dsh-cost-meter 1.8.10 → 1.8.11

package/README.md

@@ -8,9 +8,9 @@
 
 Per-conversation cost · daily totals · OpenCode Go subscription quota display · budget with usage percentage · official account balance · custom provider balance · balance progress bar · history · peak/off-peak pricing hours display (peak hours UTC 01:00–04:00, 06:00–10:00; weekends and Chinese public holidays are off-peak all day, with separate labels) · pre-switch popup & system-notification alerts for peak/off-peak changes (position / lead time / alert type configurable) · one-click price sync from the official docs · Codex-style token usage heat grid · multi-vendor model pricing (built-in 170+ model-ID catalog with auto-matching) · mainstream Coding Plan quota queries & display (Anthropic / Z.ai / MiniMax / Kimi / OpenRouter / SiliconFlow / CommandCode / SCNet / Volcano Ark / Qwen / Xiaomi MiMo) plan/API dual-track billing (subscription quota vs pay-as-you-go money separated, per-1% & full-window token/equivalent-cost estimates with daily/weekly/monthly curves) · · quota strip above the input box (budget / Go / coding-plan usage in one row, toggleable)
 
-[![version](https://img.shields.io/badge/version-1.8.10-4176E6)](https://github.com/Han-1413141/dsh-cost-meter)
+[![version](https://img.shields.io/badge/version-1.8.11-4176E6)](https://github.com/Han-1413141/dsh-cost-meter)
 
-**v1.8.10** aligns cumulative totals, conversation badges and rankings, including subagent spending. See the [release notes](docs/release-notes/v1.8.10.md).
+**v1.8.11** opens credential editors only on request and isolates them in their own forms. Includes sidebar-search recovery instructions for #232; the reporter's normal-browser trigger is awaiting confirmation. See the [release notes](docs/release-notes/v1.8.11.md).
 
 Desktop users: follow the [Desktop installation instructions](docs/install-troubleshooting.md#desktop-安装与更新) for the application's own CLI and `desktop` Profile.
 
@@ -320,22 +320,22 @@ On Node.js 20, use `npm install -g pnpm@10` instead. See [pnpm installation and
 dsh plugin --profile web add dsh-cost-meter
 ```
 
-**PowerShell one-click script** (copy the whole line, paste, press Enter; pnpm is provisioned automatically, git is auto-detected — no clone needed; the install chain is **pinned to the release tag `v1.8.10`** — review the script before running):
+**PowerShell one-click script** (copy the whole line, paste, press Enter; pnpm is provisioned automatically, git is auto-detected — no clone needed; the install chain is **pinned to the release tag `v1.8.11`** — review the script before running):
 
 ```powershell
-irm https://raw.githubusercontent.com/Han-1413141/dsh-cost-meter/v1.8.10/install.ps1 | iex
+irm https://raw.githubusercontent.com/Han-1413141/dsh-cost-meter/v1.8.11/install.ps1 | iex
 ```
 
 **Or a plain command line** (the machine must already have pnpm and git; also pinned to the tag):
 
 ```sh
-dsh plugin --profile web add github:Han-1413141/dsh-cost-meter#v1.8.10
+dsh plugin --profile web add github:Han-1413141/dsh-cost-meter#v1.8.11
 ```
 
 Without git, use the GitHub tag archive:
 
 ```sh
-dsh plugin --profile web add https://github.com/Han-1413141/dsh-cost-meter/archive/refs/tags/v1.8.10.tar.gz
+dsh plugin --profile web add https://github.com/Han-1413141/dsh-cost-meter/archive/refs/tags/v1.8.11.tar.gz
 ```
 
 After installing, **restart** `dsh web` (plugin rows, the Typert manifest and the client bundle are all scanned at startup):
@@ -493,6 +493,10 @@ dsh --profile web --port 3099                           # real startup (watch lo
 
 ## Known limitations
 
+For loading placeholders followed by “No matching sessions” after opening Cost,
+see [non-destructive sidebar search recovery](docs/session-sidebar-recovery.md).
+Check and clear the host search before changing stored data.
+
 - Official-page parsing depends on the current page structure; after a redesign, “Sync prices from official docs” fails — edit the price table manually as a fallback;
 - The session badge's fallback estimate (used when ledger data is unavailable) prices all of a session's calls at the tier of the *current* moment, including plan-type sessions: a session spanning peak and off-peak hours gets its off-peak portion overestimated during peak hours; exact figures come from the ledger (which bills each call at its own initiation moment);
 - Price sync overwrites the same-named models listed on the official page; custom model entries are unaffected;

package/README.zh-CN.md

@@ -8,9 +8,9 @@
 
 本会话费用 · 当日费用 · OpenCode Go 订阅额度显示 · 预算与已用百分比 · 官方账户余额 · 自定义 Provider 余额查询(可配任意 HTTP 端点) · 余额三段进度条 · 历史记录 · 峰谷计价时段显示(UTC 01:00–04:00、06:00–10:00 为峰时段;周末与中国法定假日全天按谷价,分别标注) · 峰/谷切换前弹窗与系统通知提醒(位置/提前量/提醒类型可配) · 官方价格一键同步 · 类 Codex Token 用量热图 · 多厂商多模型价格计费(内置 170+ 模型 ID 价格目录与自动匹配) · 主流 Coding Plan 额度查询与显示(Anthropic / Z.ai / MiniMax / Kimi / OpenRouter / SiliconFlow / CommandCode / SCNet / 火山方舟 / 千问 / 小米 MiMo 十一家,含 Volcano Ark AK/SK 签名与 MiMo 控制台 Cookie 查询) · Plan/API 双轨计费(订阅额度与按量金额分离统计,每 1% 额度与满窗的 token/等值金额估算及日/周/月曲线) · 输入框上方额度横条(预算/Go/Coding Plan 用量一条横排显示,可开关)
 
-[![version](https://img.shields.io/badge/version-1.8.10-4176E6)](https://github.com/Han-1413141/dsh-cost-meter)
+[![version](https://img.shields.io/badge/version-1.8.11-4176E6)](https://github.com/Han-1413141/dsh-cost-meter)
 
-**v1.8.10** 统一累计费用、会话徽章和对话排行，修复历史日总额与各对话费用相加不一致的问题，并统一子代理费用统计。详见[更新说明](docs/release-notes/v1.8.10.md)。
+**v1.8.11** 改为点击后才打开独立表单中的凭据编辑框，并提供 #232 的侧栏搜索恢复说明；报告者正常浏览器中的具体触发原因仍待确认。详见[更新说明](docs/release-notes/v1.8.11.md)。
 
 桌面端用户请按 [Desktop 安装说明](docs/install-troubleshooting.md#desktop-安装与更新)，使用应用自带的 CLI 和 `desktop` Profile。
 
@@ -320,22 +320,22 @@ Node.js 20 请改用 `npm install -g pnpm@10`。版本要求见 [pnpm 官方安
 dsh plugin --profile web add dsh-cost-meter
 ```
 
-**PowerShell 一键脚本**(复制整行粘贴回车;自动补齐 pnpm、自动探测 git,无需克隆仓库;安装链**固定到发布 tag `v1.8.10`**,建议先下载审阅再运行):
+**PowerShell 一键脚本**(复制整行粘贴回车;自动补齐 pnpm、自动探测 git,无需克隆仓库;安装链**固定到发布 tag `v1.8.11`**,建议先下载审阅再运行):
 
 ```powershell
-irm https://raw.githubusercontent.com/Han-1413141/dsh-cost-meter/v1.8.10/install.ps1 | iex
+irm https://raw.githubusercontent.com/Han-1413141/dsh-cost-meter/v1.8.11/install.ps1 | iex
 ```
 
 **或直接命令行**(机器上需已有 pnpm 与 git;同样固定到 tag):
 
 ```sh
-dsh plugin --profile web add github:Han-1413141/dsh-cost-meter#v1.8.10
+dsh plugin --profile web add github:Han-1413141/dsh-cost-meter#v1.8.11
 ```
 
 没有 git 时可用 GitHub tag 打包直链:
 
 ```sh
-dsh plugin --profile web add https://github.com/Han-1413141/dsh-cost-meter/archive/refs/tags/v1.8.10.tar.gz
+dsh plugin --profile web add https://github.com/Han-1413141/dsh-cost-meter/archive/refs/tags/v1.8.11.tar.gz
 ```
 
 安装后**重启** `dsh web`(插件行、Typert 清单与客户端 bundle 均在启动时扫描):
@@ -496,6 +496,10 @@ dsh --profile web --port 3099                           # 真机启动(观察启
 
 ## 已知限制
 
+打开费用设置后若侧栏出现加载占位条与「No matching sessions」，请先查看
+[无损侧栏搜索恢复说明](docs/session-sidebar-recovery.md)，检查宿主搜索内容，
+不要删除会话、账本或浏览器存储。
+
 - 历史按模型回填依赖宿主会话日志仍在盘:日志已被清理的早期调用无法逐模型重建,只能以「未分模型」残差行计入当日合计;
 - 官方页面解析依赖当前页面结构;改版后「从官方文档同步价格」会报错,可手动编辑价格表兜底;
 - 会话徽章在账本数据不可用时的回退估算按「当前时刻」的价格档位给该会话全部调用定价(含 Plan 类会话):跨峰谷时段的会话在峰时会高估其谷时部分,精确费用以账本为准(账本按每次调用的发起时刻逐笔计价);

package/docs/session-sidebar-recovery.md

@@ -0,0 +1,93 @@
+# Sidebar search recovery / 侧栏搜索恢复
+
+## English
+
+If Settings → Cost is followed by loading placeholders and “No matching
+sessions”, first check the sidebar search. **Do not delete sessions, reset cost
+history, remove the workspace database, or clear browser storage.**
+
+1. Close Settings, click the magnifying glass (“Search sessions”), and inspect
+   the revealed query. If it is unexpected, use “Clear search”, or press Escape
+   while that input has focus. Do not post the query if it contains private data.
+2. Check that the original workspaces return. For [issue #232](https://github.com/Han-1413141/dsh-cost-meter/issues/232),
+   the expected count is 18. Open a known conversation and check an existing
+   message, without sending a new model request.
+3. If needed, reload the page. This recreates the host’s local search state;
+   it does not require resetting stored conversations or billing history.
+4. If it still fails, record the browser version, other DSH plugin package
+   names/versions/configuration, password-manager/autofill extensions, whether
+   the revealed search was nonempty, and any failed session-search request or
+   console error. Redact keys, tokens, account data and private conversation text.
+5. Compare one change at a time in the same browser, with the search cleared:
+   password-manager/autofill extension enabled vs disabled, then theme glass
+   enabled vs disabled. A fresh browser alone changes too many variables to
+   identify a conflicting plugin. Keep the original data and configuration.
+
+### What the evidence establishes
+
+The reported DSH 0.1.7-rc.2
+[WorkspaceBrowser](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.7-rc.2/packages/client/ui-workspace/src/client/rows/WorkspaceBrowser.tsx)
+selects `SearchResults` only for a nonempty query. That branch renders the exact
+two-row skeleton and “No matching sessions” text in the screenshots. A failed
+content-search request can show the same empty text as a successful search with
+zero matches. These screenshots do not establish that sessions were deleted.
+
+The search input remains mounted while collapsed. Published Cost Overview in
+both 1.8.6 and 1.8.10 eagerly mounts an unowned password input. A saved-login filler may
+pair that password with the preceding text input, which can be the host search.
+Chromium’s [security FAQ](https://github.com/chromium/chromium/blob/main/docs/security/faq.md)
+explains why `autocomplete=off` is insufficient for password fields. This is a
+source-supported hypothesis, **not confirmation of the reporter’s browser trigger**.
+
+The defensive change mounts a credential editor only after “Edit credential”,
+uses its own form and `new-password` hint, and removes the secret draft on Cancel,
+successful Save or Clear. It never clears or changes the host’s search, session
+store, workspace view preferences or ledger. Existing affected tabs still need
+the host’s normal search-clear action, or a page reload.
+
+Pinned [Catppuccin 0.5.8 source](https://github.com/NoNameLeGo/dsh-catppuccin-theme/tree/7544bc422609c0f2fae218565172d12dcf72adce)
+changes material/geometry and stamps its own DOM attributes; inspection found no
+session/search mutation or global input handler. That does not exclude a visual
+interaction, but it does not justify blaming the theme for an empty search result.
+
+### Verification boundary
+
+- `test/sidebar-search-recovery.mjs` executes published host search components
+  with deterministic VM hooks. It restores 18 synthetic workspaces and checks
+  original message files, workspace preferences and a 78,000-call ledger remain
+  unchanged. Slow, failed, aborted and late replies, intentional searches and
+  remount recovery are covered on DSH 0.1.7-rc.2 and 0.2.0-rc.2
+- `test/credential-editor-dom.mjs --baseline v1.8.6` uses real React and jsdom.
+  An explicitly modeled saved-login pairing reproduces the old unowned-input
+  mechanism; the fixed mount and scoped editor avoid that model. Edit, focus,
+  Cancel, Save/Clear concurrency, failure/retry and disabled controls are covered
+- Generated dictionary packing round-trips all 527 Chinese and 527 English
+  translations; no UI wording is dropped to meet the 262,144-byte bundle limit
+- Native Chromium launch and cloud-browser loopback access were unavailable in
+  this execution environment. No native password-manager or reporter-profile
+  end-to-end reproduction is claimed. Keep #232 open until the normal-tab
+  recovery and upgrade checks are confirmed
+
+## 中文
+
+出现「加载占位条 → No matching sessions」时，先关闭设置，点击侧栏放大镜，查看
+是否存在意外的搜索内容。使用宿主的「清除搜索」按钮，或在搜索框获得焦点后按
+Escape。然后检查原工作区是否恢复，并打开一个已知对话核对原消息；#232 报告中
+应有 18 个工作区。必要时刷新页面，**不要删除会话、清空费用历史、删除工作区
+数据库或清空浏览器存储**。
+
+宿主的非空搜索分支会显示截图中的占位条和空结果提示；搜索请求失败也可能显示
+相同提示，因此不能由截图推断会话已删除。费用概览中的密码框与宿主隐藏搜索框
+被自动填充配对，是有源码依据、尚待用户正常浏览器确认的假说。此修订仅在明确
+点击「编辑凭据」后挂载独立表单中的密码框，取消、成功保存或清除后移除并清空
+草稿，不改动宿主搜索、会话、工作区偏好或账本。
+
+如果仍异常，请补充浏览器版本、其他 DSH 插件的完整包名/版本/相关配置、密码
+管理器和自动填充扩展，以及同一浏览器中逐项启停扩展、启停 glass 的对照结果。
+截图和日志需脱敏，不要公开凭据、搜索中的私人信息或原对话内容。静态检查未
+发现 Catppuccin 0.5.8 修改搜索或会话状态的行为，不能据此认定主题是原因。
+
+回归覆盖真实宿主组件回调、18 个合成工作区、原消息文件与 78,000 次调用账本的
+完整性，以及真实 React/DOM 凭据编辑流程；自动填充测试明确使用模拟配对规则。
+尚未在报告者的浏览器或原生密码管理器中完成端到端验证，需其确认恢复与升级
+结果后再关闭问题。