aikit 1.19.0: unified aikit usage snapshot (23 providers) + 4 new agents (Jules, Roo, Codebuff, Qoder)

[devin-ai-integration]

Summary

Adds aikit usage [providers...] [--json] [--all] — one table (or JSON) of plan / account / credits / spend / rate-limit windows across every provider whose CLI already stores credentials locally, plus 4 new registry agents (Jules, Roo Code CLI, Codebuff, Qoder) and registry lifecycle fixes from the audit.

Provider probes (23)

Each probe reads existing credentials read-only (never refreshes or writes back), calls the provider's own usage endpoint, and returns one normalised record:

usage_result(provider, status,            # ok | unauthenticated | error | unsupported
             account=, plan=, source=,    # source = which file/env var supplied the token
             windows=[usage_window(label, used_pct=, used=, limit=, unit=, resets_at=)],
             credits={remaining,total,used,unit}, spend={amount,currency,period,limit}, extra={})

probe_usage never raises; collect_usage runs probes via sk.parallel_map and restores registry order. Secrets never appear in messages, --json, or tests (_usage_get_json maps 401/403 to "credentials rejected — re-run login").

Endpoints were cross-checked across CodexBar, ai-usagebar, MeterBar, UsageOwl and OpenUsage; where they disagreed the more defensive parser won:

• Codex — windows labelled from limit_window_seconds (5h session / weekly / daily) instead of primary/secondary position; also code_review_rate_limit, additional_rate_limits[], rate_limit_reset_credits.
• Copilot — token from $GITHUB_COPILOT_TOKEN → github-copilot/{apps,hosts}.json → gh/hosts.yml → gh auth token (keyring, only if hosts.yml exists); sends the Editor-Version/X-GitHub-Api-Version headers copilot_internal/user expects.
• Cursor — IDE state.vscdb then headless cursor-agent ~/.config/cursor/auth.json; parses individualUsage.plan.{total,auto,api}PercentUsed + overall.used/limit (cents), falls back to the *DisplayMessage percentages.
• Kilo — GET api.kilo.ai/api/profile/balance (+ X-KiloCode-OrganizationId) replaces the tRPC credit-block sum.
• z.ai — semantic buckets: TOKENS_LIMIT unit 3 → 5h session, unit 6 → weekly, TIME_LIMIT → monthly MCP calls; API-level code/success errors surfaced.
• Kimi — ~/.kimi-code/region selects api.kimi.ai vs api.kimi.com; expiry short-circuits to unauthenticated with no network; windows keyed on window.duration/timeUnit; plan from nested user.membership.level.
• New: Codebuff (manicode/credentials.json), DeepSeek balance, Moonshot balance, MiniMax coding-plan token_plan/remains, Novita balance (1/10000 USD), Anthropic org cost_report and OpenAI org /v1/organization/costs month-to-date spend (paginated; refuse partial totals). The billing-only ones live in USAGE_ONLY_PROVIDERS so they render with names without being installable agents.

Deliberately not replicated: providers needing browser HttpOnly cookies (Windsurf, Warp, Zed) and local-transcript cost estimation.

Registry audit

• New agents: Jules (@google/jules, jules login/jules version), Roo Code CLI, Codebuff, Qoder CLI (/login, QODER_PERSONAL_ACCESS_TOKEN); npm uninstall commands are lazy lambdas so the registry builds before helpers are defined.
• Version bump 1.18.3 → 1.19.0; docs table + CHANGELOG entry.

Tests

tests/test_aikit_usage.py — all HTTP stubbed via _usage_http, credentials in a tmp HOME, env vars cleared; covers every probe's happy path, unauth/expired/error paths, header/cookie construction, and that no probe touches the network in an empty home.

Not verified: live values against real accounts (no credentials in this environment).

Link to Devin session: https://app.devin.ai/sessions/7316c54fcf484646a7dc1bc46801ccb1
Open in Devin Desktop: https://app.devin.ai/desktop/session/7316c54fcf484646a7dc1bc46801ccb1?variant=devin
Requested by: @saheljalal

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Runtime-tested in an isolated terminal (throwaway HOME, no real accounts). Devin session

• Help and all 38 registry agents verified; empty/--all guidance and ordered --json output verified.
• Fake Codex/Amp tokens → graceful HTTP 401 error rows; no token leakage in table/JSON/stderr, credential file untouched.
• Unknown provider exits 1 cleanly; declining uninstall roo preserves vendor data.
• venv/bin/python -m pytest -q green.

No-account guidance	Fake-token HTTP failures

Not covered

Real-account plan/credit/quota values and installed-agent OAuth guidance (Jules/Qoder correctly returned install-first errors). Test terminal lacked emoji glyphs, so icon columns rendered as boxes there.