Port provider correctness fixes

[Finesssee]

Summary - Add a persisted Codex-only option to hide Spark quota rows while preserving credits and every other extra usage window. - Present the setting consistently in cached/detail snapshots, live provider events, float-bar/dashboard consumers, and native tray menu/status/icon/tooltip without mutating the canonical provider cache. - Parse all Claude CLI model-scoped weekly limits and resolve explicit-year, yearless, time-only, compact, and ambiguous-DST reset occurrences in the reported IANA timezone. - Restore the Kimi K2 legacy credits dashboard URL and trim API keys while distinguishing missing/blank keys from rejected or expired keys. ## Upstream coverage | Upstream reference | Windows/Rust behavior | |---|---| | 11d3fdc65 | Spark rows were already canonical; added only the persisted Codex presentation toggle, visible by default. | | 5f6a7cc6e and follow-ups | Claude CLI now emits one canonical extra rate window per model-scoped weekly section and excludes aggregate all models, including compact output. | | a10408292, 199a79190, ce62f4a0d and related reset fixes | Reset parsing preserves explicit-year occurrences and resolves yearless/time-only values around the current occurrence with IANA timezone and DST ambiguity handling. | | 5bee0172b | Non-applicable: upstream targets the unofficial kimi-k2.ai credits service; this repository provider is the Moonshot API balance service (api.moonshot.ai/.cn). | | dde8cb7e6 | Non-applicable for the same provider identity mismatch; no new unofficial Kimi K2 provider is introduced in this PR. | ## Already present / skipped - Spark identifiers codex-spark and codex-spark-weekly already existed in canonical extra rate windows, so provider parsing was not duplicated. - Credits and unrelated extra usage already share the canonical window representation; filtering targets only those two stable Spark IDs. - Current Claude source modes select one source rather than merging web and CLI snapshots, so no web/CLI deduplication layer was added. - Existing provider construction remains through codexbar::core::instantiate_provider. ## Non-applicable and excluded - macOS Keychain/never-prompt behavior has no equivalent Windows prompt/cache path and is not applicable. - No AppKit, sidebar, appcast, Linux procfs, or macOS credential machinery was ported. - GPT pricing/accounting, Ollama, Gemini, MiMo, cost orchestration, Codex OAuth/browser isolation, reset celebrations, Wayfinder, predictive warnings, refresh orchestration, Agent Sessions, and settings reorganization remain excluded for later focused work. ## TDD evidence | Behavior | RED proof | GREEN proof | |---|---|---| | Spark persistence/filtering | New round-trip and presentation regression failed before the setting/filter existed. | hiding_codex_spark_rows_preserves_other_extra_usage and settings round-trip pass. | | Settings-driven Spark presentation | Hook regression retained the visible Spark row after settings-changed. | reloads cached provider presentation when settings change passes and verifies a second filtered cache load. | | Claude scoped weekly/reset parsing | New parser assertions failed for multiple scoped sections and reset occurrences. | 17 focused Claude tests pass. | | Claude compact edge cases | Compact dated reset returned None; compact allmodels produced a duplicate scoped row. | resolves_cli_reset_occurrences_in_the_reported_timezone and parses_compact_usage_screen pass. | | Kimi URL/key diagnostics | Focused URL, trimming, blank-key, and rejected-key assertions failed against prior behavior. | 8 focused Kimi tests pass. | ## Validation - cargo fmt --manifest-path rust\Cargo.toml --all -- --check - cargo fmt --manifest-path apps\desktop-tauri\src-tauri\Cargo.toml --all -- --check - cargo test --manifest-path rust\Cargo.toml — 534 passed (533 library + 1 CLI) - cargo clippy --manifest-path rust\Cargo.toml --all-targets -- -D warnings - cargo test --manifest-path apps\desktop-tauri\src-tauri\Cargo.toml — 303 passed - cargo clippy --manifest-path apps\desktop-tauri\src-tauri\Cargo.toml --all-targets -- -D warnings - pnpm.cmd --dir apps\desktop-tauri exec tsc --noEmit - pnpm.cmd --dir apps\desktop-tauri test — 29 files, 140 tests passed - pnpm.cmd --dir apps\desktop-tauri run check-locale - git diff --check ## Manual Windows checks Not run. Automated Tauri, bridge, provider, settings, locale, and frontend coverage passed; the Codex toggle and tray presentation should receive a manual smoke check before merge. ## Notes - Adds the approved chrono-tz dependency for accurate IANA timezone and DST occurrence resolution. - Canonical cached usage remains unfiltered so toggling Spark visibility is lossless and does not require a provider refresh. ## Thermo cleanup - Centralized live Spark filtering in events::emit_provider_updated; refresh updates cache and emits once. - Removed duplicate refresh/settings/tray filtering and settings-to-provider-event coupling; useProviders reloads filtered cache on settings-changed. - Extracted Claude scoped-weekly/reset parsing to providers/claude/cli_reset.rs, cached regexes with OnceLock, and removed UTF-8/transformed-offset hazards. - Made snapshot codexSparkUsageVisible required in TypeScript while keeping updates optional. - Added RED/GREEN regressions for settings cache reload and Unicode parser safety.

Final gate fixes

• Restored rust/src/providers/kimik2/mod.rs exactly to main; the upstream unofficial Kimi K2 service changes are non-applicable to the existing Moonshot API provider.
• Added approved direct dependency iana-time-zone; timezone-less Claude resets use the Windows system IANA timezone parsed through chrono-tz, with UTC only as lookup/parse fallback. Explicit reset timezones still win.
• Settings reloads now clear pre-change queued snapshots and use an epoch to order cache responses and post-change events, including late initial cache responses and effect restarts.
• RED/GREEN coverage includes DST-aware supplied system zone, explicit-zone precedence, queued pre-change events, post-change events during reload, late initial cache, and effect restart during reload.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​chrono-tz@​0.10.4

View full report