feat(opencode): TUI sidebar quota widget

[iceteaSA]

Dependency: Requires #34 (QuotaManager) to be merged first. Branch is based on feat/quota-manager.

Adds a TUI sidebar widget showing real-time quota usage for main and fallback accounts.

Displays:

• Usage bars with percentage and reset times per account
• Active account indicator (green dot)
• Route, fast mode, relay status
• Cache-keepalive tracked sessions

Files:

• packages/opencode/src/sidebar-state.ts — new, shared state type + file I/O
• packages/opencode/src/tui.tsx — new, Solid.js sidebar component
• packages/opencode/scripts/copy-tui.mjs — new, build helper
• packages/opencode/package.json — TUI deps, oc-plugin field, ./tui export
• packages/opencode/src/index.ts — writeSidebarState() integration
• packages/core/src/cachekeep.ts — trackedCount() getter

---

Summary by cubic

Adds a TUI sidebar that shows live Claude quota for main and fallback accounts, powered by a shared QuotaManager with inflight dedupe, exponential backoff, on-disk persistence, and cross‑process locking to reduce 429s and stabilize routing.

• New Features

  • TUI sidebar: usage bars (5h/7d) with reset times, active account dot, route/fast mode/relay status, and cache-keep tracked sessions.
  • Server writes sidebar-state.json to tmp; TUI polls for near real-time updates.
  • New QuotaManager in @cortexkit/anthropic-auth-core: unified main/fallback cache, inflight dedupe, cross-process file-lock guard, exponential backoff (60s–15m) for 429/5xx, persisted main quota and backoff, seeds from storage, and request-count refresh via refreshEveryNRequests.
  • Integrated with FallbackAccountManager: shared staleness, seeding from persisted fallbacks, and skip refresh when quota API is backed off.
  • Fail-closed routing when quota is unknown and the API is backed off (failClosedOnUnknownQuota).
  • CacheKeepManager.trackedCount() to display tracked sessions.

• Dependencies

  • Add @opentui/core, @opentui/solid, solid-js.
  • Expose TUI via exports["./tui"] and oc-plugin in packages/opencode; new scripts/copy-tui.mjs; build includes sidebar-state and copies tui.tsx.
  • Re-export QuotaManager from @cortexkit/anthropic-auth-core.

^{Written for commit 8b20be7. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

2 issues found across 12 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​opentui/​core@​0.2.15
	solid-js@​1.9.13
	@​opentui/​solid@​0.2.15

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm entities is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/@opentui/solid@0.2.15 → npm/entities@6.0.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/entities@6.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report