cctally 1.88.0 → 1.88.1

package/CHANGELOG.md

@@ -5,6 +5,14 @@ based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.88.1] - 2026-07-31
+
+### Fixed
+- Session names no longer disappear from the Recent Sessions card while cctally is pruning old transcripts. The prune held the transcript store's maintenance lock exclusively for its entire pass, and the Sessions card's name lookup is deliberately built to give up instantly rather than wait on that lock, so every Claude session rendered a blank name until the prune finished — minutes on a large store, and for most installs on the v1.88.0 upgrade in particular, whose one-off transcript re-read is followed by an unthrottled sweep. The prune still claims the lock exclusively, which is what keeps it serialized against a second prune or a `cctally db vacuum`, but now holds it shared for the pass itself so read-only lookups are no longer locked out. What gets pruned, and when, is unchanged.
+
+### Security
+- Update the build-time `postcss` dependency to 8.5.25, clearing a path-traversal advisory (GHSA-r28c-9q8g-f849) in its source-map auto-loading. It is a development dependency used only when building the dashboard bundle from source, so it is absent from npm, Homebrew, and every other install, and the shipped dashboard is byte-for-byte unchanged.
+
 ## [1.88.0] - 2026-07-31
 
 ### Fixed

package/bin/_lib_conversation_retention.py

@@ -255,7 +255,11 @@ def _maybe_prune_conversation_retention(
     skipped (retention disabled, throttled within 24h, or a lock contended).
 
     Concurrency (F7): a dedicated non-blocking MAINTENANCE flock serializes prune
-    attempts across processes (a second dashboard skips cleanly). Under it, the
+    attempts across processes (a second dashboard skips cleanly). It is claimed
+    EXCLUSIVE and then downgraded to SHARED for the pass proper, so a long prune
+    cannot starve the fail-closed panel readers that sample it
+    ``LOCK_SH | LOCK_NB``; a rival ``LOCK_EX | LOCK_NB`` claim still fails
+    against the held SHARED, so the serialization is unchanged. Under it, the
     two provider flocks are taken in a FIXED order (Claude then Codex),
     non-blocking, so a rebuild/reingest mid-flight makes the prune skip this
     cycle rather than race between candidate selection and deletion. The prune of
@@ -297,6 +301,26 @@ def _maybe_prune_conversation_retention(
                     fcntl.flock(codex_fh, fcntl.LOCK_EX | fcntl.LOCK_NB)
                 except (BlockingIOError, OSError):
                     return None  # a Codex sync is mid-flight; retry next cycle
+                # Downgrade the maintenance flock to SHARED for the pass proper.
+                # The EXCLUSIVE acquire above is what wins the race; holding it
+                # exclusive for the whole pass additionally locked out the
+                # fail-CLOSED panel readers, which take this flock
+                # `LOCK_SH | LOCK_NB` and blank their column on any contention
+                # (`read_session_titles_bounded` -> every Claude session title in
+                # the Recent Sessions card, for the minutes a large prune runs).
+                # A prune is a writer, not a family replacement: concurrent
+                # writes are already excluded by the two provider flocks, and
+                # the replacement paths readers guard against take this flock
+                # EXCLUSIVE, which a held SHARED still blocks. Rival prunes and
+                # `db vacuum` claim `LOCK_EX | LOCK_NB`, which also still fails.
+                # MUST stay after both provider flocks: a flock conversion is
+                # not atomic, so a rival can slip into the downgrade window —
+                # the provider flocks it then fails to claim are what make that
+                # harmless.
+                try:
+                    fcntl.flock(maint_fh, fcntl.LOCK_SH)
+                except OSError:
+                    pass  # keep the exclusive hold; correctness is unchanged
                 cutoff = now_utc - dt.timedelta(days=int(retention_days))
                 conn.execute("BEGIN IMMEDIATE")
                 try:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cctally",
-  "version": "1.88.0",
+  "version": "1.88.1",
   "description": "Claude Code usage tracker and local dashboard for Pro/Max subscription limits - weekly cost-per-percent trend, quota forecasts, threshold alerts. ccusage-compatible.",
   "homepage": "https://github.com/omrikais/cctally",
   "repository": {