dsh-token-use 0.2.2 → 0.3.0

package/cordis.patch.yml

@@ -12,3 +12,8 @@
           enabled: true
           currency: CNY
           refreshHour: 12
+        # Version checks for the configuration tab read npm's packument every six
+        # hours; point `registry` at a mirror on a slow or blocked network.
+        versions:
+          registry: https://registry.npmjs.org
+          ttlMs: 21600000

package/lib/health.js

@@ -0,0 +1,277 @@
+/**
+ * Harness self-check: the failure modes a plugin install can leave behind.
+ *
+ * A broken profile rarely announces itself — the service starts, the panel
+ * loads, and one plugin is silently missing (its entry file never shipped, its
+ * bundle patch is gone, or two copies of cordis fight over the same hooks).
+ * This module walks the running profile on disk, so the panel can say which
+ * plugin is incomplete and why. What the *browser* can actually load is checked
+ * on the client side, where the boot manifest lives.
+ *
+ * The report is data, not prose: rows carry a `code`/`hint` the client
+ * translates, and `detail` holds only language-neutral facts (paths, versions).
+ *
+ * Everything here is read-only, and every probe is wrapped: a check that cannot
+ * run reports `unknown` rather than breaking the report.
+ *
+ * @module dsh-token-use/health
+ */
+import { existsSync, readFileSync, readdirSync, realpathSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { compareVersions, installedVersion } from './versions.js'
+
+/** A plugin's `dsh` block, tolerant of a missing or oddly shaped one. */
+function dshBlock(pkg) {
+  const block = pkg?.dsh
+  return block !== null && typeof block === 'object' ? block : {}
+}
+
+/** Worst-first status across rows. */
+function worst(items, fallback = 'ok') {
+  if (items.length === 0) return fallback
+  if (items.some((item) => item.status === 'error')) return 'error'
+  if (items.some((item) => item.status === 'warn')) return 'warn'
+  if (items.every((item) => item.status === 'unknown')) return 'unknown'
+  return 'ok'
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(readFileSync(file, 'utf8'))
+  } catch {
+    return undefined
+  }
+}
+
+/** The profile whose dependency list names this plugin. */
+export function findProfile(dshHome, name) {
+  const root = join(dshHome, 'profiles')
+  let entries
+  try {
+    entries = readdirSync(root)
+  } catch {
+    return undefined
+  }
+  for (const entry of entries) {
+    const dir = join(root, entry)
+    const pkg = readJson(join(dir, 'package.json'))
+    if (pkg === undefined) continue
+    const deps = Object.keys(pkg.dependencies ?? {})
+    const bundles = dshBlock(pkg).profile?.bundles ?? []
+    if (deps.includes(name) || bundles.includes(name)) return { name: entry, dir, pkg }
+  }
+  return undefined
+}
+
+/** One installed package inside the profile, symlinks resolved. */
+function packageIn(profile, name) {
+  const link = join(profile.dir, 'node_modules', name)
+  const pkg = readJson(join(link, 'package.json'))
+  if (pkg === undefined) return undefined
+  let dir = link
+  try {
+    dir = realpathSync(link)
+  } catch {
+    // keep the un-resolved path: it exists, we just cannot canonicalise it
+  }
+  return { dir, pkg, linked: dir !== link }
+}
+
+/** The file a loader resolves for a subpath such as `.` or `./client`. */
+function subpathEntry(dir, pkg, subpath) {
+  const exports = pkg.exports
+  const direct = typeof exports === 'string' && subpath === '.' ? exports : undefined
+  const field = typeof exports === 'object' && exports !== null ? exports[subpath] : undefined
+  const rel = direct
+    ?? (typeof field === 'string' ? field : field?.default)
+    ?? (subpath === '.' ? pkg.main : undefined)
+  if (typeof rel !== 'string' || rel.length === 0) return undefined
+  return join(dir, rel)
+}
+
+/** Every `@deepseek-ai/cordis` copy reachable from `fromDir`, with its version. */
+function cordisFrom(fromDir) {
+  let dir = fromDir
+  for (let i = 0; i < 12; i++) {
+    const file = join(dir, 'node_modules', '@deepseek-ai', 'cordis', 'package.json')
+    if (existsSync(file)) {
+      const pkg = readJson(file)
+      let real = file
+      try {
+        real = realpathSync(file)
+      } catch {
+        // keep the unresolved path
+      }
+      return { real, version: typeof pkg?.version === 'string' ? pkg.version : 'unknown' }
+    }
+    const parent = dirname(dir)
+    if (parent === dir) break
+    dir = parent
+  }
+  return undefined
+}
+
+/**
+ * Walk the profile that runs this plugin and report every plugin-level problem
+ * that could keep it out of the running service.
+ *
+ * @param options - `dshHome`, the plugin `name` and the running `commandVersion`.
+ * @returns `{ ok, profile, checks }` — checks group per-plugin rows.
+ */
+export function checkHarness({ dshHome, name, commandVersion }) {
+  const checks = []
+  const profile = findProfile(dshHome, name)
+  if (profile === undefined) {
+    return {
+      ok: false,
+      profile: null,
+      // The summary already names the searched root, so no hint is needed here.
+      checks: [{ id: 'profile', status: 'error', hint: null, data: { root: join(dshHome, 'profiles') }, items: [] }],
+    }
+  }
+
+  const integrity = []
+  const nodeModules = join(profile.dir, 'node_modules')
+  const hasModules = existsSync(nodeModules)
+  integrity.push({
+    name: 'node_modules',
+    status: hasModules ? 'ok' : 'error',
+    code: hasModules ? null : 'modules-missing',
+    detail: nodeModules,
+    hint: hasModules ? null : 'install',
+  })
+  for (const lock of ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock']) {
+    if (existsSync(join(profile.dir, lock))) integrity.push({ name: lock, status: 'ok', code: null, detail: lock })
+  }
+  const bundles = dshBlock(profile.pkg).profile?.bundles ?? []
+  integrity.push({
+    name: 'bundles',
+    status: bundles.length > 0 ? 'ok' : 'warn',
+    code: bundles.length > 0 ? null : 'bundles-empty',
+    detail: String(bundles.length),
+    hint: bundles.length > 0 ? null : 'bundles-empty',
+  })
+  checks.push({
+    id: 'profile',
+    status: worst(integrity),
+    data: { name: profile.name, dir: profile.dir },
+    items: integrity,
+  })
+
+  // Per-plugin files on disk. Harness bundles (@deepseek-ai/…) are supplied by
+  // the service package rather than the profile, so they are not files to check.
+  const items = []
+  const cordisCopies = new Map()
+  const rememberCordis = (label, fromDir) => {
+    const found = cordisFrom(fromDir)
+    if (found === undefined) return
+    if (!cordisCopies.has(found.real)) cordisCopies.set(found.real, { version: found.version, owners: [] })
+    cordisCopies.get(found.real).owners.push(label)
+  }
+
+  for (const bundle of bundles) {
+    const found = packageIn(profile, bundle)
+    if (found === undefined) {
+      items.push(bundle.startsWith('@deepseek-ai/')
+        ? { name: bundle, client: false, status: 'ok', code: 'provided', detail: '', hint: null }
+        : { name: bundle, client: false, status: 'error', code: 'not-installed', detail: '', hint: 'add' })
+      continue
+    }
+    const problems = []
+    const entry = subpathEntry(found.dir, found.pkg, '.')
+    if (entry === undefined) problems.push({ code: 'entry-undeclared', detail: '', status: 'warn' })
+    else if (!existsSync(entry)) problems.push({ code: 'entry-missing', detail: entry, status: 'error' })
+
+    const patch = dshBlock(found.pkg).bundle?.patch
+    if (typeof patch === 'string' && !existsSync(join(found.dir, patch))) {
+      problems.push({ code: 'patch-missing', detail: patch, status: 'error' })
+    }
+
+    const declaresClient = dshBlock(found.pkg).client !== undefined
+    if (declaresClient) {
+      const clientFile = subpathEntry(found.dir, found.pkg, './client')
+      if (clientFile === undefined) problems.push({ code: 'client-undeclared', detail: '', status: 'warn' })
+      else if (!existsSync(clientFile)) problems.push({ code: 'client-missing', detail: clientFile, status: 'error' })
+    }
+    rememberCordis(bundle, found.dir)
+    items.push({
+      name: bundle,
+      client: declaresClient,
+      version: found.pkg.version,
+      status: worst(problems.map((problem) => ({ status: problem.status }))),
+      code: problems.length === 0 ? null : problems.map((problem) => problem.code).join('+'),
+      detail: problems.length === 0
+        ? `v${found.pkg.version}${found.linked ? ' (linked)' : ''}`
+        : problems.map((problem) => problem.detail).filter((text) => text.length > 0).join('; '),
+      hint: problems.length === 0 ? null : 'reinstall',
+    })
+  }
+  checks.push({
+    id: 'plugins',
+    status: worst(items),
+    data: { total: items.length, ok: items.filter((item) => item.status === 'ok').length },
+    items,
+  })
+
+  const deps = Object.entries(profile.pkg.dependencies ?? {}).map(([dep, range]) => {
+    const found = packageIn(profile, dep)
+    if (found === undefined) {
+      return { name: dep, status: 'error', code: 'not-installed', detail: String(range), hint: 'install' }
+    }
+    return { name: dep, status: 'ok', code: null, detail: `v${found.pkg.version}${found.linked ? ' (linked)' : ''}` }
+  })
+  checks.push({ id: 'deps', status: worst(deps), data: { count: deps.length }, items: deps })
+
+  rememberCordis(profile.name, profile.dir)
+  const cordisItems = [...cordisCopies.entries()].map(([file, record]) => ({
+    name: record.owners.length === 2 && record.owners[0] === profile.name ? record.owners[1] : record.owners.join(', '),
+    status: 'ok',
+    code: null,
+    detail: `v${record.version} · ${dirname(dirname(file))}`,
+  }))
+  const cordisVersions = [...new Set([...cordisCopies.values()].map((record) => record.version))]
+  const cordisStatus = cordisVersions.length > 1 ? 'error' : cordisCopies.size > 1 ? 'warn' : 'ok'
+  checks.push({
+    id: 'cordis',
+    status: cordisStatus,
+    data: { copies: cordisCopies.size, versions: cordisVersions.length },
+    items: cordisItems,
+    hint: cordisStatus === 'ok' ? null : (cordisVersions.length > 1 ? 'cordis-mixed' : 'cordis-duplicate'),
+  })
+
+  const harness = ['@deepseek-ai/dsh-base', '@deepseek-ai/dsh-web-app']
+  const versionItems = harness.map((dep) => {
+    const installed = installedVersion(dep)
+    if (installed === undefined) return { name: dep, status: 'warn', code: 'unresolved', detail: '', hint: null }
+    const same = typeof commandVersion !== 'string' || commandVersion.length === 0 || compareVersions(installed, commandVersion) === 0
+    return {
+      name: dep,
+      status: same ? 'ok' : 'warn',
+      code: same ? null : 'service-mismatch',
+      detail: `v${installed}`,
+      hint: same ? null : 'service-version',
+    }
+  })
+  const own = installedVersion(name)
+  versionItems.push({
+    name,
+    status: own === undefined ? 'warn' : 'ok',
+    code: own === undefined ? 'unresolved' : null,
+    detail: own === undefined ? '' : `v${own}`,
+  })
+  const versionHint = worst(versionItems) === 'ok' ? null : 'service-version'
+  checks.push({
+    id: 'versions',
+    status: worst(versionItems),
+    data: { commandVersion: typeof commandVersion === 'string' ? commandVersion : null },
+    items: versionItems,
+    hint: versionHint,
+  })
+
+  return {
+    // `ok` means "nothing broken": a warning is information, not a failure.
+    ok: checks.every((check) => check.status !== 'error'),
+    profile: { name: profile.name, dir: profile.dir },
+    checks,
+  }
+}

package/lib/index.js

@@ -11,8 +11,9 @@
  * `pricing.js`), so each bucket carries an estimated amount alongside tokens.
  *
  * Queries: `GET /dsh-token-use` returns all-time buckets;
- * `?day=YYYY-MM-DD` and `?month=YYYY-MM` return the matching window,
- * aggregated in memory from per-day buckets (no rescan, no disk).
+ * `?day=YYYY-MM-DD`, `?month=YYYY-MM`, `?year=YYYY` and
+ * `?from=YYYY-MM-DD&to=YYYY-MM-DD` return the matching window, aggregated in
+ * memory from per-day buckets (no rescan, no disk).
  *
  * @module dsh-token-use
  */
@@ -23,6 +24,8 @@ import { join } from 'node:path'
 import { zstdDecompressSync } from 'node:zlib'
 import { scheduler } from 'node:timers/promises'
 import { PricingStore } from './pricing.js'
+import { VersionStore, installedVersion, restartScript, scheduleRestart } from './versions.js'
+import { checkHarness } from './health.js'
 
 export const name = 'dsh-token-use'
 
@@ -40,11 +43,11 @@ const USAGE_FIELDS = [
 const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
 
 /**
- * Days of per-day buckets the snapshot carries for the trend chart. The client
- * slices this down to its 7/30/90-day range switcher, so the widest range is
- * served without another round trip.
+ * Days of per-day buckets the snapshot carries. The client slices this down to
+ * its 7/30/90-day trend switcher and draws the 12-month heatmap from the same
+ * series, so neither needs a second round trip.
  */
-const TREND_DAYS = 90
+const TREND_DAYS = 366
 
 /**
  * Auxiliary LLM calls that DeepSeek bills but that persist no `usage` record:
@@ -83,6 +86,7 @@ function pickSessionLog(entries) {
 const ZSTD_MAGIC = 4247762216
 const DAY_RE = /^\d{4}-\d{2}-\d{2}$/
 const MONTH_RE = /^\d{4}-\d{2}$/
+const YEAR_RE = /^\d{4}$/
 
 function resolveDshHome(env = process.env) {
   const explicit = env.DSH_HOME
@@ -251,6 +255,7 @@ export class UsageTracker {
   constructor(dshHome = resolveDshHome(), options = {}) {
     this.dshHome = dshHome
     this.allowRemote = options.allowRemote === true
+    this.endpoint = typeof options.endpoint === 'string' && options.endpoint.length > 0 ? options.endpoint : '/dsh-token-use'
     this.pricing = options.pricing ?? new PricingStore(dshHome, options.pricingOptions ?? {})
     this.startedAt = Date.now()
     this.totals = emptyBucket()
@@ -619,6 +624,16 @@ export class UsageTracker {
     return [...this.byModel.keys()].sort()
   }
 
+  /**
+   * Years that own at least one day bucket, oldest first: the year picker lists
+   * these instead of asking for a free-text year that may hold no data.
+   */
+  years() {
+    const years = new Set()
+    for (const day of this.byDay.keys()) years.add(day.slice(0, 4))
+    return [...years].sort()
+  }
+
   /**
    * Materialize totals/breakdowns for the optional window + model filter.
    * Filtering only re-aggregates existing per-day buckets — no rescan, no disk.
@@ -646,7 +661,10 @@ export class UsageTracker {
     const allDays = [...new Set([...this.byDay.keys(), ...this.dayAuxiliary.keys()])].sort()
     const days = filter.kind === 'all'
       ? allDays
-      : allDays.filter((day) => (filter.kind === 'day' ? day === filter.value : day.startsWith(filter.value)))
+      : filter.kind === 'range'
+        ? allDays.filter((day) => day >= filter.from && day <= filter.to)
+        // day is an exact match; month (YYYY-MM) and year (YYYY) are prefixes.
+        : allDays.filter((day) => (filter.kind === 'day' ? day === filter.value : day.startsWith(filter.value)))
     const totals = emptyBucket()
     const models = new Map()
     const projects = new Map()
@@ -668,7 +686,7 @@ export class UsageTracker {
     const lastDataDay = days.length > 0 ? days[days.length - 1] : undefined
     const trendEnd = filter.kind === 'day'
       ? filter.value
-      : (lastDataDay ?? localDay(Date.now()))
+      : (lastDataDay ?? (filter.kind === 'range' ? filter.to : localDay(Date.now())))
     const trendStart = shiftDay(trendEnd, -(TREND_DAYS - 1))
     for (let day = trendStart; day <= trendEnd; day = shiftDay(day, 1)) {
       const bucket = model === undefined ? this.byDay.get(day) : this.dayModel.get(day)?.get(model)
@@ -704,8 +722,15 @@ export class UsageTracker {
       startedAt: this.startedAt,
       updatedAt: now,
       dshHome: this.dshHome,
-      filter: filter === null ? null : { kind: filter.kind, value: filter.value ?? null, model: filter.model ?? null },
+      filter: filter === null ? null : {
+        kind: filter.kind,
+        value: filter.value ?? null,
+        from: filter.from ?? null,
+        to: filter.to ?? null,
+        model: filter.model ?? null,
+      },
       models: this.models(),
+      years: this.years(),
       modelPricing,
       pricing: this.pricing.describe(now),
       auxiliary: view.auxiliary,
@@ -722,6 +747,122 @@ export class UsageTracker {
     }
   }
 
+  /** Loopback, or a same-origin request when `allowRemote` was opted into. */
+  trusted(req) {
+    if (LOOPBACK.has(req.socket?.remoteAddress)) return true
+    const origin = req.headers.origin
+    const sameOrigin = req.headers['sec-fetch-site'] === 'same-origin'
+      && typeof origin === 'string'
+      && typeof req.headers.host === 'string'
+    let trusted = false
+    if (sameOrigin) {
+      try {
+        trusted = new URL(origin).host === req.headers.host
+      } catch {
+        trusted = false
+      }
+    }
+    return this.allowRemote && trusted
+  }
+
+  deny(res) {
+    res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: false, error: 'loopback only; set allowRemote for trusted same-origin access' }))
+  }
+
+  /**
+   * Config tab payload: installed vs latest versions for the harness packages,
+   * the runtime facts, and the restart capability of this launch command.
+   */
+  async handleConfig(req, res, versions) {
+    res.setHeader('cache-control', 'no-store')
+    if (req.method !== 'GET') {
+      res.writeHead(405, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: 'method not allowed' }))
+      return
+    }
+    if (!this.trusted(req)) {
+      this.deny(res)
+      return
+    }
+    const host = req.headers.host
+    const port = typeof host === 'string' && host.includes(':') ? host.slice(host.lastIndexOf(':') + 1) : null
+    // `?refresh=1` is the panel's re-check button: it skips the six-hour cache.
+    const force = new URL(req.url, 'http://localhost').searchParams.get('refresh') === '1'
+    const report = await versions.describe({ port, dshHome: this.dshHome, force })
+    const planned = restartScript({ pid: process.pid, argv: process.argv, cwd: process.cwd(), logFile: 'probe' })
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({
+      ok: true,
+      name,
+      version: VERSION,
+      endpoint: this.endpoint,
+      restartable: planned !== undefined,
+      ...report,
+    }))
+  }
+
+  /**
+   * Harness self-check: what the browser would load, plugin by plugin, plus the
+   * profile's own integrity — the failures that leave a plugin installed but
+   * never running.
+   */
+  async handleHealth(req, res) {
+    res.setHeader('cache-control', 'no-store')
+    if (req.method !== 'GET') {
+      res.writeHead(405, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: 'method not allowed' }))
+      return
+    }
+    if (!this.trusted(req)) {
+      this.deny(res)
+      return
+    }
+    const host = req.headers.host
+    const port = typeof host === 'string' && host.includes(':') ? host.slice(host.lastIndexOf(':') + 1) : null
+    let report
+    try {
+      report = checkHarness({
+        dshHome: this.dshHome,
+        name,
+        commandVersion: installedVersion('@deepseek-ai/dsh'),
+      })
+    } catch (error) {
+      res.writeHead(500, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: String(error?.message ?? error) }))
+      return
+    }
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: true, ...report }))
+  }
+
+  /** One-click restart: schedule the detached script and answer immediately. */
+  handleRestart(req, res) {
+    res.setHeader('cache-control', 'no-store')
+    if (req.method !== 'POST') {
+      res.writeHead(405, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: 'method not allowed' }))
+      return
+    }
+    if (!this.trusted(req)) {
+      this.deny(res)
+      return
+    }
+    const scheduled = scheduleRestart(this.dshHome)
+    if (scheduled === undefined) {
+      res.writeHead(409, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: 'this launch command cannot be restarted automatically' }))
+      return
+    }
+    if (scheduled.error !== undefined) {
+      res.writeHead(500, { 'content-type': 'application/json; charset=utf-8' })
+      res.end(JSON.stringify({ ok: false, error: scheduled.error }))
+      return
+    }
+    res.writeHead(200, { 'content-type': 'application/json; charset=utf-8' })
+    res.end(JSON.stringify({ ok: true, delaySec: 2, logFile: scheduled.logFile, script: scheduled.script }))
+  }
+
   handle(req, res) {
     res.setHeader('cache-control', 'no-store')
     if (req.method !== 'GET') {
@@ -729,50 +870,59 @@ export class UsageTracker {
       res.end(JSON.stringify({ ok: false, error: 'method not allowed' }))
       return
     }
-    if (!LOOPBACK.has(req.socket?.remoteAddress)) {
-      const origin = req.headers.origin
-      const sameOrigin = req.headers['sec-fetch-site'] === 'same-origin'
-        && typeof origin === 'string'
-        && typeof req.headers.host === 'string'
-      let trusted = false
-      if (sameOrigin) {
-        try {
-          trusted = new URL(origin).host === req.headers.host
-        } catch {
-          trusted = false
-        }
-      }
-      if (!(this.allowRemote && trusted)) {
-        res.writeHead(403, { 'content-type': 'application/json; charset=utf-8' })
-        res.end(JSON.stringify({ ok: false, error: 'loopback only; set allowRemote for trusted same-origin access' }))
-        return
-      }
+    if (!this.trusted(req)) {
+      this.deny(res)
+      return
     }
     const params = new URL(req.url, 'http://localhost').searchParams
     const day = params.get('day')
     const month = params.get('month')
+    const year = params.get('year')
+    const from = params.get('from')
+    const to = params.get('to')
     const rawModel = params.get('model')
     const model = rawModel !== null && rawModel.length > 0 && rawModel.length <= 200 ? rawModel : undefined
-    let filter = null
-    if (day !== null && month !== null) {
+    const reject = (error) => {
       res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
-      res.end(JSON.stringify({ ok: false, error: 'use exactly one of day or month' }))
+      res.end(JSON.stringify({ ok: false, error }))
+    }
+    let filter = null
+    if ((from === null) !== (to === null)) {
+      reject('from and to must be used together')
+      return
+    }
+    if ([day !== null, month !== null, year !== null, from !== null].filter(Boolean).length > 1) {
+      reject('use exactly one of day, month, year or from+to')
       return
     }
     if (day !== null) {
       if (!DAY_RE.test(day)) {
-        res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
-        res.end(JSON.stringify({ ok: false, error: 'day must be YYYY-MM-DD' }))
+        reject('day must be YYYY-MM-DD')
         return
       }
       filter = { kind: 'day', value: day, model }
     } else if (month !== null) {
       if (!MONTH_RE.test(month)) {
-        res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' })
-        res.end(JSON.stringify({ ok: false, error: 'month must be YYYY-MM' }))
+        reject('month must be YYYY-MM')
         return
       }
       filter = { kind: 'month', value: month, model }
+    } else if (year !== null) {
+      if (!YEAR_RE.test(year)) {
+        reject('year must be YYYY')
+        return
+      }
+      filter = { kind: 'year', value: year, model }
+    } else if (from !== null) {
+      if (!DAY_RE.test(from) || !DAY_RE.test(to)) {
+        reject('from and to must be YYYY-MM-DD')
+        return
+      }
+      if (from > to) {
+        reject('from must not be after to')
+        return
+      }
+      filter = { kind: 'range', from, to, model }
     } else if (model !== undefined) {
       filter = { kind: 'all', value: undefined, model }
     }
@@ -784,8 +934,9 @@ export class UsageTracker {
 /**
  * Register the tracker once the profile's webServer service exists.
  * @param ctx - host context from the cordis loader.
- * @param config - loader config: `endpoint`, `scanAtBoot`, `allowRemote` and
- * `pricing` (`enabled`, `currency`, `refreshHour`, `url`, `timeoutMs`).
+ * @param config - loader config: `endpoint`, `scanAtBoot`, `allowRemote`,
+ * `pricing` (`enabled`, `currency`, `refreshHour`, `url`, `timeoutMs`) and
+ * `versions` (`registry`, `timeoutMs`, `ttlMs`).
  */
 export function apply(ctx, config = {}) {
   const endpoint = typeof config.endpoint === 'string' && config.endpoint.length > 0 ? config.endpoint : '/dsh-token-use'
@@ -793,7 +944,8 @@ export function apply(ctx, config = {}) {
   ctx.inject(['webServer'], (host) => {
     const dshHome = resolveDshHome()
     const pricing = new PricingStore(dshHome, config.pricing ?? {})
-    const tracker = new UsageTracker(dshHome, { allowRemote: config.allowRemote === true, pricing })
+    const versions = new VersionStore(dshHome, config.versions ?? {})
+    const tracker = new UsageTracker(dshHome, { allowRemote: config.allowRemote === true, pricing, endpoint })
     host.effect(() => {
       pricing.start()
       return () => pricing.stop()
@@ -802,13 +954,17 @@ export function apply(ctx, config = {}) {
       tracker.fold(session, event)
     }, { global: true })
     host.effect(() => {
-      const dispose = host.webServer.register({
-        kind: 'exact',
-        path: endpoint,
-        handler: (req, res) => tracker.handle(req, res),
-      })
-      return () => dispose()
-    }, 'dsh-token-use: http route')
+      const routes = [
+        { path: endpoint, handler: (req, res) => tracker.handle(req, res) },
+        { path: `${endpoint}/config`, handler: (req, res) => tracker.handleConfig(req, res, versions) },
+        { path: `${endpoint}/health`, handler: (req, res) => tracker.handleHealth(req, res) },
+        { path: `${endpoint}/restart`, handler: (req, res) => tracker.handleRestart(req, res) },
+      ]
+      const disposers = routes.map((route) => host.webServer.register({ kind: 'exact', ...route }))
+      return () => {
+        for (const dispose of disposers) dispose()
+      }
+    }, 'dsh-token-use: http routes')
     if (scanAtBoot) {
       tracker.scanSessions().catch((error) => {
         tracker.scan.error = String(error?.stack ?? error)