 20px 24px 24px; }
+.card-body > .muted { grid-column: 1 / -1; padding: 14px; background: var(--panel); border: 1px solid var(--border); }
+.model { display: grid; grid-template-columns: 1fr auto; align-items: baseline; row-gap: 10px;
+  padding: 14px; background: var(--panel); border: 1px solid var(--border); }
+.lbl { font: 600 11px var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--muted-foreground); }
+.pct { font: 700 22px/1 var(--mono); }
+.pct small { font-size: 11px; color: var(--muted-foreground); margin-left: 1px; }
+.seg { grid-column: 1 / -1; display: grid; grid-template-columns: repeat(24, 1fr); gap: 2px; height: 8px; }
+.seg i { background: var(--track); }
+.reset { grid-column: 1 / -1; font-size: 12px; color: var(--muted-foreground); }
+
+.card-foot { display: flex; align-items: center; gap: 6px; padding: 14px 24px; border-top: 1px solid var(--border); }
+.card-foot .grow { flex: 1; }
+.in-use { font: 600 11px var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--primary); padding: 0 4px; }
+
+.btn { height: 38px; padding: 0 16px; border: 1px solid var(--border-strong); background: transparent; color: var(--foreground);
+  font: 500 13px Inter, system-ui, sans-serif; cursor: pointer; transition: background .12s, border-color .12s, color .12s; }
+.btn:hover:not(:disabled) { background: var(--panel); border-color: var(--muted-foreground); }
+.btn:disabled { opacity: .4; cursor: not-allowed; }
+.btn.default { background: var(--primary); border-color: var(--primary); color: var(--on-primary); }
+.btn.default:hover:not(:disabled) { background: var(--primary-hover); border-color: var(--primary-hover); }
+.btn.destructive { background: var(--destructive); border-color: var(--destructive); color: var(--on-primary); }
+.btn.ghost { border-color: transparent; color: var(--muted-foreground); }
+.btn.ghost:hover:not(:disabled) { color: var(--foreground); background: var(--panel); border-color: transparent; }
+.btn.ghost.danger:hover:not(:disabled) { color: var(--destructive); }
+.btn.sm { height: 34px; padding: 0 12px; }
+.btn:focus-visible, .input:focus-visible { outline: 2px solid var(--primary); outline-offset: 2px; }
+
+.skeleton { height: 290px; background: linear-gradient(90deg, var(--card), var(--panel), var(--card)); background-size: 200% 100%;
+  border: 1px solid var(--border); animation: sk 1.4s infinite; }
+@keyframes sk { to { background-position: -200% 0; } }
+.empty { grid-column: 1 / -1; text-align: center; padding: 80px 20px; color: var(--muted-foreground); border: 1px dashed var(--border-strong); }
+
+.dialog { background: var(--card); color: var(--foreground); border: 1px solid var(--border-strong); padding: 28px; width: min(500px, 92vw); }
+.dialog::backdrop { background: rgb(0 0 0 / .6); backdrop-filter: blur(2px); }
+.dialog h2 { margin: 0 0 6px; font-size: 18px; font-weight: 600; }
+.dialog > p { margin: 0; font-size: 13px; }
+.label { display: block; margin: 18px 0 8px; font: 600 11px var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--muted-foreground); }
+.input { width: 100%; height: 40px; padding: 0 12px; border: 1px solid var(--border-strong); background: var(--background); color: var(--foreground); font: inherit; }
+.input:focus { border-color: var(--primary); outline: none; }
+.input.mono { font: 12px var(--mono); }
+.row { display: flex; gap: 8px; } .row .input { flex: 1; min-width: 0; }
+.footer { display: flex; justify-content: flex-end; gap: 8px; margin-top: 28px; }
+
+.toasts { position: fixed; right: 24px; bottom: 24px; display: flex; flex-direction: column; gap: 8px; }
+.toast { background: var(--panel); border: 1px solid var(--border-strong); border-left: 3px solid var(--primary);
+  padding: 12px 16px; max-width: 360px; font-size: 13px; }
+.toast.err { border-left-color: var(--destructive); }
+
+@media (max-width: 640px) {
+  .wrap { padding: 0 16px; }
+  .grid { grid-template-columns: 1fr; }
+  .card-body { grid-template-columns: 1fr; }
+}
+.btn.use { color: var(--primary); border-color: color-mix(in srgb, var(--primary) 45%, transparent); }
+.btn.use:hover:not(:disabled) { background: var(--primary); border-color: var(--primary); color: var(--on-primary); }
+.theme-toggle { display: flex; border: 1px solid var(--border-strong); }
+.theme-toggle button { height: 30px; padding: 0 10px; border: 0; background: transparent; color: var(--muted-foreground);
+  font: 600 10px var(--mono); letter-spacing: .08em; text-transform: uppercase; cursor: pointer; }
+.theme-toggle button + button { border-left: 1px solid var(--border-strong); }
+.theme-toggle button[aria-pressed="true"] { background: var(--panel); color: var(--foreground); }
+.topbar .right { display: flex; align-items: center; gap: 16px; }

package/server.mjs

@@ -0,0 +1,135 @@
+import http from 'node:http';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import {
+  loadAccounts, saveAccounts, addAccount, removeAccount, switchAccount,
+  loadTokens, getActiveUsername, setActiveUsername,
+} from './lib/accounts.js';
+import { getAccountDir } from './lib/paths.js';
+import { buildAuthUrl, exchangeCode } from './lib/oauth.js';
+import { fetchQuota } from './lib/quota.js';
+import { validateUsername } from './lib/validation.js';
+
+export const PORT = Number(process.env.PORT || 4577);
+const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), 'public');
+const TYPES = { '.html': 'text/html', '.js': 'text/javascript', '.css': 'text/css' };
+const CACHE_MS = 60_000;
+
+const quotaCache = new Map(); // username -> { at, data }
+const pending = new Map();    // auth session id -> { codeVerifier, at }
+
+const send = (res, code, body) => {
+  res.writeHead(code, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(body));
+};
+
+// Block DNS-rebinding / cross-site calls: only loopback Host, and Origin (if sent) must match.
+const hostOk = (req) => {
+  const h = (req.headers.host || '').replace(/:\d+$/, '');
+  if (h !== '127.0.0.1' && h !== 'localhost') return false;
+  const o = req.headers.origin;
+  return !o || o === `http://${req.headers.host}`;
+};
+
+const readJson = async (req) => {
+  let s = '';
+  for await (const c of req) { s += c; if (s.length > 1e5) throw new Error('too large'); }
+  return s ? JSON.parse(s) : {};
+};
+
+async function quotaFor(name, force) {
+  const hit = quotaCache.get(name);
+  if (!force && hit && Date.now() - hit.at < CACHE_MS) return hit.data;
+  const data = await fetchQuota(name);
+  quotaCache.set(name, { at: Date.now(), data });
+  return data;
+}
+
+async function listAccounts(force) {
+  const { accounts } = await loadAccounts();
+  const active = (await getActiveUsername())?.trim() || null;
+  const out = await Promise.all(Object.entries(accounts).map(async ([username, a]) => ({
+    username, email: a.email, name: a.name, picture: a.picture,
+    created: a.created, lastUsed: a.lastUsed, active: username === active,
+    quota: await quotaFor(username, force),
+  })));
+  return { active, accounts: out };
+}
+
+async function rename(oldName, newName) {
+  const v = validateUsername(newName);
+  if (!v.valid) throw Object.assign(new Error(v.error), { code: 400 });
+  const data = await loadAccounts();
+  if (!data.accounts[oldName]) throw Object.assign(new Error('not found'), { code: 404 });
+  if (data.accounts[newName]) throw Object.assign(new Error('name taken'), { code: 409 });
+  await fs.rename(getAccountDir(oldName), getAccountDir(newName));
+  data.accounts[newName] = data.accounts[oldName];
+  delete data.accounts[oldName];
+  if (data.active === oldName) data.active = newName;
+  await saveAccounts(data);
+  if ((await getActiveUsername())?.trim() === oldName) await setActiveUsername(newName);
+  quotaCache.delete(oldName);
+}
+
+async function api(req, res, url) {
+  const m = req.method;
+  const seg = url.pathname.split('/').filter(Boolean); // ['api','accounts',name,action]
+  const name = seg[2] && decodeURIComponent(seg[2]);
+
+  if (m === 'GET' && url.pathname === '/api/accounts') {
+    return send(res, 200, await listAccounts(url.searchParams.get('refresh') === '1'));
+  }
+  if (m === 'POST' && url.pathname === '/api/auth-url') {
+    const { url: authUrl, codeVerifier } = buildAuthUrl();
+    const id = crypto.randomUUID();
+    for (const [k, v] of pending) if (Date.now() - v.at > 10 * 60_000) pending.delete(k);
+    pending.set(id, { codeVerifier, at: Date.now() });
+    return send(res, 200, { id, url: authUrl });
+  }
+  if (m === 'POST' && url.pathname === '/api/accounts') {
+    const { name: n, code, id } = await readJson(req);
+    const v = validateUsername(n);
+    if (!v.valid) return send(res, 400, { error: v.error });
+    if ((await loadAccounts()).accounts[n]) return send(res, 409, { error: `'${n}' already exists` });
+    const sess = pending.get(id);
+    if (!sess || !code?.trim()) return send(res, 400, { error: 'Auth session expired, reopen the link' });
+    const r = await exchangeCode(code.trim(), sess.codeVerifier);
+    pending.delete(id);
+    await addAccount(n, r.email, r.name, r.picture, r.tokens);
+    return send(res, 200, { ok: true, email: r.email });
+  }
+  if (name && m === 'POST' && seg[3] === 'switch') {
+    return (await switchAccount(name)) ? send(res, 200, { ok: true }) : send(res, 404, { error: 'not found or no tokens' });
+  }
+  if (name && m === 'DELETE' && !seg[3]) {
+    quotaCache.delete(name);
+    return (await removeAccount(name)) ? send(res, 200, { ok: true }) : send(res, 404, { error: 'not found' });
+  }
+  if (name && m === 'PATCH' && !seg[3]) {
+    await rename(name, (await readJson(req)).name);
+    return send(res, 200, { ok: true });
+  }
+  send(res, 404, { error: 'not found' });
+}
+
+export const server = http.createServer(async (req, res) => {
+  try {
+    if (!hostOk(req)) return send(res, 403, { error: 'forbidden' });
+    const url = new URL(req.url, 'http://x');
+    if (url.pathname.startsWith('/api/')) return await api(req, res, url);
+    const file = path.join(PUBLIC, url.pathname === '/' ? 'index.html' : url.pathname);
+    if (!file.startsWith(PUBLIC + path.sep)) return send(res, 403, { error: 'forbidden' });
+    const body = await fs.readFile(file).catch(() => null);
+    if (!body) return send(res, 404, { error: 'not found' });
+    res.writeHead(200, { 'Content-Type': TYPES[path.extname(file)] || 'application/octet-stream' });
+    res.end(body);
+  } catch (e) {
+    send(res, e.code >= 400 && e.code < 500 ? e.code : 500, { error: e.message });
+  }
+});
+
+const isMain = process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href;
+if (isMain) {
+  server.listen(PORT, '127.0.0.1', () => console.log(`gemix-dash on http://127.0.0.1:${PORT}`));
+}