Your "session window" is seven clocks, each with its own countdown.

No. The 5-hour window is one of seven rolling windows the server tracks per account. The full UsageResponse struct in src/models.rs lines 19-28 has seven Window-typed fields: five_hour, seven_day, seven_day_sonnet, seven_day_opus, seven_day_oauth_apps, seven_day_omelette, and seven_day_cowork. Each one carries its own utilization fraction and its own resets_at timestamp. When people say 'session window' they usually mean five_hour, but a 429 can fire because any of the other six tripped first. A monitor that only shows the 5-hour bar is hiding six clocks that can throttle you.

No, that is the whole point of a rolling window. Each Window object ships its own resets_at value, computed independently as the moment the oldest still-counted message in that bucket ages out. five_hour can reset at 18:42 while seven_day_opus resets four days later. ClaudeMeter prints each timestamp separately in src/format.rs lines 75-98, so you can see which clock will tick over first. A 'session ends in 5 hours' countdown is a fiction unless it tells you which bucket it is counting.

The browser extension in extension/background.js line 6 calls fetch with credentials: 'include'. That tells the browser to attach your already-authenticated claude.ai cookies on a same-origin-style request from inside the extension. There is no copy of the cookie in any config file, in any localStorage entry, or in any environment variable. The host_permissions entry in manifest.json line 8 is what unlocks that flow ('https://claude.ai/*'). Tools that ask you to paste a sessionKey are doing so because they cannot piggyback on browser auth from the context they run in.

Because if you install the binary without the extension (Route B in the README), it has no in-browser context to ride on. So it falls back to reading the cookie database directly: it shells out to security find-generic-password to get the AES key macOS holds for 'Chrome Safe Storage', decrypts the cookies file for the profile that has a claude.ai login, and uses that cookie to call the same /usage endpoint. The extension route (Route A) skips that entire path and is the recommended install in the README.

Every 60 seconds. POLL_MINUTES is set to 1 on line 3 of extension/background.js, and the alarm is registered with periodInMinutes: POLL_MINUTES on line 105. The cadence is chosen because rolling utilization slides as old traffic ages out, even when you stop sending messages. A sample from 30 minutes ago is usually wrong by a few percentage points, and at 95 percent utilization that gap matters. The Rust binary samples on demand whenever it is invoked, so the CLI gives you a one-shot snapshot synchronized to the moment you ran it.

The two-digit number on the toolbar icon is the worst current five_hour utilization across every org membership on your account, rounded to an integer. The logic is in extension/background.js lines 82-84: it walks every snapshot, takes the max of five_hour utilization, and renders that. The color comes from lines 86-88: green under 80 percent (#2c6e2f), amber 80 to 100 (#b26a00), red at 100+ (#b00020). If the fetch fails entirely the badge shows '!' instead of a number, which is a fast visual cue to re-login in claude.ai.

Both routes iterate. The extension calls /api/account first, walks account.memberships, and polls /usage for each org.uuid (extension/background.js lines 16-22). The CLI does the same in main.rs lines 17-30, deduping by account email at the end with dedupe_by_account so you do not see the same org twice if it appears under more than one cookie session. A monitor that only shows one number will under-report when one org is at 95 percent and another is at 30 percent.

The CLI prints them in the order the struct declares them, with each window's resets_at rendered as 'in Xd Yh' relative to now (src/format.rs lines 75-98). Eyeballing the column tells you which bar is tallest. The menu-bar UI sorts by utilization descending so the worst clock is at the top, and the badge always shows the worst five_hour value because the 5-hour window is the most common 429 source on Pro plans. For Max plans, seven_day_opus is often the binding constraint and shows up immediately below.

Only consumer plans (Pro and Max). The /api/organizations/{uuid}/usage endpoint is what claude.ai/settings/usage renders from, which is the consumer billing surface. The Console API plan ships its own Usage and Cost API on platform.claude.com, which returns dollars and tokens broken down by workspace and model. Different host, different shape, different semantics. ClaudeMeter targets the consumer surface because the consumer surface is the one with private rolling windows that nothing else surfaces.

It is a server-side internal name for one of the metered buckets (the curiosity is real, the field is real). The struct in src/models.rs deserializes it as Option<Window> like the other six, so it is decoded into the same shape and rendered the same way. We do not redefine or rename server fields because the day Anthropic ships a new bucket we want serde to either accept it transparently or fail loudly, not silently mistranslate. If you see a value here climbing while others stay flat, it is real traffic against a real server-side bucket.

Local JSONL files have token counts; they do not have utilization. To convert tokens into a percentage you would need the denominator the server divides by, and that denominator is private (and changes on server-side deploys; it changed on 2026-03-26). Local-log monitors are accurate about what your machine sent, but they cannot match what claude.ai/settings/usage shows because they have to invent the ceiling. ClaudeMeter reads the percent the server already computed, which is the same byte-for-byte value the settings page displays.

No. There is no telemetry, no analytics, no third-party host. The only network egress is the GETs to claude.ai (which you are already calling when you use the product). The bridge between the extension and the menu-bar app binds to 127.0.0.1:63762 explicitly (BRIDGE constant in extension/background.js line 2), which is loopback only. The whole project is MIT-licensed; the source you can audit lives at github.com/m13v/claude-meter.