docs: add CONTRIBUTING and CODE_OF_CONDUCT, file the #277 design note

CLAUDE.md

@@ -76,11 +76,16 @@ type UsageProvider interface {
 - `DashboardWidget` / `DetailWidget` define how provider metrics render in the TUI.
 - Providers are registered in `internal/providers/registry.go` via `AllProviders()`.
 
-### Provider patterns (16 providers)
+### Provider patterns
 
-- **HTTP header probing** (`openai`, `anthropic`, `groq`, `mistral`, `deepseek`, `xai`, `gemini_api`, `alibaba_cloud`): Lightweight API request, parse rate-limit headers using shared helpers from `internal/parsers/`.
+`AllProviders()` in `internal/providers/registry.go` is the authoritative list —
+check it rather than trusting a count written here. Providers fall into a handful
+of shapes:
+
+- **HTTP header probing** (`openai`, `anthropic`, `azure_openai`, `groq`, `mistral`, `deepseek`, `xai`, `gemini_api`, `alibaba_cloud`, `moonshot`, `zai`): Lightweight API request, parse rate-limit headers using shared helpers from `internal/parsers/`.
 - **Rich API / local hybrid** (`openrouter`, `cursor`): Multiple API endpoints; `cursor` also reads local SQLite DBs as fallback.
-- **Local file readers** (`claude_code`, `codex`, `gemini_cli`, `ollama`): Read local stats/session files. `claude_code` is the most complex with billing block computation and burn rate tracking.
+- **Browser-session auth** (`perplexity`, `opencode`): Console RPCs authenticated by a stored browser cookie. Read the session via `config.LoadSession` — never refresh from the live browser store on a poll, which clobbers a sibling account that shares the cookie domain.
+- **Local file readers** (`claude_code`, `codex`, `gemini_cli`, `qwen_cli`, `kimi_cli`, `ollama`, and most agent CLIs): Read local stats/session files. `claude_code` is the most complex with billing block computation and burn rate tracking.
 - **CLI subprocess** (`copilot`): Shells out to `gh` CLI commands.
 - **Plugin/integration** (`opencode`): Reads local session data from the OpenCode tool.
 

CODE_OF_CONDUCT.md

@@ -0,0 +1,37 @@
+# OpenUsage Code of Conduct
+
+OpenUsage is maintained as a practical, technical project for people building and using AI coding tools. Participation should
+stay respectful, focused, and useful.
+
+## Expected behavior
+
+- Be direct and constructive when discussing code, design, issues, and tradeoffs.
+- Assume good intent, but make room for maintainers to ask for clearer evidence, smaller scope, or stronger tests.
+- Keep issue and pull request threads on topic.
+- Respect differing experience levels, environments, accessibility needs, and constraints.
+- Credit ideas, reports, and contributions accurately.
+
+## Unacceptable behavior
+
+- Harassment, threats, insults, or personal attacks.
+- Sexualized language or imagery in project spaces.
+- Deliberate disruption of issues, pull requests, discussions, or release workflows.
+- Publishing private information without permission, including credentials, private logs, email addresses, or telemetry data.
+- Repeatedly ignoring maintainer requests about scope, tone, or safety.
+
+## Scope
+
+This code applies in OpenUsage project spaces, including GitHub issues, pull requests, discussions, reviews, project
+documentation, and community conversations where someone is representing the project.
+
+## Reporting and enforcement
+
+Report conduct concerns to the maintainers. For private or sensitive reports, email `security@baraniewski.com` and include
+relevant links, screenshots, or context.
+
+Maintainers may remove comments, close issues, request changes, block participants, or take other reasonable action to keep
+the project usable and safe. Enforcement decisions are based on impact, severity, and repeated patterns of behavior.
+
+## Attribution
+
+This policy is inspired by the Contributor Covenant and adapted for the OpenUsage project.

CONTRIBUTING.md

@@ -0,0 +1,84 @@
+# Contributing to OpenUsage
+
+Thanks for helping improve OpenUsage. This project is a Go terminal dashboard and local telemetry daemon for tracking AI
+coding tool usage, spend, quotas, and session activity.
+
+## Before opening a pull request
+
+- Search existing issues and pull requests before starting larger work.
+- Open an issue or design note first for broad UI, telemetry, provider, storage, or workflow changes.
+- Keep pull requests focused on one feature, fix, provider, or documentation change.
+- Avoid committing credentials, local telemetry databases, API responses with sensitive headers, or user-specific config.
+
+## Local setup
+
+OpenUsage uses CGO because the Cursor and telemetry stores use SQLite through `mattn/go-sqlite3`.
+
+```bash
+make deps
+CGO_ENABLED=1 go build ./cmd/openusage
+```
+
+Useful commands:
+
+```bash
+make build
+make run
+make demo
+make test
+make vet
+make fmt
+```
+
+`make lint` runs `golangci-lint` when the binary is installed and skips with a warning otherwise.
+
+## Development workflow
+
+Use the existing package boundaries:
+
+- CLI wiring lives in `cmd/openusage/`.
+- Provider implementations live in `internal/providers/<provider>/`.
+- Telemetry daemon, ingest, deduplication, and read models live in `internal/telemetry/` and `internal/daemon/`.
+- Bubble Tea views and components live in `internal/tui/`.
+- Integration scripts and templates live in `plugins/`.
+- Website and docs-site work lives under `website/` and `docs/site/`.
+
+Provider changes should follow `docs/skills/add-new-provider.md` and update registration, detection, examples, and tests where
+applicable.
+
+## Testing expectations
+
+- Use the standard Go `testing` package.
+- Prefer table-driven tests with `t.Run`.
+- Use `httptest.NewServer` for provider HTTP tests.
+- Use `t.TempDir` for filesystem tests.
+- Isolate and clean up environment variables in each test.
+- Run targeted tests while developing, then run the broad checks before review:
+
+```bash
+go test ./internal/providers/... -v
+go test ./internal/telemetry/... -v
+go test ./internal/tui/... -v
+make test
+make vet
+```
+
+## Code style
+
+- Run `make fmt` before opening a pull request.
+- Keep imports grouped as standard library, third-party, then internal packages.
+- Use `tea` as the alias for `github.com/charmbracelet/bubbletea`.
+- Use `snake_case` for provider IDs and JSON fields.
+- Use pointer numerics for optional numeric values, such as `Limit *float64`.
+- Return populated snapshots with `core.StatusAuth`, `core.StatusLimited`, or `core.StatusError` for handled provider states.
+- Return an error for fatal execution failures.
+- Prefix provider errors with the provider name, for example `fmt.Errorf("openai: ...: %w", err)`.
+
+## Pull request checklist
+
+- Describe the user-facing behavior change.
+- Link related issues.
+- Add or update tests for changed behavior.
+- Update docs or example config when behavior changes.
+- List validation commands you ran.
+- Do not include raw API keys, tokens, cookies, or private telemetry data in logs, fixtures, screenshots, or diagnostics.