Module detect 

Local credential detection — the seed for auto-enabling vendors.

A fresh install shows the four default vendors and nothing else, even when the machine already carries a Cursor login, a Kiro database, a gh OAuth session, or a KILO_API_KEY. This module answers “which vendors could fetch right now with what is already on disk?” cheaply enough to run at every frontend start, and turns the answer into a minimal edit of config.toml: enabled = true for the vendors that have credentials and are not enabled yet. It never writes false and never removes anything — the config stays the user’s own.

Two pieces, mirroring OpenUsage’s hasLocalCredentials + FirstRunSeeder/NewProviderSeeder:

• has_local_credentials is the per-vendor probe. Files, sqlite, saved keys, env vars, local port discovery — never the network, never a token refresh, never a cache directory or lock file. It reuses the same resolvers build_outcome reads through, so “detected” means “the fetch would at least find its credential”.
• DetectState remembers which vendors have already been considered, so a vendor the user deliberately disabled after it was auto-enabled stays disabled: it is only ever auto-enabled the first time it is seen. New vendors added by an upgrade are not in known and get their one chance. plan is the pure decision; run_once is the whole cycle.

Structs

DetectPlan

What one detection pass decided.

DetectReport

What one full run_once_with cycle did — the CLI’s report and the serialized shape of detect --json (vendors as slugs, no secrets).

DetectState

Which vendors detection has already had its one look at. Persisted as JSON next to the vendor caches; a vendor in known is never auto-enabled again, so a user’s later enabled = false sticks.

Functions

default_state_path

<cache dir>/ai-usagebar/detect.json — beside the per-vendor caches, because it is derived state that can be deleted to re-run detection.

format_report

Human-readable detect output. config_hint is where the enables were written, shown only when something was enabled.

has_local_credentials

Cheap, local-only probe: files, sqlite, saved keys, env vars. Never the network. true means the vendor’s fetch would find a credential — not that the credential is still valid, which only the wire can tell.

plan

The pure decision. Candidates are all minus state.known, or every vendor in all when force. A candidate is enabled when probe says it has credentials and the config doesn’t already enable it. known becomes the union of the old set and all, in VendorId::all order, deduped — so a vendor is considered once per install, and once more per force.

run_cli

ai-usagebar detect [--all] [--json]: one-shot local credential detection as a command, so any frontend (or the user) can run it at startup. Uses the real config and state paths — tests go through run_once_with and format_report instead.

run_once

One full detection cycle: load the config (config_path, or the resolved default), load the state at state_path, plan with has_local_credentials, write the enables into the config, save the state, and return what was enabled.

run_once_report

run_once keeping the whole DetectReport — what the detect subcommand prints. Same real probe, same catch_unwind guard.

run_once_with

run_once_report with the probe injected — the test seam, so the cycle’s config write and state bookkeeping can be exercised without a probe that reads this machine’s real credential files.