tokentracker-cli 1.5.6 → 1.5.8

package/src/lib/usage-limits.js

@@ -1,3 +1,4 @@
+const { readCustomBackend } = require("./claude-backend");
 const cp = require("node:child_process");
 const crypto = require("node:crypto");
 const fs = require("node:fs");
@@ -31,7 +32,7 @@ const { fetchGrokLimits, grokTokenSubject, loadGrokAuthEntry } = require("./grok
 const { fetchZcodeLimits } = require("./zcode-limits");
 const { fetchOpencodeGoLimits } = require("./opencode-go-limits");
 const { fetchCommandcodeLimits } = require("./commandcode-limits");
-const { fetchDevinLimits } = require("./devin-limits");
+const { fetchDevinLimits, resolveDevinCacheIdentity } = require("./devin-limits");
 const { fetchQoderLimits, fetchQoderCnLimits } = require("./qoder-limits");
 const { fetchArkCodingPlanLimits } = require("./ark-coding-plan-limits");
 const { fetchArkAgentPlanLimits } = require("./ark-agent-plan-limits");
@@ -56,7 +57,8 @@ const execFileAsync = promisify(cp.execFile);
 // is never served (or joined onto) a response fetched while it was on, an aggregate
 // fetched while Antigravity was enabled is never served after the opt-out is set,
 // and a response fetched for a visibility selection is never served to one made
-// under a different one. Key = `${devin}-${antigravity}[-<hidden ids>]`.
+// under a different one. Custom Claude origins also partition cached/in-flight
+// responses so switching endpoints cannot resurrect Anthropic quota bars.
 const USAGE_LIMITS_BASE_SELECTION_KEYS = ["off-on", "off-off", "on-on", "on-off"];
 const cacheBySelection = {};
 for (const key of USAGE_LIMITS_BASE_SELECTION_KEYS) cacheBySelection[key] = { data: null, expiresAtMs: 0 };
@@ -198,6 +200,29 @@ const KIMI_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 // (mirrors Claude / Codex / Cursor).
 const GROK_LIMITS_CACHE_FILE = "grok-usage-limits-cache.json";
 const GROK_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+// Kiro's quota windows come from a local kiro-cli round-trip (2s version probe +
+// 20s per attempt) whose upstream call can time out or return an unparseable
+// panel. Persist the last successful windows so a blip serves stale bars instead
+// (mirrors Claude / Codex / OpenCode Go / Cursor).
+const KIRO_LIMITS_CACHE_FILE = "kiro-usage-limits-cache.json";
+const KIRO_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+// kiro-cli persists the signed-in account's CodeWhisperer profile ARN — a
+// non-secret resource id — alongside its tokens in this file. It is the cache
+// partition key, never the token itself.
+const KIRO_AUTH_TOKEN_FILE = "kiro-auth-token.json";
+// api.github.com is the most stable of the network providers, but a timeout or 5xx
+// still blanks the Copilot card until the next poll. Persist the last successful
+// windows so a blip serves stale bars instead (mirrors Claude / Codex / OpenCode Go /
+// Cursor).
+const COPILOT_LIMITS_CACHE_FILE = "copilot-usage-limits-cache.json";
+const COPILOT_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
+// Devin's GetPlanStatus RPC (server.codeium.com) is the only source of its
+// daily/weekly quota windows — window state lives server-side. A transient
+// timeout / 5xx previously blanked the card until the next poll — persist the
+// last successful windows so a blip serves stale bars instead
+// (mirrors OpenCode Go / Cursor).
+const DEVIN_LIMITS_CACHE_FILE = "devin-usage-limits-cache.json";
+const DEVIN_LIMITS_CACHE_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
 // A 429 from the usage endpoint carries a long `retry-after` (often 20+ minutes). Persist
 // the cooldown so every surface — this process, the menu bar app's embedded server, a later
 // restart — stops calling until it expires. Hammering during the cooldown just renews the
@@ -1775,6 +1800,112 @@ function readKiroCreditsSummary({ home = os.homedir() } = {}) {
   }
 }
 
+// ─────────────────────────────────────────────────────────────────────────────
+// Kiro limits disk cache — last good windows parsed from the kiro-cli panel.
+// ─────────────────────────────────────────────────────────────────────────────
+
+function resolveKiroLimitsCachePath({ home } = {}) {
+  return path.join(home || os.homedir(), ".tokentracker", "tracker", KIRO_LIMITS_CACHE_FILE);
+}
+
+function hasKiroWindow(limits) {
+  return Boolean(limits?.primary_window || limits?.secondary_window);
+}
+
+// Kiro windows carry `reset_at` as an ISO string (the plan's monthly reset date,
+// the bonus credits' own expiry). A window whose reset has already passed is
+// stale data, not a usable fallback, so drop it. Windows without a reset stamp
+// are kept — the overall cached_at max-age gate already bounds them.
+function isKiroCacheWindowUsable(window, { nowMs } = {}) {
+  if (!window || typeof window !== "object") return false;
+  const resetAtMs = parseTimeMs(window.reset_at);
+  if (resetAtMs === null) return true;
+  return resetAtMs > nowMs;
+}
+
+function normalizeKiroCachedLimits(
+  raw,
+  { nowMs = Date.now(), maxAgeMs = KIRO_LIMITS_CACHE_MAX_AGE_MS } = {},
+) {
+  const cachedAtMs = parseTimeMs(raw?.cached_at);
+  if (!Number.isFinite(cachedAtMs)) return null;
+  if (cachedAtMs > nowMs + 60_000) return null;
+  if (nowMs - cachedAtMs > maxAgeMs) return null;
+
+  const cached = {
+    configured: true,
+    error: null,
+    plan_name: typeof raw?.plan_name === "string" ? raw.plan_name : null,
+    primary_window: isKiroCacheWindowUsable(raw?.primary_window, { nowMs }) ? raw.primary_window : null,
+    secondary_window: isKiroCacheWindowUsable(raw?.secondary_window, { nowMs }) ? raw.secondary_window : null,
+    stale: true,
+    cached_at: raw.cached_at,
+  };
+  return hasKiroWindow(cached) ? cached : null;
+}
+
+// The signed-in Kiro account partitions the cache (zcode / Cursor login-identity
+// precedent): the id is the CodeWhisperer profile ARN kiro-cli itself persists
+// next to its tokens. Reads require the stored identity to match the current
+// one, and a write without an identity is refused — after an account switch the
+// previous account's windows must never resurface as another login's fallback.
+function readKiroLimitsCache({ home, nowMs = Date.now(), identity } = {}) {
+  if (!identity) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolveKiroLimitsCachePath({ home }), "utf8"));
+    const entry = parsed?.kiro;
+    if (entry?.identity !== identity) return null;
+    return normalizeKiroCachedLimits(entry, { nowMs });
+  } catch (_error) {
+    return null;
+  }
+}
+
+function writeKiroLimitsCache(limits, { home, nowMs = Date.now(), identity } = {}) {
+  if (!identity) return;
+  if (!limits?.configured || limits.error || !hasKiroWindow(limits)) return;
+  const cachePath = resolveKiroLimitsCachePath({ home });
+  const payload = {
+    kiro: {
+      identity,
+      plan_name: limits.plan_name || null,
+      primary_window: limits.primary_window || null,
+      secondary_window: limits.secondary_window || null,
+      cached_at: new Date(nowMs).toISOString(),
+    },
+  };
+  try {
+    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+    const tmpPath = `${cachePath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(tmpPath, cachePath);
+  } catch (_error) {}
+}
+
+function resolveKiroAuthIdentity({ home } = {}) {
+  try {
+    const parsed = JSON.parse(
+      fs.readFileSync(
+        path.join(home || os.homedir(), ".aws", "sso", "cache", KIRO_AUTH_TOKEN_FILE),
+        "utf8",
+      ),
+    );
+    const profileArn = parsed?.profileArn;
+    return typeof profileArn === "string" && profileArn ? profileArn : null;
+  } catch (_error) {
+    return null;
+  }
+}
+
+// Any login-shaped CLI output (not-logged-in banner, oauth error, auth portal
+// failure) collapses into one "Not logged in to Kiro..." error inside
+// parseKiroUsageOutput, so the slot's error string is the whole auth story.
+function isKiroAuthError(message) {
+  return /not logged in to kiro|kiro-cli login|login required|oauth error|failed to initialize auth portal/i.test(
+    String(message || ""),
+  );
+}
+
 // ─────────────────────────────────────────────────────────────────────────────
 // GitHub Copilot — `GET https://api.github.com/copilot_internal/user`
 // Reuses the OAuth token from the user's existing Copilot install. Older clients
@@ -1796,7 +1927,10 @@ const COPILOT_AUTH_DB_SQL =
   "SELECT user_login, auth_authority, scopes, token_schema_version, hex(token_ciphertext) AS token_hex, "
   + "last_used_at, updated_at FROM oauth_tokens ORDER BY last_used_at DESC, updated_at DESC";
 
-function readPlaintextCopilotOauthToken({ home }) {
+// Returns { token, user } for the first usable entry — `user` is the non-secret
+// GitHub login stored alongside the OAuth token by the editors that write these
+// files (absent on hand-rolled setups), or null when a token carries no login.
+function readPlaintextCopilotAuth({ home }) {
   const candidates = [
     path.join(home, ".config", "github-copilot", "apps.json"),
     path.join(home, ".config", "github-copilot", "hosts.json"),
@@ -1819,14 +1953,21 @@ function readPlaintextCopilotOauthToken({ home }) {
       if (!value || typeof value !== "object") continue;
       const token = typeof value.oauth_token === "string" ? value.oauth_token : "";
       if (!token) continue;
+      const user = typeof value.user === "string" && value.user.trim()
+        ? value.user.trim()
+        : null;
       const host = String(key).split(":")[0];
-      if (host === "github.com") return token;
-      if (!fallback) fallback = token;
+      if (host === "github.com") return { token, user };
+      if (!fallback) fallback = { token, user };
     }
   }
   return fallback;
 }
 
+function readPlaintextCopilotOauthToken({ home }) {
+  return readPlaintextCopilotAuth({ home })?.token || null;
+}
+
 function readMacosKeychainGenericPassword({ service, account, securityRunner } = {}) {
   const runner = typeof securityRunner === "function" ? securityRunner : cp.spawnSync;
   if (runner === cp.spawnSync && !fs.existsSync(MACOS_SECURITY_BIN)) return null;
@@ -1967,6 +2108,14 @@ function readCopilotAuthDbRows({ home, sqliteReader, asyncReader = false } = {})
   return reader(dbPath, COPILOT_AUTH_DB_SQL, { label: "GitHub Copilot" });
 }
 
+// The non-secret GitHub login of the row the token came from — used as the
+// cache-partition identity for the Copilot limits fallback.
+function copilotRowLogin(row) {
+  return typeof row?.user_login === "string" && row.user_login.trim()
+    ? row.user_login.trim()
+    : null;
+}
+
 function resolveCopilotAuthDbTokenFromRows(rows, {
   platform = process.platform,
   securityRunner,
@@ -1982,7 +2131,7 @@ function resolveCopilotAuthDbTokenFromRows(rows, {
     const schemaVersion = parseCopilotAuthDbSchemaVersion(row?.token_schema_version);
     if (schemaVersion === 0) {
       const plaintextToken = decodeCopilotSchemaV0Token(row);
-      if (plaintextToken) return plaintextToken;
+      if (plaintextToken) return { token: plaintextToken, login: copilotRowLogin(row) };
       continue;
     }
 
@@ -2001,7 +2150,7 @@ function resolveCopilotAuthDbTokenFromRows(rows, {
     }
     if (!keyBase64) continue;
     const token = decryptCopilotAuthDbToken(keyBase64, ciphertextHex);
-    if (token) return token;
+    if (token) return { token, login: copilotRowLogin(row) };
   }
   return null;
 }
@@ -2019,7 +2168,7 @@ async function resolveCopilotAuthDbTokenFromRowsAsync(rows, {
     const schemaVersion = parseCopilotAuthDbSchemaVersion(row?.token_schema_version);
     if (schemaVersion === 0) {
       const plaintextToken = decodeCopilotSchemaV0Token(row);
-      if (plaintextToken) return plaintextToken;
+      if (plaintextToken) return { token: plaintextToken, login: copilotRowLogin(row) };
       continue;
     }
 
@@ -2035,7 +2184,7 @@ async function resolveCopilotAuthDbTokenFromRowsAsync(rows, {
     }
     if (!keyBase64) continue;
     const token = decryptCopilotAuthDbToken(keyBase64, ciphertextHex);
-    if (token) return token;
+    if (token) return { token, login: copilotRowLogin(row) };
   }
   return null;
 }
@@ -2047,7 +2196,7 @@ function readCopilotAuthDbToken({ home, platform = process.platform, securityRun
   } catch (_e) {
     return null;
   }
-  return resolveCopilotAuthDbTokenFromRows(rows, { platform, securityRunner });
+  return resolveCopilotAuthDbTokenFromRows(rows, { platform, securityRunner })?.token || null;
 }
 
 async function readCopilotAuthDbTokenAsync({ home, platform = process.platform, securityRunner, sqliteReader } = {}) {
@@ -2057,19 +2206,59 @@ async function readCopilotAuthDbTokenAsync({ home, platform = process.platform,
   } catch (_e) {
     return null;
   }
-  return resolveCopilotAuthDbTokenFromRowsAsync(rows, { platform, securityRunner });
+  const resolved = await resolveCopilotAuthDbTokenFromRowsAsync(rows, { platform, securityRunner });
+  return resolved?.token || null;
 }
 
-function readCopilotOauthToken({
+// Token + cache-partition identity in one resolution: the identity is the
+// non-secret GitHub login of whichever auth source produced the token
+// (the plaintext files' `user` field, or the auth.db row's `user_login`).
+// A token without a readable login yields identity null — the cache write
+// side refuses null identities.
+function readCopilotAuth({
   home = os.homedir(),
   platform = process.platform,
   securityRunner,
   sqliteReader,
 } = {}) {
-  const plaintext = readPlaintextCopilotOauthToken({ home });
-  if (plaintext) return plaintext;
+  const plaintext = readPlaintextCopilotAuth({ home });
+  if (plaintext?.token) return { token: plaintext.token, identity: plaintext.user };
   // No plaintext token found — recover the live one from the encrypted auth.db.
-  return readCopilotAuthDbToken({ home, platform, securityRunner, sqliteReader });
+  let rows;
+  try {
+    rows = readCopilotAuthDbRows({ home, sqliteReader });
+  } catch (_e) {
+    return null;
+  }
+  const resolved = resolveCopilotAuthDbTokenFromRows(rows, { platform, securityRunner });
+  return resolved ? { token: resolved.token, identity: resolved.login } : null;
+}
+
+async function readCopilotAuthAsync({
+  home = os.homedir(),
+  platform = process.platform,
+  securityRunner,
+  sqliteReader,
+} = {}) {
+  const plaintext = readPlaintextCopilotAuth({ home });
+  if (plaintext?.token) return { token: plaintext.token, identity: plaintext.user };
+  let rows;
+  try {
+    rows = await readCopilotAuthDbRows({ home, sqliteReader, asyncReader: true });
+  } catch (_e) {
+    return null;
+  }
+  const resolved = await resolveCopilotAuthDbTokenFromRowsAsync(rows, { platform, securityRunner });
+  return resolved ? { token: resolved.token, identity: resolved.login } : null;
+}
+
+function readCopilotOauthToken({
+  home = os.homedir(),
+  platform = process.platform,
+  securityRunner,
+  sqliteReader,
+} = {}) {
+  return readCopilotAuth({ home, platform, securityRunner, sqliteReader })?.token || null;
 }
 
 async function readCopilotOauthTokenAsync({
@@ -2078,9 +2267,7 @@ async function readCopilotOauthTokenAsync({
   securityRunner,
   sqliteReader,
 } = {}) {
-  const plaintext = readPlaintextCopilotOauthToken({ home });
-  if (plaintext) return plaintext;
-  return readCopilotAuthDbTokenAsync({ home, platform, securityRunner, sqliteReader });
+  return (await readCopilotAuthAsync({ home, platform, securityRunner, sqliteReader }))?.token || null;
 }
 
 function copilotRequestHeaders(token) {
@@ -2165,12 +2352,13 @@ async function fetchCopilotLimits({
   sqliteReader,
 } = {}) {
   const otel = describeCopilotOtelStatus({ home, env });
-  const token = await readCopilotOauthTokenAsync({
+  const auth = await readCopilotAuthAsync({
     home: home || (env.HOME || os.homedir()),
     platform,
     securityRunner,
     sqliteReader,
   });
+  const token = auth?.token || null;
   if (!token) return { configured: false, ...otel };
 
   try {
@@ -2179,7 +2367,9 @@ async function fetchCopilotLimits({
       headers: copilotRequestHeaders(token),
     });
     if (res.status === 401 || res.status === 403) {
-      throw new Error("GitHub Copilot token rejected. Re-authenticate via GitHub Copilot CLI/extension.");
+      const authError = new Error("GitHub Copilot token rejected. Re-authenticate via GitHub Copilot CLI/extension.");
+      authError.code = "AUTH_EXPIRED";
+      throw authError;
     }
     if (!res.ok) {
       throw new Error(`GitHub Copilot API error: HTTP ${res.status}`);
@@ -2194,7 +2384,16 @@ async function fetchCopilotLimits({
     const chatWindow = buildCopilotWindow(snapshots.chat, resetIso);
 
     if (!premiumWindow && !chatWindow) {
-      return { configured: true, error: null, plan_name: planName, primary_window: null, secondary_window: null, ...otel };
+      return {
+        configured: true,
+        error: null,
+        plan_name: planName,
+        primary_window: null,
+        secondary_window: null,
+        // Internal cache-partition key (stripped before the payload is served).
+        cache_identity: auth.identity,
+        ...otel,
+      };
     }
 
     return {
@@ -2203,10 +2402,21 @@ async function fetchCopilotLimits({
       plan_name: planName,
       primary_window: premiumWindow,
       secondary_window: chatWindow,
+      // Internal cache-partition key (stripped before the payload is served).
+      cache_identity: auth.identity,
       ...otel,
     };
   } catch (error) {
-    return { configured: true, error: error?.message || "Unknown error", ...otel };
+    return {
+      configured: true,
+      error: error?.message || "Unknown error",
+      // A token-rejection error is actionable (re-authenticate) and must not be hidden
+      // behind the stale disk-cache fallback (opencode-go auth_error precedent).
+      // Internal marker — stripped before the payload is served.
+      ...(error?.code === "AUTH_EXPIRED" ? { auth_error: true } : {}),
+      cache_identity: auth.identity,
+      ...otel,
+    };
   }
 }
 
@@ -2216,11 +2426,16 @@ async function fetchKiroLimits({
   platform = process.platform,
   home = os.homedir(),
 } = {}) {
+  // Identity captured BEFORE the CLI runs: if the account switches while
+  // /usage is in flight, the write side can compare against a fresh read and
+  // refuse instead of stamping the previous account's panel under the new
+  // login. Internal marker — stripped before the payload is served.
+  const cacheIdentity = resolveKiroAuthIdentity({ home });
   const trackedCredits = readKiroCreditsSummary({ home });
   const binaryPath = await whichBinary("kiro-cli", { commandRunner });
   if (!binaryPath) {
     return trackedCredits
-      ? { configured: true, error: null, ...trackedCredits }
+      ? { configured: true, error: null, cache_identity: cacheIdentity, ...trackedCredits }
       : { configured: false };
   }
 
@@ -2278,6 +2493,7 @@ async function fetchKiroLimits({
           configured: true,
           error: null,
           ...parseKiroCommandResult(result, { now }),
+          cache_identity: cacheIdentity,
           ...(trackedCredits || {}),
         };
       } catch (error) {
@@ -2289,6 +2505,7 @@ async function fetchKiroLimits({
     return {
       configured: true,
       error: error?.message || "Unknown error",
+      cache_identity: cacheIdentity,
       ...(trackedCredits || {}),
     };
   }
@@ -3193,6 +3410,25 @@ function isGrokCacheWindowUsable(window, { nowMs } = {}) {
   return resetAtMs > nowMs;
 }
 
+function resolveCopilotLimitsCachePath({ home } = {}) {
+  return path.join(home || os.homedir(), ".tokentracker", "tracker", COPILOT_LIMITS_CACHE_FILE);
+}
+
+function hasCopilotWindow(limits) {
+  return Boolean(limits?.primary_window || limits?.secondary_window);
+}
+
+// Copilot windows carry `reset_at` as an ISO string built from the monthly
+// quota_reset_date. A window whose reset has already passed is stale data, not a
+// usable fallback, so drop it. Windows without a reset stamp are kept — the overall
+// cached_at max-age gate already bounds them.
+function isCopilotCacheWindowUsable(window, { nowMs } = {}) {
+  if (!window || typeof window !== "object") return false;
+  const resetAtMs = parseTimeMs(window.reset_at);
+  if (resetAtMs === null) return true;
+  return resetAtMs > nowMs;
+}
+
 function normalizeGrokCachedLimits(
   raw,
   { nowMs = Date.now(), maxAgeMs = GROK_LIMITS_CACHE_MAX_AGE_MS } = {},
@@ -3247,6 +3483,45 @@ function readGrokLimitsCache({ home, nowMs = Date.now(), identity } = {}) {
   }
 }
 
+function normalizeCopilotCachedLimits(
+  raw,
+  { nowMs = Date.now(), maxAgeMs = COPILOT_LIMITS_CACHE_MAX_AGE_MS } = {},
+) {
+  const cachedAtMs = parseTimeMs(raw?.cached_at);
+  if (!Number.isFinite(cachedAtMs)) return null;
+  if (cachedAtMs > nowMs + 60_000) return null;
+  if (nowMs - cachedAtMs > maxAgeMs) return null;
+
+  const cached = {
+    configured: true,
+    error: null,
+    plan_name: typeof raw?.plan_name === "string" ? raw.plan_name : null,
+    primary_window: isCopilotCacheWindowUsable(raw?.primary_window, { nowMs }) ? raw.primary_window : null,
+    secondary_window: isCopilotCacheWindowUsable(raw?.secondary_window, { nowMs }) ? raw.secondary_window : null,
+    stale: true,
+    cached_at: raw.cached_at,
+  };
+  return hasCopilotWindow(cached) ? cached : null;
+}
+
+// The signed-in GitHub account partitions the cache (zcode login-identity precedent):
+// the id is the non-secret GitHub login stored alongside the OAuth token (the
+// plaintext files' `user` field, or the auth.db row's `user_login`). A single home
+// resolves one active token, so one stamped entry suffices; a read requires the stored
+// identity to match the current one, and a write without an identity is refused — an
+// unreadable login must never pin another account's bars in place.
+function readCopilotLimitsCache({ home, nowMs = Date.now(), identity } = {}) {
+  if (!identity) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolveCopilotLimitsCachePath({ home }), "utf8"));
+    const entry = parsed?.copilot;
+    if (entry?.identity !== identity) return null;
+    return normalizeCopilotCachedLimits(entry, { nowMs });
+  } catch (_error) {
+    return null;
+  }
+}
+
 function writeGrokLimitsCache(limits, { home, nowMs = Date.now(), identity } = {}) {
   if (!identity) return;
   if (!limits?.configured || limits.error || !hasGrokWindow(limits)) return;
@@ -3276,6 +3551,27 @@ function writeGrokLimitsCache(limits, { home, nowMs = Date.now(), identity } = {
   } catch (_error) {}
 }
 
+function writeCopilotLimitsCache(limits, { home, nowMs = Date.now(), identity } = {}) {
+  if (!identity) return;
+  if (!limits?.configured || limits.error || !hasCopilotWindow(limits)) return;
+  const cachePath = resolveCopilotLimitsCachePath({ home });
+  const payload = {
+    copilot: {
+      identity,
+      plan_name: limits.plan_name || null,
+      primary_window: limits.primary_window || null,
+      secondary_window: limits.secondary_window || null,
+      cached_at: new Date(nowMs).toISOString(),
+    },
+  };
+  try {
+    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+    const tmpPath = `${cachePath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(tmpPath, cachePath);
+  } catch (_error) {}
+}
+
 // Failure-only identity re-derivation for the cache fallback: when the provider
 // slot's result was produced by the outer timeout race, the fetcher's own
 // identity field is lost, so read auth.json once to learn who we are serving for.
@@ -3288,6 +3584,118 @@ function resolveGrokCacheIdentity({ home, env } = {}) {
   }
 }
 
+// Failure-only identity re-derivation for the cache fallback: when the provider slot's
+// result was produced by the outer timeout race, the fetcher's identity field is lost,
+// so re-resolve the (still-local) auth store — mirroring the token-source priority so
+// the identity always belongs to the account the token resolution would pick. Async
+// like the fetcher's own resolution so a failed poll never blocks the embedded
+// server's event loop on SQLite / Keychain.
+async function resolveCopilotCacheIdentity({
+  home = os.homedir(),
+  platform = process.platform,
+  securityRunner,
+  sqliteReader,
+} = {}) {
+  try {
+    const resolved = await readCopilotAuthAsync({ home, platform, securityRunner, sqliteReader });
+    return resolved?.identity || null;
+  } catch (_error) {
+    return null;
+  }
+}
+
+function resolveDevinLimitsCachePath({ home } = {}) {
+  return path.join(home || os.homedir(), ".tokentracker", "tracker", DEVIN_LIMITS_CACHE_FILE);
+}
+
+function hasDevinWindow(limits) {
+  return Boolean(limits?.primary_window || limits?.secondary_window);
+}
+
+// Devin windows carry `reset_at` as an ISO string. A window whose reset has
+// already passed is stale data, not a usable fallback, so drop it. Windows
+// without a reset stamp are kept — the overall cached_at max-age gate already
+// bounds them.
+function isDevinCacheWindowUsable(window, { nowMs } = {}) {
+  if (!window || typeof window !== "object") return false;
+  const resetAtMs = parseTimeMs(window.reset_at);
+  if (resetAtMs === null) return true;
+  return resetAtMs > nowMs;
+}
+
+function normalizeDevinCachedLimits(
+  raw,
+  { nowMs = Date.now(), maxAgeMs = DEVIN_LIMITS_CACHE_MAX_AGE_MS } = {},
+) {
+  const cachedAtMs = parseTimeMs(raw?.cached_at);
+  if (!Number.isFinite(cachedAtMs)) return null;
+  if (cachedAtMs > nowMs + 60_000) return null;
+  if (nowMs - cachedAtMs > maxAgeMs) return null;
+
+  const cached = {
+    configured: true,
+    error: null,
+    plan_label: typeof raw?.plan_label === "string" ? raw.plan_label : null,
+    primary_window: isDevinCacheWindowUsable(raw?.primary_window, { nowMs }) ? raw.primary_window : null,
+    secondary_window: isDevinCacheWindowUsable(raw?.secondary_window, { nowMs }) ? raw.secondary_window : null,
+    stale: true,
+    cached_at: raw.cached_at,
+  };
+  return hasDevinWindow(cached) ? cached : null;
+}
+
+// Match the current credential-file revision, including on timeout fallback.
+// Legacy unpartitioned entries are deliberately ignored.
+function readDevinLimitsCache({ home, nowMs = Date.now(), identity } = {}) {
+  if (!identity) return null;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(resolveDevinLimitsCachePath({ home }), "utf8"));
+    if (parsed?.devin?.identity !== identity) return null;
+    return normalizeDevinCachedLimits(parsed.devin, { nowMs });
+  } catch (_error) {
+    return null;
+  }
+}
+
+function writeDevinLimitsCache(limits, { home, nowMs = Date.now(), identity } = {}) {
+  if (!identity) return;
+  if (!limits?.configured || limits.error || !hasDevinWindow(limits)) return;
+  const cachePath = resolveDevinLimitsCachePath({ home });
+  const payload = {
+    devin: {
+      identity,
+      plan_label: limits.plan_label || null,
+      primary_window: limits.primary_window || null,
+      secondary_window: limits.secondary_window || null,
+      cached_at: new Date(nowMs).toISOString(),
+    },
+  };
+  try {
+    fs.mkdirSync(path.dirname(cachePath), { recursive: true });
+    const tmpPath = `${cachePath}.${process.pid}.tmp`;
+    fs.writeFileSync(tmpPath, JSON.stringify(payload, null, 2), { encoding: "utf8", mode: 0o600 });
+    fs.renameSync(tmpPath, cachePath);
+  } catch (_error) {}
+}
+
+function clearDevinLimitsCache({ home } = {}) {
+  try {
+    fs.rmSync(resolveDevinLimitsCachePath({ home }), { force: true });
+  } catch (_error) {}
+}
+
+// Only transient failures fall back to the disk cache. Requests without a
+// status (timeouts, transport failures, non-JSON or schema-malformed bodies)
+// are blips by construction; 429 and 5xx are the classic retryable classes.
+// Everything else — the ambiguous HTTP 400 the docs pin as a plain provider
+// error, and any other non-auth 4xx — is potentially persistent, and stale
+// bars must not mask it for up to the whole TTL.
+function isDevinTransientFetchError(reason) {
+  const status = reason?.statusCode;
+  if (typeof status !== "number") return true;
+  return status === 429 || status >= 500;
+}
+
 function resolveClaudeRateLimitPath({ home } = {}) {
   return path.join(home || os.homedir(), ".tokentracker", "tracker", CLAUDE_RATE_LIMIT_FILE);
 }
@@ -4630,7 +5038,14 @@ function cacheExpiresAtMs(data, fetchedAtMs) {
 
 /** Return cached quota or share one in-flight fetch for the requested provider selection. */
 async function getUsageLimits(options = {}) {
-  const selection = usageLimitsSelectionKey(options);
+  // Resolve current routing before any aggregate cache or in-flight selection.
+  // Keep this snapshot for the fetch so a settings change during an await cannot
+  // publish one backend's response into another backend's cache partition.
+  const claudeBackend = normalizeHiddenProviders(options.hiddenProviders)?.includes("claude")
+    ? null
+    : readCustomBackend({ home: options.home || os.homedir(), env: options.env });
+  const customOrigin = claudeBackend?.backend === "custom" ? claudeBackend.backend_origin : null;
+  const selection = usageLimitsSelectionKey(options) + (customOrigin ? `-claude:${customOrigin}` : "");
   const cache = cacheBySelection[selection];
   const nowMs = Date.now();
   // Unseen selections (a hidden set never requested before this process's
@@ -4644,6 +5059,7 @@ async function getUsageLimits(options = {}) {
   const cacheGeneration = usageLimitsCacheGeneration;
   const promise = fetchUsageLimitsUncached({
     ...options,
+    claudeBackend,
     selectionKey: selection,
     cacheGeneration,
   }).finally(() => {
@@ -4676,6 +5092,7 @@ async function fetchUsageLimitsUncached({
   // "fetch every configured provider" (the legacy behavior clients that don't
   // send the parameter keep getting).
   hiddenProviders = null,
+  claudeBackend = null,
   // Generation captured by getUsageLimits before the fetch began. A provider
   // key save bumps it, and this fetch must then stop at returning its own
   // result: publishing it would restore pre-save data for every later caller.
@@ -4693,16 +5110,17 @@ async function fetchUsageLimitsUncached({
   const injectedNowMs = Number.isFinite(nowMs) ? nowMs : undefined;
   nowMs = injectedNowMs ?? Date.now();
   const hiddenSet = new Set(normalizeHiddenProviders(hiddenProviders) || []);
+  const customClaudeBackend = !hiddenSet.has("claude") && claudeBackend?.backend === "custom";
 
   // A hidden provider must not have its local credentials read at all (#956):
   // these upfront token/subscription probes are the first file and keychain
   // touches of the Claude/Codex chains, so they are gated here and every
   // downstream step keys off the resulting null token.
   const [claudeOauth, claudeSubscription, codexAuth] = await Promise.all([
-    hiddenSet.has("claude")
+    hiddenSet.has("claude") || customClaudeBackend
       ? Promise.resolve(null)
       : Promise.resolve().then(() => readClaudeCodeOauthToken({ platform, securityRunner, home, nowMs })),
-    hiddenSet.has("claude")
+    hiddenSet.has("claude") || customClaudeBackend
       ? Promise.resolve(null)
       : Promise.resolve().then(() => detectClaudeCodeSubscriptionDetails({ platform, securityRunner, home })),
     hiddenSet.has("codex")
@@ -4889,9 +5307,10 @@ async function fetchUsageLimitsUncached({
       ),
     // Devin (devin.ai): daily/weekly subscription quota from the official
     // GetPlanStatus RPC, keyed by the session token the Devin CLI stores in
-    // ~/.local/share/devin/credentials.toml. No local fallback — window state
-    // lives server-side. fetchDevinLimits throws on auth expiry so the
-    // assemble step below can flag auth_action_required.
+    // ~/.local/share/devin/credentials.toml — window state lives server-side,
+    // so the assemble step below serves the last-good disk cache when this
+    // poll fails transiently. fetchDevinLimits throws on auth expiry so the
+    // assemble step can flag auth_action_required.
     hiddenSet.has("devin") ? hiddenSettled : withProviderTimeout(fetchDevinLimits({ home, env, enabled: devinEnabled === true, fetchImpl: providerFetch }), "Devin", providerTimeoutMs)
       .then(
         (value) => ({ status: "fulfilled", value }),
@@ -4934,7 +5353,9 @@ async function fetchUsageLimitsUncached({
   ]);
 
   let claude;
-  if (!claudeToken) {
+  if (customClaudeBackend) {
+    claude = { configured: true, ...claudeBackend, limits_status: "not_applicable", cost_status: "unknown", error: null };
+  } else if (!claudeToken) {
     // Claude Code blanks `accessToken`/`refreshToken` in place when its login expires
     // (macOS Keychain item and .credentials.json alike) instead of removing the entry,
     // so "no token" is ambiguous: never signed in, or signed in and expired. An entry
@@ -5010,7 +5431,7 @@ async function fetchUsageLimitsUncached({
   // waiting out the poll interval. Re-read here (not the pre-fetch value) so a
   // cool-down just armed by this cycle's 429 is included; a successful read above
   // cleared the file, so this is null in the happy path.
-  if (claude.configured) {
+  if (claude.configured && claude.limits_status !== "not_applicable") {
     const claudeCooldownMs = readClaudeRateLimitRetryAtMs({
       home,
       nowMs,
@@ -5141,8 +5562,13 @@ async function fetchUsageLimitsUncached({
 
   // Devin: server-owned quota windows like CommandCode — a fulfilled
   // `configured: false` means no CLI credentials; a rejected fetch with
-  // AUTH_EXPIRED flags auth_action_required for the re-sign-in hint.
+  // AUTH_EXPIRED flags auth_action_required for the re-sign-in hint, and a
+  // CREDENTIALS_INVALID error is a broken local sign-in (unreadable file,
+  // missing token, unsupported api_server_url) — both actionable, never
+  // masked by the disk cache below.
   let devinObj;
+  const devinCredentialsInvalid =
+    devinRaw?.status === "rejected" && devinRaw.reason?.code === "CREDENTIALS_INVALID";
   if (devinRaw?.status === "fulfilled") {
     const value = devinRaw.value;
     devinObj = value && value.configured === false
@@ -5155,6 +5581,50 @@ async function fetchUsageLimitsUncached({
       : { configured: true, error: reason?.message || "Unknown error" };
   }
 
+  // Devin: persist last successful windows so a transient timeout/5xx on the
+  // server.codeium.com route serves stale bars instead of a flashing "fetch
+  // failed" (mirrors OpenCode Go / Cursor). Auth and broken-credential errors
+  // punch through above, ambiguous/persistent HTTP rejections punch through
+  // below, an opted-out / unconfigured provider has no window state to fall
+  // back on, and a successful windowless read (legacy billing strategy)
+  // invalidates any prior entry instead of leaving it for a later blip to
+  // resurrect the former plan's bars.
+  if (
+    devinObj
+    && devinObj.configured !== false
+    && devinObj.auth_action_required !== "reauth"
+    && !devinCredentialsInvalid
+  ) {
+    const currentIdentity = resolveDevinCacheIdentity({ home, env });
+    if (!devinObj.error) {
+      // A response belongs to the credentials read before its request. Never
+      // write or clear a new login's cache after an in-flight replacement.
+      if (cacheGeneration === usageLimitsCacheGeneration
+        && currentIdentity && devinObj.cache_identity === currentIdentity) {
+        if (hasDevinWindow(devinObj)) {
+          writeDevinLimitsCache(devinObj, { home, nowMs, identity: currentIdentity });
+        } else {
+          clearDevinLimitsCache({ home });
+        }
+      }
+    } else if (isDevinTransientFetchError(devinRaw?.reason)) {
+      // The fallback lands after the whole provider round: sample the clock
+      // here (tests keep their injected clock) so a window that rolled over
+      // while the poll was waiting is dropped instead of served.
+      const cached = readDevinLimitsCache({
+        home,
+        nowMs: injectedNowMs ?? Date.now(),
+        identity: currentIdentity,
+      });
+      if (cached) devinObj = cached;
+    }
+  }
+
+  if (devinObj && "cache_identity" in devinObj) {
+    const { cache_identity: _identity, ...devinPayload } = devinObj;
+    devinObj = devinPayload;
+  }
+
   // Cursor: persist last successful windows so a transient timeout/5xx on the
   // cursor.com / api2.cursor.sh routes serves stale bars instead of a flashing
   // "fetch failed" (mirrors Codex / Claude / OpenCode Go). A session-expiry error
@@ -5244,6 +5714,45 @@ async function fetchUsageLimitsUncached({
     ? { ...cursorWithCache, quaternary_window: null }
     : cursorWithCache;
 
+  // Copilot: same fallback contract as Cursor for the api.github.com route — a
+  // transient timeout/5xx serves stale bars instead of a flashing "fetch failed",
+  // while a token-rejection error (401/403 — "re-authenticate") is actionable and
+  // passes through untouched. The otel probe fields ride along on every slot
+  // result, so a cached overlay spreads the live object first and lets the cached
+  // entry win only the limit fields.
+  let copilotWithCache;
+  if (!copilot || copilot.configured === false) {
+    copilotWithCache = copilot;
+  } else if (copilot.auth_error === true) {
+    copilotWithCache = copilot;
+  } else if (!copilot.error && hasCopilotWindow(copilot)) {
+    copilotWithCache = {
+      ...copilot,
+      stale: false,
+      cached_at: new Date(nowMs).toISOString(),
+    };
+    // Only the login captured with the request can own its windows. An
+    // unknown login must never be promoted to a newly signed-in account.
+    const identity = copilot.cache_identity;
+    if (typeof identity === "string" && identity
+      && identity === await resolveCopilotCacheIdentity({ home, platform, securityRunner })
+      && cacheGeneration === usageLimitsCacheGeneration) {
+      writeCopilotLimitsCache(copilotWithCache, { home, nowMs, identity });
+    }
+  } else {
+    // Re-read the current login even when the failed request carries an identity:
+    // the account may have changed while the request was in flight.
+    const identity = await resolveCopilotCacheIdentity({ home, platform, securityRunner });
+    // Sample after the async auth lookup too: a slow poll can straddle a reset.
+    const cached = readCopilotLimitsCache({ home, nowMs: Date.now(), identity });
+    copilotWithCache = cached ? { ...copilot, ...cached } : copilot;
+  }
+  // cache_identity / auth_error are internal cache-plumbing markers, not payload.
+  if (copilotWithCache && ("cache_identity" in copilotWithCache || "auth_error" in copilotWithCache)) {
+    const { cache_identity: _identity, auth_error: _authError, ...copilotPayload } = copilotWithCache;
+    copilotWithCache = copilotPayload;
+  }
+
   // Kimi: persist last successful windows so a transient timeout/5xx on the
   // api.kimi.com / api.kimi.ai coding routes serves stale bars instead of a
   // flashing "fetch failed" (mirrors Cursor / Codex / OpenCode Go). Re-login
@@ -5348,9 +5857,61 @@ async function fetchUsageLimitsUncached({
     geminiWithCache = geminiPayload;
   }
 
+  // Kiro: the slot runs the local kiro-cli (its own 2s/20s command budgets,
+  // never rejects), so the failure modes are CLI timeouts, unparseable panels
+  // and backend hiccups — persist the last successful windows and serve them
+  // stale on any of those (mirrors Codex / OpenCode Go / Cursor). A
+  // not-logged-in panel is actionable and must not be hidden behind stale
+  // cache, so it passes through untouched. The credits-only success (kiro-cli
+  // absent, sidecar present) is not a fetch failure and keeps its shape.
+  // Identity comes from the fetcher's pre-CLI capture (cache_identity), and a
+  // write only lands while a fresh read of the auth file still agrees — an
+  // account switch mid-flight refuses the write instead of stamping the
+  // previous account's panel under the new login.
+  const kiroAuthBlocked = isKiroAuthError(kiro?.error);
+  let kiroWithCache;
+  if (!kiro || kiro.configured === false || kiroAuthBlocked) {
+    kiroWithCache = kiro;
+  } else if (!kiro.error && hasKiroWindow(kiro)) {
+    kiroWithCache = {
+      ...kiro,
+      stale: false,
+      cached_at: new Date(nowMs).toISOString(),
+    };
+    if (cacheGeneration === usageLimitsCacheGeneration) {
+      const identity = typeof kiro.cache_identity === "string"
+        ? kiro.cache_identity
+        : resolveKiroAuthIdentity({ home });
+      if (identity && identity === resolveKiroAuthIdentity({ home })) {
+        writeKiroLimitsCache(kiroWithCache, { home, nowMs, identity });
+      }
+    }
+  } else if (!kiro.error) {
+    kiroWithCache = kiro;
+  } else {
+    const cached = readKiroLimitsCache({
+      home,
+      // Gate against the wall clock, not the aggregate's entry stamp: a slow
+      // failed CLI read can straddle a reset, and an expired window must not
+      // pass the reset gate on a timestamp from before the read started.
+      nowMs: Date.now(),
+      // The current login, never the fetch-time capture — a switch that
+      // happened mid-flight must not match the previous account's entry.
+      identity: resolveKiroAuthIdentity({ home }),
+    });
+    // The failed slot already carries the credits-sidecar fields the fetcher
+    // merged in; the cached windows overlay on top of them.
+    kiroWithCache = cached ? { ...kiro, ...cached } : kiro;
+  }
+  // cache_identity is internal cache plumbing, not payload.
+  if (kiroWithCache && "cache_identity" in kiroWithCache) {
+    const { cache_identity: _identity, ...kiroPayload } = kiroWithCache;
+    kiroWithCache = kiroPayload;
+  }
+
   const data = {
     fetched_at: new Date(nowMs).toISOString(),
-    claude: withPlanLabel(claude, claudePlanType, "Claude"),
+    claude: claude.limits_status === "not_applicable" ? claude : withPlanLabel(claude, claudePlanType, "Claude"),
     codex: withPlanLabel(codex, codex.plan_type, "Codex"),
     cursor: withPlanLabel(cursorLimits, cursorLimits.membership_type, "Cursor"),
     // Kimi's subType (TYPE_PURCHASE/TYPE_EVENT) is the credit *source*, not a plan
@@ -5359,9 +5920,9 @@ async function fetchUsageLimitsUncached({
     // "Kimi Type_event" (issue #130), so show the bare brand instead.
     kimi: withPlanLabel(kimiWithCache, null, "Kimi"),
     gemini: withPlanLabel(geminiWithCache, geminiWithCache.account_plan, "Gemini"),
-    kiro: withPlanLabel(kiro, kiro.plan_name, "Kiro"),
+    kiro: withPlanLabel(kiroWithCache, kiroWithCache.plan_name, "Kiro"),
     antigravity: withPlanLabel(antigravity, antigravity.account_plan, "Antigravity"),
-    copilot: withPlanLabel(copilot, copilot.plan_name, "Copilot"),
+    copilot: withPlanLabel(copilotWithCache, copilotWithCache.plan_name, "Copilot"),
     // grok-limits already maps subscriptionTier to xAI's own product names
     // ("SuperGrok Heavy", "X Premium+", "API Key"). The shared normalization
     // would Title-Case them into "Supergrok Heavy" / "Api Key" and drop "Free"
@@ -5399,6 +5960,9 @@ async function fetchUsageLimitsUncached({
     // Devin) is metadata-free by contract — it was never fetched, so it must
     // not be aged into a "disk-cache"/stale provenance.
     if (provider.configured === false && Object.keys(provider).length === 1) continue;
+    // A custom-backend state is local routing information, not an official
+    // provider API reading with a capture time or quota freshness.
+    if (provider.limits_status === "not_applicable") continue;
     const capturedAt = provider.cached_at || data.fetched_at;
     const ageMs = Math.max(0, nowMs - Date.parse(capturedAt || ""));
     const stale = provider.stale === true || (Number.isFinite(ageMs) && ageMs > 10 * 60 * 1000);
@@ -5503,6 +6067,8 @@ module.exports = {
   detectAntigravityProcess,
   fetchAntigravityLimits,
   fetchCopilotLimits,
+  readCopilotAuth,
+  readCopilotAuthAsync,
   readCopilotOauthToken,
   readCopilotOauthTokenAsync,
   readCopilotAuthDbToken,