QuotaPane v1.4.0

The security-review release: an owner-commissioned adversarial review of the
codebase and its claims produced eleven findings — most of them places where the
documentation said more than the code did. Every finding was independently
re-verified and every fix ships here, each behavior change landing in the same
commit as the claim it affects. The review process itself is committed under
prompts/.

Security

• --debug-raw now redacts by default. Identifier fields (email,
  user_id, account_id, id) are replaced with «redacted» at any depth
  before printing; bodies that are not valid JSON are withheld. New
  --debug-raw-unsafe restores the byte-exact dump after one warning. Existing
  invocations keep working — safer.
• Proxy support is now reachable, CLI-only, and fail-closed. New
  quotapane-cli --allow-proxy opts a single run into the proxy environment
  after a printed warning that a TLS-inspecting proxy can observe the bearer
  token. Without it, behavior is unchanged: a set proxy variable (either casing)
  means nothing is sent and the run exits with an error naming the variable —
  now followed by a hint pointing at the flag. The window has no opt-in surface
  at all.
• A hostile Retry-After can no longer stall polling. The provider's hint
  is honored only up to the 30-minute backoff cap.
• Expired tokens recover fast. An auth error retries at the polling floor
  instead of escalating backoff, so a token refreshed via the official CLI is
  noticed within minutes, not up to thirty.
• Provider timestamps are validated against the real calendar (month
  lengths, leap years) and must carry a UTC offset; anything else is rejected
  and renders as unknown rather than as a wrong reset time.
• Every CI action is now pinned to a full commit SHA, matching the release
  workflow, and cargo-audit installs at a pinned version.

Documentation truth

The review's larger half: claims aligned with shipped reality. The persistence
invariant now names theme.cfg (one word, preferences only) instead of claiming
"no files at all"; TLS validation is correctly described as the bundled WebPKI
(Mozilla) root set — the OS trust store is not consulted, so an OS-installed
interception CA is rejected rather than trusted, and the threat model's
mitigation advice was rewritten to match; zeroization claims are scoped to
buffers QuotaPane owns; the auditable surface honestly includes the provider
parsers and the CLI raw-debug path; and text-mode CLI output is documented as a
summary (per-model rows and reset credits appear in --json and the window). No
JSON key changed in this release.

---

Verify this release with the three commands in the README's Verifying a
release section — checksums, cosign keyless bundle, and GitHub build
provenance.

What's Changed

• chore(deps): bump tray-icon from 0.24.1 to 0.24.2 by @dependabot[bot] in #3

Full Changelog: v1.3.0...v1.4.0

QuotaPane v1.3.0

Pace: know whether you will make it to reset, not just where you are.

Added

• Pace ticks. Every quota bar carries a thin tick at the elapsed
  share of its window. Fill short of the tick means you are under
  budget; fill past it means you are consuming faster than time is
  passing. Shown in both themes — it is information, not decoration.
• Forecast-to-limit. QuotaPane estimates your burn rate from
  recent polls; when a window's projected exhaustion lands before its
  reset, one line appears under that provider: "at this pace: 7d full
  in ~9h" — amber, turning cardinal inside six hours. When you are
  safe it shows nothing at all. Forecasts wait for roughly fifteen
  minutes of evidence before speaking, and a window reset clears the
  history. (Any 5h-window warning is necessarily inside the six-hour
  band, so session-window warnings are always cardinal.)
• --pace-demo renders a fixed synthetic scenario — no polling,
  no credentials read, no network at all — to see the feature without
  waiting for a bad week.
• quotapane-cli --json: every window object (headline and
  per-model) gains duration_secs — always present, null when the
  provider neither stated nor implied a window length. This is the
  only JSON surface change in this release.

Zero new dependencies. Verify this release with the three commands in
the README's Verifying a release section — checksums, cosign keyless
bundle, and GitHub build provenance.

Full Changelog: v1.2.0...v1.3.0

QuotaPane v1.2.0

The window gets its face.

Added

• Cipher Pine theme (the default). Near-black ground, a faint blueprint
  grid, monospace type, // section headers, and a > quotapane titlebar
  with a block status cursor — solid when idle and fresh, blinking only while
  the first poll is in flight or data is stale.
• A theme toggle. A tray-menu item switches live between Cipher Pine and
  a plain look and remembers the choice as a single word in theme.cfg under
  your platform config directory. --plain / --themed choose per run. The
  file stores nothing but that word.
• Window and tray icons, painted in code — no image assets, no image
  crates. The tray icon is a live miniature whose two bars track your Claude
  and Codex headline usage.

Changed

• Bar colors are semantic in both themes: pine below 50%, amber from 50%,
  cardinal from 80%. Bars read amber earlier by design.
• Staleness threshold 15 min → 10 min.
• quotapane-cli --json output is unchanged in this release: no key
  added, removed, or renamed.

Zero new dependencies. Verify this release with the three commands in the
README's Verifying a release section — checksums, cosign keyless bundle,
and GitHub build provenance.

Full Changelog: v1.1.0...v1.2.0

QuotaPane v1.1.0

Anthropic changed the shape of its usage response: per-model numbers moved
into a generalized limits array and the two older per-model fields now come
back empty — so the Claude per-model breakdown had quietly gone blank. This
release reads the new shape.

Added

• Codex reset credits. The Codex pane shows resets available: N when
  the provider reports rate-limit reset credits. --json carries the same
  data as reset_credits (available / applicable_now).

Fixed

• Claude per-model quotas are visible again, read from the provider's
  generalized limits array and labelled with the provider's own model
  names. The older fields are still read as a fallback.

Changed

• The window hides per-model buckets you have never touched (providers
  list every model on your plan, not just the ones you use). Hiding is a
  display change only — quotapane-cli --json still reports every bucket the
  provider sent. Note the JSON surface does change elsewhere in this
  release: reset_credits is a new key, and per-model labels now use the
  provider's display names.

Verify with the README's three verification commands.

Full Changelog: v1.0.0...v1.1.0

QuotaPane v1.0.0

A small, always-on-top desktop window that shows how much of your Claude and
Codex subscription quota is left. It reads the credential files the
official claude / codex CLIs already wrote on your machine, asks the
providers what's left, and draws the answer. No account, no server in the
middle, nothing reported to anyone.

The point of the project is the size of its trust boundary: exactly two
modules ever touch a credential or the network, and they are small enough to
read end to end in one sitting.

Highlights

• Claude 5-hour / 7-day windows; Codex rate-limit windows labelled by
  duration; per-model breakdown behind a toggle; staleness reporting.
• System tray icon with Show/Hide/Quit (Windows, macOS).
• quotapane-cli prints the same normalized snapshot as text or JSON.
• Security: egress deny-by-default with a compile-time allowlist of
  exactly two hosts; tokens never persisted, logged, or serialized
  (Secret<T>, zeroized, «redacted»); no telemetry (CI-enforced); no
  auto-update or update check; credential files opened read-only.
• Release integrity: built only in CI from the tag; SHA256SUMS +
  cosign keyless Sigstore bundle + GitHub build-provenance attestation;
  TOOLCHAIN.txt in every archive; every Action pinned by full SHA;
  drafts only, human-published.

A passing signature proves the artifact came from this repository's CI at a
specific commit — for maximum assurance, build from source.

Full Changelog: https://github.com/cipherpine/quotapane/commits/v1.0.0