dsh-all-usage 1.1.10 → 1.1.12

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to `dsh-all-usage` are documented here.
 
+## [1.1.12] - 2026-09-25
+
+### Fixed
+
+- **The runtime smoke test no longer counts routes by hand.** It asserted that dispose removed exactly 9 exact routes, so v1.1.11 — which adds `/api/all-usage/client-env` — failed every Cordis smoke job and, with it, its own npm publication, while the published package itself was correct. The expected count is now derived from the route list the test already checks, so adding a route can no longer leave a stale number behind.
+
+### Note
+
+- v1.1.11 was published to GitHub Releases but never reached npm: the publish workflow checks out the release tag and verifies it, and a published tag is never moved. The desktop caption-strip fix reaches npm users with this release; the shipped runtime code is identical to v1.1.11.
+
+## [1.1.11] - 2026-09-25
+
+### Fixed
+
+- **The desktop client's own close button is no longer covered.** The usage sheet is a full-window overlay, so its backdrop and grabber bar were painted straight across the 40px caption strip the DSH desktop client keeps for its window buttons (minimise / maximise / close), dimming the client's close button behind the panel. When the host marks the document with `data-windows-titlebar`, the sheet now starts below `--dsh-windows-titlebar-height` (40px on Windows), so the strip stays clear. Browsers are unaffected: without the marker nothing changes.
+- **The strip reservation never actually applied.** `Number(localStorage.getItem('dsh-all-usage:topInset'))` reads an unset key as `0`, which passed the `>= 0` check and returned early — the host marker, the Window Controls Overlay geometry and the user-agent fallback were dead code, so the panel reserved nothing on any desktop host even though the logic was in place. An unset key is now distinguished from an explicit `0`.
+
+### Changed
+
+- The reserved strip is taken from the host's own declaration first (`data-windows-titlebar` plus `--dsh-windows-titlebar-height`), then the Window Controls Overlay rectangle, then the user agent. `localStorage['dsh-all-usage:topInset']` still overrides everything, so the strip can be tuned without a rebuild.
+- The client reports its environment through the new `GET /api/all-usage/client-env` route, surfaced as `clientEnv` in `/api/all-usage/status`: user agent, overlay height, the reserved strip **and where that number came from**, viewport, and the panel's own rectangles. It reports at load and again whenever the sheet opens — this is what exposed the reservation bug from outside the desktop app.
+
 ## [1.1.10] - 2026-09-14
 
 ### Fixed

package/README.md

@@ -31,11 +31,12 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 ### 兼容性与已知限制
 
 - **运行环境**：需要 Node.js `>=22 <25`；CI 会在 Node 22 和 Node 24 上运行测试、语法检查和 npm 包内容检查。
-- **DSH 兼容**：`package.json` 声明 DSH runtime `>=0.1.1-rc.1 <0.1.5-0 || >=0.1.5-rc.1 <0.1.6-0`，已使用 `0.1.5-rc.1`、`0.1.1-rc.2` 和 `0.1.1-rc.1` 的真实 Cordis 服务链验证；`0.1.2-rc.1` 已通过实际使用验证兼容，但未纳入 CI smoke 矩阵。声明按元组拆成两段而非写成单一区间，是因为 node-semver 只有在范围里存在与目标版本同 `major.minor.patch` 且自身带预发布标签的比较符时，才会放行该预发布版本。
+- **DSH 兼容**：`package.json` 声明 DSH runtime `>=0.1.1-rc.1 <0.1.5-0 || >=0.1.5-rc.1 <0.1.6-0`，已使用 `0.1.5-rc.2`、`0.1.5-rc.1`、`0.1.1-rc.2` 和 `0.1.1-rc.1` 的真实 Cordis 服务链验证；`0.1.2-rc.1` 已通过实际使用验证兼容，但未纳入 CI smoke 矩阵。声明按元组拆成两段而非写成单一区间，是因为 node-semver 只有在范围里存在与目标版本同 `major.minor.patch` 且自身带预发布标签的比较符时，才会放行该预发布版本。
 - **Web 服务依赖**：Host 将 `webServer` 声明为必需依赖，确保服务晚挂载时由 DSH 等待后再执行插件；该包面向 DSH Web profile，不提供无 WebServer 的 headless 路由。HTTP 守卫还会检查真实 socket peer，反向代理只有在连接本身来自 loopback 时才会被接受。
 
 | DSH runtime | Node.js 支持 | 真实 Cordis smoke | 结论 |
 | --- | --- | --- | --- |
+| `0.1.5-rc.2` | `>=22 <25` | 通过（真实 Cordis 服务链，Node 24） | 已实测通过（尚未纳入 CI 矩阵） |
 | `0.1.5-rc.1` | `>=22 <25`，CI 覆盖 22/24 | 通过（真实 Cordis 服务链，Node 24） | 已声明、已验证 |
 | `0.1.2-rc.1` | `>=22 <25` | 通过（实际使用验证，未纳入 CI） | 已实际验证兼容 |
 | `0.1.1-rc.2` | `>=22 <25`，CI 覆盖 22/24 | 通过（当前 Node 24） | 已声明、已验证 |
@@ -105,11 +106,13 @@ node scripts/replay-fixture.mjs fixtures/usage-events.json
 
 ### 最近更新
 
-**v1.1.10**
+**v1.1.12**
 
-- **恢复账本的 revision 快路径**：DSH 0.1.5 把 `sessionPersistence.listSnapshots()` 改名为 `list()`，插件因此拿不到每会话 revision，`sessionsSkippedByRevision` 恒为 0、每次启动都重读全部会话日志（实测 479 个会话读了 431 个、约 13 分钟）。现在两种写法都支持，未变化的会话重新从账本复用。
-- **扫描期间的工作区变更不再被丢弃**：以前基线运行中到达的注册表变更会被直接忽略，导致新增工作区必须重启才出现；现在会被记住并在扫描结束后立即补跑，另有每 30 秒的注册表轮询兜底。
-- 升级后**首次**启动仍会全量读一次（旧账本记录没有 `lastRevision` 字段），此后启动走快路径。
+- **桌面端自己的关闭按钮不再被面板盖住**：用量面板是全窗口遮罩，它的半透明背景和抓手条以前会铺满桌面客户端留给窗口按钮的那条 40px 顶栏，把桌面端的关闭按钮压在面板后面。现在只要宿主声明了 `data-windows-titlebar`，抽屉就从 `--dsh-windows-titlebar-height`（Windows 为 40px）下方开始绘制，顶栏保持干净；浏览器端没有该标记，行为不变。
+- **顶栏留白此前其实一直没生效**：`Number(localStorage.getItem('dsh-all-usage:topInset'))` 会把「未设置」读成 `0` 并提前返回，宿主标记 / Window Controls Overlay 几何 / UA 兜底全是死代码 —— 这就是上一版「改了却毫无变化」的原因。现在「未设置」与显式 `0` 已区分。
+- 顶栏高度优先取宿主自己声明的值，其次取 Window Controls Overlay 矩形，最后退回 UA；`localStorage['dsh-all-usage:topInset']` 仍可覆盖，免重构建微调。
+- `/api/all-usage/status` 新增 `clientEnv`（客户端经新的 `GET /api/all-usage/client-env` 上报）：UA、遮罩高度、留白值**及其来源**、视口、面板自身矩形，加载时与打开面板时各一次 —— 桌面端内部正是靠它在外部核对。
+- v1.1.11 只到了 GitHub Releases、没有到 npm（其发布流程会检出 release tag 并跑真实 Cordis smoke，而那条 smoke 的 route 计数写死为 9，被新路由打破；已发布的 tag 不移动）。桌面端修复随本版本进入 npm，运行时代码与 v1.1.11 完全相同。
 
 完整版本记录见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -218,11 +221,12 @@ A full usage dashboard for DeepSeek Harness. Analyze tokens, cache behavior, est
 ### Compatibility and Known Limitations
 
 - **Runtime**: Node.js `>=22 <25` is required. CI runs the test suite, syntax checks, and package-content checks on Node 22 and Node 24.
-- **DSH compatibility**: `package.json` declares DSH runtime `>=0.1.1-rc.1 <0.1.5-0 || >=0.1.5-rc.1 <0.1.6-0`; the real Cordis service chain is verified on `0.1.5-rc.1`, `0.1.1-rc.2` and `0.1.1-rc.1`. `0.1.2-rc.1` has also been verified compatible through real-world use, but is not covered by the CI smoke matrix. The declaration is split per tuple rather than written as one interval because node-semver only admits a prerelease version when some comparator shares its exact `major.minor.patch` tuple and itself carries a prerelease tag.
+- **DSH compatibility**: `package.json` declares DSH runtime `>=0.1.1-rc.1 <0.1.5-0 || >=0.1.5-rc.1 <0.1.6-0`; the real Cordis service chain is verified on `0.1.5-rc.2`, `0.1.5-rc.1`, `0.1.1-rc.2` and `0.1.1-rc.1`. `0.1.2-rc.1` has also been verified compatible through real-world use, but is not covered by the CI smoke matrix. The declaration is split per tuple rather than written as one interval because node-semver only admits a prerelease version when some comparator shares its exact `major.minor.patch` tuple and itself carries a prerelease tag.
 - **Web service dependency**: the Host declares `webServer` as a required dependency, so DSH waits for a late-mounted service before applying the plugin; this package targets the DSH Web profile and does not expose routes without WebServer. The HTTP guard also checks the actual socket peer, so a reverse proxy is accepted only when the connection itself is loopback.
 
 | DSH runtime | Node.js support | Real Cordis smoke | Conclusion |
 | --- | --- | --- | --- |
+| `0.1.5-rc.2` | `>=22 <25` | Passed (real Cordis service chain, Node 24) | Verified locally (not yet in the CI matrix) |
 | `0.1.5-rc.1` | `>=22 <25`, CI covers 22/24 | Passed (real Cordis service chain, Node 24) | Declared and verified |
 | `0.1.2-rc.1` | `>=22 <25` | Passed through real-world use (not in CI) | Verified compatible in real-world use |
 | `0.1.1-rc.2` | `>=22 <25`, CI covers 22/24 | Passed (current Node 24) | Declared and verified |
@@ -292,11 +296,13 @@ The command loads the real plugin Host, calls its compatible APIs, checks the do
 
 ### Latest Update
 
-**v1.1.10**
+**v1.1.12**
 
-- **The ledger fast path is back**: DSH 0.1.5 renamed `sessionPersistence.listSnapshots()` to `list()`, so no per-session revision was ever obtained — `sessionsSkippedByRevision` stayed at 0 and every start re-read every session log (431 reads / ~13 minutes for 479 sessions). Both spellings are accepted now, and unchanged sessions are applied from the ledger again.
-- **A registry change during a baseline is no longer dropped**: a change arriving mid-scan used to be ignored, so a newly added workspace only appeared after a restart. It is now replayed as soon as the scan settles, with a 30-second registry poll as a safety net.
-- The first start after upgrading still reads every log once (older ledger records carry no `lastRevision`); later starts take the fast path.
+- **The desktop client's own close button is no longer covered**: the usage sheet is a full-window overlay, so its backdrop and grabber bar were painted across the 40px caption strip the desktop client keeps for its window buttons, dimming the client's close button behind the panel. When the host marks the document with `data-windows-titlebar`, the sheet now starts below `--dsh-windows-titlebar-height` (40px on Windows) and the strip stays clear. Browsers have no such marker and are unchanged.
+- **The strip reservation never actually applied**: `Number(localStorage.getItem('dsh-all-usage:topInset'))` read an unset key as `0` and returned early, leaving the host marker, the Window Controls Overlay geometry and the user-agent fallback as dead code — which is why the previous attempt changed nothing at all. An unset key is now distinguished from an explicit `0`.
+- The strip height comes from the host's own declaration first, then the Window Controls Overlay rectangle, then the user agent; `localStorage['dsh-all-usage:topInset']` still overrides it, so no rebuild is needed to tune it.
+- `/api/all-usage/status` now exposes `clientEnv` (reported through the new `GET /api/all-usage/client-env` route): user agent, overlay height, the reserved strip **and its source**, viewport, and the panel's own rectangles, sent at load and whenever the sheet opens — which is how the reservation bug was pinned down from outside the desktop app.
+- v1.1.11 reached GitHub Releases but never npm: its publish workflow checks out the release tag and runs the real Cordis smoke, whose route count was hard-coded to 9 and broke on the new route (a published tag is never moved). The desktop fix reaches npm with this release; the runtime code is identical to v1.1.11.
 
 See [CHANGELOG.md](CHANGELOG.md) for the complete version history.
 

package/lib/aggregation.js

@@ -601,7 +601,7 @@ export function createAggregation(host) {
   }
   function statusSnapshot() {
     commitPendingStats()
-    return { instanceId: state.instanceId, ...revisionSnapshot(), updatedAt: state.statsUpdatedAt, scan: scanSnapshot(), sync: syncSnapshot() }
+    return { instanceId: state.instanceId, ...revisionSnapshot(), updatedAt: state.statsUpdatedAt, scan: scanSnapshot(), sync: syncSnapshot(), clientEnv: state.clientEnv }
   }
   function serializeIdentity(identity) {
     const value = coerceIdentity(identity)