onWatch is a local Go daemon that polls LLM provider quota APIs, writes snapshots to SQLite, and serves a dashboard. This week the tree changed 318 files across 54 commits and shipped v2.14.0 through v2.14.2. The parts that matter for operators are a Codex poll stall that could freeze usage collection, a new Ollama Cloud provider, and a bind warning that used to vanish once a real password was set.
A failed Codex probe could pin polling for the process lifetime ¶
Codex serves usage from one of two paths, and which one works depends on the account. The client probed the alternate on HTTP 404 and cached it immediately. A probe that came back 403, 5xx, or a transport error stayed selected until the process restarted. Repeated forbidden answers then tripped the agent auth failure threshold. Lifting that pause needed a credential change, but the bad endpoint stayed cached, so polling paused again.
The Codex endpoint recovery commit changes the cache rule. The alternate path is stored only after it actually serves usage. A cached endpoint is dropped as soon as it fails or the token changes. HTML or Cloudflare challenge bodies are now ErrCodexAccessBlocked and do not spend the auth failure budget.
Paused agents also retry on their own. The first attempt is 15 minutes later, then the delay doubles up to 6 hours. The retry reuses the stored token and never fires an OAuth refresh. Codex refresh tokens are single use, so a timer driven refresh would burn credentials the Codex CLI still needs. That behavior shipped in v2.14.2.
const (
codexAuthPausedRetryInterval = 15 * time.Minute
codexAuthPausedRetryMaxInterval = 6 * time.Hour
)
Ollama Cloud usage now lands in the same snapshot store ¶
The Ollama Cloud client is a new opt in provider. The agent polls GET /api/usage and POST /api/me on ollama.com with a bearer key. Usage is required. A failed /api/me only costs plan, account, and derived reset data. Snapshots stay local in SQLite: included monthly spend in USD, per model request counts, and extra spend above the included allowance.
The ollama.com usage API does not return the monthly dollar cap or the reset time. Caps come from plan tier, Pro 60, Max 300, Team 1000 USD, or from OLLAMA_MONTHLY_LIMIT. The Free plan cap is unpublished, so the card shows dollars used without a percentage unless that env is set. Env names and the two endpoints are in OLLAMA_SETUP.md.
Reset day is the interesting derivation. Free accounts reset from signup. Paid plans reset on the subscription start day, which the API does not expose. When included usage falls by more than half a cent between two polls, the learned reset records that moment as the reset anchor and applies it to ResetsAt. The value is persisted in settings. OLLAMA_RESET_DAY still wins if set. onwatch setup now checks the key against ollama.com before saving it. A rejected key is prompted again. A network failure keeps the key.
The network exposure warning used to hide behind the password check ¶
The dashboard can bind all interfaces. The console and log warning for that was nested under the default password checks in main.go. Anyone who had set a real password, or had run onWatch before, never saw it.
The bind warning fix gates the notice on the bind address alone. Loopback stays quiet. An exposed bind prints the warning even with a custom password and an existing database. A password does not make an all interfaces bind any less exposed. Tests for that split live in first_run_test.go.
Windows install and beta updates reported the wrong state ¶
install.ps1 offers to star the repo when gh is logged in. On Windows PowerShell 5.1, redirected native stderr becomes a terminating NativeCommandError while $ErrorActionPreference is Stop. gh writes to stderr on every call, so gh auth status *> $null aborted the installer on any machine with gh installed but not logged in. The daemon was already running. The install ended on a red gh.exe error instead of the completion banner.
The installer fix routes every gh call through Invoke-GhQuiet, which relaxes the preference, swallows both streams, and returns an exit code. The star offer is wrapped so that courtesy cannot abort a finished install.
Separately, compareVersions dropped the prerelease suffix, so 2.14.0-beta.3 and 2.14.0 compared equal and onwatch update told beta testers they were already current. The updater and tray fix orders versions the way semver says. A preview build sits below the release it leads to. The tray companion watches the daemon PID in ONWATCH_DAEMON_PID and quits about 30 seconds after that daemon disappears, so a crash or onwatch stop cannot leave a dead icon behind.
Stable releases now attach SHA256SUMS. The preview workflow keeps betas off latest with --latest=false so a tester build can never become the GitHub latest release.
What to watch ¶
Ollama Cloud is still beta. The usage API is undocumented. Confirm the dollar cap on the ollama.com settings page against what onWatch shows, and set OLLAMA_MONTHLY_LIMIT if the card has no percentage.
Codex operators who paused polling to fix auth should upgrade to v2.14.2 before rotating tokens. The stall was often an endpoint cache, not a dead credential, and a timer driven OAuth refresh is still intentionally absent.
The VS Code extension is a thin client of the same menubar API. It discovers the daemon via ~/.onwatch/port, ONWATCH_PORT, then 9211. On Windows it now reads the port file where the daemon actually writes it. Treat it as another reader of local quota state, not a second collector.