vibe-usage-cli 0.0.0-stage → 0.1.1

package/build/core/models.js

@@ -0,0 +1,164 @@
+// Models each tool accepts, read from the tool's own data. Lists are read from `homeDir` (the
+// tools' data) and `cacheDir` (Vibe Usage's data directory, where the Cursor list is cached;
+// never inside ~/.cursor).
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { CLAUDE_FILES, SYNTHETIC_MODEL } from "../providers/claude.js";
+import { accountProfileDirs } from "../providers/profiles.js";
+import { CLAUDE_ALIASES, modelTier, nameMatchesFamily, tierFamilies } from "./model-families.js";
+import { runProcess } from "../providers/common.js";
+import { findCursorAgent } from "../providers/cursor.js";
+import { DURATION_MS } from "../shared/catalog.js";
+import { asArray, attemptSync, field, isObject, JSON_LINES_EXTENSION, jsonLines, newestFiles, readHeadSync, readJsonSync } from "./files.js";
+const CURSOR_CACHE_FILE = 'cursor-models.json';
+const CURSOR_CACHE_TTL_MS = DURATION_MS.DAY;
+const CURSOR_LIST_TIMEOUT_MS = 20000;
+const isStringArray = (value) => Array.isArray(value) && value.every(item => typeof item === 'string');
+function readCursorCache(cacheDir) {
+    if (!cacheDir)
+        return null;
+    const cache = readJsonSync(path.join(cacheDir, CURSOR_CACHE_FILE));
+    if (!isObject(cache) || !isStringArray(cache.models) || !cache.models.length)
+        return null;
+    const { updatedAt } = cache;
+    return typeof updatedAt === 'number' && Number.isFinite(updatedAt) ? { models: cache.models, updatedAt } : null;
+}
+// Output format of `cursor-agent --list-models` (verified on CLI 2026.10.01):
+//   Available models
+//
+//   auto - Auto (default)
+//   gpt-5.3-codex - Codex 5.3
+const CURSOR_MODEL_LINE = /^([A-Za-z0-9][A-Za-z0-9._:/-]*) - \S/;
+export function parseCursorModelList(output) {
+    const models = output.split(/\r?\n/).flatMap(line => CURSOR_MODEL_LINE.exec(line)?.[1] ?? []);
+    return [...new Set(models)];
+}
+// Runs the CLI asynchronously (it takes ~1s) and refreshes the cache at most once a day.
+// Returns the live list, or null when the CLI is unavailable or its output is unusable.
+export async function refreshCursorModels({ cacheDir, force = false, binary, now = Date.now() } = {}) {
+    const cached = readCursorCache(cacheDir);
+    if (!force && cached && now - cached.updatedAt < CURSOR_CACHE_TTL_MS)
+        return cached.models;
+    const agent = binary ?? (await findCursorAgent());
+    if (!agent)
+        return null;
+    const output = await runProcess(agent, ['--list-models'], { timeoutMs: CURSOR_LIST_TIMEOUT_MS }).catch(() => '');
+    const models = parseCursorModelList(output);
+    if (!models.length)
+        return null;
+    // The cache only saves the next CLI call; failing to write it changes nothing else.
+    if (cacheDir) {
+        attemptSync(() => {
+            fs.mkdirSync(cacheDir, { recursive: true });
+            fs.writeFileSync(path.join(cacheDir, CURSOR_CACHE_FILE), JSON.stringify({ models, updatedAt: now }), 'utf8');
+        });
+    }
+    return models;
+}
+const CLAUDE_RECENT_SESSIONS_PER_PROJECT = 3;
+// The model appears in the first assistant record; the head of the transcript suffices.
+const CLAUDE_TRANSCRIPT_HEAD_BYTES = 64 * 1024;
+// The file a Codex profile caches its model list in, and the visibility of the ones its picker shows.
+const CODEX_MODELS_CACHE = 'models_cache.json';
+const CODEX_LISTED_VISIBILITY = 'list';
+// Cursor's default model, which the CLI accepts without a catalogue.
+const CURSOR_DEFAULT_MODEL = 'auto';
+const CURSOR_UNSET_MODEL = 'default';
+// Full model names used in recent Claude Code sessions of a profile, so a pinned version stays selectable.
+function recentClaudeModels(profileDir) {
+    const projects = path.join(profileDir, CLAUDE_FILES.projects);
+    const projectDirs = (attemptSync(() => fs.readdirSync(projects, { withFileTypes: true })) ?? []).filter(d => d.isDirectory());
+    const found = new Set();
+    for (const dir of projectDirs) {
+        for (const file of newestFiles(path.join(projects, dir.name), JSON_LINES_EXTENSION).slice(0, CLAUDE_RECENT_SESSIONS_PER_PROJECT)) {
+            for (const record of jsonLines(readHeadSync(file, CLAUDE_TRANSCRIPT_HEAD_BYTES))) {
+                const model = field(record.message, 'model');
+                if (typeof model === 'string' && model !== SYNTHETIC_MODEL)
+                    found.add(model);
+            }
+        }
+    }
+    return [...found];
+}
+// The aliases, then each profile's configured model and recently used ones.
+function claudeModels(profileDirs) {
+    const fromProfile = (dir) => {
+        const configured = field(readJsonSync(path.join(dir, CLAUDE_FILES.settings)), 'model');
+        return [...(typeof configured === 'string' ? [configured] : []), ...recentClaudeModels(dir)];
+    };
+    return [...new Set([...CLAUDE_ALIASES, ...profileDirs.flatMap(fromProfile)])];
+}
+// The models each profile's Codex lists in its picker.
+function codexModels(profileDirs) {
+    const fromProfile = (dir) => asArray(field(readJsonSync(path.join(dir, CODEX_MODELS_CACHE)), 'models')).flatMap(model => {
+        const slug = field(model, 'slug');
+        return field(model, 'visibility') === CODEX_LISTED_VISIBILITY && typeof slug === 'string' ? [slug] : [];
+    });
+    return [...new Set(profileDirs.flatMap(fromProfile))];
+}
+// The CLI's live list (a stale list still beats an invented one); without it, the default
+// plus models the user picked in the CLI before.
+function cursorModels(homeDir, cacheDir) {
+    const cache = readCursorCache(cacheDir);
+    if (cache)
+        return cache.models;
+    const config = readJsonSync(path.join(homeDir, '.cursor', 'cli-config.json'));
+    const history = field(config, 'modelSelectionHistory');
+    const used = [field(field(config, 'selectedModel'), 'modelId'), ...asArray(history)].filter((model) => typeof model === 'string' && model !== '' && model !== CURSOR_UNSET_MODEL);
+    return [...new Set([CURSOR_DEFAULT_MODEL, ...used])];
+}
+// Models each handover target accepts. Providers whose launch takes no model argument
+// (catalog `acceptsModel: false`) get none.
+export function discoverModels({ homeDir = os.homedir(), cacheDir, accounts = [] } = {}) {
+    return {
+        claude: claudeModels(accountProfileDirs('claude', homeDir, accounts)),
+        codex: codexModels(accountProfileDirs('codex', homeDir, accounts)),
+        cursor: cursorModels(homeDir, cacheDir),
+        antigravity: []
+    };
+}
+const DEFAULT_TIER = 'balanced';
+const TIER_FALLBACK = {
+    flagship: ['flagship', 'balanced', 'fast'],
+    balanced: ['balanced', 'flagship', 'fast'],
+    fast: ['fast', 'balanced', 'flagship']
+};
+// Cursor lists every model per reasoning effort; `-high` (or no suffix) is the standard one.
+const VARIANT_SUFFIX = /-(thinking|fast|max|xhigh|low|medium|minimal|none)(-|$)/;
+const STANDARD_VARIANT = '-high';
+export const resolveModelTier = (modelName) => modelTier(modelName ?? '') ?? DEFAULT_TIER;
+function pickByTier(models, tier) {
+    for (const candidateTier of TIER_FALLBACK[tier]) {
+        for (const family of tierFamilies(candidateTier)) {
+            // A model naming the family as its base but of another tier (a flash-lite for flash) is not it.
+            const matches = models.filter(m => nameMatchesFamily(m, family) && modelTier(m) === candidateTier);
+            const choice = matches.find(m => !VARIANT_SUFFIX.test(m)) ?? matches[0];
+            if (choice)
+                return choice;
+        }
+    }
+    return null;
+}
+// 'Gemini 3.8 Flash (High)' → 'gemini-3.8-flash-high', the form CLI model ids use.
+function modelIdFromDisplayName(name) {
+    return name
+        .trim()
+        .toLowerCase()
+        .replace(/\s*\((\w+)\)$/, '-$1')
+        .replace(/\s+/g, '-');
+}
+// Target model for a handover: the user's preference, else the same model if the target
+// offers it, else the target's closest tier. A null model lets the tool use its default.
+export function getMappedModel(sourceModel, targetProvider, preferences = {}, location = {}) {
+    const tier = resolveModelTier(sourceModel);
+    const preferred = preferences[targetProvider];
+    if (preferred)
+        return { tier, targetModel: preferred, source: 'preference' };
+    const models = discoverModels(location)[targetProvider];
+    const id = sourceModel ? modelIdFromDisplayName(sourceModel) : '';
+    const same = id ? (models.find(m => m === id) ?? models.find(m => m === `${id}${STANDARD_VARIANT}`)) : undefined;
+    if (same)
+        return { tier, targetModel: same, source: 'same' };
+    return { tier, targetModel: pickByTier(models, tier), source: 'tier' };
+}

package/build/core/redact.d.ts

@@ -0,0 +1,2 @@
+export declare const REDACTED = "[REDACTED_SECRET]";
+export declare function redactSecrets(text: string): string;

package/build/core/redact.js

@@ -0,0 +1,64 @@
+// Removes recognizable credentials from text the app passes on to another tool (a handover
+// brief). Patterns match the documented shapes of common keys, so ordinary text such as paths,
+// commit hashes and prose stays intact; a secret of an unknown shape (a password given as a
+// command-line flag, a wallet's word list) is not detected.
+export const REDACTED = '[REDACTED_SECRET]';
+// Names that always announce a credential in `name=value` or `"name": "value"` form, optionally
+// prefixed (DB_PASSWORD, STRIPE_SECRET_KEY, config.secret_key_base). The name must end there:
+// `max_tokens` is not one.
+const SECRET_NAME = String.raw `\b([\w.-]*?(?:password|passwd|pwd|secret|token|credentials?|api[_-]?key|access[_-]?key|private[_-]?key|secret[_-]?key|key[_-]?base))\b`;
+// Any other name ending in `key` (ENCRYPTION_KEY, signingKey) counts only with a value that
+// looks generated, since `sortKey: "createdAt"` is not a secret.
+const KEY_NAME = String.raw `\b([\w.-]*?key)\b`;
+const GENERATED = (quote) => String.raw `(?=[^${quote}\s]*\d)(?=[^${quote}\s]*[A-Za-z])[^${quote}\s]{16,}`;
+// A value in double, single or back quotes, which may contain escaped quotes.
+const quoted = (body) => ['"', "'", '`'].map(quote => String.raw `${quote}${body(quote)}${quote}`).join('|');
+const ANY_VALUE = (quote) => String.raw `(?:\\.|[^${quote}\\\r\n]){4,}?`;
+// The end of an unquoted value.
+const UNQUOTED_END = String.raw `(?=$|[\s"'\`,;&)}\]])`;
+// Keeps the name, the separator and the quotes; only the value goes.
+const keepQuotes = (_match, name, separator, value) => `${name}${separator}${value.charAt(0)}${REDACTED}${value.charAt(0)}`;
+// Ordered: whole key blocks first, then token shapes, then values announced by their name.
+const PATTERNS = [
+    // PEM and PGP private keys. An unterminated block (a clipped message) is redacted to the end.
+    [/-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----|$)/g, REDACTED],
+    // OpenAI (sk-, sk-proj-) and Anthropic (sk-ant-) API keys.
+    [/\bsk-[A-Za-z0-9_-]{20,}/g, REDACTED],
+    // Stripe secret and restricted keys.
+    [/\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}/g, REDACTED],
+    // GitHub personal, OAuth, app and refresh tokens, and fine-grained tokens.
+    [/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/g, REDACTED],
+    // GitLab personal access tokens, npm and Hugging Face tokens.
+    [/\b(?:glpat-[A-Za-z0-9_-]{20,}|npm_[A-Za-z0-9]{36}|hf_[A-Za-z0-9]{30,})/g, REDACTED],
+    // AWS access key ids (long-term and temporary).
+    [/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, REDACTED],
+    // Slack bot, user, app and refresh tokens.
+    [/\bxox[abposr]-[A-Za-z0-9-]{10,}/g, REDACTED],
+    // Google API keys and OAuth access tokens.
+    [/\b(?:AIza[0-9A-Za-z_-]{35}|ya29\.[A-Za-z0-9_-]{20,})/g, REDACTED],
+    // JSON Web Tokens: two base64url JSON segments (`{"` encodes as `eyJ`) and a signature.
+    [/\beyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g, REDACTED],
+    // Any credential in an Authorization header (also as a JSON field), whatever its length.
+    [/(\bAuthorization["']?\s*:\s*["']?(?:Bearer|Basic|token)\s+)[A-Za-z0-9._~+/=-]{8,}/gi, `$1${REDACTED}`],
+    // A bearer token elsewhere is recognized by its length: "Bearer" alone is an ordinary word.
+    [/\bBearer\s+[A-Za-z0-9._~+/=-]{16,}/gi, `Bearer ${REDACTED}`],
+    // The password in a URL's user info (postgres://user:password@host), up to the last `@`
+    // before the host, since a password may contain one.
+    [/(\b[a-z][a-z0-9+.-]*:\/\/[^\s/:@]+:)[^\s/]*@/gi, `$1${REDACTED}@`],
+    // A quoted value after `:` or `=`: JSON, YAML, code.
+    [new RegExp(String.raw `${SECRET_NAME}(["'\`]?\s*[:=]\s*)(${quoted(ANY_VALUE)})`, 'gi'), keepQuotes],
+    [new RegExp(String.raw `${KEY_NAME}(["'\`]?\s*[:=]\s*)(${quoted(GENERATED)})`, 'gi'), keepQuotes],
+    // An unquoted value after `=` (shell, .env, URL queries, connection strings). A call such
+    // as `token = getToken()` is code, not a value.
+    [new RegExp(String.raw `${SECRET_NAME}(\s*=\s*)[^\s"'\`,;&(){}<>[\]]{8,}${UNQUOTED_END}`, 'gi'), `$1$2${REDACTED}`],
+    // An unquoted value after `:` (YAML, headers) counts only when it mixes letters and digits,
+    // so prose like `token: required` stays.
+    [
+        new RegExp(String.raw `${SECRET_NAME}(\s*:\s*)(?=[^\s"'\`]*\d)(?=[^\s"'\`]*[A-Za-z])[^\s"'\`,;(){}<>[\]]{8,}${UNQUOTED_END}`, 'gi'),
+        `$1$2${REDACTED}`
+    ],
+    [new RegExp(String.raw `${KEY_NAME}(\s*[:=]\s*)${GENERATED(String.raw `"'\`,;(){}<>[\]`)}${UNQUOTED_END}`, 'gi'), `$1$2${REDACTED}`]
+];
+export function redactSecrets(text) {
+    return PATTERNS.reduce((result, [pattern, replacement]) => typeof replacement === 'string' ? result.replace(pattern, replacement) : result.replace(pattern, replacement), text);
+}

package/build/core/selection.d.ts

@@ -0,0 +1,65 @@
+import { type ProviderId } from '../shared/catalog.ts';
+import type { MessageKey } from '../shared/i18n/index.ts';
+import type { Account, AutoContinue, MeasuredAccount, QuotaWindow, Snapshot } from '../shared/types.ts';
+export declare const QUOTA_FLOOR_PERCENT = 5;
+export type QuotaState = Pick<Snapshot, 'providers'> & {
+    settings: Pick<Snapshot['settings'], 'accounts' | 'providerOrder'>;
+};
+interface Options {
+    model?: string | undefined;
+    now?: number;
+}
+export declare function isMeasurementFresh(account: MeasuredAccount | null, now: number): account is MeasuredAccount;
+export type KnownWindow = QuotaWindow & {
+    remainingPercent: number;
+};
+export declare function isAccountEligible(account: MeasuredAccount | null, { model, now }?: Options): boolean;
+export declare function tightestWindow(account: MeasuredAccount | null, model?: string): KnownWindow | null;
+export declare const headroomPercent: (account: MeasuredAccount | null, model?: string) => number | null;
+export declare function usableModel(account: MeasuredAccount | null, model: string | undefined, now?: number): {
+    model: string | undefined;
+} | null;
+export interface Preference {
+    tool?: ProviderId | undefined;
+    accountId?: string | undefined;
+}
+export declare function selectAccount(state: QuotaState, providerId: ProviderId, { accountId, model, now }?: Options & {
+    accountId?: string | undefined;
+}): Account | null;
+export declare function primaryAccount(state: QuotaState, providerId: ProviderId): Account | null;
+export interface ProviderChoice {
+    providerId: ProviderId;
+    account: Account | null;
+    model?: string | undefined;
+    verified: boolean;
+    isFallback: boolean;
+    headroomPercent: number | null;
+}
+export declare function selectProvider(state: QuotaState, { exclude, now, models, prefer }?: {
+    exclude?: ProviderId | null;
+    now?: number;
+    models?: Partial<Record<ProviderId, string>>;
+    prefer?: Preference;
+}): ProviderChoice;
+export type ContinueScope = Exclude<AutoContinue, 'off'>;
+export declare const continueScope: (setting: AutoContinue) => ContinueScope;
+export interface Successor {
+    providerId: ProviderId;
+    account: Account | null;
+    model?: string | null;
+}
+export declare const SUCCESSOR_MIN_HEADROOM_PERCENT = 20;
+export declare function chooseSuccessor(state: QuotaState, from: Account, scope: ContinueScope, { now, minHeadroom, models, prefer }?: {
+    now?: number;
+    minHeadroom?: number;
+    models?: Partial<Record<ProviderId, string>>;
+    prefer?: Preference;
+}): Successor | null;
+export interface LaunchWarning {
+    key: MessageKey;
+    params: Readonly<Record<string, string>>;
+}
+export declare function claudeLaunchWarnings(state: QuotaState, account: Account, { model, settingsFiles, now }?: Options & {
+    settingsFiles?: Readonly<Record<string, unknown>>;
+}): LaunchWarning[];
+export {};

package/build/core/selection.js

@@ -0,0 +1,173 @@
+// Which account or provider can take new work. One rule for every provider: a fresh,
+// successful measurement whose relevant windows are all known and above the floor. Unknown
+// quota is never treated as available.
+import { DURATION_MS, normalizeProviderOrder } from "../shared/catalog.js";
+import { AppError } from "./errors.js";
+import { isObject } from "./files.js";
+import { nameMatchesFamily, quotaScopeFamily } from "./model-families.js";
+export const QUOTA_FLOOR_PERCENT = 5;
+// How old a reading may be to count as the quota now (eligibility, moves). Kept readings are a
+// separate matter (measurements.ts).
+const FRESH_READING_MAX_AGE_MS = 5 * DURATION_MS.MINUTE;
+// A partial limit that does not cover the model (Cursor's API pool for Auto).
+const exempts = (window, model) => Boolean(window.partial && model && window.except?.includes(model.toLowerCase()));
+// The limits that decide whether the account can take work with `model`. Secondary windows
+// (spend, combined totals) never do; a partial limit does unless it does not cover the model,
+// so without a known model it counts.
+function relevantWindows(account, model) {
+    const windows = (account?.windows ?? []).filter(w => w.section !== 'details' && !exempts(w, model));
+    const family = quotaScopeFamily(model);
+    const covers = (scope) => !family || nameMatchesFamily(scope, family.name);
+    return {
+        family,
+        // Without a model every model scope counts: the work may be for any of them.
+        windows: [...windows.filter(w => !w.scope), ...windows.filter(w => w.scope && covers(w.scope))],
+        scoped: family !== undefined && windows.some(w => w.scope && covers(w.scope))
+    };
+}
+export function isMeasurementFresh(account, now) {
+    const fetchedAt = Date.parse(account?.fetchedAt ?? '');
+    return account?.status === 'ok' && Number.isFinite(fetchedAt) && now - fetchedAt <= FRESH_READING_MAX_AGE_MS;
+}
+// A window's `active` is the source's choice of headline row, not whether the limit applies:
+// Claude's weekly rows are reported inactive while they still bind. It says nothing here.
+const isWindowKnown = (window) => !window.stale && window.remainingPercent !== null;
+export function isAccountEligible(account, { model, now = Date.now() } = {}) {
+    if (!isMeasurementFresh(account, now))
+        return false;
+    const { family, windows, scoped } = relevantWindows(account, model);
+    if (family?.scopeRequired && !scoped)
+        return false;
+    return windows.length > 0 && windows.every(w => isWindowKnown(w) && w.remainingPercent > QUOTA_FLOOR_PERCENT);
+}
+// The relevant window with the least left, i.e. the limit that decides what the user can spend.
+export function tightestWindow(account, model) {
+    return relevantWindows(account, model)
+        .windows.filter(isWindowKnown)
+        .reduce((tightest, w) => (tightest && tightest.remainingPercent <= w.remainingPercent ? tightest : w), null);
+}
+export const headroomPercent = (account, model) => tightestWindow(account, model)?.remainingPercent ?? null;
+// The model the account can take the work with: the one planned when it has quota for it, else
+// one its spent partial limits do not cover (Cursor's Auto once the API pool is spent); null
+// when none. `{ model: undefined }` is the account's own default.
+export function usableModel(account, model, now = Date.now()) {
+    if (isAccountEligible(account, { model, now }))
+        return { model };
+    const alternatives = new Set((account?.windows ?? []).filter(w => w.partial).flatMap(w => w.except ?? []));
+    for (const alternative of alternatives)
+        if (alternative !== model?.toLowerCase() && isAccountEligible(account, { model: alternative, now }))
+            return { model: alternative };
+    return null;
+}
+const primaryFirst = (a, b) => Number(b.primary) - Number(a.primary);
+function configuredAccounts(state, providerId) {
+    return state.settings.accounts.filter(a => a.providerId === providerId && a.enabled);
+}
+function candidates(state, providerId, prefer = {}) {
+    const accounts = configuredAccounts(state, providerId);
+    const preferred = accounts.filter(a => a.id === prefer.accountId);
+    return preferred.length ? preferred : accounts;
+}
+function measuredAccount(state, account) {
+    return state.providers.find(p => p.id === account.providerId)?.accounts.find(a => a.id === account.id) ?? null;
+}
+// Explicit choice wins; otherwise the primary-first eligible account, or null.
+export function selectAccount(state, providerId, { accountId, model, now = Date.now() } = {}) {
+    const accounts = configuredAccounts(state, providerId);
+    if (accountId) {
+        const chosen = accounts.find(a => a.id === accountId);
+        if (!chosen)
+            throw new AppError('account_not_found');
+        return chosen;
+    }
+    return accounts.sort(primaryFirst).find(a => isAccountEligible(measuredAccount(state, a), { model, now })) ?? null;
+}
+// The account a tool uses when nothing is verified: the user's primary, else the first.
+export function primaryAccount(state, providerId) {
+    return configuredAccounts(state, providerId).sort(primaryFirst)[0] ?? null;
+}
+// First provider in the user's order with an eligible account. When none qualifies, the
+// first provider is returned unverified so the caller can say so instead of guessing. A
+// preferred tool is the only candidate.
+export function selectProvider(state, { exclude, now = Date.now(), models = {}, prefer = {} } = {}) {
+    const order = normalizeProviderOrder(state.settings.providerOrder).filter(id => id !== exclude && (!prefer.tool || id === prefer.tool || prefer.tool === exclude));
+    for (const [index, providerId] of order.entries()) {
+        for (const account of candidates(state, providerId, prefer).sort(primaryFirst)) {
+            const usable = usableModel(measuredAccount(state, account), models[providerId], now);
+            if (usable)
+                return {
+                    providerId,
+                    account,
+                    ...(usable.model ? { model: usable.model } : {}),
+                    verified: true,
+                    isFallback: index > 0,
+                    headroomPercent: headroomPercent(measuredAccount(state, account), usable.model)
+                };
+        }
+    }
+    // `exclude` removes at most one provider, so the order is never empty.
+    const [first] = order;
+    if (!first)
+        throw new Error('provider order is empty');
+    return { providerId: first, account: primaryAccount(state, first), verified: false, isFallback: false, headroomPercent: null };
+}
+// The scope for a setting: with auto-continue off, work is offered rather than moved, and the
+// offer looks within every tool.
+export const continueScope = (setting) => (setting === 'off' ? 'tools' : setting);
+// Work only moves to an account with real room left: one just above the floor would run out
+// again within minutes and bounce the work on.
+export const SUCCESSOR_MIN_HEADROOM_PERCENT = 20;
+// The tool's eligible account with the most headroom, at least `minHeadroom`, and the model it
+// takes the work with.
+function roomiest(state, accounts, minHeadroom, now, model) {
+    return (accounts
+        .map(account => {
+        const measured = measuredAccount(state, account);
+        const usable = usableModel(measured, model, now);
+        return { account, model: usable?.model, headroom: usable ? (headroomPercent(measured, usable.model) ?? 0) : -1 };
+    })
+        .filter(candidate => candidate.headroom >= minHeadroom)
+        .sort((a, b) => b.headroom - a.headroom)[0] ?? null);
+}
+// Who takes over from `from`: the same tool's other account with the most verified headroom,
+// else, within `scope`, the first other tool in the fallback order with such an account. A
+// preferred tool comes first among the other tools.
+export function chooseSuccessor(state, from, scope, { now = Date.now(), minHeadroom = SUCCESSOR_MIN_HEADROOM_PERCENT, models = {}, prefer = {} } = {}) {
+    // The preferred account running out leaves its tool's other accounts to take over.
+    const narrowed = prefer.accountId === from.id ? { tool: prefer.tool } : prefer;
+    const others = (providerId) => candidates(state, providerId, narrowed).filter(a => a.id !== from.id);
+    const sibling = roomiest(state, others(from.providerId), minHeadroom, now, models[from.providerId]);
+    if (sibling)
+        return { providerId: from.providerId, account: sibling.account, ...(sibling.model ? { model: sibling.model } : {}) };
+    if (scope === 'accounts')
+        return null;
+    const order = normalizeProviderOrder(state.settings.providerOrder).filter(id => id !== from.providerId);
+    const preferred = order.filter(id => id === prefer.tool);
+    for (const providerId of [...preferred, ...order.filter(id => id !== prefer.tool)]) {
+        const found = roomiest(state, others(providerId), minHeadroom, now, models[providerId]);
+        if (found)
+            return { providerId, account: found.account, ...(found.model ? { model: found.model } : {}) };
+    }
+    return null;
+}
+const CREDENTIAL_ENV_PREFIXES = ['ANTHROPIC_', 'CLAUDE_', 'AWS_'];
+// Risks of starting Claude Code with a chosen profile. `settingsFiles` maps a display name
+// to a parsed Claude settings.json (or null).
+export function claudeLaunchWarnings(state, account, { model, settingsFiles = {}, now = Date.now() } = {}) {
+    const warnings = [];
+    for (const [file, settings] of Object.entries(settingsFiles)) {
+        if (!isObject(settings))
+            continue;
+        const overrides = isObject(settings.env) ? Object.keys(settings.env) : [];
+        if (overrides.some(name => CREDENTIAL_ENV_PREFIXES.some(prefix => name.toUpperCase().startsWith(prefix))))
+            warnings.push({ key: 'warnSettingsEnvOverride', params: { file } });
+        if (settings.apiKeyHelper)
+            warnings.push({ key: 'warnApiKeyHelper', params: { file } });
+    }
+    const measured = measuredAccount(state, account);
+    if (!isAccountEligible(measured, { model, now }))
+        warnings.push({ key: 'warnQuotaUnverified', params: {} });
+    if (relevantWindows(measured, model).windows.some(w => w.remainingPercent === 0))
+        warnings.push({ key: 'warnQuotaExhausted', params: {} });
+    return warnings;
+}

package/build/core/service.d.ts

@@ -0,0 +1,35 @@
+import type { Clock } from '../providers/common.ts';
+import type { DiscoveredAccount, ProviderAdapter } from '../providers/types.ts';
+import { type ProviderId } from '../shared/catalog.ts';
+import type { Account, Settings, Snapshot } from '../shared/types.ts';
+import type { SettingsPatch } from '../shared/ipc.ts';
+export declare const SIGN_IN_WINDOW_MS: number;
+export interface ServiceOptions {
+    settingsPath: string;
+    measurementsPath?: string;
+    renewSignIn?: Partial<Record<ProviderId, (account: Account) => Promise<boolean>>>;
+    onChange?: () => void;
+    providers?: ProviderAdapter[];
+    clock?: Clock;
+    home?: string;
+}
+export interface RefreshOptions {
+    fresh?: boolean;
+}
+export interface Service {
+    snapshot(): Snapshot;
+    refresh(providerId?: ProviderId, options?: RefreshOptions): Promise<Snapshot>;
+    updateSettings(patch: SettingsPatch): Promise<Snapshot>;
+    updateSettingsFrom(input: unknown): Promise<Snapshot>;
+    dismissAccount(accountId: unknown): Promise<Snapshot>;
+    addPendingAccount(account: Omit<DiscoveredAccount, 'primary'>): Promise<Snapshot>;
+    signInOpened(accountId: string): Promise<Snapshot>;
+    withdrawPendingAccount(accountId: string): Promise<Snapshot>;
+    resetSettings(): Promise<Snapshot>;
+    importSettings(document: unknown): Promise<Snapshot>;
+    exportSettings(): Omit<Settings, 'window'>;
+    dismissSettingsNotice(): Snapshot;
+    restoreDismissedAccounts(): Promise<Snapshot>;
+    reconcileDiscovery(): Promise<void>;
+}
+export declare function createService({ settingsPath, measurementsPath, renewSignIn, onChange, providers: injected, clock, home }: ServiceOptions): Promise<Service>;