quotacap 0.0.37 → 0.0.39

package/dist/http/server.js

@@ -10,12 +10,13 @@ import { validateTask } from "../advisory/validate.js";
 import { readUpdateCache } from "../runtime/updates.js";
 import { compareVersions } from "../runtime/versions.js";
 import { parseManualUsage } from "../adapters/manual.js";
+import { adapters } from "../adapters/index.js";
 import { upsertQuota } from "../store/quotas.js";
 import { createCoordinator, ServiceClosing, } from "../runtime/poll.js";
 import { classifyFailure } from "../diagnostics/failure.js";
 import { validateDisplayName } from "../advisory/validation.js";
 import { providerIdentity } from "../advisory/provider-names.js";
-import { setProviderNameOverride } from "../config.js";
+import { setProviderNameOverride, setProviderEnabled } from "../config.js";
 import { ensureCatalogs, catalogProviders, CATALOG_FAIL_COOLDOWN_MS } from "../catalog/index.js";
 import { getAllLatest } from "../store/quotas.js";
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
@@ -91,6 +92,7 @@ export function testCtx(db, overrides) {
         coordinator: createCoordinator({ db, enabledProviders: [] }),
         enabledProviders: [],
         providerNames: {},
+        detectedProviders: [],
         version: "test",
         exec: "test",
         ingestEnabled: false,
@@ -119,6 +121,7 @@ function snapshotOf(ctx) {
                 upToDate: !cache || compareVersions(cache.latest, ctx.version) <= 0,
                 checkedAt: cache?.checkedAt ?? null,
             },
+            detectedProviders: ctx.detectedProviders ?? [],
         },
     });
 }
@@ -363,6 +366,39 @@ export function buildApp(ctx) {
             override: validatedName,
         };
     });
+    // Enable/disable a provider. Token-gated like refresh. Consent is recorded
+    // protocol-level for the one provider whose key QuotaCap reads. The
+    // coordinator's enabled set is a start-time snapshot, so the response
+    // tells every caller a restart applies it — no live mutation.
+    app.post("/api/providers/:id/enabled", async (req, reply) => {
+        const headerToken = req.headers["x-quotacap-token"];
+        if (!isValidToken(headerToken, ctx.token)) {
+            return reply.status(401).send({ error: "unauthorized: missing or invalid X-QuotaCap-Token header" });
+        }
+        const { id } = req.params;
+        if (typeof id !== "string" || !id || !Object.hasOwn(adapters, id) || id === "manual") {
+            return reply.status(400).send({ error: `unknown provider id: ${id}` });
+        }
+        const body = (req.body ?? {});
+        if (typeof body !== "object" || body === null || typeof body.enabled !== "boolean") {
+            return reply.status(400).send({ error: "invalid-argument: body must contain enabled: boolean" });
+        }
+        const enabling = body.enabled === true;
+        if (id === "opencode-go" && enabling && body.consent !== true) {
+            return reply.status(400).send({ error: "consent required: enabling opencode-go requires consent: true" });
+        }
+        if (ctx.configPath) {
+            try {
+                await setProviderEnabled(id, enabling, ctx.configPath);
+            }
+            catch (err) {
+                return reply.status(500).send({
+                    error: `failed to persist configuration: ${err?.message ?? String(err)}`,
+                });
+            }
+        }
+        return { ok: true, id, enabled: enabling, restartRequired: true };
+    });
     // Graceful-stop request for CLI-driven takeovers. The endpoint restarts
     // nothing by itself: it responds 202, then the service follows its normal
     // SIGTERM path while the CLI spawns the successor after the port releases.

package/dist/runtime/service.js

@@ -16,6 +16,7 @@ import { buildApp } from "../http/server.js";
 import { detectChannel, refreshUpdateCache } from "./updates.js";
 import { VERSION } from "../version.js";
 import { claudeAdapter } from "../adapters/claude.js";
+import { opencodeGoDetected } from "../adapters/opencode-go.js";
 import { classifyFailure } from "../diagnostics/failure.js";
 import { ensureCatalogs, catalogProviders } from "../catalog/index.js";
 export function resolveClaudeExecPath() {
@@ -198,6 +199,7 @@ export async function startService(opts) {
             token,
             coordinator,
             enabledProviders: config.enabledProviders,
+            detectedProviders: opencodeGoDetected() ? ["opencode-go"] : [],
             providerNames: config.providerNames,
             catalogTtlHours: config.catalogTtlHours,
             version: VERSION,

package/dist/version.js

@@ -1,2 +1,2 @@
 // generated by scripts/build-embed.mjs — do not edit
-export const VERSION = "0.0.37";
+export const VERSION = "0.0.39";

package/dist/web/src/App.js

@@ -2,7 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-run
 import { useCallback, useEffect, useState } from "react";
 import { createRoot } from "react-dom/client";
 import "./theme.css";
-import { daemonEndpoint, loadState, triggerRefresh, StateHttpError, StateNetworkError, } from "./api.js";
+import { daemonEndpoint, loadState, triggerRefresh, setProviderEnabled, StateHttpError, StateNetworkError, } from "./api.js";
 import { ageLabel, firstRun, toViewModel } from "./state.js";
 import { Recommendation } from "./components/Recommendation.js";
 import { SubscriptionList } from "./components/SubscriptionList.js";
@@ -14,6 +14,7 @@ import { navigate, routeFor, useRoute } from "./router.js";
 import { Onboarding } from "./pages/Onboarding.js";
 import { Header } from "./components/Header.js";
 import { FaultBanner } from "./components/FaultBanner.js";
+import { ConsentModal, OpencodeGoBanner, showOpenCodeGoBanner } from "./components/OpencodeGoBanner.js";
 import { SiteFooter } from "./components/PacingLegend.js";
 function UnavailablePanel({ endpoint, lastGood, onRetry, }) {
     return (_jsxs("div", { "data-testid": "state-unavailable", role: "alert", children: [_jsx("h2", { children: "Service unavailable" }), _jsxs("p", { children: ["The QuotaCap daemon did not answer at ", _jsx("code", { children: endpoint }), ". Start it with", " ", _jsx("code", { children: "quotacap daemon" }), ", then retry."] }), _jsx("button", { type: "button", onClick: onRetry, children: "Retry" }), lastGood && _jsxs("p", { children: ["Showing last readings (", ageLabel(lastGood.asOf), ")."] })] }));
@@ -34,6 +35,9 @@ function App() {
     const [selectedProvider, setSelectedProvider] = useState(null);
     const [adviceOpen, setAdviceOpen] = useState(false);
     const [settingsOpen, setSettingsOpen] = useState(false);
+    const [consentOpen, setConsentOpen] = useState(false);
+    const [consentBusy, setConsentBusy] = useState(false);
+    const [goSuppressed, setGoSuppressed] = useState(false);
     const route = useRoute();
     const target = snapshot ? routeFor(route, firstRun(snapshot)) : null;
     useEffect(() => {
@@ -98,6 +102,23 @@ function App() {
             setRefreshing(false);
         }
     }, [load]);
+    const handleSetProviderEnabled = (id, enabled) => {
+        if (id === "opencode-go" && enabled) {
+            setConsentOpen(true);
+            return;
+        }
+        void (async () => {
+            try {
+                await setProviderEnabled(id, enabled);
+                if (!enabled)
+                    setGoSuppressed(false);
+                setNotice(`${id === "opencode-go" ? "OpenCode Go" : id} ${enabled ? "enabled" : "disabled"} — restart the daemon to apply it.`);
+            }
+            catch (e) {
+                setNotice(`Could not update ${id}: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        })();
+    };
     const setupMode = target === "/setup";
     const pollErrorText = error
         ? error.kind === "http-error"
@@ -106,7 +127,21 @@ function App() {
         : null;
     const header = (_jsx(Header, { runtime: snapshot?.runtime ?? null, unreachable: error?.kind === "service-unavailable", refreshing: refreshing, onRefresh: () => void refresh(), onSettings: () => setSettingsOpen(true) }));
     if (snapshot && setupMode) {
-        return (_jsxs(_Fragment, { children: [header, _jsx("main", { children: _jsx(Onboarding, { snapshot: snapshot, onFirstPoll: () => void refresh(), polling: refreshing, pollError: pollErrorText }) }), _jsx(SettingsDrawer, { open: settingsOpen, providers: snapshot.providers, onRefresh: () => void refresh(), refreshing: refreshing, onClose: () => setSettingsOpen(false) }), _jsx(SiteFooter, { version: snapshot.runtime.version })] }));
+        return (_jsxs(_Fragment, { children: [header, _jsxs("main", { children: [notice && (_jsx("div", { "data-testid": "refresh-notice", role: "status", children: notice })), showOpenCodeGoBanner(snapshot.runtime, snapshot.providers, goSuppressed) && (_jsx(OpencodeGoBanner, { onEnable: () => setConsentOpen(true) })), _jsx(Onboarding, { snapshot: snapshot, onFirstPoll: () => void refresh(), polling: refreshing, pollError: pollErrorText })] }), _jsx(SettingsDrawer, { open: settingsOpen, providers: snapshot.providers, onRefresh: () => void refresh(), refreshing: refreshing, onSetProviderEnabled: handleSetProviderEnabled, onClose: () => setSettingsOpen(false) }), consentOpen && (_jsx(ConsentModal, { busy: consentBusy, onCancel: () => setConsentOpen(false), onConfirm: () => void (async () => {
+                        setConsentBusy(true);
+                        try {
+                            await setProviderEnabled("opencode-go", true, true);
+                            setGoSuppressed(true);
+                            setConsentOpen(false);
+                            setNotice("OpenCode Go enabled — restart the daemon to apply it.");
+                        }
+                        catch (e) {
+                            setNotice(`Could not enable OpenCode Go: ${e instanceof Error ? e.message : String(e)}`);
+                        }
+                        finally {
+                            setConsentBusy(false);
+                        }
+                    })() })), _jsx(SiteFooter, { version: snapshot.runtime.version })] }));
     }
     return (_jsxs(_Fragment, { children: [header, _jsxs("main", { children: [notice && (_jsx("div", { "data-testid": "refresh-notice", role: "status", children: notice })), loading && !snapshot && (_jsx("div", { "data-testid": "state-loading", "aria-busy": "true", "aria-label": "Loading quota state", children: [0, 1, 2].map((i) => (_jsx("div", { "aria-hidden": "true", className: "skel", style: {
                                 height: 64,
@@ -114,13 +149,27 @@ function App() {
                                 border: i === 0 ? "1px solid var(--rec)" : "1px solid var(--line)",
                                 borderRadius: 8,
                                 marginBottom: 8,
-                            } }, i))) })), error?.kind === "service-unavailable" && !snapshot && (_jsx(UnavailablePanel, { endpoint: daemonEndpoint(), lastGood: snapshot, onRetry: () => void load() })), error?.kind === "http-error" && !snapshot && (_jsx(HttpErrorPanel, { status: error.status, message: error.message, lastGood: snapshot, onRetry: () => void load() })), error && snapshot && (_jsxs("div", { "data-testid": "state-stale-error", role: "alert", children: [error.kind === "http-error" ? `Request failed (HTTP ${error.status}): ` : "Service unavailable: ", error.message, " Showing last readings (", ageLabel(snapshot.asOf), ").", " ", _jsx("button", { type: "button", onClick: () => void load(), children: "Retry" })] })), snapshot && (_jsx(FaultBanner, { providers: snapshot.providers, onRepoll: () => void refresh(), repolling: refreshing, polling: snapshot.runtime.polling })), snapshot && (_jsx(ReadyView, { snapshot: snapshot, onSelectProvider: (id) => {
+                            } }, i))) })), error?.kind === "service-unavailable" && !snapshot && (_jsx(UnavailablePanel, { endpoint: daemonEndpoint(), lastGood: snapshot, onRetry: () => void load() })), error?.kind === "http-error" && !snapshot && (_jsx(HttpErrorPanel, { status: error.status, message: error.message, lastGood: snapshot, onRetry: () => void load() })), error && snapshot && (_jsxs("div", { "data-testid": "state-stale-error", role: "alert", children: [error.kind === "http-error" ? `Request failed (HTTP ${error.status}): ` : "Service unavailable: ", error.message, " Showing last readings (", ageLabel(snapshot.asOf), ").", " ", _jsx("button", { type: "button", onClick: () => void load(), children: "Retry" })] })), snapshot && (_jsx(FaultBanner, { providers: snapshot.providers, onRepoll: () => void refresh(), repolling: refreshing, polling: snapshot.runtime.polling })), snapshot && showOpenCodeGoBanner(snapshot.runtime, snapshot.providers, goSuppressed) && (_jsx(OpencodeGoBanner, { onEnable: () => setConsentOpen(true) })), snapshot && (_jsx(ReadyView, { snapshot: snapshot, onSelectProvider: (id) => {
                             setAdviceOpen(false);
                             setSelectedProvider(id);
                         }, onViewAdvice: () => {
                             setSelectedProvider(null);
                             setAdviceOpen(true);
-                        } }))] }), _jsx(ProviderDrawer, { provider: snapshot?.providers.find((p) => p.id === selectedProvider) ?? null, asOf: snapshot?.asOf ?? "", recommendation: snapshot?.recommendation ?? null, onClose: () => setSelectedProvider(null), onRenamed: () => void load() }), snapshot && (_jsx(AdviceDrawer, { open: adviceOpen, recommendation: snapshot.recommendation, providers: snapshot.providers, asOf: snapshot.asOf, onClose: () => setAdviceOpen(false) })), _jsx(SettingsDrawer, { open: settingsOpen, providers: snapshot?.providers ?? [], onRefresh: () => void refresh(), refreshing: refreshing, onClose: () => setSettingsOpen(false) }), _jsx(SiteFooter, { version: snapshot?.runtime.version })] }));
+                        } }))] }), _jsx(ProviderDrawer, { provider: snapshot?.providers.find((p) => p.id === selectedProvider) ?? null, asOf: snapshot?.asOf ?? "", recommendation: snapshot?.recommendation ?? null, onClose: () => setSelectedProvider(null), onRenamed: () => void load() }), consentOpen && (_jsx(ConsentModal, { busy: consentBusy, onCancel: () => setConsentOpen(false), onConfirm: () => void (async () => {
+                    setConsentBusy(true);
+                    try {
+                        await setProviderEnabled("opencode-go", true, true);
+                        setGoSuppressed(true);
+                        setConsentOpen(false);
+                        setNotice("OpenCode Go enabled — restart the daemon to apply it.");
+                    }
+                    catch (e) {
+                        setNotice(`Could not enable OpenCode Go: ${e instanceof Error ? e.message : String(e)}`);
+                    }
+                    finally {
+                        setConsentBusy(false);
+                    }
+                })() })), snapshot && (_jsx(AdviceDrawer, { open: adviceOpen, recommendation: snapshot.recommendation, providers: snapshot.providers, asOf: snapshot.asOf, onClose: () => setAdviceOpen(false) })), _jsx(SettingsDrawer, { open: settingsOpen, providers: snapshot?.providers ?? [], onRefresh: () => void refresh(), refreshing: refreshing, onSetProviderEnabled: handleSetProviderEnabled, onClose: () => setSettingsOpen(false) }), _jsx(SiteFooter, { version: snapshot?.runtime.version })] }));
 }
 const el = typeof document === "undefined" ? null : document.getElementById("app");
 if (el)

package/dist/web/src/api.d.ts

@@ -27,3 +27,5 @@ export declare function refreshMessage(body: unknown): string | null;
 export declare function triggerRefresh(): Promise<RefreshResult>;
 /** Rename provider or restore built-in default with null. */
 export declare function renameProvider(id: string, displayName: string | null): Promise<void>;
+/** Enable or disable a provider. Consent is required by the server for opencode-go. */
+export declare function setProviderEnabled(id: string, enabled: boolean, consent?: boolean): Promise<void>;

package/dist/web/src/api.js

@@ -122,3 +122,23 @@ export async function renameProvider(id, displayName) {
     if (!r.ok)
         throw new StateHttpError(r.status, await serverMessage(r));
 }
+/** Enable or disable a provider. Consent is required by the server for opencode-go. */
+export async function setProviderEnabled(id, enabled, consent) {
+    const token = await fetchToken();
+    let r;
+    try {
+        r = await fetch(`/api/providers/${encodeURIComponent(id)}/enabled`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "X-QuotaCap-Token": token,
+            },
+            body: JSON.stringify(consent === undefined ? { enabled } : { enabled, consent }),
+        });
+    }
+    catch (e) {
+        throw new StateNetworkError(`/api/providers/${id}/enabled`, e);
+    }
+    if (!r.ok)
+        throw new StateHttpError(r.status, await serverMessage(r));
+}

package/dist/web/src/components/FaultBanner.d.ts

@@ -5,7 +5,8 @@ export interface Repair {
 }
 /**
  * Repair routing per excluded provider. Auth failures point at signing into
- * the provider CLI (QuotaCap never handles those credentials); every other
+ * the provider CLI (by default QuotaCap never reads credentials; the only
+ * exception is OpenCode Go, which the user enables explicitly); every other
  * exclusion points at a re-poll. Service start/install is covered by the
  * service-unavailable panel when the daemon itself is down.
  */

package/dist/web/src/components/FaultBanner.js

@@ -3,15 +3,21 @@ import { ageDuration } from "../state.js";
 import { failureWords } from "./ProviderDrawer.js";
 /**
  * Repair routing per excluded provider. Auth failures point at signing into
- * the provider CLI (QuotaCap never handles those credentials); every other
+ * the provider CLI (by default QuotaCap never reads credentials; the only
+ * exception is OpenCode Go, which the user enables explicitly); every other
  * exclusion points at a re-poll. Service start/install is covered by the
  * service-unavailable panel when the daemon itself is down.
  */
 export function repairFor(provider) {
     const name = provider.displayName;
     if (provider.lastAttempt?.failureCategory === "auth") {
+        if (provider.id === "opencode-go") {
+            return {
+                text: "Run `opencode auth login -p opencode-go`, then re-poll. QuotaCap reads that key only because you enabled OpenCode Go — `quotacap providers disable opencode-go` stops it.",
+            };
+        }
         return {
-            text: `Sign in to the ${name} CLI, then re-poll. QuotaCap never handles those credentials.`,
+            text: `Sign in to the ${name} CLI, then re-poll. By default QuotaCap never reads credentials; the only exception is OpenCode Go, which you enable explicitly.`,
         };
     }
     switch (provider.exclusionReason) {

package/dist/web/src/components/OpencodeGoBanner.d.ts

@@ -0,0 +1,12 @@
+import React from "react";
+import type { ProviderView, RuntimeView } from "../state.js";
+export declare const OPENCODE_GO_CONSENT_COPY = "QuotaCap will read the API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` \u2192 `opencode` fallback). It is read in-memory, read-only once per poll (every 15 minutes by default). It is sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`. It is never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`). Revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling. If you prefer no file access, set `OPENCODE_API_KEY` instead.";
+export declare function showOpenCodeGoBanner(runtime: Pick<RuntimeView, "detectedProviders"> | undefined, providers: Array<Pick<ProviderView, "id" | "enabled">>, suppressed: boolean): boolean;
+export declare function OpencodeGoBanner({ onEnable }: {
+    onEnable: () => void;
+}): React.JSX.Element;
+export declare function ConsentModal({ onConfirm, onCancel, busy, }: {
+    onConfirm: () => void;
+    onCancel: () => void;
+    busy?: boolean;
+}): React.JSX.Element;

package/dist/web/src/components/OpencodeGoBanner.js

@@ -0,0 +1,36 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect } from "react";
+export const OPENCODE_GO_CONSENT_COPY = "QuotaCap will read the API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback). It is read in-memory, read-only once per poll (every 15 minutes by default). It is sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`. It is never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`). Revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling. If you prefer no file access, set `OPENCODE_API_KEY` instead.";
+export function showOpenCodeGoBanner(runtime, providers, suppressed) {
+    const detected = runtime?.detectedProviders?.includes("opencode-go") ?? false;
+    const row = providers.find((p) => p.id === "opencode-go");
+    return detected && !row?.enabled && !suppressed;
+}
+export function OpencodeGoBanner({ onEnable }) {
+    return (_jsxs("div", { "data-testid": "opencode-go-banner", role: "status", className: "alert", children: [_jsxs("span", { children: [_jsx("strong", { children: "OpenCode Go detected." }), " Enable to track 5h/weekly usage? The API key stays with OpenCode until you enable tracking."] }), _jsx("button", { type: "button", className: "linkbtn", onClick: onEnable, style: { flex: "none", marginLeft: "auto" }, children: "Enable OpenCode Go" })] }));
+}
+export function ConsentModal({ onConfirm, onCancel, busy, }) {
+    useEffect(() => {
+        const onKey = (e) => {
+            if (e.key === "Escape")
+                onCancel();
+        };
+        window.addEventListener("keydown", onKey);
+        return () => window.removeEventListener("keydown", onKey);
+    }, [onCancel]);
+    return (_jsx("div", { role: "presentation", style: {
+            position: "fixed",
+            inset: 0,
+            display: "grid",
+            placeItems: "center",
+            background: "var(--scrim, rgba(0,0,0,0.5))",
+            zIndex: 60,
+        }, children: _jsxs("div", { role: "dialog", "aria-modal": "true", "aria-labelledby": "opencode-go-consent-title", style: {
+                background: "var(--surface)",
+                border: "1px solid var(--line)",
+                borderRadius: "var(--r-md)",
+                padding: "var(--s4) var(--s5)",
+                maxWidth: 560,
+                margin: "var(--s4)",
+            }, children: [_jsx("h2", { id: "opencode-go-consent-title", style: { fontSize: "var(--t-4)", margin: "0 0 var(--s3)" }, children: "Enable OpenCode Go?" }), _jsx("p", { style: { fontSize: "var(--t-2)", color: "var(--ink-soft)", margin: "0 0 var(--s4)" }, children: OPENCODE_GO_CONSENT_COPY }), _jsxs("div", { style: { display: "flex", justifyContent: "flex-end", gap: "var(--s2)" }, children: [_jsx("button", { type: "button", className: "btn btn-quiet", onClick: onCancel, disabled: busy, children: "Cancel" }), _jsx("button", { type: "button", className: "btn btn-primary", onClick: onConfirm, disabled: busy, children: busy ? "Enabling…" : "Enable" })] })] }) }));
+}

package/dist/web/src/components/ProviderDrawer.js

@@ -109,6 +109,9 @@ export function paceBasis(provider, asOfMs) {
 }
 export function credentialLabel(provider) {
     const source = provider.quota?.source;
+    if (provider.id === "opencode-go" && source === "api") {
+        return "read in-memory from OpenCode auth (opt-in), never stored";
+    }
     if (source === "cli" || source === "tui")
         return `handled by ${provider.displayName}`;
     return "not stored by QuotaCap";

package/dist/web/src/components/settings/ProvidersPanel.d.ts

@@ -7,8 +7,9 @@ export declare function connectionBadge(provider: ProviderView): string;
 export type SettingsStatus = "Ready" | "Stale" | "Failed" | "Invalid" | "Reset passed" | "Not reporting";
 /** Short status from server exclusion and attempt fields. */
 export declare function providerStatus(provider: ProviderView): SettingsStatus;
-export declare function ProvidersPanel({ providers, onRefresh, refreshing, }: {
+export declare function ProvidersPanel({ providers, onRefresh, refreshing, onSetProviderEnabled, }: {
     providers: ProviderView[];
     onRefresh: () => void;
     refreshing: boolean;
+    onSetProviderEnabled?: (id: string, enabled: boolean) => void;
 }): React.JSX.Element;

package/dist/web/src/components/settings/ProvidersPanel.js

@@ -12,6 +12,8 @@ const CONNECTION_NAMES = new Map([
     ["grok", "Grok"],
     ["agy", "Antigravity"],
     ["agy:3p", "Antigravity 3P"],
+    ["muse", "Muse Code"],
+    ["opencode-go", "OpenCode Go"],
 ]);
 export function connectionName(id) {
     return CONNECTION_NAMES.get(id) ?? id;
@@ -38,7 +40,7 @@ export function providerStatus(provider) {
             return provider.lastAttempt && !provider.lastAttempt.success ? "Failed" : "Ready";
     }
 }
-export function ProvidersPanel({ providers, onRefresh, refreshing, }) {
+export function ProvidersPanel({ providers, onRefresh, refreshing, onSetProviderEnabled, }) {
     const listed = adapterProviders(providers);
     return (_jsxs("div", { children: [_jsxs("div", { style: { display: "flex", justifyContent: "space-between", alignItems: "center", marginBottom: "var(--s3)" }, children: [_jsx("h3", { style: { fontSize: "var(--t-3)", fontWeight: 700, margin: 0 }, children: "Active Tool Connections" }), _jsx("button", { type: "button", className: "btn btn-quiet", onClick: onRefresh, disabled: refreshing, style: { fontSize: "var(--t-1)", padding: "4px 8px" }, children: refreshing ? "Polling…" : "Re-poll adapters" })] }), _jsx("div", { style: {
                     border: "1px solid var(--line)",
@@ -55,14 +57,14 @@ export function ProvidersPanel({ providers, onRefresh, refreshing, }) {
                             display: "flex",
                             justifyContent: "space-between",
                             alignItems: "center",
-                        }, children: [_jsxs("div", { children: [_jsx("b", { style: { fontSize: "var(--t-3)" }, children: connectionName(p.id) }), _jsx("span", { style: { display: "block", fontSize: "var(--t-1)", color: "var(--ink-soft)" }, children: sourceLabel(p.quota?.source) })] }), _jsx("span", { className: isReady ? "st-ready" : "st-todo", style: {
-                                    fontSize: "var(--t-1)",
-                                    padding: "2px 8px",
-                                    borderRadius: 999,
-                                    background: isReady ? "var(--good-soft)" : "var(--warn-soft)",
-                                    border: `1px solid ${isReady ? "var(--good)" : "var(--warn)"}`,
-                                    color: isReady ? "var(--good)" : "var(--warn)",
-                                    fontWeight: 600,
-                                }, children: connectionBadge(p) })] }, p.id));
+                        }, children: [_jsxs("div", { children: [_jsx("b", { style: { fontSize: "var(--t-3)" }, children: connectionName(p.id) }), _jsx("span", { style: { display: "block", fontSize: "var(--t-1)", color: "var(--ink-soft)" }, children: sourceLabel(p.quota?.source) })] }), _jsxs("div", { style: { display: "flex", alignItems: "center", flex: "none" }, children: [_jsx("span", { className: isReady ? "st-ready" : "st-todo", style: {
+                                            fontSize: "var(--t-1)",
+                                            padding: "2px 8px",
+                                            borderRadius: 999,
+                                            background: isReady ? "var(--good-soft)" : "var(--warn-soft)",
+                                            border: `1px solid ${isReady ? "var(--good)" : "var(--warn)"}`,
+                                            color: isReady ? "var(--good)" : "var(--warn)",
+                                            fontWeight: 600,
+                                        }, children: connectionBadge(p) }), onSetProviderEnabled && p.id !== "agy:3p" && (_jsx("button", { type: "button", className: "btn btn-quiet", "aria-label": `${p.enabled ? "Disable" : "Enable"} ${connectionName(p.id)}`, onClick: () => onSetProviderEnabled(p.id, !p.enabled), disabled: refreshing, style: { fontSize: "var(--t-1)", padding: "4px 8px", flex: "none", marginLeft: "8px" }, children: p.enabled ? "Disable" : "Enable" }))] })] }, p.id));
                 }) })] }));
 }

package/dist/web/src/components/settings/SettingsDrawer.d.ts

@@ -1,9 +1,10 @@
 import React from "react";
 import type { ProviderView } from "../../state.js";
-export declare function SettingsDrawer({ open, providers, onRefresh, refreshing, onClose, }: {
+export declare function SettingsDrawer({ open, providers, onRefresh, refreshing, onSetProviderEnabled, onClose, }: {
     open: boolean;
     providers: ProviderView[];
     onRefresh: () => void;
     refreshing: boolean;
+    onSetProviderEnabled?: (id: string, enabled: boolean) => void;
     onClose: () => void;
 }): React.JSX.Element | null;

package/dist/web/src/components/settings/SettingsDrawer.js

@@ -8,7 +8,7 @@ const TABS = [
     { id: "cli", label: "CLI & Shell" },
     { id: "daemon", label: "Daemon" },
 ];
-export function SettingsDrawer({ open, providers, onRefresh, refreshing, onClose, }) {
+export function SettingsDrawer({ open, providers, onRefresh, refreshing, onSetProviderEnabled, onClose, }) {
     const [tab, setTab] = useState("providers");
     const dialogRef = useRef(null);
     const previouslyFocused = useRef(null);
@@ -51,5 +51,5 @@ export function SettingsDrawer({ open, providers, onRefresh, refreshing, onClose
     if (!open)
         return null;
     const titleId = "settings-drawer-title";
-    return (_jsxs(_Fragment, { children: [_jsx("div", { "data-testid": "settings-scrim", className: "scrim is-open", "aria-hidden": "true", onClick: onClose }), _jsxs("aside", { ref: dialogRef, tabIndex: -1, "data-testid": "settings-drawer", role: "dialog", "aria-modal": "true", "aria-labelledby": titleId, className: "drawer is-open", style: { width: "min(580px, 100vw)" }, onClick: (e) => e.stopPropagation(), children: [_jsxs("div", { className: "drawer-head", children: [_jsxs("div", { style: { flex: 1 }, children: [_jsx("h2", { id: titleId, style: { margin: "0 0 2px" }, children: "Settings & Configuration" }), _jsx("span", { className: "sub", children: "Connected provider adapters and CLI prompt integration." })] }), _jsx("button", { className: "drawer-close", type: "button", "aria-label": "Close settings", onClick: onClose, children: _jsx("svg", { width: "16", height: "16", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2.4", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M6 6l12 12M18 6L6 18" }) }) })] }), _jsx("div", { className: "seg", role: "tablist", "aria-label": "Settings sections", style: { margin: "var(--s4) var(--s5) 0", display: "flex", height: 32 }, children: TABS.map((t) => (_jsx("button", { type: "button", role: "tab", className: `settings-tab${tab === t.id ? " is-active" : ""}`, "aria-selected": tab === t.id, onClick: () => setTab(t.id), style: { flex: 1, justifyContent: "center" }, children: t.label }, t.id))) }), _jsxs("div", { role: "tabpanel", style: { padding: "var(--s4) var(--s5) var(--s6)", overflowY: "auto" }, children: [tab === "providers" && (_jsx(ProvidersPanel, { providers: providers, onRefresh: onRefresh, refreshing: refreshing })), tab === "cli" && _jsx(CliIntegrationPanel, {}), tab === "daemon" && _jsx(DaemonPanel, {})] })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsx("div", { "data-testid": "settings-scrim", className: "scrim is-open", "aria-hidden": "true", onClick: onClose }), _jsxs("aside", { ref: dialogRef, tabIndex: -1, "data-testid": "settings-drawer", role: "dialog", "aria-modal": "true", "aria-labelledby": titleId, className: "drawer is-open", style: { width: "min(580px, 100vw)" }, onClick: (e) => e.stopPropagation(), children: [_jsxs("div", { className: "drawer-head", children: [_jsxs("div", { style: { flex: 1 }, children: [_jsx("h2", { id: titleId, style: { margin: "0 0 2px" }, children: "Settings & Configuration" }), _jsx("span", { className: "sub", children: "Connected provider adapters and CLI prompt integration." })] }), _jsx("button", { className: "drawer-close", type: "button", "aria-label": "Close settings", onClick: onClose, children: _jsx("svg", { width: "16", height: "16", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: "2.4", strokeLinecap: "round", "aria-hidden": "true", children: _jsx("path", { d: "M6 6l12 12M18 6L6 18" }) }) })] }), _jsx("div", { className: "seg", role: "tablist", "aria-label": "Settings sections", style: { margin: "var(--s4) var(--s5) 0", display: "flex", height: 32 }, children: TABS.map((t) => (_jsx("button", { type: "button", role: "tab", className: `settings-tab${tab === t.id ? " is-active" : ""}`, "aria-selected": tab === t.id, onClick: () => setTab(t.id), style: { flex: 1, justifyContent: "center" }, children: t.label }, t.id))) }), _jsxs("div", { role: "tabpanel", style: { padding: "var(--s4) var(--s5) var(--s6)", overflowY: "auto" }, children: [tab === "providers" && (_jsx(ProvidersPanel, { providers: providers, onRefresh: onRefresh, refreshing: refreshing, onSetProviderEnabled: onSetProviderEnabled })), tab === "cli" && _jsx(CliIntegrationPanel, {}), tab === "daemon" && _jsx(DaemonPanel, {})] })] })] }));
 }

package/dist/web/src/pages/Onboarding.js

@@ -17,7 +17,7 @@ export function readiness(provider) {
     if (provider.lastAttempt?.success && provider.lastAttempt.succeededAt) {
         return { status: "Ready", detail: "Connected — no readings yet." };
     }
-    const credentialNote = "QuotaCap never handles those credentials.";
+    const credentialNote = "By default QuotaCap never reads credentials; the only exception is OpenCode Go, which you enable explicitly.";
     if (provider.harness === null) {
         return {
             status: "Sign in first",
@@ -91,5 +91,5 @@ export function Onboarding({ snapshot, onFirstPoll, polling, pollError, }) {
                     letterSpacing: "-0.024em",
                     margin: "0 0 var(--s5)",
                     fontWeight: 700,
-                }, children: "Connect the subscriptions you already use" }), _jsxs("div", { className: "setup", children: [_jsxs("ol", { className: "steps", children: [_jsxs("li", { className: step === 1 ? "is-now" : "", "aria-current": step === 1 ? "step" : undefined, children: [_jsx("span", { className: "num", children: "1" }), _jsxs("span", { children: [_jsx("span", { className: "t", children: "Detect" }), _jsx("span", { className: "d", children: "Find installed coding tools" })] })] }), _jsxs("li", { className: step === 2 ? "is-now" : "", "aria-current": step === 2 ? "step" : undefined, children: [_jsx("span", { className: "num", children: "2" }), _jsxs("span", { children: [_jsx("span", { className: "t", children: "Review" }), _jsx("span", { className: "d", children: "Check what each adapter reads" })] })] }), _jsxs("li", { className: step === 3 ? "is-now" : "", "aria-current": step === 3 ? "step" : undefined, children: [_jsx("span", { className: "num", children: "3" }), _jsxs("span", { children: [_jsx("span", { className: "t", children: "Start" }), _jsx("span", { className: "d", children: "Read current usage once" })] })] })] }), _jsxs("div", { className: "panel", children: [step === 1 && (_jsxs("section", { "data-testid": "setup-step-1", "aria-label": "Step 1: Detect", children: [_jsxs("div", { className: "panel-head", children: [_jsx("p", { className: "eyebrow", children: "Step 1 of 3" }), _jsx("h2", { children: "What the daemon can see" }), _jsx("p", { children: "QuotaCap asked the running daemon what it knows. The dashboard cannot scan this machine from the browser, so anything missing here needs the provider CLI installed and signed in first." }), _jsxs("div", { className: "privacy", children: [_jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", fill: "none", stroke: "var(--good)", strokeWidth: "2.2", style: { flex: "none" }, "aria-hidden": "true", children: [_jsx("path", { d: "M12 3l7 3v5c0 5-3 8-7 10-4-2-7-5-7-10V6z" }), _jsx("path", { d: "M9 12l2 2 4-4" })] }), _jsxs("div", { children: [_jsx("b", { children: "Usage history stays on this machine" }), _jsx("span", { children: "QuotaCap reads quota percentages and reset times only. It never accesses code, prompts, or sensitive files." })] })] })] }), _jsx(ProviderReadinessList, { providers: snapshot.providers }), _jsxs("div", { className: "panel-foot", children: [_jsx("span", { style: { fontSize: "var(--t-2)", color: "var(--ink-soft)" }, children: "You can add, disable, or repair providers at any time." }), _jsx("button", { className: "btn btn-primary", type: "button", onClick: () => setStep(2), children: "Continue to review" })] })] })), step === 2 && (_jsxs("section", { "data-testid": "setup-step-2", "aria-label": "Step 2: Review", children: [_jsxs("div", { className: "panel-head", children: [_jsx("p", { className: "eyebrow", children: "Step 2 of 3" }), _jsx("h2", { children: "Review accounts" }), _jsx("p", { children: "QuotaCap reads usage through your own provider CLIs. It never asks for, stores, or transmits your provider credentials \u2014 sign-in happens in the provider CLI itself, not here." }), _jsxs("div", { className: "privacy", children: [_jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", fill: "none", stroke: "var(--good)", strokeWidth: "2.2", style: { flex: "none" }, "aria-hidden": "true", children: [_jsx("path", { d: "M12 3l7 3v5c0 5-3 8-7 10-4-2-7-5-7-10V6z" }), _jsx("path", { d: "M9 12l2 2 4-4" })] }), _jsxs("div", { children: [_jsx("b", { children: "Zero credential storage" }), _jsx("span", { children: "Authentication stays in official CLI keychains. QuotaCap never handles or persists tokens." })] })] })] }), _jsx(ProviderReadinessList, { providers: snapshot.providers }), _jsxs("div", { className: "panel-foot", children: [_jsx("button", { className: "btn btn-quiet", type: "button", onClick: () => setStep(1), children: "Back" }), _jsx("button", { className: "btn btn-primary", type: "button", onClick: () => setStep(3), children: "Continue to first poll" })] })] })), step === 3 && (_jsxs("section", { "data-testid": "setup-step-3", "aria-label": "Step 3: Start", children: [_jsxs("div", { className: "panel-head", children: [_jsx("p", { className: "eyebrow", children: "Step 3 of 3" }), _jsx("h2", { children: "Take the first readings" }), _jsx("p", { children: "Run the first poll. The daemon will ask each provider CLI for current usage and the dashboard will open when readings land." })] }), _jsx(SamplePreview, {}), _jsxs("div", { className: "panel-foot", children: [_jsx("button", { className: "btn btn-quiet", type: "button", onClick: () => setStep(2), children: "Back" }), _jsx("button", { "data-testid": "setup-poll-button", className: "btn btn-primary", type: "button", onClick: onFirstPoll, disabled: polling, children: polling ? "Polling…" : "Run first poll" })] }), pollError && (_jsxs("div", { "data-testid": "setup-poll-error", className: "alert", role: "alert", style: { margin: "var(--s4) var(--s5)" }, children: [_jsx("span", { children: pollError }), _jsx("button", { className: "btn btn-quiet btn-sm", type: "button", onClick: onFirstPoll, children: "Retry" })] }))] }))] })] })] }));
+                }, children: "Connect the subscriptions you already use" }), _jsxs("div", { className: "setup", children: [_jsxs("ol", { className: "steps", children: [_jsxs("li", { className: step === 1 ? "is-now" : "", "aria-current": step === 1 ? "step" : undefined, children: [_jsx("span", { className: "num", children: "1" }), _jsxs("span", { children: [_jsx("span", { className: "t", children: "Detect" }), _jsx("span", { className: "d", children: "Find installed coding tools" })] })] }), _jsxs("li", { className: step === 2 ? "is-now" : "", "aria-current": step === 2 ? "step" : undefined, children: [_jsx("span", { className: "num", children: "2" }), _jsxs("span", { children: [_jsx("span", { className: "t", children: "Review" }), _jsx("span", { className: "d", children: "Check what each adapter reads" })] })] }), _jsxs("li", { className: step === 3 ? "is-now" : "", "aria-current": step === 3 ? "step" : undefined, children: [_jsx("span", { className: "num", children: "3" }), _jsxs("span", { children: [_jsx("span", { className: "t", children: "Start" }), _jsx("span", { className: "d", children: "Read current usage once" })] })] })] }), _jsxs("div", { className: "panel", children: [step === 1 && (_jsxs("section", { "data-testid": "setup-step-1", "aria-label": "Step 1: Detect", children: [_jsxs("div", { className: "panel-head", children: [_jsx("p", { className: "eyebrow", children: "Step 1 of 3" }), _jsx("h2", { children: "What the daemon can see" }), _jsx("p", { children: "QuotaCap asked the running daemon what it knows. The dashboard cannot scan this machine from the browser, so anything missing here needs the provider CLI installed and signed in first." }), _jsxs("div", { className: "privacy", children: [_jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", fill: "none", stroke: "var(--good)", strokeWidth: "2.2", style: { flex: "none" }, "aria-hidden": "true", children: [_jsx("path", { d: "M12 3l7 3v5c0 5-3 8-7 10-4-2-7-5-7-10V6z" }), _jsx("path", { d: "M9 12l2 2 4-4" })] }), _jsxs("div", { children: [_jsx("b", { children: "Usage history stays on this machine" }), _jsx("span", { children: "QuotaCap reads quota percentages and reset times only. It never accesses code or prompts." })] })] })] }), _jsx(ProviderReadinessList, { providers: snapshot.providers }), _jsxs("div", { className: "panel-foot", children: [_jsx("span", { style: { fontSize: "var(--t-2)", color: "var(--ink-soft)" }, children: "You can add, disable, or repair providers at any time." }), _jsx("button", { className: "btn btn-primary", type: "button", onClick: () => setStep(2), children: "Continue to review" })] })] })), step === 2 && (_jsxs("section", { "data-testid": "setup-step-2", "aria-label": "Step 2: Review", children: [_jsxs("div", { className: "panel-head", children: [_jsx("p", { className: "eyebrow", children: "Step 2 of 3" }), _jsx("h2", { children: "Review accounts" }), _jsx("p", { children: "QuotaCap reads usage through your own provider CLIs. It never asks for, stores, or transmits your provider credentials \u2014 sign-in happens in the provider CLI itself, not here." }), _jsxs("div", { className: "privacy", children: [_jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", fill: "none", stroke: "var(--good)", strokeWidth: "2.2", style: { flex: "none" }, "aria-hidden": "true", children: [_jsx("path", { d: "M12 3l7 3v5c0 5-3 8-7 10-4-2-7-5-7-10V6z" }), _jsx("path", { d: "M9 12l2 2 4-4" })] }), _jsxs("div", { children: [_jsx("b", { children: "Zero credential storage" }), _jsx("span", { children: "Authentication stays in official CLI keychains. QuotaCap never stores tokens, and reads one only if you explicitly enable OpenCode Go." })] })] })] }), _jsx(ProviderReadinessList, { providers: snapshot.providers }), _jsxs("div", { className: "panel-foot", children: [_jsx("button", { className: "btn btn-quiet", type: "button", onClick: () => setStep(1), children: "Back" }), _jsx("button", { className: "btn btn-primary", type: "button", onClick: () => setStep(3), children: "Continue to first poll" })] })] })), step === 3 && (_jsxs("section", { "data-testid": "setup-step-3", "aria-label": "Step 3: Start", children: [_jsxs("div", { className: "panel-head", children: [_jsx("p", { className: "eyebrow", children: "Step 3 of 3" }), _jsx("h2", { children: "Take the first readings" }), _jsx("p", { children: "Run the first poll. The daemon will ask each provider CLI for current usage and the dashboard will open when readings land." })] }), _jsx(SamplePreview, {}), _jsxs("div", { className: "panel-foot", children: [_jsx("button", { className: "btn btn-quiet", type: "button", onClick: () => setStep(2), children: "Back" }), _jsx("button", { "data-testid": "setup-poll-button", className: "btn btn-primary", type: "button", onClick: onFirstPoll, disabled: polling, children: polling ? "Polling…" : "Run first poll" })] }), pollError && (_jsxs("div", { "data-testid": "setup-poll-error", className: "alert", role: "alert", style: { margin: "var(--s4) var(--s5)" }, children: [_jsx("span", { children: pollError }), _jsx("button", { className: "btn btn-quiet btn-sm", type: "button", onClick: onFirstPoll, children: "Retry" })] }))] }))] })] })] }));
 }

package/dist/web/src/state.d.ts

@@ -103,6 +103,7 @@ export interface RuntimeView {
     polling: "idle" | "in-progress" | "cooldown";
     lastCompletedPollAt: string | null;
     version: string;
+    detectedProviders?: string[];
     update?: UpdateView;
 }
 export interface StateSnapshot {
@@ -136,7 +137,8 @@ export declare function displayPlan(plan: string | null | undefined): string | n
 /**
  * Short-window display name ("5h Limit"). Codex, Kimi, and Agy report a 5h limit;
  * Claude (current session) and Muse (current window) report an equivalent 5-hour
- * rolling window. Returns null when the provider reports no short window (grok, manual).
+ * rolling window, as does OpenCode Go. Returns null when the provider reports no
+ * short window (grok, manual).
  */
 export declare function shortWindowLabel(id: string): string | null;
 /** "read Xm ago" from the last good snapshot's server timestamp. */

package/dist/web/src/state.js

@@ -24,7 +24,13 @@ export function toViewModel(s) {
         : [];
     return {
         asOf: s.asOf,
-        runtime: { ...s.runtime },
+        runtime: {
+            ...s.runtime,
+            // A service older than opencode-go support omits this field.
+            detectedProviders: Array.isArray(s.runtime?.detectedProviders)
+                ? [...s.runtime.detectedProviders]
+                : [],
+        },
         providers,
         recommendation: { ...s.recommendation, advisories },
     };
@@ -54,7 +60,8 @@ export function displayPlan(plan) {
 /**
  * Short-window display name ("5h Limit"). Codex, Kimi, and Agy report a 5h limit;
  * Claude (current session) and Muse (current window) report an equivalent 5-hour
- * rolling window. Returns null when the provider reports no short window (grok, manual).
+ * rolling window, as does OpenCode Go. Returns null when the provider reports no
+ * short window (grok, manual).
  */
 export function shortWindowLabel(id) {
     switch (id.split(":")[0]) {
@@ -63,6 +70,7 @@ export function shortWindowLabel(id) {
         case "agy":
         case "claude":
         case "muse":
+        case "opencode-go":
             return "5h Limit";
         default:
             return null;