v1.11.0

What's changed

Security

• Codex's cache no longer holds the account's user_id, account_id and
  email. It stored the raw wham/usage body, so all three sat in
  ~/.cache/ai-usagebar/openai/usage.json for the life of the TTL, though no
  renderer reads any of them. It now stores the parsed response, which is an
  allowlist by construction — a field OpenAI adds later cannot start living on
  disk without someone adding it to the type first. The file was, and remains,
  mode 0600. This is the rule CLAUDE.md already stated for Command Code.

Added

• Banked reset credits for Codex and SuperGrok. Both providers let you earn
  quota resets and redeem them by hand, on their own expiry clock — information
  that existed nowhere in ai-usagebar, because it is not the window rollover
  the *_reset placeholders already showed. The count and the next expiry now
  appear in the Waybar tooltip, the TUI panel, and ai-usagebar usage --json
  (and so in the Omarchy, GNOME and KDE frontends, which read that report) as
  a list, one row per credit, with its own title and expiry — two Codex
  "Full reset (Weekly + 5 hr)" credits that lapse hours apart on the same day
  no longer collapse into a single "next expires" line. New placeholders are
  {oai_resets_available} / {oai_resets} and {sgk_resets_available} /
  {sgk_resets} (the compact count). A provider with none reports nothing
  rather than a standing 0.

  Codex's count rides its usage response; the expiries come from
  wham/rate-limit-reset-credits, called only when something is banked.
  SuperGrok's come from grok.com's ConsumerUiSvc/GetRemainingResets, a
  gRPC-Web call authenticated with the Grok Build login's own key, parsed by a
  bounded hand-written protobuf reader rather than a new dependency.

  Read-only: ai-usagebar never redeems a reset. The redemption identifier
  each provider returns beside the expiry is skipped during parsing rather than
  parsed and dropped, so it reaches neither the cache nor the screen. Both
  extra calls fail quietly — a broken one costs the expiry date and leaves
  every quota figure beside it untouched.

Changed

• SuperGrok's panel no longer repeats the current period's rollover as a
  standalone "Resets" row. That countdown already sits under the weekly
  credits bar, the same way Codex 5h and Codex weekly do.

• README.md documents the macOS Keychain prompt storm as a known issue, with
  the workaround, until #148 is fixed. Every release so far is affected on
  macOS: ai-usagebar's token write-back claims the Claude Code-credentials
  item for its own code signature, and Claude Code's own reads then raise a
  permission dialog per process.

• CONTRIBUTING.md and a PR template record the pre-PR gate, the checklist
  review kept asking for, and the bar a new provider has to clear.

• docs/vendor-endpoints.md records which providers have been evaluated and not
  added, and the credential bar a new one has to clear (#146, #147). Xiaomi MiMo
  is blocked on Xiaomi: its quota routes need a web SSO session, not the plan's
  API key. Alibaba Cloud Model Studio's Token Plan is wanted and fits the
  existing patterns, pending the evidence to build it against.

Install

Arch (AUR)

yay -S ai-usagebar-bin      # prebuilt binary from this release
yay -S ai-usagebar          # compiles from source

Manual

curl -fsSL https://github.com/akitaonrails/ai-usagebar/releases/download/v1.11.0/ai-usagebar-linux-x86_64.tar.gz | tar xz -C ~/.local/bin ai-usagebar ai-usagebar-tui

Checksums (SHA256)

c7006495509acaa222b0c568b6ad946340d87c44fc0cb0f89d4bf4a6b22479f7  ai-usagebar-linux-aarch64.tar.gz
3c64c7bffd482c73be7f38ff2a46077bc3f27d64b4863b1aa1e53b265535c649  ai-usagebar-linux-x86_64.tar.gz

Full diff: v1.10.0...v1.11.0