* Add z.ai peak/off-peak quota rate row for credit plans
Credit-based plans charge 1x during peak (Mon-Fri 14:00-18:00 UTC+8;
weekends off-peak all day) and 0.5x off-peak, but no z.ai endpoint
exposes the phase, so derive it from ctx.date.now() and render
"Quota rate: Off-peak - peak in 2h 21m" in the quota details. Gated
to CREDIT_LIMIT plans: legacy TOKENS_LIMIT plans charge model-
dependent flat rates where a phase display would claim a rate that
isn't being charged. Golden-covered at four fixed-clock epochs
(weekday peak, weekday off-peak, Friday-night weekend skip,
Saturday-inside-window).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat: expose deterministic plugin clock milliseconds
* refactor: use plugin millisecond clock for z.ai
* Document ctx.date.nowMillis() in both plugin API references
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: pwnqgljxs <pwn@example.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>
Benchmark (test-target, both engines), QuickJS default on all platforms
with CODEXBAR_PLUGIN_ENGINE=jsc rollback (env + Debug pane), dedicated
4 MiB worker threads with true-interrupt watchdog, native stack headroom
for the overflow guard, CI crash-report collection, and the overflow
regression pinned to production stack geometry.
* feat(synthetic): cut over provider to JavaScript
* feat(poe): cut over provider to JavaScript
* feat(xai): cut over provider to JavaScript
* feat(zai): cut over provider to JavaScript
* style(zai): use predicate count
* test: give the hung-script watchdog assertion CI headroom
The 0.15s interrupt must fire promptly, not wait out the hang; the 1s
elapsed bound flaked at 1.66s on a loaded ARM64 runner. 5s still proves
prompt termination against an unbounded loop.
* test: give hooks-watch interrupt assertion CI headroom
The 0.3s stop signal must beat the 10s interval; the 2s elapsed bound
flaked at 2.02s on a loaded x64 runner. 5s still proves prompt
interruption.
* refactor: migrate provider details batch one
* refactor: migrate provider details batch two
* refactor: migrate provider details batch three
* fix: preserve provider detail rendering parity
* fix: migrate Copilot credits into provider details
* fix: pin Poe details to UTC
Poe timestamps are UTC and the daily buckets already used it, but the
recent-activity labels and Today bucket used the local zone in both the
Swift and JS paths, flaking the golden on non-Pacific runners. Golden
proven invariant under TZ=UTC, America/Los_Angeles, Asia/Tokyo.
* fix: normalize OpenRouter reset detail
* test: pin Poe menu fixture to UTC
* fix: preserve OpenRouter key details
---------
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
* feat: add user-installed provider plugins
* fix: broker owns plugin HTTP representation headers
Apply broker-owned Accept, Accept-Encoding, and Content-Type after
plugin-supplied headers so a plugin cannot relax the user-plugin
response boundary. Test transport gains configurable response headers.
* build: add reproducible sucrase bundle verification script
Regenerates and verifies Sources/CodexBarCore/Resources/Plugins/
sucrase-3.35.1.min.js from the official npm artifact (sucrase@3.35.1,
esbuild@0.25.8 pinned, IIFE browser bundle). Expected SHA-256
4d997e15b72cbc9ccf6e743c30c6eb48bf4533f6709852367b40766be5eba70b was
independently reproduced by the coordinator from the npm registry;
'check' mode fails closed on any mismatch.
* fix: gate user-plugin registry lookup for non-JavaScriptCore platforms
Linux CLI builds compile CodexBarConfig without the plugin runtime;
unknown plugin config entries are dropped with the existing warning,
matching the documented macOS-only plugin boundary.
---------
Co-authored-by: Peter Steinberger <steipete@mac-studio-sf2.local>
cruzanstx