tokentracker-cli 1.5.2 → 1.5.3

package/src/lib/provider-status.js

@@ -9,6 +9,8 @@
 // Statuspage.io contract (`/api/v2/status.json`):
 //   { "page": { "updated_at": ISO }, "status": { "indicator": "none|minor|major|critical", "description": "..." } }
 
+const { parseDeepSeekStatusPage } = require("./deepseek-status");
+
 const STATUS_PROBE_TIMEOUT_MS = 6_000;
 // Status pages change on incident timescales; 5 minutes keeps the limits
 // poll (2-min TTL upstream) from hammering statuspage.io every cycle.
@@ -23,6 +25,13 @@ const STATUS_PAGE_SPECS = {
     apiUrl: "https://status.claude.com/api/v2/status.json",
     pageUrl: "https://status.claude.com",
   },
+  deepseek: {
+    // Flashcat-hosted Next.js page: no public JSON API and no CORS. Relayed
+    // server-side here; `format` switches the fetch to HTML + RSC parsing.
+    apiUrl: "https://status.deepseek.com/",
+    pageUrl: "https://status.deepseek.com",
+    format: "deepseek-rsc",
+  },
 };
 
 const VALID_INDICATORS = new Set(["none", "minor", "major", "critical"]);
@@ -68,13 +77,17 @@ async function fetchProviderServiceStatus(providerId, { fetchImpl = fetch, nowMs
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), STATUS_PROBE_TIMEOUT_MS);
     try {
+      const isDeepSeek = spec.format === "deepseek-rsc";
       const res = await fetchImpl(spec.apiUrl, {
         method: "GET",
-        headers: { Accept: "application/json" },
+        headers: { Accept: isDeepSeek ? "text/html" : "application/json" },
         signal: controller.signal,
       });
       if (res.ok) {
-        data = normalizeStatusPayload(await res.json(), spec, nowMs);
+        const payload = isDeepSeek
+          ? parseDeepSeekStatusPage(await res.text())
+          : await res.json();
+        data = normalizeStatusPayload(payload, spec, nowMs);
       }
     } finally {
       clearTimeout(timer);

package/src/lib/qoder-limits.js

@@ -40,6 +40,9 @@ const QODER_ACTIVITY_CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 const QODER_LIMITS_CACHE_FILE = "qoder-usage-limits-cache.json";
 const QODER_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 const QODER_LIMITS_CACHE_UNKNOWN_RESET_TTL_MS = 12 * 60 * 60 * 1000;
+// Align with usage-limits provenance aging (10 min): a cache hit fresher than
+// this inherits its written source and is not flagged stale (#955 self-lock).
+const QODER_LIMITS_CACHE_FRESH_TTL_MS = 10 * 60 * 1000;
 // Qoder Desktop 0.4+ writes its account usage summary to main.log, which can
 // accumulate a whole session before the quota is read. Scan a bounded window
 // backwards instead of assuming the summary is near EOF.
@@ -435,6 +438,15 @@ function readQoderLimitsCache({
     if (nowMs - cachedAtMs > QODER_LIMITS_CACHE_MAX_AGE_MS && !hasUnexpiredDatedWindow) {
       return null;
     }
+    // Provenance must describe the data's age, not the transport (#955): a
+    // successful refresh writes this cache and immediately floors later log
+    // scans, so the next refresh re-serves the same payload. Marking every
+    // hit stale/disk-cache made the Limits page permanently partial.
+    const ageMs = nowMs - cachedAtMs;
+    const fresh = ageMs <= QODER_LIMITS_CACHE_FRESH_TTL_MS;
+    const writtenSource = typeof raw.source === "string" && raw.source.trim()
+      ? raw.source.trim()
+      : null;
     return {
       configured: true,
       error: null,
@@ -444,9 +456,9 @@ function readQoderLimitsCache({
       secondary_window: secondaryWindow,
       ...(tertiaryWindow ? { tertiary_window: tertiaryWindow } : {}),
       cached: true,
-      stale: true,
+      stale: !fresh,
       cached_at: raw.cached_at,
-      source: "disk-cache",
+      source: fresh && writtenSource ? writtenSource : "disk-cache",
     };
   } catch (_error) {
     return null;
@@ -467,6 +479,9 @@ function writeQoderLimitsCache(limits, {
       primary_window: limits.primary_window || null,
       secondary_window: limits.secondary_window || null,
       ...(limits.tertiary_window ? { tertiary_window: limits.tertiary_window } : {}),
+      // Remember the winning source so a fresh re-serve keeps honest
+      // provenance instead of always claiming "disk-cache" (#955).
+      source: typeof limits.source === "string" ? limits.source : null,
       cached_at: new Date(nowMs).toISOString(),
     },
   };

package/src/lib/usage-limits.js

@@ -50,21 +50,54 @@ const execFileAsync = promisify(cp.execFile);
 // 2-minute in-memory cache. It also expires early at the earliest upcoming window
 // reset in the cached data (see cacheExpiresAtMs), floored so a provider reporting
 // a reset "right now" can't turn every poll into a full upstream round.
-// Partitioned by the Devin opt-in selection AND the Antigravity quota opt-out, so
-// a request made while Devin is off is never served (or joined onto) a response
-// fetched while it was on, and an aggregate fetched while Antigravity was enabled
-// is never served after the opt-out is set. Key = `${devin}-${antigravity}`.
-const USAGE_LIMITS_SELECTION_KEYS = ["off-on", "off-off", "on-on", "on-off"];
+// Partitioned by the Devin opt-in selection AND the Antigravity quota opt-out AND
+// the per-request hidden-provider set (#956), so a request made while Devin is off
+// is never served (or joined onto) a response fetched while it was on, an aggregate
+// fetched while Antigravity was enabled is never served after the opt-out is set,
+// and a response fetched for a visibility selection is never served to one made
+// under a different one. Key = `${devin}-${antigravity}[-<hidden ids>]`.
+const USAGE_LIMITS_BASE_SELECTION_KEYS = ["off-on", "off-off", "on-on", "on-off"];
 const cacheBySelection = {};
-for (const key of USAGE_LIMITS_SELECTION_KEYS) cacheBySelection[key] = { data: null, expiresAtMs: 0 };
+for (const key of USAGE_LIMITS_BASE_SELECTION_KEYS) cacheBySelection[key] = { data: null, expiresAtMs: 0 };
 // Credential replacements (provider-key save) bump this generation so a fetch
 // that started under the old credential cannot repopulate the memory or disk
 // caches after invalidation.
 let usageLimitsCacheGeneration = 0;
+// Provider row keys of the usage-limits aggregate — the id space `hidden`
+// parameter values are validated against (dashboard rows, menu-bar
+// LimitsSettingsStore.allProviders, and this payload all share it).
+const USAGE_LIMITS_PROVIDER_IDS = Object.freeze([
+  "claude", "codex", "cursor", "gemini", "kimi", "kiro", "grok",
+  "copilot", "antigravity", "zcode", "opencodeGo", "commandCode",
+  "qoder", "qoderCn", "codingPlan", "agentPlan", "devin",
+  "workbuddy", "workbuddyAi",
+]);
+
+// Normalize a caller-supplied hidden-provider list (array, Set, or
+// comma-separated query value) into a sorted, de-duplicated id array, or null
+// when nothing is hidden. Unknown ids are dropped: the parameter only ever
+// narrows the fetch, so a silently ignored typo must not widen the cache-key
+// space (and leniency matches the devin query param, which accepts any value
+// that is not "1"/"true" as off).
+function normalizeHiddenProviders(input) {
+  const raw = input instanceof Set
+    ? [...input]
+    : Array.isArray(input)
+      ? input
+      : typeof input === "string" && input.trim().length > 0
+        ? input.split(",")
+        : [];
+  const ids = [...new Set(
+    raw.map((id) => String(id).trim()).filter((id) => USAGE_LIMITS_PROVIDER_IDS.includes(id)),
+  )].sort();
+  return ids.length > 0 ? ids : null;
+}
+
 function usageLimitsSelectionKey(options) {
   const devin = options?.devinEnabled === true ? "on" : "off";
   const antigravity = isAntigravityQuotaDisabled() ? "off" : "on";
-  return `${devin}-${antigravity}`;
+  const hidden = normalizeHiddenProviders(options?.hiddenProviders);
+  return `${devin}-${antigravity}${hidden ? `-${hidden.join("+")}` : ""}`;
 }
 const CACHE_TTL_MS = 2 * 60 * 1000;
 // Must stay below the macOS app's post-reset re-fetch grace (10s in
@@ -237,6 +270,43 @@ function withAbortableProviderTimeout(start, label, timeoutMs) {
     .finally(() => controller.abort());
 }
 
+// WorkBuddy bounds its own live chain (the IPC proxy timeout is internal), and
+// its disk-cache fallback runs after the abort lands: the abort makes the
+// socket fail within milliseconds and the cache read is synchronous. A plain
+// provider-timeout race would settle on the timeout first and drop that
+// fallback, so after the budget expires, abort and give the attempt a short
+// grace to land its fallback — its outcome (cache hit or specific error)
+// replaces the generic timeout. The hard bound is timeoutMs + graceMs.
+function withWorkbuddyProviderTimeout(start, label, timeoutMs, graceMs = 2_000) {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) return start(undefined);
+  const controller = new AbortController();
+  const work = start(controller.signal);
+  let timeoutTimer;
+  let graceTimer;
+  let deadlineFired = false;
+  // Once the budget aborts the attempt, any rejection it produces is the
+  // deadline's doing — the IPC socket fails with its cancellation error, a
+  // fetch with an AbortError — so report the labeled timeout instead of the
+  // symptom. A post-abort resolution still wins the grace race (the
+  // disk-cache fallback).
+  const guardedWork = work.catch((error) => {
+    if (deadlineFired) throw new Error(`${label} usage request timed out.`);
+    throw error;
+  });
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutTimer = setTimeout(() => {
+      deadlineFired = true;
+      controller.abort();
+      graceTimer = setTimeout(() => reject(new Error(`${label} usage request timed out.`)), graceMs);
+    }, timeoutMs);
+  });
+  return Promise.race([guardedWork, timeoutPromise]).finally(() => {
+    clearTimeout(timeoutTimer);
+    clearTimeout(graceTimer);
+    controller.abort();
+  });
+}
+
 function parseRetryAfterSeconds(headers) {
   const ra = headers?.get ? headers.get("retry-after") : null;
   const sec = ra ? Number.parseInt(ra, 10) : NaN;
@@ -3959,7 +4029,6 @@ function withPlanLabel(obj, raw, brand) {
 // local-api.js): a refresh arriving while a fetch is already running reuses that
 // in-flight fetch and returns its result.
 const inFlightBySelection = {};
-for (const key of USAGE_LIMITS_SELECTION_KEYS) inFlightBySelection[key] = null;
 
 // Codex stamps reset_at as unix seconds; every other provider (and Claude's
 // resets_at) uses ISO strings. Numbers that look like epoch milliseconds are
@@ -4001,7 +4070,9 @@ async function getUsageLimits(options = {}) {
   const selection = usageLimitsSelectionKey(options);
   const cache = cacheBySelection[selection];
   const nowMs = Date.now();
-  if (cache.data && nowMs < cache.expiresAtMs) {
+  // Unseen selections (a hidden set never requested before this process's
+  // lifetime) simply miss — partitions are created lazily on first fetch.
+  if (cache?.data && nowMs < cache.expiresAtMs) {
     return cache.data;
   }
   if (inFlightBySelection[selection]) {
@@ -4037,6 +4108,11 @@ async function fetchUsageLimitsUncached({
   providerTimeoutMs = DEFAULT_PROVIDER_TIMEOUT_MS,
   forceRefresh = false,
   devinEnabled = false,
+  // Provider visibility gate (#956): ids to skip entirely — no upstream call,
+  // no credential read, no subprocess, no cache read/write. Null/empty means
+  // "fetch every configured provider" (the legacy behavior clients that don't
+  // send the parameter keep getting).
+  hiddenProviders = null,
   // Generation captured by getUsageLimits before the fetch began. A provider
   // key save bumps it, and this fetch must then stop at returning its own
   // result: publishing it would restore pre-save data for every later caller.
@@ -4045,13 +4121,30 @@ async function fetchUsageLimitsUncached({
   // here would let an opt-out flipped mid-fetch store a pre-opt-out result in the
   // post-opt-out slot.
   selectionKey,
+  // Injectable clock for tests. Production leaves it unset so per-provider
+  // cache gates sample the time when they actually run (the live attempt can
+  // spend the whole budget before its fallback reads the cache) instead of
+  // inheriting this fetch's start instant.
+  nowMs,
 } = {}) {
-  const nowMs = Date.now();
-
+  const injectedNowMs = Number.isFinite(nowMs) ? nowMs : undefined;
+  nowMs = injectedNowMs ?? Date.now();
+  const hiddenSet = new Set(normalizeHiddenProviders(hiddenProviders) || []);
+
+  // A hidden provider must not have its local credentials read at all (#956):
+  // these upfront token/subscription probes are the first file and keychain
+  // touches of the Claude/Codex chains, so they are gated here and every
+  // downstream step keys off the resulting null token.
   const [claudeOauth, claudeSubscription, codexAuth] = await Promise.all([
-    Promise.resolve().then(() => readClaudeCodeOauthToken({ platform, securityRunner, home, nowMs })),
-    Promise.resolve().then(() => detectClaudeCodeSubscriptionDetails({ platform, securityRunner, home })),
-    readCodexAuthBundle({ home, env }),
+    hiddenSet.has("claude")
+      ? Promise.resolve(null)
+      : Promise.resolve().then(() => readClaudeCodeOauthToken({ platform, securityRunner, home, nowMs })),
+    hiddenSet.has("claude")
+      ? Promise.resolve(null)
+      : Promise.resolve().then(() => detectClaudeCodeSubscriptionDetails({ platform, securityRunner, home })),
+    hiddenSet.has("codex")
+      ? Promise.resolve(null)
+      : readCodexAuthBundle({ home, env }),
   ]);
   const claudeToken = claudeOauth?.accessToken || null;
   const claudeTokenExpiresAtMs = claudeOauth?.expiresAtMs ?? null;
@@ -4107,6 +4200,15 @@ async function fetchUsageLimitsUncached({
     : null;
 
   const providerFetch = withFetchTimeout(fetchImpl, providerTimeoutMs);
+  // What a hidden provider's Promise.all slot resolves to. Both shapes flow
+  // through the same assembly branches as a genuinely unconfigured provider —
+  // the CommandCode/Devin fulfilled branches keep the value verbatim, the
+  // OpenCode Go branch passes `configured === false` through, Claude/Codex
+  // naturally produce `{ configured: false }` from their gated null tokens —
+  // so no hidden error, cache read, or credential touch can reach the payload
+  // (#956).
+  const hiddenSentinel = Promise.resolve({ configured: false });
+  const hiddenSettled = Promise.resolve({ status: "fulfilled", value: { configured: false } });
   const [claudeResult, codexResult, cursor, kimi, gemini, kiro, antigravity, copilot, grok, zcode, opencodeGoRaw, qoder, qoderCn, codingPlan, agentPlan, commandCodeRaw, devinRaw, workbuddy, workbuddyAi, claudeServiceStatus] = await Promise.all([
     claudeToken && !freshClaudeCache && !claudeRetryAtMs
       ? withProviderTimeout(fetchClaudeUsageLimits(claudeToken, { fetchImpl: providerFetch, maxAttempts: 1 }), "Claude", providerTimeoutMs).then(
@@ -4124,17 +4226,17 @@ async function fetchUsageLimitsUncached({
           (reason) => ({ status: "rejected", reason }),
         )
       : Promise.resolve(null),
-    withProviderTimeout(fetchCursorLimits({ home, fetchImpl: providerFetch }), "Cursor", providerTimeoutMs)
+    hiddenSet.has("cursor") ? hiddenSentinel : withProviderTimeout(fetchCursorLimits({ home, fetchImpl: providerFetch }), "Cursor", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(fetchKimiLimits({ home, env, fetchImpl: providerFetch }), "Kimi", providerTimeoutMs)
+    hiddenSet.has("kimi") ? hiddenSentinel : withProviderTimeout(fetchKimiLimits({ home, env, fetchImpl: providerFetch }), "Kimi", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(fetchGeminiLimits({ home, env, fetchImpl: providerFetch, commandRunner }), "Gemini", providerTimeoutMs)
+    hiddenSet.has("gemini") ? hiddenSentinel : withProviderTimeout(fetchGeminiLimits({ home, env, fetchImpl: providerFetch, commandRunner }), "Gemini", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    fetchKiroLimits({ commandRunner, now, platform, home }),
+    hiddenSet.has("kiro") ? hiddenSentinel : fetchKiroLimits({ commandRunner, now, platform, home }),
     // Antigravity's own budget keeps the serial chain inside providerTimeoutMs; this
     // outer race is the enforcing backstop every other provider already has, and the
     // signal makes a fired race actually kill the spawned scans and open sockets.
-    withAbortableProviderTimeout(
+    hiddenSet.has("antigravity") ? hiddenSentinel : withAbortableProviderTimeout(
       (signal) => fetchAntigravityLimits({
         home,
         commandRunner,
@@ -4150,18 +4252,18 @@ async function fetchUsageLimitsUncached({
       "Antigravity",
       providerTimeoutMs,
     ).catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(fetchCopilotLimits({ home, env, fetchImpl: providerFetch, platform, securityRunner }), "GitHub Copilot", providerTimeoutMs)
+    hiddenSet.has("copilot") ? hiddenSentinel : withProviderTimeout(fetchCopilotLimits({ home, env, fetchImpl: providerFetch, platform, securityRunner }), "GitHub Copilot", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(fetchGrokLimits({ home, env, fetchImpl: providerFetch, timeoutMs: providerTimeoutMs }), "Grok Build", providerTimeoutMs)
+    hiddenSet.has("grok") ? hiddenSentinel : withProviderTimeout(fetchGrokLimits({ home, env, fetchImpl: providerFetch, timeoutMs: providerTimeoutMs }), "Grok Build", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(fetchZcodeLimits({ home, env, fetchImpl: providerFetch, providerTimeoutMs }), "ZCode", providerTimeoutMs)
+    hiddenSet.has("zcode") ? hiddenSentinel : withProviderTimeout(fetchZcodeLimits({ home, env, fetchImpl: providerFetch, providerTimeoutMs }), "ZCode", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
     // OpenCode Go: authoritative subscription windows come from the dashboard
     // scrape; local opencode.db cost is available only as an explicit estimate.
     // See src/lib/opencode-go-limits.js.
-    withProviderTimeout(fetchOpencodeGoLimits({ home, trackerDir, env, fetchImpl: providerFetch }), "OpenCode Go", providerTimeoutMs)
+    hiddenSet.has("opencodeGo") ? hiddenSentinel : withProviderTimeout(fetchOpencodeGoLimits({ home, trackerDir, env, fetchImpl: providerFetch }), "OpenCode Go", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(
+    hiddenSet.has("qoder") ? hiddenSentinel : withProviderTimeout(
       fetchQoderLimits({
         home,
         env,
@@ -4171,7 +4273,7 @@ async function fetchUsageLimitsUncached({
       "Qoder",
       providerTimeoutMs,
     ).catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withProviderTimeout(
+    hiddenSet.has("qoderCn") ? hiddenSentinel : withProviderTimeout(
       fetchQoderCnLimits({
         home,
         env,
@@ -4185,7 +4287,7 @@ async function fetchUsageLimitsUncached({
     // products sharing the same arkcli binary. No token-consumption source —
     // consumption for the compatible CLIs is already counted from their
     // local files; these only surface the 5h/week/month quota percentages.
-    withAbortableProviderTimeout(
+    hiddenSet.has("codingPlan") ? hiddenSentinel : withAbortableProviderTimeout(
       (signal) => fetchArkCodingPlanLimits({
         commandRunner,
         home,
@@ -4197,7 +4299,7 @@ async function fetchUsageLimitsUncached({
       "Ark Coding Plan",
       providerTimeoutMs,
     ).catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withAbortableProviderTimeout(
+    hiddenSet.has("agentPlan") ? hiddenSentinel : withAbortableProviderTimeout(
       (signal) => fetchArkAgentPlanLimits({
         commandRunner,
         home,
@@ -4217,7 +4319,7 @@ async function fetchUsageLimitsUncached({
     // outer race bounds the whole slot: without it three sequential per-request
     // timeouts (whoami, then credits+subscriptions) could hold the aggregate
     // ~2x longer than any sibling provider.
-    withProviderTimeout(fetchCommandcodeLimits({ home, trackerDir, env, fetchImpl: providerFetch }), "CommandCode", providerTimeoutMs)
+    hiddenSet.has("commandCode") ? hiddenSettled : withProviderTimeout(fetchCommandcodeLimits({ home, trackerDir, env, fetchImpl: providerFetch }), "CommandCode", providerTimeoutMs)
       .then(
         (value) => ({ status: "fulfilled", value }),
         (reason) => ({ status: "rejected", reason }),
@@ -4227,17 +4329,19 @@ async function fetchUsageLimitsUncached({
     // ~/.local/share/devin/credentials.toml. No local fallback — window state
     // lives server-side. fetchDevinLimits throws on auth expiry so the
     // assemble step below can flag auth_action_required.
-    withProviderTimeout(fetchDevinLimits({ home, env, enabled: devinEnabled === true, fetchImpl: providerFetch }), "Devin", providerTimeoutMs)
+    hiddenSet.has("devin") ? hiddenSettled : withProviderTimeout(fetchDevinLimits({ home, env, enabled: devinEnabled === true, fetchImpl: providerFetch }), "Devin", providerTimeoutMs)
       .then(
         (value) => ({ status: "fulfilled", value }),
         (reason) => ({ status: "rejected", reason }),
       ),
     // WorkBuddy CN and WorkBuddy AI are separate editions. Each one calls only
     // its own local authenticated billing proxy. Abort closes the IPC socket
-    // when the provider budget expires. Reward credits are not a plan window.
-    withAbortableProviderTimeout((signal) => fetchWorkbuddyLimits({ home, env, fetchImpl: providerFetch, signal }), "WorkBuddy", providerTimeoutMs)
+    // when the provider budget expires; the post-abort grace lets the edition's
+    // disk-cache fallback land instead of the bare timeout. Reward credits are
+    // not a plan window.
+    hiddenSet.has("workbuddy") ? hiddenSentinel : withWorkbuddyProviderTimeout((signal) => fetchWorkbuddyLimits({ home, env, fetchImpl: providerFetch, signal, nowMs: injectedNowMs }), "WorkBuddy", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
-    withAbortableProviderTimeout((signal) => fetchWorkbuddyAiLimits({ home, env, fetchImpl: providerFetch, signal }), "WorkBuddy AI", providerTimeoutMs)
+    hiddenSet.has("workbuddyAi") ? hiddenSentinel : withWorkbuddyProviderTimeout((signal) => fetchWorkbuddyAiLimits({ home, env, fetchImpl: providerFetch, signal, nowMs: injectedNowMs }), "WorkBuddy AI", providerTimeoutMs)
       .catch((reason) => ({ configured: true, error: reason?.message || "Unknown error" })),
     // Public status-page probe (fail-soft, own 5-min cache in provider-status.js).
     // Only probed for configured accounts — without a token the Claude section
@@ -4255,8 +4359,10 @@ async function fetchUsageLimitsUncached({
     // that still exists means the latter — reporting `configured: false` there hides the
     // whole Claude section while the usage bars (parsed from local logs, no auth needed)
     // keep updating, which reads as "TokenTracker doesn't support my plan" rather than
-    // "your CLI login expired". Existence-only probe: no secret is read here.
-    const credentialsPresent = detectClaudeCodeCredentialsPresence({ platform, securityRunner, home });
+    // "your CLI login expired". Existence-only probe: no secret is read here — and a
+    // hidden Claude skips even that (#956): its row is the plain sentinel either way.
+    const credentialsPresent = !hiddenSet.has("claude")
+      && detectClaudeCodeCredentialsPresence({ platform, securityRunner, home });
     claude = credentialsPresent
       ? { configured: true, error: CLAUDE_AUTH_EXPIRED_MESSAGE, auth_action_required: "reauth" }
       : { configured: false };
@@ -4514,6 +4620,10 @@ async function fetchUsageLimitsUncached({
 
   for (const [providerName, provider] of Object.entries(data)) {
     if (providerName === "fetched_at" || !provider || typeof provider !== "object") continue;
+    // An exact not-configured sentinel (hidden provider #956, or an opted-out
+    // Devin) is metadata-free by contract — it was never fetched, so it must
+    // not be aged into a "disk-cache"/stale provenance.
+    if (provider.configured === false && Object.keys(provider).length === 1) continue;
     const capturedAt = provider.cached_at || data.fetched_at;
     const ageMs = Math.max(0, nowMs - Date.parse(capturedAt || ""));
     const stale = provider.stale === true || (Number.isFinite(ageMs) && ageMs > 10 * 60 * 1000);
@@ -4534,7 +4644,8 @@ async function fetchUsageLimitsUncached({
   }
 
   if (cacheGeneration === usageLimitsCacheGeneration) {
-    cacheBySelection[selectionKey || usageLimitsSelectionKey({ devinEnabled })] = {
+    pruneSelectionPartitions(nowMs);
+    cacheBySelection[selectionKey || usageLimitsSelectionKey({ devinEnabled, hiddenProviders })] = {
       data,
       expiresAtMs: cacheExpiresAtMs(data, nowMs),
     };
@@ -4542,20 +4653,50 @@ async function fetchUsageLimitsUncached({
   return data;
 }
 
+// Hidden-set keys make the partition space user-shaped and unbounded in
+// principle, while realistic sessions only ever hold a handful of selections.
+// Keep it bounded: once past the soft cap, drop expired partitions first and
+// then the oldest still-unexpired ones — they are simply refetched on demand.
+const SELECTION_PARTITION_CAP = 48;
+function pruneSelectionPartitions(nowMs) {
+  const keys = Object.keys(cacheBySelection);
+  if (keys.length <= SELECTION_PARTITION_CAP) return;
+  const expired = [];
+  const live = [];
+  for (const key of keys) {
+    (cacheBySelection[key].expiresAtMs <= nowMs ? expired : live).push(key);
+  }
+  const dropCount = keys.length - SELECTION_PARTITION_CAP;
+  const drop = expired.length >= dropCount
+    ? expired.slice(0, dropCount)
+    : [...expired, ...live.slice(0, dropCount - expired.length)];
+  for (const key of drop) delete cacheBySelection[key];
+}
+
 function resetUsageLimitsCache({ invalidateInFlight = false } = {}) {
   if (invalidateInFlight) usageLimitsCacheGeneration += 1;
-  for (const key of USAGE_LIMITS_SELECTION_KEYS) {
+  // Selection partitions are created lazily (hidden sets extend the key
+  // space), so reset whatever exists instead of a fixed key list.
+  for (const key of Object.keys(cacheBySelection)) {
     cacheBySelection[key] = { data: null, expiresAtMs: 0 };
-    // Ordinary resets still let a running fetch serve refresh=1 callers; a
-    // credential replacement must not, so drop the old-key promises too.
-    if (invalidateInFlight) inFlightBySelection[key] = null;
+  }
+  // Ordinary resets still let a running fetch serve refresh=1 callers; a
+  // credential replacement must not, so drop the old-key promises too. The
+  // in-flight map is walked on its own: a selection can hold a promise before
+  // its partition exists (stored only when the fetch completes).
+  if (invalidateInFlight) {
+    for (const key of Object.keys(inFlightBySelection)) {
+      delete inFlightBySelection[key];
+    }
   }
 }
 
 module.exports = {
   getUsageLimits,
   normalizePlanLabel,
+  normalizeHiddenProviders,
   resetUsageLimitsCache,
+  USAGE_LIMITS_PROVIDER_IDS,
   OPENCODE_GO_LIMITS_CACHE_FILE,
   resolveOpencodeGoLimitsCachePath,
   cacheExpiresAtMs,
@@ -4601,4 +4742,5 @@ module.exports = {
   fetchQoderCnLimits,
   fetchWorkbuddyLimits,
   fetchWorkbuddyAiLimits,
+  withWorkbuddyProviderTimeout,
 };