feat(command-code-usage): add Command Code plan usage plugin - #46

What user problem this solves

Command Code is a paid coding plan with three nested limits — a rolling 5-hour cap, a rolling weekly cap, and the monthly credit pool. Users hit the caps mid-task with no idea how deep they were, because the only way to see usage was to leave the conversation and open the vendor's web dashboard.

This plugin puts those three windows inside the ZCode conversation: /quota prints them with reset countdowns plus a remaining-requests estimate and a burn-rate warning; /usage prints the same figures in a compact form.

Visible behavior and how it was tested

• /quota in a ZCode session prints plan, the three windows with percentages and reset countdowns, request/token totals, and a warning line when a window is close to its cap.
• /usage prints the compact one-liner form.
• Everything renders from the user's own account data, read live over the API; the plugin keeps a local last-good snapshot so a cold start paints immediately and a transient upstream failure dims the numbers instead of blanking them.
• Tested: the plugin ships an offline suite (node scripts/check.mjs) covering rendering, gating (which windows appear for which plan), thresholds, output formats, a credential/secret scan and installer assertions — no network and no real credentials needed. The same suite passes on Windows, macOS and Linux × Node 18/22 in the plugin's own CI. The live path was exercised against a real GOAT account before submitting.

Version changes and marketplace registration

• Plugin version: 1.3.2, matching the vendored manifest (.zcode-plugin/plugin.json) and the root marketplace.json entry.
• Registered one entry in marketplace.json pointing at ./plugins/command-code-usage, category utilities.

Dependencies, network requests, permissions, side effects

• Dependencies: none. One bundled ESM script (scripts/cc-usage.mjs) on Node's built-in fetch; Node 18+.
• Network: https://api.commandcode.ai only — four read-only GETs (/alpha/whoami, /alpha/usage/summary, /alpha/billing/credits, /alpha/billing/subscriptions). No other host appears in the code, and nothing is sent to the plugin author.
• Credentials: it uses the user's own Command Code API key, resolved from the host's configuration or credential store/environment. It is never logged, never cached (the local snapshot stores figures plus a short non-reversible digest so a snapshot from another account is never shown as yours), and only ever sent to api.commandcode.ai.
• Side effects: one file written — the last-report snapshot under the plugin's own directory in the host's data home (directory 0700, file 0600). No hooks, no MCP servers, no background process, no telemetry.
• The plugin's SECURITY.md documents exactly what it reads, writes and sends.

Licensing or provenance for third-party material

• MIT, first-party code only. No third-party code, assets or services are bundled; the endpoint contract was written against the vendor's public API.

Checklist

• the plugin name is unique and kebab-case (command-code-usage);
• required files and both language READMEs are present (README.md, README_CN.md, .zcode-plugin/plugin.json);
• the category is correct (utilities);
• no secrets, private data, or machine-specific paths are included (the plugin resolves its own root through ZCODE_PLUGIN_ROOT);
• validate.py, build_dist.py, and git diff --check pass locally;
• review feedback has been addressed on the pull request.