quotacap 0.0.36 → 0.0.38

package/README.md

@@ -23,11 +23,12 @@ QuotaCap helps you get more from the AI coding subscriptions you already pay for
 | Codex | `pty` — `codex --no-alt-screen` then `/status`, parse `Weekly/5h limit: X% left` | Live |
 | Kimi Code | `pty` — `kimi` then `/usage`, parse `Weekly/5h limit: Y% used` | Live |
 | Grok | `pty` — `grok` then `/usage`, parse `Weekly limit (plan)` + `Credits: $X` | Live |
-| Muse Code | `pty` — `muse --trust-workspace` then `/usage`, parse `Subscription · Muse Code <plan>` + `Weekly/Current N% used` | Live |
+| Muse Code | `pty` — `muse --trust-workspace` then `/usage`, parse `Subscription · Muse Code <plan>` + `Weekly/Current N% used`; on `Currently unavailable`, up to three headless `muse exec` warm turns and re-reads inside the poll | Live |
+| OpenCode Go | `api` — `GET https://opencode.ai/zen/go/v1/usage` with the OpenCode auth key; opt-in via `quotacap providers enable opencode-go` (consent recorded, disable revokes it) | Live (opt-in) |
 
-Exec adapters run via `execFile` with an argv list. PTY adapters run via `node-pty` (`src/adapters/pty.ts`). They are TUI-fragile: a vendor text change breaks the parser and the row degrades fail-closed until the regex is fixed. Poll latency is 2–10 s per PTY provider (settle plus completion). It dominates `POST /api/refresh` and the first poll, not the steady-state 15 m timer.
+Exec adapters run via `execFile` with an argv list. PTY adapters run via `node-pty` (`src/adapters/pty.ts`). They are TUI-fragile: a vendor text change breaks the parser and the row degrades fail-closed until the regex is fixed. Poll latency is 2–10 s per PTY provider (settle plus completion); `muse` can reach about 75 s when it has to warm an unavailable subscription. It dominates `POST /api/refresh` and the first poll, not the steady-state 15 m timer.
 
-Live adapters invoke the CLIs you already logged into. No API keys. No token files are read.
+Live adapters invoke the CLIs you already logged into — no API keys, no token files read. The one opt-in exception is OpenCode Go: after you run `quotacap providers enable opencode-go`, each poll reads the OpenCode auth key in-memory (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback, or `OPENCODE_API_KEY`) and sends it only to `opencode.ai/zen/go/v1/usage`. It is never stored, logged, or returned by the API or MCP. Disable any time with `quotacap providers disable opencode-go`.
 
 ## Install
 
@@ -83,6 +84,7 @@ The local web server listens on `127.0.0.1:8787` (configured via `QUOTACAP_URL`
 | `GET` | `/api/token` | Same-origin | Shared secret token for the dashboard |
 | `POST` | `/api/refresh` | `X-QuotaCap-Token` | Trigger an immediate adapter poll (debounced to 60s) |
 | `PATCH` | `/api/providers/:id` | `X-QuotaCap-Token` | Set or clear custom provider display name override |
+| `POST` | `/api/providers/:id/enabled` | `X-QuotaCap-Token` | Enable or disable a provider (`consent: true` required for `opencode-go`); restart applies it |
 
 ### Curl examples
 
@@ -119,7 +121,7 @@ curl -X PATCH http://localhost:8787/api/providers/claude \
 
 QuotaCap is a local daemon. It binds to `127.0.0.1` only (`src/runtime/service.ts` `app.listen`). It does not listen on `0.0.0.0`. There is no LAN surface.
 
-It owns no tokens. It never reads `~/.codex/auth.json`, `~/.kimi-code/credentials/kimi-code.json`, `~/.kimi/credentials/kimi-code.json`, `~/.grok/auth.json`, or `~/.gemini/oauth_creds.json`. It never uses `refresh_token` or `grant_type=refresh_token`. It has no hardcoded client ids. Those OAuth paths and the `.qc-bak` and `.qc-lock` helpers were removed in #14. This is asserted by `tests/adapters/credential-free.test.ts`. Each CLI owns its own session. It never reads `~/.config/muse/auth.json`, `~/.local/share/muse/sessions/`, or `~/.config/muse/tui-history.jsonl`. Each CLI owns its own session. QuotaCap only spawns the CLI and reads its stdout via `exec` (`claude`, `agy`) or PTY (`codex`, `kimi`, `grok`, `muse`).
+It owns no tokens. It never reads `~/.codex/auth.json`, `~/.kimi-code/credentials/kimi-code.json`, `~/.kimi/credentials/kimi-code.json`, `~/.grok/auth.json`, or `~/.gemini/oauth_creds.json`. It never uses `refresh_token` or `grant_type=refresh_token`. It has no hardcoded client ids. Those OAuth paths and the `.qc-bak` and `.qc-lock` helpers were removed in #14. This is asserted by `tests/adapters/credential-free.test.ts`. Each CLI owns its own session. It never reads `~/.config/muse/auth.json`, `~/.local/share/muse/sessions/`, or `~/.config/muse/tui-history.jsonl`. Each CLI owns its own session. The one opt-in exception is OpenCode Go: when you enable it, QuotaCap reads `~/.local/share/opencode/auth.json` in-memory, read-only, once per poll, and sends the key only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage`. The read is consent-gated (`opencodeGoConsentAt` in config), asserted read-only by `tests/adapters/credential-free.test.ts`, and revoked by `quotacap providers disable opencode-go`. QuotaCap only spawns the CLI and reads its stdout via `exec` (`claude`, `agy`) or PTY (`codex`, `kimi`, `grok`, `muse`).
 
 It stores no `raw` provider payload. The `raw` column was dropped and migrated in `src/store/db.ts` `migrate`. `GET /api/quotas` and MCP `get_quotas` never return `raw` (`tests/http/api.test.ts`). History and the token live under `~/.quotacap/` with `0700` on the directory and `0600` on files.
 

package/dist/adapters/index.js

@@ -5,6 +5,7 @@ import { kimiAdapter } from "./kimi.js";
 import { grokAdapter } from "./grok.js";
 import { agyAdapter } from "./agy.js";
 import { museAdapter } from "./muse.js";
+import { opencodeGoAdapter } from "./opencode-go.js";
 import { installAdapterSignal, clearAdapterSignal } from "../runtime/spawn.js";
 export const adapters = {
     claude: claudeAdapter,
@@ -14,6 +15,7 @@ export const adapters = {
     grok: grokAdapter,
     agy: agyAdapter,
     muse: museAdapter,
+    "opencode-go": opencodeGoAdapter,
 };
 const ADAPTER_TIMEOUTS = {
     claude: 8000,
@@ -21,7 +23,8 @@ const ADAPTER_TIMEOUTS = {
     kimi: 8000,
     grok: 14000,
     agy: 20000,
-    muse: 14000,
+    muse: 90000,
+    "opencode-go": 8000,
 };
 export async function pollAll(enabled, opts) {
     const rawJobs = enabled.map(id => {

package/dist/adapters/muse.d.ts

@@ -1,4 +1,32 @@
 import type { ParsedQuota } from "./types.js";
+/** Canonical unavailability error: parseMuseTui throws it, poll() recognises it
+ *  to start recovery, and failure.ts classifies its text as service_unavailable. */
+export declare const MUSE_UNAVAILABLE_MESSAGE = "muse: subscription currently unavailable in TUI output";
+export declare const WARM_ATTEMPTS = 3;
+export declare const WARM_SETTLE_MS = 3000;
+export declare const WARM_EXEC_TIMEOUT_MS = 20000;
+export declare const FALLBACK_BUDGET_MS = 60000;
+export interface RecoveryDeps {
+    unavailable: Error;
+    usagePass: (timeoutMs: number) => Promise<ParsedQuota>;
+    warmTurn: (timeoutMs: number) => Promise<void>;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    aborted?: () => boolean;
+    log?: (message: string) => void;
+    attempts?: number;
+    settleMs?: number;
+    budgetMs?: number;
+}
+/**
+ * Recovery loop for an unavailable subscription, entered only on
+ * MUSE_UNAVAILABLE_MESSAGE. Attempt = settle, headless warm turn, settle,
+ * /usage re-read. The budget is checked before every step, and the warm turn,
+ * sleep and readiness/completion waits are clamped to what remains; the
+ * adapter's 90 s timeout is the backstop for the fixed per-pass overheads.
+ * Exhaustion rethrows the last unavailability error.
+ */
+export declare function recoverSubscription(deps: RecoveryDeps): Promise<ParsedQuota>;
 export declare function museProbeDir(): string;
 export declare function parseMuseTui(text: string, now?: Date): ParsedQuota;
 export declare const museAdapter: {

package/dist/adapters/muse.js

@@ -3,7 +3,71 @@ import os from "node:os";
 import path from "node:path";
 import { parseResetText } from "./parse.js";
 import { runPty, stripAnsi } from "./pty.js";
-import { adapterSignal } from "../runtime/spawn.js";
+import { adapterSignal, trackedExecFile } from "../runtime/spawn.js";
+/** Canonical unavailability error: parseMuseTui throws it, poll() recognises it
+ *  to start recovery, and failure.ts classifies its text as service_unavailable. */
+export const MUSE_UNAVAILABLE_MESSAGE = "muse: subscription currently unavailable in TUI output";
+export const WARM_ATTEMPTS = 3;
+export const WARM_SETTLE_MS = 3000;
+export const WARM_EXEC_TIMEOUT_MS = 20000;
+export const FALLBACK_BUDGET_MS = 60000;
+const USAGE_TIMEOUT_MS = 14000;
+const MIN_STEP_MS = 1000;
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Recovery loop for an unavailable subscription, entered only on
+ * MUSE_UNAVAILABLE_MESSAGE. Attempt = settle, headless warm turn, settle,
+ * /usage re-read. The budget is checked before every step, and the warm turn,
+ * sleep and readiness/completion waits are clamped to what remains; the
+ * adapter's 90 s timeout is the backstop for the fixed per-pass overheads.
+ * Exhaustion rethrows the last unavailability error.
+ */
+export async function recoverSubscription(deps) {
+    const sleep = deps.sleep ?? delay;
+    const now = deps.now ?? Date.now;
+    const aborted = deps.aborted ?? (() => adapterSignal("muse")?.aborted === true);
+    const log = deps.log ?? ((message) => console.warn(`[quotacap] muse: ${message}`));
+    const attempts = deps.attempts ?? WARM_ATTEMPTS;
+    const settleMs = deps.settleMs ?? WARM_SETTLE_MS;
+    const deadline = now() + (deps.budgetMs ?? FALLBACK_BUDGET_MS);
+    const remaining = () => deadline - now();
+    let unavailable = deps.unavailable;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        if (remaining() < MIN_STEP_MS)
+            break;
+        await sleep(Math.min(settleMs, remaining()));
+        if (remaining() < MIN_STEP_MS)
+            break;
+        try {
+            await deps.warmTurn(Math.min(WARM_EXEC_TIMEOUT_MS, remaining()));
+        }
+        catch (warmError) {
+            if (aborted())
+                throw warmError;
+            log(`warm attempt ${attempt} failed: ${warmError?.message}`);
+            continue;
+        }
+        if (remaining() < MIN_STEP_MS)
+            break;
+        await sleep(Math.min(settleMs, remaining()));
+        if (remaining() < MIN_STEP_MS)
+            break;
+        try {
+            const quota = await deps.usagePass(Math.min(USAGE_TIMEOUT_MS, remaining()));
+            log(`subscription unavailable; recovered after ${attempt} warm prompt(s)`);
+            return quota;
+        }
+        catch (readError) {
+            if (readError?.message !== MUSE_UNAVAILABLE_MESSAGE)
+                throw readError;
+            unavailable = readError;
+        }
+    }
+    log("subscription still unavailable; warm recovery exhausted");
+    throw unavailable;
+}
 // QuotaCap-owned empty probe dir, beside the config and database. Muse loads
 // project-local skills, rules, hooks and plugin config from cwd, so the probe
 // never runs in $HOME or a user project — an empty dir grants nothing.
@@ -15,7 +79,7 @@ export function parseMuseTui(text, now = new Date()) {
     // newlines), so no pattern here may anchor on ^, $ or \n.
     const cleaned = stripAnsi(text);
     if (/currently unavailable|subscriptions aren't currently available|subscription_unavailable/i.test(cleaned)) {
-        throw new Error("muse: subscription currently unavailable in TUI output");
+        throw new Error(MUSE_UNAVAILABLE_MESSAGE);
     }
     const weekly = cleaned.match(/Weekly\s+(\d+)%\s+used/i);
     if (!weekly)
@@ -60,40 +124,67 @@ export function parseMuseTui(text, now = new Date()) {
         raw: cleaned.slice(0, 4096),
     };
 }
+/** One `/usage` read: the TUI scrape, shared by the first attempt and every
+ *  recovery re-read. */
+async function usagePass(timeoutMs = USAGE_TIMEOUT_MS) {
+    const cwd = museProbeDir();
+    fs.mkdirSync(cwd, { recursive: true });
+    const transcript = await runPty({
+        file: "muse",
+        args: ["--trust-workspace"],
+        cwd,
+        // Without this, a missing binary triggers a foreground 248 MB download
+        // on every poll; with it the launcher dies fast with a clear message.
+        env: { MUSE_NO_AUTO_UPDATE: "1" },
+        cols: 140,
+        rows: 50,
+        readyRegex: /muse-spark|Muse Code \d/,
+        readyTimeoutMs: 8000,
+        settleDelayMs: 1000,
+        // Two-phase submit: "/usage" first, CR 1500ms later. A single combined
+        // write is swallowed by the slash-command autocomplete and never runs.
+        input: "/usage",
+        submitInput: "\r",
+        submitAfterMs: 1500,
+        completionRegex: /Subscription/i,
+        // Trust prompt and the accidental-turn guard stay fail-closed. The
+        // unavailable-subscription message is deliberately not here: parseMuseTui
+        // owns detection so the poll can recover from it.
+        abortOn: /Do you trust this workspace|Working \(\d+s/,
+        timeoutMs,
+        respondToQueries: true,
+        maxBytes: 256 * 1024,
+        signal: adapterSignal("muse"),
+        label: "muse",
+    });
+    return parseMuseTui(transcript);
+}
 export const museAdapter = {
     id: "muse",
     requiresAuth: "muse login (CLI owns credentials)",
     async poll() {
-        const cwd = museProbeDir();
-        fs.mkdirSync(cwd, { recursive: true });
-        const transcript = await runPty({
-            file: "muse",
-            args: ["--trust-workspace"],
-            cwd,
-            // Without this, a missing binary triggers a foreground 248 MB download
-            // on every poll; with it the launcher dies fast with a clear message.
-            env: { MUSE_NO_AUTO_UPDATE: "1" },
-            cols: 140,
-            rows: 50,
-            readyRegex: /muse-spark|Muse Code \d/,
-            readyTimeoutMs: 8000,
-            settleDelayMs: 1000,
-            // Two-phase submit: "/usage" first, CR 1500ms later. A single combined
-            // write is swallowed by the slash-command autocomplete and never runs.
-            input: "/usage",
-            submitInput: "\r",
-            submitAfterMs: 1500,
-            completionRegex: /Subscription/i,
-            // Trust prompt (in case a future Muse ignores the flag), an accidental
-            // model turn from a mistimed Enter, and the unavailable-subscription
-            // fast-fail — every one aborts to a degraded row, never a 14s timeout.
-            abortOn: /Do you trust this workspace|Working \(\d+s|Subscriptions aren't currently available|subscription_unavailable/,
-            timeoutMs: 14000,
-            respondToQueries: true,
-            maxBytes: 256 * 1024,
-            signal: adapterSignal("muse"),
-            label: "muse",
-        });
-        return parseMuseTui(transcript);
+        // Captured before the first pass: pollAll clears the adapter signal map
+        // entry in a microtask when its gate rejects, but clearing the map does
+        // not reset the signal object, so the loop can still observe the abort.
+        const signal = adapterSignal("muse");
+        try {
+            return await usagePass();
+        }
+        catch (e) {
+            if (e?.message !== MUSE_UNAVAILABLE_MESSAGE)
+                throw e;
+            return recoverSubscription({
+                unavailable: e,
+                usagePass: (timeoutMs) => usagePass(timeoutMs),
+                warmTurn: async (timeoutMs) => {
+                    await trackedExecFile("muse", "muse", ["exec", "hi"], {
+                        cwd: museProbeDir(),
+                        env: { ...process.env, MUSE_NO_AUTO_UPDATE: "1" },
+                        timeout: timeoutMs,
+                    });
+                },
+                aborted: () => signal?.aborted === true,
+            });
+        }
     },
 };

package/dist/adapters/opencode-go.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedQuota } from "./types.js";
+export declare const OPENCODE_GO_CONSENT_NOTICE = "QuotaCap will read the API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` \u2192 `opencode` fallback). It is read in-memory, read-only once per poll (every 15 minutes by default). It is sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`. It is never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`). Revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling. If you prefer no file access, set `OPENCODE_API_KEY` instead.";
+export declare function openCodeGoAuthPath(): string;
+/** Detection is existence only — no content read before enablement. */
+export declare function opencodeGoDetected(): boolean;
+export declare function parseOpencodeGoUsage(body: unknown, now?: Date): ParsedQuota;
+export declare const opencodeGoAdapter: {
+    id: string;
+    requiresAuth: string;
+    poll(): Promise<ParsedQuota>;
+};

package/dist/adapters/opencode-go.js

@@ -0,0 +1,122 @@
+// Consented exception to credential-free polling: reads the OpenCode auth
+// key in-memory, only after `providers enable opencode-go` records consent.
+// The static gate pins the auth-file literal to this adapter plus the
+// generated dashboard bundle — see tests/adapters/credential-free.test.ts.
+import fsSync from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { adapterSignal } from "../runtime/spawn.js";
+const USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
+const POLL_TIMEOUT_MS = 8000;
+export const OPENCODE_GO_CONSENT_NOTICE = "QuotaCap will read the API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback). It is read in-memory, read-only once per poll (every 15 minutes by default). It is sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`. It is never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`). Revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling. If you prefer no file access, set `OPENCODE_API_KEY` instead.";
+export function openCodeGoAuthPath() {
+    return path.join(os.homedir(), ".local", "share", "opencode", "auth.json");
+}
+/** Detection is existence only — no content read before enablement. */
+export function opencodeGoDetected() {
+    try {
+        return fsSync.existsSync(openCodeGoAuthPath());
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Consent-gated: poll() runs only when the provider is in enabledProviders,
+ * which the enable flow records as explicit consent. One read, in-memory
+ * only, never written or logged. Env wins so a host can avoid file access.
+ */
+function readBearerToken(env = process.env) {
+    const fromEnv = env.OPENCODE_API_KEY;
+    if (typeof fromEnv === "string" && fromEnv.length > 0)
+        return fromEnv;
+    let parsed;
+    try {
+        parsed = JSON.parse(fsSync.readFileSync(openCodeGoAuthPath(), "utf8"));
+    }
+    catch {
+        throw new Error("opencode-go: missing API key in auth file");
+    }
+    const entry = (parsed["opencode-go"] ?? parsed["opencode"]);
+    if (!entry ||
+        entry.type !== "api" ||
+        typeof entry.key !== "string" ||
+        !entry.key.startsWith("sk-")) {
+        throw new Error("opencode-go: missing API key in auth file");
+    }
+    return entry.key;
+}
+export function parseOpencodeGoUsage(body, now = new Date()) {
+    const usage = body?.usage;
+    if (typeof usage !== "object" || usage === null) {
+        throw new Error("opencode-go: weekly usage not found");
+    }
+    const weekly = usage.weekly;
+    if (typeof weekly !== "object" || weekly === null) {
+        throw new Error("opencode-go: weekly usage not found");
+    }
+    if (weekly.status !== "ok") {
+        throw new Error("opencode-go: usage status not ok");
+    }
+    const usedPct = weekly.percent;
+    if (typeof usedPct !== "number" || !Number.isFinite(usedPct) || usedPct < 0 || usedPct > 100) {
+        throw new Error("opencode-go: bad weekly pct");
+    }
+    const resetsMs = Date.parse(String(weekly.resetsAt ?? ""));
+    if (!Number.isFinite(resetsMs)) {
+        throw new Error("opencode-go: bad weekly reset");
+    }
+    const rolling = usage.rolling;
+    if (typeof rolling !== "object" || rolling === null) {
+        throw new Error("opencode-go: rolling usage not found");
+    }
+    if (rolling.status !== "ok") {
+        throw new Error("opencode-go: usage status not ok");
+    }
+    const sessionPct = rolling.percent;
+    if (typeof sessionPct !== "number" || !Number.isFinite(sessionPct) || sessionPct < 0 || sessionPct > 100) {
+        throw new Error("opencode-go: bad rolling pct");
+    }
+    return {
+        provider: "opencode-go",
+        plan: "unknown",
+        usedPct,
+        sessionPct,
+        resetsAt: new Date(resetsMs).toISOString(),
+        periodStart: new Date(resetsMs - 7 * 86400000).toISOString(),
+        source: "api",
+        fetchedAt: now.toISOString(),
+    };
+}
+export const opencodeGoAdapter = {
+    id: "opencode-go",
+    requiresAuth: "opencode auth login -p opencode-go (read only after you enable opencode-go)",
+    async poll() {
+        const bearer = readBearerToken();
+        const adapter = adapterSignal("opencode-go");
+        const signals = [AbortSignal.timeout(POLL_TIMEOUT_MS)];
+        if (adapter)
+            signals.push(adapter);
+        const res = await fetch(USAGE_URL, {
+            headers: { Authorization: `Bearer ${bearer}` },
+            signal: AbortSignal.any(signals),
+        });
+        if (res.status === 401 || res.status === 403) {
+            throw new Error(`opencode-go: unauthorized (${res.status})`);
+        }
+        if (res.status === 429) {
+            throw new Error("opencode-go: rate limit (429)");
+        }
+        if (!res.ok) {
+            throw new Error(`opencode-go: usage request failed with status ${res.status}`);
+        }
+        let body;
+        try {
+            body = JSON.parse(await res.text());
+        }
+        catch {
+            throw new Error("opencode-go: weekly usage not found");
+        }
+        return parseOpencodeGoUsage(body);
+    },
+};

package/dist/advisory/provider-names.js

@@ -66,6 +66,15 @@ export const REGISTRY = new Map([
             description: "Meta's Muse Code subscription, running Muse Spark models, metered as a weekly window with a shorter current window inside it.",
         },
     ],
+    [
+        "opencode-go",
+        {
+            displayName: "OpenCode Go",
+            vendor: "Anomaly",
+            harness: "OpenCode",
+            description: "OpenCode Go subscription usage via the zen/go usage API, polled only after you explicitly enable it.",
+        },
+    ],
     [
         "manual",
         {

package/dist/advisory/snapshot.d.ts

@@ -16,6 +16,7 @@ export interface SnapshotOptions {
             upToDate: boolean;
             checkedAt: string | null;
         };
+        detectedProviders?: string[];
     };
 }
 export declare function buildSnapshot(db: any, opts: SnapshotOptions): StateSnapshot;

package/dist/advisory/types.d.ts

@@ -102,6 +102,9 @@ export interface StateSnapshot {
         lastCompletedPollAt: string | null;
         version: string;
         update?: UpdateStatus;
+        /** Auth detected for these provider ids (detection-only; consumers intersect with the enabled set).
+         *  Empty on daemons predating the field. */
+        detectedProviders?: string[];
     };
     providers: ProviderSnapshot[];
     recommendation: Recommendation;

package/dist/cli/providers.js

@@ -1,4 +1,6 @@
-import { readConfig, resetAllProviderNameOverrides, setProviderNameOverride } from "../config.js";
+import { adapters } from "../adapters/index.js";
+import { OPENCODE_GO_CONSENT_NOTICE } from "../adapters/opencode-go.js";
+import { readConfig, resetAllProviderNameOverrides, setProviderEnabled, setProviderNameOverride } from "../config.js";
 import { REGISTRY, providerIdentity } from "../advisory/provider-names.js";
 import { validateDisplayName } from "../advisory/validation.js";
 import { ServiceError, ServiceUnavailable, createServiceClient } from "../runtime/client.js";
@@ -171,4 +173,122 @@ export function registerProvidersCommand(program, deps = {}) {
             console.log(`reset display name for ${id}`);
         }
     });
+    providers
+        .command("enable <id>")
+        .description("enable a provider (OpenCode Go requires explicit consent)")
+        .option("--yes", "skip the interactive consent prompt (scripts)")
+        .action(async (id, opts) => {
+        if (typeof id !== "string" || !id || !Object.hasOwn(adapters, id) || id === "manual") {
+            console.error(`error: unknown provider id: ${id}`);
+            exit(1);
+            return;
+        }
+        if (id === "opencode-go") {
+            console.log("**Enable OpenCode Go?**\n");
+            console.log(OPENCODE_GO_CONSENT_NOTICE + "\n");
+            if (!opts.yes) {
+                if (!process.stdin.isTTY) {
+                    console.error("refusing to enable opencode-go without interactive consent — read the notice above and re-run with --yes");
+                    exit(1);
+                    return;
+                }
+                const readline = (await import("node:readline/promises")).default;
+                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                try {
+                    const answer = (await rl.question("Proceed? [y/N] ")).trim().toLowerCase();
+                    if (answer !== "y" && answer !== "yes") {
+                        console.log("not enabled");
+                        return;
+                    }
+                }
+                catch {
+                    console.log("not enabled");
+                    return;
+                }
+                finally {
+                    rl.close();
+                }
+            }
+        }
+        const cfg = await readConfig();
+        const client = createClient({ port: cfg.port, token: readToken(), timeoutMs: 2000 });
+        try {
+            await client.post(`/api/providers/${encodeURIComponent(id)}/enabled`, {
+                enabled: true,
+                ...(id === "opencode-go" ? { consent: true } : {}),
+            });
+        }
+        catch (e) {
+            if (e instanceof ServiceError && e.status === 404 && id === "opencode-go") {
+                console.error("the running daemon predates OpenCode Go support (no enable route) — upgrade it with `quotacap update` before enabling; refusing to write config the old daemon cannot start with");
+                exit(1);
+                return;
+            }
+            if (e instanceof ServiceUnavailable || (e instanceof ServiceError && e.status === 404)) {
+                try {
+                    await setProviderEnabled(id, true);
+                }
+                catch (err) {
+                    console.error(err?.message ?? String(err));
+                    exit(1);
+                    return;
+                }
+                if (e instanceof ServiceError && e.status === 404) {
+                    console.warn("note: daemon returned 404 (version skew); updated local config, restart quotacap daemon to apply");
+                }
+            }
+            else if (e instanceof ServiceError) {
+                console.error(e.message);
+                exit(1);
+                return;
+            }
+            else {
+                console.error(e instanceof Error ? e.message : String(e));
+                exit(1);
+                return;
+            }
+        }
+        console.log(`enabled ${id} — restart quotacap daemon to apply`);
+    });
+    providers
+        .command("disable <id>")
+        .description("disable a provider and stop polling it")
+        .action(async (id) => {
+        if (typeof id !== "string" || !id || !Object.hasOwn(adapters, id) || id === "manual") {
+            console.error(`error: unknown provider id: ${id}`);
+            exit(1);
+            return;
+        }
+        const cfg = await readConfig();
+        const client = createClient({ port: cfg.port, token: readToken(), timeoutMs: 2000 });
+        try {
+            await client.post(`/api/providers/${encodeURIComponent(id)}/enabled`, { enabled: false });
+        }
+        catch (e) {
+            if (e instanceof ServiceUnavailable || (e instanceof ServiceError && e.status === 404)) {
+                try {
+                    await setProviderEnabled(id, false);
+                }
+                catch (err) {
+                    console.error(err?.message ?? String(err));
+                    exit(1);
+                    return;
+                }
+                if (e instanceof ServiceError && e.status === 404) {
+                    console.warn("note: daemon returned 404 (version skew); updated local config, restart quotacap daemon to apply");
+                }
+            }
+            else if (e instanceof ServiceError) {
+                console.error(e.message);
+                exit(1);
+                return;
+            }
+            else {
+                console.error(e instanceof Error ? e.message : String(e));
+                exit(1);
+                return;
+            }
+        }
+        console.log(`disabled ${id} — restart quotacap daemon to apply`);
+    });
 }

package/dist/cli/status.js

@@ -135,6 +135,12 @@ export function registerStatusCommand(program, deps) {
         }
         if (resolved.source === "offline")
             console.error(OFFLINE_LABEL);
+        const detected = resolved.snapshot.runtime?.detectedProviders;
+        if (Array.isArray(detected) &&
+            detected.includes("opencode-go") &&
+            !cfg.enabledProviders.includes("opencode-go")) {
+            console.error("opencode-go detected — run `quotacap providers enable opencode-go` to track 5h/weekly usage");
+        }
         const { snapshot } = resolved;
         if (o.json) {
             console.log(JSON.stringify(projectQuotasResponse(snapshot), null, 2));

package/dist/config.d.ts

@@ -9,6 +9,7 @@ declare const ConfigSchema: z.ZodObject<{
     enabledProviders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     knownProviders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     providerNames: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>>;
+    opencodeGoConsentAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     experimentalIngest: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     port: number;
@@ -17,6 +18,7 @@ declare const ConfigSchema: z.ZodObject<{
     enabledProviders: string[];
     knownProviders: string[];
     providerNames: Record<string, string>;
+    opencodeGoConsentAt: string | null;
     experimentalIngest?: boolean | undefined;
 }, {
     port?: number | undefined;
@@ -25,6 +27,7 @@ declare const ConfigSchema: z.ZodObject<{
     enabledProviders?: string[] | undefined;
     knownProviders?: string[] | undefined;
     providerNames?: Record<string, string> | undefined;
+    opencodeGoConsentAt?: string | null | undefined;
     experimentalIngest?: boolean | undefined;
 }>;
 export type Config = z.infer<typeof ConfigSchema>;
@@ -50,6 +53,12 @@ export declare function writeConfig(c: Config, p?: string): Promise<void>;
  * all unknown keys and custom configuration, and fails loudly if the file is corrupt.
  */
 export declare function setProviderNameOverride(id: string, displayName: string | null, p?: string): Promise<void>;
+/**
+ * Safe mutation of provider enablement in config.json: raw-JSON like
+ * setProviderNameOverride (unknown keys preserved). Enabling opencode-go
+ * records the consent timestamp; disabling it revokes the consent record.
+ */
+export declare function setProviderEnabled(id: string, enabled: boolean, p?: string): Promise<void>;
 export declare function resetAllProviderNameOverrides(p?: string): Promise<void>;
 export declare const LEGACY_KNOWN_PROVIDERS: string[];
 export interface AutoEnableDeps {
@@ -63,7 +72,8 @@ export interface AutoEnableResult {
 }
 /**
  * Auto-enable newly shipped adapters. For each registered adapter (minus
- * `manual`, which has no CLI binary) absent from knownProviders, resolve its
+ * `manual`, which has no CLI binary, and minus opt-in adapters, which an
+ * explicit enable must consent to) absent from knownProviders, resolve its
  * binary on PATH and append it to both lists when found. An adapter whose
  * binary is missing stays unknown so it is re-checked on the next start; a
  * provider already known but disabled is never re-added. Raw-JSON mutation