feat(providers): add Command Code with live 5h/weekly/monthly windows

[Luna161]

Add Command Code (commandcode.ai) provider with live quota windows

TL;DR: Add a new provider that surfaces the live 5-hour and weekly usage windows plus the monthly USD credit balance for Command Code subscriptions (Go / GOAT / Pro / Max / Team) via the same Provider API key the user already uses for /provider/v1/models.

Why

Command Code is a frontier coding-agent subscription with usage-windowed plans (Go $1/$10 credit, GOAT $10/$70, Pro $20/$80, Max 10× $100/$150, Max 20× $200/$300, Team Pro $40/$40 — see docs/resources/pricing-limits#usage-limits). Users on every paid plan above Go today have no read-only way to surface their live quota in their DankBar without opening the web console — same UX gap that motivated this project for Codex, GLM, Kimi, and 9Router.

Proposed data source

Three endpoints under https://api.commandcode.ai, all authenticated with the Provider API key via Authorization: Bearer <key>. The key is the same one users already create in Studio > API Keys, the same one that hits /provider/v1/models today. No cookies, no dashboard scraping, no auth-file reads from ~/.commandcode/auth.json.

Endpoint	Purpose	Stability
GET /alpha/billing/credits	live 5h + weekly windows, monthly USD balance	⚠️ /alpha/ namespace — no documented versioned contract, can change without notice
GET /alpha/billing/subscriptions	planId + currentPeriodEnd	⚠️ same caveat
GET /provider/v1/models	already-public fallback for key validity	✅ documented at commandcode.ai/docs/provider

Honest coverage level

Quota (primary: 5h remaining %, secondary: weekly remaining %, credits: monthly USD balance). Falls back to Auth / configured when /alpha/billing/credits is unreachable, with a clear note in the card that quota windows are unavailable.

Why this differs from the CodexBar precedent (issue #2629)

CodexBar maintainers declined a direct Command Code API source in steipete/CodexBar#2629, primarily because:

1. Credential-boundary policy — CodexBar refused to read ~/.commandcode/auth.json. AiOverviewControl already follows the user-supplied-key pattern (Z.ai, MiniMax, GLM, etc.); users bring their own COMMAND_CODE_API_KEY.
2. Alpha-namespace risk — acknowledged. The adapter will degrade to a documented /provider/v1/models check on alpha failures and never claim a quota number it couldn't fetch. The card label will read "Quota endpoint unavailable" so the failure is honest, not silent.
3. Owner-mediated work — Command Code has no CLI usage-output command (verified against the official docs index at commandcode.ai/docs). The Provider API key is the only read-only channel.

Live verification

I have already verified the response shape against a live GOAT account:

// GET /alpha/billing/credits
{
  "credits": {
    "belowThreshold": false,
    "monthlyCredits": 50.2490682944,
    "purchasedCredits": 0,
    "freeCredits": 0
  },
  "windowLimits": {
    "limited": true,
    "exceeded": null,
    "fiveHour": { "used": 0.33, "cap": 14, "exceeded": false, "resetAt": 1787604583458 },
    "weekly":     { "used": 19.75, "cap": 35, "exceeded": false, "resetAt": 1787837142731 }
  }
}

resetAt is a Unix-ms timestamp that maps cleanly onto the existing resetsAt schema used by fetch_zai_native. used/cap yields usedPercent directly. monthlyCredits becomes credits.remaining in USD.

Implementation outline

Mirrors the existing fetch_zai_native structure:

• providers/get-commandcode-usage → dispatches via the existing get-provider-wrapper
• fetch_commandcode_native reads COMMAND_CODE_API_KEY, tries /alpha/billing/credits, falls back to /provider/v1/models for auth-only on alpha failure
• Widget/Settings/docs updates identical in shape to the MiniMax entry, with primary = 5h, secondary = weekly, credits = monthly USD balance, console URL = https://commandcode.ai/billing?plan=…
• Theme color: needs maintainer input; defaulting to Theme.primary if no objection
• Plan-name detection via planId: individual-goat → "GOAT", individual-pro → "Pro", individual-go → "Go", individual-max-10x/individual-max-20x → "Max 10×"/"Max 20×", team-pro → "Team Pro", provider → "Provider API"

Questions for maintainers

1. Comfortable with the /alpha/ dependency if labeled "experimental" in the docs?
2. Preferred theme color? (Suggest Theme.primary to match the neutral brand palette.)
3. Settings label — Command Code (display) vs commandcode (provider id) — confirm consistent with existing casing?

Happy to iterate on the PR per feedback before merge. The PR will be ready alongside this issue so you can review end-to-end.

[bernardopg]

@Luna161 — thank you for this outstanding contribution! 🎉

This is exactly the issue→PR flow we love: live-verified response shapes, honest-degradation design, and an adapter that mirrors fetch_zai_native's structure to the letter. The fake-curl stub with the single-quoted heredoc and carefully scoped SC2016 suppressions shows real attention to detail. I cloned your branch and ran the adapter end-to-end through a header-logging curl stub — full review below.

✅ What's already great

• Dispatch aliases commandcode|cmd|cmdcode follow the canonical-first convention; Widget display/color/console-URL alias handling mirrors the zhipu/dashscope precedent.
• The fallback ladder (/alpha/billing/credits → /provider/v1/models → unreachable note) is textbook honest coverage — no fabricated percentages, ever.
• json_error / json_note_usage signatures used correctly; the jq program is solid (Unix-ms → ISO resetsAt, clamped usedPercent, best-effort identity enrichment with 4s timeouts that can never sink the main call).
• Docs updates in docs/providers.md + README integrations table.

🔴 Blockers (must fix before merge)

1. The Authorization header ships a literal `***

All four curl calls send the masked placeholder instead of the key:

-H "Authorization: Bearer ***" \

I verified this by running your adapter through a stub that logs headers: with COMMAND_CODE_API_KEY=real_key exported, the requests still go out as Authorization: Bearer *** — so every live call will 401 and the provider can never leave the error path. The unit test can't catch it because the stub never inspects headers.

Fix: -H "Authorization: Bearer ${key}" in all four places — and consider making the stub assert the header (e.g. case on Authorization: Bearer $COMMAND_CODE_API_KEY, fail the stub otherwise) so this class of bug can't regress.

2. mode:"quota" makes the provider invisible in Settings

AiOverviewControlSettings.qml partitions allProviders into exactly two buckets — telemetry and informational (the filters behind telemetryProviders/informationalProviders). mode:"quota" matches neither, so Command Code won't appear in any picker section. Z.ai/GLM, which also surface real quota windows, use mode:"telemetry" — please switch to that.

3. Missing provider logo → Metadata CI is red

The Metadata gate requires every allProviders id to have a assets/provider-logos/commandcode.svg (or .png). It's currently failing with:

::error::Providers without local logos: ['commandcode']

Any simple, brand-safe mark works — ProviderLogo.qml handles tinting and fallback icons.

4. tests/test-commandcode.sh isn't wired into CI

The integration-tests job enumerates each suite explicitly, so your test never runs in CI. Please add a step alongside the others:

      - name: Integration test — Command Code quota windows and fallback
        run: tests/test-commandcode.sh

🟡 Nice-to-haves (non-blocking — happy to take them here or in a follow-up)

• docs/configuration.md env-var table is missing the Command Code | COMMAND_CODE_API_KEY row.
• README provider badge and copy still say 36 — bump the providers-37 badge and the "37 AI providers" line.
• Missing trailing newline at EOF in providers/get-commandcode-usage and the four fixtures.
• A short ## Unreleased CHANGELOG entry (we'll handle the plugin.json version bump and release cut at merge time, as usual).
• Future thought, not for this PR: the per-window exceeded flags could drive an explicit "limit hit" card state — today the clamp to 100% covers it visually. Also, Go-plan accounts (no 5h/weekly windows) will render credits-only; the widget's slot fallback handles primary: null gracefully, so no action needed there.

Once 1–4 are addressed I'm confident this lands quickly — the hard part (API archaeology + the honest degradation design) is already done. 💪

[bernardopg]

Hey @Luna161 — great news: I went ahead and pushed the review follow-ups directly to your branch (hope that's OK — it keeps your commit as the feature author and you as the contributor of record! 🙌).

What I fixed on top of your work

1. The Bearer *** placeholder → real credential. All four curl calls now send -H "Authorization: Bearer ${key}". Verified end-to-end through a header-logging stub: with a real key exported, the requests carry it. I also taught your fake-curl stub to log -H values into $HDR_LOG and added assertions that Authorization: Bearer user_test reaches every alpha endpoint and the models fallback — so this class of bug can never silently regress again. Your single-quoted-heredoc design made that a three-line change. 👏

2. Provider logo → CI green. Added assets/provider-logos/commandcode.svg, derived from the official logomark on the brand assets page (the black-symbol-commandcode.svg published in your .github/): the opaque background square is dropped and both symbol paths flattened to a single #000 fill — geometry untouched — because ProviderLogo.qml colorizes the alpha silhouette to the theme color at runtime. Provenance documented in SOURCES.md, matching the pi.dev precedent. The Metadata gate now reports "Runtime manifest OK — 37 providers and logos."

3. Settings visibility. mode:"quota" → mode:"telemetry" — Command Code now lands in the telemetry picker section where it belongs.

4. CI wiring. tests/test-commandcode.sh now runs in the integration-tests job, right after the Kimi Code suite.

5. Paperwork. docs/configuration.md env-var row, README badge/copy 36 → 37, a ## Unreleased CHANGELOG entry crediting you, and trailing newlines at EOF for the stub + fixtures.

Verification

All local gates pass: your test suite (with the new header assertions), shellcheck, bash -n, the metadata logo check, i18n parity, the CHANGELOG version gate, qmllint, the full existing integration suites, and scripts/package-release. CI is re-running on the branch now.

Nothing left on my checklist — once CI comes back green this is ready to merge. Thanks again for bringing Command Code on board; the adapter design was a joy to review. 🚀

[bernardopg]

CI is fully green on the updated branch ✅ — all 8 checks pass, including the previously-red Metadata gate (logo shipped) and Integration tests, which now runs tests/test-commandcode.sh (OK: test-commandcode, with the new auth-header assertions).

PR #21 is merge-ready. 🎉

[bernardopg]

Post-merge audit follow-up, shipped in v1.13.1: the Settings readiness check (get-provider-health) was missing a commandcode case — the health chip would have shown "unknown provider". Added the case (ready with COMMAND_CODE_API_KEY, missing with a pointed hint otherwise), the ProviderLogo fallback icon, and extended the CI dispatch-coverage gate to assert every selectable provider has a health-check case so this gap class can't ship again. 🛡️