dsh-all-usage 1.1.4 → 1.1.6

package/CHANGELOG.md

@@ -2,7 +2,30 @@
 
 All notable changes to `dsh-all-usage` are documented here.
 
-## [Unreleased]
+## [1.1.6] - 2026-09-11
+
+### Fixed
+
+- DSH 0.1.5 compatibility: that runtime replaced the Session `events` getter with `snapshotEvents()`, so the live flush path read an empty event log and folded every flushed session into an empty ledger record (`lastSeq: -1`, no turns, no usage). The dashboard stayed correct because live totals come from the `session/event` hook, but the durable "usage survives session deletion" guarantee silently degraded and restart lost the zero-rescan fast path. Event access now prefers `session.events` and falls back to `session.snapshotEvents()`, leaving 0.1.1 behaviour unchanged.
+- The runtime smoke test now asserts the persisted ledger keeps the flushed session's sequence and usage, and covers 0.1.5-rc.1 alongside the 0.1.1 line, so this regression cannot return unnoticed.
+
+### Changed
+
+- Declared DSH runtime compatibility widened to `>=0.1.1-rc.1 <0.1.6`, with `0.1.5-rc.1` added to the verified list; the runtime smoke test pins the Cordis/loader/timer lines per runtime version.
+
+## [1.1.5] - 2026-09-07
+
+### Added
+
+- Workspace registries are now kept fresh by an automatic **probe**: all-usage listens to DSH's `domain/changed` event for the workspace domain and, on any durable registry write (create/delete/rename/reorder/archive/attach/detach), rereads `workspaceRegistry.list()`. The sync is incremental — only added workspaces are scanned (the sessions that belong to them) and removed workspaces have their sessions subtracted via inverse folding, while unchanged workspaces reuse their computed aggregates and ledger with zero rescan. The manual Refresh workspaces control, its `POST /api/all-usage/workspaces/refresh` route, and the refresh-workspaces client button were removed. Usage remains intentionally restricted to registered workspaces; unregistered cwds are ignored.
+
+### Fixed
+
+- Usage is strictly limited to DSH-registered workspaces: sessions whose cwd does not map to `workspaceRegistry.list()` (including existing directories absent from the registry) are ignored, and legacy `unregistered:` ledger rows are never resurrected as history.
+- Ledger rows whose persisted `sourceCwd` no longer maps to a registered workspace (for example the session directory was removed) are skipped during recovery instead of being restored as stale data; the workspace source path is now persisted with every ledger record so restart recovery can validate ownership.
+
+
+## [1.1.4] - 2026-09-03
 
 ### Added
 
@@ -38,8 +61,6 @@ All notable changes to `dsh-all-usage` are documented here.
 - Build-time SVG validation now decodes XML entities before checking, rejects unquoted URI attributes, external CSS url()/image-set() and @import targets (including escaped/commented/CDO-CDC/namespaced <svg:style> forms), DOCTYPE/CDATA/processing instructions and every external-resource element; the CSS checks run only on style attributes and <style> bodies so icon text and comments stay inert. It lives in scripts/svg-guard.mjs so the tests exercise the exact same guard with adversarial fixtures.
 - Bundle the icon provenance required for release: the manifest pins the upstream commit, records per-file upstream paths and modification flags, and assets/model-icons/LICENSE.upstream-lobe-icons.txt ships the MIT notice, copyright, trademark disclaimer and the local modifications. The build fails if the pinned revision, licence file or per-file attribution is missing.
 
-## [1.1.4] - 2026-09-03
-
 ### Fixed
 
 - Hardened the model-icon build guard after an independent audit: the CSS checks now reject CDO/CDC-adjacent `@import`, external `@import` inside namespaced `<svg:style>` elements, CSS-escaped `url(` identifiers and external `image-set()` targets, all matching Blink's own tokenizer. Style-attribute `url(...)` references are checked on both the raw and entity-decoded document so `&quot;` quoting cannot split a payload while encoded `@import` is still caught after decoding.
@@ -235,6 +256,7 @@ This release reduces historical scan work, storage write amplification, and Dash
 - Allowed same-origin browser balance GET requests that omit `Origin` while retaining token protection.
 - Standardized English date buckets, range filters, streaks, heatmap dates, and export timestamps on UTC.
 
+[1.1.5]: https://github.com/ParticleLight/dsh-all-usage/releases/tag/v1.1.5
 [1.1.4]: https://github.com/ParticleLight/dsh-all-usage/releases/tag/v1.1.4
 [1.1.3]: https://github.com/ParticleLight/dsh-all-usage/releases/tag/v1.1.3
 [1.1.2]: https://github.com/ParticleLight/dsh-all-usage/releases/tag/v1.1.2

package/README.md

@@ -11,7 +11,7 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 ### 功能
 
 - **热力图**：53 周使用热力图；按工作区筛选并查看每日回合与 Token 明细
-- **模型统计**：支持混合查看、按模型合并、按供应商汇总三种维度，展示调用次数、各类 Token 与缓存命中率
+- **模型统计**：支持混合查看、按模型合并、按供应商汇总三种维度，展示调用次数、各类 Token 与缓存命中率；模型行与筛选下拉显示真实厂商品牌 SVG 图标（未知/混牌保持中性）
 - **摘要与工作区**：Token 用量、缓存命中、估算成本、账户余额、连续使用、工作区 Token 分布和明细
 - **成本统计**：从 models.dev 同步模型价格；按输入、输出、缓存读取和缓存写入四个桶计算，保存价格快照，明确区分已计价、免费模型和未计价调用
 - **导出**：按当前时间范围和模型聚合方式导出 CSV
@@ -21,6 +21,7 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 - **完整历史与增量重建**：基线扫描全部可读历史会话；独立用量账本同时作为每会话游标——未变化的会话直接复用账本，新增事件只增量回填，长历史重启不再全量重建
 - **重启免读**：用持久化日志的 revision 作为每会话的变更信号（只读头部行 + stat，不读全量）——日志未变的会话重启时连事件都不读，直接从账本复用；仅日志变化（新增/修改）的会话才做增量读取
 - **数据健康与按需刷新**：扫描完成后浏览器只检查轻量状态版本，只有用量、别名或同步状态变化时才拉完整历史；显示本次数据更新时间、历史扫描健康、revision 免读、实际读取、账本恢复和失败，网络异常保留上次成功数据并可重试
+- **工作区注册同步**：监听 DSH 的 `domain/changed` 事件自动跟随工作区注册表——注册表一有改动（创建/删除/重命名/重排/归档/成员变化）就重读 `workspaceRegistry.list()`；只对新增/删除的工作区做增量处理，未变化的已有工作区直接复用已计算账本（零重扫）。统计严格限定已注册工作区：未注册 cwd（含存在但未登记目录）一律忽略
 - **性能优化**：Host 在 ingest 时维护 local/UTC 的日期、工作区、模型身份日级 cube 与单日小时桶；scope 查询按 bucket 合并，成本使用精确 BigInt 小数累加，53 周热力图只生成实际需要的字段，并继续使用 revision-scoped snapshot/records 缓存和可回收的实时事件队列；Client 将热力图、tooltip、趋势、环形图、请求日志和定价对话框隔离为 memoized 边界，指针坐标通过 ref + requestAnimationFrame 更新，不再触发整页重渲染；浏览器入口在打包前确定性压缩
 - **趋势折线图**：按当前范围、时区、工作区、供应商和模型显示输入、缓存读写、输出、推理及总处理量；单日范围按小时聚合并显示小时轴，跨日范围按日聚合；使用平滑单调曲线与入场动画，悬停查看精确值，图例可切换曲线，点击点位进入当日明细
 - **统一筛选与审计**：工作区、供应商、模型和日期筛选贯穿摘要、热力图、趋势、表格与 CSV；工作区、供应商、模型三个筛选维度可独立自由组合，工作区、供应商和模型选项只展示当前日期范围内实际使用过的值；切换范围后失效筛选会自动清除；请求日志以紧凑分页表常驻显示，选择单条后查看分组 Token 详情
@@ -30,11 +31,12 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 ### 兼容性与已知限制
 
 - **运行环境**：需要 Node.js `>=22 <25`；CI 会在 Node 22 和 Node 24 上运行测试、语法检查和 npm 包内容检查。
-- **DSH 兼容**：`package.json` 声明 DSH runtime `>=0.1.1-rc.1 <0.1.2`，已使用 `0.1.1-rc.2` 和 `0.1.1-rc.1` 的真实 Cordis 服务链验证。
+- **DSH 兼容**：`package.json` 声明 DSH runtime `>=0.1.1-rc.1 <0.1.2`，已使用 `0.1.1-rc.2` 和 `0.1.1-rc.1` 的真实 Cordis 服务链验证；`0.1.2-rc.1` 已通过本人实际使用验证兼容，但尚未纳入 CI smoke 矩阵。
 - **Web 服务依赖**：Host 将 `webServer` 声明为必需依赖，确保服务晚挂载时由 DSH 等待后再执行插件；该包面向 DSH Web profile，不提供无 WebServer 的 headless 路由。HTTP 守卫还会检查真实 socket peer，反向代理只有在连接本身来自 loopback 时才会被接受。
 
 | DSH runtime | Node.js 支持 | 真实 Cordis smoke | 结论 |
 | --- | --- | --- | --- |
+| `0.1.2-rc.1` | `>=22 <25` | 通过（本人实际使用验证，未纳入 CI） | 已实际验证兼容 |
 | `0.1.1-rc.2` | `>=22 <25`，CI 覆盖 22/24 | 通过（当前 Node 24） | 已声明、已验证 |
 | `0.1.1-rc.1` | `>=22 <25`，CI 覆盖 22/24 | 通过（当前 Node 24） | 已声明、已验证 |
 | 其他版本 | `>=22 <25` | 未测试 | 不在已验证矩阵内 |
@@ -44,7 +46,7 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 - **中断请求**：上游请求被中断时可能只有 `assistant/chunk` 的 usage，没有最终 `assistant/message`；本插件会保留该 chunk 用量。同一 `turn / step` 后续出现最终 message 时，message 会替换 chunk。若上游完全没有 usage 事件，则无法从响应内容精确恢复 Token。
 - **估算成本**：成本是基于 models.dev 价格和 DSH usage 桶的估算，不是供应商账单；目录不可用或模型没有官方匹配时不会猜测价格，而是显示未计价。缓存读取、缓存写入和 reasoning 的口径取决于 DSH 上游事件。
 - **分层价格**：models.dev 的 tiered/context-dependent 价格按本次请求的输入上下文（fresh input + cache read + cache write）选择对应档位；阈值边界遵循目录定义，无法验证的异常 tier 仍显示为 unsupported。
-- **历史边界**：只有能按 cwd 映射到已注册工作区的会话会进入统计；会话尚未成功 flush 前删除或损坏的日志无法由独立账本恢复。
+- **工作区边界**：只有 cwd 能映射到 DSH 已注册工作区的会话才进入统计；未注册 cwd（包括已存在但未在 registry 中登记的目录）会被忽略。工作区注册列表通过 DSH 的 `domain/changed` 探针自动同步：注册表一有改动就重读并只对新增/删除的工作区做增量处理，未变化的已有工作区直接复用已计算账本，不会全量重扫。会话尚未成功 flush 前删除或损坏的日志无法由独立账本恢复。
 
 ### 本地统计与官方账单
 
@@ -53,7 +55,7 @@ DeepSeek Harness 全量用量看板：按模型、供应商、工作区和时间
 - 本地统计读取 DSH 的 `assistant/chunk`、最终 `assistant/message` 和其他会话事件，按同一 `turn / step` 去重和替换；官方账单可能按供应商自己的请求、分词器、舍入、折扣、免费额度和结算周期计算。
 - 失败请求只要留下 usage chunk，就会进入本地统计；供应商是否对该失败请求收费，应以官方账单为准。
 - 价格来自 models.dev 的公开模型目录和本地显式覆盖；目录价格、供应商实际价格、区域费率和账单折扣可能不同。成本字段应理解为估算值。
-- 本地统计只包含能映射到已注册工作区的会话，并可能因日志损坏、清理或上游没有发出 usage 而少于官方账单。
+- 本地统计只包含已注册工作区；未注册 cwd 与已删除目录的旧 ledger 不进入统计，并可能因日志损坏、清理或上游没有发出 usage 而少于官方账单。
 
 ### 可复现事件示例
 
@@ -102,6 +104,17 @@ node scripts/replay-fixture.mjs fixtures/usage-events.json
 
 ### 最近更新
 
+**v1.1.5**
+
+- **工作区注册探针**：自动跟随 DSH 工作区注册表（`domain/changed` 事件）；只对新增/删除的工作区增量重扫，未变化工作区直接复用账本，零全量重扫。移除了手动“刷新工作区”按钮与其 `POST /api/all-usage/workspaces/refresh` 路由。
+- **严格注册边界**：统计只包含 cwd 能映射到已注册工作区的会话；未登记目录（即使存在）与历史 `unregistered:` 账本行不再进入统计，已删除目录的旧账本行在恢复时跳过（`sourceCwd` 现在随每条账本持久化以校验归属）。
+
+**v1.1.4**
+
+- **模型品牌图标**：请求日志、选中调用详情、模型统计表、成本设置匹配表、环形图图例与模型筛选下拉现在显示真实厂商品牌 SVG（DeepSeek、OpenAI、Claude、Gemini、Meta、Zhipu、xAI、Qwen、Doubao、Kimi、MiniMax）；模型命名空间优先于 DSH 供应商名，未知或混牌行保持中性。图标在构建期以 data URI 内嵌并由 scripts/svg-guard.mjs 校验（实体解码、CSS 转义/CDO/命名空间、url()/image-set() 均覆盖，注释与文本不误杀），运行时零网络请求。
+- **构建安全加固**：补齐 CDO/CDC 邻接 at-import、命名空间 style 元素、CSS 转义 url() 与外部 image-set() 四类绕过，并把 CSS 检查收窄到 style 属性与 style 体；对抗用例现在断言拒绝原因。
+- 三张用量仪表盘截图刷新为当前 UI。
+
 **v1.1.3**
 
 - 成本统计支持经验证的 context-tiered 官方费率、可展开费率表和显式价格覆盖。
@@ -197,7 +210,7 @@ A full usage dashboard for DeepSeek Harness. Analyze tokens, cache behavior, est
 ### Features
 
 - **Heatmap**: a 53-week activity heatmap with workspace filters and daily turn/token details
-- **Model analytics**: mixed view, model-merged view, and provider summary with calls, token categories, and cache hit rate
+- **Model analytics**: mixed view, model-merged view, and provider summary with calls, token categories, and cache hit rate; model rows and the model filter dropdown render vendor brand SVG icons (neutral for unknown or mixed brands)
 - **Summary and workspaces**: processed tokens, cache hits, estimated cost, account balance, usage streaks, workspace distribution, and details
 - **Cost statistics**: sync model prices from models.dev, calculate four cost buckets, persist price snapshots, and distinguish priced, free, ambiguous, and unpriced calls
 - **CSV export**: export data using the selected time range and aggregation mode
@@ -206,6 +219,7 @@ A full usage dashboard for DeepSeek Harness. Analyze tokens, cache behavior, est
 - **Interface language**: switch between Chinese and English from the dashboard header; your choice persists locally in the browser
 - **Full history & incremental rebuild**: the baseline scans every readable historical session; the durable usage ledger doubles as a per-session cursor, so unchanged sessions are reused straight from the ledger and only newly appended events are folded — long histories restart without a full rebuild
 - **Restart with no re-read**: the persisted log revision (a header-line + stat via `sessionPersistence.listSnapshots()`) acts as a per-session change signal — sessions whose log is unchanged are applied from the ledger on restart without reading their events at all; only changed/new sessions are read incrementally
+- **Workspace registry sync**: follows DSH's `domain/changed` event so the workspace registry stays fresh automatically — any durable registry write (create/delete/rename/reorder/archive/membership) triggers a reread of `workspaceRegistry.list()`, with only added/removed workspaces reprocessed incrementally while unchanged workspaces reuse their computed aggregates and ledger (zero rescan). Usage is strictly limited to registered workspaces: unregistered cwds, including existing directories absent from the registry, are ignored.
 - **Data health and on-demand refresh**: after a scan completes, the browser polls only a lightweight status revision and fetches full history only after usage, alias, or sync state changes; it shows the latest full-data update, historical scan health, revision skips, rereads, ledger recovery, and failures while preserving last-good data on network errors
 - **Performance**: Host maintains ingest-time local/UTC day, workspace, model-identity cubes and single-day hour buckets; scope queries merge buckets, exact costs use BigInt decimal accumulators, and the 53-week heatmap emits only the fields it consumes, while revision-scoped snapshot/records caches and recyclable live-event queues remain in place. Client isolates the heatmap, tooltip, trend, donuts, request records, and pricing dialog behind memoized boundaries; pointer coordinates update through refs plus requestAnimationFrame instead of rerendering the page, and the browser entry is deterministically minified before packing
 - **Trend line chart**: show input, cache read/write, output, reasoning, and total processed tokens for the active range, timezone, workspace, provider, and model scope; use hourly buckets for a single-day scope and daily buckets for cross-day scopes, with smooth monotone curves, staged entrance animation, hover for exact values, and click a point to inspect that day
@@ -216,11 +230,12 @@ A full usage dashboard for DeepSeek Harness. Analyze tokens, cache behavior, est
 ### Compatibility and Known Limitations
 
 - **Runtime**: Node.js `>=22 <25` is required. CI runs the test suite, syntax checks, and package-content checks on Node 22 and Node 24.
-- **DSH compatibility**: `package.json` declares DSH runtime `>=0.1.1-rc.1 <0.1.2`; the real Cordis service chain is verified on `0.1.1-rc.2` and `0.1.1-rc.1`.
+- **DSH compatibility**: `package.json` declares DSH runtime `>=0.1.1-rc.1 <0.1.2`; the real Cordis service chain is verified on `0.1.1-rc.2` and `0.1.1-rc.1`. `0.1.2-rc.1` has also been verified compatible through the maintainer's real-world use, but is not yet covered by the CI smoke matrix.
 - **Web service dependency**: the Host declares `webServer` as a required dependency, so DSH waits for a late-mounted service before applying the plugin; this package targets the DSH Web profile and does not expose routes without WebServer. The HTTP guard also checks the actual socket peer, so a reverse proxy is accepted only when the connection itself is loopback.
 
 | DSH runtime | Node.js support | Real Cordis smoke | Conclusion |
 | --- | --- | --- | --- |
+| `0.1.2-rc.1` | `>=22 <25` | Passed through maintainer use (not in CI) | Verified compatible in real-world use |
 | `0.1.1-rc.2` | `>=22 <25`, CI covers 22/24 | Passed (current Node 24) | Declared and verified |
 | `0.1.1-rc.1` | `>=22 <25`, CI covers 22/24 | Passed (current Node 24) | Declared and verified |
 | Other versions | `>=22 <25` | Not tested | Outside the verified matrix |
@@ -230,7 +245,7 @@ An unlisted DSH version is not necessarily incompatible. Include the DSH, Node.j
 - **Interrupted requests**: an interrupted upstream request may emit only `assistant/chunk` usage and never produce a final `assistant/message`; that chunk is retained. A later final message for the same turn/step replaces it. If the upstream emits no usage event at all, exact token usage cannot be reconstructed from response text.
 - **Estimated cost**: cost is an estimate based on models.dev rates and DSH usage buckets, not a provider invoice. Unavailable catalogs and unmatched models remain unpriced instead of receiving guessed rates. Cache reads, cache writes, and reasoning follow the buckets reported by the upstream DSH event.
 - **Tiered prices**: models.dev context-tiered entries select the applicable rate from the request input context (fresh input plus cache read/write tokens); malformed schedules remain unsupported.
-- **History boundary**: only sessions whose cwd maps to a registered workspace are included; data deleted or corrupted before a successful session flush cannot be recovered from the separate ledger.
+- **Workspace boundary**: only sessions whose cwd maps to a DSH-registered workspace are included. Unregistered cwds, including existing directories absent from the registry, are ignored. The registry is kept fresh by a `domain/changed` probe: any durable workspace-domain write triggers a reread, and only added/removed workspaces are reprocessed incrementally — unchanged workspaces reuse their computed aggregates and ledger. Data deleted or corrupted before a successful session flush cannot be recovered from the separate ledger.
 
 ### Local Statistics vs Official Billing
 
@@ -239,7 +254,7 @@ This plugin reports replayable statistics from local DSH event logs; it is not a
 - Local statistics read DSH `assistant/chunk`, final `assistant/message`, and related session events, then deduplicate and replace samples by logical `turn / step`. Official billing may use a provider tokenizer, rounding rules, discounts, free quotas, and billing periods.
 - A failed request is included locally whenever it leaves a usage chunk; whether the provider charged for that failed request must be checked against the official bill.
 - Prices come from the public models.dev catalog and local explicit overrides. Catalog prices can differ from provider prices, regional rates, and invoice discounts, so the cost field is an estimate.
-- Local statistics include only sessions mapped to registered workspaces and can be lower than the official bill when logs are damaged, cleaned up, or the upstream emits no usage event.
+- Local statistics include registered workspaces only; unregistered cwds and old ledger rows for deleted directories are excluded, and totals can still be lower than the official bill when logs are damaged, cleaned up, or the upstream emits no usage event.
 
 ### Reproducible Event Examples
 
@@ -288,6 +303,17 @@ The command loads the real plugin Host, calls its compatible APIs, checks the do
 
 ### Latest Update
 
+**v1.1.5**
+
+- **Workspace registry probe**: all-usage follows DSH's workspace registry automatically through the `domain/changed` event; only added/removed workspaces are reprocessed incrementally while unchanged workspaces reuse their ledger with zero rescan. The manual Refresh workspaces control and its `POST /api/all-usage/workspaces/refresh` route were removed.
+- **Strict registration boundary**: only sessions whose cwd maps to a registered workspace are counted; unregistered directories (even existing ones) and legacy `unregistered:` ledger rows never re-enter statistics, and ledger rows for deleted directories are skipped on recovery (`sourceCwd` is now persisted with every ledger record so ownership can be validated after a restart).
+
+**v1.1.4**
+
+- **Vendor brand icons**: request logs, selected-call details, the model summary table, the cost-settings match table, donut legends, and the model filter dropdown now render real vendor brand SVGs (DeepSeek, OpenAI, Claude, Gemini, Meta, Zhipu, xAI, Qwen, Doubao, Kimi, MiniMax); the model namespace wins over the DSH provider name, and unknown or mixed-brand rows stay neutral. Icons are embedded as data URIs at build time and validated by scripts/svg-guard.mjs (entity decoding, CSS escapes/CDO/namespaced styles, url()/image-set() all covered, comments and text stay inert), with zero runtime network access.
+- **Build hardening**: per the independent audit, closed four bypass classes (CDO/CDC-adjacent at-import, namespaced style elements, CSS-escaped url(), external image-set()) and scoped the CSS checks to style attributes and bodies; adversarial fixtures now assert the rejection reason.
+- Refreshed the three usage-dashboard screenshots to the current UI.
+
 **v1.1.3**
 
 - Added validated context-tiered official pricing, expandable rate schedules, and explicit price overrides.

package/lib/ledger.js

@@ -9,6 +9,24 @@ const LEDGER_UNIT_NAME = 'all_usage_ledger'
 const LEDGER_META_KEY = '__all_usage_ledger_meta__'
 const LEDGER_WRITE_DEBOUNCE_MS = 25
 
+// DSH 0.1.5 replaced the Session `events` getter with `snapshotEvents()` while
+// 0.1.1 exposed `events`; both return the log in seq order. Read whichever the
+// running runtime provides, because falling back to an empty log would fold a
+// flushed session into an empty ledger record.
+function sessionEvents(session) {
+  if (session === null || session === undefined) return []
+  if (Array.isArray(session.events)) return session.events
+  if (typeof session.snapshotEvents === 'function') {
+    try {
+      const snapshot = session.snapshotEvents()
+      if (Array.isArray(snapshot)) return snapshot
+    } catch (error) {
+      return []
+    }
+  }
+  return []
+}
+
 // Ledger sequences follow the DSH contract: -1 marks a missing/unavailable
 // sequence, otherwise a non-negative safe integer is required.
 function validLedgerSeq(value) {
@@ -173,7 +191,7 @@ export function createLedger(host) {
   }
   function buildLedgerRecord(session, workspaceId, source = 'scan', revision, previousRecord, sequenceClean = true) {
     const sid = session && typeof session.id === 'string' ? session.id : ''
-    const events = session && Array.isArray(session.events) ? session.events : []
+    const events = sessionEvents(session)
     if (sid === '' || workspaceId === undefined) return null
     // DSH sequences every persisted event with seq === log index, so the last
     // event's seq is the record's lastSeq in O(1); fall back to a full scan only
@@ -238,7 +256,8 @@ export function createLedger(host) {
       }, { costPrevious: previousUsage.get(key) })
       if (result.accepted && usageEvent.kind === 'message') currentIdentity = identity
     }
-    return { version: LEDGER_VERSION, sessionId: sid, workspaceId, lastSeq, source, updatedAt: nextLedgerRevision(), lastRevision: typeof revision === 'string' ? revision : undefined, sourceRevision: typeof revision === 'string' ? revision : undefined, lastIdentity: currentIdentity, contextTimes: Array.from(contextTimes.entries()).map(([key, time]) => ({ key, time })), turns: Array.from(turns.values()), usage: Array.from(usage.values()) }
+    const sourceCwd = session && session.header && typeof session.header.cwd === 'string' ? session.header.cwd : undefined
+    return { version: LEDGER_VERSION, sessionId: sid, workspaceId, ...(sourceCwd === undefined ? {} : { sourceCwd }), lastSeq, source, updatedAt: nextLedgerRevision(), lastRevision: typeof revision === 'string' ? revision : undefined, sourceRevision: typeof revision === 'string' ? revision : undefined, lastIdentity: currentIdentity, contextTimes: Array.from(contextTimes.entries()).map(([key, time]) => ({ key, time })), turns: Array.from(turns.values()), usage: Array.from(usage.values()) }
   }
   function normalizeLedgerRecord(raw, key) {
     if (raw === null || typeof raw !== 'object' || (raw.version !== LEDGER_VERSION && raw.version !== PREVIOUS_LEDGER_VERSION && raw.version !== LEGACY_LEDGER_VERSION) || typeof raw.sessionId !== 'string' || raw.sessionId !== key) return null
@@ -279,7 +298,8 @@ export function createLedger(host) {
     }
     const lastUsage = Array.from(usageMap.values()).at(-1)
     const lastIdentity = coerceIdentity(raw.lastIdentity || raw.sourceRevisionIdentity || (lastUsage && lastUsage.identity))
-    const normalizedRecord = { version: LEDGER_VERSION, sessionId: raw.sessionId, workspaceId: raw.workspaceId, lastSeq: validLedgerSeq(raw.lastSeq) ? raw.lastSeq : -1, source: raw.source === 'flush' ? 'flush' : 'scan', updatedAt, lastRevision: typeof raw.lastRevision === 'string' ? raw.lastRevision : (typeof raw.sourceRevision === 'string' ? raw.sourceRevision : undefined), sourceRevision: typeof raw.sourceRevision === 'string' ? raw.sourceRevision : (typeof raw.lastRevision === 'string' ? raw.lastRevision : undefined), lastIdentity, contextTimes: Array.from(contextMap.entries()).map(([key, time]) => ({ key, time })), turns: Array.from(turnMap.values()), usage: Array.from(usageMap.values()) }
+    const sourceCwd = typeof raw.sourceCwd === 'string' && raw.sourceCwd.trim() !== '' ? raw.sourceCwd : undefined
+    const normalizedRecord = { version: LEDGER_VERSION, sessionId: raw.sessionId, workspaceId: raw.workspaceId, ...(sourceCwd === undefined ? {} : { sourceCwd }), lastSeq: validLedgerSeq(raw.lastSeq) ? raw.lastSeq : -1, source: raw.source === 'flush' ? 'flush' : 'scan', updatedAt, lastRevision: typeof raw.lastRevision === 'string' ? raw.lastRevision : (typeof raw.sourceRevision === 'string' ? raw.sourceRevision : undefined), sourceRevision: typeof raw.sourceRevision === 'string' ? raw.sourceRevision : (typeof raw.lastRevision === 'string' ? raw.lastRevision : undefined), lastIdentity, contextTimes: Array.from(contextMap.entries()).map(([key, time]) => ({ key, time })), turns: Array.from(turnMap.values()), usage: Array.from(usageMap.values()) }
     if (rebuildReason !== undefined) normalizedRecord.rebuildRequired = rebuildReason
     Object.defineProperty(normalizedRecord, 'needsUpgrade', { value: needsUpgrade, enumerable: false, writable: true })
     return normalizedRecord
@@ -474,6 +494,7 @@ export function createLedger(host) {
   return {
     nextLedgerRevision,
     ledgerEventKey,
+    sessionEvents,
     buildLedgerRecord,
     normalizeLedgerRecord,
     prepareLedgerRecord,

package/lib/plugin.js

@@ -100,6 +100,9 @@ function apply(ctx) {
     reconcilePending: false,
     reconcileInFlight: false,
     reconcileTimer: null,
+    workspaceSyncTimer: null,
+    workspaceSyncInFlight: false,
+    workspaceSyncPending: false,
   }
 
   const host = { ctx, services, state, webServer: services.webServer, aggregation: null, ledger: null, pricing: null, balance: null, sessionSync: null, aliases: null }

package/lib/session-sync.js

@@ -1,7 +1,8 @@
-import { contextTimeKey, extractUsageEvent, pickPricingTime, touchContextTimes } from './usage-core.js'
+import { contextTimeKey, extractUsageEvent, pickPricingTime, touchContextTimes, workspacePathKey } from './usage-core.js'
 
 const RECONCILE_INTERVAL_MS = 120000
 const RECONCILE_HINT_DELAY_MS = 3000
+const WORKSPACE_SYNC_DEBOUNCE_MS = 300
 
 export function createSessionSync(host) {
   const { ctx, state } = host
@@ -17,6 +18,7 @@ export function createSessionSync(host) {
   } = host.aggregation
   const { beginSync, noteSyncError, markStatsChanged } = host
   const {
+    sessionEvents,
     buildLedgerRecord,
     applyLedgerRecord,
     storeLedgerRecord,
@@ -107,13 +109,56 @@ export function createSessionSync(host) {
     state.ledgerDirtySessions.add(sid)
     state.ledgerDirtyEpochs.set(sid, (state.ledgerDirtyEpochs.get(sid) || 0) + 1)
   }
+  function buildWorkspaceSnapshot(workspaces) {
+    const wsMeta = new Map()
+    const pathIndex = new Map()
+    const memberOf = new Map()
+    for (const w of workspaces) {
+      const id = w && w.id
+      const path = w && typeof w.path === 'string' ? w.path : ''
+      const title = w && typeof w.title === 'string' ? w.title : ''
+      if (id === undefined) continue
+      wsMeta.set(id, { id, title, path })
+      if (path !== '') pathIndex.set(workspacePathKey(path), id)
+      if (w && Array.isArray(w.sessionIds)) {
+        for (const sid of w.sessionIds) memberOf.set(sid, id)
+      }
+    }
+    return { wsMeta, pathIndex, memberOf }
+  }
+  function installWorkspaceSnapshot(next) {
+    let metadataChanged = state.wsMeta.size !== next.wsMeta.size || state.pathIndex.size !== next.pathIndex.size || state.memberOf.size !== next.memberOf.size
+    if (!metadataChanged) {
+      for (const [id, value] of next.wsMeta) {
+        const previous = state.wsMeta.get(id)
+        if (previous === undefined || previous.title !== value.title || previous.path !== value.path) { metadataChanged = true; break }
+      }
+    }
+    if (!metadataChanged) {
+      for (const [path, id] of next.pathIndex) if (state.pathIndex.get(path) !== id) { metadataChanged = true; break }
+    }
+    if (!metadataChanged) {
+      for (const [sid, id] of next.memberOf) if (state.memberOf.get(sid) !== id) { metadataChanged = true; break }
+    }
+    state.wsMeta.clear()
+    state.pathIndex.clear()
+    state.memberOf.clear()
+    for (const [id, value] of next.wsMeta) state.wsMeta.set(id, value)
+    for (const [path, id] of next.pathIndex) state.pathIndex.set(path, id)
+    for (const [sid, id] of next.memberOf) state.memberOf.set(sid, id)
+    if (metadataChanged) markStatsChanged('metadata')
+    return metadataChanged
+  }
+  function workspaceForCwd(cwd) {
+    if (typeof cwd !== 'string' || cwd === '') return undefined
+    return state.pathIndex.get(workspacePathKey(cwd))
+  }
   function wsForLiveSession(session, sid) {
     let wsId = state.memberOf.get(sid)
     if (wsId !== undefined) return wsId
     const header = session && session.header
     const cwd = header && typeof header.cwd === 'string' ? header.cwd : ''
-    if (cwd === '') return undefined
-    wsId = state.pathIndex.get(cwd)
+    wsId = workspaceForCwd(cwd)
     if (wsId !== undefined) state.memberOf.set(sid, wsId)
     return wsId
   }
@@ -259,6 +304,81 @@ export function createSessionSync(host) {
       return undefined
     })
   }
+  function scanOneSession(sid, record, wsId, generation, snapshots) {
+    return enqueue(sid, async () => {
+      if (state.disposed || generation !== state.aggregationGeneration) return
+      try {
+        if (state.sessionSeq.has(sid) && !state.liveResyncPending.has(sid)) return
+        // v1.0.8: when the persisted log revision is unchanged since the last ledger
+        // write, the whole readSession (full event transfer) is skipped — the ledger
+        // record is applied directly and the live feed keeps catching new events.
+        const previousRecord = state.ledgerRecords.get(sid)
+        const revision = snapshots === null ? undefined : snapshots.get(sid)
+        if (!state.liveResyncPending.has(sid) && previousRecord !== undefined && previousRecord.needsUpgrade !== true && previousRecord.rebuildRequired === undefined && previousRecord.workspaceId === wsId && typeof previousRecord.lastRevision === 'string' && typeof revision === 'string' && revision === previousRecord.lastRevision) {
+          state.sync.sessionsSkippedByRevision += 1
+          applyLedgerRecord(previousRecord, 'ledger-reuse')
+          state.sessionSeq.set(sid, previousRecord.lastSeq)
+          state.sessionCount.add(sid)
+          markStatsChanged('scan')
+          return
+        }
+        state.sync.sessionsRead += 1
+        markStatsChanged('scan')
+        const snap = await ctx.sessionQuery.readSession(sid)
+        if (state.disposed || generation !== state.aggregationGeneration) return
+        if (snap && Array.isArray(snap.events)) {
+          // v1.0.7: incremental seed — the durable ledger doubles as a per-session
+          // cursor (cc-switch session_log_sync mtime+offset parity). An unchanged
+          // session applies its canonical record directly and never re-folds;
+          // a changed session seeds the previous record once, then folds only the
+          // new tail (previously every listed session was re-read and fully rebuilt).
+          const sequence = sequenceProfile(snap.events)
+          const currentLastSeq = sequence.lastSeq
+          const previous = state.ledgerRecords.get(sid)
+          const canFoldTail = previous !== undefined && previous.needsUpgrade !== true && previous.rebuildRequired === undefined && previous.workspaceId === wsId && !sequence.nonMonotonic && !sequence.hasInvalid && previous.lastSeq >= 0 && currentLastSeq > previous.lastSeq
+          if (canFoldTail) {
+            applyLedgerRecord(previous, 'ledger-reuse')
+            foldEvents(wsId, snap.events, previous.lastSeq, sid, 'scan')
+          } else {
+            // A changed revision with no new tail may still contain a replacement;
+            // rebuild from the complete read instead of trusting lastSeq alone.
+            foldEvents(wsId, snap.events, undefined, sid, 'scan')
+          }
+          const ledger = buildLedgerRecord({ id: sid, header: record.header, events: snap.events }, wsId, 'scan', revision, previous, !sequence.hasInvalid)
+          const canonical = ledger === null ? state.ledgerRecords.get(sid) : (canFoldTail ? storeLedgerRecord(ledger) : replaceLedgerRecord(ledger))
+          if (canonical === ledger) {
+            void persistLedgerRecord(ledger)
+          }
+          const observedLastSeq = state.sessionSeq.get(sid)
+          const nextLastSeq = Math.max(currentLastSeq, observedLastSeq === undefined ? -1 : observedLastSeq)
+          state.sessionSeq.set(sid, nextLastSeq)
+          state.sessionCount.add(sid)
+          if (observedLastSeq === undefined || observedLastSeq <= currentLastSeq) cancelLiveResync(sid)
+          else scheduleLiveResync(sid, wsId, generation)
+        }
+      } catch (err) {
+        if (generation !== state.aggregationGeneration) return
+        state.sync.sessionsFailed += 1
+        state.scan.failed += 1
+        noteSyncError('session-read-failed')
+        const saved = state.ledgerRecords.get(sid)
+        if (saved !== undefined) {
+          applyLedgerRecord(saved, 'ledger-recovery')
+          if (saved.turns.length > 0 || saved.usage.length > 0) state.sync.sessionsRestoredFromLedger += 1
+          state.sessionSeq.set(sid, -1)
+          state.sessionCount.add(sid)
+        } else {
+          state.sessionSeq.set(sid, -1)
+        }
+      } finally {
+        if (generation === state.aggregationGeneration) {
+          state.scan.scanned += 1
+          markStatsChanged('scan')
+        }
+      }
+    })
+  }
+
   async function runBaseline(generation = state.aggregationGeneration) {
     if (state.scan.started || state.disposed || generation !== state.aggregationGeneration) return
     state.scan.started = true
@@ -268,40 +388,7 @@ export function createSessionSync(host) {
     let setupFailed = false
     try {
       const workspaces = ctx.workspaceRegistry.list()
-      const nextWsMeta = new Map()
-      const nextPathIndex = new Map()
-      const nextMemberOf = new Map()
-      for (const w of workspaces) {
-        const id = w && w.id
-        const path = w && typeof w.path === 'string' ? w.path : ''
-        const title = w && typeof w.title === 'string' ? w.title : ''
-        if (id === undefined) continue
-        nextWsMeta.set(id, { id, title, path })
-        if (path !== '') nextPathIndex.set(path, id)
-        if (w && Array.isArray(w.sessionIds)) {
-          for (const sid of w.sessionIds) nextMemberOf.set(sid, id)
-        }
-      }
-      let metadataChanged = state.wsMeta.size !== nextWsMeta.size || state.pathIndex.size !== nextPathIndex.size || state.memberOf.size !== nextMemberOf.size
-      if (!metadataChanged) {
-        for (const [id, value] of nextWsMeta) {
-          const previous = state.wsMeta.get(id)
-          if (previous === undefined || previous.title !== value.title || previous.path !== value.path) { metadataChanged = true; break }
-        }
-      }
-      if (!metadataChanged) {
-        for (const [path, id] of nextPathIndex) if (state.pathIndex.get(path) !== id) { metadataChanged = true; break }
-      }
-      if (!metadataChanged) {
-        for (const [sid, id] of nextMemberOf) if (state.memberOf.get(sid) !== id) { metadataChanged = true; break }
-      }
-      state.wsMeta.clear()
-      state.pathIndex.clear()
-      state.memberOf.clear()
-      for (const [id, value] of nextWsMeta) state.wsMeta.set(id, value)
-      for (const [path, id] of nextPathIndex) state.pathIndex.set(path, id)
-      for (const [sid, id] of nextMemberOf) state.memberOf.set(sid, id)
-      if (metadataChanged) markStatsChanged('metadata')
+      installWorkspaceSnapshot(buildWorkspaceSnapshot(workspaces))
     } catch (err) {
       console.error('[all-usage] workspace list failed:', err)
       setupFailed = true
@@ -353,11 +440,18 @@ export function createSessionSync(host) {
       if (record === undefined || record === null || record.header === undefined) continue
       const sid = record.header.id
       const cwd = typeof record.header.cwd === 'string' ? record.header.cwd : ''
-      const wsId = cwd === '' ? undefined : state.pathIndex.get(cwd)
+      const wsId = workspaceForCwd(cwd)
       if (sid !== undefined && wsId !== undefined) listedSessionIds.add(sid)
     }
     for (const [sid, record] of state.ledgerRecords) {
       if (!listedSessionIds.has(sid)) {
+        // A ledger row from a deleted cwd is stale historical data, not an
+        // active workspace. Registered records remain recoverable; unknown
+        // records are recovered only while their source cwd still exists. Old
+        // synthetic rows predate sourceCwd persistence and cannot be validated,
+        // so they are fail-closed rather than resurrected after a restart.
+        if (record.sourceCwd !== undefined && workspaceForCwd(record.sourceCwd) === undefined) continue
+        if (typeof record.workspaceId === 'string' && record.workspaceId.startsWith('unregistered:')) continue
         applyLedgerRecord(record, 'ledger-recovery')
         if (record.turns.length > 0 || record.usage.length > 0) state.sync.sessionsRestoredFromLedger += 1
       }
@@ -372,85 +466,14 @@ export function createSessionSync(host) {
       }
       const sid = record.header.id
       const cwd = typeof record.header.cwd === 'string' ? record.header.cwd : ''
-      const wsId = cwd === '' ? undefined : state.pathIndex.get(cwd)
+      const wsId = workspaceForCwd(cwd)
       if (sid === undefined || wsId === undefined) {
         state.scan.scanned += 1
         markStatsChanged('scan')
         continue
       }
       listedSessionIds.add(sid)
-      await enqueue(sid, async () => {
-        if (state.disposed || generation !== state.aggregationGeneration) return
-        try {
-          if (state.sessionSeq.has(sid) && !state.liveResyncPending.has(sid)) return
-          // v1.0.8: when the persisted log revision is unchanged since the last ledger
-          // write, the whole readSession (full event transfer) is skipped — the ledger
-          // record is applied directly and the live feed keeps catching new events.
-          const previousRecord = state.ledgerRecords.get(sid)
-          const revision = snapshots === null ? undefined : snapshots.get(sid)
-          if (!state.liveResyncPending.has(sid) && previousRecord !== undefined && previousRecord.needsUpgrade !== true && previousRecord.rebuildRequired === undefined && previousRecord.workspaceId === wsId && typeof previousRecord.lastRevision === 'string' && typeof revision === 'string' && revision === previousRecord.lastRevision) {
-            state.sync.sessionsSkippedByRevision += 1
-            applyLedgerRecord(previousRecord, 'ledger-reuse')
-            state.sessionSeq.set(sid, previousRecord.lastSeq)
-            state.sessionCount.add(sid)
-            markStatsChanged('scan')
-            return
-          }
-          state.sync.sessionsRead += 1
-          markStatsChanged('scan')
-          const snap = await ctx.sessionQuery.readSession(sid)
-          if (state.disposed || generation !== state.aggregationGeneration) return
-          if (snap && Array.isArray(snap.events)) {
-            // v1.0.7: incremental seed — the durable ledger doubles as a per-session
-            // cursor (cc-switch session_log_sync mtime+offset parity). An unchanged
-            // session applies its canonical record directly and never re-folds;
-            // a changed session seeds the previous record once, then folds only the
-            // new tail (previously every listed session was re-read and fully rebuilt).
-            const sequence = sequenceProfile(snap.events)
-            const currentLastSeq = sequence.lastSeq
-            const previous = state.ledgerRecords.get(sid)
-            const canFoldTail = previous !== undefined && previous.needsUpgrade !== true && previous.rebuildRequired === undefined && previous.workspaceId === wsId && !sequence.nonMonotonic && !sequence.hasInvalid && previous.lastSeq >= 0 && currentLastSeq > previous.lastSeq
-            if (canFoldTail) {
-              applyLedgerRecord(previous, 'ledger-reuse')
-              foldEvents(wsId, snap.events, previous.lastSeq, sid, 'scan')
-            } else {
-              // A changed revision with no new tail may still contain a replacement;
-              // rebuild from the complete read instead of trusting lastSeq alone.
-              foldEvents(wsId, snap.events, undefined, sid, 'scan')
-            }
-            const ledger = buildLedgerRecord({ id: sid, header: record.header, events: snap.events }, wsId, 'scan', revision, previous, !sequence.hasInvalid)
-            const canonical = ledger === null ? state.ledgerRecords.get(sid) : (canFoldTail ? storeLedgerRecord(ledger) : replaceLedgerRecord(ledger))
-            if (canonical === ledger) {
-              void persistLedgerRecord(ledger)
-            }
-            const observedLastSeq = state.sessionSeq.get(sid)
-            const nextLastSeq = Math.max(currentLastSeq, observedLastSeq === undefined ? -1 : observedLastSeq)
-            state.sessionSeq.set(sid, nextLastSeq)
-            state.sessionCount.add(sid)
-            if (observedLastSeq === undefined || observedLastSeq <= currentLastSeq) cancelLiveResync(sid)
-            else scheduleLiveResync(sid, wsId, generation)
-          }
-        } catch (err) {
-          if (generation !== state.aggregationGeneration) return
-          state.sync.sessionsFailed += 1
-          state.scan.failed += 1
-          noteSyncError('session-read-failed')
-          const saved = state.ledgerRecords.get(sid)
-          if (saved !== undefined) {
-            applyLedgerRecord(saved, 'ledger-recovery')
-            if (saved.turns.length > 0 || saved.usage.length > 0) state.sync.sessionsRestoredFromLedger += 1
-            state.sessionSeq.set(sid, -1)
-            state.sessionCount.add(sid)
-          } else {
-            state.sessionSeq.set(sid, -1)
-          }
-        } finally {
-          if (generation === state.aggregationGeneration) {
-            state.scan.scanned += 1
-            markStatsChanged('scan')
-          }
-        }
-      })
+      await scanOneSession(sid, record, wsId, generation, snapshots)
       if (!(await safeContextTimeout(0))) {
         state.scan.started = false
         noteSyncError('baseline-yield-unavailable')
@@ -485,13 +508,132 @@ export function createSessionSync(host) {
     if (state.reconcilePending) scheduleReconcileHint()
   }
 
+  function scheduleWorkspaceSync() {
+    if (state.disposed) return
+    if (state.workspaceSyncTimer !== null) return
+    state.workspaceSyncTimer = setTimeout(() => {
+      state.workspaceSyncTimer = null
+      if (!state.disposed) void runWorkspaceSync()
+    }, WORKSPACE_SYNC_DEBOUNCE_MS)
+    if (state.workspaceSyncTimer && typeof state.workspaceSyncTimer.unref === 'function') state.workspaceSyncTimer.unref()
+  }
+  async function runWorkspaceSync() {
+    if (state.disposed) return
+    if (state.workspaceSyncInFlight) {
+      state.workspaceSyncPending = true
+      return
+    }
+    state.workspaceSyncInFlight = true
+    try {
+      await synchronizeWorkspaceRegistry()
+    } catch (err) {
+      console.error('[all-usage] workspace synchronize failed:', err)
+      noteSyncError('workspace-sync-failed')
+    } finally {
+      state.workspaceSyncInFlight = false
+      if (state.workspaceSyncPending) {
+        state.workspaceSyncPending = false
+        scheduleWorkspaceSync()
+      }
+    }
+  }
+  async function synchronizeWorkspaceRegistry() {
+    // The first baseline reads the registry with the latest list, so a probe
+    // arriving before it completes has nothing to add.
+    if (state.disposed || !state.scan.done) return
+    let workspaces
+    try {
+      workspaces = ctx.workspaceRegistry.list()
+    } catch (err) {
+      console.error('[all-usage] workspace list failed:', err)
+      noteSyncError('workspace-list-failed')
+      return
+    }
+    const next = buildWorkspaceSnapshot(workspaces)
+    const removedWs = new Set()
+    for (const id of state.wsMeta.keys()) if (!next.wsMeta.has(id)) removedWs.add(id)
+    const addedWs = new Set()
+    for (const id of next.wsMeta.keys()) if (!state.wsMeta.has(id)) addedWs.add(id)
+    // Reuse path: no membership change — metadata only, zero rescan.
+    if (removedWs.size === 0 && addedWs.size === 0) {
+      installWorkspaceSnapshot(next)
+      return
+    }
+    // Remove path: subtract every session that belonged to a deregistered workspace.
+    if (removedWs.size > 0) {
+      const removedSids = new Set()
+      for (const [sid, record] of state.ledgerRecords) {
+        if (record !== null && record !== undefined && typeof record.workspaceId === 'string' && removedWs.has(record.workspaceId)) removedSids.add(sid)
+      }
+      for (const [sid, id] of state.memberOf) if (removedWs.has(id)) removedSids.add(sid)
+      for (const sid of removedSids) {
+        if (typeof sid !== 'string' || sid === '') continue
+        host.aggregation.removeSession(sid)
+        state.ledgerRecords.delete(sid)
+        state.knownSessionIds.delete(sid)
+        state.sessionCount.delete(sid)
+        state.sessionSeq.delete(sid)
+        state.sessionModel.delete(sid)
+        state.sessionContextTimes.delete(sid)
+        state.memberOf.delete(sid)
+        state.liveResyncPending.delete(sid)
+        cancelLiveResync(sid)
+      }
+      for (const id of removedWs) {
+        state.perWorkspace.delete(id)
+        for (const day of state.byDay.values()) day.byWs.delete(id)
+        for (const day of state.byDayUtc.values()) day.byWs.delete(id)
+      }
+    }
+    installWorkspaceSnapshot(next)
+    // Add path: scan only the sessions that belong to newly registered workspaces.
+    if (addedWs.size === 0) return
+    let records = null
+    try {
+      records = await ctx.sessionQuery.listSessions()
+    } catch (err) {
+      console.error('[all-usage] session list failed:', err)
+      noteSyncError('session-list-failed')
+    }
+    if (!Array.isArray(records)) return
+    state.sync.sessionsTotal = records.length
+    markStatsChanged('scan')
+    let snapshots = null
+    if (sessionPersistence !== undefined && typeof sessionPersistence.listSnapshots === 'function') {
+      try {
+        const rows = await sessionPersistence.listSnapshots()
+        if (Array.isArray(rows)) {
+          snapshots = new Map()
+          for (const row of rows) {
+            const rid = row && row.header && typeof row.header.id === 'string' ? row.header.id : undefined
+            if (rid !== undefined && row && typeof row.revision === 'string') snapshots.set(rid, row.revision)
+          }
+        }
+      } catch (err) {
+        console.error('[all-usage] session persistence snapshots unavailable:', err)
+        markStatsChanged('scan')
+      }
+    }
+    for (const record of records) {
+      if (state.disposed) return
+      if (record === undefined || record === null || record.header === undefined) continue
+      const sid = record.header.id
+      const cwd = typeof record.header.cwd === 'string' ? record.header.cwd : ''
+      const wsId = workspaceForCwd(cwd)
+      if (sid === undefined || wsId === undefined) continue
+      if (!addedWs.has(wsId)) continue
+      state.knownSessionIds.add(sid)
+      scanOneSession(sid, record, wsId, state.aggregationGeneration, snapshots)
+    }
+  }
+
   function sessionIdsFromRecords(records) {
     const ids = new Set()
     for (const record of records) {
       if (record === undefined || record === null || record.header === undefined) continue
       const sid = record.header.id
       const cwd = typeof record.header.cwd === 'string' ? record.header.cwd : ''
-      const wsId = cwd === '' ? undefined : state.pathIndex.get(cwd)
+      const wsId = workspaceForCwd(cwd)
       if (sid !== undefined && wsId !== undefined) ids.add(sid)
     }
     return ids
@@ -569,7 +711,7 @@ export function createSessionSync(host) {
     if (state.disposed || session === null || typeof session !== 'object' || typeof session.id !== 'string') return
     const sid = session.id
     const previous = state.ledgerRecords.get(sid)
-    const eventList = Array.isArray(session.events) ? session.events : []
+    const eventList = sessionEvents(session)
     // DSH sequences events with seq === log index: the tail event gives the
     // latest sequence in O(1) without scanning a 500K-event session twice.
     const tailEvent = eventList.length > 0 ? eventList[eventList.length - 1] : null
@@ -616,6 +758,18 @@ export function createSessionSync(host) {
   ctx.on('session/disposed', () => {
     if (!state.disposed) scheduleReconcileHint()
   })
+  // Workspace registry probe: DSH emits domain/changed after every durable
+  // workspace-domain write (create/delete/rename/reorder/archive/attach/detach).
+  // On any such change we re-read workspaceRegistry.list() and, when membership
+  // changed, rescan only the affected workspaces — unchanged ones keep their
+  // computed aggregates and ledger untouched.
+  ctx.on('domain/changed', (change) => {
+    if (state.disposed) return
+    if (change === undefined || change === null) return
+    if (change.domain !== 'workspace') return
+    if (change.table !== 'workspaces' && change.table !== '') return
+    scheduleWorkspaceSync()
+  })
 
   return {
     foldEvent,
@@ -633,6 +787,8 @@ export function createSessionSync(host) {
     scheduleNativeBaselineRetry,
     scheduleBaselineRetry,
     runBaseline,
+    synchronizeWorkspaceRegistry,
+    scheduleWorkspaceSync,
     sessionIdsFromRecords,
     reconcileSessions,
     scheduleReconcileHint,

package/lib/usage-core.js

@@ -1,3 +1,10 @@
+/** Canonical comparison key for Windows workspace paths. */
+export function workspacePathKey(value) {
+  if (typeof value !== 'string') return ''
+  const normalized = value.trim().replaceAll('\\', '/').toLowerCase()
+  return normalized.length > 3 ? normalized.replace(/\/+$/, '') : normalized
+}
+
 const TOKEN_FIELDS = Object.freeze({
   input: 'inputTokens',
   output: 'outputTokens',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-all-usage",
-  "version": "1.1.4",
+  "version": "1.1.6",
   "description": "DeepSeek Harness usage dashboard with model, provider, workspace, cache, balance, and CSV insights",
   "repository": {
     "type": "git",
@@ -31,8 +31,8 @@
   },
   "dsh": {
     "compatibility": {
-      "runtime": ">=0.1.1-rc.1 <0.1.2",
-      "verified": ["0.1.1-rc.2", "0.1.1-rc.1"]
+      "runtime": ">=0.1.1-rc.1 <0.1.6",
+      "verified": ["0.1.5-rc.1", "0.1.1-rc.2", "0.1.1-rc.1"]
     },
     "bundle": {
       "patch": "./cordis.patch.yml"