w-dispatch-ai 1.0.21 → 1.0.23

package/test/unit-getQuotaAntigravity.test.mjs

@@ -0,0 +1,123 @@
+import assert from 'assert'
+import getQuotaAntigravity from '../src/quota/getQuotaAntigravity.mjs'
+import createFakeCli from './tools/fakeCliForTest.mjs'
+
+
+//假agy: 依MODE決定--version與-p /usage之行為; 帶--log-file時寫入含applyAuthResult之log
+//(模擬2026-09-05實測agy 1.1.27之print模式JSON形狀)
+let codeAgy = (mode) => `
+import fs from 'fs'
+let args = process.argv.slice(2)
+let mode = '${mode}'
+let say = (o) => process.stdout.write((typeof o === 'string' ? o : JSON.stringify(o)) + '\\n')
+if (args.includes('--version')) {
+    say(mode === 'old' ? '1.1.10' : '1.1.27')
+    process.exit(0)
+}
+let iLog = args.indexOf('--log-file')
+if (iLog >= 0) {
+    fs.writeFileSync(args[iLog + 1], '[info] boot\\n[info] applyAuthResult: email=agy-user@example.com, authMethod=consumer\\n', 'utf8')
+}
+let cmd = args[args.indexOf('-p') + 1]
+if (mode === 'prompt') {
+    say({ status: 'SUCCESS', num_turns: 1, response: 'I treated it as a prompt' })
+    process.exit(0)
+}
+if (mode === 'fail') {
+    say({ status: 'ERROR', num_turns: 0, response: 'backend down', command: { name: 'usage' } })
+    process.exit(0)
+}
+if (cmd === '/usage') {
+    say('noise line before json')
+    say({ status: 'SUCCESS', num_turns: 0, usage: {}, command: { name: 'usage', data: { description: 'd', groups: [
+        { name: 'Gemini Models', buckets: [
+            { id: 'gemini-weekly', window: 'weekly', remaining_fraction: 0.7852, reset_time: '2099-01-03T00:00:00Z' },
+            { id: 'gemini-5h', window: '5h', remaining_fraction: '0.9829', reset_time: '2099-01-01T05:00:00Z' },
+        ] },
+        { name: 'Claude and GPT models', buckets: [
+            { id: '3p-5h', window: '5h', remaining_fraction: 0, reset_time: '2099-01-01T05:00:00Z' },
+            { id: '3p-x', window: '3d', remaining_fraction: 1, disabled: true },
+            { window: '5h', remaining_fraction: 1 },
+        ] },
+    ] } } })
+    process.exit(0)
+}
+if (cmd === '/credits') {
+    say({ status: 'SUCCESS', num_turns: 0, command: { name: 'credits', data: { remaining_credits: 123, upgrade_uri: 'https://x' } } })
+    process.exit(0)
+}
+say({})
+process.exit(0)
+`
+
+
+describe('getQuotaAntigravity', function() {
+
+    let fakes = []
+    let mkFake = (mode) => {
+        let f = createFakeCli(`fake-agy-${mode}`, codeAgy(mode))
+        fakes.push(f)
+        return f.exe
+    }
+
+    after(function() {
+        for (let f of fakes) {
+            f.clean()
+        }
+    })
+
+    it('成功: 版本把關通過, 自log取得email, 各群組桶正規化(剩餘比例反推已用, 字串型比例亦可), 停用/用罄之severity明示, 無id之桶略過', async function() {
+        let r = await getQuotaAntigravity('', { exe: mkFake('ok'), timeoutMs: 20000 })
+        let rr = [
+            r.ok, r.matched, r.provider, r.email, r.plan, r.source, r.raw.version, r.raw.authMethod,
+            r.windows.map((w) => `${w.key}|${w.label}|${w.usedPercent}|${w.scope}|${w.severity}`),
+            r.credits,
+        ]
+        assert.strict.deepEqual(rr, [
+            true, null, 'antigravity', 'agy-user@example.com', '', 'agy-print-usage', '1.1.27', 'consumer',
+            [
+                'gemini-weekly|7天(Gemini Models)|21.48|Gemini Models|normal',
+                'gemini-5h|5小時(Gemini Models)|1.71|Gemini Models|normal',
+                '3p-5h|5小時(Claude and GPT models)|100|Claude and GPT models|exhausted',
+                '3p-x|3天(Claude and GPT models)|0|Claude and GPT models|disabled',
+            ],
+            null,
+        ])
+    })
+
+    it('帳號比對相符與不符', async function() {
+        let exe = mkFake('ok2')
+        let r1 = await getQuotaAntigravity('AGY-User@example.com', { exe, timeoutMs: 20000 })
+        let r2 = await getQuotaAntigravity('other@example.com', { exe, timeoutMs: 20000 })
+        let rr = [[r1.ok, r1.matched], [r2.ok, r2.matched, r2.errorType, r2.windows.length]]
+        assert.strict.deepEqual(rr, [[true, true], [false, false, 'account', 4]])
+    })
+
+    it('withCredits時另執行/credits取得點數', async function() {
+        let r = await getQuotaAntigravity('', { exe: mkFake('ok3'), withCredits: true, timeoutMs: 20000 })
+        let rr = [r.ok, r.credits, r.raw.credits !== null]
+        assert.strict.deepEqual(rr, [true, { remainingCredits: 123, upgradeUri: 'https://x' }, true])
+    })
+
+    it('版本低於門檻→unsupported且不執行/usage(舊版會把它當prompt跑而耗額度); checkVersion關閉則照跑', async function() {
+        let exe = mkFake('old')
+        let r1 = await getQuotaAntigravity('', { exe, timeoutMs: 20000 })
+        let r2 = await getQuotaAntigravity('', { exe, checkVersion: false, timeoutMs: 20000 })
+        let rr = [[r1.ok, r1.errorType, /1\.1\.10.*below 1\.1\.11/.test(r1.error), r1.raw.version], [r2.ok, r2.windows.length, r2.raw.version]]
+        assert.strict.deepEqual(rr, [[false, 'unsupported', true, '1.1.10'], [true, 4, '']])
+    })
+
+    it('agy把指令當prompt執行(num_turns>0)→unsupported防呆; status非SUCCESS→exit', async function() {
+        let r1 = await getQuotaAntigravity('', { exe: mkFake('prompt'), timeoutMs: 20000 })
+        let r2 = await getQuotaAntigravity('', { exe: mkFake('fail'), timeoutMs: 20000 })
+        let rr = [[r1.ok, r1.errorType, /num_turns=1/.test(r1.error)], [r2.ok, r2.errorType, /status=ERROR/.test(r2.error)]]
+        assert.strict.deepEqual(rr, [[false, 'unsupported', true], [false, 'exit', true]])
+    })
+
+    it('exe不存在→notfound且附安裝指引', async function() {
+        let r = await getQuotaAntigravity('', { exe: 'agy-no-such-exe-xyz', timeoutMs: 20000 })
+        let rr = [r.ok, r.errorType, /antigravity\.google\/docs\/cli/.test(r.error)]
+        assert.strict.deepEqual(rr, [false, 'notfound', true])
+    })
+
+})

package/test/unit-getQuotaClaude.test.mjs

@@ -0,0 +1,137 @@
+import fs from 'fs'
+import path from 'path'
+import { fileURLToPath } from 'url'
+import assert from 'assert'
+import getQuotaClaude from '../src/quota/getQuotaClaude.mjs'
+import fakeServerForQuotaTest from './tools/fakeServerForQuotaTest.mjs'
+
+
+//產物落test/tmp/(同fakeCliForTest慣例), 測試結束清除
+let FD = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'tmp', 'quota-claude')
+
+
+//建立一組假Claude設定目錄(憑證檔+帳號檔), 回傳目錄路徑
+let mkConfigDir = (name, cred, conf) => {
+    let fd = path.join(FD, name)
+    fs.mkdirSync(fd, { recursive: true })
+    if (cred !== null) {
+        fs.writeFileSync(path.join(fd, '.credentials.json'), JSON.stringify(cred), 'utf8')
+    }
+    if (conf !== null) {
+        fs.writeFileSync(path.join(fd, '.claude.json'), JSON.stringify(conf), 'utf8')
+    }
+    return fd
+}
+
+
+describe('getQuotaClaude', function() {
+
+    let svr = null
+    let base = null
+
+    before(async function() {
+        svr = await fakeServerForQuotaTest()
+        fs.mkdirSync(FD, { recursive: true })
+        //env注入空物件: 隔離本機之CLAUDE_CONFIG_DIR/CLAUDE_CODE_OAUTH_TOKEN/ANTHROPIC_API_KEY
+        base = { env: {}, usageUrl: svr.usageUrlClaude, profileUrl: svr.profileUrlClaude, timeoutMs: 5000 }
+    })
+
+    after(async function() {
+        if (svr) {
+            await svr.close()
+        }
+        fs.rmSync(FD, { recursive: true, force: true })
+        try {
+            fs.rmdirSync(path.dirname(FD))
+        }
+        catch (e) {}
+    })
+
+    it('成功: 優先取limits[](含模型別週限額), plan/planTier取自憑證檔, email取自帳號檔', async function() {
+        let configDir = mkConfigDir('ok',
+            { claudeAiOauth: { accessToken: 'tok-ok', subscriptionType: 'max', rateLimitTier: 'default_claude_max_20x', expiresAt: 4102444800000 } },
+            { oauthAccount: { emailAddress: 'claude-user@example.com' } },
+        )
+        let r = await getQuotaClaude('', { ...base, configDir })
+        let rr = [
+            r.ok, r.matched, r.provider, r.email, r.plan, r.planTier, r.source,
+            r.windows.map((w) => `${w.key}|${w.label}|${w.usedPercent}|${w.active}|${w.severity}`),
+            r.raw.configDir === configDir,
+            r.credits.spendCurrency,
+        ]
+        assert.strict.deepEqual(rr, [
+            true, null, 'claude', 'claude-user@example.com', 'max', 'default_claude_max_20x', 'anthropic-oauth-usage-api',
+            ['session|5小時|3|false|normal', 'weekly_all|7天|13|false|normal', 'weekly_scoped|7天(Fable)|15|true|normal'],
+            true,
+            'USD',
+        ])
+    })
+
+    it('帳號比對: 相符ok為true; 不符ok為false且matched為false但額度仍回傳', async function() {
+        let configDir = mkConfigDir('match',
+            { claudeAiOauth: { accessToken: 'tok-ok' } },
+            { oauthAccount: { emailAddress: 'Claude-User@Example.com' } },
+        )
+        let r1 = await getQuotaClaude('claude-user@example.com', { ...base, configDir })
+        let r2 = await getQuotaClaude('other@example.com', { ...base, configDir })
+        let rr = [[r1.ok, r1.matched], [r2.ok, r2.matched, r2.errorType, r2.windows.length]]
+        assert.strict.deepEqual(rr, [[true, true], [false, false, 'account', 3]])
+    })
+
+    it('無limits[]時回退頂層舊欄位(含模型別), 標籤由秒數推導', async function() {
+        let configDir = mkConfigDir('legacy', { claudeAiOauth: { accessToken: 'tok-legacy' } }, { oauthAccount: { emailAddress: 'a@b.c' } })
+        let r = await getQuotaClaude('', { ...base, configDir })
+        let rr = r.windows.map((w) => `${w.key}|${w.label}|${w.usedPercent}|${w.scope}`)
+        assert.strict.deepEqual(rr, ['five_hour|5小時|42|', 'seven_day|7天|7|', 'seven_day_sonnet|7天(Sonnet)|1|Sonnet'])
+    })
+
+    it('憑證不存在→notfound(訊息含檔案路徑與指引); 非訂閱模式環境變數→unsupported', async function() {
+        let configDir = mkConfigDir('nocred', null, null)
+        let r1 = await getQuotaClaude('', { ...base, configDir })
+        let r2 = await getQuotaClaude('', { ...base, configDir, env: { ANTHROPIC_API_KEY: 'sk-ant-xxx' } })
+        let rr = [
+            [r1.ok, r1.errorType, r1.error.includes('.credentials.json'), r1.error.includes('claude auth login')],
+            [r2.ok, r2.errorType, r2.error.includes('ANTHROPIC_API_KEY')],
+        ]
+        assert.strict.deepEqual(rr, [[false, 'notfound', true, true], [false, 'unsupported', true]])
+    })
+
+    it('權杖被拒(401)→auth, 訊息附本機到期時刻與「執行一次claude自行刷新、不需重新登入」指引', async function() {
+        let configDir = mkConfigDir('expired', { claudeAiOauth: { accessToken: 'tok-401', expiresAt: 946684800000 } }, { oauthAccount: { emailAddress: 'a@b.c' } })
+        let r = await getQuotaClaude('', { ...base, configDir })
+        //錯誤訊息不得外洩權杖明文(redact於fetchQuotaJson層施作)
+        let rr = [r.ok, r.errorType, /local recorded expiry: 2000-01-01/.test(r.error), /re-login is not needed/.test(r.error), /tok-401/.test(r.error)]
+        assert.strict.deepEqual(rr, [false, 'auth', true, true, false])
+    })
+
+    it('環境變數CLAUDE_CODE_OAUTH_TOKEN不作為權杖來源(setup-token缺user:profile scope, 2026-09-05實測403): 有憑證檔即用憑證檔; 無憑證檔時notfound並說明該變數被忽略之原因', async function() {
+        let configDir = mkConfigDir('envtok', { claudeAiOauth: { accessToken: 'tok-ok', subscriptionType: 'max' } }, { oauthAccount: { emailAddress: 'a@b.c' } })
+        let configDir2 = mkConfigDir('envtok-nocred', null, null)
+        //環境變數給一枚會被端點拒絕的權杖, 若被誤用為來源便會401而非ok
+        let r1 = await getQuotaClaude('', { ...base, configDir, env: { CLAUDE_CODE_OAUTH_TOKEN: 'tok-401' } })
+        let r2 = await getQuotaClaude('', { ...base, configDir: configDir2, env: { CLAUDE_CODE_OAUTH_TOKEN: 'tok-ok' } })
+        let r3 = await getQuotaClaude('', { ...base, configDir: configDir2 })
+        let rr = [
+            [r1.ok, r1.email, r1.plan],
+            [r2.ok, r2.errorType, /CLAUDE_CODE_OAUTH_TOKEN is set but is ignored/.test(r2.error), /user:profile/.test(r2.error)],
+            [r3.ok, r3.errorType, /CLAUDE_CODE_OAUTH_TOKEN/.test(r3.error)],
+        ]
+        assert.strict.deepEqual(rr, [[true, 'a@b.c', 'max'], [false, 'notfound', true, true], [false, 'notfound', false]])
+    })
+
+    it('帳號檔無email時改打profile端點取得(profileFallback), 關閉則email為空', async function() {
+        let configDir = mkConfigDir('noemail', { claudeAiOauth: { accessToken: 'tok-ok' } }, {})
+        let r1 = await getQuotaClaude('', { ...base, configDir })
+        let r2 = await getQuotaClaude('', { ...base, configDir, profileFallback: false })
+        let rr = [[r1.ok, r1.email], [r2.ok, r2.email]]
+        assert.strict.deepEqual(rr, [[true, 'profile-user@example.com'], [true, '']])
+    })
+
+    it('403之oauth_not_allowed_for_organization附組織限制說明', async function() {
+        let configDir = mkConfigDir('org', { claudeAiOauth: { accessToken: 'tok-403-org' } }, { oauthAccount: { emailAddress: 'a@b.c' } })
+        let r = await getQuotaClaude('', { ...base, configDir })
+        let rr = [r.ok, r.errorType, /organization disallows OAuth usage queries/.test(r.error)]
+        assert.strict.deepEqual(rr, [false, 'forbidden', true])
+    })
+
+})

package/test/unit-getQuotaCodex.test.mjs

@@ -0,0 +1,191 @@
+import fs from 'fs'
+import path from 'path'
+import { fileURLToPath } from 'url'
+import assert from 'assert'
+import getQuotaCodex from '../src/quota/getQuotaCodex.mjs'
+import fakeServerForQuotaTest from './tools/fakeServerForQuotaTest.mjs'
+import createFakeCli from './tools/fakeCliForTest.mjs'
+
+
+//產物落test/tmp/(同fakeCliForTest慣例), 測試結束清除
+let FD = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'tmp', 'quota-codex')
+
+
+//假codex app-server: 一行一則JSON之RPC, 依MODE決定account/read之回應
+//(模擬2026-09-05實測之真實形狀: account.type/email/planType; rateLimits含primary/secondary與byLimitId)
+let codeAppServer = (mode) => `
+import readline from 'readline'
+let mode = '${mode}'
+let rl = readline.createInterface({ input: process.stdin })
+rl.on('line', (l) => {
+    let m = null
+    try {
+        m = JSON.parse(l)
+    }
+    catch (e) {
+        return
+    }
+    if (m.id === undefined) {
+        return
+    }
+    let out = (result) => process.stdout.write(JSON.stringify({ id: m.id, result }) + '\\n')
+    let err = (message) => process.stdout.write(JSON.stringify({ id: m.id, error: { code: -1, message } }) + '\\n')
+    if (m.method === 'initialize') {
+        return out({ userAgent: 'fake-codex' })
+    }
+    if (m.method === 'account/read') {
+        if (mode === 'nologin') return out({ account: null })
+        if (mode === 'apikey') return out({ account: { type: 'apikey' } })
+        if (mode === 'rpcfail') return err('boom')
+        return out({ account: { type: 'chatgpt', email: 'codex-user@example.com', planType: 'plus' } })
+    }
+    if (m.method === 'account/rateLimits/read') {
+        return out({
+            rateLimits: {
+                limitId: 'codex', planType: 'plus',
+                primary: { usedPercent: 0, windowDurationMins: 300, resetsAt: 4102444800 },
+                secondary: { usedPercent: 31, windowDurationMins: 10080, resetsAt: 4102444800 },
+                credits: { hasCredits: false, unlimited: false, balance: '0' },
+            },
+            rateLimitsByLimitId: {
+                codex: {},
+                'codex-spark': { limitName: 'GPT-5.3-Codex-Spark', primary: { usedPercent: 12, windowDurationMins: 300, resetsAt: 4102444800 } },
+            },
+            rateLimitResetCredits: { availableCount: 1, credits: [{ id: 'c1', title: 'Reset' }] },
+        })
+    }
+    err('unknown method ' + m.method)
+})
+rl.on('close', () => process.exit(0))
+`
+
+
+//以base64url組一枚不驗簽之JWT(僅供解出payload)
+let mkJwt = (payload) => {
+    let b64 = (o) => Buffer.from(JSON.stringify(o)).toString('base64url')
+    return `${b64({ alg: 'none' })}.${b64(payload)}.sig`
+}
+
+
+//建立假codexHome(auth.json)
+let mkCodexHome = (name, auth) => {
+    let fd = path.join(FD, name)
+    fs.mkdirSync(fd, { recursive: true })
+    if (auth !== null) {
+        fs.writeFileSync(path.join(fd, 'auth.json'), JSON.stringify(auth), 'utf8')
+    }
+    return fd
+}
+
+
+describe('getQuotaCodex', function() {
+
+    let svr = null
+    let fakes = []
+    let mkFake = (mode) => {
+        let f = createFakeCli(`fake-codex-${mode}`, codeAppServer(mode))
+        fakes.push(f)
+        return f.exe
+    }
+
+    before(async function() {
+        svr = await fakeServerForQuotaTest()
+        fs.mkdirSync(FD, { recursive: true })
+    })
+
+    after(async function() {
+        if (svr) {
+            await svr.close()
+        }
+        for (let f of fakes) {
+            f.clean()
+        }
+        fs.rmSync(FD, { recursive: true, force: true })
+        try {
+            fs.rmdirSync(path.dirname(FD))
+        }
+        catch (e) {}
+    })
+
+    it('app-server主路徑: 帳號與額度經JSON-RPC取得, byLimitId另列並略過與彙總同id者, severity對稱推導', async function() {
+        let r = await getQuotaCodex('', { exe: mkFake('ok'), env: {}, timeoutMs: 20000 })
+        let rr = [
+            r.ok, r.matched, r.provider, r.email, r.plan, r.source,
+            r.windows.map((w) => `${w.key}|${w.label}|${w.usedPercent}|${w.scope}|${w.severity}`),
+            r.credits.resetCreditsAvailable,
+            r.raw.accountType,
+        ]
+        assert.strict.deepEqual(rr, [
+            true, null, 'codex', 'codex-user@example.com', 'plus', 'codex-app-server',
+            ['primary|5小時|0||normal', 'secondary|7天|31||normal', 'codex-spark:primary|5小時(GPT-5.3-Codex-Spark)|12|GPT-5.3-Codex-Spark|normal'],
+            1,
+            'chatgpt',
+        ])
+    })
+
+    it('app-server回報尚未登入(account為null)→notfound且不走備援(以notLoggedIn旗標判別, 非字串比對)', async function() {
+        let codexHome = mkCodexHome('nologin', { tokens: { access_token: 'tok-ok' } })
+        let r = await getQuotaCodex('', { exe: mkFake('nologin'), env: {}, codexHome, usageUrl: svr.usageUrlCodex, timeoutMs: 20000 })
+        let rr = [r.ok, r.errorType, r.source, /codex login/.test(r.error)]
+        assert.strict.deepEqual(rr, [false, 'notfound', 'codex-app-server', true])
+    })
+
+    it('app-server回報非chatgpt帳號型別(如apikey)→unsupported且不走備援', async function() {
+        let codexHome = mkCodexHome('apikey-rpc', { tokens: { access_token: 'tok-ok' } })
+        let r = await getQuotaCodex('', { exe: mkFake('apikey'), env: {}, codexHome, usageUrl: svr.usageUrlCodex, timeoutMs: 20000 })
+        let rr = [r.ok, r.errorType, r.source, /\[apikey\]/.test(r.error)]
+        assert.strict.deepEqual(rr, [false, 'unsupported', 'codex-app-server', true])
+    })
+
+    it('app-server之RPC失敗或exe不存在→退回HTTP備援, 成功時raw記錄app-server之錯誤', async function() {
+        let codexHome = mkCodexHome('fallback', {
+            auth_mode: 'chatgpt',
+            tokens: { access_token: 'tok-ok', account_id: 'acct-123456', id_token: mkJwt({ 'email': 'jwt@example.com', 'https://api.openai.com/auth': { chatgpt_plan_type: 'pro' } }) },
+        })
+        let r1 = await getQuotaCodex('', { exe: mkFake('rpcfail'), env: {}, codexHome, usageUrl: svr.usageUrlCodex, timeoutMs: 20000 })
+        let r2 = await getQuotaCodex('', { exe: 'codex-no-such-exe-xyz', env: {}, codexHome, usageUrl: svr.usageUrlCodex, timeoutMs: 20000 })
+        let rr = [
+            [r1.ok, r1.source, r1.email, r1.plan, r1.windows.length, /boom/.test(r1.raw.appServerError)],
+            [r2.ok, r2.source, r2.raw.appServerError !== ''],
+        ]
+        //回應之email/plan為權威值(覆蓋id_token所解); fixture有主窗口2+code review1+additional1=4
+        assert.strict.deepEqual(rr, [[true, 'chatgpt-wham-usage-api', 'codex-user@example.com', 'plus', 4, true], [true, 'chatgpt-wham-usage-api', true]])
+    })
+
+    it('fallbackHttp為false時app-server失敗即回報, 不打備援', async function() {
+        let r = await getQuotaCodex('', { exe: mkFake('rpcfail'), env: {}, fallbackHttp: false, usageUrl: svr.usageUrlCodex, timeoutMs: 20000 })
+        let rr = [r.ok, r.source, r.errorType]
+        assert.strict.deepEqual(rr, [false, 'codex-app-server', 'rpc'])
+    })
+
+    it('HTTP備援(useAppServer:false): 憑證不存在→notfound; API key模式→unsupported; 401→auth附刷新指引', async function() {
+        let h1 = mkCodexHome('nocred', null)
+        let h2 = mkCodexHome('apikey-http', { OPENAI_API_KEY: 'sk-xxx' })
+        let h3 = mkCodexHome('expired', { tokens: { access_token: 'tok-401', id_token: mkJwt({ email: 'old@example.com' }) } })
+        let o = { useAppServer: false, env: {}, usageUrl: svr.usageUrlCodex, timeoutMs: 5000 }
+        let r1 = await getQuotaCodex('', { ...o, codexHome: h1 })
+        let r2 = await getQuotaCodex('', { ...o, codexHome: h2 })
+        let r3 = await getQuotaCodex('', { ...o, codexHome: h3 })
+        let rr = [
+            [r1.ok, r1.errorType, /auth\.json/.test(r1.error)],
+            [r2.ok, r2.errorType, /API key mode/.test(r2.error)],
+            [r3.ok, r3.errorType, r3.email, /run any codex command/.test(r3.error), /tok-401/.test(r3.error)],
+        ]
+        //401時仍以id_token指出本機綁定帳號; 錯誤訊息不外洩權杖
+        assert.strict.deepEqual(rr, [[false, 'notfound', true], [false, 'unsupported', true], [false, 'auth', 'old@example.com', true, false]])
+    })
+
+    it('HTTP備援之env注入: OPENAI_API_KEY僅存在於env時亦判為API key模式', async function() {
+        let codexHome = mkCodexHome('apikey-env', {})
+        let r = await getQuotaCodex('', { useAppServer: false, env: { OPENAI_API_KEY: 'sk-yyy' }, codexHome, usageUrl: svr.usageUrlCodex, timeoutMs: 5000 })
+        let rr = [r.ok, r.errorType]
+        assert.strict.deepEqual(rr, [false, 'unsupported'])
+    })
+
+    it('帳號比對: 不符時ok為false、matched為false且額度仍回傳', async function() {
+        let r = await getQuotaCodex('someone-else@example.com', { exe: mkFake('ok'), env: {}, timeoutMs: 20000 })
+        let rr = [r.ok, r.matched, r.errorType, r.windows.length, /codex-user@example.com/.test(r.error)]
+        assert.strict.deepEqual(rr, [false, false, 'account', 3, true])
+    })
+
+})

package/test/unit-readJsonOrNull.test.mjs

@@ -0,0 +1,44 @@
+import fs from 'fs'
+import path from 'path'
+import { fileURLToPath } from 'url'
+import assert from 'assert'
+import readJsonOrNull from '../src/quota/readJsonOrNull.mjs'
+
+
+//產物落test/tmp/(同fakeCliForTest慣例), 測試結束清除
+let FD = path.resolve(path.dirname(fileURLToPath(import.meta.url)), 'tmp', 'read-json-or-null')
+
+
+describe('readJsonOrNull', function() {
+
+    before(function() {
+        fs.mkdirSync(FD, { recursive: true })
+    })
+
+    after(function() {
+        fs.rmSync(FD, { recursive: true, force: true })
+        try {
+            fs.rmdirSync(path.dirname(FD))
+        }
+        catch (e) {}
+    })
+
+    it('合法JSON回解析值(物件或陣列皆可)', function() {
+        let fp1 = path.join(FD, 'a.json')
+        let fp2 = path.join(FD, 'b.json')
+        fs.writeFileSync(fp1, '{"a":1,"b":{"c":[1,2]}}', 'utf8')
+        fs.writeFileSync(fp2, '[1,2,3]', 'utf8')
+        let r = [readJsonOrNull(fp1), readJsonOrNull(fp2)]
+        let rr = [{ a: 1, b: { c: [1, 2] } }, [1, 2, 3]]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('檔案不存在、內容非JSON、路徑無效皆回null不throw(三種情形對呼叫端皆為「取不到」)', function() {
+        let fp = path.join(FD, 'broken.json')
+        fs.writeFileSync(fp, '{ not json', 'utf8')
+        let r = [readJsonOrNull(path.join(FD, 'nope.json')), readJsonOrNull(fp), readJsonOrNull(''), readJsonOrNull(null)]
+        let rr = [null, null, null, null]
+        assert.strict.deepEqual(r, rr)
+    })
+
+})

package/test/unit-toQuotaLabel.test.mjs

@@ -0,0 +1,43 @@
+import assert from 'assert'
+import toQuotaLabel from '../src/quota/toQuotaLabel.mjs'
+import toQuotaScopedLabel from '../src/quota/toQuotaScopedLabel.mjs'
+
+
+describe('toQuotaLabel', function() {
+
+    it('由窗口秒數推導中文標籤: 整除者取最大單位(天>小時>分鐘), 皆不整除則秒', function() {
+        let r = [toQuotaLabel(604800), toQuotaLabel(18000), toQuotaLabel(900), toQuotaLabel(90), toQuotaLabel(86400), toQuotaLabel(3600)]
+        let rr = ['7天', '5小時', '15分鐘', '90秒', '1天', '1小時']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('無效或非正數回傳空字串(呼叫端據此判斷供應商未提供窗口長度)', function() {
+        let r = [toQuotaLabel(null), toQuotaLabel(undefined), toQuotaLabel(0), toQuotaLabel(-5), toQuotaLabel('abc'), toQuotaLabel({})]
+        let rr = ['', '', '', '', '', '']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('數值字串亦可推導(供應商可能回字串型秒數)', function() {
+        let r = toQuotaLabel('18000')
+        let rr = '5小時'
+        assert.strict.deepEqual(r, rr)
+    })
+
+})
+
+
+describe('toQuotaScopedLabel', function() {
+
+    it('有範圍時為「基底(範圍)」, 基底取自toQuotaLabel(單一來源, 窗口變動標籤自動正確)', function() {
+        let r = [toQuotaScopedLabel(604800, 'Fable'), toQuotaScopedLabel(18000, 'Gemini Models')]
+        let rr = ['7天(Fable)', '5小時(Gemini Models)']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('有範圍但窗口秒數無效時僅以範圍為標籤; 無範圍回傳空字串令toQuotaWindow自行推導', function() {
+        let r = [toQuotaScopedLabel(null, 'codex-spark'), toQuotaScopedLabel(18000, ''), toQuotaScopedLabel(18000, null)]
+        let rr = ['codex-spark', '', '']
+        assert.strict.deepEqual(r, rr)
+    })
+
+})

package/test/unit-toQuotaResult.test.mjs

@@ -0,0 +1,53 @@
+import assert from 'assert'
+import toQuotaResult from '../src/quota/toQuotaResult.mjs'
+
+
+describe('toQuotaResult', function() {
+
+    it('未指定emailWant時不比對(matched為null), ok僅取決於查詢本身', function() {
+        let r1 = toQuotaResult('claude', { email: 'a@b.com', windows: [{ key: 'x' }] })
+        let r2 = toQuotaResult('claude', { email: 'a@b.com', error: 'boom', errorType: 'http' })
+        let r = [[r1.ok, r1.matched, r1.windows.length], [r2.ok, r2.matched, r2.errorType]]
+        let rr = [[true, null, 1], [false, null, 'http']]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('帳號比對去空白且不分大小寫; 不符時ok為false但額度資料仍回傳, error載明本機實際帳號', function() {
+        let r1 = toQuotaResult('codex', { email: 'User@Example.com', emailWant: ' user@example.com ', windows: [{ key: 'x' }] })
+        let r2 = toQuotaResult('codex', { email: 'a@b.com', emailWant: 'c@d.com', windows: [{ key: 'x' }] })
+        let r = [
+            [r1.ok, r1.matched],
+            [r2.ok, r2.matched, r2.errorType, r2.windows.length, r2.error],
+        ]
+        let rr = [
+            [true, true],
+            [false, false, 'account', 1, 'local codex login account is [a@b.com], which does not match the requested account [c@d.com]'],
+        ]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('指定emailWant但無從取得本機帳號時視為不符並補述原因(errorType為account)', function() {
+        let r1 = toQuotaResult('antigravity', { emailWant: 'a@b.com' })
+        let r = [r1.ok, r1.matched, r1.errorType, r1.error]
+        let rr = [false, false, 'account', 'cannot determine the local antigravity login account, so it is unknown whether it is the requested account [a@b.com]']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('已有查詢錯誤時不以帳號比對訊息覆蓋之', function() {
+        let r1 = toQuotaResult('claude', { emailWant: 'a@b.com', error: 'unauthorized(401)', errorType: 'auth' })
+        let r = [r1.ok, r1.matched, r1.error, r1.errorType]
+        let rr = [false, false, 'unauthorized(401)', 'auth']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('回傳鍵名固定且無效輸入回退預設', function() {
+        let r1 = toQuotaResult(null, { windows: 'bad', plan: 123, credits: undefined })
+        let r = [Object.keys(r1), r1.provider, r1.windows, r1.plan, r1.credits, r1.raw, r1.durationMs]
+        let rr = [
+            ['ok', 'provider', 'email', 'matched', 'plan', 'planTier', 'source', 'windows', 'credits', 'raw', 'error', 'errorType', 'durationMs'],
+            '', [], '', null, null, 0,
+        ]
+        assert.strict.deepEqual(r, rr)
+    })
+
+})

package/test/unit-toQuotaWindow.test.mjs

@@ -0,0 +1,73 @@
+import assert from 'assert'
+import toQuotaWindow from '../src/quota/toQuotaWindow.mjs'
+
+
+describe('toQuotaWindow', function() {
+
+    it('正規化基本欄位: label由windowSeconds推導, remainingPercent由usedPercent推得', function() {
+        let w = toQuotaWindow({ key: 'five_hour', windowSeconds: 18000, usedPercent: 11 })
+        let r = [w.key, w.label, w.windowSeconds, w.usedPercent, w.remainingPercent, w.scope, w.active, w.severity]
+        let rr = ['five_hour', '5小時', 18000, 11, 89, '', false, 'normal']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('usedPercent夾至0~100且未知時remainingPercent同為null(不假造100)', function() {
+        let w1 = toQuotaWindow({ usedPercent: 150 })
+        let w2 = toQuotaWindow({ usedPercent: -3 })
+        let w3 = toQuotaWindow({})
+        let r = [[w1.usedPercent, w1.remainingPercent], [w2.usedPercent, w2.remainingPercent], [w3.usedPercent, w3.remainingPercent]]
+        let rr = [[100, 0], [0, 100], [null, null]]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('resetAt接受ISO字串或unix秒數, 一律轉ISO字串並補算resetAfterSeconds', function() {
+        let future = Math.floor(Date.now() / 1000) + 3600
+        let w1 = toQuotaWindow({ resetAt: future })
+        let w2 = toQuotaWindow({ resetAt: '2099-01-01T00:00:00.000Z' })
+        let w3 = toQuotaWindow({ resetAt: 'not-a-date' })
+        let r = [
+            w1.resetAt === new Date(future * 1000).toISOString(),
+            w1.resetAfterSeconds >= 3598 && w1.resetAfterSeconds <= 3600,
+            w2.resetAt,
+            w2.resetAfterSeconds > 0,
+            w3.resetAt,
+            w3.resetAfterSeconds,
+        ]
+        let rr = [true, true, '2099-01-01T00:00:00.000Z', true, '', null]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('只給resetAfterSeconds時反推resetAt; 已過期之resetAt其resetAfterSeconds夾為0', function() {
+        let w1 = toQuotaWindow({ resetAfterSeconds: 120 })
+        let w2 = toQuotaWindow({ resetAt: '2000-01-01T00:00:00.000Z' })
+        let dt = Math.round((new Date(w1.resetAt).getTime() - Date.now()) / 1000)
+        let r = [dt >= 118 && dt <= 120, w1.resetAfterSeconds, w2.resetAfterSeconds]
+        let rr = [true, 120, 0]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('severity: 供應商有給即用之; 未給則由usedPercent推導(用罄exhausted/其餘normal/未知空字串)——三家對稱', function() {
+        let r = [
+            toQuotaWindow({ usedPercent: 50, severity: 'warning' }).severity,
+            toQuotaWindow({ usedPercent: 50 }).severity,
+            toQuotaWindow({ usedPercent: 100 }).severity,
+            toQuotaWindow({}).severity,
+        ]
+        let rr = ['warning', 'normal', 'exhausted', '']
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('明給label優先於推導; scope與active原樣保留', function() {
+        let w = toQuotaWindow({ windowSeconds: 604800, label: '7天(Fable)', scope: 'Fable', active: true })
+        let r = [w.label, w.scope, w.active]
+        let rr = ['7天(Fable)', 'Fable', true]
+        assert.strict.deepEqual(r, rr)
+    })
+
+    it('回傳鍵名固定', function() {
+        let r = Object.keys(toQuotaWindow({}))
+        let rr = ['key', 'label', 'windowSeconds', 'usedPercent', 'remainingPercent', 'resetAt', 'resetAfterSeconds', 'scope', 'active', 'severity']
+        assert.strict.deepEqual(r, rr)
+    })
+
+})