quotacap 0.0.37 → 0.0.38

package/README.md

@@ -24,10 +24,11 @@ QuotaCap helps you get more from the AI coding subscriptions you already pay for
 | Kimi Code | `pty` — `kimi` then `/usage`, parse `Weekly/5h limit: Y% used` | Live |
 | Grok | `pty` — `grok` then `/usage`, parse `Weekly limit (plan)` + `Credits: $X` | Live |
 | Muse Code | `pty` — `muse --trust-workspace` then `/usage`, parse `Subscription · Muse Code <plan>` + `Weekly/Current N% used`; on `Currently unavailable`, up to three headless `muse exec` warm turns and re-reads inside the poll | Live |
+| OpenCode Go | `api` — `GET https://opencode.ai/zen/go/v1/usage` with the OpenCode auth key; opt-in via `quotacap providers enable opencode-go` (consent recorded, disable revokes it) | Live (opt-in) |
 
 Exec adapters run via `execFile` with an argv list. PTY adapters run via `node-pty` (`src/adapters/pty.ts`). They are TUI-fragile: a vendor text change breaks the parser and the row degrades fail-closed until the regex is fixed. Poll latency is 2–10 s per PTY provider (settle plus completion); `muse` can reach about 75 s when it has to warm an unavailable subscription. It dominates `POST /api/refresh` and the first poll, not the steady-state 15 m timer.
 
-Live adapters invoke the CLIs you already logged into. No API keys. No token files are read.
+Live adapters invoke the CLIs you already logged into — no API keys, no token files read. The one opt-in exception is OpenCode Go: after you run `quotacap providers enable opencode-go`, each poll reads the OpenCode auth key in-memory (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback, or `OPENCODE_API_KEY`) and sends it only to `opencode.ai/zen/go/v1/usage`. It is never stored, logged, or returned by the API or MCP. Disable any time with `quotacap providers disable opencode-go`.
 
 ## Install
 
@@ -83,6 +84,7 @@ The local web server listens on `127.0.0.1:8787` (configured via `QUOTACAP_URL`
 | `GET` | `/api/token` | Same-origin | Shared secret token for the dashboard |
 | `POST` | `/api/refresh` | `X-QuotaCap-Token` | Trigger an immediate adapter poll (debounced to 60s) |
 | `PATCH` | `/api/providers/:id` | `X-QuotaCap-Token` | Set or clear custom provider display name override |
+| `POST` | `/api/providers/:id/enabled` | `X-QuotaCap-Token` | Enable or disable a provider (`consent: true` required for `opencode-go`); restart applies it |
 
 ### Curl examples
 
@@ -119,7 +121,7 @@ curl -X PATCH http://localhost:8787/api/providers/claude \
 
 QuotaCap is a local daemon. It binds to `127.0.0.1` only (`src/runtime/service.ts` `app.listen`). It does not listen on `0.0.0.0`. There is no LAN surface.
 
-It owns no tokens. It never reads `~/.codex/auth.json`, `~/.kimi-code/credentials/kimi-code.json`, `~/.kimi/credentials/kimi-code.json`, `~/.grok/auth.json`, or `~/.gemini/oauth_creds.json`. It never uses `refresh_token` or `grant_type=refresh_token`. It has no hardcoded client ids. Those OAuth paths and the `.qc-bak` and `.qc-lock` helpers were removed in #14. This is asserted by `tests/adapters/credential-free.test.ts`. Each CLI owns its own session. It never reads `~/.config/muse/auth.json`, `~/.local/share/muse/sessions/`, or `~/.config/muse/tui-history.jsonl`. Each CLI owns its own session. QuotaCap only spawns the CLI and reads its stdout via `exec` (`claude`, `agy`) or PTY (`codex`, `kimi`, `grok`, `muse`).
+It owns no tokens. It never reads `~/.codex/auth.json`, `~/.kimi-code/credentials/kimi-code.json`, `~/.kimi/credentials/kimi-code.json`, `~/.grok/auth.json`, or `~/.gemini/oauth_creds.json`. It never uses `refresh_token` or `grant_type=refresh_token`. It has no hardcoded client ids. Those OAuth paths and the `.qc-bak` and `.qc-lock` helpers were removed in #14. This is asserted by `tests/adapters/credential-free.test.ts`. Each CLI owns its own session. It never reads `~/.config/muse/auth.json`, `~/.local/share/muse/sessions/`, or `~/.config/muse/tui-history.jsonl`. Each CLI owns its own session. The one opt-in exception is OpenCode Go: when you enable it, QuotaCap reads `~/.local/share/opencode/auth.json` in-memory, read-only, once per poll, and sends the key only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage`. The read is consent-gated (`opencodeGoConsentAt` in config), asserted read-only by `tests/adapters/credential-free.test.ts`, and revoked by `quotacap providers disable opencode-go`. QuotaCap only spawns the CLI and reads its stdout via `exec` (`claude`, `agy`) or PTY (`codex`, `kimi`, `grok`, `muse`).
 
 It stores no `raw` provider payload. The `raw` column was dropped and migrated in `src/store/db.ts` `migrate`. `GET /api/quotas` and MCP `get_quotas` never return `raw` (`tests/http/api.test.ts`). History and the token live under `~/.quotacap/` with `0700` on the directory and `0600` on files.
 

package/dist/adapters/index.js

@@ -5,6 +5,7 @@ import { kimiAdapter } from "./kimi.js";
 import { grokAdapter } from "./grok.js";
 import { agyAdapter } from "./agy.js";
 import { museAdapter } from "./muse.js";
+import { opencodeGoAdapter } from "./opencode-go.js";
 import { installAdapterSignal, clearAdapterSignal } from "../runtime/spawn.js";
 export const adapters = {
     claude: claudeAdapter,
@@ -14,6 +15,7 @@ export const adapters = {
     grok: grokAdapter,
     agy: agyAdapter,
     muse: museAdapter,
+    "opencode-go": opencodeGoAdapter,
 };
 const ADAPTER_TIMEOUTS = {
     claude: 8000,
@@ -22,6 +24,7 @@ const ADAPTER_TIMEOUTS = {
     grok: 14000,
     agy: 20000,
     muse: 90000,
+    "opencode-go": 8000,
 };
 export async function pollAll(enabled, opts) {
     const rawJobs = enabled.map(id => {

package/dist/adapters/opencode-go.d.ts

@@ -0,0 +1,11 @@
+import type { ParsedQuota } from "./types.js";
+export declare const OPENCODE_GO_CONSENT_NOTICE = "QuotaCap will read the API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` \u2192 `opencode` fallback). It is read in-memory, read-only once per poll (every 15 minutes by default). It is sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`. It is never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`). Revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling. If you prefer no file access, set `OPENCODE_API_KEY` instead.";
+export declare function openCodeGoAuthPath(): string;
+/** Detection is existence only — no content read before enablement. */
+export declare function opencodeGoDetected(): boolean;
+export declare function parseOpencodeGoUsage(body: unknown, now?: Date): ParsedQuota;
+export declare const opencodeGoAdapter: {
+    id: string;
+    requiresAuth: string;
+    poll(): Promise<ParsedQuota>;
+};

package/dist/adapters/opencode-go.js

@@ -0,0 +1,122 @@
+// Consented exception to credential-free polling: reads the OpenCode auth
+// key in-memory, only after `providers enable opencode-go` records consent.
+// The static gate pins the auth-file literal to this adapter plus the
+// generated dashboard bundle — see tests/adapters/credential-free.test.ts.
+import fsSync from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { adapterSignal } from "../runtime/spawn.js";
+const USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
+const POLL_TIMEOUT_MS = 8000;
+export const OPENCODE_GO_CONSENT_NOTICE = "QuotaCap will read the API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback). It is read in-memory, read-only once per poll (every 15 minutes by default). It is sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`. It is never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`). Revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling. If you prefer no file access, set `OPENCODE_API_KEY` instead.";
+export function openCodeGoAuthPath() {
+    return path.join(os.homedir(), ".local", "share", "opencode", "auth.json");
+}
+/** Detection is existence only — no content read before enablement. */
+export function opencodeGoDetected() {
+    try {
+        return fsSync.existsSync(openCodeGoAuthPath());
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Consent-gated: poll() runs only when the provider is in enabledProviders,
+ * which the enable flow records as explicit consent. One read, in-memory
+ * only, never written or logged. Env wins so a host can avoid file access.
+ */
+function readBearerToken(env = process.env) {
+    const fromEnv = env.OPENCODE_API_KEY;
+    if (typeof fromEnv === "string" && fromEnv.length > 0)
+        return fromEnv;
+    let parsed;
+    try {
+        parsed = JSON.parse(fsSync.readFileSync(openCodeGoAuthPath(), "utf8"));
+    }
+    catch {
+        throw new Error("opencode-go: missing API key in auth file");
+    }
+    const entry = (parsed["opencode-go"] ?? parsed["opencode"]);
+    if (!entry ||
+        entry.type !== "api" ||
+        typeof entry.key !== "string" ||
+        !entry.key.startsWith("sk-")) {
+        throw new Error("opencode-go: missing API key in auth file");
+    }
+    return entry.key;
+}
+export function parseOpencodeGoUsage(body, now = new Date()) {
+    const usage = body?.usage;
+    if (typeof usage !== "object" || usage === null) {
+        throw new Error("opencode-go: weekly usage not found");
+    }
+    const weekly = usage.weekly;
+    if (typeof weekly !== "object" || weekly === null) {
+        throw new Error("opencode-go: weekly usage not found");
+    }
+    if (weekly.status !== "ok") {
+        throw new Error("opencode-go: usage status not ok");
+    }
+    const usedPct = weekly.percent;
+    if (typeof usedPct !== "number" || !Number.isFinite(usedPct) || usedPct < 0 || usedPct > 100) {
+        throw new Error("opencode-go: bad weekly pct");
+    }
+    const resetsMs = Date.parse(String(weekly.resetsAt ?? ""));
+    if (!Number.isFinite(resetsMs)) {
+        throw new Error("opencode-go: bad weekly reset");
+    }
+    const rolling = usage.rolling;
+    if (typeof rolling !== "object" || rolling === null) {
+        throw new Error("opencode-go: rolling usage not found");
+    }
+    if (rolling.status !== "ok") {
+        throw new Error("opencode-go: usage status not ok");
+    }
+    const sessionPct = rolling.percent;
+    if (typeof sessionPct !== "number" || !Number.isFinite(sessionPct) || sessionPct < 0 || sessionPct > 100) {
+        throw new Error("opencode-go: bad rolling pct");
+    }
+    return {
+        provider: "opencode-go",
+        plan: "unknown",
+        usedPct,
+        sessionPct,
+        resetsAt: new Date(resetsMs).toISOString(),
+        periodStart: new Date(resetsMs - 7 * 86400000).toISOString(),
+        source: "api",
+        fetchedAt: now.toISOString(),
+    };
+}
+export const opencodeGoAdapter = {
+    id: "opencode-go",
+    requiresAuth: "opencode auth login -p opencode-go (read only after you enable opencode-go)",
+    async poll() {
+        const bearer = readBearerToken();
+        const adapter = adapterSignal("opencode-go");
+        const signals = [AbortSignal.timeout(POLL_TIMEOUT_MS)];
+        if (adapter)
+            signals.push(adapter);
+        const res = await fetch(USAGE_URL, {
+            headers: { Authorization: `Bearer ${bearer}` },
+            signal: AbortSignal.any(signals),
+        });
+        if (res.status === 401 || res.status === 403) {
+            throw new Error(`opencode-go: unauthorized (${res.status})`);
+        }
+        if (res.status === 429) {
+            throw new Error("opencode-go: rate limit (429)");
+        }
+        if (!res.ok) {
+            throw new Error(`opencode-go: usage request failed with status ${res.status}`);
+        }
+        let body;
+        try {
+            body = JSON.parse(await res.text());
+        }
+        catch {
+            throw new Error("opencode-go: weekly usage not found");
+        }
+        return parseOpencodeGoUsage(body);
+    },
+};

package/dist/advisory/provider-names.js

@@ -66,6 +66,15 @@ export const REGISTRY = new Map([
             description: "Meta's Muse Code subscription, running Muse Spark models, metered as a weekly window with a shorter current window inside it.",
         },
     ],
+    [
+        "opencode-go",
+        {
+            displayName: "OpenCode Go",
+            vendor: "Anomaly",
+            harness: "OpenCode",
+            description: "OpenCode Go subscription usage via the zen/go usage API, polled only after you explicitly enable it.",
+        },
+    ],
     [
         "manual",
         {

package/dist/advisory/snapshot.d.ts

@@ -16,6 +16,7 @@ export interface SnapshotOptions {
             upToDate: boolean;
             checkedAt: string | null;
         };
+        detectedProviders?: string[];
     };
 }
 export declare function buildSnapshot(db: any, opts: SnapshotOptions): StateSnapshot;

package/dist/advisory/types.d.ts

@@ -102,6 +102,9 @@ export interface StateSnapshot {
         lastCompletedPollAt: string | null;
         version: string;
         update?: UpdateStatus;
+        /** Auth detected for these provider ids (detection-only; consumers intersect with the enabled set).
+         *  Empty on daemons predating the field. */
+        detectedProviders?: string[];
     };
     providers: ProviderSnapshot[];
     recommendation: Recommendation;

package/dist/cli/providers.js

@@ -1,4 +1,6 @@
-import { readConfig, resetAllProviderNameOverrides, setProviderNameOverride } from "../config.js";
+import { adapters } from "../adapters/index.js";
+import { OPENCODE_GO_CONSENT_NOTICE } from "../adapters/opencode-go.js";
+import { readConfig, resetAllProviderNameOverrides, setProviderEnabled, setProviderNameOverride } from "../config.js";
 import { REGISTRY, providerIdentity } from "../advisory/provider-names.js";
 import { validateDisplayName } from "../advisory/validation.js";
 import { ServiceError, ServiceUnavailable, createServiceClient } from "../runtime/client.js";
@@ -171,4 +173,122 @@ export function registerProvidersCommand(program, deps = {}) {
             console.log(`reset display name for ${id}`);
         }
     });
+    providers
+        .command("enable <id>")
+        .description("enable a provider (OpenCode Go requires explicit consent)")
+        .option("--yes", "skip the interactive consent prompt (scripts)")
+        .action(async (id, opts) => {
+        if (typeof id !== "string" || !id || !Object.hasOwn(adapters, id) || id === "manual") {
+            console.error(`error: unknown provider id: ${id}`);
+            exit(1);
+            return;
+        }
+        if (id === "opencode-go") {
+            console.log("**Enable OpenCode Go?**\n");
+            console.log(OPENCODE_GO_CONSENT_NOTICE + "\n");
+            if (!opts.yes) {
+                if (!process.stdin.isTTY) {
+                    console.error("refusing to enable opencode-go without interactive consent — read the notice above and re-run with --yes");
+                    exit(1);
+                    return;
+                }
+                const readline = (await import("node:readline/promises")).default;
+                const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+                try {
+                    const answer = (await rl.question("Proceed? [y/N] ")).trim().toLowerCase();
+                    if (answer !== "y" && answer !== "yes") {
+                        console.log("not enabled");
+                        return;
+                    }
+                }
+                catch {
+                    console.log("not enabled");
+                    return;
+                }
+                finally {
+                    rl.close();
+                }
+            }
+        }
+        const cfg = await readConfig();
+        const client = createClient({ port: cfg.port, token: readToken(), timeoutMs: 2000 });
+        try {
+            await client.post(`/api/providers/${encodeURIComponent(id)}/enabled`, {
+                enabled: true,
+                ...(id === "opencode-go" ? { consent: true } : {}),
+            });
+        }
+        catch (e) {
+            if (e instanceof ServiceError && e.status === 404 && id === "opencode-go") {
+                console.error("the running daemon predates OpenCode Go support (no enable route) — upgrade it with `quotacap update` before enabling; refusing to write config the old daemon cannot start with");
+                exit(1);
+                return;
+            }
+            if (e instanceof ServiceUnavailable || (e instanceof ServiceError && e.status === 404)) {
+                try {
+                    await setProviderEnabled(id, true);
+                }
+                catch (err) {
+                    console.error(err?.message ?? String(err));
+                    exit(1);
+                    return;
+                }
+                if (e instanceof ServiceError && e.status === 404) {
+                    console.warn("note: daemon returned 404 (version skew); updated local config, restart quotacap daemon to apply");
+                }
+            }
+            else if (e instanceof ServiceError) {
+                console.error(e.message);
+                exit(1);
+                return;
+            }
+            else {
+                console.error(e instanceof Error ? e.message : String(e));
+                exit(1);
+                return;
+            }
+        }
+        console.log(`enabled ${id} — restart quotacap daemon to apply`);
+    });
+    providers
+        .command("disable <id>")
+        .description("disable a provider and stop polling it")
+        .action(async (id) => {
+        if (typeof id !== "string" || !id || !Object.hasOwn(adapters, id) || id === "manual") {
+            console.error(`error: unknown provider id: ${id}`);
+            exit(1);
+            return;
+        }
+        const cfg = await readConfig();
+        const client = createClient({ port: cfg.port, token: readToken(), timeoutMs: 2000 });
+        try {
+            await client.post(`/api/providers/${encodeURIComponent(id)}/enabled`, { enabled: false });
+        }
+        catch (e) {
+            if (e instanceof ServiceUnavailable || (e instanceof ServiceError && e.status === 404)) {
+                try {
+                    await setProviderEnabled(id, false);
+                }
+                catch (err) {
+                    console.error(err?.message ?? String(err));
+                    exit(1);
+                    return;
+                }
+                if (e instanceof ServiceError && e.status === 404) {
+                    console.warn("note: daemon returned 404 (version skew); updated local config, restart quotacap daemon to apply");
+                }
+            }
+            else if (e instanceof ServiceError) {
+                console.error(e.message);
+                exit(1);
+                return;
+            }
+            else {
+                console.error(e instanceof Error ? e.message : String(e));
+                exit(1);
+                return;
+            }
+        }
+        console.log(`disabled ${id} — restart quotacap daemon to apply`);
+    });
 }

package/dist/cli/status.js

@@ -135,6 +135,12 @@ export function registerStatusCommand(program, deps) {
         }
         if (resolved.source === "offline")
             console.error(OFFLINE_LABEL);
+        const detected = resolved.snapshot.runtime?.detectedProviders;
+        if (Array.isArray(detected) &&
+            detected.includes("opencode-go") &&
+            !cfg.enabledProviders.includes("opencode-go")) {
+            console.error("opencode-go detected — run `quotacap providers enable opencode-go` to track 5h/weekly usage");
+        }
         const { snapshot } = resolved;
         if (o.json) {
             console.log(JSON.stringify(projectQuotasResponse(snapshot), null, 2));

package/dist/config.d.ts

@@ -9,6 +9,7 @@ declare const ConfigSchema: z.ZodObject<{
     enabledProviders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     knownProviders: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     providerNames: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>>;
+    opencodeGoConsentAt: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     experimentalIngest: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     port: number;
@@ -17,6 +18,7 @@ declare const ConfigSchema: z.ZodObject<{
     enabledProviders: string[];
     knownProviders: string[];
     providerNames: Record<string, string>;
+    opencodeGoConsentAt: string | null;
     experimentalIngest?: boolean | undefined;
 }, {
     port?: number | undefined;
@@ -25,6 +27,7 @@ declare const ConfigSchema: z.ZodObject<{
     enabledProviders?: string[] | undefined;
     knownProviders?: string[] | undefined;
     providerNames?: Record<string, string> | undefined;
+    opencodeGoConsentAt?: string | null | undefined;
     experimentalIngest?: boolean | undefined;
 }>;
 export type Config = z.infer<typeof ConfigSchema>;
@@ -50,6 +53,12 @@ export declare function writeConfig(c: Config, p?: string): Promise<void>;
  * all unknown keys and custom configuration, and fails loudly if the file is corrupt.
  */
 export declare function setProviderNameOverride(id: string, displayName: string | null, p?: string): Promise<void>;
+/**
+ * Safe mutation of provider enablement in config.json: raw-JSON like
+ * setProviderNameOverride (unknown keys preserved). Enabling opencode-go
+ * records the consent timestamp; disabling it revokes the consent record.
+ */
+export declare function setProviderEnabled(id: string, enabled: boolean, p?: string): Promise<void>;
 export declare function resetAllProviderNameOverrides(p?: string): Promise<void>;
 export declare const LEGACY_KNOWN_PROVIDERS: string[];
 export interface AutoEnableDeps {
@@ -63,7 +72,8 @@ export interface AutoEnableResult {
 }
 /**
  * Auto-enable newly shipped adapters. For each registered adapter (minus
- * `manual`, which has no CLI binary) absent from knownProviders, resolve its
+ * `manual`, which has no CLI binary, and minus opt-in adapters, which an
+ * explicit enable must consent to) absent from knownProviders, resolve its
  * binary on PATH and append it to both lists when found. An adapter whose
  * binary is missing stays unknown so it is re-checked on the next start; a
  * provider already known but disabled is never re-added. Raw-JSON mutation

package/dist/config.js

@@ -37,6 +37,7 @@ const ConfigSchema = z.object({
     enabledProviders: z.array(z.string()).default(["claude", "codex", "kimi", "grok", "agy", "muse"]),
     knownProviders: z.array(z.string()).default(["claude", "codex", "kimi", "grok", "agy", "muse"]),
     providerNames: z.record(z.string(), ProviderDisplayNameSchema).default({}),
+    opencodeGoConsentAt: z.string().nullable().default(null),
     // Optional, omitted from defaults and `init` output. Manual ingest stays
     // in-tree but is not a public surface until the product design lands.
     experimentalIngest: z.boolean().optional(),
@@ -90,7 +91,7 @@ const ServiceConfigSchema = z.object({
     enabledProviders: z
         .array(z.string())
         .superRefine((ids, ctx) => {
-        const bad = ids.filter((id) => !(id in adapters));
+        const bad = ids.filter((id) => !Object.hasOwn(adapters, id));
         if (bad.length > 0) {
             ctx.addIssue({
                 code: z.ZodIssueCode.custom,
@@ -103,6 +104,7 @@ const ServiceConfigSchema = z.object({
     // start. A non-array still fails naming the field.
     knownProviders: z.array(z.string()).default(["claude", "codex", "kimi", "grok", "agy", "muse"]),
     providerNames: z.record(z.string(), ProviderDisplayNameSchema).default({}),
+    opencodeGoConsentAt: z.string().nullable().default(null),
     experimentalIngest: z.boolean().optional(),
 });
 export function defaultConfig() {
@@ -205,6 +207,49 @@ export async function setProviderNameOverride(id, displayName, p) {
     await fs.mkdir(path.dirname(file), { recursive: true });
     await fs.writeFile(file, JSON.stringify(rawObj, null, 2) + "\n");
 }
+/**
+ * Safe mutation of provider enablement in config.json: raw-JSON like
+ * setProviderNameOverride (unknown keys preserved). Enabling opencode-go
+ * records the consent timestamp; disabling it revokes the consent record.
+ */
+export async function setProviderEnabled(id, enabled, p) {
+    const file = getConfigPath(p);
+    let rawObj = {};
+    try {
+        const raw = await fs.readFile(file, "utf8");
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error(`invalid config: ${file} must contain a JSON object`);
+        }
+        rawObj = parsed;
+    }
+    catch (err) {
+        if (err?.code === "ENOENT") {
+            rawObj = {};
+        }
+        else {
+            throw new Error(`cannot update provider enablement: failed to read ${file}: ${err?.message ?? err}`);
+        }
+    }
+    const list = Array.isArray(rawObj.enabledProviders)
+        ? [...rawObj.enabledProviders]
+        : [...defaultConfig().enabledProviders];
+    if (enabled) {
+        if (!list.includes(id))
+            list.push(id);
+    }
+    else {
+        const at = list.indexOf(id);
+        if (at >= 0)
+            list.splice(at, 1);
+    }
+    rawObj.enabledProviders = list;
+    if (id === "opencode-go") {
+        rawObj.opencodeGoConsentAt = enabled ? new Date().toISOString() : null;
+    }
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, JSON.stringify(rawObj, null, 2) + "\n");
+}
 export async function resetAllProviderNameOverrides(p) {
     const file = getConfigPath(p);
     let rawObj = {};
@@ -233,6 +278,9 @@ export async function resetAllProviderNameOverrides(p) {
 // reads as new. Never extend this list: seeding from the live registry would
 // mark every adapter known and silently disable auto-enable.
 export const LEGACY_KNOWN_PROVIDERS = ["claude", "codex", "kimi", "grok", "agy"];
+// Opt-in adapters are never auto-enabled: a binary on PATH is not consent.
+// opencode-go polls a stored credential, so only an explicit enable adds it.
+const OPT_IN_ADAPTERS = new Set(["opencode-go"]);
 // PATH lookup kept local: importing the sibling in src/service/macos.ts
 // would create a config<->service import cycle.
 function defaultWhich(bin) {
@@ -249,7 +297,8 @@ function defaultWhich(bin) {
 }
 /**
  * Auto-enable newly shipped adapters. For each registered adapter (minus
- * `manual`, which has no CLI binary) absent from knownProviders, resolve its
+ * `manual`, which has no CLI binary, and minus opt-in adapters, which an
+ * explicit enable must consent to) absent from knownProviders, resolve its
  * binary on PATH and append it to both lists when found. An adapter whose
  * binary is missing stays unknown so it is re-checked on the next start; a
  * provider already known but disabled is never re-added. Raw-JSON mutation
@@ -285,7 +334,7 @@ export async function autoEnableNewProviders(deps) {
     const enabled = [...prevEnabled];
     const known = [...prevKnown];
     for (const id of Object.keys(adapters)) {
-        if (id === "manual" || known.includes(id))
+        if (id === "manual" || OPT_IN_ADAPTERS.has(id) || known.includes(id))
             continue;
         let resolved = null;
         try {

package/dist/diagnostics/failure.js

@@ -22,6 +22,8 @@ export function formatProviderName(provider) {
             return "Antigravity (3rd-party)";
         case "muse":
             return "Muse";
+        case "opencode-go":
+            return "OpenCode Go";
         case "all":
             return "QuotaCap service";
         default:
@@ -224,6 +226,15 @@ function matchPrecedence(evidence, errorName, errorCode, text) {
     if (/\bno weekly bucket\b/i.test(text)) {
         return { code: "parse_error", phrase: "no weekly bucket" };
     }
+    if (/\brolling usage not found\b/i.test(text)) {
+        return { code: "parse_error", phrase: "rolling usage not found" };
+    }
+    if (/\bbad rolling pct\b/i.test(text)) {
+        return { code: "parse_error", phrase: "bad rolling pct" };
+    }
+    if (/\busage status not ok\b/i.test(text)) {
+        return { code: "parse_error", phrase: "usage status not ok" };
+    }
     // Order 8b: service_unavailable — subscription or service currently unavailable
     if (/\b(?:subscription|service|usage)\s+currently\s+unavailable\b/i.test(text) ||
         /\bsubscriptions aren't currently available\b/i.test(text)) {

package/dist/http/server.d.ts

@@ -10,6 +10,8 @@ export interface RuntimeContext {
     coordinator: Coordinator;
     enabledProviders: string[];
     providerNames?: Record<string, string>;
+    /** Detected-but-not-enabled opt-in providers, computed once at start. */
+    detectedProviders?: string[];
     version: string;
     exec: string;
     now?: () => Date;

package/dist/http/server.js

@@ -10,12 +10,13 @@ import { validateTask } from "../advisory/validate.js";
 import { readUpdateCache } from "../runtime/updates.js";
 import { compareVersions } from "../runtime/versions.js";
 import { parseManualUsage } from "../adapters/manual.js";
+import { adapters } from "../adapters/index.js";
 import { upsertQuota } from "../store/quotas.js";
 import { createCoordinator, ServiceClosing, } from "../runtime/poll.js";
 import { classifyFailure } from "../diagnostics/failure.js";
 import { validateDisplayName } from "../advisory/validation.js";
 import { providerIdentity } from "../advisory/provider-names.js";
-import { setProviderNameOverride } from "../config.js";
+import { setProviderNameOverride, setProviderEnabled } from "../config.js";
 import { ensureCatalogs, catalogProviders, CATALOG_FAIL_COOLDOWN_MS } from "../catalog/index.js";
 import { getAllLatest } from "../store/quotas.js";
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
@@ -91,6 +92,7 @@ export function testCtx(db, overrides) {
         coordinator: createCoordinator({ db, enabledProviders: [] }),
         enabledProviders: [],
         providerNames: {},
+        detectedProviders: [],
         version: "test",
         exec: "test",
         ingestEnabled: false,
@@ -119,6 +121,7 @@ function snapshotOf(ctx) {
                 upToDate: !cache || compareVersions(cache.latest, ctx.version) <= 0,
                 checkedAt: cache?.checkedAt ?? null,
             },
+            detectedProviders: ctx.detectedProviders ?? [],
         },
     });
 }
@@ -363,6 +366,39 @@ export function buildApp(ctx) {
             override: validatedName,
         };
     });
+    // Enable/disable a provider. Token-gated like refresh. Consent is recorded
+    // protocol-level for the one provider whose key QuotaCap reads. The
+    // coordinator's enabled set is a start-time snapshot, so the response
+    // tells every caller a restart applies it — no live mutation.
+    app.post("/api/providers/:id/enabled", async (req, reply) => {
+        const headerToken = req.headers["x-quotacap-token"];
+        if (!isValidToken(headerToken, ctx.token)) {
+            return reply.status(401).send({ error: "unauthorized: missing or invalid X-QuotaCap-Token header" });
+        }
+        const { id } = req.params;
+        if (typeof id !== "string" || !id || !Object.hasOwn(adapters, id) || id === "manual") {
+            return reply.status(400).send({ error: `unknown provider id: ${id}` });
+        }
+        const body = (req.body ?? {});
+        if (typeof body !== "object" || body === null || typeof body.enabled !== "boolean") {
+            return reply.status(400).send({ error: "invalid-argument: body must contain enabled: boolean" });
+        }
+        const enabling = body.enabled === true;
+        if (id === "opencode-go" && enabling && body.consent !== true) {
+            return reply.status(400).send({ error: "consent required: enabling opencode-go requires consent: true" });
+        }
+        if (ctx.configPath) {
+            try {
+                await setProviderEnabled(id, enabling, ctx.configPath);
+            }
+            catch (err) {
+                return reply.status(500).send({
+                    error: `failed to persist configuration: ${err?.message ?? String(err)}`,
+                });
+            }
+        }
+        return { ok: true, id, enabled: enabling, restartRequired: true };
+    });
     // Graceful-stop request for CLI-driven takeovers. The endpoint restarts
     // nothing by itself: it responds 202, then the service follows its normal
     // SIGTERM path while the CLI spawns the successor after the port releases.

package/dist/runtime/service.js

@@ -16,6 +16,7 @@ import { buildApp } from "../http/server.js";
 import { detectChannel, refreshUpdateCache } from "./updates.js";
 import { VERSION } from "../version.js";
 import { claudeAdapter } from "../adapters/claude.js";
+import { opencodeGoDetected } from "../adapters/opencode-go.js";
 import { classifyFailure } from "../diagnostics/failure.js";
 import { ensureCatalogs, catalogProviders } from "../catalog/index.js";
 export function resolveClaudeExecPath() {
@@ -198,6 +199,7 @@ export async function startService(opts) {
             token,
             coordinator,
             enabledProviders: config.enabledProviders,
+            detectedProviders: opencodeGoDetected() ? ["opencode-go"] : [],
             providerNames: config.providerNames,
             catalogTtlHours: config.catalogTtlHours,
             version: VERSION,

package/dist/version.js

@@ -1,2 +1,2 @@
 // generated by scripts/build-embed.mjs — do not edit
-export const VERSION = "0.0.37";
+export const VERSION = "0.0.38";