opencode-navigator 0.20.0 → 0.21.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## [0.21.0] - 2026-10-06
+
+- Automatically verify Codex account identity from OpenCode 2's ChatGPT connection. When host identity is unavailable, confirm a private binding once per connection or provider and reuse it across models, projects, and sessions; preserve compatible older confirmations and isolate conflicting ones until relinked.
+- Expand OpenCode 2 Limits with documented native subscription allowances, API rate-limit observations, configured capacities, account balances, and key budgets. Keep provider-native units, currencies, model associations, and active-account boundaries explicit.
+- Add Provider sources to explain each provider's supported measurements, required permissions, and unavailable APIs without guessing remaining quota.
+- Keep available account balances visible when a separate subscription read fails, and show exhausted NanoGPT subscription windows instead of hiding them.
+- Keep stale quota guidance visible after failed refreshes, reject late results after credential changes, and recover from stalled provider reads without blocking model response streams.
+
 ## [0.20.0] - 2026-10-05
 
 - Add a default-visible Limits section for the selected model's provider-native quota windows, reset times, account identity, and freshness. Codex CLI support requires an explicit private account binding; unsupported providers show calm guidance.
@@ -70,6 +78,7 @@
 
 Earlier release notes are available on [GitHub Releases](https://github.com/St1ggy/opencode-navigator/releases).
 
+[0.21.0]: https://github.com/St1ggy/opencode-navigator/compare/v0.20.0...v0.21.0
 [0.20.0]: https://github.com/St1ggy/opencode-navigator/compare/v0.19.3...v0.20.0
 [0.19.3]: https://github.com/St1ggy/opencode-navigator/compare/v0.19.2...v0.19.3
 [0.19.2]: https://github.com/St1ggy/opencode-navigator/compare/v0.19.1...v0.19.2

package/PROVIDERS.md

@@ -0,0 +1,92 @@
+# Provider Quota Sources
+
+Navigator follows the currently selected host model and active provider connection.
+It never treats session token/cost totals as remaining provider quota. Subscription
+windows, API rate limits, configured capacities, and monetary balances are different
+measurements and are labelled separately.
+
+The implemented contracts were rechecked on 2026-10-06. The runtime also includes providers from
+the host catalog; an unrecognized provider gets an explicit unverified-source state
+rather than fabricated quota values. Availability depends on the selected account,
+permissions, region, transport, and supported host APIs.
+
+## Audited Read Sources
+
+| Provider | Native source | Scope and prerequisites | Reference |
+| --- | --- | --- | --- |
+| OpenAI / Codex ChatGPT | Codex app-server account/rate-limit RPC and manual reset credits | Verified account identity; exact provider-reported model bucket | [Codex protocol](https://github.com/openai/codex/tree/main/codex-rs/app-server-protocol) |
+| OpenAI API | HTTP request/token/project-token rate-limit headers | Actual response for the selected model/account; HTTP transport | [Rate limits](https://developers.openai.com/api/docs/guides/rate-limits) |
+| Anthropic API | Native response headers and organization rate-limits API | Per-model headers; configured limits need an eligible org/admin credential and explicit model association | [Rate limits API](https://platform.claude.com/docs/en/manage-claude/rate-limits-api) |
+| Azure OpenAI | Native remaining request/token headers | Actual deployment response; does not expose a ChatGPT subscription | [Quotas and limits](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/quotas-limits) |
+| Groq | Native request/day and token/minute response headers | Actual response for the selected model/account | [Rate limits](https://console.groq.com/docs/rate-limits) |
+| Fireworks | Model response throughput headers; account quotas API | Native token/second capacities; account lookup must be unambiguous, and GPU quotas are excluded from chat-model views | [Serverless limits](https://docs.fireworks.ai/serverless/rate-limits), [Quotas API](https://docs.fireworks.ai/api-reference/list-quotas) |
+| OpenRouter | Current-key USD spending budget and free-model daily requests | Normal inference key; free-model counters apply only to documented free variants | [Key API](https://openrouter.ai/docs/api/api-reference/api-keys/get-current-api-key) |
+| OpenRouter management | Account purchased/used credits in USD | Management key required; never substitute key budget for account balance | [Credits API](https://openrouter.ai/docs/api/api-reference/credits/get-remaining-credits) |
+| DeepSeek | Current-user currency balances | Existing inference API key; API supplies USD/CNY and separates granted/top-up balances | [Balance API](https://api-docs.deepseek.com/api/get-user-balance) |
+| Moonshot / Kimi API | Available, voucher, and cash balance | Region-specific API key; international USD and China CNY are not interchangeable | [International balance](https://platform.moonshot.ai/docs/api/balance), [China balance](https://platform.moonshot.cn/docs/api/balance) |
+| MiniMax Token Plan | Documented token-plan remains endpoint and provider-owned response types | Subscription key; explicit model rows/percentages only, without guessing ambiguous legacy count direction | [Token Plan FAQ](https://platform.minimax.io/docs/token-plan/faq), [Official quota SDK](https://github.com/MiniMax-AI/cli/tree/main/src/sdk/quota) |
+| GitHub Copilot | Official SDK account quota RPC with explicit host token | SDK runtime; token-scoped model lookup and quota read; no private REST endpoint calls | [Official SDK](https://github.com/github/copilot-sdk), [Authentication](https://github.com/github/copilot-sdk/blob/main/docs/auth/authenticate.md) |
+| NanoGPT | USD/Nano balances and daily/weekly subscription input-token quotas | Existing inference key; only models in the same API host's subscription-only catalog; null/degraded counters remain unknown | [Balance](https://docs.nano-gpt.com/api-reference/endpoint/check-balance), [Usage](https://docs.nano-gpt.com/api-reference/endpoint/subscription-usage), [Models](https://docs.nano-gpt.com/api-reference/endpoint/models) |
+| SiliconFlow / China | Current-user available, charged, and granted balances | Region-specific inference key; retain unknown currency when the response omits it | [User info](https://docs.siliconflow.com/en/api-reference/userinfo/get-user-info) |
+| Novita | Available balance, cash balance, credit limit, pending charges, and outstanding invoices | Existing inference key; exact 1/10000 USD scaling | [Balance](https://novita.ai/docs/api-reference/basic-get-user-balance) |
+| Poe | Current combined plan/add-on point balance | Existing API credential; points are not dollars or tokens | [Usage API](https://creator.poe.com/docs/resources/usage-api) |
+| AIHubMix | Current-user USD balance | Manage Key required; quota units scale by 500000 per USD | [Current user](https://docs.aihubmix.com/en/api/CliEndpoints/get-self) |
+
+## Capability Constraints And Other Providers
+
+| Provider / product | Constraint or additional capability required | Public reference |
+| --- | --- | --- |
+| Claude Pro/Max / Claude Code | Session-local `rate_limits` statusline exists; it does not provide a portable OpenCode cross-process subscription read API | [Statusline](https://code.claude.com/docs/en/statusline) |
+| Google Gemini API | Project/model rate limits; AI Studio and cloud quota permissions are separate from a plain inference key | [Gemini limits](https://ai.google.dev/gemini-api/docs/rate-limits) |
+| Google Vertex AI | Project/region quota and cloud authentication; shared/dynamic quotas are not a personal subscription balance | [Vertex quotas](https://cloud.google.com/vertex-ai/generative-ai/docs/quotas) |
+| Amazon Bedrock | IAM/region Service Quotas and CloudWatch require additional cloud capabilities and exact model/quota mapping | [Bedrock quotas](https://docs.aws.amazon.com/bedrock/latest/userguide/quotas.html) |
+| Azure AI / Microsoft Foundry | Resource/deployment quotas and cloud management permissions; no portable credit balance from an inference key alone | [Foundry quotas](https://learn.microsoft.com/en-us/azure/ai-foundry/openai/quotas-limits) |
+| Cerebras | Organization/project/model rate limits; parse only self-describing native counters actually present in the model response, never copy console tier examples | [Cerebras limits](https://inference-docs.cerebras.ai/support/rate-limits) |
+| Mistral | Organization request/token limits and remaining headers; do not infer missing counter units or a subscription balance | [Known limitations](https://docs.mistral.ai/resources/known-limitations) |
+| Together AI | Current serverless API exposes a retry interval on 429, not remaining counters; a portable remaining-credit API is not established by billing UI documentation | [Credits](https://docs.together.ai/docs/billing-credits), [Rate limits](https://docs.together.ai/docs/rate-limits) |
+| xAI / Grok | API usage differs from consumer subscriptions; management billing needs separate team credentials | [Developer docs](https://docs.x.ai/) |
+| Perplexity | API credits are separate from the consumer subscription and Computer credits; billing UI does not establish a remaining-credit read endpoint | [API billing](https://www.perplexity.ai/help-center/en/articles/10354847-api-payment-and-billing) |
+| Kimi Code subscription | Keep separate from Moonshot pay-as-you-go balance; undocumented usage/browser endpoints are not adopted | [Kimi Code](https://www.kimi.com/code/docs/en/) |
+| Z.ai / Zhipu GLM Coding Plan | Usage windows exist; monitor/dashboard endpoints require a documented external API contract before integration | [Coding Plan](https://docs.z.ai/devpack/overview) |
+| Qwen / Alibaba Cloud / DashScope | Model/project/cloud quota and billing permissions; browser OAuth state is not a portable quota source | [Model Studio docs](https://www.alibabacloud.com/help/en/model-studio/) |
+| Hugging Face Inference Providers | Hub request quotas are not automatically inference-model quotas or inference credits | [Hub limits](https://huggingface.co/docs/hub/rate-limits), [Inference pricing](https://huggingface.co/docs/inference-providers/pricing) |
+| Cloudflare Workers AI | Account billing/analytics and model/resource limits; do not derive remaining free allowance from static daily examples | [Workers AI limits](https://developers.cloudflare.com/workers-ai/platform/limits/) |
+| OpenCode Zen / Go | Host session statistics are not the provider's account balance; no undocumented billing endpoints are queried | [OpenCode Zen](https://opencode.ai/docs/zen/) |
+| Cursor | Consumer account usage requires a supported external API; no browser cookies or local credential extraction | [Cursor docs](https://docs.cursor.com/) |
+| Windsurf / Codeium | Consumer plan usage is separate from API response rate limits; no private account endpoints | [Windsurf docs](https://docs.windsurf.com/) |
+| Amp | Product credits require a supported external account API; no credential-file or cookie integrations | [Amp manual](https://ampcode.com/manual) |
+| OpenAI-compatible gateways | Protocol compatibility does not prove account identity, native quota units, or backend bucket/model mapping | [OpenCode providers](https://opencode.ai/docs/providers/) |
+| Ollama / LM Studio / local models | Local inference generally has no provider subscription quota to read; cloud offerings are separate products | [Ollama API](https://docs.ollama.com/api), [LM Studio API](https://lmstudio.ai/docs/developer) |
+| NVIDIA NIM / NGC | Cloud/trial and self-hosted limits differ; an inference endpoint does not identify an NGC credit balance | [NIM docs](https://docs.nvidia.com/nim/) |
+| Cohere | Organization/API rate limits are distinct from subscription windows and account credit balances | [Cohere rate limits](https://docs.cohere.com/docs/rate-limits) |
+| AI21 | Project/model rate limits; no independently verified subscription remaining-window API | [AI21 docs](https://docs.ai21.com/) |
+| Replicate | Model execution billing is distinct from subscription quota; no inferred remaining credits from prediction cost | [Billing](https://replicate.com/docs/topics/billing) |
+| Baseten / ModelScope / Nebius / Vultr / v0 | Additional billing permissions or an independently verified model/quota contract are required; protocol compatibility alone is insufficient | [OpenCode providers](https://opencode.ai/docs/providers/) |
+| Chutes | Public current-user quota routes exist, but native units and model/allowance semantics have not been independently established | [Users API](https://chutes.ai/docs/api-reference/users) |
+| Requesty | Management key/key ID and budget semantics are required; dated usage reports are not remaining quota | [Key management API](https://docs.requesty.ai/features/key-management-api) |
+
+## Authentication And Host Boundaries
+
+- OpenCode 2 metadata matching uses public provider/credential APIs and the built-in
+  ChatGPT OAuth `metadata.accountID`. Account IDs are compared with Codex's own
+  reported identity; a provider name or model-name similarity is not proof.
+- A confirmation is saved once per connection, or per provider when the host has
+  no connection API. Models do not need separate confirmations. Conflicting older
+  model-specific records remain isolated until an explicit relink.
+- Additional read-only sources use Navigator's OpenCode 2 server plugin and public
+  integration/HTTP-response hooks. Secrets remain on the server and are never
+  returned by quota RPCs, written to Navigator preferences, or included in logs.
+- Native response observations do not issue extra model requests. No quota read
+  triggers inference, a credit purchase, a reset, or an authorization flow.
+- HTTP-only observations may be absent for WebSocket transports. Report that
+  limitation instead of changing the host transport or reading private frames.
+- The native adapters are available through the OpenCode 2 server plugin. OpenCode
+  1.x keeps Codex support and capability guidance without accessing host internals.
+- REST credentials are not reused against a native provider origin when the host
+  explicitly configures a different gateway origin. Redirects are rejected.
+- Contract fixtures cover endpoint selection, regions, units, pagination, account
+  ambiguity/rotation, malformed bodies, cancellation, and partial-data handling.
+  These are deterministic checks, not live billing-account probes.
+- Documentation from reference implementations is used only to discover APIs;
+  browser cookies, credential-file readers, private endpoints, and organization-
+  specific stacks are excluded.

package/README.md

@@ -358,7 +358,7 @@ OpenCode after changing `cli.json`.
 ## Limits: provider quotas and banked resets
 
 Navigator keeps subscription limits separate from OpenCode's session token and
-cost statistics. The first supported source is Codex's documented app-server
+cost statistics. Codex subscription data comes from its documented app-server
 `account/rateLimits/read` RPC. It reports provider-owned usage windows, reset
 times, account identity, and any available banked reset credits. The installed
 Codex 0.160.0 protocol also exposes the separate
@@ -371,12 +371,30 @@ Switching provider, model, session, or account invalidates stale reads and credi
 CodexBar is useful for discovering providers, but its cookie, credential-file,
 and undocumented endpoint integrations are not Navigator data sources.
 
-| Source | Machine-readable subscription limits | Banked reset credits |
+| Source | Native measurement | Banked reset credits |
 | --- | --- | --- |
 | Codex app-server | Rate-limit windows and account ID | Available count, optional details and expiry, confirmed manual consumption |
+| MiniMax and NanoGPT | Explicit model-associated subscription windows; separate pay-as-you-go balances | Read-only |
+| GitHub Copilot | Official SDK token-scoped premium allowance, checked against the selected model's billing metadata | Read-only |
+| OpenRouter, DeepSeek, Moonshot, SiliconFlow, Novita, Poe, AIHubMix | Current-account balance or key spending budget, preserving provider-native currency/points and permission requirements | Read-only |
+| OpenAI API, Anthropic, Azure OpenAI, Groq, Cerebras, Fireworks | Native model-response counters or explicitly labelled configured capacities | Read-only |
 | Claude Code (not integrated) | Session-local `rate_limits` statusline payload after a Claude Code response | No documented cross-process consumption API |
 | OpenCode session statistics | Token and cost statistics, not subscription quota | Not applicable |
-| Other providers | Not shown until a documented machine-readable quota API is verified | No action without a documented consume API |
+| Other providers | Capability guidance until a documented source and model/account mapping are verified | No action without a documented consume API |
+
+The additional native sources use the **OpenCode 2 Navigator server plugin** already
+used for Todo. Configure it on the 2.x launch path as described in the installation
+section. OpenCode 1.x retains Codex support; additional sources need the 2.x public
+integration/HTTP APIs. Without the server plugin, Limits shows setup guidance.
+**Provider sources** lists audited capabilities and unsupported-source reasons;
+the [source inventory](PROVIDERS.md) includes public API references and prerequisites.
+
+The server resolves the active host credential through OpenCode's public API.
+Quota RPCs return measurements, never credentials. Response-header observations
+use real model requests without issuing extra inference calls or consuming their
+response bodies. HTTP-only observations may be absent on WebSocket transports.
+REST reads use a short in-memory cache; Refresh bypasses it. Observed headers older
+than two minutes are marked stale instead of presented as current remaining quota.
 
 Limits is visible and expanded by default, first below the session title. Change
 its visibility and order under **Settings → Sections** in Global or Current
@@ -386,20 +404,29 @@ available from the command palette.
 
 ![Model-specific Codex quota windows and reset times](screenshots/39-provider-limits.png)
 
+![Audited provider sources and required capabilities](screenshots/47-provider-sources.png)
+
 ### Link the intended Codex account
 
 Install a Codex CLI exposing the documented read and consume RPCs (verified with
 0.160.0), ensure `codex` is on the same machine's `PATH`, and sign in with a ChatGPT
-account. Navigator starts `codex app-server --stdio` lazily; it does not start a
-Codex subprocess for unsupported providers or before an explicit account link.
-
-OpenCode does not expose which Codex CLI account its selected model uses. Select
-**Link Codex CLI account** in Limits and confirm the reported account ID only if
-you know it matches this OpenCode provider. The binding is private, user-wide,
-and specific to the provider/model. **Unlink Codex account** removes it;
-**Relink Codex account** is available when the CLI account has changed.
-
-For a linked model, Limits shows only buckets with a provider-reported model
+account. Navigator starts `codex app-server --stdio` lazily after the account is
+associated with the selected ChatGPT connection.
+
+OpenCode 2's built-in ChatGPT OAuth integration reports an account ID. Navigator
+automatically associates that identity and verifies it against Codex's reported
+account. API-key OpenAI connections use API measurements instead of a ChatGPT
+subscription.
+
+When the host does not provide a verifiable identity, select **Link Codex CLI
+account** and confirm the reported account ID if it matches this host connection.
+The private, user-wide binding is saved **once per connection**, or once per
+provider on hosts without a connection API, and reused across models, projects,
+and sessions. **Unlink Codex account** removes the manual association; **Relink
+Codex account** is available after an account change. Compatible older model
+bindings are reused; conflicting bindings remain isolated until a deliberate relink.
+
+For an associated model, Limits shows only buckets with a provider-reported model
 association, their native usage units and window durations, reset times, and
 the last successful read time. It refreshes quietly every five seconds, even
 when hidden. **Refresh** requests a read immediately; a failed read preserves
@@ -720,11 +747,12 @@ session or workspace dismisses the entire search dialog chain.
 Development requires Bun 1.4.2 and Node.js 24.16 or newer. Install dependencies with
 `bun install --frozen-lockfile`.
 
-ESLint uses the Solid preset from
-[`@st1ggy/linter-config`](https://github.com/St1ggy/linter-config); Prettier uses its
-common preset. `eslint.config.js` documents project-specific adaptations for
-OpenTUI callbacks, SDK compatibility, and test fixtures. Type-aware linting covers
-application code, tests, build scripts, and JavaScript configuration files.
+Oxlint uses the `solid-ox` preset from
+[`@st1ggy/linter-config`](https://github.com/St1ggy/linter-config); Oxfmt uses its
+`oxfmt-common` preset. `oxlint.config.ts` documents project-specific adaptations for
+OpenTUI callbacks, SDK compatibility, and test fixtures. Type-aware analysis uses
+`oxlint-tsgolint`; `tsconfig.lint.json` covers application code, tests, build scripts,
+and configuration files. Formatter exclusions are maintained in `oxfmt.config.ts`.
 
 ```sh
 bun run test
@@ -742,7 +770,7 @@ bun run screenshots:verify
 bun run check
 ```
 
-`bun run check` runs the tests, TypeScript, ESLint, bundle-size guard, and formatting
+`bun run check` runs the tests, TypeScript, Oxlint, bundle-size guard, and Oxfmt
 check. The unminified TUI bundle is limited to 360,000 bytes.
 Font generation is a separate development task: `bun run font:build` and
 `bun run font:check` use `uv` and the pinned FontTools dependency. Users install
@@ -753,7 +781,7 @@ CI checks that the bundled font matches its generator.
 through Ghostty on Xvfb. The image includes the bundled corner font and a pinned
 JetBrainsMono Nerd Font; every displayed task, session, workspace, path, skill,
 server, error, and preset is synthetic. `bun run screenshots:verify` renders the
-same 37 scenes to a temporary directory and fails if any PNG differs. Three scenes
+same scenes to a temporary directory and fails if any PNG differs. Additional scenes
 keep the pinned Nerd Font but remove the Navigator corner font so the uninstalled-font
 experience remains reproducible beside the required-font captures. The harness
 requires Docker with Linux ARM64 support. These commands are available for harness