opencode-ufr 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Finley Leo Lämpe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,184 @@
+# opencode-ufr
+
+An [opencode](https://opencode.ai) provider for Uni Freiburg's Open WebUI
+models. A small local gateway runs on your machine, pools your UFR API
+key(s), and handles UFR's rate limits and outages so opencode doesn't have to.
+
+## Requirements
+
+- opencode ≥ 2.0
+- A UFR account and API key (Open WebUI → Settings → Account → API keys)
+- [Bun](https://bun.sh) on your `PATH` for the `ufr` CLI. The plugin itself
+  needs no Bun — it runs inside opencode.
+- Off campus, the **built-in VPN** connects to UFR on its own: store your uni
+  login once (`ufr login add <user>`) and the plugin tunnels its UFR calls
+  through `fortivpn.uni-freiburg.de` — with no TUN device, no admin rights, no
+  openconnect and no changes to your routing. Your own VPNs keep working
+  untouched in parallel. See the RZ guide if you prefer a system VPN:
+  https://wiki.uni-freiburg.de/rz/doku.php?id=vpn
+
+## Install
+
+Not on npm yet — install straight from GitHub:
+
+```bash
+bun add -g github:FinleyLaempe/opencode-ufr   # puts `ufr` on PATH
+ufr connect
+```
+
+`ufr connect` asks for your UFR API key(s) — comma-separated, whitespace
+around keys is filtered, aliases (key1, key2, …) are assigned automatically —
+and optionally your uni login for the built-in VPN. Everything is verified
+against UFR and stored in the OS keyring (never on disk).
+
+Inside opencode you never need the CLI: the plugin takes over the built-in
+`/connect` panel's **Uni Freiburg** entry. It shows the API-key(s) field plus
+**Uni login (optional)** and **Uni password (optional)** — both only needed on
+a machine outside the uni network, where the built-in VPN uses them. Submitted
+credentials land in the OS keyring automatically and the gateway restarts with
+them.
+
+Manual alternative — add to `opencode.json`:
+
+```json
+{ "plugins": ["github:FinleyLaempe/opencode-ufr"] }
+```
+
+or run `opencode plugin add github:FinleyLaempe/opencode-ufr` yourself, then
+`ufr connect --keys "<key1>,<key2>"`.
+
+npm publication is planned; once it lands, `bunx opencode-ufr …` /
+`npx opencode-ufr …` will work without a global install.
+
+## Use
+
+Models show up in opencode as `unifreiburg/<model>`, e.g.
+`unifreiburg/ufr/coding-complex`. Everything else is the CLI:
+
+```bash
+ufr status       # gateway, keys, limits, breakers, spend today
+ufr stats        # requests, tokens and cost
+ufr keys test    # check your stored keys against UFR
+ufr keys list    # aliases
+ufr login show   # the stored uni login
+```
+
+The gateway starts itself the first time opencode needs it (the plugin waits
+up to 40 s for it to come up) and shuts down again after 5 minutes idle. You
+don't run or manage it directly.
+
+## What the gateway does
+
+- Keeps each key under 18 of UFR's 20 requests-per-rolling-minute, waiting
+  instead of failing when a key is close to its limit.
+- Enforces a pool-wide cap of 800 requests/hour across all keys and models —
+  UFR walls a model group for hours once it sees sustained traffic above
+  roughly 900/hour.
+- **Connects to UFR on its own when you are off campus.** It logs in to the
+  uni's Fortinet gateway with your stored uni login, negotiates PPP/IPCP and
+  runs a userspace TCP/IP stack inside the gateway process: no TUN device, no
+  routes, no admin rights, identical on Linux, macOS and Windows. On campus it
+  talks to UFR directly and never opens the tunnel; `vpn.mode: "always"`
+  forces the tunnel.
+- Runs a circuit breaker per model: after repeated failures it backs off from
+  30 s up to 60 minutes before probing again, instead of hammering a walled
+  model.
+- Falls back, when a model is rate-limited or walled, only to models listed
+  in `free_escape_order` (in `models.json`), in that order — and never to
+  UFR's external (paid-tier) models unless you set `allowPaid`. Some "local"
+  UFR models (glm-5.x) are still billed per token.
+- Caps every client request at 4 upstream calls to UFR in total, across
+  retries and fallbacks.
+- Retries once with reasoning turned off if a `glm` model spends its whole
+  token budget thinking and returns no text.
+- Keeps local stats in the same "% of $20/day" unit UFR's own portal uses, so
+  the numbers in `ufr status` line up with what you see there.
+- Survives being killed: if the gateway's lock file is left behind by an
+  unclean shutdown, the next start detects it's stale and takes it over
+  rather than refusing to start.
+
+## More than one key
+
+UFR allows one API key per account, so one key is one account's worth of
+throughput. Adding more keys only helps if they belong to different UFR
+accounts — it does not raise any one account's limit.
+
+## Configuration
+
+Non-secret settings live in a JSON file; keys always stay in the OS keyring.
+
+- **Linux / macOS:** `~/.config/opencode-ufr/config.json` (state in
+  `~/.local/state/opencode-ufr`, cache in `~/.cache/opencode-ufr`, data in
+  `~/.local/share/opencode-ufr` — or the matching `$XDG_*` variable if you
+  set one)
+- **Windows:** `%APPDATA%\opencode-ufr\config.json` (state, cache and data
+  under `%LOCALAPPDATA%\opencode-ufr`)
+- Set `OPENCODE_UFR_HOME` to point everything (config, state, cache, data)
+  at one directory instead — useful for testing or a fully portable setup.
+
+Reference `config.json` (all fields optional; shown here at their defaults
+except `port`, which is written on first start):
+
+```json
+{
+  "schema": 1,
+  "port": 47300,
+  "transport": { "type": "auto" },
+  "vpn": { "gateway": "https://fortivpn.uni-freiburg.de", "mode": "auto" },
+  "keys": ["a", "b"],
+  "limits": {
+    "keyRpm": 18,
+    "keyWindowS": 60,
+    "poolPerHour": 800,
+    "poolWindowS": 3600,
+    "keyMaxWaitS": 60,
+    "poolMaxWaitS": 20,
+    "maxUpstreamAttempts": 4
+  },
+  "dailyBudgetUsd": 20,
+  "breaker": {
+    "tripThreshold": 3,
+    "ladderS": [30, 120, 300, 900, 1800, 3600],
+    "probeTimeoutS": 120
+  },
+  "allowPaid": false,
+  "catalog": {
+    "url": "https://raw.githubusercontent.com/FinleyLaempe/opencode-ufr/main/models.json",
+    "refreshHours": 6
+  },
+  "idleShutdownMin": 5
+}
+```
+
+`port` is chosen once (preferred `47300`, next free port if taken) and then
+stays fixed across restarts. `poolPerHour: 0` disables the pool limiter.
+`transport.type: "direct"` never opens the tunnel; `"auto"` (the default)
+tunnels only when UFR is not reachable directly. `vpn.mode: "always"` tunnels
+every UFR call, useful behind firewalls that block the campus route.
+
+## Model data
+
+The gateway fetches `models.json` from this repository every 6 hours —
+context windows, prices, vision/tool flags, alias spellings and fallback
+order that UFR's own API doesn't expose or gets wrong. Fixes reach every
+user without a release.
+
+To contribute a measurement (a price, a context window, a missing alias),
+open a PR against `models.json` with the source of the measurement in a
+`note` field.
+
+## Privacy
+
+- UFR API keys and the uni VPN login live only in your OS keyring (Keychain,
+  Credential Manager, or libsecret/KWallet on Linux) — never in a config file
+  or in this repository.
+- The gateway listens on `127.0.0.1` only, behind a random local token; it
+  is not reachable from the network or by other local users without that
+  token.
+- Local stats record token counts, cost and latency per request — never
+  prompt or response content.
+
+## Not affiliated
+
+This is an independent project, not an official service of the University
+of Freiburg's Rechenzentrum (RZ).

package/bin/ufr.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env bun
+import { main } from "../src/cli/index"
+
+process.exit(await main(process.argv.slice(2)))

package/models.json

@@ -0,0 +1,206 @@
+{
+  "schema": 1,
+  "updated": "2026-09-28",
+  "defaults": {
+    "context": 131072,
+    "max_output": 16384
+  },
+  "fallbacks": {
+    "free_escape_order": [
+      "gemma-4-31b-llmlb",
+      "mistral-small-4-llmlb",
+      "glm-5.2-llmlb"
+    ],
+    "max_targets": 4,
+    "context_hub": "openai/gpt-5.6-llmlb"
+  },
+  "exclude": [
+    "gpt-oss-120b-llmlb",
+    "openai/gpt-5.4-llmlb",
+    "standard-chat-ufr",
+    "standard-reasoning-ufr",
+    "standard-bild-ufr"
+  ],
+  "aliases": {
+    "gpt-5.6-llmlb": "openai/gpt-5.6-llmlb",
+    "gpt-5.6-sol-llmlb": "openai/gpt-5.6-sol-llmlb",
+    "gpt-5.6-terra-llmlb": "openai/gpt-5.6-terra-llmlb",
+    "mistral-large-latest-llmlb": "mistral/mistral-large-latest-llmlb",
+    "codestral-latest-llmlb": "mistral/codestral-latest-llmlb"
+  },
+  "models": {
+    "glm-5.2-llmlb": {
+      "context": 1048576,
+      "price": {
+        "input": 0.4,
+        "output": 0.4
+      }
+    },
+    "glm-5.3-flash-llmlb": {
+      "context": 1048576,
+      "price": {
+        "input": 0.4,
+        "output": 0.4
+      },
+      "note": "portal-measured 2026-09-28: 100 267 input tokens moved a test key 1.58% -> 1.78% of $20 (= $0.40/Mtok)"
+    },
+    "gemma-4-31b-llmlb": {
+      "context": 262144
+    },
+    "gemma-4-12b-llmlb": {
+      "context": 131072
+    },
+    "gemma-3-27b-llmlb": {
+      "context": 128000
+    },
+    "gpt-oss-120b-llmlb": {
+      "context": 128000
+    },
+    "mistral-small-4-llmlb": {
+      "context": 256000
+    },
+    "qwen-3.5-397b-llmlb": {
+      "context": 262144
+    },
+    "qwen-3.6-27b-llmlb": {
+      "context": 262144
+    },
+    "qwen-3.8-27b-llmlb": {
+      "context": 262144
+    },
+    "qwen3.5-9b-llmlb": {
+      "context": 128000
+    },
+    "nuextract3-llmlb": {
+      "context": 131072,
+      "tools": false
+    },
+    "numarkdown-8b-thinking-llmlb": {
+      "context": 24768,
+      "tools": false
+    },
+    "standard-chat-ufr": {
+      "context": 262144
+    },
+    "standard-coding-ufr": {
+      "context": 1048576,
+      "price": {
+        "input": 0.4,
+        "output": 0.4
+      }
+    },
+    "standard-reasoning-ufr": {
+      "context": 262144,
+      "price": {
+        "input": 0.1,
+        "output": 0.1
+      }
+    },
+    "standard-bild-ufr": {
+      "context": 262144
+    },
+    "ufr/chat": {
+      "context": 262144,
+      "vision": true
+    },
+    "ufr/chat-fast": {
+      "context": 131044
+    },
+    "ufr/chat-standard": {
+      "context": 262144
+    },
+    "ufr/coding-complex": {
+      "context": 1048576,
+      "vision": false,
+      "price": {
+        "input": 0.4,
+        "output": 0.4
+      }
+    },
+    "ufr/coding-fast": {
+      "context": 262144,
+      "vision": true
+    },
+    "ufr/reasoning-complex": {
+      "context": 262144,
+      "price": {
+        "input": 0.1,
+        "output": 0.1
+      }
+    },
+    "ufr/reasoning-fast": {
+      "context": 262144
+    },
+    "ufr/text": {
+      "context": 256000
+    },
+    "ufr/vision-complex": {
+      "context": 262144
+    },
+    "ufr/vision-fast": {
+      "context": 131044
+    },
+    "ufr/vision-standard": {
+      "context": 262144
+    },
+    "openai/gpt-5.6-llmlb": {
+      "context": 1050000,
+      "price": {
+        "input": 0.2,
+        "output": 1.2,
+        "cache_read": 0.02,
+        "cache_write": 0.25
+      }
+    },
+    "openai/gpt-5.6-sol-llmlb": {
+      "context": 922000,
+      "price": {
+        "input": 5,
+        "output": 30,
+        "cache_read": 0.5,
+        "cache_write": 6.25
+      }
+    },
+    "openai/gpt-5.6-terra-llmlb": {
+      "context": 1000000,
+      "price": {
+        "input": 2,
+        "output": 12,
+        "cache_read": 0.2,
+        "cache_write": 2.5
+      }
+    },
+    "openai/gpt-5.4-llmlb": {
+      "context": 272000,
+      "price": {
+        "input": 2.5,
+        "output": 15,
+        "cache_read": 0.25,
+        "cache_write": 3.125
+      }
+    },
+    "openai/gpt-5.3-codex-llmlb": {
+      "context": 1000000,
+      "price": {
+        "input": 1.75,
+        "output": 14,
+        "cache_read": 0.175,
+        "cache_write": 2.1875
+      }
+    },
+    "mistral/mistral-large-latest-llmlb": {
+      "context": 262144,
+      "price": {
+        "input": 2,
+        "output": 6
+      }
+    },
+    "mistral/codestral-latest-llmlb": {
+      "context": 128000,
+      "price": {
+        "input": 0.3,
+        "output": 0.9
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,16 @@
+{
+  "name": "opencode-ufr",
+  "version": "0.2.0",
+  "description": "Uni Freiburg (UFR) Open WebUI models in opencode — local gateway with key pool, UFR-aware rate limiting, circuit breaker and fallbacks",
+  "license": "MIT",
+  "type": "module",
+  "main": "./src/plugin/index.ts",
+  "exports": { ".": "./src/plugin/index.ts" },
+  "bin": { "ufr": "bin/ufr.ts", "opencode-ufr": "bin/ufr.ts" },
+  "files": ["bin", "src", "models.json", "README.md", "LICENSE"],
+  "engines": { "bun": ">=1.3.0" },
+  "repository": { "type": "git", "url": "git+https://github.com/FinleyLaempe/opencode-ufr.git" },
+  "keywords": ["opencode", "opencode-plugin", "uni-freiburg", "open-webui"],
+  "scripts": { "test": "bun test", "typecheck": "tsc --noEmit", "prepublishOnly": "bun run typecheck && bun test" },
+  "devDependencies": { "@types/bun": "^1.3.0", "typescript": "^5.9.0" }
+}

package/src/cli/catalog.ts

@@ -0,0 +1,45 @@
+import type { UfrModel } from "../daemon/catalog"
+import { BUNDLED_MODELS, loadModelsFile, loadUfrModels } from "../daemon/catalog-source"
+import { loadConfig } from "../shared/config"
+import type { ModelsFile } from "../shared/models-file"
+import type { CliDeps } from "./index"
+
+export function diffCatalog(ufr: UfrModel[], file: ModelsFile) {
+  const served = new Set(ufr.map((u) => u.id))
+  const aliasSpellings = new Set(Object.keys(file.aliases))
+  const canonical = ufr.filter((u) => !aliasSpellings.has(u.id))
+  return {
+    added: canonical.filter((u) => !file.models[u.id]).map((u) => u.id),
+    gone: Object.keys(file.models).filter((id) => !served.has(id)),
+    vision: canonical
+      .filter((u) => file.models[u.id]?.vision !== undefined && file.models[u.id]!.vision !== u.vision)
+      .map((u) => ({ id: u.id, ufr: u.vision, ours: file.models[u.id]!.vision! })),
+    unpriced: canonical.filter((u) => !file.models[u.id]?.price).map((u) => u.id),
+  }
+}
+
+export async function cmdCatalogDiff(d: CliDeps): Promise<number> {
+  const cfg = await loadConfig(d.paths.configFile)
+  const alias = cfg.keys[0]
+  const key = alias ? await d.secrets.get(alias) : null
+  if (!key) {
+    d.io.err("catalog diff needs a key — run `ufr keys add <alias>`\n")
+    return 1
+  }
+  const log = (m: string) => d.io.err(`${m}\n`)
+  const mf = await loadModelsFile({ url: cfg.catalog.url, cachePath: d.paths.modelsCache, etagPath: d.paths.modelsEtag,
+    bundledPath: BUNDLED_MODELS, fetch: d.fetch, log })
+  const ufr = await loadUfrModels({ baseUrl: cfg.upstream.baseUrl, key, cachePath: d.paths.ufrModelsCache, fetch: d.fetch, log })
+  if (ufr.source !== "remote") {
+    d.io.err(`cannot read UFR's live model list: ${ufr.error}\n`)
+    return 1
+  }
+  const diff = diffCatalog(ufr.models, mf.file)
+  d.io.out(`models.json from ${mf.source}, ${ufr.models.length} models at UFR\n`)
+  for (const id of diff.added) d.io.out(`+ ${id}  (new at UFR, no models.json entry)\n`)
+  for (const id of diff.gone) d.io.out(`- ${id}  (in models.json, no longer at UFR)\n`)
+  for (const v of diff.vision) d.io.out(`~ ${v.id}  vision: UFR says ${v.ufr}, models.json says ${v.ours}\n`)
+  for (const id of diff.unpriced) d.io.out(`$ ${id}  (no price — cost unknown)\n`)
+  if (!diff.added.length && !diff.gone.length) d.io.out("no models added or removed\n")
+  return diff.added.length || diff.gone.length ? 1 : 0
+}

package/src/cli/connect.ts

@@ -0,0 +1,146 @@
+import { parseArgs } from "node:util"
+import { ALIAS_RE, loadConfig, saveConfig } from "../shared/config"
+import { VPN_PASS, VPN_USER } from "../shared/secrets"
+import { checkKey, type Check } from "./ufr-check"
+import { applyKeyChange } from "./keys"
+import type { CliDeps } from "./index"
+
+const LABEL: Record<Check | "missing", string> = {
+  ok: "ok",
+  invalid: "INVALID (UFR says 401)",
+  vpn: "not verified — not on the uni VPN",
+  unreachable: "not verified — UFR unreachable",
+  rate_limited: "ok (currently rate-limited)",
+  missing: "MISSING in keyring",
+}
+
+const PLUGIN_SPEC = "github:FinleyLaempe/opencode-ufr"
+
+/** Splits a key list on commas AND newlines, trims whitespace, drops empties. */
+export function splitKeys(spec: string): string[] {
+  return spec
+    .split(/[,\n\r]+/)
+    .map((k) => k.trim())
+    .filter((k) => k.length > 0)
+}
+
+/** Auto-aliases key1…keyN, skipping numbers already in use. */
+export function nextAliases(existing: string[], count: number): string[] {
+  const used = new Set(existing)
+  const out: string[] = []
+  for (let n = 1; out.length < count; n++) {
+    const alias = `key${n}`
+    if (!used.has(alias)) {
+      used.add(alias)
+      out.push(alias)
+    }
+  }
+  return out
+}
+
+async function storeKey(d: CliDeps, alias: string, key: string): Promise<{ stored: boolean; check: Check }> {
+  const cfg = await loadConfig(d.paths.configFile)
+  const check = await checkKey(d.fetch, cfg.upstream.baseUrl, key)
+  if (check === "invalid") return { stored: false, check }
+  if (check !== "ok" && check !== "rate_limited") {
+    const why = check === "vpn" ? "not on the uni VPN" : "UFR unreachable"
+    if (!(await d.io.confirm(`could not verify this key (${why}). Store it anyway?`))) return { stored: false, check }
+  }
+  await d.secrets.set(alias, key)
+  if (!cfg.keys.includes(alias)) {
+    cfg.keys.push(alias)
+    await saveConfig(d.paths.configFile, cfg)
+  }
+  return { stored: true, check }
+}
+
+async function stopIdleGateway(d: CliDeps): Promise<void> {
+  await applyKeyChange({ paths: d.paths, fetch: d.fetch, log: (m) => d.io.out(m + "\n") })
+}
+
+/**
+ * ufr connect — one command for everything: uni login (optional) + API keys.
+ * Interactive when arguments are missing; fully non-interactive with flags
+ * (what the /connect slash command uses).
+ */
+export async function cmdConnect(d: CliDeps, args: string[]): Promise<number> {
+  const { values } = parseArgs({
+    args,
+    options: {
+      login: { type: "string" },
+      password: { type: "string" },
+      keys: { type: "string" },
+    },
+    allowPositionals: true,
+  })
+
+  const io = d.io
+  const cfg = await loadConfig(d.paths.configFile)
+
+  // keys -------------------------------------------------------------------
+  let keySpec = values.keys
+  if (keySpec === undefined && d.io.isTTY) {
+    keySpec = await io.prompt("UFR API keys (comma-separated or one per line; Open WebUI → Settings → Account → API keys): ")
+  }
+  const keys = splitKeys(keySpec ?? "")
+  if (keys.length === 0) {
+    io.err("no keys given — usage: ufr connect [--login <user> --password <pass>] --keys \"<key1>,<key2>\"\n")
+    return 2
+  }
+  const aliases = nextAliases(cfg.keys, keys.length)
+
+  // --- login (optional) ------------------------------------------------------
+  let user = values.login
+  let pass = values.password
+  if (user === undefined && d.io.isTTY) {
+    user = (await io.prompt("Uni login for the built-in VPN, e.g. fl240@uni-freiburg.de (empty to skip): ")).trim()
+  }
+  if (user) {
+    if (!/^[^\s@]+@[^\s@]+$/.test(user)) {
+      io.err(`"${user}" does not look like a uni login (expected e.g. fl240@uni-freiburg.de)\n`)
+      return 2
+    }
+    if (pass === undefined) {
+      if (d.io.isTTY) pass = await io.prompt(`Uni password for ${user}: `, { secret: true })
+      else {
+        io.err("--password is required when --login is given non-interactively\n")
+        return 2
+      }
+    }
+    if (!pass) {
+      io.err("no password entered\n")
+      return 2
+    }
+  }
+
+  // --- store everything -------------------------------------------------------
+  let bad = 0
+  for (let i = 0; i < keys.length; i++) {
+    const alias = aliases[i]!
+    const r = await storeKey(d, alias, keys[i]!)
+    if (r.stored) io.out(`${alias}\t${LABEL[r.check]}\n`)
+    else {
+      bad++
+      io.err(`${alias}\t${LABEL[r.check]} — not stored\n`)
+    }
+  }
+  if (bad === keys.length) return 1
+
+  if (user && pass) {
+    await d.secrets.set(VPN_USER, user)
+    await d.secrets.set(VPN_PASS, pass)
+    io.out(`login\tstored for ${user} (used by the built-in VPN)\n`)
+  }
+
+  await stopIdleGateway(d)
+  if (d.io.isTTY) {
+    if (await io.confirm(`register the plugin with opencode now (\`opencode plugin add ${PLUGIN_SPEC}\`)?`)) {
+      const code = await d.runOpencode(["plugin", "add", PLUGIN_SPEC])
+      if (code !== 0) io.err(`opencode plugin add exited with ${code} — add "${PLUGIN_SPEC}" to "plugins" in opencode.json yourself\n`)
+    }
+  } else {
+    io.out(`register the provider in opencode if not done yet: opencode plugin add ${PLUGIN_SPEC}\n`)
+  }
+  io.out(`done — ${keys.length - bad}/${keys.length} key(s) stored${user ? ", uni login stored" : ""}\n`)
+  return bad > 0 ? 1 : 0
+}

package/src/cli/daemon-client.ts

@@ -0,0 +1,19 @@
+import type { FetchLike } from "../daemon/catalog-source"
+import { readJson, readText } from "../shared/fs"
+import type { Paths } from "../shared/paths"
+
+/** A request to the running daemon, or null if none answers. */
+export async function daemonRequest(paths: Paths, f: FetchLike, path: string, method = "GET"): Promise<Response | null> {
+  const info = (await readJson(paths.daemonFile)) as { port?: number } | null
+  const token = (await readText(paths.tokenFile))?.trim()
+  if (!info?.port || !token) return null
+  try {
+    return await f(`http://127.0.0.1:${info.port}${path}`, {
+      method,
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(5_000),
+    })
+  } catch {
+    return null
+  }
+}