@hk_net/pi-usage-bars 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased
+
+## [0.4.1] - 2026-07-31
+
+### Fixed
+
+- Classify Codex quota windows by `limit_window_seconds` instead of assuming `primary_window` is always the session limit. Codex accounts that expose only a seven-day primary window now show it as Weekly and no longer display a fabricated `Session 0%` lane.
+
+### Changed
+
+- Updated the development and test baseline to Pi SDK 0.83.0 while retaining runtime compatibility with Pi 0.81.1 and newer.
+
 ## [0.4.0] - 2026-07-22
 
 ### Added

package/README.md

@@ -124,3 +124,4 @@ This extension is based on and inspired by:
 
 - [CodexBar](https://github.com/steipete/CodexBar)
 - [rho usage-bars](https://github.com/mikeyobrien/rho/tree/main/extensions/usage-bars)
+- [ajarellanod/pi-usage-bars](https://github.com/ajarellanod/pi-usage-bars)

package/docs/releasing.md

@@ -2,105 +2,83 @@
 
 This repository uses semantic versions. The package version, changelog heading, Git tag, and npm version must agree.
 
-The npm publish workflow is manual-only. Pushing a Git tag does not publish the package, which prevents a tag pushed after a local npm release from attempting to publish the same version twice.
+Local publication uses npm browser authentication. The GitHub Actions publish workflow is manual-only; pushing a tag does not publish the package.
 
 ## Prerequisites
 
 - Write access to `hknet/pi-usage-bars`.
 - Publish access to the npm scope `@hk_net`.
-- npm authentication for the `hk_net` account (`npm whoami`).
 - Node.js 22.19 or newer.
-- Bun 1.3.0. The commands below use a temporary pinned Bun installation, so a global Bun installation is not required.
+- A clean, synchronized `main` branch.
 
-Never place an npm token in the repository, command history, or endpoint override. Complete npm's browser or OTP authorization when prompted.
+Never place an npm token in the repository, command history, or endpoint configuration. Complete npm's browser or OTP authorization when prompted.
 
-## 1. Verify the source release
+## Recommended release script
 
-From the repository root:
+From the repository root, provide the exact new semantic version:
 
 ```bash
-git switch main
-git pull --ff-only origin main
-git status --short
-node -p "require('./package.json').version"
+cd /path/to/pi-usage-bars
+scripts/release.sh 0.4.1
 ```
 
-For this release, the version must be `0.4.0` and the working tree must be clean.
+This **default command only prepares the release**. It deliberately stops before npm login or publication, so the pushed release commit can be reviewed first. The launcher first executes an immutable temporary copy of itself, so editing the script while a release is running cannot corrupt that run.
 
-Run the same checks used by CI and npm's `prepublishOnly` hook:
+Preparation:
 
-```bash
-npx --yes --package bun@1.3.0 -- npm run check
-npm audit --omit=dev --audit-level=high
-npm pack --dry-run
-```
-
-Expected results for `0.4.0`:
+1. verifies that `main` is clean and synchronized with `origin/main`;
+2. rejects an existing npm version or Git tag;
+3. updates `package.json` and `package-lock.json` without creating an early tag;
+4. promotes the `Unreleased` changelog entries into a dated release while preserving an empty `Unreleased` heading;
+5. installs dependencies with `npm ci --no-audit`, provisions a temporary pinned Bun binary, and runs typecheck, tests, detailed dependency audits, and package dry-run; and
+6. commits and pushes the release source.
 
-- strict TypeScript check passes;
-- 32 tests pass;
-- Pi smoke test passes;
-- production audit has no vulnerabilities;
-- the dry-run package is `@hk_net/pi-usage-bars@0.4.0` and contains the extension, documentation, changelog, and license.
-
-## 2. Verify npm state
+After reviewing the prepared commit, stage it for browser approval:
 
 ```bash
-npm whoami
-npm view @hk_net/pi-usage-bars version
+scripts/release.sh 0.4.1 stage
 ```
 
-Before publishing `0.4.0`, the registry should still report `0.3.0`. If it already reports `0.4.0`, do not publish it again.
+`stage` submits the package to npm's staged-publishing queue. It **does not publish live**, does not open a browser, and does not tag Git. If npm authentication is needed, run `npm login --auth-type=web` manually first.
 
-Optionally inspect exactly what npm will receive:
+In [npmjs.com](https://www.npmjs.com), open **Staged Packages**, review the staged tarball, and click **Approve**. npm prompts for 2FA during approval. After npm shows the version as live, finalize the release:
 
 ```bash
-npm pack --dry-run --json
+scripts/release.sh 0.4.1 finalize
 ```
 
-## 3. Publish manually
+`finalize` refuses to run until the exact version is live in the npm registry. It then verifies registry metadata and creates/pushes the annotated Git tag. It never stages or publishes a package.
 
-Local npm publication cannot use GitHub's OIDC provenance attestation, so explicitly disable provenance for this manual release:
+Use `--yes` only for attended preparation:
 
 ```bash
-npx --yes --package bun@1.3.0 -- \
-  npm publish --access public --provenance=false
+scripts/release.sh 0.4.1 --yes  # prepare only
 ```
 
-The `prepublishOnly` hook reruns the complete check. Complete the npm browser/OTP authorization if requested. Do not retry blindly after an ambiguous network failure; verify the registry first.
+## Recovery
+
+Staging and finalization are safe to rerun: `stage` refuses if the exact version is already live, and `finalize` refuses until it is live. Never force-push a release tag.
+
+The release script first prints a full dependency audit with package names, dependency paths, affected ranges, and available fixes. This is informational because it includes development-only dependencies. It then runs a blocking production-only audit, which rejects high or critical production findings.
 
-## 4. Verify the published package
+Show script help with:
 
 ```bash
-npm view @hk_net/pi-usage-bars version dist-tags.latest
-npm view @hk_net/pi-usage-bars@0.4.0 dist.integrity
+scripts/release.sh --help
 ```
 
-Both version values should report `0.4.0`, and the integrity field should be present.
+## Post-release verification
 
-Test installation or update through Pi:
+Confirm installation through Pi:
 
 ```bash
 pi install npm:@hk_net/pi-usage-bars
-# If it is already installed:
+# If already installed from npm:
 pi update npm:@hk_net/pi-usage-bars
 ```
 
 Restart Pi, or use `/reload`, then run `/usage`.
 
-## 5. Tag the verified source
-
-Only tag after npm verification succeeds:
-
-```bash
-git switch main
-git pull --ff-only origin main
-git tag -a v0.4.0 -m "Release v0.4.0"
-git push origin v0.4.0
-```
-
-The tag does not trigger npm publication. It records the exact source corresponding to the already-published package. A GitHub release can then be created from `v0.4.0` using the `0.4.0` changelog section.
-
-## CI publishing alternative
+## GitHub Actions alternative
 
-The **Publish to npm (manual)** GitHub Actions workflow remains available as an alternative. It requires the `NPM_TOKEN` repository secret and publishes with npm provenance. Do not run it after publishing the same version locally.
+The **Publish to npm (manual)** workflow is available as an alternative. It requires the `NPM_TOKEN` repository secret and publishes with npm provenance. Do not run it after publishing the same version locally.

package/extensions/usage-bars/core.ts

@@ -56,6 +56,7 @@ export interface UsageData {
   extraLimit?: number;
   sessionLabel?: string;
   weeklyLabel?: string;
+  sessionHidden?: boolean;
   weeklyHidden?: boolean;
   notice?: string;
   warning?: string;
@@ -470,6 +471,7 @@ function snapshotUsage(usage: UsageData, nowMs = Date.now()): UsageData {
     extraLimit: usage.extraLimit,
     sessionLabel: usage.sessionLabel,
     weeklyLabel: usage.weeklyLabel,
+    sessionHidden: usage.sessionHidden,
     weeklyHidden: usage.weeklyHidden,
     notice: usage.notice,
     fetchedAt: usage.fetchedAt ?? nowMs,
@@ -520,6 +522,41 @@ function readClaudeCacheOutcome(cacheFile = DEFAULT_USAGE_CACHE_FILE, nowMs = Da
   return null;
 }
 
+export function parseCodexRateLimit(data: any): UsageData {
+  const rateLimit = data?.rate_limit ?? data?.rate_limits;
+  const primary = rateLimit?.primary_window ?? rateLimit?.primary ?? rateLimit?.five_hour;
+  const secondary = rateLimit?.secondary_window ?? rateLimit?.secondary ?? rateLimit?.weekly;
+
+  let sessionWindow: any = null;
+  let weeklyWindow: any = null;
+  for (const [position, window] of [["primary", primary], ["secondary", secondary]] as const) {
+    if (!window || typeof window !== "object") continue;
+    const duration = window.limit_window_seconds;
+    if (typeof duration === "number" && Number.isFinite(duration)) {
+      // Some Codex accounts return their seven-day quota as primary_window
+      // and omit secondary_window, so position alone does not identify it.
+      if (duration >= 2 * 24 * 60 * 60) weeklyWindow ??= window;
+      else sessionWindow ??= window;
+    } else if (position === "primary") {
+      sessionWindow ??= window;
+    } else {
+      weeklyWindow ??= window;
+    }
+  }
+
+  const reset = (window: any) =>
+    typeof window?.reset_after_seconds === "number" ? formatDuration(window.reset_after_seconds) : undefined;
+
+  return {
+    session: readPercentCandidate(sessionWindow?.used_percent) ?? 0,
+    weekly: readPercentCandidate(weeklyWindow?.used_percent) ?? 0,
+    ...(!sessionWindow ? { sessionHidden: true } : {}),
+    ...(!weeklyWindow ? { weeklyHidden: true } : {}),
+    sessionResetsIn: reset(sessionWindow),
+    weeklyResetsIn: reset(weeklyWindow),
+  };
+}
+
 export async function fetchCodexUsage(token: string, config: RequestConfig = {}): Promise<UsageData> {
   const result = await requestJson(
     "https://chatgpt.com/backend-api/wham/usage",
@@ -527,16 +564,7 @@ export async function fetchCodexUsage(token: string, config: RequestConfig = {})
     config,
   );
   if (!result.ok) return { session: 0, weekly: 0, error: result.error };
-
-  const data = result.data as any;
-  const primary = data?.rate_limit?.primary_window;
-  const secondary = data?.rate_limit?.secondary_window;
-  return {
-    session: readPercentCandidate(primary?.used_percent) ?? 0,
-    weekly: readPercentCandidate(secondary?.used_percent) ?? 0,
-    sessionResetsIn: typeof primary?.reset_after_seconds === "number" ? formatDuration(primary.reset_after_seconds) : undefined,
-    weeklyResetsIn: typeof secondary?.reset_after_seconds === "number" ? formatDuration(secondary.reset_after_seconds) : undefined,
-  };
+  return parseCodexRateLimit(result.data);
 }
 
 async function fetchClaudeUsageAttempt(

package/extensions/usage-bars/index.ts

@@ -256,12 +256,14 @@ class UsageSelectorComponent extends Container implements Focusable {
       const weeklyLabel = (item.data.weeklyLabel ?? "Weekly").slice(0, 9).padEnd(10);
 
       if (!item.data.quotaHidden) {
-        this.listContainer.addChild(new Text(
-          indent + theme.fg("muted", sessionLabel) + this.renderBar(session) + " " +
-            theme.fg(colorForPercent(session), `${session}%`.padStart(4)) + sessionReset,
-          0,
-          0,
-        ));
+        if (!item.data.sessionHidden) {
+          this.listContainer.addChild(new Text(
+            indent + theme.fg("muted", sessionLabel) + this.renderBar(session) + " " +
+              theme.fg(colorForPercent(session), `${session}%`.padStart(4)) + sessionReset,
+            0,
+            0,
+          ));
+        }
         if (!item.data.weeklyHidden) {
           this.listContainer.addChild(new Text(
             indent + theme.fg("muted", weeklyLabel) + this.renderBar(weekly) + " " +
@@ -459,15 +461,22 @@ export default function (pi: ExtensionAPI): void {
         : data.sessionLabel === "Key limit"
           ? "L "
           : "S ";
-    const weeklyStatus = data.weeklyHidden
-      ? ""
-      : theme.fg("muted", " W ") + renderBar(theme, weekly) + " " + renderPercent(theme, weekly) +
-        (data.weeklyResetsIn ? theme.fg("dim", ` ⟳ ${data.weeklyResetsIn}`) : "");
+    const quotaLanes: string[] = [];
+    if (!data.sessionHidden) {
+      quotaLanes.push(
+        theme.fg("muted", sessionPrefix) + renderBar(theme, session) + " " + renderPercent(theme, session) +
+          (data.sessionResetsIn ? theme.fg("dim", ` ⟳ ${data.sessionResetsIn}`) : ""),
+      );
+    }
+    if (!data.weeklyHidden) {
+      quotaLanes.push(
+        theme.fg("muted", "W ") + renderBar(theme, weekly) + " " + renderPercent(theme, weekly) +
+          (data.weeklyResetsIn ? theme.fg("dim", ` ⟳ ${data.weeklyResetsIn}`) : ""),
+      );
+    }
     const status =
       theme.fg("dim", `${label} `) +
-      theme.fg("muted", sessionPrefix) + renderBar(theme, session) + " " + renderPercent(theme, session) +
-      (data.sessionResetsIn ? theme.fg("dim", ` ⟳ ${data.sessionResetsIn}`) : "") +
-      weeklyStatus +
+      quotaLanes.join(" ") +
       (data.accountBalance ? theme.fg("muted", ` · ${formatAccountBalance(data.accountBalance)}`) : "") +
       (data.accountSpend?.monthly === undefined
         ? ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hk_net/pi-usage-bars",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Quota, balance, and spend indicators for current Pi providers",
   "keywords": [
     "pi-package",
@@ -40,8 +40,7 @@
   "scripts": {
     "test": "bun test tests",
     "typecheck": "tsc --noEmit",
-    "smoke": "pi -e ./extensions/usage-bars/index.ts --list-models",
-    "check": "npm run typecheck && npm test && npm run smoke",
+    "check": "npm run typecheck && npm test",
     "prepublishOnly": "npm run check"
   },
   "engines": {
@@ -52,8 +51,8 @@
     "@earendil-works/pi-tui": ">=0.81.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "0.81.1",
-    "@earendil-works/pi-tui": "0.81.1",
+    "@earendil-works/pi-coding-agent": "0.83.0",
+    "@earendil-works/pi-tui": "0.83.0",
     "@types/bun": "1.3.14",
     "@types/node": "24.13.3",
     "typescript": "5.9.3"