[dhh]

This PR brings every open agents-panel collector PR and every default-agent launcher PR into one place, adapted so that every agent behaves the same. It supersedes #14039 (merged in here) and the community PRs credited below.

The panel goes from 6 collectors on quattro to 23, and omarchy default agent gains 9 launchers. All of them follow one written contract, docs/agent-usage-collectors.md, with bin/omarchy-agent-usage-claude as the reference.

Agents panel collectors

Collector	From	Shows
cursor	#12582 (Mark Xiong), editor sign-in from #7087 (@AndrijaSkontra)	Monthly included total, with auto/named/on-demand meters in its tooltip, and tokens by day from Cursor's dashboard RPCs
grokbot	#14563 (Rene Limberger)	Grok Bot's weekly allowance on a Cursor account
opencode	#13548 (Mauricio Wolff), #12651 (@felixzsh), fixes from #15153 (Alvaro Minarro Gil) and #14704	Zen + Go usage and Go's 5-hour, weekly, and monthly meters
copilot	#9945 (Marek Šneberger)	Local per-request usage and the live monthly allowance from GitHub
muse	#10610 (Andrés Antonio Riveros, Jackson Roussin), fixes from #15236 (Nicolas Desjardins)	5-hour and weekly meters, real prompt counts from session-index.db
hermes	#13505 (Mena, Scott Cashman), profiles from #6647 (@okurmustafa)	Local stats from every profile
agy	#11989 (@Steph4n), fixes from #14098 (steph4n), #14704 (ivanvan08), #14149 (Slawomir S), #15056 (Ashish Daga), #15466 (Cedric Darne)	Quota and plan, with the sign-in agy, pi, omp, or opencode keeps; local stats from all of them
zai	#7566 (@FelipeMayerDev)	5-hour and weekly meters
ollama	#10172 (Dante Loi)	5-hour and weekly fractions
minimax	#9597 (Michael D), fixes from #11367 (Josh LeBlanc)	Token Plan windows, plus MiniMax Code's local sessions
openrouter	#10824 (@Azonnali)	Prepaid balance and key-limit meter
deepseek	#10683 (Alexander Holbreich)	Prepaid balance, plus DeepSeek Harness session logs
kimchi	#14166 (Oleksandr Anosov)	Credits and spend budgets
devin	#8124 (Joao), pieces of #12605 (betim-hodza)	Daily/weekly quota and credit buckets from the CLI's own cache, with no network call
synthetic	#7051 (aserper)	The documented /v2/quotas
local	#12034 (Nate Ashby)	Usage on self-hosted models, the exact complement of the provider collectors
qwen	new, from Qwen Code's package source	Qwen Code's billed responses and typed prompts, plus pi/omp/opencode usage on Alibaba's Qwen Coding and Token Plan providers. No meter: Alibaba documents no usage API for the plan, and Qwen Code reads none

The upstream claude, codex, grok, kimi, and fireworks collectors are brought in line with the same contract too. Codex now keeps its last good limits through a failed probe, building on #15249, #14298 (AnPod), #14630 (Harrison Kairalla), and #14550.

What "uniform" means here

Every collector follows the contract:

• Reuse and refresh. A probe answer is reused for 15 seconds and a local scan for 20 seconds (15 minutes on the panel's near-limit refresh). --force reuses nothing.
• Kept answers. Each credential or account keeps its own last good answer. A failed check keeps it with limitsStale, and the panel shows its age on hover. A window whose reset has passed comes back at 0% instead of disappearing. Reset times are only ever the service's own.
• Retries. retryAdvised is set only when the service couldn't be reached.
• Statuses. One small status vocabulary, the same for every agent. "Waiting for auth" means in use but not signed in, "Sign-in expired" means refused, "Limits paused" means the agent's own CLI will renew the token, and " limits unavailable" means a failed check with nothing kept. A plan without limits, such as pay-as-you-go, is no trouble and shows local stats alone.
• Unused agents. An agent the machine doesn't use prints an empty record that the panel skips.
• Counting. Tokens are counted once, under the provider that bills them. pi, omp, and opencode usage is split by provider, never re-counted in a harness tab. pi/omp sessions are read from every root: profiles, PI_CODING_AGENT_DIR, and rg --no-ignore. Forks are deduplicated. Both of opencode's stores are read, deduplicated by message id, without a fork's copied history. Untrusted timestamps and token values skip their row, never the record.

The plumbing every collector needs lives once, in shell/plugins/agents/collectors.py. Each collector imports it through $OMARCHY_PATH and is only its own credentials, endpoint, provider filter, and record specifics. The module holds:

• the record and stats accumulator
• the scan and limits caches
• the pi/omp and opencode readers
• untrusted-value parsing
• HTTP with redirect refusal and the transport/cut-short rule
• the Cursor sign-in and the account registry

It's about 1,260 lines, and the 23 collectors on top of it are 11,400. The same collectors were about 19,700 lines as standalone copies.

The collector tests share fixtures the same way:

• test/shell.d/agent_usage_fixtures.py and agent-usage-helpers.sh (about 1,150 lines) hold the sandbox, collector loading, HTTP fakes and stub servers, the pi/opencode/credential builders, and cache helpers.
• One parametrized check_limits_contract/check_scan_cache pair runs each collector through the contract with a small adapter.
• Behaviour the shared and partition tests already cover for every collector isn't re-tested per collector.

The collector tests went from about 14,060 lines to 8,530, plus the helpers. Each converted test was checked by breaking its collector and watching it fail.

test/shell.d/agent-usage-partition-test.sh enforces the counting rule across all 23 collectors at once. It builds one home with sessions on every claimed provider in every source and runs every collector offline against it. It asserts that each provider's tokens land in exactly one collector, once, that the totals add up, and that an unclaimed provider is counted by nobody. It also checks that every collector prints the contract's empty record on an unused machine.

The panel's Sign-in required link is now offered only for agents omarchy-agent-account-add can sign in (Claude, Codex, Grok). Before, it would sign in the default agent instead. Ported from #11367 (Josh LeBlanc).

Default agent launchers

Each launcher is declared the way quattro's own agents are, as a lazy = true mise tool in etc/mise/conf.d/omarchy-tools.toml, with:

• an omarchy-agent case and an omarchy-default-agent alias
• a setup.default.agent.<id> menu entry
• an icon-font glyph (none colliding)
• a manual row and tests

One migration rebuilds the mise shims for existing users.

Launcher	From
qwen	#11067 (Caden DeNike)
dsh	#14455 (@stjohn668-openclaw), supersedes #9777 (@falser101)
mcode	#11367 (Josh LeBlanc), launcher only
kiro-cli	#15481 (@MrBazzieB) and #7693 (@kenth-dev)
kilo	#11129 (@WebReflection)
devin	#8124 (Joao), launcher only
amp	#6844 (@daveashworth)
commandcode	#10730 (@ahmadawais), also covers #11839's Command Code part

What changed from those PRs:

• Custom installers, curl | bash scripts, and pipx are replaced with mise packages that install on a stock machine.
• Freebuff takes no starting prompt. omarchy-agent copies the prompt to the clipboard, sends a notification, and opens the agent, with no Panel.qml change.

Left out on purpose

• Add omp (Oh My Pi) usage collector to the agents panel #13845 omp and Add X Subscription usage collector to the agents panel #15252 X Subscription. Both would count usage other collectors already count: omp's sessions are split by provider, and X is Cursor's dashboard relabeled.
• Add MiniMax Code (mcode) to the agents panel and default agent switch #11367's MiniMax Code collector. Its account lookup forges MiniMax's signed client requests with a hardcoded salt. Its launcher and its safe fixes are in.
• Add Devin collector to the agents panel #12605's live Devin RPC. It impersonates the CLI. The Devin collector reads the CLI's own cache instead.
• Launchers that need their own design:
  • Add Junie as a selectable default coding agent #8051 Junie: its npm install replaces the mise wrapper.
  • Add GitLab Duo CLI as a default coding agent #11444 GitLab Duo: the npm package is frozen.
  • Add Axon as a default coding agent #11144 Axon: needs Bun at runtime and isn't a coding agent.
  • Add AFK as a default coding agent #10079 AFK: browser-only.
  • Add openzoo as a coding agent option: claude code, no api key, pays per call #8487 openzoo: a proxy around Claude Code.
  • Add FAM as an externally packaged coding agent #8755 FAM: a framework.
  • Add Cursor to the default coding agent picker #8450 Cursor: already cursor-agent.
• Collectors dropped for their size: LiteLLM (Add a LiteLLM collector for the agents usage panel #13052, a self-hosted proxy's budget), and Kiro (Add Kiro CLI as a supported agent #7693) and Freebuff (Add Freebuff as a first-class agent #14019), which had prompt counts but no limits, and Freebuff no tokens. The Kiro and Freebuff launchers stay.
• Launchers held back until mise registers them: Goose (Add Goose as a coding agent choice #14492), Mistral Vibe (Add Mistral Vibe as a default coding agent #14847, Add Mistral Vibe as a supported coding agent #10838), ZeroClaw (Add ZeroClaw agent support #13993), and Phantombot (Add Phantombot as a default agent option #12251). They have no mise registry entry yet, and agents/skills/mise-tools.md says to wait for one rather than declare an explicit github:/aqua: backend. Their icon-font glyphs stay in the font, unused, since omarchy dev font can't remove a glyph. The Mistral Vibe usage collector stays.
• Not launchers or collectors: Add extensible agent harnesses #10171, Add opper (Opper CLI) as a lazy-installed mise tool #15288, and feat: add commandcode, qwen audio agent, and colibri to AI installs #11839's Colibri and Qwen Audio parts.

Decisions worth a look

• Cursor shows one Monthly row, with its auto/named/on-demand meters in the tooltip, instead of four rows. Dropping the meter titles brings back four rows.
• Copilot without any GitHub token says "Waiting for auth". "remote": false in copilot.json silences it for budget-only users.
• DeepSeek Harness follows its latest release (no pin) and, given a prompt, opens its browser UI with the prompt on the clipboard. It uploads session logs to DeepSeek by default. The launcher doesn't override that, and the manual names both uploads and how to turn them off. The launcher could set DSH_TELEMETRY_DISABLED=1, plus a config patch for the session-log uploader.
• Codex keeps "Waiting for auth" for a refused sign-in, because omarchy-agent-account-state relies on it.
• Grok and Claude: a lapsed access token with a live refresh token reads "Limits paused", with the last limits kept stale. Claude's one exception is a 429, which keeps numbers under 15 minutes old current (documented in the contract).
• Kimchi shows "Out of credits" when its gateway rate-limits an account with no credit left. That's now a documented status in the contract, since Kimchi's balance has no funded figure to raise the low-balance alarm.
• Antigravity keeps labeling the plan from agy's sign-in method when Google names no tier.
• No mark for Local, which has no brand, so the bar glyph stands in. Hermes' official mark is about 30 KB per file.
• Muse Code uses the Meta logo: Meta publishes no separate Muse mark, and dev.meta.ai uses this one.
• Ollama cloud models through Codex. A :cloud model reached through a Codex provider pointed at a local Ollama daemon is counted by nobody. Local leaves cloud models out, and the Ollama collector doesn't read Codex rollouts.
• Stale balances (DeepSeek, OpenRouter, Fireworks, Kimchi) are marked limitsStale, but the panel only shows age on limit windows. Showing a stale balance's age would be a small panel follow-up.

Pre-merge review

Five reviewers went over the whole diff fresh. Their two blockers are fixed:

• Kiro and Devin couldn't install. mise drops bracket options on table declarations; a test now holds every declaration to that.
• MiniMax sent a look-alike provider's key.

About 50 should-fixes are fixed, each with a regression test that fails without it:

• crash paths on untrusted input
• key, host, and endpoint safety
• incomplete answers that replaced good data
• partial scans that were cached
• launcher behaviour

About 20 test coverage gaps are closed, each proven against a code change that used to slip through. The midnight-sensitive tests are frozen to the day they start. Every Greptile comment is answered inline.

Official marks

Every agent mark was checked against the brand's own site, favicon, press kit, or repo. These were wrong or generic and now use the official mark:

• Default Agent menu: Antigravity, Claude, Crush, Kimi, and Muse Code drew Nerd Font stand-ins and now use icon-font marks. Amp's old chevrons became its current wordmark tile, and Codex uses the Codex app's >_ mark instead of the plain OpenAI blossom.
• Agents panel: Antigravity (it showed a Gemini-style sparkle) and Fireworks (a made-up burst) use their real marks, and OpenRouter gets its brand v2 glyph.

The font README records every source. The font is package-owned, so the new glyphs reach desktops with the next omarchy-settings release; until then those entries draw no icon on a pulled checkout.

Fuzzing

Six fuzzers threw adversarial input at all 23 collectors and the 9 launchers, sandboxed and offline: malformed files and replies, wrong types at every level, out-of-range and falsy times, every HTTP failure, dripping servers, corrupt and future-stamped caches, hostile keys. A skeptic reran each report; 45 reproduced and 35 were rejected. All 45 are fixed, each with a regression test that fails without it:

• Shared helpers: a reply nested too deep, a key with a line break (which also put the key in a traceback), a server dripping bytes forever, an overflowed number printing invalid JSON, a limits cache stamped before the clock went back, and digit strings that can't be a time.
• Collectors: crashes on one bad line or reply (Grok, Claude, Codex, Copilot, Antigravity, Z.ai, OpenCode, Qwen, Fireworks, Local), wrong-shaped answers replacing kept limits (Antigravity, Kimi, Fireworks), and partial scans cached as complete (MiniMax, DeepSeek).
• Keys: Kimchi, Synthetic, DeepSeek, MiniMax, and Fireworks base-URL overrides now go through trusted_endpoint(), so a key never travels over plain HTTP to another host.
• Accounts and state: Claude's single-home limits cache is keyed by account, so a new sign-in never shows the last account's numbers; an abandoned Kimi CLI lock is taken over; Claude and Codex count a line with a 0, false, or empty time nowhere instead of today.
• Launchers: a user's own install in ~/.local/bin runs ahead of mise's lazy shim.

Final checks

• Launchers installed for real. All 9 installed through mise in a sandbox on x86_64, with binary names matching what omarchy-agent runs, and each answered --version/--help. The flags the launcher passes appear in each tool's help, except Amp's --dangerously-allow-all, which its own messages recommend. That found a bug Kimi already had on quattro: node is a lazy tool, and mise refuses to install an npm-backed agent without it, so picking Qwen Code, Amp, Kilo, MiniMax Code, DeepSeek Harness, Command Code, Freebuff or Kimi on a fresh machine failed. The install now names node alongside any npm-backed agent.
• Merged with current quattro. All 54 agent and launcher test files pass in both timezones, ./test/cli passes, and the full ./test/shell fails only the 11 files that fail identically on quattro alone.
• Second fresh review of everything after the fuzzing round. Fixed from it:
  • the launcher now runs mise's installed agent over a leftover ~/.local/bin copy, and recognizes older one-line mise wrappers;
  • an Antigravity bucket whose zero fraction proto3 JSON left out reads as fully spent instead of disappearing;
  • Grok, Claude and per-account entries no longer call limits stale when none were kept;
  • a reply that never finishes counts as cut short, not unreachable;
  • Copilot counts a line with an untrusted time nowhere;
  • Codex rereads per-file totals cached before the falsy-time fix.
• Freebuff downloads a 49 MB binary into ~/.config/manicode/ on its first run, outside mise.

Validation against real agents

The fixtures above were written by us, so a misreading shared between a collector and its fixture would pass. To catch that, the collectors were validated against data and definitions that didn't come from us, in ten passes, each fixing what the last one found until a pass came back with nothing that miscounts:

• Real agents, mock model server. Claude Code 2.1.308, Codex 0.163, pi, omp, opencode, Qwen Code, Kimi Code, Hermes, DeepSeek Harness, MiniMax Code, Mistral Vibe and Kimchi were installed in sandboxes and pointed at a local mock that served known token counts: tool loops, forks, resumes, compactions, model switches, subagents, failed requests, routed providers. Every collector's totals were compared with what the mock served.
• Your own data. Claude and Codex on a real home were compared with ccusage (and an independent count of typed prompts); they match to the token.
• Upstream conformance. Every endpoint and on-disk format was checked against the agent's published source, the provider's official API docs, and a credential-free probe of each endpoint.

What that changed, beyond the fuzzing fixes:

• Prompts are typed messages, not model requests (Claude and Codex counted about 80x too many); one answered in a fork, on another provider, or after a failure counts once, on the day it was typed.
• Tokens nobody counted now count once, under the provider that bills them: Claude Code's cost-state usage beyond its replies (compactions, title and side queries, about a third of real Opus usage), Codex remote compactions (token_usage_record), pi compactions, and usage routed through another provider.
• Routing: Claude Code (ANTHROPIC_BASE_URL), Codex (model_providers, openai_base_url), MiniMax Code, DeepSeek Harness, Kimi Code, Qwen Code, Hermes, Vibe, Kimchi and Copilot BYOK traffic is placed by one shared classifier (PROVIDER_HOSTS, self-hosted endpoints to Local, Ollama cloud tags to Ollama), and the partition test holds every collector to it.
• Readers: reasoning tokens counted once, fork copies counted once, Claude's weekly limit and percent scale read as Claude Code reads them, Kimi's local stats from Kimi Code's wire logs, Ollama's documented balance endpoint, DeepSeek's currencies, OpenRouter inference-only keys, a Codex API-key login starting no app-server.
• Speed: the Claude Code transcript index and the Codex rollout cache are shared across collectors and read incrementally, so a refresh parses each changed file once.

Not verified

No collector's limits, plan or balance answer was checked against a real signed-in reply: those rest on official docs, upstream source and credential-free probes. Cursor, Antigravity, Devin and Copilot can't run without a sign-in, so their local readers were checked against upstream-shaped fixtures only. A few gaps are deliberate and documented: usage behind a gateway or host nothing can place counts nowhere, and requests an agent never records (interactive Codex's title queries, omp's compactions, Claude Code sessions with no cost-state) can't be counted. The undocumented endpoints and on-disk formats come from the original PRs or were read from the agents' published source. The launchers were installed on x86_64 only; the aarch64 downloads for Kiro and Devin answer, but nothing was installed on ARM. The Default Agent menu was checked in a running shell with the new font. The new panel marks were checked through Qt's SVG renderer on dark and light surfaces, not in the live picker.

Tests

• Agent tests: every test/shell.d/agent*-test.sh passes, including the partition test and agents-panel-test.sh. With the launcher tests below that's 57 files, run in both Pacific/Honolulu and Pacific/Kiritimati.
• Launcher tests: default-agent-test.sh, menu-test.sh, mise-provision-test.sh, and every <id>-agent-test.sh pass.
• ./test/cli: passes.
• Full ./test/shell: 15 files fail: battery-status, crash-capture, hyprland-workspace-layout, i18n, keybindings-menu, menu-plugin, migrate-notify, openclaw-cli, passwordless-grant-lifecycle, screenrecording, screenrecording-wf-audio, sleep-lock, system-power, tailscale-receive, and update-restart-kernel. All 15 fail identically on a clean quattro checkout in this environment, and the failing assertions in menu-plugin, i18n, and keybindings-menu are the same on both.

Fixes found along the way:

• Probe stamps. Probe times were rounded up, which put them half a millisecond in the future, so an immediate rerun probed again instead of reusing the answer. Every collector now floors them.
• Kimi's sign-in lock read a lock the CLI had just released as busy (a race already on quattro). It now retries.
• Flaky tests. The Grok Bot test rebuilt its expected tokens from the clock, and the Hermes test stamped days in fixed 86,400-second steps that DST could merge. Both failed intermittently and are fixed.
• From Greptile's review (every comment is answered inline):
  • Devin no longer shows the previous account's quota just after a switch.
  • Muse dates prompts by the day they were made, and counts sessions its index hasn't seen yet.
  • Synthetic finds keys in named pi/omp profiles.
  • Kimchi, Copilot, Fireworks, Codex, and OpenRouter keep their last good answer when a service replies in an unexpected shape, instead of replacing it with nothing.
  • Kimchi keeps each budget's provider caps on that budget's own meter.
  • Muse drops a former plan's windows once a check says the plan has none.
  • Cursor sums a carried week again past midnight and renames a reset on-demand meter with its new spend.

🤖 Generated with Claude Code

Posted by Claude on behalf of DHH

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; the latest change fixes the remaining copied-prompt finding without introducing a new actionable issue.

Summary

Expands the agents panel to 23 collectors, shares their readers and caches, and adds default-agent launchers.

• The agents panel brings usage from more agents and providers into one view.
• Nine more coding agents can be installed and chosen as the default.
• The panel offers sign-in links only for agents it can sign in.

Previously accepted decisions remain unchanged:

• dhh accepted keeping undated OpenCode and Synthetic limits stale because the contract forbids invented reset times.
• dhh accepted the 15-minute scan reuse on near-limit refreshes as deliberate.
• dhh accepted omitted Fireworks serverlessCosts as an idle month because proto3 JSON omits empty lists.
• dhh accepted explicitly configured litellm usage as local after removing its collector.
• dhh confirmed that requiring OMARCHY_PATH follows the session's runtime contract.
• dhh accepted losing old Codex cached limits once if the first check after upgrading fails; the next successful check restores them.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Surviving fork A] --> P[Deleted parent path]
  B[Surviving fork B] --> P
  P --> F[Connected fork family]
  F --> O[Choose one prompt owner]
  O --> C[Provider collector]

Loading

_{Reviews (46) · Last reviewed commit: "Keep a deleted pi session tying its fork..." · Reviewed by Greptile}

[Rattlyy]

Thank you @dhh ! <3

[jandrusk]

One small robustness note, the same class of bug @ChaseC-130 found on #14039. In omarchy-agent-usage-copilot, parse_event_time() guards the numeric path against OverflowError, but the ISO path's final parsed.astimezone() isn't guarded. A zero-time or year-1 timestamp raises in any zone west of UTC:

  if parsed.tzinfo is None:
    parsed = parsed.replace(tzinfo=dt.timezone.utc)
  try:
    return parsed.astimezone()
  except (OverflowError, ValueError, OSError):
    return None

omarchy-agent-usage-opencode's local_day() also calls datetime.fromtimestamp(value) unguarded on the numeric branch. A corrupt or negative timestamp there would end the scan instead of falling back to today.

[rlimberger]

Grok Bot could ride along here as a fifth collector: #14563 adds it as one self-contained commit (four new files, no overlap with this PR), and it cherry-picks cleanly onto the current head.

Grok Bot runs on a Cursor account but has its own weekly pool, read from the dashboard's GetSandUsageStatus. The collector already follows this PR's adaptations: it resolves the account exactly like the Cursor collector (CURSOR_API_KEY, then the CLI's auth.json, then the editor's state.vscdb); it keeps the last good limit through a failed check, marked stale, and drops it at its reset; and it gives an empty record for accounts without Grok Bot. It carries no tokens, so nothing is counted twice with Cursor's section.

[kwsantiago]

mise 2026.10.18 adds Goose to its registry as goose-agent (aqua:aaif-goose/goose, jdx/mise#14822), so its launcher can come back.