Repository navigation
feat(quota-plane): browser-token adapter framework — managed credentials, fail-closed dashboard-API clients #1153
Description
Priority P0 — order 2. Horizon: Week. Design: quota-plane-design-2026-10-26.md (usage-billing-hub goal files), Stage 2. Parent context: epic #1047. (§1, adapter framework; builds on #1115's pattern — this is its implementation vehicle for Stage 2)
The shared browser-token adapter framework: credential = dashboard session token/cookie captured once at login, held as a managed quota credential (0600 file contract and/or Bitwarden); client calls the same undocumented endpoints the provider's dashboard SPA calls; parsing is fail-closed (schema drift -> "unparseable", previous value ages, never zeros); a session health check (get-session equivalent) distinguishes "expired — re-login needed" from zero usage and raises the re-login as a user/owned item instead of failing silently. Includes the file-export ingest path (a dated-reads file written on the session-holding machine, same quota-current contract, source labelled file-export).
Acceptance: framework + one working adapter (developer's pick of the easiest dashboard API) + tests for drift/expiry behavior.
Acceptance criteria
- A shared browser-token adapter framework exists: dashboard session credentials are captured once at login and held as managed quota credentials (0600 file contract and/or Bitwarden), never in repo files.
- Adapter clients call the same endpoints the provider dashboard SPA calls, and parsing is fail-closed: schema drift yields "unparseable" and the previous value ages — never a zero.
- A session health check distinguishes "expired — re-login needed" from zero usage, and raises the re-login as a
user/owneditem instead of failing silently. - The file-export ingest path works: a dated-reads file written on the session-holding machine is ingested under the same quota-current contract, with source labelled file-export.
- At least one working adapter (developer's pick of the easiest dashboard API) runs on the framework, with tests covering the drift and expiry behaviours.
Activity
developing-today commentedon Oct 27, 2026
CODE-289
dezren39 commentedon Oct 27, 2026
REVIEW FINDING (2026-10-26, Muse review of the fork-ecosystem quota subcommand at Drew's direction): the starting point already exists — do NOT build a new framework. OpenChamber's quota module (devtoday-openchamber, packages/web/server/lib/quota) is a registry-pattern adapter library with ~30 providers, a managed-credential store with validators (routes.js: exe-dev, cursor, zenmux, opendesign), per-credential fetching, and the
openchamber quotaCLI (PRs #474/#475/#481/#484/#520). It already implements Drew's pattern: e.g. opencode-go calls the undocumented console APIs (opencode.ai/console/api/go/status), codex calls chatgpt.com/backend-api/wham/usage, claude calls api.anthropic.com/api/oauth/usage with the stored OAuth credential, antigravity calls cloudcode-pa v1internal:retrieveUserQuotaSummary.Re-scope this issue to: adopt this module as the adapter framework; harden it for unattended 15-min use (timeouts, per-adapter isolation at the library level, schema-drift tests); fill the two registry gaps — there is NO meta provider and NO command-code provider in the catalogue.
dezren39 commentedon Oct 27, 2026
CORRECTION (2026-10-26 23:2x CDT, per Drew — my earlier wording was wrong): "no meta provider / no command-code provider" was imprecise. Precise state:
Also live-verified in the same pass: with opencode-serve restored,
openchamber quota --jsonreturns per-provider results — cline-pass ok, deepseek ok, opencode-go ok, openai.alternate ok; claude ERRORS "session expired" (credential present, needs re-login — a fixable state, tracked in the resilience issue filed alongside this comment).dezren39 commentedon Oct 28, 2026
Intake review
Fleet monitor intake pass, 2026-10-28. Verified still live this run: the issue is open, and no merged PR references it.
Related: Parent epic #1047 and the Stage 2 epic #1149 are the surrounding context named in the body; this item builds on #1115's pattern as its Stage 2 implementation vehicle. Sibling pm-stack items #1141-#1150 were filed from the same 2026-10-26 review.
Notes / risks: This is the framework slice, not a single-provider fix: the fail-closed parsing and the expired-vs-zero distinction are the parts that must not be simplified away — a silent zero or a silent expiry is exactly the failure the quota plane exists to prevent. Credential handling is the risk surface: managed credentials only (0600/Bitwarden), nothing in repo files.
Suggested approach: Start from #1115's working pattern, extract the shared framework (credential home, health check, fail-closed parser contract, file-export ingest), then prove it with the easiest dashboard API as the first adapter, with drift/expiry tests from the start.
Labels normalized this pass and an
## Acceptance criteriasection appended to the body (original text preserved verbatim above it), formalizing the acceptance prose already in the issue. Markedmeta/enriched.25 remaining items
dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 2, 2026
🤖 Agent note · done
State on current main
23c2c514bpm-stack/aggregator/src/token-adapter.ts(landed in PR feat(quota-plane): browser-token adapter framework core + file-export adapter (#1153) #2115, commit48e9aebcf, task 3044, 2026-10-29) implements the acceptance core — credential contract (Bitwarden-by-name or mode-0600 file references only; value-carrying refs rejected), fail-closedcollectAdapter(schema drift →unparseable, previous value retained and aged, never zeroed), session-health classification (classifyHttpProbe: 401/403/auth-bounce = expired ≠ zero usage), and the file-export source re-expressed as the framework's first adapter over the feat(quota-plane): quota-gatherer service in the PM stack — 15-minute tick, quota-current contract #1151 mapping (later hardened by aggregator(token-adapter): file-export adapter's fail-closed window check throws on a null window element and accepts a non-string window name, instead of returning the retained unparseable outcome #2551).bun test test/token-adapter.test.ts— 26 pass, 0 fail, covering drift, expiry-vs-zero, and file-export paths.Remainder — already tracked, not new work for a packet
session-expiredas auser/ownedre-login item in the Needs-you flow — lands with those issues, as the PR feat(quota-plane): browser-token adapter framework core + file-export adapter (#1153) #2115 disposition note recorded.dezren39 commentedon Nov 2, 2026
🤖 Agent note · correction (lane E shift, post-shift)
bun test test/token-adapter.test.tson current main is 15 pass, 0 fail (48 expect() calls, 1 file) — the "26 pass" figure in the verdict note came from a mismatched tool output during the shift. The verdict itself is unchanged: the framework core exists, its tests all pass, and the remainder stays with issues feat(quota-plane): adapter — ClinePass via dashboard session token #1159/feat(quota-plane): adapter — OpenCode Go console, per-workspace windows #1161/feat(quota-plane): adapter — Claude via claude.ai session (usage API) #1163/feat(quota-plane): adapter — Command Code via CLI/app credential #1165.developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 7197 (triage, queued, priority 70) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03