quotacap 0.0.51 → 0.0.52

package/README.md

@@ -28,7 +28,7 @@ QuotaCap helps you get more from the AI coding subscriptions you already pay for
 
 Exec adapters run via `execFile` with an argv list. PTY adapters run via `node-pty` (`src/adapters/pty.ts`). They are TUI-fragile: a vendor text change breaks the parser and the row degrades fail-closed until the regex is fixed. Poll latency is 2–10 s per PTY provider (settle plus completion); `muse` can reach about 75 s when it has to warm an unavailable subscription. It dominates `POST /api/refresh` and the first poll, not the steady-state 15 m timer.
 
-Live adapters invoke the CLIs you already logged into — no API keys, no token files read. The one opt-in exception is OpenCode Go: after you run `quotacap providers enable opencode-go`, each poll reads the OpenCode auth key in-memory (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback, or `OPENCODE_API_KEY`) and sends it only to `opencode.ai/zen/go/v1/usage`. It is never stored, logged, or returned by the API or MCP. Disable any time with `quotacap providers disable opencode-go`.
+Live adapters invoke the CLIs you already logged into — no API keys, no token files read. The one opt-in exception is OpenCode Go: after you run `quotacap providers enable opencode-go`, each poll reads the bearer OpenCode already stored (v2 `~/.local/share/opencode/opencode.db` active credential, else legacy `auth.json`; `opencode-go` then `opencode`, or `OPENCODE_API_KEY`) and sends it only to `opencode.ai/zen/go/v1/usage`. It is never stored, logged, or returned by the API or MCP. Disable any time with `quotacap providers disable opencode-go`.
 
 ## Install
 
@@ -121,7 +121,7 @@ curl -X PATCH http://localhost:8787/api/providers/claude \
 
 QuotaCap is a local daemon. It binds to `127.0.0.1` only (`src/runtime/service.ts` `app.listen`). It does not listen on `0.0.0.0`. There is no LAN surface.
 
-It owns no tokens. It never reads `~/.codex/auth.json`, `~/.kimi-code/credentials/kimi-code.json`, `~/.kimi/credentials/kimi-code.json`, `~/.grok/auth.json`, or `~/.gemini/oauth_creds.json`. It never uses `refresh_token` or `grant_type=refresh_token`. It has no hardcoded client ids. Those OAuth paths and the `.qc-bak` and `.qc-lock` helpers were removed in #14. This is asserted by `tests/adapters/credential-free.test.ts`. Each CLI owns its own session. It never reads `~/.config/muse/auth.json`, `~/.local/share/muse/sessions/`, or `~/.config/muse/tui-history.jsonl`. Each CLI owns its own session. The one opt-in exception is OpenCode Go: when you enable it, QuotaCap reads `~/.local/share/opencode/auth.json` in-memory, read-only, once per poll, and sends the key only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage`. The read is consent-gated (`opencodeGoConsentAt` in config), asserted read-only by `tests/adapters/credential-free.test.ts`, and revoked by `quotacap providers disable opencode-go`. QuotaCap only spawns the CLI and reads its stdout via `exec` (`claude`, `agy`) or PTY (`codex`, `kimi`, `grok`, `muse`).
+It owns no tokens. It never reads `~/.codex/auth.json`, `~/.kimi-code/credentials/kimi-code.json`, `~/.kimi/credentials/kimi-code.json`, `~/.grok/auth.json`, or `~/.gemini/oauth_creds.json`. It never uses `refresh_token` or `grant_type=refresh_token`. It has no hardcoded client ids. Those OAuth paths and the `.qc-bak` and `.qc-lock` helpers were removed in #14. This is asserted by `tests/adapters/credential-free.test.ts`. Each CLI owns its own session. It never reads `~/.config/muse/auth.json`, `~/.local/share/muse/sessions/`, or `~/.config/muse/tui-history.jsonl`. Each CLI owns its own session. The one opt-in exception is OpenCode Go: when you enable it, QuotaCap reads the bearer OpenCode stored — the active credential in `~/.local/share/opencode/opencode.db`, or the legacy `auth.json` key — in-memory, read-only, once per poll, and sends it only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage`. The read is consent-gated (`opencodeGoConsentAt` in config), asserted read-only by `tests/adapters/credential-free.test.ts`, and revoked by `quotacap providers disable opencode-go`. QuotaCap only spawns the CLI and reads its stdout via `exec` (`claude`, `agy`) or PTY (`codex`, `kimi`, `grok`, `muse`).
 
 It stores no `raw` provider payload. The `raw` column was dropped and migrated in `src/store/db.ts` `migrate`. `GET /api/quotas` and MCP `get_quotas` never return `raw` (`tests/http/api.test.ts`). History and the token live under `~/.quotacap/` with `0700` on the directory and `0600` on files.
 

package/dist/adapters/agy.js

@@ -26,11 +26,14 @@ function parseGroup(g, provider, rawJsonString, now) {
     const sessionPct = fiveHour
         ? usedPctFromRemaining(fiveHour.remaining_fraction) ?? undefined
         : undefined;
+    const fiveResetDate = fiveHour?.reset_time ? new Date(fiveHour.reset_time) : null;
+    const fiveHourResetsAt = fiveResetDate && !Number.isNaN(fiveResetDate.getTime()) ? fiveResetDate.toISOString() : undefined;
     return {
         provider,
         plan: "unknown",
         weeklyPct: usedPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt,
         periodStart,
         source: "cli",

package/dist/adapters/claude.js

@@ -12,6 +12,8 @@ export function parseClaudeUsage(result, now = new Date()) {
     // and whole-text farthest-wins would pick it instead (muse precedent:
     // scope to the weekly section, then degrade to +7d when it won't parse).
     const weeklyLine = result.match(/^.*current week.*$/gim)?.[0];
+    const sessionLine = result.match(/^.*current session.*$/gim)?.[0];
+    const fiveHourResetsAt = sessionLine ? parseResetText(sessionLine, now) ?? undefined : undefined;
     let resetsAt = parseResetText(weeklyLine ?? result, now);
     const parsedReset = !!resetsAt;
     if (!resetsAt)
@@ -20,6 +22,7 @@ export function parseClaudeUsage(result, now = new Date()) {
     const periodStart = (parsedReset ? new Date(resets - 7 * 86400000) : new Date(now.getTime() - 7 * 86400000)).toISOString();
     return {
         provider: "claude", plan: "unknown", weeklyPct: usedPct, fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt, periodStart, source: "cli", fetchedAt: now.toISOString(), raw: result,
     };
 }

package/dist/adapters/codex.js

@@ -121,8 +121,9 @@ function parseCodexCleaned(cleaned, now) {
         weeklyIso = new Date(now.getTime() + 7 * 86400000).toISOString();
         estimated = true;
     }
-    if (!fiveIso)
-        fiveIso = new Date(now.getTime() + 5 * 3600000).toISOString();
+    // The 5h reset is display-only: expose it only when actually parsed,
+    // never the synthesized fallback a garbled timestamp would produce.
+    const fiveHourResetsAt = fiveIso ?? undefined;
     const usedPct = 100 - weeklyLeft;
     const sessionPct = 100 - fiveLeft;
     // The /status panel carries "Account: <email> (<plan>)" above the limits.
@@ -137,6 +138,7 @@ function parseCodexCleaned(cleaned, now) {
         plan,
         weeklyPct: usedPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt: weeklyIso,
         periodStart,
         source: "tui",

package/dist/adapters/kimi.js

@@ -43,6 +43,7 @@ function parseKimiCleaned(cleaned, now) {
     // Degrade, don't fail (grok precedent): the percents are the critical
     // fields; an unparseable timestamp degrades to an estimate.
     let weeklyIso = parseResetText(`resets ${weeklyRaw}`, now);
+    const fiveHourResetsAt = f ? parseResetText(`resets ${f[2].trim()}`, now) ?? undefined : undefined;
     let estimated = false;
     if (!weeklyIso) {
         weeklyIso = new Date(now.getTime() + 7 * 86400000).toISOString();
@@ -86,6 +87,7 @@ function parseKimiCleaned(cleaned, now) {
         plan,
         weeklyPct: usedPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt: weeklyIso,
         periodStart,
         source: "tui",
@@ -184,6 +186,7 @@ export function parseKimiApiUsage(usagesBody, meBody, now = new Date()) {
     }
     // 2. 5-hour window (from limits array)
     let sessionPct = null;
+    let fiveHourResetsAt;
     if (Array.isArray(u.limits)) {
         for (const item of u.limits) {
             if (item && typeof item === "object") {
@@ -193,6 +196,11 @@ export function parseKimiApiUsage(usagesBody, meBody, now = new Date()) {
                     const limit = Number(detail.limit);
                     if (Number.isFinite(used) && Number.isFinite(limit) && limit > 0) {
                         sessionPct = Math.round((used / limit) * 100);
+                        if (typeof detail.resetTime === "string") {
+                            const parsed = Date.parse(detail.resetTime);
+                            if (Number.isFinite(parsed))
+                                fiveHourResetsAt = new Date(parsed).toISOString();
+                        }
                         break;
                     }
                 }
@@ -218,6 +226,11 @@ export function parseKimiApiUsage(usagesBody, meBody, now = new Date()) {
             if (l5h && typeof l5h.used_ratio === "number") {
                 sessionPct = Math.round(l5h.used_ratio * 100);
             }
+            if (l5h && typeof l5h.reset_time === "string" && !fiveHourResetsAt) {
+                const parsed = Date.parse(l5h.reset_time);
+                if (Number.isFinite(parsed))
+                    fiveHourResetsAt = new Date(parsed).toISOString();
+            }
         }
     }
     // 3. Plan identity (from meBody), before the field throws: an empty
@@ -252,6 +265,7 @@ export function parseKimiApiUsage(usagesBody, meBody, now = new Date()) {
         plan,
         weeklyPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt,
         periodStart,
         source: "api",

package/dist/adapters/manual.js

@@ -20,11 +20,15 @@ export function parseManualUsage(provider, text, now = new Date()) {
         if (Number.isFinite(v) && v >= 0 && v <= 100)
             sessionPct = v;
     }
+    // The short window's own reset lives on its line, never the weekly one.
+    const fiveLine = text.match(/^.*(?:5h|5-hour).*$/gim)?.[0];
+    const fiveHourResetsAt = fiveLine ? parseResetText(fiveLine, now) ?? undefined : undefined;
     return {
         provider,
         plan: "unknown",
         weeklyPct: usedPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt,
         periodStart,
         source: "manual",

package/dist/adapters/muse.js

@@ -105,11 +105,24 @@ function parseMuseCleaned(cleaned, now) {
     const planMatch = cleaned.match(/Subscription\s*·\s*Muse Code\s+(.+?)\s{2,}/i);
     if (planMatch)
         plan = planMatch[1].trim();
-    // The Current-window reset ("Resets at 3:51 PM") is a bare clock time with
-    // no date, and Quota has no session-reset field — discarded, as claude and
-    // kimi already do. A missing or unparseable Weekly reset degrades to an
-    // estimate (grok precedent): the percents are the critical fields, and the
-    // estimate flag keeps advisory and scheduler honest.
+    // The Current-window reset ("Resets at 3:51 PM") is a bare clock time
+    // with no date: resolve it against the panel's Brisbane date, rolling to
+    // tomorrow once today's time has passed. Display-only; a missing or
+    // unparseable Weekly reset degrades to an estimate (grok precedent): the
+    // percents are the critical fields, and the estimate flag keeps advisory
+    // and scheduler honest.
+    const currentReset = cleaned.match(/Current\s+\d+%\s+used[\s\S]{0,120}?Resets at\s+(\d{1,2}):(\d{2})\s*([AP]M)/i);
+    let fiveHourResetsAt;
+    if (currentReset) {
+        let hour = parseInt(currentReset[1], 10) % 12;
+        if (/pm/i.test(currentReset[3]))
+            hour += 12;
+        const brisbaneNow = new Date(now.getTime() + 10 * 3600000);
+        let candidate = Date.UTC(brisbaneNow.getUTCFullYear(), brisbaneNow.getUTCMonth(), brisbaneNow.getUTCDate(), hour - 10, parseInt(currentReset[2], 10));
+        if (candidate <= now.getTime())
+            candidate += 86400000;
+        fiveHourResetsAt = new Date(candidate).toISOString();
+    }
     const resetMatch = cleaned.match(/Weekly[\s\S]{0,400}?Resets\s+([A-Za-z]{3}\s+\d{1,2}\s+at\s+\d{1,2}:\d{2}\s*[AP]M)/i);
     let resetsAt = resetMatch ? parseResetText(`resets ${resetMatch[1].trim()}`, now) : null;
     let estimated = false;
@@ -123,6 +136,7 @@ function parseMuseCleaned(cleaned, now) {
         plan,
         weeklyPct: usedPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt,
         periodStart,
         source: "tui",

package/dist/adapters/opencode-go.d.ts

@@ -1,8 +1,18 @@
 import type { ParsedQuota } from "./types.js";
+export declare const OPENCODE_LOGIN_COMMAND_V2 = "opencode auth login opencode";
+export declare const OPENCODE_LOGIN_COMMAND_V1 = "opencode console login";
+/** Login command for the installed OpenCode CLI major version, or null
+ *  when the version text carries no readable major. */
+export declare function openCodeLoginCommandForVersion(versionText: string | null | undefined): string | null;
+/** Best-effort local detection: `<opencode> --version`, never throws. */
+export declare function detectOpenCodeLoginCommand(versionReader?: () => Promise<string | null>): Promise<string | null>;
+export declare function openCodeGoConsentNotice(loginCommand?: string | null): string;
 export declare const OPENCODE_GO_CONSENT_NOTICE: string;
-export declare function openCodeGoAuthPath(): string;
+export declare function openCodeGoAuthPath(env?: NodeJS.Dict<string>, home?: string): string;
+/** v2 database. `OPENCODE_DB` wins, otherwise the OpenCode data directory. */
+export declare function openCodeGoDbPath(env?: NodeJS.Dict<string>, home?: string): string;
 /** Detection is existence only — no content read before enablement. */
-export declare function opencodeGoDetected(): boolean;
+export declare function opencodeGoDetected(env?: NodeJS.Dict<string>, home?: string): boolean;
 export declare function parseOpencodeGoUsage(body: unknown, now?: Date): ParsedQuota;
 export declare const opencodeGoAdapter: {
     id: string;

package/dist/adapters/opencode-go.js

@@ -1,57 +1,177 @@
-// Consented exception to credential-free polling: reads the OpenCode auth
-// key in-memory, only after `providers enable opencode-go` records consent.
+// Consented exception to credential-free polling: reads the OpenCode bearer
+// in-memory, only after `providers enable opencode-go` records consent.
+// v2 stores it in opencode.db. v1 stored an API key in auth.json.
 // The static gate pins the auth-file literal to this adapter plus the
 // generated dashboard bundle — see tests/adapters/credential-free.test.ts.
+import { createRequire } from "node:module";
 import fsSync from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { adapterSignal } from "../runtime/spawn.js";
+import { getCliVersion } from "../diagnostics/bundle.js";
+const require = createRequire(import.meta.url);
 const USAGE_URL = "https://opencode.ai/zen/go/v1/usage";
 const POLL_TIMEOUT_MS = 8000;
-export const OPENCODE_GO_CONSENT_NOTICE = [
-    "• What is read: API key OpenCode already stored when you ran `opencode auth login -p opencode-go` (`~/.local/share/opencode/auth.json`, `opencode-go` → `opencode` fallback).",
-    "• Read frequency: in-memory, read-only once per poll (every 15 minutes by default).",
-    "• Request destination: sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`.",
-    "• Never-list: never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`).",
-    "• Revocation instructions: revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling.",
-    "• Optional environment override: if you prefer no file access, set `OPENCODE_API_KEY` instead.",
-].join("\n");
-export function openCodeGoAuthPath() {
-    return path.join(os.homedir(), ".local", "share", "opencode", "auth.json");
+export const OPENCODE_LOGIN_COMMAND_V2 = "opencode auth login opencode";
+export const OPENCODE_LOGIN_COMMAND_V1 = "opencode console login";
+/** Login command for the installed OpenCode CLI major version, or null
+ *  when the version text carries no readable major. */
+export function openCodeLoginCommandForVersion(versionText) {
+    if (!versionText)
+        return null;
+    const m = versionText.match(/(?:^|\s)v?(\d+)\.\d+/);
+    if (!m)
+        return null;
+    const major = parseInt(m[1], 10);
+    if (major >= 2)
+        return OPENCODE_LOGIN_COMMAND_V2;
+    if (major === 1)
+        return OPENCODE_LOGIN_COMMAND_V1;
+    return null;
+}
+/** Best-effort local detection: `<opencode> --version`, never throws. */
+export async function detectOpenCodeLoginCommand(versionReader = () => getCliVersion("opencode")) {
+    try {
+        return openCodeLoginCommandForVersion(await versionReader());
+    }
+    catch {
+        return null;
+    }
+}
+export function openCodeGoConsentNotice(loginCommand) {
+    const loginClause = loginCommand
+        ? `when you ran \`${loginCommand}\``
+        : `with the command for your CLI version: v2 \`${OPENCODE_LOGIN_COMMAND_V2}\` or v1 \`${OPENCODE_LOGIN_COMMAND_V1}\``;
+    return [
+        `• What is read: Bearer [REDACTED] already stored ${loginClause} (v2 \`~/.local/share/opencode/opencode.db\` active credential, else legacy \`~/.local/share/opencode/auth.json\`; \`opencode-go\` then \`opencode\`).`,
+        "• Read frequency: in-memory, read-only once per poll (every 15 minutes by default).",
+        "• Request destination: sent only as `Authorization: Bearer` to `https://opencode.ai/zen/go/v1/usage` to fetch `rolling/weekly/monthly` `percent` + `resetsAt`.",
+        "• Never-list: never used to make chat or model requests, never written or rotated, never stored in the `quotacap` DB, never returned by the API or MCP, and never logged (errors show `[redacted]`).",
+        "• Revocation instructions: revoke at `https://opencode.ai/auth` or `opencode providers logout opencode-go` and run `quotacap providers disable opencode-go` to stop polling.",
+        "• Optional environment override: if you prefer no file access, set `OPENCODE_API_KEY` instead.",
+    ].join("\n");
+}
+export const OPENCODE_GO_CONSENT_NOTICE = openCodeGoConsentNotice();
+export function openCodeGoAuthPath(env = process.env, home = os.homedir()) {
+    return path.join(openCodeDataDir(env, home), "auth.json");
+}
+/** v2 database. `OPENCODE_DB` wins, otherwise the OpenCode data directory. */
+export function openCodeGoDbPath(env = process.env, home = os.homedir()) {
+    const override = env.OPENCODE_DB;
+    if (typeof override === "string" && override.length > 0)
+        return override;
+    return path.join(openCodeDataDir(env, home), "opencode.db");
+}
+function openCodeDataDir(env, home) {
+    const xdg = env.XDG_DATA_HOME;
+    if (typeof xdg === "string" && xdg.length > 0)
+        return path.join(xdg, "opencode");
+    return path.join(home, ".local", "share", "opencode");
 }
 /** Detection is existence only — no content read before enablement. */
-export function opencodeGoDetected() {
+export function opencodeGoDetected(env = process.env, home = os.homedir()) {
     try {
-        return fsSync.existsSync(openCodeGoAuthPath());
+        return fsSync.existsSync(openCodeGoDbPath(env, home)) || fsSync.existsSync(openCodeGoAuthPath(env, home));
     }
     catch {
         return false;
     }
 }
+function openReadonlySqlite(dbPath) {
+    try {
+        const { DatabaseSync } = require("node:sqlite");
+        return new DatabaseSync(dbPath, { readOnly: true });
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "ERR_UNKNOWN_BUILTIN_MODULE" && code !== "MODULE_NOT_FOUND")
+            throw err;
+        const { Database } = require("bun:sqlite");
+        return new Database(dbPath, { readonly: true });
+    }
+}
+/** API key, or the OAuth access token. Refresh material is never read. */
+function bearerFromStoredValue(raw) {
+    if (typeof raw !== "string" || raw.length === 0)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return null;
+    const entry = parsed;
+    if (entry.type === "api" && typeof entry.key === "string" && entry.key.length > 0)
+        return entry.key;
+    if (entry.type === "oauth" && typeof entry.access === "string" && entry.access.length > 0)
+        return entry.access;
+    return null;
+}
+/**
+ * Active v2 credential. `opencode-go` wins over `opencode`. Newest row wins
+ * within one integration. A missing or unreadable database is no credential.
+ */
+function readV2Bearer(env, home) {
+    const dbPath = openCodeGoDbPath(env, home);
+    if (!fsSync.existsSync(dbPath))
+        return null;
+    let db;
+    try {
+        db = openReadonlySqlite(dbPath);
+        const rows = db.prepare("SELECT integration_id, value FROM credential WHERE active = 1 AND integration_id IN ('opencode-go', 'opencode') ORDER BY rowid DESC").all();
+        const chosen = new Map();
+        for (const row of rows) {
+            const id = row.integration_id;
+            if (typeof id !== "string" || chosen.has(id))
+                continue;
+            const bearer = bearerFromStoredValue(row.value);
+            if (bearer)
+                chosen.set(id, bearer);
+        }
+        return chosen.get("opencode-go") ?? chosen.get("opencode") ?? null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch { /* a failed open has nothing to close */ }
+    }
+}
+function readLegacyBearer(env, home) {
+    try {
+        const parsed = JSON.parse(fsSync.readFileSync(openCodeGoAuthPath(env, home), "utf8"));
+        const entry = (parsed["opencode-go"] ?? parsed["opencode"]);
+        if (!entry || entry.type !== "api" || typeof entry.key !== "string" || entry.key.length === 0)
+            return null;
+        return entry.key;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Consent-gated: poll() runs only when the provider is in enabledProviders,
  * which the enable flow records as explicit consent. One read, in-memory
  * only, never written or logged. Env wins so a host can avoid file access.
+ * v2's database wins over the legacy file, which v2 no longer updates.
  */
-function readBearerToken(env = process.env) {
+function readBearerToken(env = process.env, home = os.homedir()) {
     const fromEnv = env.OPENCODE_API_KEY;
     if (typeof fromEnv === "string" && fromEnv.length > 0)
         return fromEnv;
-    let parsed;
-    try {
-        parsed = JSON.parse(fsSync.readFileSync(openCodeGoAuthPath(), "utf8"));
-    }
-    catch {
-        throw new Error("opencode-go: missing API key in auth file");
-    }
-    const entry = (parsed["opencode-go"] ?? parsed["opencode"]);
-    if (!entry ||
-        entry.type !== "api" ||
-        typeof entry.key !== "string" ||
-        !entry.key.startsWith("sk-")) {
-        throw new Error("opencode-go: missing API key in auth file");
-    }
-    return entry.key;
+    const fromV2 = readV2Bearer(env, home);
+    if (fromV2)
+        return fromV2;
+    const fromLegacy = readLegacyBearer(env, home);
+    if (fromLegacy)
+        return fromLegacy;
+    throw new Error("opencode-go: missing API key in auth file");
 }
 // `rate-limited` is the binding state, not a failure: it is exactly the
 // reading issue 109 needed. Anything unreadable fails closed.
@@ -110,12 +230,17 @@ export function parseOpencodeGoUsage(body, now = new Date()) {
     if (typeof sessionPct !== "number" || !Number.isFinite(sessionPct) || sessionPct < 0 || sessionPct > 100) {
         throw new Error("opencode-go: bad rolling pct");
     }
+    const rollingResetsMs = Date.parse(String(rolling.resetsAt ?? ""));
+    const fiveHourResetsAt = Number.isFinite(rollingResetsMs)
+        ? new Date(rollingResetsMs).toISOString()
+        : undefined;
     const monthly = parseMonthly(usage);
     return {
         provider: "opencode-go",
         plan: "unknown",
         weeklyPct: usedPct,
         fiveHourPct: sessionPct,
+        ...(fiveHourResetsAt ? { fiveHourResetsAt } : {}),
         resetsAt: new Date(resetsMs).toISOString(),
         periodStart: new Date(resetsMs - 7 * 86400000).toISOString(),
         source: "api",
@@ -125,7 +250,7 @@ export function parseOpencodeGoUsage(body, now = new Date()) {
 }
 export const opencodeGoAdapter = {
     id: "opencode-go",
-    requiresAuth: "opencode auth login -p opencode-go (read only after you enable opencode-go)",
+    requiresAuth: "OpenCode CLI login for your version (read only after you enable opencode-go)",
     async poll() {
         const bearer = readBearerToken();
         const adapter = adapterSignal("opencode-go");

package/dist/adapters/types.d.ts

@@ -5,6 +5,8 @@ export interface Quota {
     weeklyPct: number;
     /** 5-hour rolling window. 0..100. Display only — never ranks. Was `sessionPct`. */
     fiveHourPct?: number;
+    /** When the 5-hour window resets, when the provider reports it. Display only. */
+    fiveHourResetsAt?: string;
     /** Included monthly envelope. 0..100. Absent means the provider has no monthly window. */
     monthlyPct?: number;
     monthlyResetsAt?: string;

package/dist/advisory/snapshot.d.ts

@@ -17,6 +17,7 @@ export interface SnapshotOptions {
             checkedAt: string | null;
         };
         detectedProviders?: string[];
+        opencodeLoginCommand?: string | null;
     };
 }
 export declare function buildSnapshot(db: any, opts: SnapshotOptions): StateSnapshot;

package/dist/advisory/snapshot.js

@@ -151,6 +151,12 @@ export function buildSnapshot(db, opts) {
                 paceByProvider.set(id, pace);
         }
         const catalog = catalogMap.get(id) ?? emptyCatalog();
+        const closeWindow = advisory?.bindingWindow === "monthly" &&
+            quota?.monthlyKind === "included" &&
+            typeof quota?.monthlyPct === "number" &&
+            !!quota?.monthlyResetsAt
+            ? "monthly"
+            : "weekly";
         providerSnapshots.push({
             id,
             ...providerIdentity(id, opts.providerNames),
@@ -165,7 +171,7 @@ export function buildSnapshot(db, opts) {
             evidence,
             exclusionReason,
             advisory,
-            lastCloses: getWindowCloses(db, id, 4),
+            lastCloses: getWindowCloses(db, id, 4, closeWindow),
             catalog,
         });
     }

package/dist/advisory/types.d.ts

@@ -113,6 +113,9 @@ export interface StateSnapshot {
         /** Auth detected for these provider ids (detection-only; consumers intersect with the enabled set).
          *  Empty on daemons predating the field. */
         detectedProviders?: string[];
+        /** Login command for the locally detected OpenCode CLI version, or
+         *  null when the version could not be read. */
+        opencodeLoginCommand?: string | null;
     };
     providers: ProviderSnapshot[];
     recommendation: Recommendation;

package/dist/cli/models.js

@@ -5,21 +5,22 @@ import { getAllLatest } from "../store/quotas.js";
 import { providerIdentity } from "../advisory/provider-names.js";
 import { readToken } from "../runtime/token.js";
 import { createServiceClient } from "../runtime/client.js";
+import { bindingLeftover } from "../format/rows.js";
 import { OFFLINE_LABEL } from "./snapshot-source.js";
 import { phase } from "./progress.js";
-function projectModels(catalogs, quotaMap, providerNames) {
+function projectModels(catalogs, quotaMap, providerNames, now = new Date()) {
     const out = [];
     for (const [id, catalog] of catalogs) {
         const identity = providerIdentity(id, providerNames);
         const quota = quotaMap.get(id);
-        const leftoverPct = quota?.weeklyPct != null ? Math.round((100 - quota.weeklyPct) * 10) / 10 : null;
+        const binding = bindingLeftover(quota, now);
         out.push({
             id,
             displayName: identity.displayName,
             harness: identity.harness,
             vendor: identity.vendor,
-            leftoverPct,
-            resetsAt: quota?.resetsAt ?? null,
+            leftoverPct: binding.leftoverPct,
+            resetsAt: binding.resetsAt,
             catalog,
         });
     }

package/dist/format/rows.d.ts

@@ -16,6 +16,35 @@ export interface Row {
 }
 export declare const RAIL_CELLS = 20;
 export declare const SORT_KEYS: SortKey[];
+/**
+ * Quota-window resolution, mirroring the dashboard helpers: the advisory
+ * binding window rations the account, so standalone resets, usage,
+ * elapsed, and pace read it. Weekly-bound rows fall back to the weekly
+ * fields unchanged; rate-limit windows never drive these figures.
+ */
+export declare function isMonthlyBound(ps: ProviderSnapshot): boolean;
+/** Reset instant of the quota window, or null without a quota reading. */
+export declare function bindingResetsAt(ps: ProviderSnapshot): string | null;
+/** Used percent of the quota window. Null without a quota reading. */
+export declare function bindingUsedPct(ps: ProviderSnapshot): number | null;
+/**
+ * Binding leftover for a raw quota without an advisory (model catalogs):
+ * the same scarcer-headroom rule the engine applies, so the catalog
+ * leftover and reset name the quota window, not always the week.
+ */
+export declare function bindingLeftover(quota: {
+    weeklyPct?: number;
+    resetsAt?: string;
+    monthlyKind?: string;
+    monthlyPct?: number;
+    monthlyResetsAt?: string;
+    monthlyStatus?: string;
+} | null | undefined, now: Date): {
+    leftoverPct: number | null;
+    resetsAt: string | null;
+};
+/** Window-average pace of the quota window; monthly divides monthly used by elapsed monthly days. */
+export declare function bindingAvgPace(ps: ProviderSnapshot, now: Date): number | null;
 export declare function weeklyPctOf(q: {
     weeklyPct?: number;
     usedPct?: number;
@@ -31,5 +60,5 @@ export declare function forecastText(ps: ProviderSnapshot, now: Date): string;
 export declare function compactSuffix(ps: ProviderSnapshot): CompactSuffix;
 export declare function assertValidSortKey(key: string): asserts key is SortKey;
 export declare function sortProviders(providers: ProviderSnapshot[], key: string, use: string): ProviderSnapshot[];
-export declare function paceText(ps: ProviderSnapshot): string;
+export declare function paceText(ps: ProviderSnapshot, now?: Date): string;
 export declare function buildRow(ps: ProviderSnapshot, now: Date): Row;