Skip to content

USAGE Miner Beta 0.3.0

Pre-release
Pre-release

Choose a tag to compare

View all tags
@Deniscoke Deniscoke released this 08 Sep 18:01
· 84 commits to main since this release
v0.3.0-beta.1
d785147

USAGE Miner Beta 0.3.0 — Windows 10/11 (64-bit)

Security release. Everyone on 0.2.x should update.

What changed, and why it matters

0.2.x routed Claude Code by writing this device's miner token into ~/.claude/settings.json in plaintext. That file gets copied into dotfile repositories and pasted into bug reports. It was documented, which was not good enough.

0.3.0 removes the capability rather than documenting it:

  • Claude Code is now started by USAGE, not configured by it. Use Start with USAGE in the app, or the new Claude Code — USAGE Mining Start Menu shortcut. Routing lives in that session's process environment and is gone when you close the tool. Nothing is written to disk, and the shortcut holds an argument (run claude-code), never a credential.
  • Upgrading cleans up after 0.2.x. On first run it removes the stored credential, restores your previous Claude Code settings exactly, and rotates the exposed credential — a secret that has sat in a readable file has to be assumed read. It tells you when it has. Running it again on a clean machine does nothing.
  • Codex is unaffected and keeps persistent configuration: its config names USAGE_MINER_TOKEN rather than containing it. Still experimental — no live Codex session has run through USAGE.
  • Device credentials now carry explicit scopes: miner:route, miner:config, miner:heartbeat, miner:rotate. There is no scope for changing account settings, reading a provider key, creating a proof, altering a reward or settling points — those are not disabled, they are not expressible.

Still unsigned

This build is not code-signed. Windows SmartScreen will warn about an unrecognised publisher, and that warning is correct. Verify the bytes instead:

certutil -hashfile USAGE-Miner-0.3.0-Setup.exe SHA256

a4d2e221135f5e8d25a9acf8cb3ca2e3079afb6f851498ce49e61023da9377b4  USAGE-Miner-0.3.0.exe
770ede5eb302afd7071f538dd6cd51c89d0d7e76af0418286c54fb440fd555b6  USAGE-Miner-0.3.0-Setup.exe

USAGE-Miner-0.3.0.exe is byte-for-byte reproducible: build it from miner/ with npm run package on Node v24.13.1 and you get that hash. The installer wrapper is not — the in-box Windows C# compiler stamps a fresh module id into every build.

Signing is coming via SignPath Foundation (the miner is Apache-2.0 as of this release). When it lands, this page will name a publisher. It will not promise that Windows stops asking: SmartScreen weighs a publisher's reputation as well as its identity, and a new certificate has none yet.

Privacy and credentials

  • Provider credentials remain server-side. Your OpenRouter or Anthropic key never reaches this device.
  • USAGE does not store prompts, responses, tool arguments, or source code. Model, token counts, cost, latency, timing. Nothing else.
  • The miner is not a trusted usage reporter. It cannot submit token counts, cost, verification status or points.
  • The device credential is stored encrypted with Windows DPAPI, scoped to your Windows account.

Install

Per-user. No administrator rights, no service, no autostart. Uninstalling offers to restore every tool's original settings first.

Full details: docs/MINER.md

Assets 6
Loading