headroomhq 0.0.0-stage → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Amit Ray
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md CHANGED
@@ -1,3 +1,237 @@
1
- # Temporary Holding Version
1
+ <div align="center">
2
2
 
3
- This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
3
+ <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/apps/web/public/favicon.svg?sanitize=true" width="72" height="72" alt="Headroom logo">
4
+
5
+ # Headroom
6
+
7
+ **Every AI plan you pay for, on one screen.**
8
+
9
+ Self-hosted dashboard for Claude, Codex, Cursor, Copilot, Grok, Antigravity and Vercel AI Gateway.<br>
10
+ Live limits, resets, credits and spend for every account, with credentials encrypted on your own server.
11
+
12
+ [![CI](https://github.com/amitray007/headroom/actions/workflows/ci.yml/badge.svg)](https://github.com/amitray007/headroom/actions/workflows/ci.yml)
13
+ [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/amitray007/headroom/blob/v0.1.3/LICENSE)
14
+ [![Self-hosted](https://img.shields.io/badge/self--hosted-yes-2ea44f)](#quick-start)
15
+ [![Bun](https://img.shields.io/badge/Bun-1.4-000000?logo=bun&logoColor=white)](https://bun.sh)
16
+ [![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178C6?logo=typescript&logoColor=white)](https://github.com/amitray007/headroom/blob/v0.1.3/tsconfig.json)
17
+ [![React](https://img.shields.io/badge/React-19-149ECA?logo=react&logoColor=white)](https://github.com/amitray007/headroom/blob/v0.1.3/apps/web)
18
+ [![SQLite](https://img.shields.io/badge/SQLite-embedded-003B57?logo=sqlite&logoColor=white)](https://github.com/amitray007/headroom/blob/v0.1.3/docs/architecture/data-model.md)
19
+ [![Docker](https://img.shields.io/badge/Docker-ghcr.io-2496ED?logo=docker&logoColor=white)](#docker)
20
+ [![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/amitray007/headroom/blob/v0.1.3/CONTRIBUTING.md)
21
+ [![Sponsor](https://img.shields.io/badge/sponsor-GitHub%20Sponsors-EA4AAA?logo=githubsponsors&logoColor=white)](https://github.com/sponsors/amitray007)
22
+
23
+ [Live demo](https://headroom.theblank.club/) · [Quick start](#quick-start) · [Screenshots](#screenshots) · [Providers](#supported-providers) · [How it works](#how-it-works) · [Docs](https://github.com/amitray007/headroom/blob/v0.1.3/docs/README.md)
24
+
25
+ <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/detailed.png" alt="Headroom Detailed view: every account sorted by how close it is to its limit" width="900">
26
+
27
+ <sub>All screenshots use Demo Mode: synthetic accounts on reserved <code>example</code> domains.</sub>
28
+
29
+ </div>
30
+
31
+ ## Why Headroom
32
+
33
+ You pay for several AI plans, often more than one account each. Each one shows its limits somewhere else, in a different unit, with a different reset. You find out an account is spent when a request fails halfway through a task.
34
+
35
+ Headroom signs in to each account once, refreshes them in the background, and shows everything on one page: what is left, when it resets, which account to use next, and what it all costs.
36
+
37
+ ## Why there is no cloud version
38
+
39
+ Headroom holds the sign-in tokens for every AI account you connect. A hosted copy would put everyone's tokens on one server that someone else runs, which defeats the purpose. Run it on a server you control, and your tokens stay there. There is no hosted Headroom, and none is planned.
40
+
41
+ ## Features
42
+
43
+ - **Every limit in one place.** 5-hour sessions, weekly pools, per-model limits, credit balances, banked resets and on-demand spend, side by side.
44
+ - **Know which account to use next.** Compare ranks accounts of a provider by the room they have left and names the one to use.
45
+ - **See resets coming.** Timeline lays every window on a calendar, so you know when headroom comes back.
46
+ - **Track what you pay.** Wallet totals subscriptions, usage spend and top-ups in one currency, with upcoming renewals.
47
+ - **Get warned in time.** In-app notices, Telegram and signed webhooks for limits running low, new and expiring resets, early resets, your own spend budgets and broken sign-ins.
48
+ - **Automations you switch on.** Use a banked Codex reset when a limit runs out, and record credit top-ups in the Wallet as soon as a balance rises.
49
+ - **Many accounts per provider.** Personal, work and side-project accounts stay separate, each with its own credentials.
50
+ - **Private by design.** One owner, passkeys, encrypted credentials, and a Privacy Mode that blurs emails on screen.
51
+ - **Works on your phone.** Every view is built for small screens.
52
+
53
+ ## Screenshots
54
+
55
+ | Overview | Compare |
56
+ | :---: | :---: |
57
+ | <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/overview.png" alt="Overview: one panel per account with its limits, credits and resets" width="420"> | <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/compare.png" alt="Compare: accounts of one provider ranked by room left, with a recommendation" width="420"> |
58
+ | **Timeline** | **Wallet** |
59
+ | <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/timeline.png" alt="Timeline: limit windows on a two-week calendar" width="420"> | <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/wallet.png" alt="Wallet: monthly spend by provider, top-ups and renewals" width="420"> |
60
+ | **Connect** | **Light theme** |
61
+ | <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/connect.png" alt="Connect: pick a provider and manage connected accounts" width="420"> | <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/overview-light.png" alt="Overview in the light theme" width="420"> |
62
+
63
+ <p align="center">
64
+ <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/mobile-detailed.png" alt="Detailed view on a phone" width="240">
65
+ &nbsp;&nbsp;
66
+ <img src="https://raw.githubusercontent.com/amitray007/headroom/v0.1.3/docs/assets/screenshots/mobile-wallet.png" alt="Wallet on a phone" width="240">
67
+ </p>
68
+
69
+ ## Supported providers
70
+
71
+ | Provider | Sign-in | What you see | Interface |
72
+ | --- | --- | --- | --- |
73
+ | Claude | Claude Code sign-in, or import `.credentials.json` | Session and weekly limits, per-model limits, extra-usage spend, reset grants | Private |
74
+ | Codex | Codex CLI device sign-in, or import `auth.json` | 5-hour and weekly limits, credits, banked reset credits | Private |
75
+ | Cursor | Browser approval | Included usage, Auto and API pools, Grok Bot, on-demand spend | Private |
76
+ | Copilot | GitHub device code, or import a `gh` token | AI credits, credits used, extra usage, chat and completions | Private |
77
+ | Grok | Grok CLI device sign-in, or import `auth.json` | Weekly pool, chat and code share, on-demand cap, prepaid balance | Private |
78
+ | Antigravity | Google sign-in, then paste the redirect | Gemini and Claude/GPT quota pools | Private |
79
+ | Vercel AI Gateway | API key | Credit balance, credits used, spend | Official |
80
+
81
+ - **Private:** the endpoint the provider's own app or CLI calls. It can change without notice.
82
+ - **Official:** a published API.
83
+ - **Enable providers** with `HEADROOM_ENABLED_PROVIDERS`. The default is all seven.
84
+ - **Evidence:** the [provider dossiers](https://github.com/amitray007/headroom/blob/v0.1.3/docs/providers/README.md) record what is validated.
85
+
86
+ ## How it works
87
+
88
+ ```mermaid
89
+ flowchart LR
90
+ you([You]) -->|browser or phone| web[Web app]
91
+ web -->|session-checked API| server[Headroom server]
92
+ server --> db[(SQLite<br/>credentials sealed<br/>with AES-256-GCM)]
93
+ server --> sched[Scheduler]
94
+ sched --> conn[Connectors]
95
+ conn -->|direct HTTPS| prov[Provider APIs]
96
+ cli[Official CLI] -.->|once, at sign-in| server
97
+ server -->|alerts| out[Telegram / webhooks]
98
+ ```
99
+
100
+ - Sign in once. Where a provider needs it, its official CLI runs one time on the server to sign in. Headroom seals the result with a master key kept outside the database.
101
+ - Refresh in the background. The scheduler collects each account over direct HTTPS on your interval, refreshes tokens before they expire, and keeps 90 days of history by default.
102
+ - Read only by default. Monitoring never sends a model request, redeems a reset or buys credits. Using a banked Codex reset needs "Allow Account Actions" and either a press-and-hold or an auto-reset rule you set.
103
+ - Unknown is not zero. A figure a provider does not report shows as unknown, never as 0.
104
+
105
+ ## Quick start
106
+
107
+ Every way to install, update and remove Headroom is in [Install](https://github.com/amitray007/headroom/blob/v0.1.3/docs/operations/install.md).
108
+
109
+ ### Installer
110
+
111
+ ```sh
112
+ curl -fsSL https://headroom.theblank.club/install | sh
113
+ headroom --open # serve on 127.0.0.1:8080 and open the dashboard
114
+ headroom service install # start at login
115
+ ```
116
+
117
+ The script checks the download against the release checksums and puts `headroom` in `~/.local/bin`. Run it again, or run `headroom update`, to upgrade. It supports macOS and Linux on arm64 and x64.
118
+
119
+ ### Homebrew
120
+
121
+ ```sh
122
+ brew tap amitray007/headroom https://github.com/amitray007/headroom
123
+ brew install amitray007/headroom/headroom
124
+ brew services start headroom
125
+ ```
126
+
127
+ ### Package runners
128
+
129
+ ```sh
130
+ npx headroomhq # or bunx headroomhq, uvx headroomhq, pipx run headroomhq
131
+ ```
132
+
133
+ ### Docker
134
+
135
+ ```sh
136
+ docker run -d --name headroom -p 8080:8080 \
137
+ -v headroom-data:/var/lib/headroom/data -v headroom-secrets:/etc/headroom \
138
+ ghcr.io/amitray007/headroom:latest
139
+ ```
140
+
141
+ Open <http://localhost:8080> and create the owner account. Back up both volumes together: without the key, every account must be reconnected. A compose file is [deploy/compose.simple.yaml](https://github.com/amitray007/headroom/blob/v0.1.3/deploy/compose.simple.yaml). To reach Headroom from other devices, put an HTTPS reverse proxy in front and set `HEADROOM_PUBLIC_URL` to its address. Image tags are in [Releases](https://github.com/amitray007/headroom/blob/v0.1.3/docs/operations/releases.md).
142
+
143
+ ### Docker on a Tailscale tailnet
144
+
145
+ Headroom publishes no port. A Tailscale container serves it over HTTPS to your own devices only.
146
+
147
+ ```sh
148
+ git clone https://github.com/amitray007/headroom.git && cd headroom/deploy
149
+ cp .env.example .env # set TS_AUTHKEY and HEADROOM_PUBLIC_URL
150
+ docker compose up -d --build
151
+ ```
152
+
153
+ Open `https://<TS_HOSTNAME>.<tailnet>.ts.net` and create the owner account. The full guide, including Dokploy and moving an existing instance, is in [Self-hosting on a tailnet](https://github.com/amitray007/headroom/blob/v0.1.3/docs/operations/tailscale.md).
154
+
155
+ ### From source
156
+
157
+ Requires [mise](https://mise.jdx.dev), which installs the pinned Bun.
158
+
159
+ ```sh
160
+ mise install && mise run install
161
+ mise run start # builds the web app and the binary, then serves on :8080
162
+ ```
163
+
164
+ Open <http://localhost:8080>. In the checkout, `mise` sets data to `.data/` and the two secret files to `.state/`. Back up `.state/headroom.key` with `.data/headroom.db`: without the key every account must be reconnected.
165
+
166
+ ### The binary
167
+
168
+ The binary keeps per-user state: on macOS under `~/Library/Application Support/Headroom/`, on Linux data in `${XDG_DATA_HOME:-~/.local/share}/headroom/` and the key and secret in `${XDG_CONFIG_HOME:-~/.config}/headroom/`. Codex, Claude and Grok sign in through their official CLI: install it on the same machine, or use Import. See [Install](https://github.com/amitray007/headroom/blob/v0.1.3/docs/operations/install.md).
169
+
170
+ ```sh
171
+ headroom --open # serve on 127.0.0.1:8080 and open the dashboard
172
+ headroom --help # commands, flags and the resolved file locations
173
+ headroom paths # print the data, key and secret locations
174
+ headroom update # install the newest release (--check only reports)
175
+ headroom service install # run at login (launchd on macOS, a systemd user unit on Linux)
176
+ headroom service status # installed and running?
177
+ headroom service uninstall
178
+ ```
179
+
180
+ `service install` must run from the compiled binary, not `bun`. On a headless Linux server also run `loginctl enable-linger $USER`. Back up the key with the database.
181
+
182
+ ### Configuration
183
+
184
+ | Variable | Default | Purpose |
185
+ | --- | --- | --- |
186
+ | `HEADROOM_PUBLIC_URL` | none | The address you open Headroom at. Required behind a proxy; passkeys and cookies use it |
187
+ | `HEADROOM_ENABLED_PROVIDERS` | all seven | Comma list: `codex`, `claude`, `grok`, `antigravity`, `copilot`, `cursor`, `vercel_ai_gateway` |
188
+ | `HEADROOM_HOST` | `127.0.0.1` | Listen address. The container image sets `0.0.0.0` |
189
+ | `HEADROOM_PORT` | `8080` | HTTP port (`--port` overrides) |
190
+ | `HEADROOM_DATA_DIR` | macOS `~/Library/Application Support/Headroom/data`, Linux `~/.local/share/headroom/data` | Where the database lives |
191
+ | `HEADROOM_MASTER_KEY_FILE` | next to the data on macOS, `~/.config/headroom/headroom.key` on Linux | The key that seals credentials. Keep it out of the data folder |
192
+ | `HEADROOM_AUTH_SECRET_FILE` | same folder as the key, `headroom.auth-secret` | Session signing secret |
193
+ | `HEADROOM_CODEX_BIN`, `HEADROOM_CLAUDE_BIN`, `HEADROOM_GROK_BIN` | resolved on `PATH` | Absolute path of a sign-in CLI |
194
+
195
+ Every variable is listed in [Deployment and credential storage](https://github.com/amitray007/headroom/blob/v0.1.3/docs/architecture/deployment.md).
196
+
197
+ ## Security
198
+
199
+ - Credentials are sealed per account with AES-256-GCM. The master key never enters the database.
200
+ - One owner account, with username and password or passkeys. Sign-up closes after the first account.
201
+ - Provider requests time out, and a redirect to another host never carries your tokens.
202
+ - Provider errors are mapped to fixed messages, so raw responses never reach logs or the browser.
203
+ - Demo Mode swaps in synthetic data for screenshots, and Privacy Mode blurs identities on screen.
204
+
205
+ Report a vulnerability privately as described in [SECURITY.md](https://github.com/amitray007/headroom/blob/v0.1.3/SECURITY.md).
206
+
207
+ ## Development
208
+
209
+ ```sh
210
+ mise run dev # API server with reload on :8080
211
+ mise exec -- bun run web:dev # Vite on :5173, proxying /api to :8080
212
+ mise run check # docs, format, lint, typecheck, knip and tests
213
+ ```
214
+
215
+ ```text
216
+ apps/server Hono API, scheduler, notifications
217
+ apps/web React 19 app
218
+ packages/core Enumerations, stores, crypto, connector contract
219
+ packages/view-model Presenters shared by every view, Demo Mode data
220
+ packages/connectors/* One direct-HTTP client per provider
221
+ docs/ Product, architecture, provider research, decisions
222
+ ```
223
+
224
+ Start with [CONTRIBUTING.md](https://github.com/amitray007/headroom/blob/v0.1.3/CONTRIBUTING.md) and the [documentation index](https://github.com/amitray007/headroom/blob/v0.1.3/docs/README.md).
225
+
226
+ ## Support
227
+
228
+ Headroom is free, and there is no paid cloud version. If it saves you a surprise limit, you can [sponsor its development](https://github.com/sponsors/amitray007). Sponsorship pays for connector fixes when a provider changes its API, new providers, releases and documentation.
229
+
230
+ ## License
231
+
232
+ [MIT](https://github.com/amitray007/headroom/blob/v0.1.3/LICENSE).
233
+
234
+ > [!NOTE]
235
+ > Headroom is an independent project, not affiliated with any provider listed above. Product names are trademarks of their owners.
236
+ >
237
+ > It is for personal self-hosted use. It reads your own accounts with your own credentials, and each provider's terms still apply.
@@ -0,0 +1,48 @@
1
+ #!/usr/bin/env node
2
+ "use strict";
3
+ // Starts the native headroom binary from the platform package. Plain Node, no dependencies.
4
+ const { spawn } = require("node:child_process");
5
+
6
+ const platforms = {
7
+ "darwin-arm64": "headroomhq-darwin-arm64",
8
+ "darwin-x64": "headroomhq-darwin-x64",
9
+ "linux-x64": "headroomhq-linux-x64",
10
+ "linux-arm64": "headroomhq-linux-arm64",
11
+ };
12
+ const installer = "curl -fsSL https://headroom.theblank.club/install.sh | sh";
13
+
14
+ function fail(message) {
15
+ process.stderr.write(`headroom: ${message}\nInstall the binary directly instead: ${installer}\n`);
16
+ process.exit(1);
17
+ }
18
+
19
+ const key = `${process.platform}-${process.arch}`;
20
+ const pkg = platforms[key];
21
+ if (pkg === undefined) {
22
+ fail(`no prebuilt binary for ${key}. Supported: ${Object.keys(platforms).join(", ")}.`);
23
+ }
24
+
25
+ let binary;
26
+ try {
27
+ binary = require.resolve(`${pkg}/bin/headroom`);
28
+ } catch {
29
+ fail(
30
+ `the package ${pkg} is not installed. It is an optional dependency of headroomhq, ` +
31
+ "so it is missing when you install with --no-optional or --omit=optional.",
32
+ );
33
+ }
34
+
35
+ const child = spawn(binary, process.argv.slice(2), { stdio: "inherit" });
36
+ const forwarded = ["SIGINT", "SIGTERM", "SIGHUP"];
37
+ for (const signal of forwarded) {
38
+ process.on(signal, () => child.kill(signal));
39
+ }
40
+ child.on("error", (error) => fail(`cannot start ${binary}: ${error.message}`));
41
+ child.on("exit", (code, signal) => {
42
+ if (signal !== null) {
43
+ for (const name of forwarded) process.removeAllListeners(name);
44
+ process.kill(process.pid, signal);
45
+ } else {
46
+ process.exit(code ?? 1);
47
+ }
48
+ });
package/package.json CHANGED
@@ -1,6 +1,51 @@
1
1
  {
2
2
  "name": "headroomhq",
3
- "version": "0.0.0-stage",
4
- "stub": true,
5
- "description": "Temporary package placeholder for staged publishing"
6
- }
3
+ "version": "0.1.3",
4
+ "bugs": "https://github.com/amitray007/headroom/issues",
5
+ "license": "MIT",
6
+ "repository": {
7
+ "type": "git",
8
+ "url": "git+https://github.com/amitray007/headroom.git"
9
+ },
10
+ "bin": {
11
+ "headroom": "bin/headroom.js",
12
+ "headroomhq": "bin/headroom.js"
13
+ },
14
+ "files": [
15
+ "bin/headroom.js",
16
+ "README.md",
17
+ "LICENSE"
18
+ ],
19
+ "optionalDependencies": {
20
+ "headroomhq-darwin-arm64": "0.1.3",
21
+ "headroomhq-darwin-x64": "0.1.3",
22
+ "headroomhq-linux-x64": "0.1.3",
23
+ "headroomhq-linux-arm64": "0.1.3"
24
+ },
25
+ "engines": {
26
+ "node": ">=18"
27
+ },
28
+ "description": "Self-hosted dashboard for all your AI plans. Track limits, resets and spend across Claude, Codex, Cursor, Copilot, Grok and more.",
29
+ "keywords": [
30
+ "ai",
31
+ "antigravity",
32
+ "claude",
33
+ "claude-code",
34
+ "codex",
35
+ "cursor",
36
+ "dashboard",
37
+ "github-copilot",
38
+ "grok",
39
+ "llm",
40
+ "openai-codex",
41
+ "rate-limits",
42
+ "self-hosted",
43
+ "usage-tracking",
44
+ "vercel-ai-gateway"
45
+ ],
46
+ "homepage": "https://headroom.theblank.club",
47
+ "funding": {
48
+ "type": "github",
49
+ "url": "https://github.com/sponsors/amitray007"
50
+ }
51
+ }