@ohgodtamit/pi-usage 0.1.0-alpha.0

package/src/provider.ts

@@ -0,0 +1,704 @@
+/**
+ * Active-provider detection and live quota fetching.
+ *
+ * The usage panel surfaces TWO independent signals about your active provider:
+ *
+ *   1. Live money quota   — fetched from the provider's billing API when it has
+ *                           one (OpenRouter credits, OpenAI costs). This is the
+ *                           provider's own view of your account.
+ *   2. Rate-limit headers — captured from every provider HTTP response via the
+ *                           `after_provider_response` event. These are universal
+ *                           (Anthropic, OpenAI, OpenRouter, Google, … all return
+ *                           them) and reflect the live per-window limits applied
+ *                           to your current API key.
+ *
+ * API keys are resolved through the session's model registry, the same path pi
+ * uses for request-time credentials and OAuth refresh.
+ */
+import type { Api, Model } from "@earendil-works/pi-ai";
+import { type ModelRegistry, readStoredCredential } from "@earendil-works/pi-coding-agent";
+import { classifyZaiLimits, type ZaiQuotaLimit } from "./zai.ts";
+
+const HOUR = 60 * 60 * 1000;
+const DAY = 24 * HOUR;
+
+/** Resolve a provider's current request credential, including refreshed OAuth. */
+export async function resolveApiKey(
+  modelRegistry: ModelRegistry,
+  provider: string,
+): Promise<string | undefined> {
+  if (!provider) return undefined;
+  try {
+    return await modelRegistry.getApiKeyForProvider(provider);
+  } catch (err) {
+    console.error(
+      `[usage] getApiKeyForProvider(${provider}) failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return undefined;
+  }
+}
+
+/** Check whether pi can currently resolve authentication for a provider. */
+export async function hasProviderKey(
+  modelRegistry: ModelRegistry,
+  provider: string,
+): Promise<boolean> {
+  if (!provider) return false;
+  try {
+    return (await modelRegistry.getProviderAuth(provider)) !== undefined;
+  } catch (err) {
+    console.error(
+      `[usage] getProviderAuth(${provider}) failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return false;
+  }
+}
+
+export interface ActiveProvider {
+  provider: string;
+  modelId: string;
+  baseUrl: string;
+  api: string;
+  /** True when an API key for this provider is resolvable from the environment. */
+  hasKey: boolean;
+}
+
+/** Detect the currently active provider/model from the session context. */
+export async function detectActiveProvider(
+  modelRegistry: ModelRegistry,
+  model: Model<Api> | undefined,
+): Promise<ActiveProvider | null> {
+  if (!model) return null;
+  const provider = model.provider ?? "";
+  return {
+    provider,
+    modelId: model.id ?? "",
+    baseUrl: model.baseUrl ?? "",
+    api: (model as { api?: string }).api ?? "",
+    hasKey: await hasProviderKey(modelRegistry, provider),
+  };
+}
+
+export interface RateLimitWindow {
+  /** "requests" | "tokens" | "input-tokens" | "output-tokens" */
+  resource: string;
+  /** Approximate window label, e.g. "tokens/min". Heuristic per provider tier. */
+  window: string;
+  limit: number;
+  remaining: number;
+  /** Epoch ms when the window resets, or 0 if unknown. */
+  resetMs: number;
+}
+
+export interface ProviderQuota {
+  active: ActiveProvider | null;
+  fetchedAt: number;
+  /** Live account credits (OpenRouter). Undefined when not applicable/available. */
+  credits?: { total: number; used: number; remaining: number };
+  /** Live provider spend in USD (OpenAI organization/costs API). Best-effort. */
+  spend5h?: number;
+  spend7d?: number;
+  monthlyLimit?: number;
+  /**
+   * Provider-native plan quotas (ZAI GLM coding plans, OpenAI Codex subscription):
+   * session (5h) and weekly (7d) windows reported directly by the upstream as a
+   * used percentage with a live reset countdown. These replace the session-derived bars.
+   */
+  planQuota?: {
+    plan: string;
+    session5h?: { usedPct: number; resetMs: number };
+    weekly?: { usedPct: number; resetMs: number };
+    webSearches?: { used: number; limit: number; resetMs: number };
+    /** Purchased credits balance (OpenAI Codex), when reported. */
+    credits?: { balance: number; unlimited: boolean };
+  };
+  /** Rate-limit windows captured from the most recent provider response. */
+  rateLimits: RateLimitWindow[];
+  /** "live" if a billing API responded, "headers" if only rate-limit headers, "none" otherwise. */
+  source: "live" | "headers" | "none";
+  /** Human hints (e.g. why live quota is unavailable). */
+  notes: string[];
+  error?: string;
+}
+
+/**
+ * Parse provider rate-limit headers into structured windows.
+ *
+ * Recognizes three conventions and de-dupes by resource:
+ *   - Anthropic: `anthropic-ratelimit-{resource}-{limit|remaining|reset}`
+ *   - OpenAI:    `x-ratelimit-{limit|remaining|reset}-{resource}`
+ *   - Generic:   `x-ratelimit-{limit|remaining|reset}` (older/simpler APIs)
+ *
+ * Pi lowercases all header keys, so matching is case-insensitive by contract.
+ */
+export function parseRateLimits(
+  headers: Record<string, string>,
+  now: number = Date.now(),
+): RateLimitWindow[] {
+  const windows: RateLimitWindow[] = [];
+  const seen = new Set<string>();
+
+  const anthropicRe =
+    /^anthropic-ratelimit-(requests|tokens|input-tokens|output-tokens)-(limit|remaining|reset)$/;
+  const openaiRe = /^x-ratelimit-(limit|remaining|reset)-(requests|tokens)$/;
+
+  const pushGroup = (
+    groups: Map<string, { limit?: number; remaining?: number; reset?: string }>,
+    origin: string,
+  ) => {
+    for (const [resource, g] of groups) {
+      const key = `${origin}:${resource}`;
+      if (seen.has(key)) continue;
+      if (g.limit == null && g.remaining == null) continue;
+      seen.add(key);
+      windows.push({
+        resource,
+        window: windowLabel(resource),
+        limit: g.limit ?? 0,
+        remaining: g.remaining ?? 0,
+        resetMs: parseReset(g.reset, now),
+      });
+    }
+  };
+
+  const anthropicGroups = new Map<string, { limit?: number; remaining?: number; reset?: string }>();
+  const openaiGroups = new Map<string, { limit?: number; remaining?: number; reset?: string }>();
+  for (const [kRaw, v] of Object.entries(headers)) {
+    const k = kRaw.toLowerCase();
+    const a = k.match(anthropicRe);
+    if (a) {
+      const [, resource, field] = a;
+      const g = anthropicGroups.get(resource) ?? {};
+      applyField(g, field, v);
+      anthropicGroups.set(resource, g);
+      continue;
+    }
+    const o = k.match(openaiRe);
+    if (o) {
+      const [, field, resource] = o;
+      const g = openaiGroups.get(resource) ?? {};
+      applyField(g, field, v);
+      openaiGroups.set(resource, g);
+    }
+  }
+  pushGroup(anthropicGroups, "anthropic");
+  pushGroup(openaiGroups, "openai");
+
+  // Generic single-window fallback (no resource distinction).
+  const gLimit = headers["x-ratelimit-limit"] ?? headers["ratelimit-limit"];
+  const gRemaining = headers["x-ratelimit-remaining"] ?? headers["ratelimit-remaining"];
+  const gReset = headers["x-ratelimit-reset"] ?? headers["ratelimit-reset"];
+  if ((gLimit || gRemaining) && !seen.has("generic")) {
+    windows.push({
+      resource: "requests",
+      window: "window",
+      limit: Number(gLimit) || 0,
+      remaining: Number(gRemaining) || 0,
+      resetMs: parseReset(gReset, now),
+    });
+  }
+
+  return windows;
+}
+
+function applyField(
+  g: { limit?: number; remaining?: number; reset?: string },
+  field: string,
+  value: string,
+): void {
+  if (field === "limit") g.limit = Number(value);
+  else if (field === "remaining") g.remaining = Number(value);
+  else g.reset = value;
+}
+
+function windowLabel(resource: string): string {
+  if (resource.includes("token")) return "tokens/min";
+  return "requests/min";
+}
+
+/**
+ * Parse a reset value into an epoch-ms timestamp.
+ *
+ * Handles ISO-8601 timestamps ("2024-01-01T12:00:00Z"), OpenAI-style durations
+ * ("6m0s", "500ms", "2h"), and bare-seconds integers.
+ */
+export function parseReset(value: string | undefined, now: number): number {
+  if (!value) return 0;
+  const s = String(value).trim();
+  if (!s) return 0;
+
+  // ISO 8601 / RFC3339 timestamp.
+  if (/^\d{4}-\d{2}-\d{2}T/.test(s) || s.endsWith("Z")) {
+    const t = Date.parse(s);
+    if (!Number.isNaN(t)) return t;
+  }
+
+  // Duration: "1d2h3m4s500ms" (any subset, OpenAI style).
+  const dm = s.match(/^(?:(\d+)d)?(?:(\d+)h)?(?:(\d+)m(?!s))?(?:(\d+(?:\.\d+)?)s)?(?:(\d+)ms)?$/);
+  if (dm && s.match(/\d/)) {
+    const days = Number(dm[1] ?? 0);
+    const hours = Number(dm[2] ?? 0);
+    const mins = Number(dm[3] ?? 0);
+    const secs = Number(dm[4] ?? 0);
+    const ms = Number(dm[5] ?? 0);
+    const totalMs = ((days * 24 + hours) * 60 + mins) * 60 * 1000 + secs * 1000 + ms;
+    if (totalMs > 0) return now + totalMs;
+  }
+
+  // Plain number → seconds until reset (some providers).
+  if (/^\d+(\.\d+)?$/.test(s)) return now + Number(s) * 1000;
+
+  return 0;
+}
+
+/** Normalize a base URL so it ends with exactly `/v1`. Falls back to `<fallback>/v1` when not derivable. */
+function ensureV1(baseUrl: string, fallback: string): string {
+  const trimmed = baseUrl.replace(/\/+$/, "");
+  if (/\/v\d+$/.test(trimmed)) return trimmed; // already has a version segment
+  if (trimmed) return `${trimmed}/v1`;
+  return `${fallback}/v1`;
+}
+
+/** Fetch OpenRouter account credits. Works with a normal API key. */
+async function fetchOpenRouterCredits(
+  baseUrl: string,
+  apiKey: string,
+  signal?: AbortSignal,
+): Promise<{ total: number; used: number; remaining: number } | undefined> {
+  const root = ensureV1(baseUrl, "https://openrouter.ai");
+  const res = await fetch(`${root}/credits`, {
+    headers: { Authorization: `Bearer ${apiKey}` },
+    signal,
+  });
+  if (!res.ok) throw new Error(`OpenRouter /credits HTTP ${res.status}`);
+  const json = (await res.json()) as {
+    data?: { total_credits?: number; total_usage?: number };
+  };
+  const total = json?.data?.total_credits;
+  const used = json?.data?.total_usage;
+  if (typeof total !== "number" || typeof used !== "number") return undefined;
+  return { total, used, remaining: Math.max(0, total - used) };
+}
+
+/** Best-effort OpenAI spend for the 5h and 7d windows via the organization/costs API. */
+async function fetchOpenAICosts(
+  baseUrl: string,
+  apiKey: string,
+  signal?: AbortSignal,
+): Promise<{ spend5h: number; spend7d: number; monthlyLimit?: number } | undefined> {
+  const root = ensureV1(baseUrl, "https://api.openai.com");
+  const nowS = Math.floor(Date.now() / 1000);
+  const start5 = Math.floor((Date.now() - 5 * HOUR) / 1000);
+  const start7 = Math.floor((Date.now() - 7 * DAY) / 1000);
+
+  const sumCosts = async (start: number): Promise<number> => {
+    const url = `${root}/organization/costs?start_time=${start}&end_time=${nowS}&limit=1`;
+    const res = await fetch(url, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal,
+    });
+    if (!res.ok) throw new Error(`OpenAI /costs HTTP ${res.status}`);
+    const json = (await res.json()) as {
+      data?: Array<{ results?: Array<{ cost?: { value?: number } }> }>;
+    };
+    let total = 0;
+    for (const bucket of json.data ?? []) {
+      for (const r of bucket.results ?? []) total += r.cost?.value ?? 0;
+    }
+    return total;
+  };
+
+  const [spend5h, spend7d] = await Promise.all([sumCosts(start5), sumCosts(start7)]);
+
+  // Monthly hard limit is best-effort; many keys can't read /subscription.
+  let monthlyLimit: number | undefined;
+  try {
+    const subRes = await fetch(`${root}/organization/subscription`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal,
+    });
+    if (subRes.ok) {
+      const sub = (await subRes.json()) as {
+        plan?: { hard_limit_usd?: number };
+      };
+      const hard = sub?.plan?.hard_limit_usd;
+      if (typeof hard === "number") monthlyLimit = hard;
+    }
+  } catch {
+    // Optional; ignore.
+  }
+
+  return { spend5h, spend7d, monthlyLimit };
+}
+
+function errMsg(e: unknown): string {
+  return e instanceof Error ? e.message : String(e);
+}
+
+/** Shape of ZAI's /api/monitor/usage/quota/limit response. */
+interface ZaiQuotaPayload {
+  code?: number;
+  success?: boolean;
+  data?: {
+    level?: string;
+    limits?: ZaiQuotaLimit[];
+  };
+}
+
+/**
+ * Fetch ZAI (Zhipu / GLM coding plans) native plan quota from the undocumented
+ * monitor endpoint used by the subscription UI. Verified schema (2026-06):
+ *
+ *   GET https://api.z.ai/api/monitor/usage/quota/limit   (intl)
+ *   GET https://open.bigmodel.cn/api/monitor/usage/quota/limit   (CN fallback)
+ *   Authorization: Bearer <key>
+ *
+ *   { code:200, success:true, data:{ level:"max", limits:[
+ *     { type:"TOKENS_LIMIT", unit:3, number:5, percentage:81, nextResetTime:<ms> },  // 5h session
+ *     { type:"TOKENS_LIMIT", unit:6, number:1, percentage:51, nextResetTime:<ms> },  // weekly
+ *     { type:"TIME_LIMIT",   unit:5, number:1, usage:4000, currentValue:0, remaining:4000, nextResetTime:<ms>, usageDetails:[...] } // web searches
+ *   ]}}
+ *
+ * ZAI only exposes `percentage` for the token windows (absolute used/remaining
+ * are hidden), so we report the upstream percentage + reset countdown.
+ */
+async function fetchZaiPlanQuota(
+  apiKey: string,
+  signal?: AbortSignal,
+): Promise<NonNullable<ProviderQuota["planQuota"]> | undefined> {
+  const endpoints = [
+    "https://api.z.ai/api/monitor/usage/quota/limit",
+    "https://open.bigmodel.cn/api/monitor/usage/quota/limit",
+  ];
+  const headers = {
+    Authorization: `Bearer ${apiKey}`,
+    Accept: "application/json",
+  };
+
+  let payload: ZaiQuotaPayload | null = null;
+
+  for (const url of endpoints) {
+    try {
+      const res = await fetch(url, { headers, signal });
+      if (res.status === 404) continue; // endpoint not available on this region
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      payload = (await res.json()) as ZaiQuotaPayload;
+      break;
+    } catch (e) {
+      // Try the next endpoint; if this was the last one, rethrow to the caller.
+      if (url === endpoints[endpoints.length - 1]) throw e;
+    }
+  }
+  if (!payload?.data?.limits) return undefined;
+  return classifyZaiLimits(payload.data.limits, payload.data.level ?? "");
+}
+
+/**
+ * Parse OpenAI Codex subscription quota from response headers captured via
+ * `after_provider_response`. This is the reliable path: the headers come fresh
+ * from pi's own authenticated Codex request, so there is no token/refresh
+ * management (unlike the `/wham/usage` REST endpoint, whose OAuth token in
+ * `~/.codex/auth.json` is frequently stale/rotated).
+ *
+ * Header families (authoritative: openai/codex rate_limits.rs):
+ *   x-codex-primary-used-percent        — 5h rolling window used % (0-100)
+ *   x-codex-primary-reset-at            — unix SECONDS of next reset
+ *   x-codex-secondary-used-percent      — 7-day rolling window used %
+ *   x-codex-secondary-reset-at          — unix SECONDS
+ *   x-codex-credits-has-credits / -unlimited / -balance  — purchased credits
+ *   x-codex-limit-name                  — plan/limit display name
+ *
+ * Returns the planQuota shape (shared with ZAI) when any Codex window is present.
+ */
+export function parseCodexQuota(
+  headers: Record<string, string>,
+): NonNullable<ProviderQuota["planQuota"]> | undefined {
+  const get = (name: string): string | undefined => {
+    // Pi lowercases header keys; be defensive about case either way.
+    return headers[name] ?? headers[name.toLowerCase()];
+  };
+  const num = (v: string | undefined): number | undefined => {
+    if (v == null || v === "") return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+  };
+
+  const pctPrimary = num(get("x-codex-primary-used-percent"));
+  const pctSecondary = num(get("x-codex-secondary-used-percent"));
+  const resetPrimary = num(get("x-codex-primary-reset-at")); // unix seconds
+  const resetSecondary = num(get("x-codex-secondary-reset-at"));
+  const limitName = get("x-codex-limit-name");
+
+  if (pctPrimary == null && pctSecondary == null) return undefined;
+
+  // Credits (optional).
+  let credits: { balance: number; unlimited: boolean } | undefined;
+  const hasCredits = get("x-codex-credits-has-credits");
+  if (hasCredits != null) {
+    const balance = num(get("x-codex-credits-balance")) ?? 0;
+    const unlimited =
+      get("x-codex-credits-unlimited") === "true" || get("x-codex-credits-unlimited") === "1";
+    credits = { balance, unlimited };
+  }
+
+  return {
+    plan: limitName ?? "codex",
+    session5h:
+      pctPrimary != null && resetPrimary != null
+        ? { usedPct: pctPrimary, resetMs: resetPrimary * 1000 }
+        : undefined,
+    weekly:
+      pctSecondary != null && resetSecondary != null
+        ? { usedPct: pctSecondary, resetMs: resetSecondary * 1000 }
+        : undefined,
+    credits,
+  };
+}
+
+const CODEX_USAGE_URL = "https://chatgpt.com/backend-api/wham/usage";
+
+interface CodexUsage {
+  plan_type?: string;
+  rate_limit?: {
+    primary_window?: {
+      used_percent?: number;
+      reset_at?: number;
+      limit_window_seconds?: number;
+    };
+    secondary_window?: {
+      used_percent?: number;
+      reset_at?: number;
+      limit_window_seconds?: number;
+    };
+  };
+  credits?: {
+    has_credits?: boolean;
+    unlimited?: boolean;
+    balance?: number | string;
+  };
+  rate_limit_reset_credits?: { available_count?: number };
+}
+
+function accountIdFromAccessToken(accessToken: string): string | undefined {
+  try {
+    const payload = accessToken.split(".")[1];
+    if (!payload) return undefined;
+    const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<
+      string,
+      unknown
+    >;
+    const accountId = decoded["https://api.openai.com/auth.chatgpt_account_id"];
+    return typeof accountId === "string" && accountId ? accountId : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Fetch OpenAI Codex subscription quota from the REST endpoint using pi's
+ * request-time credential resolver, which refreshes OAuth before returning.
+ */
+export async function fetchCodexQuota(
+  modelRegistry: ModelRegistry,
+  provider = "openai-codex",
+  signal?: AbortSignal,
+): Promise<
+  | { quota: NonNullable<ProviderQuota["planQuota"]>; error?: string }
+  | { quota: undefined; error: string }
+  | undefined
+> {
+  const accessToken = await resolveApiKey(modelRegistry, provider);
+  if (!accessToken) {
+    return {
+      quota: undefined,
+      error: `No Codex credentials in pi's auth for "${provider}" — run /login to authenticate.`,
+    };
+  }
+
+  // Prefer the claim from the freshly resolved access token. Older stored
+  // credentials are consulted only for providers whose token omits the claim.
+  let accountId = accountIdFromAccessToken(accessToken);
+  if (!accountId) {
+    try {
+      const credential = readStoredCredential(provider);
+      if (credential?.type === "oauth") {
+        accountId = typeof credential.accountId === "string" ? credential.accountId : undefined;
+      }
+    } catch {
+      // The account header is optional; quota fetching can still proceed.
+    }
+  }
+
+  // Fetch the quota.
+  const headers: Record<string, string> = {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: "application/json",
+  };
+  if (accountId) headers["ChatGPT-Account-Id"] = accountId;
+  let json: CodexUsage;
+  try {
+    const res = await fetch(CODEX_USAGE_URL, { headers, signal });
+    if (res.status === 401) {
+      return {
+        quota: undefined,
+        error: "Codex token rejected by server — sign in to Codex CLI to refresh credentials.",
+      };
+    }
+    if (!res.ok) {
+      return {
+        quota: undefined,
+        error: `Codex usage HTTP ${res.status}`,
+      };
+    }
+    json = (await res.json()) as CodexUsage;
+  } catch (e) {
+    return {
+      quota: undefined,
+      error: `Codex usage fetch failed: ${errMsg(e)}`,
+    };
+  }
+
+  const rl = json.rate_limit;
+  const primary = rl?.primary_window;
+  const secondary = rl?.secondary_window;
+  const plan: string =
+    (rl && (rl as { limit_name?: string }).limit_name) || json.plan_type || "codex";
+
+  return {
+    quota: {
+      plan,
+      session5h:
+        primary?.used_percent != null && primary.reset_at != null
+          ? { usedPct: primary.used_percent, resetMs: primary.reset_at * 1000 }
+          : undefined,
+      weekly:
+        secondary?.used_percent != null && secondary.reset_at != null
+          ? {
+              usedPct: secondary.used_percent,
+              resetMs: secondary.reset_at * 1000,
+            }
+          : undefined,
+      credits: json.credits
+        ? {
+            balance: Number(json.credits.balance ?? 0),
+            unlimited: json.credits.unlimited ?? false,
+          }
+        : undefined,
+    },
+  };
+}
+
+/**
+ * Build a full provider quota snapshot: merge already-captured rate-limit
+ * headers with a fresh live fetch from the provider's billing API (if any).
+ *
+ * `capturedRateLimits` comes from the `after_provider_response` event in the
+ * orchestrator (index.ts), so it reflects the most recent real request made by
+ * the active provider.
+ */
+export async function fetchProviderQuota(
+  modelRegistry: ModelRegistry,
+  active: ActiveProvider | null,
+  capturedRateLimits: RateLimitWindow[],
+  capturedHeaders: Record<string, string> = {},
+  signal?: AbortSignal,
+): Promise<ProviderQuota> {
+  const result: ProviderQuota = {
+    active,
+    fetchedAt: Date.now(),
+    rateLimits: capturedRateLimits,
+    source: "none",
+    notes: [],
+  };
+
+  if (!active) {
+    result.error = "No active model";
+    return result;
+  }
+
+  if (!active.hasKey) {
+    result.notes.push(
+      `No auth configured for "${active.provider}" — set a key via /login or an env var to enable live quota.`,
+    );
+  }
+
+  // Resolve the key through pi's request-time model registry auth chain.
+  // OpenAI Codex subscription quota uses the refreshed OAuth access token
+  // returned by that public extension API.
+  //
+  // Why NOT headers? pi's codex provider uses a WebSocket for streaming and
+  // only surfaces the HTTP/SSE response headers to `after_provider_response`.
+  // The WebSocket upgrade response (which carries `x-codex-*`) is NOT exposed
+  // to extensions, so the header path is unreliable for codex. The REST
+  // endpoint is the only reliable way to get live quota data.
+  if (!result.planQuota) {
+    const lowerKeys = Object.keys(capturedHeaders).map((k) => k.toLowerCase());
+    const hasCodexHeaders = lowerKeys.includes("x-codex-primary-used-percent");
+    const isCodex =
+      active.provider === "openai-codex" ||
+      active.provider.startsWith("openai-codex-") ||
+      hasCodexHeaders;
+    if (isCodex) {
+      // Prefer the REST fetch (works proactively, no request needed).
+      const rest = await fetchCodexQuota(modelRegistry, active.provider, signal);
+      if (rest) {
+        // Only set planQuota when we actually got real window data. On error
+        // (token expired / rejected), rest.quota is undefined so planQuota
+        // stays unset and the view falls to the subscription-hint branch,
+        // which shows the clear error instead of an empty "codex plan" label.
+        if (rest.quota) {
+          result.planQuota = rest.quota;
+          result.source = "live";
+        }
+        if (rest.error) result.notes.push(rest.error);
+      }
+      // Fallback: parse any captured headers (in case the user just made
+      // a request and some headers leaked through, or they were captured
+      // by pi's WS path in the future).
+      const pq = result.planQuota;
+      if (pq && !pq.session5h && !pq.weekly) {
+        const fromHeaders = parseCodexQuota(capturedHeaders);
+        if (fromHeaders) {
+          result.planQuota = fromHeaders;
+          result.source = result.source === "live" ? "live" : "headers";
+        }
+      }
+    }
+  }
+
+  const key = await resolveApiKey(modelRegistry, active.provider);
+
+  if (key) {
+    try {
+      if (active.provider === "openrouter") {
+        const credits = await fetchOpenRouterCredits(active.baseUrl, key, signal);
+        if (credits) {
+          result.credits = credits;
+          result.source = "live";
+        }
+      } else if (active.provider === "openai") {
+        const costs = await fetchOpenAICosts(active.baseUrl, key, signal);
+        if (costs) {
+          result.spend5h = costs.spend5h;
+          result.spend7d = costs.spend7d;
+          result.monthlyLimit = costs.monthlyLimit;
+          result.source = "live";
+        }
+      } else if (active.provider === "zai") {
+        // ZAI GLM coding plans expose a native 5h-session + weekly quota via an
+        // undocumented monitor endpoint. This is the authoritative upstream view
+        // (used/remaining % with reset countdown) — replaces session-derived bars.
+        const planQuota = await fetchZaiPlanQuota(key, signal);
+        if (planQuota) {
+          result.planQuota = planQuota;
+          result.source = "live";
+        }
+      }
+    } catch (e) {
+      result.notes.push(`Live quota fetch failed: ${errMsg(e)}`);
+    }
+  }
+
+  if (result.source === "none" && capturedRateLimits.length > 0) result.source = "headers";
+  return result;
+}