
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@mynameistito/opencode-usage-limits
Advanced tools
OpenCode TUI plugin that shows Codex, OpenCode GO, ZAI, Synthetic, MiniMax Token Plan, and Qwen usage limits in the sidebar and prompt footer.
OpenCode TUI plugin that shows Codex, OpenCode GO, ZAI, Synthetic, MiniMax Token Plan, Qwen, and Alibaba Token Plan usage limits in the sidebar and prompt footer.
Usage Limits block under the sidebar Context section.qwencloud CLI.bl CLI.~/.config/opencode/usage-limits.jsonc.This package contains the OpenCode v2 TUI plugin and is published from the monorepo main branch using npm's latest dist-tag. Install it globally with:
opencode2 plugin add @mynameistito/opencode-usage-limits@latest -g
-g / --global installs to ~/.config/opencode/cli.json.-g, installs locally to <project>/.opencode/cli.json (requires a git worktree).--force replaces an existing pinned version.The CLI installs the latest package and updates the TUI plugin config for you. The package entrypoint is @mynameistito/opencode-usage-limits/tui.
To configure it manually instead, add the plugin to ~/.config/opencode/cli.json:
{
"$schema": "https://opencode.ai/v2/cli.json",
"plugins": ["@mynameistito/opencode-usage-limits"],
}
OpenCode CLI/TUI plugins are configured in cli.json.
Restart OpenCode after changing TUI plugin config.
@mynameistito/opencode-usage-limits/tui is the TUI plugin entrypoint.@mynameistito/opencode-usage-limits/schema is the JSON schema for the usage-limits configuration.examples/usage-limits.jsonc is a complete, annotated configuration example.If the plugin is stale, broken, or needs a clean reinstall, quit OpenCode and remove the cache for the lane you installed. OpenCode caches immutable package versions, so clearing the cache is required when a cli.json entry still resolves to an older version.
For standard OpenCode (@latest), clear the cached package using the command for your shell:
PowerShell:
Remove-Item -LiteralPath "$HOME\.cache\opencode\packages\@mynameistito\opencode-usage-limits@latest" -Recurse -Force
macOS/Linux:
rm -rf ~/.cache/opencode/packages/@mynameistito/opencode-usage-limits@latest
Start OpenCode again and it will reinstall the plugin from the existing cli.json entry. If the plugin is no longer configured, run the install command again:
opencode2 plugin add @mynameistito/opencode-usage-limits -g
@opencode/plugin usually mean OpenCode's package cache contains an older plugin API package. Update OpenCode, clear the cached plugin as above, then retry the install. This package does not publish OpenCode runtime packages as peer dependencies.No versions available right after a release means a supply-chain cooldown policy (e.g. min-release-age) is blocking the fresh version. Wait for the cooldown window to pass, or install a previously vetted version instead.Both packages release from the monorepo main branch using normal root Changesets and npm's latest dist-tag. The package entrypoint is @mynameistito/opencode-usage-limits/tui.
Create ~/.config/opencode/usage-limits.jsonc from the complete examples/usage-limits.jsonc example. It includes every top-level, provider-common, and provider-specific option.
If you only need Codex and ZAI with auto-discovered credentials:
{
"$schema": "https://raw.githubusercontent.com/mynameistito/opencode-plugins/main/packages/opencode-usage-limits/usage-limits.schema.json",
"providers": {
"codex": { "enabled": true },
"zai": { "enabled": true, "authorizationScheme": "raw" },
},
}
Disabled providers are hidden:
"providers": {
"codex": { "enabled": true },
"zai": { "enabled": false }
}
Top-level enabled is the plugin master switch, and showErrors controls error text globally. Each provider's enabled controls fetching. Provider showSidebarBar and showFooterBar independently control its sidebar and footer displays without stopping refreshes; both default to true.
Each provider's sidebarWindow can be all, rolling, daily, weekly, monthly, credits, or other. Rolling includes legacy 5h labels. Each provider accepts footerWindow with auto (the provider's normal selection), or one of the same window kinds. An unavailable requested footer window falls back to the provider's automatic selection and then its first available window.
Enable alibaba-token-plan to read the real 5-hour and weekly quota windows through the official Bailian CLI. This is separate from the existing qwen / qwencloud integration and from the older Alibaba Coding Plan. Team credit balances are not supported by this adapter.
Install Bailian CLI following its upstream instructions, then authenticate once:
bl auth login --console --console-site international
bl usage token-plan --console-region ap-southeast-1 --console-site international --output json
The CLI owns authentication; the plugin neither imports browser cookies nor stores credentials. Initial console login may open a browser, but refreshes use the API through bl. An OpenCode model API key alone is insufficient. bl must be on the PATH inherited by OpenCode. Command failures (including a missing CLI or expired login) use the plugin's normal error/stale-data display.
Add to ~/.config/opencode/usage-limits.jsonc:
{
"providers": {
"alibaba-token-plan": {
"enabled": true,
"region": "international",
"showSidebarBar": true,
"showFooterBar": true,
},
},
}
For mainland China, use region: "china" and log in with bl auth login --console --console-site domestic. The adapter selects cn-beijing / domestic; the default is ap-southeast-1 / international. Footer aliases are alibaba, alibaba-cn, and alibaba-token-plan. Missing quota windows are omitted rather than displayed as zero or unlimited; an entirely empty response is treated as unavailable, preserving last-good data.
The response contract follows the official CLI's usage/token-plan.ts: per5HourPercentage and per1WeekPercentage are fractions from 0 to 1, and reset timestamps are Unix milliseconds.
| Provider ID | Service | Env var | Auth header | Default base URL |
|---|---|---|---|---|
codex | ChatGPT Codex usage | — | Bearer | https://chatgpt.com/backend-api |
zai | Z.AI Coding Plan quota | OC_ZAI_API_KEY | raw / Bearer | https://api.z.ai |
synthetic | Synthetic quotas | OC_SYNTHETIC_API_KEY | Bearer | https://api.synthetic.new |
minimax | MiniMax Token Plan | OC_MINIMAX_TOKEN_PLAN_KEY | Bearer | https://www.minimax.io |
qwen | Qwen Token Plan | qwencloud CLI | CLI | — |
alibaba-token-plan | Alibaba Token Plan | — | CLI | — |
opencode-go | OpenCode GO usage | OPENCODE_API_KEY | Bearer | https://opencode.ai/zen/go/v1 |
Qwen usage requires the local qwencloud CLI to be installed and authenticated because the plugin calls its authentication-status and usage commands; an unauthenticated CLI state appears as missing credentials.
Synthetic always uses Bearer auth and ignores authorizationScheme.
Set baseUrl on minimax to https://api.minimaxi.com when using the mainland-China region. MiniMax always uses Bearer auth and ignores authorizationScheme.
authPath and apiKey are optional overrides. Typical OpenCode users only need enabled: true; label is an optional display override. Credentials are discovered automatically from OpenCode auth and provider defaults. Set apiKey (or authPath to a standalone key file) only when auto-discovery is not enough.
Codex lookup order:
~/.local/share/opencode/auth.json, provider openai.authPath, default ~/.codex/auth.json.If an official-host request rejects the OpenCode credentials, the plugin retries with the configured or default Codex auth file.
ZAI lookup order:
authPath, which can point at OpenCode auth JSON or a simple { "key": "..." } / { "apiKey": "..." } JSON file.~/.local/share/opencode/auth.json, provider zai-coding-plan.zai.apiKey, including {env:OC_ZAI_API_KEY} references.Synthetic lookup order:
authPath JSON file ({ "key": "..." } / { "apiKey": "..." } / { "synthetic": { "key": "..." } }).~/.local/share/opencode/auth.json, provider synthetic.apiKey, including {env:OC_SYNTHETIC_API_KEY} references.MiniMax Token Plan lookup order:
authPath JSON file ({ "key": "..." } / { "apiKey": "..." } / { "minimax-coding-plan": { "key": "..." } }).~/.local/share/opencode/auth.json, provider minimax-coding-plan, minimax, or minimax-token-plan.apiKey, including {env:OC_MINIMAX_TOKEN_PLAN_KEY} references.Sidebar rows look like:
Usage Limits
codex
5h: 42% used resets 1h 2m
weekly: 12% used resets 3d 4h
ZAI
tokens: 18% used resets 2h
MCP: 6% used
Synthetic
5h: 0% used resets 11m
weekly: 11% used resets 7m
MiniMax
5h: 10% used resets 2h 56m
Prompt footer shows compact usage when the current session model belongs to a supported provider:
5h: 42% used resets 1h 2m
Provider mapping:
openai -> Codex usage.zai-coding-plan -> ZAI token usage.synthetic -> Synthetic usage.minimax-coding-plan -> MiniMax Token Plan usage (prompt footer); minimax is also accepted as an alias.qwen -> Qwen Token Plan usage.opencode-go -> OpenCode GO usage.bun install
bun run typecheck
bun run test
bun run check
bun run build
The package exposes a TUI entrypoint at @mynameistito/opencode-usage-limits/tui for OpenCode's package plugin loader.
{ model_remains, base_resp }; the per-model current_interval_status and current_weekly_status are treated as 1 = in plan and 3 = not in plan, and a window is hidden when its status is 3 (the API otherwise reports a meaningless 100% remaining for a non-existent bucket).FAQs
OpenCode TUI plugin that shows Codex, DeepSeek, Moonshot/Kimi API balances, Novita AI, OpenRouter, Command Code, OpenCode GO, ZAI, Synthetic, MiniMax Token Plan, and Qwen usage limits in the sidebar and prompt footer.
The npm package @mynameistito/opencode-usage-limits receives a total of 0 weekly downloads. As such, @mynameistito/opencode-usage-limits popularity was classified as not popular.
We found that @mynameistito/opencode-usage-limits demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.