Omahub
← All plugins
M

Vibe Usage

by mimiqdev

vibecafe.ai token spend in the Omarchy bar.

GitHub

Security review

No obvious issues detected

Deterministic scan — not a security guarantee

None
Risk level
None
Analyzed commit
0c5ac8f
Scanned
1 month ago

No potentially dangerous behavior detected in the analyzed commit.

Automated analysis only — not a security guarantee.

AI advisory review

No obvious issues detected

Language-model assessment · ~deepseek/deepseek-v4-flash-latest — advisory only

None
AI risk level
None
Recommendation
install
Model
~deepseek/deepseek-v4-flash-latest
Analyzed commit
0c5ac8f
Reviewed
1 month ago

The plugin is a display-only bar widget whose Python helper reads the Vibe Usage API key from the user's config and makes one read-only API request; the code is transparent, uses only the standard library, and sanitizes external labels and the dashboard URL before use. No obfuscation, install-time scripts, persistence, or credential-exfiltration behavior was found. I agree with the deterministic scan's all-clear and consider this safe to install.

How this check works

This review combines the deterministic scan (the rule-based results above) with an independent look at the plugin's code by a language model. The model reads a trimmed sample of the repository's files, the manifest, and the README, then gives a plain-language risk level and a recommendation: install (no notable danger), review (look closer first), or avoid (clearly dangerous).

It runs on the same analyzed commit as the deterministic scan and is strictly advisory — it is not a security guarantee and never blocks a plugin by itself. A human moderator still reviews plugins before they are listed.

AI advisory only — automated analysis, not a security guarantee.

Install
$ omarchy plugin add https://github.com/mimiqdev/omarchy-vibe-usage --enable
Widgets #bar #quickshell #ai

Vibe Usage Omarchy plugin

A third-party Omarchy 4 bar-widget for the Vibe Usage dashboard. It shows the platform's spend and token usage in the bar and provides a local-time panel for Today, 24H, 7D, or 30D. Account setup and data synchronization are provided by the open-source vibe-usage client.

中文文档

The plugin is display-only: the vibe-usage daemon keeps syncing local records, while this plugin makes one read-only API request whenever it refreshes. It is an independent community integration and is not affiliated with, sponsored by, or endorsed by VibeCafé or Omarchy.

Requirements and dependencies

  • Omarchy 4 with the Quickshell plugin UI
  • Python 3 (standard library only; no pip packages)
  • A Vibe Usage account and ~/.vibe-usage/config.json created by vibe-usage init
  • A running vibe-usage daemon is recommended so local usage continues to sync

The helper reads the API key itself and never passes it through QML, argv, or environment variables. Every request includes the machine's local IANA timezone so calendar ranges match the desktop.

Install and update

The plugin id is mimiqdev.vibe-usage. Install it from GitHub with:

omarchy plugin add https://github.com/mimiqdev/omarchy-vibe-usage.git --enable

The manifest must be at the repository root. To update a git-installed copy:

omarchy plugin update mimiqdev.vibe-usage

For local development, omarchy plugin validate can validate this directory. A copied or rsync-installed tree is not a git checkout, so omarchy plugin update mimiqdev.vibe-usage will not work until the plugin is installed from git.

To uninstall this plugin:

omarchy plugin remove mimiqdev.vibe-usage --yes

Uninstalling the widget does not remove ~/.vibe-usage/config.json or stop the separately managed vibe-usage daemon.

If the old quota meter is installed, remove only that unrelated plugin before enabling this one:

omarchy plugin remove akitaonrails.ai-usagebar --yes

Do not edit /usr/share/omarchy/.

Controls

  • Left click: open or close the detail panel
  • Right click: open https://vibecafe.ai/usage
  • Middle click or r: refresh the current range
  • h/l or the range chips: switch Today / 24H / 7D / 30D
  • Cost / Token: switch the panel metric without refetching
  • ↗: open the dashboard and close the panel
  • Esc: close; Tab: move to the neighboring bar panel

Each range has its own in-memory report cache. The first visit fetches that range; switching to a fresh cached range is instant, while a stale cached report remains visible during its background refresh. Manual refresh affects only the selected range. A failed refresh keeps the last successful report for that range visible and marks the panel stale. With no cached report, loading displays … and an error displays !. Missing configuration or a rejected key shows instructions to run vibe-usage init.

The panel follows the desktop locale automatically. Locales whose name starts with zh use Simplified Chinese; all other locales use English. There is no manual language switch.

Helper contract

python3 helper/usage.py --range today|24h|7d|30d

The helper performs one request per invocation:

  • today: from=<local midnight as UTC ISO>&tz=<IANA id>
  • 24h: days=1&tz=<IANA id>
  • 7d: days=7&tz=<IANA id>
  • 30d: days=30&tz=<IANA id>

Successful JSON contains totals (cost, computed tokens, cache-only tokens, sessions, active time), chronological series bars, and independently ranked top-eight cost lists (byHost, bySource, byModel) plus token lists (byHostTokens, bySourceTokens, byModelTokens). Token totals match the official website/Mac app:

inputTokens + outputTokens + reasoningOutputTokens + cachedInputTokens

When all component fields are present, totalTokens is not added to this value. If any component field is omitted, the helper falls back to totalTokens + cachedInputTokens so the displayed volume is not lost. cachedTokens remains the sum of cachedInputTokens only. Source labels rename pi-coding-agent to pi; API-controlled labels are sanitized before they reach the UI.

Failure responses include a stable code such as authentication, network_error, or invalid_json. The UI translates that code for the active desktop locale instead of displaying the helper's raw error text.

Panel

The panel follows the official Mac popover's order, not its pixels. Reports are cached independently for Today, 24H, 7D, and 30D; the cache uses refreshIntervalSec as its freshness TTL and never approximates one server range from another:

Vibe Usage                         [refresh] [dashboard]
[Today] [24H] [7D] [30D]
[Cost] [Token]
┌ cost ┐ ┌ tokens ┐ ┌ cache ┐ ┌ active ┐
TREND   (hourly bars for Today/24H, daily bars for 7D/30D)
BY TOOL
BY MODEL
BY HOST
updated …

The four cards always show cost, computed tokens, cache tokens, and active time. The Cost / Token switch changes the hero, trend bars, breakdown values, percentages, progress bars, sorting, and independent top-eight + Other lists without another request. Token values use compact K, M, and B units with at most one decimal. The bar pill and its showTokens setting are unchanged. Each range refresh uses one helper process; navigation never cancels or misattributes an in-flight request, and a failed request never discards the previous successful report.

Publish and release

  1. Keep manifest.json at the repository root and use the third-party id mimiqdev.vibe-usage.
  2. Run the local tests and omarchy plugin validate ..
  3. Commit and push the repository to a public git host. Tags or GitHub releases are optional.
  4. Users install with omarchy plugin add https://github.com/mimiqdev/omarchy-vibe-usage.git --enable and later update with omarchy plugin update mimiqdev.vibe-usage.
  5. If desired, submit the public repository link to omarchyplugins.com according to that site's current instructions. This is an optional community listing, not an official Omarchy store.

Do not publish API keys or ~/.vibe-usage/config.json. A local copy is useful for development but does not provide git-based updates.

Project layout

manifest.json
README.md
README.zh-CN.md
DESIGN.md
LICENSE
BarWidget.qml
Panel.qml
Model.js
Locale.js
RangeCache.js
helper/usage.py
test/model.test.mjs
test/locale.test.mjs
test/range-cache.test.mjs
test/helper.test.py

Tests

python3 test/helper.test.py
node test/model.test.mjs
node test/locale.test.mjs
node test/range-cache.test.mjs
omarchy plugin validate .
git diff --check

The tests use local fixtures and mocked HTTP responses. No API key is required or committed.