Where the app can replace itself (the portable exe and the AppImage), a check that finds a release now installs it and relaunches straight away. The .deb still only reports the update.
Telegram toasts and similar topmost windows could sit over a bubble until the next minute's bring-back. On Windows, every fullscreen check now re-raises a shown bubble that another process's visible topmost window overlaps. The app's own panel and menus are ignored, and bubbles hidden for a fullscreen app stay hidden.
Another always-on-top window, or a shell action that hid ours, could
leave a bubble covered or hidden until restart. The fullscreen check
thread now shows every ready bubble again and puts it back at the top of
the always-on-top band once a minute, unless the user or a fullscreen
app has them hidden. Windows re-asserts HWND_TOPMOST without activating;
other platforms drop and re-set always-on-top.
The bubble is now a full-height round head with a slimmer, centred tail
whose end has small rounded corners, clipped in the page so only the
shape takes input. Its background is 60% opaque; text, rings and bars
stay solid. A new Click-through menu item makes the bubbles ignore the
mouse so clicks reach the windows below; it is saved as click_through
and turned off again from the tray menu.
OpenCode Go never had a usage source, so the provider list, its colours,
label, window lengths, default position and settings fields go. With it
goes the live/non-live split it introduced: every provider is now live,
and toggling still keeps at least one enabled. Saved settings that carry
the old OpenCode Go keys still load; the keys are dropped on next save.
On Unix the --diagnose log moves from a world-readable file in the temp directory to $XDG_STATE_HOME/usage-monitor/usage-monitor.log (falling back to the cache, then temp, directory), in a 0700 folder owned by the user, with the file at 0600. Windows keeps %TEMP%.
The autostart plugin wrote the AppImage path into Exec unquoted, so a path with spaces never started while the menu still showed the item checked. Linux now writes ~/.config/autostart/UsageMonitor.desktop itself, quoting and escaping the path for both desktop-entry layers, and keeps the file name so existing entries still read as enabled.
A failed update check is no longer stamped as the last check. The
scheduler retries it after a delay that starts at a minute, doubles per
failure and is capped at the check interval; a success resets it.
The update deadline is now a unix timestamp, so it is not pushed back by
a sleep. The thread wakes at least once a minute, and when the wall clock
ran more than 30 s ahead of Instant it treats the gap as a resume: it
polls at once and re-arms the poll interval.
A poll asked for while one is running, such as after enabling a provider,
was dropped and left the new bubble empty. It is now queued, and the
worker polls once more before it finishes; repeated requests fold into one
follow-up poll.
A stored session window whose reset time has passed, or whose reset time
the provider moved forward by more than a minute, counts as replaced, so
usage in the new window climbs from zero. Small reset-time jitter within
one window still does not re-alert, and the cooldown is unchanged.
A wrongly typed value no longer resets every setting: the valid keys are
kept and only the bad ones fall back to their defaults. A file that is not
JSON at all is copied to settings.json.bak before a save can replace it.
- Place the details panel inside the work area of the bubble's monitor
instead of the union of all monitors, so it flips above the bubble
rather than landing over the taskbar or off-screen in mixed layouts.
- Clamp bubbles into their monitor's work area after a resize and update
the saved position of bubbles that already have one.
- Snap to the taskbar only when it borders the bubble's work area, so the
primary monitor's taskbar no longer pulls bubbles on other monitors.
- Follow live theme changes on Linux through the desktop portal's
SettingChanged signal, since tao's ThemeChanged never reaches a window.
The Claude and Codex fetches now take their endpoint URLs as arguments,
with poll supplying the real ones, so tests can point them at the local
one-shot server. The tests pin the current behaviour: usage auth
failures stop before the Messages fallback, server errors and unparsable
bodies fall back to Messages, partial bodies get their reset times
merged, Messages auth failures and missing rate-limit headers are
reported, Codex 401 and 500 map to auth-required and bad-response, and
the account header is sent only when an account id is set.
A GUI app starts with its working directory at the home folder, / or
System32, and `codex exec .` refuses to run there because it is not a
trusted directory or repository. Both CLIs now start from the temp
directory so neither runs inside a project or loads its instructions and
hooks, and Codex runs with --skip-git-repo-check in a read-only sandbox.
The orchestrator takes its spawn step as an argument internally, so its
refreshed, timeout and missing-CLI outcomes are now tested with a fake
credential source, along with the locator's source order and the Claude
credential file signature.
The Windows exe and the AppImage now read and write settings.json in
their own folder, so a copied or moved folder keeps its settings. A .deb
install still uses the user's config folder, because it lives in a
read-only system folder.
Rename the crate, binary, product name, identifier, settings folder, log
file, autostart entry, user agent, updater endpoint and release assets.
Legacy Win32 clients still update: they fall back to the first .exe asset,
and the legacy rollback workflow reads the package name from the ref it
builds. Upgraded installs start with default settings.
The updater left an environment proxy to the plugin's reqwest, which was
built without SOCKS support, so a SOCKS ALL_PROXY broke updates and, on
Windows, displaced a working system proxy. Enable reqwest's socks feature
and pass the chosen environment or system proxy to the plugin explicitly.
Clash and v2ray set ALL_PROXY=socks5h://..., which ureq reads before
HTTPS_PROXY. Enable the socks-proxy feature so that entry is used instead
of skipped, and cover a socks5h tunnel with a fake SOCKS5 server.
The plugin fetches latest.json and downloads the platform entry, verifying
its minisign signature. The suffix-ignoring version comparison moves to
core::version and drives the plugin comparator; a manifest without an entry
for this platform counts as up to date. The Windows portable exe swaps
itself in with self_replace, an AppImage goes through the plugin install,
and both relaunch with --updated-to. A package-manager install keeps
checking but greys the apply item.
The GitHub API lookup, the WinHTTP download and the --apply-update helper
are gone, along with the sha2 dependency they needed.
A 1.5 s thread asks the platform whether the foreground window is a
fullscreen window of another process and feeds the result through the
visibility state machine. Windows keeps the proven evaluation with an
own-process check in place of the bubble class check; Linux reads the
EWMH active window state over X11; native Wayland and macOS report false.
Each enabled live provider gets a transparent, undecorated, always-on-top
bubble webview, created hidden at its exact physical size and its saved or
default position, clamped into the work area. It is shown without taking
focus once the page reports ready, or 1.5 s after creation.
On Windows a subclass hook reports move ends, setting changes (theme
recheck and reclamp) and display changes, answers WM_MOUSEACTIVATE with
MA_NOACTIVATE, and bubbles are shown and hidden only through
SW_SHOWNOACTIVATE and SW_HIDE. Elsewhere a 250 ms debounce armed by the
page's drag start ends the drag; on X11 it waits while Button1 is held.
Move end snaps once and saves the position; resize, clamp and reset only
move the windows. Native Wayland skips positioning.
User show/hide goes through a pure visibility state shared with the coming
fullscreen auto-hide, and the saved widget_visible now applies at startup.
A theme change reaches open bubbles. The unused os module is removed.
A per-icon tray handler runs while Tauri holds the per-icon listener
table; the inline refresh could build a missing icon that locks the same
table. The app-level handler avoids that. The AppIndicator probe now
matches the tray backend's backcompat names, which some AppImages need,
and keeps the loaded library open.
Building a webview window inside a menu or window event handler deadlocks
on Windows, so provider toggles and the Destroyed recreate now build the
bubble on a short-lived thread, serialised so only one of them creates it.
refresh_shell now takes its state snapshot inside the main-thread closure,
so a refresh queued by the poll worker cannot re-apply a tree older than
one a menu click already applied.
On Windows the start-at-login entry is written through auto-launch in
current-user mode with the quoted exe path, so an elevated run can no
longer write an all-users entry with an unquoted path that a normal run
cannot remove. Linux and macOS keep the autostart plugin.
Each enabled live provider gets a tray icon with the usage badge, a four-line tooltip and the context menu; a left click toggles the widget. Menus are rebuilt from state after every click so native check marks stay right, and a bubble right-click pops the same menu.
Alerts go through the notification plugin. On Windows the app id is registered under HKCU with a name and icon first, so a portable exe without a Start-menu shortcut can show toasts.
Start at login uses the autostart plugin under the Run value name earlier releases wrote, so an existing entry is picked up as is. On Linux the tray is skipped when no AppIndicator library loads instead of aborting.
run() keeps the pre-builder order: diagnostic log, the Windows WebView2 guard
(a message box with the download link, then exit 0), the --wait-pid wait
capped at 15 s, GDK_BACKEND=x11 under Wayland when Xwayland is present, and
the single-instance plugin registered first with a no-op callback.
setup() loads the settings, drops positions on missing monitors, reads the
theme, cleans up after earlier updates, starts the scheduler and polls. The
state sits behind one mutex reached only through with_state, so no Tauri call
runs under the lock. The poll worker keeps the in-flight gate, applies the
results, runs the CLI credential refresh and pushes bubble payloads from the
main thread.
Commands: get_bubble_state, get_strings, log_js and bubble_ready. Bubble
windows ignore close requests; Restart saves the settings and exits only once
the new instance spawned. The scaffold window now renders its payload as JSON.
The Win32 app module is removed.
One std thread owns the poll, countdown and update-check deadlines and is fed
over an mpsc channel. The deadline rules are a pure struct tested with
fabricated instants; the thread hands each due action to a host trait.
An update check that fires stays disarmed until the check reports back, and
only that report re-arms the full interval, so the automatic check repeats
instead of running once. Changing the interval checks at once when the last
check is older than the new interval.
The argv parser accepts --diagnose, --wait-pid and --updated-to and ignores
anything else, including --apply-update, which no released version passes to
the downloaded binary. Arguments are read lossily, so a non-UTF-8 argument no
longer panics.
The wait for a parent pid polls kill(pid, 0) on Unix and waits on the process
handle on Windows, capped by the caller. The Windows platform module gains the
WebView2 runtime probe, an error message box and the theme read.
handoff::relaunch spawns the AppImage or the current executable detached with
--wait-pid and returns the spawn error to the caller. The startup cleanup of
<exe>.old.* siblings and staged updater executables moves out of the Win32
update module.
ureq is built without socks-proxy, so an ALL_PROXY=socks5h entry failed
every request and a socks5 entry silently connected directly, while also
suppressing the Windows system proxy. Pick the first HTTP or HTTPS proxy
from the environment ourselves, keep NO_PROXY on it, and fall back to the
system proxy when none is usable.
Replace the WinHTTP client with a ureq agent that keeps the same
Client/Response surface: status errors come back as responses, gzip,
60 s connect / 30 s receive / 120 s total timeouts, rustls with the
platform verifier and a per-request User-Agent override.
Environment proxies come from ureq. On Windows, when none is set, the
static Internet Settings proxy is read from HKCU and parsed by a pure
core module (per-scheme ProxyServer, ProxyOverride globs and <local>);
bypassed hosts go through a direct agent. PAC/WPAD is not evaluated.
The usage providers and credential sources compile again on every
platform. Refresh keeps the Windows candidates and CREATE_NO_WINDOW;
Unix spawns claude/codex from PATH plus the usual per-user install
directories and reaps the child on a detached thread. An empty
CODEX_HOME now counts as unset and a float expiresAt is truncated
instead of ignored.
Fixture tests cover the OAuth usage body, rate-limit headers (including
a 429 over loopback), the ChatGPT envelope, ISO 8601 edge cases,
credential JSON and proxy strings. An ignored live_poll test polls the
real providers.
Poll results, threshold crossings and the alert cooldown now return
values instead of calling the tray, so they run under unit tests. The
bubble and panel payloads carry every display string and colour from
Rust, and the context menu is a plain tree with string ids that parse
back into commands. The update-check schedule and countdown delay are
plain functions of the stored times.
Settings, the English strings, the colour ramp and the bubble geometry no
longer touch Win32 types, so they compile and test on every platform.
Snapping, clamping, default placement, panel placement and the monitor
probe take plain rects; settings loading is split into parsing and an
offscreen check fed with the monitor list. ProviderId now serialises as
its slug.
Turn the package into a lib plus thin bin on Tauri v2 with a root-level
tauri.conf.json, capabilities, generated icons (keeping the hand-tuned
icon.ico) and a placeholder bubble page. The Win32 modules leave the
module tree until each one is ported; their sources stay on disk.
tauri-build now embeds the icon, a VERSIONINFO from the Cargo version and
a PerMonitorV2 manifest, replacing res/icon.rc and its stale 0.1.0.
tiennm99