TokenBar for Windows

Windows port of TokenBar — the
menu-bar/tray AI coding-agent token-usage monitor. Same Rust parsing core,
a native WinUI 3 shell.

Status: v0.2.2 is the
latest release — the first installed build produced by CI, across four channels.
See docs/release-velopack.md for the packaging contract,
docs/release.md for the earlier portable one, and the
release list for history.

Unreleased since v0.2.2: the Quota lens and the usage-attribution subsystem, the
equivalence denominator fix, and an engine pin advance that corrects the engine's own
cost and token calculations — Codex reasoning tokens were priced twice, Claude
tool_result input was char-estimated, and 1-hour cache writes were billed at the
5-minute rate. Presentation defects above that layer are not all fixed; Phase 13
below records what shipped into main, and "Before the next release" lists the
figures still wrong on screen.

Architecture

Windows native packaging is opt-in for TokenBar.App, TokenBar.Smoke, and
TokenBar.Core.Tests. The supported tuples are x64/win-x64 →
x86_64-pc-windows-msvc and ARM64/win-arm64 →
aarch64-pc-windows-msvc; Windows managed builds never select a default
target/release DLL.

Build

git submodule update --init --recursive

# macOS (inner loop — no Windows needed)
scripts/check.sh

# Windows x64: restore the locked graph, build the explicit native source, then run the x64 gates
dotnet restore src/TokenBar.slnx --locked-mode
dotnet restore src/TokenBar.App/TokenBar.App.csproj --locked-mode
.\scripts\dev.ps1
dotnet msbuild src/TokenBar.Smoke/TokenBar.Smoke.csproj -t:BuildTbNative -p:Configuration=Release -p:Platform=x64 -p:RuntimeIdentifier=win-x64 -p:TbNativeCargoLocked=true -p:RestoreLockedMode=true
dotnet build src/TokenBar.Core.Tests/TokenBar.Core.Tests.csproj -c Release -p:Platform=x64 --no-restore
dotnet test src/TokenBar.Core.Tests/TokenBar.Core.Tests.csproj -c Release -p:Platform=x64 --no-build --no-restore
dotnet build src/TokenBar.App/TokenBar.App.csproj -c Release -p:Platform=x64 -p:RuntimeIdentifier=win-x64 --no-restore
dotnet build src/TokenBar.Smoke/TokenBar.Smoke.csproj -c Release -p:Platform=x64 --no-restore
dotnet run --project src/TokenBar.Smoke -c Release -p:Platform=x64 --no-build --no-restore
dotnet publish src/TokenBar.Smoke/TokenBar.Smoke.csproj -c Release -r win-x64 --self-contained -o out/smoke-win-x64 --no-restore

ARM64 is cross-build/package validation only on an x64 runner:

dotnet restore src/TokenBar.App/TokenBar.App.csproj --locked-mode
dotnet restore src/TokenBar.Smoke/TokenBar.Smoke.csproj --locked-mode
dotnet msbuild src/TokenBar.Smoke/TokenBar.Smoke.csproj -t:BuildTbNative -p:Configuration=Release -p:Platform=ARM64 -p:RuntimeIdentifier=win-arm64 -p:TbNativeCargoLocked=true -p:RestoreLockedMode=true
dotnet build src/TokenBar.App/TokenBar.App.csproj -c Release -p:Platform=ARM64 -p:RuntimeIdentifier=win-arm64 --no-restore
dotnet publish src/TokenBar.Smoke/TokenBar.Smoke.csproj -c Release -r win-arm64 --self-contained -o out/smoke-win-arm64 --no-restore

The unsigned portable App package command performs the locked restore, native
build, publish, ZIP creation, and structure/version/PE/hash checks. Use a clean
Git checkout and a new empty output root on a Windows host or CI runner:

.\scripts\build-app-artifact.ps1 -Rid win-x64 -OutputRoot "$env:RUNNER_TEMP\tokenbar-phase10-x64"
.\scripts\build-app-artifact.ps1 -Rid win-arm64 -OutputRoot "$env:RUNNER_TEMP\tokenbar-phase10-arm64"

The cross-language CrossCheck stays platform-neutral and has no Platform/RID:

TZ=Asia/Taipei dotnet run \
  --project src/TokenBar.CrossCheck \
  -c Release -- \
  crosscheck/fixtures \
  crosscheck/csharp-out

CI publishes only short-retention Smoke test-harness artifacts and sanitized
Phase 10 App evidence/checksums. Hosted CI never uploads App ZIP/EXE/DLL files.
The hosted runners perform structure, version, PE, and hash checks; they do not
claim an interactive WinUI startup gate.

The M19-B1 real-ARM64 result is historical evidence from a separate Windows
ARM64 gate on 2026-07-27: 351 Rust tests, 12 provider-v3 CrossCheck cases, PE
checks, and synthetic WinUI startup were recorded in the public issue
comment.
That result does not satisfy or replace the Phase 10 published-artifact x64 and
ARM64 gates. The published v0.1.0-preview.1 x64/ARM64 startup-smoke used the
active Nanako profile with outbound blocked under explicit approval; it was a
non-disposable exception, not disposable isolation. For stable, the default is
a disposable Windows VM/account with production credentials absent and outbound
blocked; a non-disposable exception needs separate explicit authorization, must
be labelled, and must never be called isolated. The published v0.1.0 stable
x64/ARM64 startup-smoke used the separately authorized active Nanako profile
with executable-specific outbound blocking under those non-disposable terms;
both runs reached tray-ready and exited with task result 0.

Prereqs: Rust 1.96.1, .NET SDK 10.0.301, PowerShell 7.0+; on Windows the
MSVC toolchain.

Windows CI runs the x64 Rust workspace tests, Core.Tests, WinUI App, and Smoke
from their project roots (the solution has no x64 configuration), then executes
both the all-entry-point and strict relocated-CODEX_HOME Smoke checks with
network and host-profile isolation. It runs the no-Platform/RID CrossCheck,
publishes and executes the self-contained smoke-win-x64 bundle, and uploads
that test-harness artifact. The arm64-cross job only cross-builds and packages
the native DLL and Smoke bundle, and uploads the test-harness artifact plus
sanitized Phase 10 evidence/checksums; it is not an ARM64 runtime test. The provider-pace branch
passed local command-equivalent x64 and ARM64 gates plus fresh review on
2026-07-19; GitHub PR #3 preserves its remote CI and review record. cargo fmt
is not currently a repository CI gate; its existing workspace-wide formatting
debt is tracked separately.

Progress

Before the next release

Everything remaining on the blocking list is the same shape: the app displays something and it is not true — a figure, a label, or a control — rather than a feature being absent. That distinction is the line, not whether the wrong thing happens to be numeric: two identically-named entries in a menu and a row labelled for a surface it does not cover mislead exactly as a wrong total does, and neither can be filed as a limitation.

Known limitations that are honest to ship with, because the feature is absent rather than lying: no Discord Rich Presence, no per-client tray items, no Simplified Chinese, no menu-bar font colour, no flat-heatmap chart mode, no agent brand icons, no Agent-limits sparkline or chart layout, no Stats attribution-breakdown card, and no multi-account Claude.

Provider runtime validation

Fixture cross-checks, synthetic session smokes, and path-only checks are kept
separate from credential-bound live coverage. The final live gate retained the
same exists/hash state across all 7 monitored credential and account-scope
paths; normal secure v3 pace-history writes remain permitted. Session-parser
environment-root overrides now flow through one shared FFI source context and
have strict relocated-CODEX_HOME coverage. RID-aware native-DLL selection and
freshness are complete through the shared BuildTbNative/Directory.Build.targets
path.

Credits

Shared parsing engine from tokscale-core,
originally derived from tokscale by
junhoyeo. Original menu-bar concept by
handlecusion's tokcat.

Lite channel (framework-dependent)

Optional Lite builds omit the bundled .NET 10 runtime. See docs/lite-distribution.md for channels, package identity, and the per-surface default policy (README/GitHub default Full; Scoop default Lite; winget Full + Lite package).