feat(command-code-usage): add command-code-usage v1.2.0

[Jovan1666]

What / 改动内容

Adds command-code-usage v1.1.0 to the marketplace: a panel that shows a user's Command Code
plan usage — the 5-hour rolling window, the weekly rolling window, and the monthly credits or
balance — rendered in the conversation.

The plan's two rolling windows are the reason this exists. They open on the first request and reset
a fixed time later, so the monthly balance alone cannot answer "can I still finish this task?".
The panel adds a remaining-requests estimate (remaining allowance ÷ your own average cost per
request) and a burn-rate warning for windows projected to run out before they reset.

Command Code · GOAT                             09-21 00:45 · 30d left in period
5-hour window  ██░░░░░░░░░░░░░░░░░░░░░░   6.3%    $0.89 / $14.00
               resets 04:29 · in 3h 43m
weekly window  █░░░░░░░░░░░░░░░░░░░░░░░   2.5%    $0.89 / $35.00
               resets 09-27 23:29 · in 6d 22h
monthly        ░░░░░░░░░░░░░░░░░░░░░░░░   1.3%    $0.89 / $70.00
               $69.11 remaining
estimate      at your $0.0026 average, room for ≈ 5,064 more requests in the 5-hour window

Components: commands /quota and /usage, plus a command-code-usage skill. No hooks, no MCP
servers, no agents, no background processes.

Visible behavior and how it was tested

• Verified against a live Command Code account: the four /alpha endpoints, all output modes
  (terminal, --md, --compact, --json, --from-json, optional HTML/serve), credential
  resolution from all three sources, and every error path (no credentials, invalid key, network
  failure).
• Account-shape branches exercised with fixtures: known plan, unknown/new plan, pay-as-you-go
  balance, organisation spend caps, and a period with no requests yet.
• Command discovery verified with scripts/verify-discoverable.cjs, which re-implements the
  client's own command parser — 2 commands found, 0 diagnostics.
• Since this submission is for one client only, the plugin's own CI also runs on Ubuntu, Windows
  and macOS; that matrix runs a release gate, offline smoke tests, an install-and-discover check
  against a throwaway HOME, and the installer's conflict guard.

Version and marketplace registration

• plugins/command-code-usage/.zcode-plugin/plugin.json version 1.1.0
• marketplace.json entry version 1.1.0, source ./plugins/command-code-usage
• description_i18n is identical in both (verified by validate.py)
• category: utilities

Dependencies, network requests, permissions, side effects

• Runtime: Node.js on PATH. Scripts use only Node built-ins and global fetch; nothing to
  install.
• Network: four read-only GETs to https://api.commandcode.ai (/alpha/whoami,
  /alpha/billing/credits, /alpha/billing/subscriptions, /alpha/usage/summary). No other host,
  no telemetry, no proxying.
• Credentials: the user's own Command Code API key, resolved at runtime from
  COMMAND_CODE_API_KEY/CMD_API_KEY/COMMANDCODE_API_KEY, ~/.commandcode/auth.json, or the
  provider already configured in ZCode. It is only placed in an Authorization: Bearer header —
  never written, printed, logged, or transmitted elsewhere. The plugin contains no credentials.
• File writes: none by default — no cache, no state, no config changes. --html writes one HTML
  file to a user-chosen path, and --serve binds a local HTTP server to 127.0.0.1; both are
  opt-in flags. scripts/install-user-scope.mjs writes into ~/.zcode/commands and
  ~/.zcode/skills for users who prefer a non-marketplace install, and keeps a manifest so it can
  update or remove them.
• Command execution: the command runs node <plugin>/scripts/cc-usage.mjs. That is the only
  process started.
• Both READMEs document all of the above, including a troubleshooting table.

Licensing and provenance

All code is original, MIT-licensed, and written for this plugin — no third-party code, assets, or
services are bundled. The icon in assets/command-code-usage/icon.png is generated by
scripts/make-icon.mjs in the source repository (pure geometry drawn with Node built-ins), so it
is reproducible rather than supplied by a third party.

Related upstream repository: https://github.com/Jovan1666/zcode-command-code-usage (MIT).

Self-check / 自查清单

• Plugin name is unique kebab-case; directory is plugins/command-code-usage/
• version is 1.1.0 in BOTH plugin.json and marketplace.json
• README.md (EN) and README_CN.md (中文) both present and equivalent in structure
• description_i18n has both en and zh-CN, identical in manifest and marketplace entry
• No secrets, machine-specific paths, or private dependencies
• Model/API/network dependencies documented
• python3 scripts/validate.py → OK: 27 plugin(s) validated
• python3 scripts/build_dist.py → builds plugins/command-code-usage/1.1.0/plugin.zip
• git diff --check → clean

---

Update: version bumped to 1.2.0. The command body was cut from 731 to 311 characters and the agent is now told not to restate the panel (it is already visible from the tool call), cutting the token cost of one /quota from about 680 to about 390. Both READMEs document the cost and the zero-token alternative (--serve in the built-in browser pane). validate.py → OK: 27 plugin(s) validated, build_dist.py and git diff --check pass.