fix(tools): validate dict shape in read_quota_status() per Codex review

Codex's REQUEST_CHANGES review on PR #138 flagged that read_quota_status()
returned json.load(f) directly without validating the payload is a dict.
A candidate file containing valid JSON but a non-dict shape (e.g. [], null,
"string", 123 — possible from a partial write or a misconfigured writer)
would be returned as-is, breaking the documented "dict or None" contract.
Downstream consumers calling status.get(...) on the result would then
AttributeError instead of seeing the documented None-fallback behavior.

Fix: after json.load, check isinstance(data, dict). If true, return it.
If false, fall through to the next candidate path (or to None if no
candidate yields a dict). Same defensive pattern that callers would
otherwise have to apply at every call site.

Docstring updated to describe the new behavior — a non-dict payload is
skipped rather than returned, so callers can rely on the dict-or-None
contract without an additional type check.

Verified empirically with five malformed-payload cases:
1. Both files missing → None
2. New-path valid dict → returns it
3. New-path non-dict + legacy-path dict → returns legacy
4. Both non-dict → None
5. New-path malformed JSON + legacy-path dict → returns legacy
All pass.

— Proxy Builder

Author: cnighswonger

tools/cache_analysis.py

@@ -150,8 +150,15 @@ def read_quota_status():
       - v3.5.0+ (proxy mode, per-session split): ~/.claude/quota-status/account.json
       - v3.4.x and earlier (or preload mode): ~/.claude/quota-status.json (flat)
 
-    Tries the v3.5.0+ path first, falls back to the legacy flat path.
-    Returns dict with five_hour/seven_day pct, or None if unavailable.
+    Tries the v3.5.0+ path first, falls back to the legacy flat path. A
+    candidate file whose JSON parses but isn't a dict (e.g. a partial write
+    that lands as ``[]`` or ``null``) is skipped so the next candidate gets
+    a chance — and so callers never receive a non-dict and break on
+    ``status.get(...)`` accessors downstream.
+
+    Returns dict with five_hour/seven_day pct (and other fields written by
+    cache-fix's response-header capture), or None if no candidate yields a
+    dict-shaped payload.
     """
     import os
     for quota_file in (
@@ -160,9 +167,12 @@ def read_quota_status():
     ):
         try:
             with open(quota_file) as f:
-                return json.load(f)
+                data = json.load(f)
         except (OSError, json.JSONDecodeError):
             continue
+        if isinstance(data, dict):
+            return data
+        # Valid JSON but wrong shape — try the next candidate.
     return None