registry / @sreetej510/pi-usage / 0.1.6

@sreetej510/pi-usage@0.1.6

Pi extension that reports provider usage/rate-limit budgets (Codex, Anthropic OAuth, etc.) via /usage, with an optional statusline widget.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 32.9 KB of source, external domains: api.anthropic.com, chatgpt.com

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-15javascript

1import{homedir as gr}from"node:os";import{join as xr}from"node:path";var yt="usage",Oe="openai-codex",Ie="anthropic",Ae="https://chatgpt.com/backend-api/wham/usage",At="https://chatgpt.com/backend-api/wham/rate-limit-reset-credits",Rt="https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume",wt="codex-1",De="https://api.anthropic.com/api/oauth/usage",Re=15e3,E=180*1e3,Fe=3,St=1e3,bt=900*1e3,Et=30*1e3,ie=3600*1e3,W=xr(gr(),".pi","agent","usage-cache.json"),Be=1,se="provider-usage",ze=20,Ut=29,ae=600,vt="\x1B[39m",Mt=new Set(["five_hour","seven_day","extra_usage"]),je=[{value:"--re ...

2`)}function Ot(e,r){let t=Er(e,r);if(!t)return"usage unavailable";let n=[Mr(t)];return t.primary&&n.push(`${v(t.primary.usedPercent).toFixed(0)}% 5h`),t.secondary&&n.push(`${v(t.secondary.usedPercent).toFixed(0)}% wk`),n.length===1&&t.credits&&n.push($r(t.credits)),n.join(" ")}function It(e,r){return e.provider==="anthropic"?e.statusline:Ot(e,r)}function br(e,r){return e.provider==="anthropic"?e.summaryLines.join(`

3`):Lt(e,r)}function ve(e,r,t){let o=_r(r,e.model).map(i=>br(i,t?Date.now()-i.capturedAt:void 0)).join(`

5`);e.ui.notify(e.hasUI?Pr(o):o,"info")}function Ge(e){let r=["Unable to read usage for the current provider."];for(let t of e){let n=t.source==="pi-auth"?"Pi Codex auth":t.source==="codex-app-server"?"Codex app-server fallback":"Anthropic OAuth usage";r.push(`- ${n}: ${t.message}`)}return r.push(""),r.push("Tip: use a Pi OpenAI Codex model or Pi Anthropic model. For Codex, /login with OpenAI ChatGPT Plus/Pro. For Anthropic, /login with Anthropic so the OAuth usage endpoint can be queried."),r.join(`

6`)}function ce(e){let r=Math.round(v(e)/100*ze);return`[${"\u2588".repeat(r)}${"\u2591".repeat(ze-r)}]`}function Er(e,r){let t=e.snapshots.find(Ue);if(!r||!H(r))return t??e.snapshots[0];let n=Ur(r),o=e.snapshots.find(d=>Tt(d).some(s=>n.has(s)));if(o)return o;let i=vr(n);for(let d of i){let s=e.snapshots.filter(u=>!Ue(u)&&Tt(u).some(a=>$t(a,d)));if(s.length===1)return s[0]}return t??e.snapshots[0]}function Ur(e){let r=new Set;qe(r,e.id),qe(r,e.name);for(let t of[...r]){let n=t.indexOf("codex");n>=0&&r.add(t.slice(n))}return r}function Tt(e){return[J(e.limitId),J(e.limitName)].filter(r=>r!==void ...

7${Ke(i)}`)}catch(n){if(y(n))throw n;t.push(`>_ Anthropic raw: error \u2014 ${x(n)}`)}if(K(e).length>0)try{let n=await ue(e);if(!n)throw new Error("No Codex auth available.");let o=await _(Ae,{headers:n.headers},r,"Codex usage"),i=await o.text();t.push(`>_ Codex raw (${o.status}):

8${Ke(i)}`)}catch(n){if(y(n))throw n;t.push(`>_ Codex raw: error \u2014 ${x(n)}`)}return t.length===0?"No providers with usable auth found.":t.join(`

10`)}function Ze(e){let r=e.trimStart();if(r==="")return[...je];let t=/\s$/.test(r),n=r.trimEnd().split(/\s+/).filter(Boolean),o=n.at(-

11`);for(let t of e.credits){let n=t.status?` [${t.status}]`:"",o=t.grantedAt?`granted ${tt(t.grantedAt)}`:void 0,i=t.expiresAt?`expires ${tt(t.expiresAt)}`:void 0,d=[o,i].filter(Boolean).join(" \u2022 ");r.push(` ${t.id}${n}${d?` \u2014 ${d}`:""}`)}return r.join(`

12`)}function nt(e){let r=e.expiresAt?`expires ${tt(e.expiresAt)}`:"no expiry shown";return`${e.id} \u2014 ${r}`}function tt(e,r=!0){let t=new Date(e);if(Number.isNaN(t.getTime()))return"at an unknown time";let n=new Date,o=`${t.getHours().toString().padStart(2,"0")}:${t.getMinutes().toString().padStart(2,"0")}`;if(!r&&t.toDateString()===n.toDateString())return o;let i=t.getDate().toString(),d=t.toLocaleDateString(void 0,{month:"short"});return`${o} on ${i} ${d}`}import{spawn as zr}from"node:child_process";import{createInterface as jr}from"node:readline";function ot(e,r,t){let n=[],o=f(e.plan_ty ...

13`),d}notify(r){let t=this.child;t?.stdin.writable&&t.stdin.write(`${JSON.stringify({method:r})}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

14`)}dispose(){for(let[t,n]of this.pending)n.reject(new Error(`codex app-server request ${t} cancelled.`));this.pending.clear();let r=this.child;r&&(r.stdin.end(),r.killed||r.kill(),this.child=void 0)}handleLine(r){let t;try{t=JSON.parse(r)}catch{return}if(typeof t.id!="number")return;let n=this.pending.get(t.id);if(n){if(this.pending.delete(t.id),t.error){let o=typeof t.error.message=="string"?t.error.message:"unknown error";n.reject(new Error(`codex app-server request failed: ${o}`));return}n.resolve(t.result)}}rejectAll(r){for(let t of this.pending.values())t.reject(r);this.pending.clear()}}; ...

High

Same File Env Network Execution

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/index.jsView file

1import{homedir as gr}from"node:os";import{join as xr}from"node:path";var yt="usage",Oe="openai-codex",Ie="anthropic",Ae="https://chatgpt.com/backend-api/wham/usage",At="https://cha... L2: `)}function Ot(e,r){let t=Er(e,r);if(!t)return"usage unavailable";let n=[Mr(t)];return t.primary&&n.push(`${v(t.primary.usedPercent).toFixed(0)}% 5h`),t.secondary&&n.push(`${v(t.se... ... L11: `);for(let t of e.credits){let n=t.status?` [${t.status}]`:"",o=t.grantedAt?`granted ${tt(t.grantedAt)}`:void 0,i=t.expiresAt?`expires ${tt(t.expiresAt)}`:void 0,d=[o,i].filter(Boo... L12: `)}function nt(e){let r=e.expiresAt?`expires ${tt(e.expiresAt)}`:"no expiry shown";return`${e.id} \u2014 ${r}`}function tt(e,r=!0){let t=new Date(e);if(Number.isNaN(t.getTime()))re... L13: `),d}notify(r){let t=this.child;t?.stdin.writable&&t.stdin.write(`${JSON.stringify({method:r})} L14: `)}dispose(){for(let[t,n]of this.pending)n.reject(new Error(`codex app-server request ${t} cancelled.`));this.pending.clear();let r=this.child;r&&(r.stdin.end(),r.killed||r.kill(),...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1import{homedir as gr}from"node:os";import{join as xr}from"node:path";var yt="usage",Oe="openai-codex",Ie="anthropic",Ae="https://chatgpt.com/backend-api/wham/usage",At="https://cha... L2: `)}function Ot(e,r){let t=Er(e,r);if(!t)return"usage unavailable";let n=[Mr(t)];return t.primary&&n.push(`${v(t.primary.usedPercent).toFixed(0)}% 5h`),t.secondary&&n.push(`${v(t.se... ... L9: L10: `)}function Ze(e){let r=e.trimStart();if(r==="")return[...je];let t=/\s$/.test(r),n=r.trimEnd().split(/\s+/).filter(Boolean),o=n.at(-1);if(o==="--timeout"&&t||o==="--consume-banked... L11: `);for(let t of e.credits){let n=t.status?` [${t.status}]`:"",o=t.grantedAt?`granted ${tt(t.grantedAt)}`:void 0,i=t.expiresAt?`expires ${tt(t.expiresAt)}`:void 0,d=[o,i].filter(Boo... L12: `)}function nt(e){let r=e.expiresAt?`expires ${tt(e.expiresAt)}`:"no expiry shown";return`${e.id} \u2014 ${r}`}function tt(e,r=!0){let t=new Date(e);if(Number.isNaN(t.getTime()))re... L13: `),d}notify(r){let t=this.child;t?.stdin.writable&&t.stdin.write(`${JSON.stringify({method:r})}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

Findings

2 High3 Medium4 Low

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 1-15javascript

1import{homedir as gr}from"node:os";import{join as xr}from"node:path";var yt="usage",Oe="openai-codex",Ie="anthropic",Ae="https://chatgpt.com/backend-api/wham/usage",At="https://chatgpt.com/backend-api/wham/rate-limit-reset-credits",Rt="https://chatgpt.com/backend-api/wham/rate-limit-reset-credits/consume",wt="codex-1",De="https://api.anthropic.com/api/oauth/usage",Re=15e3,E=180*1e3,Fe=3,St=1e3,bt=900*1e3,Et=30*1e3,ie=3600*1e3,W=xr(gr(),".pi","agent","usage-cache.json"),Be=1,se="provider-usage",ze=20,Ut=29,ae=600,vt="\x1B[39m",Mt=new Set(["five_hour","seven_day","extra_usage"]),je=[{value:"--re ...

3`):Lt(e,r)}function ve(e,r,t){let o=_r(r,e.model).map(i=>br(i,t?Date.now()-i.capturedAt:void 0)).join(`

8${Ke(i)}`)}catch(n){if(y(n))throw n;t.push(`>_ Codex raw: error \u2014 ${x(n)}`)}return t.length===0?"No providers with usable auth found.":t.join(`

10`)}function Ze(e){let r=e.trimStart();if(r==="")return[...je];let t=/\s$/.test(r),n=r.trimEnd().split(/\s+/).filter(Boolean),o=n.at(-

13`),d}notify(r){let t=this.child;t?.stdin.writable&&t.stdin.write(`${JSON.stringify({method:r})}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

High

Same File Env Network Execution

Long lines were clipped for display.