dsh-all-usage 1.1.17 → 1.1.18

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to `dsh-all-usage` are documented here.
 
+## [1.1.18] - 2026-10-07
+
+### Added
+
+- **A seven-day range.** The time-range presets gain 近 7 天 / Last 7 Days next to today, 30 days, 90 days and all time; it scopes the summary, trend, model tables, audit log, filters and CSV export like every other preset (seven calendar days, today included), and the choice persists in the browser like the others.
+- **A switchable heatmap span.** The activity heatmap no longer forces 53 columns: 30 天 / 90 天 / 12 个月 buttons redraw it with 5, 13 or 53 week columns. The grid follows the span (each column is a week and every cell keeps a 1:1 aspect ratio), so a shorter span also gets taller, readable cells instead of 10px squares. The span is stored with the other UI preferences and is independent of the time range above: changing the range never resizes the heatmap and vice versa.
+- **A version indicator in the header.** The dashboard title now carries the running plugin version: “已是最新 / Up to date” in small text when it matches the newest release on npm, “最新 vX.Y.Z / Latest vX.Y.Z” highlighted when it is behind, and clicking it opens the GitHub repository. The host performs the check (`GET /api/all-usage/version`, one read-only request to `registry.npmjs.org`, cached for 6 hours, never initiated by the page itself), so a desktop shell that cannot reach the network still shows its running version, and the refresh button forces a fresh check. An unreachable registry or an unparseable tag degrades to “unknown” (the chip shows the version alone) rather than claiming either verdict.
+
 ## [1.1.17] - 2026-10-01
 
 ### Fixed

package/README.md

@@ -1,5 +1,6 @@
 # dsh-all-usage
 
+[![](https://img.shields.io/badge/powered_by-dsh-4D6BFE?style=flat-square&logo=deepseek&logoColor=white)](https://github.com/deepseek-ai/deepseek-harness)
 [![awesome · DSH plugin](https://awesome-dsh-plugin.com/badge.svg)](https://awesome-dsh-plugin.com)
 [![npm](https://img.shields.io/npm/v/dsh-all-usage?label=npm&color=4D6BFE)](https://www.npmjs.com/package/dsh-all-usage)
 [![downloads](https://img.shields.io/npm/dt/dsh-all-usage?label=downloads&color=4D6BFE)](https://www.npmjs.com/package/dsh-all-usage)
@@ -17,14 +18,15 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 
 ### 功能
 
-- **热力图**：53 周使用热力图；按工作区筛选并查看每日回合与 Token 明细
+- **热力图**：使用热力图可选**最近 30 天 / 90 天 / 12 个月**三种跨度（格子随跨度自适应，跨度越短格子越大）；按工作区筛选并查看每日回合与 Token 明细
 - **模型统计**：支持混合查看、按模型合并、按供应商汇总三种维度，展示调用次数、各类 Token 与缓存命中率；模型行与筛选下拉显示真实厂商品牌 SVG 图标（未知/混牌保持中性）
 - **摘要与工作区**：Token 用量、缓存命中、估算成本、账户余额、连续使用、工作区 Token 分布和明细
 - **成本统计 / 价格表**：从 models.dev 同步模型价格；按输入、输出、缓存读取和缓存写入四个桶计算，保存价格快照，明确区分已计价、免费模型和未计价调用。成本设置是一张可编辑的价格表：每行一个账本模型，价格框直接编辑即写入该模型的手工价，「官方模型」列选定映射后该行自动改用官方目录价，并可为每行配置**上下文费率档位**与**分时段（UTC 峰谷）计费**；配置里存在但账本暂无用量的行同样可见、可改、可删。峰谷规则可额外开启「中国法定节假日全天按谷时计价」，节假日日期以显式列表保存在该模型的峰谷计划里（按北京时间 UTC+8 日历日判定，支持 2026-10-01..2026-10-07 区间写法，也可一键「从公开日历载入」当年放假安排后冻结进策略）。内置 DeepSeek 峰谷表已自带 2026 年官方放假安排（随插件版本更新），官方直连或已映射到官方条目的行无需任何配置即按节假日谷价计价；非官方直连的中转行仍按静态价，映射后生效
 - **导出**：按当前时间范围和模型聚合方式导出 CSV
-- **时间范围**：今日、近 30 天、近 90 天、全部，或在全部可扫描历史日数据中自定义起止日期；热力图始终展示最近 53 周
+- **时间范围**：今日、**近 7 天**、近 30 天、近 90 天、全部，或在全部可扫描历史日数据中自定义起止日期；热力图跨度独立切换（30 天 / 90 天 / 12 个月），与时间范围互不影响
 - **工作区别名**：在侧栏入口打开看板后管理，持久化保存到 $DSH_HOME/storages 的 KV 单元 `all_usage_aliases`
 - **界面语言**：在看板顶部切换中文与 English；选择会保存到浏览器本地
+- **版本指示**：标题旁显示当前运行版本号——与 npm 上最新发布版一致时小字标注「已是最新」，落后时标出「最新 vX.Y.Z」并高亮，点击任意状态都打开 GitHub 仓库；检查由 Host 缓存（默认 6 小时），只有点「刷新统计数据」才会强制重新检查
 - **完整历史与增量重建**：基线扫描全部可读历史会话；独立用量账本同时作为每会话游标——未变化的会话直接复用账本，新增事件只增量回填，长历史重启不再全量重建
 - **重启免读**：用持久化日志的 revision 作为每会话的变更信号（只读头部行 + stat，不读全量）——日志未变的会话重启时连事件都不读，直接从账本复用；仅日志变化（新增/修改）的会话才做增量读取
 - **数据健康与按需刷新**：扫描完成后浏览器只检查轻量状态版本，只有用量、别名或同步状态变化时才拉完整历史；显示本次数据更新时间、历史扫描健康、revision 免读、实际读取、账本恢复和失败，网络异常保留上次成功数据并可重试
@@ -116,10 +118,11 @@ node scripts/replay-fixture.mjs fixtures/usage-events.json
 
 ### 最近更新
 
-**v1.1.17**
+**v1.1.18**
 
-- **修复：DSH 桌面端无法保存成本设置。** 写接口（保存价格、立即同步、节假日抓取、别名）原先要求请求带 `Origin` 且与 loopback Host 同源，而桌面端把 UI 跑在自定义协议 `dsh-app://app` 上、请求由 Electron 主进程转发时会删掉 `Origin`（连同 `Host`/`Cookie`/`Sec-Fetch-*`），于是桌面端的所有写入必然 403——保存价格报「没有权限」、models.dev 目录永远同步不下来、自动同步勾选后回滚。现在写入以**进程令牌**为授权凭据（跨域页面既读不到也塞不进表单 POST），`Origin` 存在时仍必须是 loopback 或桌面端自身 scheme，`Host` 仍必须是 loopback（防 DNS rebinding）。
-- **健壮性修复**：宿主未下发 `usageBacked` 时不再断言「账本无用量」，改为「用量未知」三态（独立标记、行样式与页脚计数）；`/api/all-usage/status` 新增派生的 `capabilityId`（令牌轮换时变化，令牌本身只在完整快照里下发）与 `pluginVersion`，页面据此察觉宿主被重新加载、写入遇 403 时自动重取令牌并重试一次，宿主与页面版本不一致时直接提示「请重启 DSH」。
+- **新增「近 7 天」时间范围**：预设行变为 今日 / **近 7 天** / 近 30 天 / 近 90 天 / 全部 / 自定义；口径是含今天的 7 个日历日，摘要、趋势、模型表、请求日志、筛选与 CSV 导出同步生效，选择会记在浏览器里。
+- **热力图跨度可切换（30 天 / 90 天 / 12 个月）**：列数随跨度变化（5 / 13 / 53 列），每列一周、格子保持 1:1，所以跨度越短格子越大（实测 12 个月 18×18px、30/90 天 34×34px，并做了上限避免少数几列被拉成巨块）；默认仍是 12 个月，与上方时间范围互不影响。
+- **标题旁新增版本指示**：显示当前运行版本，与 npm 最新版一致时小字「已是最新」，落后时高亮「最新 vX.Y.Z」，点击打开 GitHub 仓库；检查由宿主发起（只读一次 npm registry，缓存 6 小时，同一进程 30 秒内不重复请求），拿不到结论时降级为「未知」而不是猜。
 
 完整版本记录见 [CHANGELOG.md](CHANGELOG.md)。
 
@@ -168,6 +171,7 @@ dsh plugin --profile web add github:ParticleLight/dsh-all-usage
   - `GET /api/all-usage/status` — 轻量 revision 与同步健康状态，并附带最近一次客户端环境报告（`clientEnv`）、运行中插件的版本号（`pluginVersion`）与写入令牌的派生 ID（`capabilityId`，令牌轮换时变化，用于让页面察觉宿主被重新加载；令牌本身只在完整快照里下发）
   - `GET /api/all-usage/query` — 按 scope 返回聚合、daily/hourly 趋势和 heatmap 数据；单日 scope 填充 `hourly`，跨日 scope 的 `hourly` 为空
   - `GET /api/all-usage/records` — 按 scope 分页返回脱敏 canonical usage rows
+  - `GET /api/all-usage/version?force=1` — 版本检查：返回运行中版本与 npm 上最新版本、比较结论（`latest` / `outdated` / `unknown`）、检查时间与来源；Host 侧缓存 6 小时，同一进程内对上游的请求最多每 30 秒一次（`force=1` 也受此下限约束），`force=1` 来自刷新按钮
   - `GET /api/all-usage/balance?force=1` — 账户余额（复用 `llm-deepseek` 的 API Key 配置）
   - `POST /api/all-usage/alias` — 设置工作区别名
   - `GET /api/all-usage/pricing` — 读取可编辑价格表所需的完整配置：逐模型的生效费率与状态、映射、手工价、峰谷计划（含内置表来源与完整规则）以及仅存在于配置中的行
@@ -181,10 +185,11 @@ dsh plugin --profile web add github:ParticleLight/dsh-all-usage
 ### 数据说明
 
 - 使用次数与 Token 来自 DSH 会话日志；`session/flush` 只在存在新的相关事件时重建并将派生账本写入异步队列，同一 session 的 pending record 会合并，插件退出时 drain；插件激活时会回填日志与账本历史，插件卸载/重启后已成功持久化的数据不丢
-- 按日范围统计会保留全部可读取历史会话的有使用记录日期；热力图仅作为最近 53 周的固定视图窗口
+- 按日范围统计会保留全部可读取历史会话的有使用记录日期；热力图是可切换跨度的视图窗口（最近 30 天 / 90 天 / 12 个月，默认 12 个月）
 - 会话删除后，已成功 flush 的用量仍从独立账本恢复；工作区删除同样不会丢数据——其历史用量汇总为一行「已删除」（含未落账的实时用量）。会话销毁提示和周期对账只负责触发重建，不会删除账本记录
 - 同一会话的同一 `turn / step` 只保留一份最终 usage；重试或替换消息会替换旧贡献，不重复累计
 - 输入 Token 按「未含缓存命中」计（缓存命中 / 写入独立成桶）；全 0 用量的重放事件不会覆盖已记录的真实用量，纯缓存命中的请求仍会计入
+- 版本检查会向 `registry.npmjs.org` 发一次只读 GET（仅读取 `dsh-all-usage` 的版本号，无请求体、无 Cookie；由 Host 发起并缓存 6 小时，页面自身不联网），失败时降级为「未知」而非猜测
 - 轻量状态接口只公开 Host 实例、统计 revision、扫描进度、同步计数与最近一次客户端环境报告（UA、视口、预留顶栏值及其来源、面板矩形——由本机客户端上报且只存内存），不公开会话 ID、工作区路径、提示词或回复正文；完整快照仅在状态变化或手动刷新时获取
 - scope query 将回合（turns）、模型调用（calls）和去重会话（sessions）分开统计；Provider/模型筛选缺少路由信息时明确归为 Unknown，不从展示字符串猜测
 - records 接口只返回短 hash、时间、工作区 ID、结构化模型身份、turn/step、Token buckets 和当前物化来源，不返回原始 session ID、路径、提示词、回复或凭据
@@ -211,12 +216,12 @@ A full usage dashboard for DeepSeek Harness. Analyze tokens, cache behavior, est
 
 ### Features
 
-- **Heatmap**: a 53-week activity heatmap with workspace filters and daily turn/token details
+- **Heatmap**: an activity heatmap with a switchable span (**last 30 days / 90 days / 12 months**; shorter spans get larger cells), workspace filters and daily turn/token details
 - **Model analytics**: mixed view, model-merged view, and provider summary with calls, token categories, and cache hit rate; model rows and the model filter dropdown render vendor brand SVG icons (neutral for unknown or mixed brands)
 - **Summary and workspaces**: processed tokens, cache hits, estimated cost, account balance, usage streaks, workspace distribution, and details
 - **Cost statistics / price table**: sync model prices from models.dev, calculate four cost buckets, persist price snapshots, and distinguish priced, free, ambiguous, and unpriced calls. Cost Settings is one editable price table: each row is a ledger model, its price boxes write that model's manual price, the official-model column switches the row to the catalog price, and every row can carry context rate bands and time-of-day (UTC peak/off-peak) rules, including an optional "Chinese statutory holidays price as off-peak all day" switch whose explicit date list lives in that model's peak plan (China Standard Time calendar days, 2026-10-01..2026-10-07 ranges supported, and one click loads the year's arrangement from a public calendar before it is frozen into the policy); rows that exist only in the saved configuration stay visible, editable, and removable
 - **CSV export**: export data using the selected time range and aggregation mode
-- **Time ranges**: today, last 30 days, last 90 days, all time, or a custom start/end date across all available historical daily data; the heatmap always shows the latest 53 weeks
+- **Time ranges**: today, **last 7 days**, last 30 days, last 90 days, all time, or a custom start/end date across all available historical daily data; the heatmap span switches independently (30 days / 90 days / 12 months)
 - **Workspace aliases**: manage aliases from the sidebar dashboard; values persist in the $DSH_HOME/storages KV cell `all_usage_aliases`
 - **Interface language**: switch between Chinese and English from the dashboard header; your choice persists locally in the browser
 - **Full history & incremental rebuild**: the baseline scans every readable historical session; the durable usage ledger doubles as a per-session cursor, so unchanged sessions are reused straight from the ledger and only newly appended events are folded — long histories restart without a full rebuild
@@ -225,6 +230,7 @@ A full usage dashboard for DeepSeek Harness. Analyze tokens, cache behavior, est
 - **Data health and on-demand refresh**: after a scan completes, the browser polls only a lightweight status revision and fetches full history only after usage, alias, or sync state changes; it shows the latest full-data update, historical scan health, revision skips, rereads, ledger recovery, and failures while preserving last-good data on network errors
 - **Performance**: Host maintains ingest-time local/UTC day, workspace, model-identity cubes and single-day hour buckets; scope queries merge buckets, exact costs use BigInt decimal accumulators, and the 53-week heatmap emits only the fields it consumes, while revision-scoped snapshot/records caches and recyclable live-event queues remain in place. Client isolates the heatmap, tooltip, trend, donuts, request records, and pricing dialog behind memoized boundaries; pointer coordinates update through refs plus requestAnimationFrame instead of rerendering the page, and the browser entry is deterministically minified before packing
 - **Trend line chart**: show input, cache read/write, output, reasoning, and total processed tokens for the active range, timezone, workspace, provider, and model scope; use hourly buckets for a single-day scope and daily buckets for cross-day scopes, with smooth monotone curves, staged entrance animation, hover for exact values, and click a point to inspect that day
+- **Version indicator**: the header shows the running version next to the title — “Up to date” in small text when it matches the newest release on npm, “Latest vX.Y.Z” highlighted when it is behind, and a click opens the GitHub repository; the host caches the check (6 hours by default) and only the refresh button forces a new one
 - **Unified filters and audit**: workspace, provider, model, and date filters apply to the summary, heatmap, trend, tables, and CSV; workspace, provider, and model filters remain independent and can be combined freely, while workspace, provider, and model options are limited to values used in the selected date range and stale selections clear automatically; request logs stay visible as a compact paginated table with grouped Token details for the selected row
 - **Token accounting semantics**: input tokens are fresh (exclude cache hits/writes, which sit in separate buckets along with reasoning); all-zero usage replays never overwrite recorded usage, while cache-only requests still count
 - **Cost semantics**: prices come from the models.dev USD per 1M token catalog; DSH-normalized fresh input and the four cost buckets are snapshotted at calculation time, the multiplier applies only to final total, and existing positive historical costs are not recalculated; matching uses the model's official vendor entry and ignores the DSH provider, while missing official prices stay unpriced
@@ -310,10 +316,11 @@ The command loads the real plugin Host, calls its compatible APIs, checks the do
 
 ### Latest Update
 
-**v1.1.17**
+**v1.1.18**
 
-- **Fixed: the DSH desktop client could not save cost settings.** The write routes (price save, immediate sync, holiday fetch, alias) required an `Origin` header matching the loopback host, but the desktop shell serves the UI on its own `dsh-app://app` scheme and forwards page requests through Electron, which strips `Origin` (along with `Host`, `Cookie` and `Sec-Fetch-*`) — so every desktop write was rejected with 403: saving prices reported "no permission", the models.dev catalog could never be synced, and the auto-sync checkbox rolled back. Writes are now authorized by the process capability (which a cross-origin page can neither read nor attach to a form POST), a present `Origin` must still be loopback or the shell's own scheme, and `Host` must still be loopback against DNS rebinding.
-- **Robustness fixes**: a host that omits `usageBacked` no longer reads as "no ledger usage" (the panel now has a distinct "usage unknown" state, flag, row style and footer count); `GET /api/all-usage/status` reports a derived `capabilityId` (changes when the capability rotates, while the capability itself is only ever sent in the full snapshot) and the running `pluginVersion`, so the page notices a plugin reload, re-reads the capability and retries once when a write is rejected with 403, and says "restart DSH" when the host and the page disagree on the version.
+- **A new “Last 7 Days” range**: the presets are now Today / **Last 7 Days** / Last 30 Days / Last 90 Days / All Time / Custom; it covers seven calendar days including today and applies to the summary, trend, model tables, request log, filters and CSV export, with the choice remembered in the browser.
+- **A switchable heatmap span (30 days / 90 days / 12 months)**: the column count follows the span (5 / 13 / 53 columns); each column is a week and the cells keep a 1:1 aspect ratio, so a shorter span also gets larger cells (18×18px at twelve months, 34×34px at 30/90 days, capped so a few columns cannot stretch into huge tiles). Twelve months stays the default and the span is independent of the time range above.
+- **A version indicator next to the title**: it shows the running version, “Up to date” in small text when it matches the newest release on npm, a highlighted “Latest vX.Y.Z” when it is behind, and a click opens the GitHub repository. The host performs the check (one read-only request to the npm registry, cached for six hours, at most one every 30 seconds per process) and degrades to “unknown” rather than guessing.
 
 See [CHANGELOG.md](CHANGELOG.md) for the complete version history.
 
@@ -354,6 +361,7 @@ The profile patch layer hot-reloads; save the file and refresh the page.
   - `GET /api/all-usage/status` — lightweight revision and sync health, plus the last client environment report (`clientEnv`), the running plugin version (`pluginVersion`) and a derived id of the write capability (`capabilityId`, changes when the capability rotates so the page can notice a plugin reload; the capability itself is only ever sent in the full snapshot)
   - `GET /api/all-usage/query` — scoped aggregate, daily/hourly trend, and heatmap data; single-day scopes populate `hourly`, while cross-day scopes return an empty `hourly` array
   - `GET /api/all-usage/records` — paginated privacy-safe canonical usage rows
+  - `GET /api/all-usage/version?force=1` — version check: the running version, the newest published version, the verdict (`latest` / `outdated` / `unknown`), when it was checked and where it came from; cached on the host for 6 hours with at most one upstream request every 30 seconds per process (the floor applies to `force=1` too), `force=1` comes from the refresh button
   - `GET /api/all-usage/balance?force=1` — account balance using the configured `llm-deepseek` API key
   - `POST /api/all-usage/alias` — update workspace aliases
   - `GET /api/all-usage/pricing` — read the full editable price table: per-row effective rates and status, mappings, manual prices, peak plans (with their built-in/explicit origin and full rules), and rows that exist only in the configuration
@@ -367,10 +375,11 @@ The profile patch layer hot-reloads; save the file and refresh the page.
 ### Data semantics
 
 - Calls and tokens come from DSH session logs; `session/flush` rebuilds and queues the derived ledger only when related events are dirty, coalescing the latest pending record per session and draining on plugin disposal. Readable logs and ledger history are backfilled when the plugin activates, so successfully persisted data survives reloads or session deletion; deleting a workspace likewise keeps its history, summed into one "Deleted" row together with usage that had not reached the ledger yet
-- Day-level range data retains every readable historical session date with tracked usage; the heatmap is only a fixed latest-53-week view
+- Day-level range data retains every readable historical session date with tracked usage; the heatmap is a switchable-span view (last 30 days / 90 days / 12 months, 12 months by default), not a fixed latest-53-week view
 - After a session is deleted, successfully flushed usage is restored from the separate ledger; disposal hints and periodic reconciliation trigger rebuilds without deleting ledger rows
 - For each session and logical `turn / step`, only the final usage contribution is kept; retries or replaced messages do not double-count
 - Input tokens are fresh (exclude cache hits/writes, which sit in their own buckets); all-zero usage replays do not overwrite recorded usage and pure cache-read requests still count
+- The version check is a single read-only GET to `registry.npmjs.org` (the version number of `dsh-all-usage` only: no body, no cookies; issued by the host and cached for 6 hours, the page itself never reaches the network), and a failed check degrades to “unknown” instead of guessing
 - The lightweight status endpoint exposes only the Host instance, stats revision, scan progress, sync counters, and the last client environment report (user agent, viewport, reserved strip and its source, panel rectangles — reported by a local client and kept in memory only). It does not expose session IDs, workspace paths, prompts, or reply bodies; full snapshots are fetched only after status changes or a manual refresh
 - Scoped results keep turns, model calls, and distinct sessions as separate metrics; missing route identity is explicitly Unknown rather than inferred from a display label
 - The records endpoint returns only a short hash, time, workspace ID, structured model identity, turn/step, token buckets, and current materialization source. It omits raw session IDs, paths, prompts, replies, and credentials