@hk_net/pi-usage-bars 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -1,103 +1,123 @@
-# Changelog
-
-## Unreleased
-
-## [0.4.2] - 2026-08-13
-
-### Fixed
-
-- Added support for credit-based ZAI plan tiers that report `CREDIT_LIMIT` quota windows. Thanks to [@chrislucca](https://github.com/chrislucca) for the contribution in [#1](https://github.com/hknet/pi-usage-bars/pull/1).
-
-### Changed
-
-- Updated the development and test baseline to Pi SDK 0.84.1 while retaining runtime compatibility with Pi 0.81.1 and newer.
-
-### Security
-
-- Updated the Pi SDK development dependency chain to use `undici` 8.9.0, resolving the advisories affecting earlier 8.x releases.
-
-## [0.4.1] - 2026-07-31
-
-### Fixed
-
-- Classify Codex quota windows by `limit_window_seconds` instead of assuming `primary_window` is always the session limit. Codex accounts that expose only a seven-day primary window now show it as Weekly and no longer display a fabricated `Session 0%` lane.
-
-### Changed
-
-- Updated the development and test baseline to Pi SDK 0.83.0 while retaining runtime compatibility with Pi 0.81.1 and newer.
-
-## [0.4.0] - 2026-07-22
-
-### Added
-
-- Added Kimi For Coding quota support through Pi's `kimi-coding` credential and the first-party five-hour/weekly usage endpoint.
-- Added separate MiniMax Global and China Coding/Token Plan support, including the current token-plan endpoint and legacy coding-plan fallback.
-- Added provider-specific quota labels and support for MiniMax responses that expose an interval quota without a weekly quota.
-- Added neutral MiniMax purchased-Credits balance rendering when a key-authenticated first-party response exposes a balance.
-- Added OpenRouter account balance and daily/weekly/monthly key spend using the first-party Credits and Key APIs.
-- Added OpenRouter per-key limit bars only when the key has a real configured credit limit.
-- Added DeepSeek total, topped-up, and granted balance support through the official key-authenticated balance API.
-- Added separate Moonshot/Kimi API Global and China available, cash, and voucher balance support.
-- Added a typed financial-metrics roadmap for further balance/spend providers.
-- Added provider parsing, regional routing, endpoint fallback, financial rendering, authentication lifecycle, and smoke tests.
-- Added CI, reproducible installs, production auditing, and a maintainer release guide.
-
-### Changed
-
-- Treat MiniMax status `2062` as a neutral “No active Token Plan” account state rather than an API error; the cookie-only console balance endpoint remains out of scope.
-- Expanded endpoint configuration documentation for Kimi, MiniMax, OpenRouter, DeepSeek, and Moonshot.
-- Changed npm publishing to an explicit manual workflow so source tags cannot accidentally republish an already released version.
-- Bumped the package version to 0.4.0.
-
-## [0.3.0] - 2026-07-22
-
-### Breaking changes
-
-- Renamed the npm package to `@hk_net/pi-usage-bars`; install it with `pi install npm:@hk_net/pi-usage-bars`.
-- Updated the minimum supported Pi release to 0.81.1.
-- Removed Google Gemini CLI and Google Antigravity usage support, matching their removal from Pi 0.71.0.
-- Refactored core usage orchestration to accept resolved provider tokens instead of reading or refreshing Pi credentials directly.
-
-### Added
-
-- Added ZAI Coding Plan (China) provider and quota endpoint support.
-- Added abort-aware polling and provider requests.
-- Added strict TypeScript checking, a current-Pi smoke test, pinned development dependencies, and reproducible npm installs.
-- Added Pi package gallery image metadata and documented endpoint/security behavior.
-
-### Changed
-
-- Authentication now goes through `ctx.modelRegistry.getProviderAuth()`, allowing Pi to safely resolve and refresh credentials with its canonical locked credential store.
-- Renamed Z.AI to the current Pi labels, ZAI Coding Plan (Global) and ZAI Coding Plan (China).
-- Limited polling and custom `/usage` UI to interactive TUI mode.
-- Made startup and model-change polling non-blocking and added complete session shutdown cleanup.
-- Updated the selector to use typed TUI APIs, explicit render requests, abortable loading, and theme-safe invalidation.
-
-### Fixed
-
-- Fixed OAuth refresh failures on Pi 0.81.1 caused by the removed runtime `getOAuthApiKey` export.
-- Fixed potential credential races and permission changes caused by direct `auth.json` writes.
-- Fixed in-flight polling and selector requests surviving session shutdown or dialog disposal.
-
-## [0.2.3] - 2026-06-10
-
-### Fixed
-
-- **`DynamicBorder` is not defined** — added missing import of `DynamicBorder` from `@earendil-works/pi-coding-agent`. This fixes the `DynamicBorder is not defined` error when calling `/usage`.
-
-### Changed
-
-- Updated repository URLs from `ajarellanod` to `hknet` in `package.json` and `README.md`.
-- Updated README image URLs to point to the `hknet` repository.
-- Updated LICENSE copyright to `ajarellanod (secondary: hknet)`.
-
-### Removed
-
-- Removed stale tgz build artifacts and `package-lock.json` from the repository.
-- Removed `NOTE.md` compliance report (development artifact).
-
-## [0.2.2] - 2026-06-10
-
-### Fixed
-
-- **Keybinding violation in `UsageSelectorComponent`** — replaced `getKeybindings()` with the `keybindings` parameter injected by `ctx.ui.custom()`. Per the Pi extension docs, custom components must use the injected `KeybindingsManager` directly rather than calling `getKeybindings()` or `setKeybindings()`. This fixes a compliance issue that could cause unexpected behavior under custom keybinding configurations.
+# Changelog
+
+## Unreleased
+
+## [0.4.4] - 2026-08-22
+
+### Documentation
+
+- Clarified that Kimi For Coding supports both Pi's Kimi Coding Plan OAuth login and API-key authentication.
+
+## [0.4.3] - 2026-08-22
+
+### Fixed
+
+- Resolve kimi-coding OAuth credentials that Pi exposes only as a Bearer `Authorization` header (no `apiKey`), so the Kimi For Coding usage indicator no longer reports "auth resolution failed (configured authentication did not resolve a token)". Thanks to [@Rakkael](https://github.com/Rakkael) for the contribution in [#2](https://github.com/hknet/pi-usage-bars/pull/2).
+
+### Changed
+
+- Updated the development and test baseline to Pi SDK 0.84.2 while retaining runtime compatibility with Pi 0.81.1 and newer.
+
+### Documentation
+
+- Recorded Qwen Token Plan and Baseten usage-API research, including the conditions for revisiting provider support.
+
+## [0.4.2] - 2026-08-13
+
+### Fixed
+
+- Added support for credit-based ZAI plan tiers that report `CREDIT_LIMIT` quota windows. Thanks to [@chrislucca](https://github.com/chrislucca) for the contribution in [#1](https://github.com/hknet/pi-usage-bars/pull/1).
+
+### Changed
+
+- Updated the development and test baseline to Pi SDK 0.84.1 while retaining runtime compatibility with Pi 0.81.1 and newer.
+
+### Security
+
+- Updated the Pi SDK development dependency chain to use `undici` 8.9.0, resolving the advisories affecting earlier 8.x releases.
+
+## [0.4.1] - 2026-07-31
+
+### Fixed
+
+- Classify Codex quota windows by `limit_window_seconds` instead of assuming `primary_window` is always the session limit. Codex accounts that expose only a seven-day primary window now show it as Weekly and no longer display a fabricated `Session 0%` lane.
+
+### Changed
+
+- Updated the development and test baseline to Pi SDK 0.83.0 while retaining runtime compatibility with Pi 0.81.1 and newer.
+
+## [0.4.0] - 2026-07-22
+
+### Added
+
+- Added Kimi For Coding quota support through Pi's `kimi-coding` credential and the first-party five-hour/weekly usage endpoint.
+- Added separate MiniMax Global and China Coding/Token Plan support, including the current token-plan endpoint and legacy coding-plan fallback.
+- Added provider-specific quota labels and support for MiniMax responses that expose an interval quota without a weekly quota.
+- Added neutral MiniMax purchased-Credits balance rendering when a key-authenticated first-party response exposes a balance.
+- Added OpenRouter account balance and daily/weekly/monthly key spend using the first-party Credits and Key APIs.
+- Added OpenRouter per-key limit bars only when the key has a real configured credit limit.
+- Added DeepSeek total, topped-up, and granted balance support through the official key-authenticated balance API.
+- Added separate Moonshot/Kimi API Global and China available, cash, and voucher balance support.
+- Added a typed financial-metrics roadmap for further balance/spend providers.
+- Added provider parsing, regional routing, endpoint fallback, financial rendering, authentication lifecycle, and smoke tests.
+- Added CI, reproducible installs, production auditing, and a maintainer release guide.
+
+### Changed
+
+- Treat MiniMax status `2062` as a neutral “No active Token Plan” account state rather than an API error; the cookie-only console balance endpoint remains out of scope.
+- Expanded endpoint configuration documentation for Kimi, MiniMax, OpenRouter, DeepSeek, and Moonshot.
+- Changed npm publishing to an explicit manual workflow so source tags cannot accidentally republish an already released version.
+- Bumped the package version to 0.4.0.
+
+## [0.3.0] - 2026-07-22
+
+### Breaking changes
+
+- Renamed the npm package to `@hk_net/pi-usage-bars`; install it with `pi install npm:@hk_net/pi-usage-bars`.
+- Updated the minimum supported Pi release to 0.81.1.
+- Removed Google Gemini CLI and Google Antigravity usage support, matching their removal from Pi 0.71.0.
+- Refactored core usage orchestration to accept resolved provider tokens instead of reading or refreshing Pi credentials directly.
+
+### Added
+
+- Added ZAI Coding Plan (China) provider and quota endpoint support.
+- Added abort-aware polling and provider requests.
+- Added strict TypeScript checking, a current-Pi smoke test, pinned development dependencies, and reproducible npm installs.
+- Added Pi package gallery image metadata and documented endpoint/security behavior.
+
+### Changed
+
+- Authentication now goes through `ctx.modelRegistry.getProviderAuth()`, allowing Pi to safely resolve and refresh credentials with its canonical locked credential store.
+- Renamed Z.AI to the current Pi labels, ZAI Coding Plan (Global) and ZAI Coding Plan (China).
+- Limited polling and custom `/usage` UI to interactive TUI mode.
+- Made startup and model-change polling non-blocking and added complete session shutdown cleanup.
+- Updated the selector to use typed TUI APIs, explicit render requests, abortable loading, and theme-safe invalidation.
+
+### Fixed
+
+- Fixed OAuth refresh failures on Pi 0.81.1 caused by the removed runtime `getOAuthApiKey` export.
+- Fixed potential credential races and permission changes caused by direct `auth.json` writes.
+- Fixed in-flight polling and selector requests surviving session shutdown or dialog disposal.
+
+## [0.2.3] - 2026-06-10
+
+### Fixed
+
+- **`DynamicBorder` is not defined** — added missing import of `DynamicBorder` from `@earendil-works/pi-coding-agent`. This fixes the `DynamicBorder is not defined` error when calling `/usage`.
+
+### Changed
+
+- Updated repository URLs from `ajarellanod` to `hknet` in `package.json` and `README.md`.
+- Updated README image URLs to point to the `hknet` repository.
+- Updated LICENSE copyright to `ajarellanod (secondary: hknet)`.
+
+### Removed
+
+- Removed stale tgz build artifacts and `package-lock.json` from the repository.
+- Removed `NOTE.md` compliance report (development artifact).
+
+## [0.2.2] - 2026-06-10
+
+### Fixed
+
+- **Keybinding violation in `UsageSelectorComponent`** — replaced `getKeybindings()` with the `keybindings` parameter injected by `ctx.ui.custom()`. Per the Pi extension docs, custom components must use the injected `KeybindingsManager` directly rather than calling `getKeybindings()` or `setKeybindings()`. This fixes a compliance issue that could cause unexpected behavior under custom keybinding configurations.

package/README.md

@@ -17,7 +17,7 @@ It adds:
 | Anthropic Claude | `anthropic` | Claude Pro/Max OAuth |
 | ZAI Coding Plan (Global) | `zai` | ZAI API key |
 | ZAI Coding Plan (China) | `zai-coding-cn` | ZAI China API key |
-| Kimi For Coding | `kimi-coding` | Kimi Coding Plan API key |
+| Kimi For Coding | `kimi-coding` | Kimi Coding Plan OAuth or API key |
 | MiniMax Coding Plan (Global) | `minimax` | MiniMax Global API key |
 | MiniMax Coding Plan (China) | `minimax-cn` | MiniMax China API key |
 | OpenRouter | `openrouter` | OpenRouter API key |
@@ -35,7 +35,7 @@ Google Gemini CLI and Google Antigravity are not supported because Pi removed th
 
 ## Requirements
 
-- Pi 0.81.1 or newer (tested with the current Pi 0.83.0 release)
+- Pi 0.81.1 or newer (tested with the current Pi 0.84.2 release)
 - Node.js 22.19 or newer when using the npm-distributed Pi CLI
 
 Authenticate providers through Pi's `/login` command. The extension resolves credentials through Pi's provider API; it does not read or write `auth.json` itself.
@@ -105,6 +105,8 @@ The Codex and Claude usage endpoints are fixed to their first-party services. Cl
 
 Quota percentages and monetary account data have different meaning and color semantics. OpenRouter, DeepSeek, Moonshot, and MiniMax financial data are rendered as neutral account values; percentages are used only when an actual limit exists.
 
+See [provider support research](docs/provider-research.md) for providers investigated but currently blocked by the absence of a suitable first-party usage API, including Qwen Token Plan and Baseten.
+
 ## Development
 
 Install Node.js 22.19+ and Bun 1.3, then run:

package/docs/provider-research.md

@@ -0,0 +1,39 @@
+# Provider support research
+
+This document records providers considered for usage-bar support but currently blocked by the absence of a suitable first-party API. Recheck these findings when a provider publishes a new quota, balance, or billing API.
+
+## Qwen Token Plan
+
+**Status:** Blocked — no account-usage surface found as of 2026-08-13.
+
+Pi 0.84.1 supports these provider IDs:
+
+- `qwen-token-plan`
+- `qwen-token-plan-individual`
+- `qwen-token-plan-cn`
+
+The Individual provider shares the international inference endpoint and `QWEN_TOKEN_PLAN_API_KEY` with the existing international provider, but exposes a narrower model catalog.
+
+Research found no documented API-key-authenticated endpoint that reports consumed or remaining quota, percentages, or reset times. Independent probing of eight likely usage/quota paths on `token-plan.ap-southeast-1.maas.aliyuncs.com` returned `404`, and successful inference responses did not include quota or rate-limit headers. Qwen's client can recognize an exhausted-quota error, but that provides no usage percentage or reset timestamp.
+
+Do not estimate account-wide quota from requests observed by this extension: other clients and sessions would make that value incomplete and misleading.
+
+**Recheck when:** Alibaba Model Studio documents a Token Plan usage endpoint, adds quota headers to inference responses, or exposes a key-authenticated portal API.
+
+## Baseten
+
+**Status:** Blocked — no account-usage surface found as of 2026-08-13.
+
+Pi 0.84.0 added the `baseten` provider using `BASETEN_API_KEY`. Baseten is primarily usage-billed, and research found no documented API-key endpoint for account balance, credits, budget utilization, or billing usage that this extension could safely query.
+
+**Recheck when:** Baseten publishes a first-party balance, credits, budget, or billing-usage API accessible with the inference credential or a documented monitoring credential.
+
+## Acceptance criteria for a new provider
+
+A provider is suitable when a documented first-party API or response header supplies at least one meaningful account-level value:
+
+- quota consumed or remaining, ideally with a reset time;
+- account balance or credits; or
+- spend for a defined billing period.
+
+Authentication must work through Pi's provider credential API. The extension must not import browser cookies, scrape console pages, estimate account-wide usage from local traffic, or send credentials to third-party services.

package/extensions/usage-bars/index.ts

@@ -506,7 +506,14 @@ export default function (pi: ExtensionAPI): void {
       const resolved = await ctx.modelRegistry.getProviderAuth(providerId);
       if (provider === "claude" && resolved?.source !== "OAuth") return {};
       const token = resolved?.auth.apiKey;
-      return token ? { token } : { error: "configured authentication did not resolve a token" };
+      if (token) return { token };
+      // Some OAuth flows (e.g. kimi-coding) expose the token only as a Bearer
+      // Authorization header rather than as apiKey.
+      const authorization = resolved?.auth.headers?.Authorization ?? resolved?.auth.headers?.authorization;
+      if (typeof authorization === "string" && authorization.startsWith("Bearer ")) {
+        return { token: authorization.slice("Bearer ".length) };
+      }
+      return { error: "configured authentication did not resolve a token" };
     } catch (error) {
       return { error: error instanceof Error ? error.message : String(error) };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hk_net/pi-usage-bars",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Quota, balance, and spend indicators for current Pi providers",
   "keywords": [
     "pi-package",
@@ -51,8 +51,8 @@
     "@earendil-works/pi-tui": ">=0.81.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-coding-agent": "0.84.1",
-    "@earendil-works/pi-tui": "0.84.1",
+    "@earendil-works/pi-coding-agent": "0.84.2",
+    "@earendil-works/pi-tui": "0.84.2",
     "@types/bun": "1.3.14",
     "@types/node": "24.13.3",
     "typescript": "5.9.3"