claude-usage-limits 1.11.0 → 1.11.2

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "usage-limits",
   "displayName": "Usage Limits",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Puts your remaining Claude Code usage limit into Claude's context before every prompt, so it opens with what fits in the budget instead of starting work that gets cut off. Reports headroom as turns rather than percentages, prices a job before you start it, and detects your plan tier.",
   "author": {
     "name": "Ridelink",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "usage-limits",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Reports how much of your Codex usage limit is left as turns of work rather than a percentage, prices a job before you start it, and counts the other agents sharing the same budget.",
   "author": {
     "name": "Ridelink",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-usage-limits",
-  "version": "1.11.0",
+  "version": "1.11.2",
   "description": "Puts your remaining Claude Code usage limit into Claude's context before every prompt, so it opens with what fits in the budget instead of starting work that gets cut off. Reports headroom as turns rather than percentages, prices a job before you start it, and detects your plan tier.",
   "keywords": [
     "claude",

package/skills/usage-limits/scripts/activity.js

@@ -68,10 +68,20 @@ function mark(state, sessionId, extra, now) {
     else if (previous.model) entry.model = previous.model;
     all[sessionId || '_'] = entry;
     const file = activityFile();
-    fs.mkdirSync(path.dirname(file), { recursive: true });
     const temp = file + '.' + process.pid + '.usage-limits-tmp';
-    fs.writeFileSync(temp, JSON.stringify(trim(all)), 'utf8');
-    fs.renameSync(temp, file);
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      fs.writeFileSync(temp, JSON.stringify(trim(all)), 'utf8');
+      fs.renameSync(temp, file);
+    } catch (err) {
+      // A rename Windows refused leaves nothing behind.
+      try {
+        fs.unlinkSync(temp);
+      } catch (gone) {
+        // Nothing to clean up.
+      }
+      return false;
+    }
     return true;
   } catch (err) {
     return false;

package/skills/usage-limits/scripts/feed.js

@@ -26,6 +26,7 @@ const bars = require('./bars.js');
 const view = require('./view.js');
 const activity = require('./activity.js');
 const statusline = require('./statusline.js');
+const live = require('./live.js');
 
 const KEEP_SESSIONS = 8;
 // Two updates this close together mean Claude is mid-turn.
@@ -69,16 +70,24 @@ function readFeed() {
 }
 
 function writeFeed(all) {
-  try {
-    const file = feedFile();
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const temp = file + '.' + process.pid + '.usage-limits-tmp';
-    fs.writeFileSync(temp, JSON.stringify(all), 'utf8');
-    fs.renameSync(temp, file);
-    return true;
-  } catch (err) {
-    return false;
-  }
+  return live.writeAtomic(feedFile(), JSON.stringify(all));
+}
+
+// Two updates a few seconds apart mean a turn in progress, unless the status
+// line is on a timer that fires that often anyway, in which case the gap says
+// nothing and only the hooks' marks do.
+function gapMeansWorking(settings) {
+  const line = settings && settings.statusLine;
+  const every = line && Number.isFinite(line.refreshInterval) ? line.refreshInterval * 1000 : null;
+  return !(every !== null && every <= WORKING_GAP_MS);
+}
+
+// This session's own mark, from the hooks. Another window working must not
+// spin this one's line.
+function ownState(marks, sessionId, now) {
+  const mine = sessionId && marks ? marks[sessionId] : null;
+  if (!mine || !Number.isFinite(mine.at) || now - mine.at > activity.STALE_MS) return { working: false, ultracode: false };
+  return { working: mine.state === 'working', ultracode: Boolean(mine.ultracode) };
 }
 
 function number(value) {
@@ -231,13 +240,13 @@ function readStdin() {
 
 // The status line that was there before ours, run with the same stdin, so
 // installing this one loses nothing.
-function runPrevious(command, raw, env) {
+function runPrevious(command, raw, env, budgetMs) {
   try {
     const result = spawnSync(command, {
       shell: true,
       input: raw,
       encoding: 'utf8',
-      timeout: CHAIN_TIMEOUT_MS,
+      timeout: Math.max(300, Number.isFinite(budgetMs) ? budgetMs : CHAIN_TIMEOUT_MS),
       env: env || process.env,
       windowsHide: true,
       stdio: ['pipe', 'pipe', 'ignore'],
@@ -268,9 +277,18 @@ function motionOff(settings, env) {
   return Boolean(settings && settings.prefersReducedMotion === true);
 }
 
+// Written and flushed before the process is allowed to end: stdout is a pipe
+// here, and a pipe write can still be in flight when process.exit runs.
+function out(text) {
+  return new Promise((resolve) => {
+    process.stdout.write(text, () => resolve());
+  });
+}
+
 async function main(argv) {
   const env = process.env;
-  const now = Date.now();
+  const started = Date.now();
+  const now = started;
   let chained = '';
   try {
     usage.setHost(host.detect(argv || [], env));
@@ -285,7 +303,8 @@ async function main(argv) {
 
     const state = statusline.readState();
     if (state && state.chain && state.previous && state.previous.type === 'command' && state.previous.command) {
-      chained = runPrevious(state.previous.command, raw, env);
+      // Whatever the stdin wait used comes out of the previous line's time.
+      chained = runPrevious(state.previous.command, raw, env, CHAIN_TIMEOUT_MS - (Date.now() - started));
     }
 
     let all = readFeed();
@@ -296,11 +315,11 @@ async function main(argv) {
 
     const off = String(env.USAGE_LIMITS_STATUSLINE || '').toLowerCase();
     if (off === 'off' || off === '0' || off === 'false') {
-      if (chained) process.stdout.write(chained + '\n');
+      if (chained) await out(chained + '\n');
       return 0;
     }
     if (usage.isCodex()) {
-      if (chained) process.stdout.write(chained + '\n');
+      if (chained) await out(chained + '\n');
       return 0;
     }
 
@@ -308,9 +327,11 @@ async function main(argv) {
     const collected = usage.collect(now);
     const settings = settingsFor(configDir());
     const marks = activity.read();
-    const seen = activity.summarise(marks, now);
-    // The other sessions working right now, so the line can say so.
     const mine = input && input.session_id ? input.session_id : null;
+    // This session's own state; only with no session id at all does the
+    // machine-wide picture stand in for it.
+    const own = mine ? ownState(marks, mine, now) : activity.summarise(marks, now);
+    // The other sessions working right now, so the line can say so.
     const othersWorking = activity
       .combine({ marks, feed: all }, now, activity.STALE_MS)
       .filter((row) => row.state === 'working' && row.sessionId !== mine).length;
@@ -324,8 +345,8 @@ async function main(argv) {
       model: slot ? slot.model : null,
       modelName: slot ? slot.modelName : null,
       effort: slot ? slot.effort : null,
-      working: isWorking(slot, now) || seen.working,
-      ultracode: seen.ultracode || settings.ultracode === true,
+      working: own.working || (gapMeansWorking(settings) && isWorking(slot, now)),
+      ultracode: own.ultracode || settings.ultracode === true,
       settingsModel: collected.settings ? collected.settings.model : null,
       env,
     });
@@ -339,10 +360,10 @@ async function main(argv) {
       ascii: String(env.USAGE_LIMITS_ASCII || '') === '1',
       clock: clockFor(settings, env),
     });
-    process.stdout.write((chained ? chained + '\n' : '') + text + '\n');
+    await out((chained ? chained + '\n' : '') + text + '\n');
     return 0;
   } catch (err) {
-    if (chained) process.stdout.write(chained + '\n');
+    if (chained) await out(chained + '\n');
     return 0;
   }
 }
@@ -358,6 +379,8 @@ module.exports = {
   record,
   newest,
   isWorking,
+  gapMeansWorking,
+  ownState,
   line,
   runPrevious,
   clockFor,

package/skills/usage-limits/scripts/live.js

@@ -105,12 +105,21 @@ function readToken(options) {
   }
 
   if (platform === 'darwin') {
+    // The keychain is a child process each time, so a long-lived panel or the
+    // VS Code extension remembers the answer for a few minutes.
+    const nowMs = Date.now();
+    // Only the real keychain is remembered; an injected reader (the tests)
+    // is asked every time.
+    const remember = opts.cache !== false && !opts.exec;
+    if (remember && keychainMemo && nowMs - keychainMemo.at < KEYCHAIN_MEMO_MS) return keychainMemo.result;
     const exec = opts.exec || defaultExec;
     try {
       const out = exec(['find-generic-password', '-s', KEYCHAIN_SERVICE, '-w']);
       const parsed = parseCredentials(String(out || '').trim());
       if (parsed && parsed.token) {
-        return { token: parsed.token, expiresAt: parsed.expiresAt, source: 'keychain' };
+        const result = { token: parsed.token, expiresAt: parsed.expiresAt, source: 'keychain' };
+        if (remember) keychainMemo = { at: nowMs, result };
+        return result;
       }
     } catch (err) {
       // No keychain entry, or no permission to read it: same answer as no file.
@@ -120,6 +129,34 @@ function readToken(options) {
   return { token: null, reason: 'no_credentials' };
 }
 
+let keychainMemo = null;
+const KEYCHAIN_MEMO_MS = 5 * MINUTE;
+
+const LOOPBACK = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+
+function isLoopback(hostname) {
+  return LOOPBACK.has(String(hostname || '').toLowerCase());
+}
+
+// Where the login may be sent: Anthropic over https, or this machine (the
+// tests run a stub on a loopback port). A project's settings file can put
+// anything into the environment of a hook, and USAGE_LIMITS_USAGE_URL must
+// not be a way to walk off with the token.
+function allowedUrl(raw) {
+  if (!raw) return null;
+  let url;
+  try {
+    url = new URL(String(raw));
+  } catch (err) {
+    return null;
+  }
+  if (isLoopback(url.hostname)) return url.toString();
+  if (url.protocol !== 'https:') return null;
+  const host = url.hostname.toLowerCase();
+  if (host === 'anthropic.com' || host.endsWith('.anthropic.com')) return url.toString();
+  return null;
+}
+
 function bad(kind, status, retryAfterMs, message) {
   return {
     ok: false,
@@ -150,12 +187,11 @@ function fetchUsage(options) {
   return new Promise((resolve) => {
     if (!opts.token) return resolve(bad('no_credentials', null, null, 'no Claude login found'));
 
-    let url;
-    try {
-      url = new URL(opts.url || USAGE_URL);
-    } catch (err) {
-      return resolve(bad('bad_response', null, null, 'the usage url is not a url'));
+    const permitted = allowedUrl(opts.url || USAGE_URL);
+    if (!permitted) {
+      return resolve(bad('bad_response', null, null, 'refusing to send the login anywhere but Anthropic over https'));
     }
+    const url = new URL(permitted);
     const client = url.protocol === 'http:' ? http : https;
     const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
 
@@ -242,6 +278,7 @@ function nextDelayMs(outcome, previousMs, options) {
         ? Math.min(Math.max(outcome.retryAfterMs, 1000), 10 * MINUTE)
         : 60 * 1000;
     case 'unauthorized':
+    case 'expired':
     case 'forbidden':
     case 'no_credentials':
       return 30 * 1000;
@@ -263,6 +300,8 @@ function describe(outcome) {
       return 'offline';
     case 'unauthorized':
       return 'sign in to Claude Code again';
+    case 'expired':
+      return 'login expired, Claude Code renews it on its next call';
     case 'forbidden':
       return 'usage not available for this login';
     case 'no_credentials':
@@ -287,20 +326,30 @@ function readLive() {
   return parsed;
 }
 
-// Through a temporary file, so a reader never sees half a reading.
-function writeLive(snapshot) {
+// Through a temporary file named for this process, so a reader never sees
+// half a reading and two writers never share a temp file. A rename that fails
+// (Windows, with the target held open) leaves nothing behind.
+function writeAtomic(file, text) {
+  const temp = file + '.' + process.pid + '.usage-limits-tmp';
   try {
-    const file = liveFile();
     fs.mkdirSync(path.dirname(file), { recursive: true });
-    const temp = file + '.usage-limits-tmp';
-    fs.writeFileSync(temp, JSON.stringify(snapshot), 'utf8');
+    fs.writeFileSync(temp, text, 'utf8');
     fs.renameSync(temp, file);
     return true;
   } catch (err) {
+    try {
+      fs.unlinkSync(temp);
+    } catch (gone) {
+      // Nothing to clean up.
+    }
     return false;
   }
 }
 
+function writeLive(snapshot) {
+  return writeAtomic(liveFile(), JSON.stringify(snapshot));
+}
+
 function fetchDisabled(env) {
   return String((env || process.env).USAGE_LIMITS_FETCH || '').toLowerCase() === 'off';
 }
@@ -320,9 +369,14 @@ async function refresh(options) {
       snapshot: readLive(),
     };
   }
+  // A token past its expiry gets a 401 and nothing else. Claude Code renews it
+  // on its own next call, so do not send it, and say what is being waited for.
+  if (Number.isFinite(creds.expiresAt) && creds.expiresAt < (Number.isFinite(opts.now) ? opts.now : Date.now())) {
+    return { outcome: bad('expired', null, null, 'the login has expired; Claude Code renews it on its next call'), snapshot: readLive() };
+  }
   const outcome = await fetchUsage({
     token: creds.token,
-    url: opts.url || env.USAGE_LIMITS_USAGE_URL || USAGE_URL,
+    url: allowedUrl(opts.url || env.USAGE_LIMITS_USAGE_URL) || USAGE_URL,
     timeoutMs: opts.timeoutMs,
   });
   if (!outcome.ok) return { outcome, snapshot: readLive() };
@@ -352,11 +406,9 @@ function readAttempt() {
 }
 
 function writeAttempt(record) {
-  try {
-    fs.writeFileSync(attemptFile(), JSON.stringify(record), 'utf8');
-  } catch (err) {
-    // Without it the next caller merely tries again a little sooner.
-  }
+  // Atomic, so a concurrent reader never parses half a record and skips the
+  // backoff by accident.
+  writeAtomic(attemptFile(), JSON.stringify(record));
 }
 
 // A reading only when the one on disk has aged. This is what the hooks call:
@@ -381,10 +433,19 @@ async function refreshIfStale(options) {
   if (newestAt > 0 && now - newestAt < maxAgeMs) return { outcome: null, snapshot: current, skipped: 'fresh' };
 
   const attempt = readAttempt();
-  if (attempt && Number.isFinite(attempt.delayMs) && now - attempt.attemptedAtMs < attempt.delayMs) {
+  // A record from a clock that was ahead would hold the backoff until the
+  // wall clock caught up with it; a minute of skew is all that is honoured.
+  const sinceAttempt = attempt ? now - attempt.attemptedAtMs : 0;
+  if (attempt && Number.isFinite(attempt.delayMs) && sinceAttempt >= -MINUTE && sinceAttempt < attempt.delayMs) {
     return { outcome: null, snapshot: current, skipped: 'backoff' };
   }
 
+  // Claim the attempt before making it, so the other hooks that fire in the
+  // same second (parallel agents, several windows) skip rather than each
+  // sending its own request and each waiting out its own timeout.
+  const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+  writeAttempt({ attemptedAtMs: now, delayMs: timeoutMs, kind: 'inflight' });
+
   const result = await refresh({
     now,
     accountUuid: opts.accountUuid,
@@ -395,7 +456,10 @@ async function refreshIfStale(options) {
   });
   writeAttempt({
     attemptedAtMs: now,
-    delayMs: nextDelayMs(result.outcome, attempt ? attempt.delayMs : 0, { baseMs: maxAgeMs, maxMs: 10 * MINUTE }),
+    delayMs: nextDelayMs(result.outcome, attempt && attempt.kind !== 'inflight' ? attempt.delayMs : 0, {
+      baseMs: maxAgeMs,
+      maxMs: 10 * MINUTE,
+    }),
     kind: result.outcome.ok ? 'ok' : result.outcome.kind,
   });
   return { outcome: result.outcome, snapshot: result.snapshot, skipped: null };
@@ -409,6 +473,9 @@ module.exports = {
   credentialsFile,
   liveFile,
   attemptFile,
+  allowedUrl,
+  isLoopback,
+  writeAtomic,
   userAgent,
   readToken,
   fetchUsage,

package/skills/usage-limits/scripts/panel.js

@@ -281,7 +281,7 @@ function stateLine(built, mode) {
 function noteColour(built) {
   const kind = built.outcome && !built.outcome.ok ? built.outcome.kind : null;
   if (kind === 'unauthorized' || kind === 'forbidden' || kind === 'no_credentials') return bars.THEME.error;
-  if (kind === 'offline' || kind === 'rate_limited' || kind === 'server' || kind === 'http' || kind === 'bad_response') {
+  if (kind === 'offline' || kind === 'expired' || kind === 'rate_limited' || kind === 'server' || kind === 'http' || kind === 'bad_response') {
     return bars.THEME.warning;
   }
   return null;
@@ -291,7 +291,10 @@ function noteColour(built) {
 // dropping breathing room first and footers second.
 function render(built, options) {
   const opts = options || {};
-  const columns = Math.max(MIN_COLUMNS, Number.isFinite(opts.columns) ? Math.floor(opts.columns) : 40);
+  // Laid out for at least MIN_COLUMNS, but cut to the width that really
+  // exists: a line wider than the pane wraps, and a wrapped frame scrolls.
+  const real = Number.isFinite(opts.columns) ? Math.max(1, Math.floor(opts.columns)) : 40;
+  const columns = Math.max(MIN_COLUMNS, real);
   const height = Number.isFinite(opts.rows) ? Math.floor(opts.rows) : null;
   const mode = opts.mode || 'none';
   const tick = Number.isFinite(opts.tick) ? opts.tick : 0;
@@ -399,7 +402,7 @@ function render(built, options) {
   if (height !== null && lines.length > height) lines = compose(false, true);
   if (height !== null && lines.length > height) lines = compose(false, false);
   if (height !== null && lines.length > height) lines = lines.slice(0, height);
-  return lines.map((line) => fit(line, columns));
+  return lines.map((line) => fit(line, real));
 }
 
 function quote(value) {
@@ -408,7 +411,7 @@ function quote(value) {
 
 // How to put the panel in a pane to the right of the current one, for the
 // terminals that can be told to. Pure, so the table can be tested.
-function openCommand(env, panelPath, nodePath, platform, extraArgs) {
+function openCommand(env, panelPath, nodePath, platform, extraArgs, options) {
   const e = env || process.env;
   const os = platform || process.platform;
   const node = nodePath || process.execPath;
@@ -417,9 +420,12 @@ function openCommand(env, panelPath, nodePath, platform, extraArgs) {
   const cmd = [quote(node), quote(panel)].concat(extra.map(quote)).join(' ');
 
   if (e.TMUX) {
+    // A percentage on -l arrived in tmux 3.1; older ones want the old -p.
+    const version = options && options.tmuxVersion ? String(options.tmuxVersion).match(/(\d+)\.(\d+)/) : null;
+    const old = version && (Number(version[1]) < 3 || (Number(version[1]) === 3 && Number(version[2]) < 1));
     return {
       program: 'tmux',
-      args: ['split-window', '-h', '-d', '-l', '32%', cmd],
+      args: ['split-window', '-h', '-d'].concat(old ? ['-p', '32'] : ['-l', '32%'], [cmd]),
       note: 'opened a pane to the right in tmux',
     };
   }
@@ -468,8 +474,20 @@ function openCommand(env, panelPath, nodePath, platform, extraArgs) {
   return null;
 }
 
+function tmuxVersion() {
+  try {
+    const result = require('child_process').spawnSync('tmux', ['-V'], { encoding: 'utf8', timeout: 2000, windowsHide: true });
+    return result && result.stdout ? String(result.stdout).trim() : null;
+  } catch (err) {
+    return null;
+  }
+}
+
 function openPanel(env, extraArgs) {
-  const plan = openCommand(env, __filename, process.execPath, process.platform, extraArgs);
+  const e = env || process.env;
+  const plan = openCommand(e, __filename, process.execPath, process.platform, extraArgs, {
+    tmuxVersion: e.TMUX ? tmuxVersion() : null,
+  });
   if (!plan) {
     process.stdout.write(
       'This terminal cannot be told to split. Open a second pane to the right and run:\n  ' +
@@ -601,21 +619,28 @@ async function interactive(args) {
     const now = Date.now();
     const due = fetch && !state.fetching && now - state.lastFetchAt >= state.delayMs;
     if (due) {
+      // The reading runs beside the frames, never in front of them: a slow
+      // network must not freeze the spinner or the countdown.
       state.fetching = true;
-      try {
-        state.built = await snapshot({ fetch: true, network: fetch, env, now });
-        state.outcome = state.built.outcome;
-      } catch (err) {
-        state.outcome = { ok: false, kind: 'bad_response', message: err.message };
-      }
-      state.lastFetchAt = Date.now();
-      state.delayMs = live.nextDelayMs(state.outcome, state.delayMs, {
-        baseMs: pollBase(state.built, args, env),
-        maxMs: POLL_IDLE_MS,
-      });
-      state.fetching = false;
-      state.dirty = true;
-    } else if (!state.built || now - state.lastCheck >= FILE_CHECK_MS) {
+      snapshot({ fetch: true, network: fetch, env, now })
+        .then((built) => {
+          state.built = built;
+          state.outcome = built.outcome;
+        })
+        .catch((err) => {
+          state.outcome = { ok: false, kind: 'bad_response', message: err && err.message ? err.message : String(err) };
+        })
+        .then(() => {
+          state.lastFetchAt = Date.now();
+          state.delayMs = live.nextDelayMs(state.outcome, state.delayMs, {
+            baseMs: pollBase(state.built, args, env),
+            maxMs: POLL_IDLE_MS,
+          });
+          state.fetching = false;
+          state.dirty = true;
+        });
+    }
+    if (!state.built || now - state.lastCheck >= FILE_CHECK_MS) {
       state.lastCheck = now;
       try {
         state.built = await snapshot({ fetch: false, network: fetch, env, now, outcome: state.outcome });

package/skills/usage-limits/scripts/view.js

@@ -116,6 +116,8 @@ function noteFor(outcome, ageMs) {
       return 'network off' + suffix;
     case 'unauthorized':
       return 'sign in to Claude Code again' + suffix;
+    case 'expired':
+      return 'the login has expired, Claude Code renews it on its next call' + suffix;
     case 'forbidden':
       return 'usage is not available for this login' + suffix;
     case 'no_credentials':
@@ -141,7 +143,10 @@ function build(input) {
   // knows for certain; the setting is the fallback; nothing is hidden when
   // neither says.
   const model = opts.model || opts.settingsModel || env.ANTHROPIC_MODEL || null;
-  const families = usage.familiesInUse(null, null, [opts.model, opts.settingsModel, env.ANTHROPIC_MODEL]);
+  // When Claude Code has said which model is running, that is the whole
+  // answer: adding the setting on top would keep a Fable week on screen after
+  // /model moved the session to Opus. The setting is only the fallback.
+  const families = usage.familiesInUse(null, null, opts.model ? [opts.model] : [opts.settingsModel, env.ANTHROPIC_MODEL]);
 
   const rows = [];
   for (const key of ['five_hour', 'seven_day']) {