gh-glance 0.7.0 → 0.8.0

package/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.8.0] - 2026-08-11
+
+### Added
+
+- **Last-known-good dashboard rows now survive process restarts.** Successfully
+  parsed Actions, Issues, Pull Requests, and Security state is stored in a
+  private, target-scoped cache. It retains five recent targets and 60 rows per
+  tab, ignores corrupt or unwritable state, and never stores credentials.
+
+### Changed
+
+- **Development tooling was refreshed.** The paired CodeQL actions now use
+  4.37.6, and the development-only `globals` lock entry is 17.9.0.
+
+### Fixed
+
+- **Status updates no longer accumulate old footer lines during prolonged rate
+  limiting.** The dashboard leaves the terminal's physical bottom row as a
+  scroll guard while preserving incremental rendering.
+- **Restarting during a live rate limit no longer shows an empty dashboard.**
+  Cached rows remain visible below the current error with an explicit `stale`
+  age, while repository targets remain isolated.
+- **Blind Security refreshes preserve known alerts.** A failed observation
+  cannot replace last-known-good Security rows with a false empty result, and an
+  identical healthy response clears the warning after recovery.
+
 ## [0.7.0] - 2026-08-10
 
 ### Added
@@ -621,7 +647,8 @@ engineering, security, QA and UX. What follows is what changed as a result.
 - The `main` field from `package.json`. It advertised the file as importable,
   but importing it took over the terminal or exited the host process.
 
-[Unreleased]: https://github.com/juan294/gh-glance/compare/v0.7.0...HEAD
+[Unreleased]: https://github.com/juan294/gh-glance/compare/v0.8.0...HEAD
+[0.8.0]: https://github.com/juan294/gh-glance/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/juan294/gh-glance/compare/v0.6.1...v0.7.0
 [0.6.1]: https://github.com/juan294/gh-glance/releases/tag/v0.6.1
 [0.6.0]: https://github.com/juan294/gh-glance/releases/tag/v0.6.0

package/README.md

@@ -30,7 +30,7 @@ without switching to the browser.
 │                                                                          │
 │                                                                          │
 ╰───────────────────────────────────────────────────────────────── 4 of 4 ─╯
-⣾ Fetching  Move: ↑↓ | Open: Ent | Refresh: r | Width: w | Quit: q     0.7.0
+⣾ Fetching  Move: ↑↓ | Open: Ent | Refresh: r | Width: w | Quit: q     0.8.0
 ```
 
 > Captured from a real run at 76 columns with `GH_GLANCE_ICONS=unicode`, so the
@@ -90,10 +90,13 @@ current.
   answers "is CI red" without colour
 - Says when it is stale rather than showing old data silently, and marks a tab
   whose last refresh failed
+- Keeps the last successfully parsed rows visible during temporary failures and
+  across a restart, scoped to the repository being watched
 - Adapts row count to the terminal pane's height live, on resize
 - Enters the terminal's alternate screen buffer on launch (like `lazygit`,
   `htop`, `vim`) so the shell prompt that launched it stays out of view, and
-  is restored cleanly on exit
+  is restored cleanly on exit without old status lines accumulating below the
+  frame
 
 ## Prerequisites
 
@@ -344,6 +347,32 @@ the live session and width mode reports `Widths not saved`; a later successful
 write clears the warning. The UI owns this file, so direct editing is not the
 primary configuration workflow.
 
+### Last-known-good dashboard cache
+
+Successfully parsed dashboard rows are also saved automatically, in
+`dashboard-cache.json` beside `preferences.json`:
+
+```text
+$XDG_CONFIG_HOME/gh-glance/dashboard-cache.json
+~/Library/Application Support/gh-glance/dashboard-cache.json
+~/.config/gh-glance/dashboard-cache.json
+```
+
+The cache is scoped to the repository and host being watched. In inferred mode,
+the host and current working directory form the identity, so rows from one
+checkout cannot appear in another. It retains at most five recent targets and
+60 rows per tab; a shortened cached tab keeps its `+` marker rather than
+presenting the saved count as complete.
+
+Only successfully parsed, non-blind observations replace saved rows. A failed
+request can add a live error or `?` marker, but it cannot turn known Security
+alerts or other last-known-good rows into an empty result. Missing, corrupt,
+unknown-version, or unwritable cache state is ignored rather than blocking the
+dashboard. On POSIX systems, gh-glance restricts its config directory to `0700`
+and the cache file to `0600`. The file contains repository data, including
+titles, authors, branches, and Security findings, but never GitHub credentials.
+It is recovery state owned by the UI, not a configuration interface.
+
 ## GitHub Enterprise and EMU
 
 **The common case needs no configuration.** Authenticate once --
@@ -443,6 +472,13 @@ hour, an authorization failure every 30 seconds, a rate limit every minute.
 Pressing `r` clears that backoff and retries immediately. And `--refresh`
 scales the whole figure: doubling the interval halves it.
 
+When a refresh fails, the last successful rows stay visible below the live
+error instead of disappearing. If gh-glance is restarted while GitHub is still
+rate-limiting, it loads the saved rows for that same target immediately. Their
+age remains explicit through the `stale` label, and the rate-limit banner still
+describes the current failed request; cached data never turns a failure into a
+false success.
+
 One pane on Actions costs about a third of an hourly REST budget, so roughly
 three panes fill it. Past that, `gh-glance` widens its own poll interval: it
 reads your remaining budget once a minute, works out how much of it belongs to
@@ -544,7 +580,7 @@ in some terminals, which would shift every column to their right.
 | Security tab shows `?` instead of a number | The alert endpoints could not be read at all -- an expired SAML session, a token without `security_events`, or an org OAuth restriction. `?` means "unknown", not "zero"; run `gh-glance --doctor` to see which probe failed and how it was classified. |
 | A failing tab seems to have stopped retrying | It backs off deliberately, rather than re-spawning `gh` every five seconds against an endpoint that is refusing. Press `r` to clear the backoff and retry now. |
 | `unknown argument: -v` | `-v` used to mean `--version` and no longer does, because this CLI also has `--verbose`. Use `--version` or `--verbose` explicitly. |
-| `stale 2m` in the status bar | The visible tab has not refreshed successfully for a while — usually a network drop. |
+| `stale 2m` in the status bar | The visible tab has not refreshed successfully for a while — usually a network drop or rate limit. Last-known-good rows can remain visible, including after restart; the live error above the table explains why they are stale. |
 | It exits immediately when piped | Intentional. It is a full-screen dashboard, not a reporting command. |
 | It stopped updating and you cannot tell why | Run `gh-glance --verbose 2>gh-glance.log`, reproduce, then read the log: one line per `gh` call with its duration and outcome. It is redacted the same way `--doctor` is, so it is safe to attach to a bug report. `--doctor --verbose` logs the probes too. |
 | `--verbose` refuses to start | stderr is still your terminal, where the log would draw over the dashboard. Redirect it to a file. |

package/index.mjs

@@ -24,6 +24,7 @@ process.env.NODE_ENV ??= "production";
 
 import { execFile, spawn } from "node:child_process";
 import {
+  chmodSync,
   mkdirSync,
   readFileSync,
   realpathSync,
@@ -2981,8 +2982,8 @@ function saveWidthPreferences(path, overrides, tabs = TABS) {
   }
 }
 
-function createWidthPreferenceWriter({ write, delay = 200, onResult = () => {} }) {
-  let latest = EMPTY_WIDTH_OVERRIDES;
+function createCoalescedWriter({ write, delay = 200, onResult = () => {} }) {
+  let latest;
   let generation = 0;
   let persistedGeneration = 0;
   let timer = null;
@@ -3083,6 +3084,227 @@ function createWidthPreferenceWriter({ write, delay = 200, onResult = () => {} }
   };
 }
 
+const createWidthPreferenceWriter = createCoalescedWriter;
+
+// ---------- Last-known-good dashboard cache ----------
+
+const DASHBOARD_CACHE_VERSION = 1;
+const MAX_DASHBOARD_CACHE_TARGETS = 5;
+const MAX_DASHBOARD_CACHE_ROWS_PER_TAB = 60;
+let dashboardCacheTempSequence = 0;
+
+function dashboardCachePath(options = {}) {
+  return join(dirname(widthPreferencesPath(options)), "dashboard-cache.json");
+}
+
+// Explicit targets are stable across working directories. In inferred mode the
+// directory is the only repository identity available without making another
+// GitHub call -- exactly the call that cannot succeed when this cache is needed.
+// JSON encoding avoids delimiter ambiguity in host, repo, and path strings.
+function dashboardCacheTarget({ repo = null, ghRepo = null, host = null, cwd = process.cwd() } = {}) {
+  const target = repo || ghRepo;
+  return target
+    ? JSON.stringify({ kind: "repo", host: String(host ?? ""), repo: String(target) })
+    : JSON.stringify({ kind: "cwd", host: String(host ?? ""), cwd: String(cwd) });
+}
+
+function cacheTimestamp(value) {
+  return Number.isFinite(value) && value >= 0 ? value : null;
+}
+
+function normalizeCachedItem(tabKey, item) {
+  if (!isRecord(item)) return null;
+  if (tabKey === "actions") {
+    if (!Number.isSafeInteger(item.databaseId)) return null;
+    return {
+      databaseId: item.databaseId,
+      displayTitle: safe(item.displayTitle),
+      workflowName: safe(item.workflowName),
+      number: Number.isSafeInteger(item.number) ? item.number : null,
+      headBranch: safe(item.headBranch),
+      status: safe(item.status),
+      conclusion: item.conclusion == null ? null : safe(item.conclusion),
+      startedAt: safe(item.startedAt),
+      updatedAt: safe(item.updatedAt),
+    };
+  }
+  if (tabKey === "issues") {
+    if (!Number.isSafeInteger(item.number)) return null;
+    return {
+      number: item.number,
+      title: safe(item.title),
+      author: safe(item.author),
+      label: safe(item.label),
+      updatedAt: safe(item.updatedAt),
+    };
+  }
+  if (tabKey === "prs") {
+    if (!Number.isSafeInteger(item.number)) return null;
+    return {
+      number: item.number,
+      title: safe(item.title),
+      author: safe(item.author),
+      headRefName: safe(item.headRefName),
+      isDraft: Boolean(item.isDraft),
+      reviewDecision: safe(item.reviewDecision),
+      updatedAt: safe(item.updatedAt),
+    };
+  }
+  if (tabKey === "security") {
+    const id = safe(item.id);
+    if (!id) return null;
+    return {
+      id,
+      kind: safe(item.kind),
+      severity: safe(item.severity),
+      title: safe(item.title),
+      detail: safe(item.detail),
+      createdAt: safe(item.createdAt),
+    };
+  }
+  return null;
+}
+
+function normalizeDashboardCacheEntry(entry) {
+  if (!isRecord(entry) || !isRecord(entry.tabs)) return null;
+  const tabs = {};
+  for (const tabKey of TAB_KEYS) {
+    const tab = entry.tabs[tabKey];
+    if (!isRecord(tab) || !Array.isArray(tab.data)) continue;
+    const lastOk = cacheTimestamp(tab.lastOk);
+    if (
+      lastOk === null ||
+      !isRecord(tab.meta) ||
+      cacheTimestamp(tab.meta.at) === null ||
+      typeof tab.meta.truncated !== "boolean"
+    ) {
+      continue;
+    }
+    const normalizedData = tab.data.map((item) => normalizeCachedItem(tabKey, item)).filter(Boolean);
+    // A malformed row means this tab was not written by the current schema.
+    // Reject the tab rather than turning a corrupt non-empty payload into a
+    // confident empty state.
+    if (normalizedData.length !== tab.data.length) continue;
+    const data = normalizedData.slice(0, MAX_DASHBOARD_CACHE_ROWS_PER_TAB);
+    const meta = {
+      at: tab.meta.at,
+      truncated: tab.meta.truncated || normalizedData.length > MAX_DASHBOARD_CACHE_ROWS_PER_TAB,
+    };
+    tabs[tabKey] = { data, meta, lastOk };
+  }
+  if (Object.keys(tabs).length === 0) return null;
+  const latestTab = Math.max(...Object.values(tabs).map((tab) => tab.lastOk));
+  return {
+    tabs,
+    securityNotes: Array.isArray(entry.securityNotes)
+      ? entry.securityNotes
+          .filter((note) => typeof note === "string")
+          .slice(0, ALERT_SOURCES.length)
+          .map((note) => safe(note))
+      : [],
+    securityBlind: typeof entry.securityBlind === "boolean" ? entry.securityBlind : false,
+    updatedAt: cacheTimestamp(entry.updatedAt) ?? latestTab,
+  };
+}
+
+function normalizeDashboardCache(cache) {
+  if (!isRecord(cache)) return {};
+  return limitDashboardCache(
+    Object.fromEntries(
+      Object.entries(cache)
+        .map(([target, entry]) => [target, normalizeDashboardCacheEntry(entry)])
+        .filter(([target, entry]) => target.length > 0 && entry !== null),
+    ),
+  );
+}
+
+function limitDashboardCache(cache) {
+  return Object.fromEntries(
+    Object.entries(cache)
+      .sort((left, right) => right[1].updatedAt - left[1].updatedAt)
+      .slice(0, MAX_DASHBOARD_CACHE_TARGETS),
+  );
+}
+
+function mergeDashboardCacheEntry(cache, target, entry) {
+  const normalized = normalizeDashboardCacheEntry(entry);
+  return normalized === null ? cache : limitDashboardCache({ ...cache, [target]: normalized });
+}
+
+function decodeDashboardCache(raw) {
+  let document;
+  try {
+    document = JSON.parse(raw);
+  } catch (error) {
+    return { cache: {}, error };
+  }
+  if (
+    !isRecord(document) ||
+    document.version !== DASHBOARD_CACHE_VERSION ||
+    !isRecord(document.targets)
+  ) {
+    return { cache: {}, error: new Error("Unsupported dashboard cache document") };
+  }
+  return { cache: normalizeDashboardCache(document.targets), error: null };
+}
+
+function serializeDashboardCache(cache, { normalized = false } = {}) {
+  return `${JSON.stringify(
+    { version: DASHBOARD_CACHE_VERSION, targets: normalized ? cache : normalizeDashboardCache(cache) },
+    null,
+    2,
+  )}\n`;
+}
+
+function loadDashboardCache(path, target) {
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    return error?.code === "ENOENT"
+      ? { cache: {}, entry: null, error: null }
+      : { cache: {}, entry: null, error };
+  }
+  const decoded = decodeDashboardCache(raw);
+  return {
+    cache: decoded.cache,
+    entry: pick(decoded.cache, target, null),
+    error: decoded.error,
+  };
+}
+
+function saveDashboardCache(path, cache, { normalized = false } = {}) {
+  let tempPath = null;
+  try {
+    const parent = dirname(path);
+    mkdirSync(parent, { recursive: true, mode: 0o700 });
+    if (process.platform !== "win32") chmodSync(parent, 0o700);
+    dashboardCacheTempSequence += 1;
+    tempPath = `${path}.${process.pid}.${Date.now()}.${dashboardCacheTempSequence}.tmp`;
+    writeFileSync(tempPath, serializeDashboardCache(cache, { normalized }), {
+      encoding: "utf8",
+      mode: 0o600,
+      flag: "wx",
+    });
+    renameSync(tempPath, path);
+    return { ok: true };
+  } catch (error) {
+    if (tempPath !== null) {
+      try {
+        unlinkSync(tempPath);
+      } catch {
+        // The write may have failed before creating this exact temporary file.
+      }
+    }
+    return { ok: false, error };
+  }
+}
+
+function nextSecurityRaw(previousRaw, raw, blind) {
+  if (blind === true) return null;
+  return previousRaw === raw ? previousRaw : raw;
+}
+
 // Below this the full column set cannot render without its fixed columns
 // overflowing the frame -- rows hard-wrap and ink switches to clearing and
 // repainting the whole screen every frame. Worse, in the band just above the
@@ -3409,19 +3631,42 @@ function App({ onCreateRemote = () => {} } = {}) {
       void widthPreferenceWriter.dispose();
     };
   }, [widthPreferenceWriter]);
+  const [cachePath] = useState(() => dashboardCachePath());
+  const [cacheTarget] = useState(() =>
+    dashboardCacheTarget({
+      repo: runtime.repo,
+      ghRepo: process.env.GH_REPO,
+      host: runtime.host ?? process.env.GH_HOST,
+      cwd: process.cwd(),
+    }),
+  );
+  const [loadedCache] = useState(() => loadDashboardCache(cachePath, cacheTarget));
+  const dashboardCacheRef = useRef(loadedCache.cache);
+  const dashboardCacheTargetRef = useRef(cacheTarget);
+  const [dashboardCacheWriter] = useState(() =>
+    createCoalescedWriter({
+      write: (cache) => saveDashboardCache(cachePath, cache, { normalized: true }),
+    }),
+  );
+  useEffect(() => () => {
+    // Production writes start synchronously, so a pending latest snapshot is
+    // not lost on quit. The cache is bounded; ignoring the advisory result keeps
+    // a filesystem error from replacing terminal teardown.
+    void dashboardCacheWriter.dispose();
+  }, [dashboardCacheWriter]);
+  const cachedEntry = loadedCache.entry;
   // `null` means "never resolved" -- distinct from `[]`, which means "resolved
   // and genuinely empty". The tab bar and the body render those differently.
-  const [data, setData] = useState({ actions: null, issues: null, prs: null, security: null });
-  const [meta, setMeta] = useState({
-    actions: null,
-    issues: null,
-    prs: null,
-    security: null,
-  });
-  const [securityNotes, setSecurityNotes] = useState([]);
+  const [data, setData] = useState(() =>
+    Object.fromEntries(TABS.map((candidate) => [candidate.key, cachedEntry?.tabs[candidate.key]?.data ?? null])),
+  );
+  const [meta, setMeta] = useState(() =>
+    Object.fromEntries(TABS.map((candidate) => [candidate.key, cachedEntry?.tabs[candidate.key]?.meta ?? null])),
+  );
+  const [securityNotes, setSecurityNotes] = useState(() => cachedEntry?.securityNotes ?? []);
   // Whether the Security tab is currently unable to see its endpoints, as
   // opposed to seeing that they are switched off. Drives the count marker.
-  const [securityBlind, setSecurityBlind] = useState(false);
+  const [securityBlind, setSecurityBlind] = useState(() => cachedEntry?.securityBlind ?? false);
   // The `?` overlay. Renders only on a keypress, so consecutive idle frames are
   // still byte-identical and the redraw suppression is untouched.
   const [showHelp, setShowHelp] = useState(false);
@@ -3509,12 +3754,18 @@ function App({ onCreateRemote = () => {} } = {}) {
 
   const inFlightRef = useRef({});
   const rawRef = useRef({});
-  const cleanRef = useRef({});
   // Last *successful* poll per tab, wall-clock. Wall-clock on purpose: a laptop
   // sleeping is exactly the gap this is meant to report, and a monotonic clock
   // does not advance across suspend. Never written on the failure path, or a
   // persistently failing tab would report itself fresh forever.
-  const lastOkRef = useRef({});
+  const lastOkRef = useRef(
+    Object.fromEntries(
+      TABS.flatMap((candidate) => {
+        const lastOk = cachedEntry?.tabs[candidate.key]?.lastOk;
+        return lastOk == null ? [] : [[candidate.key, lastOk]];
+      }),
+    ),
+  );
   const fetchTabRef = useRef(null);
   const contextCoordinatorRef = useRef(null);
 
@@ -3881,10 +4132,10 @@ function App({ onCreateRemote = () => {} } = {}) {
   // -- the behaviour the per-tab guard and the fetch-time limit read were
   // written to prevent. Do not "fix" this by adding them.
   //
-  // exhaustive-deps is satisfied as written -- every captured value is either a
-  // ref or a setState function, both of which the rule treats as stable -- so
-  // this needs no suppression, and if one ever becomes necessary that is the
-  // signal that a real dependency crept in.
+  // exhaustive-deps is satisfied as written -- every captured value is a ref,
+  // a setState function, or the stable cache writer created once above. If a
+  // changing dependency ever becomes necessary, that is the signal that the
+  // mount-only contract has been broken.
   //
   // The adaptive throttle re-arms the timer, which is not a contradiction of the
   // above: `rearm` swaps the interval from *inside* this effect, so the effect
@@ -3915,6 +4166,32 @@ function App({ onCreateRemote = () => {} } = {}) {
     });
     contextCoordinatorRef.current = coordinator;
 
+    function cacheSuccessfulTab(key, tabData, tabMeta, lastOk, security = {}) {
+      const target = dashboardCacheTargetRef.current;
+      const currentCache = dashboardCacheRef.current;
+      const currentEntry = pick(currentCache, target, null) ?? {
+        tabs: {},
+        securityNotes: [],
+        securityBlind: false,
+        updatedAt: lastOk,
+      };
+      const nextEntry = {
+        ...currentEntry,
+        tabs: {
+          ...currentEntry.tabs,
+          [key]: { data: tabData, meta: tabMeta, lastOk },
+        },
+        securityNotes:
+          key === "security" ? (security.notes ?? []) : currentEntry.securityNotes,
+        securityBlind:
+          key === "security" ? Boolean(security.blind) : currentEntry.securityBlind,
+        updatedAt: lastOk,
+      };
+      const nextCache = mergeDashboardCacheEntry(currentCache, target, nextEntry);
+      dashboardCacheRef.current = nextCache;
+      dashboardCacheWriter.schedule(nextCache);
+    }
+
     // Each tab commits its own result the moment it lands instead of waiting on
     // a Promise.allSettled barrier. Actions is by far the slowest fetch, so
     // barrelling everything together meant the three fast tabs sat invisible
@@ -3953,32 +4230,50 @@ function App({ onCreateRemote = () => {} } = {}) {
           // completely healthy. A ref rather than state because writing state here
           // would allocate a new object every tick and permanently defeat the
           // React bail-out this early return exists to preserve.
-          lastOkRef.current[key] = Date.now();
-          // Clear on the first success or a single failure latches the ladder.
-          clearBackoff(`tab:${key}`);
-          if (rawRef.current[key] === raw && cleanRef.current[key]) {
+          const completedAt = Date.now();
+          if (rawRef.current[key] === raw) {
+            lastOkRef.current[key] = completedAt;
+            // Clear on the first success or a single failure latches the ladder.
+            clearBackoff(`tab:${key}`);
             setErrors((x) => (x[key] === null ? x : { ...x, [key]: null }));
             return;
           }
           const value = parse();
-          rawRef.current[key] = raw;
-          cleanRef.current[key] = true;
+          // Security fetches resolve each source independently so their notes
+          // remain visible. A blind result is still a failed observation: it
+          // must not replace known alerts with a false empty state or advance
+          // freshness. Do not retain its raw value either, so the next source
+          // retry is parsed instead of taking the identical-payload fast path.
+          if (key === "security" && value.blind) {
+            rawRef.current[key] = nextSecurityRaw(rawRef.current[key], raw, true);
+            setErrors((x) => (x[key] === null ? x : { ...x, [key]: null }));
+            setSecurityNotes(value.notes ?? []);
+            setSecurityBlind(true);
+            return;
+          }
+          const tabData = value.alerts ?? value;
+          const tabMeta = {
+            at: completedAt,
+            // Compare against the limit this payload was actually fetched
+            // with. Comparing against the live pane-height ref made the "n+"
+            // marker lie for one cycle after every resize.
+            truncated: value.truncated ?? tabData.length >= limit,
+          };
+          lastOkRef.current[key] = completedAt;
+          clearBackoff(`tab:${key}`);
+          rawRef.current[key] =
+            key === "security" ? nextSecurityRaw(rawRef.current[key], raw, false) : raw;
           setErrors((x) => (x[key] === null ? x : { ...x, [key]: null }));
-          setData((d) => ({ ...d, [key]: value.alerts ?? value }));
-          setMeta((m) => ({
-            ...m,
-            [key]: {
-              at: Date.now(),
-              // Compare against the limit this payload was actually fetched
-              // with. Comparing against the live pane-height ref made the "n+"
-              // marker lie for one cycle after every resize.
-              truncated: value.truncated ?? (value.alerts ?? value).length >= limit,
-            },
-          }));
+          setData((d) => ({ ...d, [key]: tabData }));
+          setMeta((m) => ({ ...m, [key]: tabMeta }));
           if (value.notes) setSecurityNotes(value.notes);
           if (key === "security") {
             setSecurityBlind((b) => (b === Boolean(value.blind) ? b : Boolean(value.blind)));
           }
+          cacheSuccessfulTab(key, tabData, tabMeta, completedAt, {
+            notes: value.notes,
+            blind: value.blind,
+          });
         })
         .catch((err) => {
           // A rejected fetch carries no result, so its own spend is unknowable
@@ -3987,7 +4282,6 @@ function App({ onCreateRemote = () => {} } = {}) {
           // errs toward throttling harder, which is the safe direction.
           restSpentTotal += REST_PER_FETCH[key] ?? 0;
           if (cancelled || err?.name === "AbortError") return;
-          cleanRef.current[key] = false;
           // Preserve both the verdict and the bounded raw error in state. The
           // renderer translates recognized verdicts at draw time, which lets a
           // later repository/account context refine the one-line remedy without
@@ -4121,7 +4415,7 @@ function App({ onCreateRemote = () => {} } = {}) {
       // needed.
       controller.abort();
     };
-  }, []);
+  }, [dashboardCacheWriter]);
 
   // Background tabs can be up to BACKGROUND_EVERY ticks stale, so the tab you
   // switch to refreshes straight away rather than showing old data until its
@@ -4358,9 +4652,19 @@ function App({ onCreateRemote = () => {} } = {}) {
     widthPreferenceWriter,
   ]);
 
+  // Keep one physical row below Ink's output, the vertical counterpart to the
+  // spare column in `frameCols`. Incremental rendering assumes its cursor still
+  // sits at the bottom of the previous frame; if dynamic content occupies the
+  // terminal's last row, a terminal scroll can invalidate that assumption and
+  // leave old status lines behind. A non-fullscreen frame gets a trailing
+  // newline from Ink, so the cursor parks on the unused guard row while the
+  // status bar remains one row above the scroll edge.
+  const liveRows = Math.min(rows, usableSize(stdout?.rows, rows));
+  const frameRows = Math.max(1, liveRows - 1);
+
   return e(
     Box,
-    { flexDirection: "column", width: frameCols, height: Math.min(rows, usableSize(stdout?.rows, rows)) },
+    { flexDirection: "column", width: frameCols, height: frameRows },
     e(TabBar, {
       activeIndex,
       counts,
@@ -4818,6 +5122,13 @@ export {
   loadWidthPreferences,
   saveWidthPreferences,
   createWidthPreferenceWriter,
+  DASHBOARD_CACHE_VERSION,
+  dashboardCachePath,
+  dashboardCacheTarget,
+  serializeDashboardCache,
+  loadDashboardCache,
+  saveDashboardCache,
+  nextSecurityRaw,
   runStatusIcon,
   RUN_STATUS_ICON,
   SEVERITY_STYLE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gh-glance",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "A live-refreshing GitHub dashboard for your terminal: Actions, Issues, Pull Requests, and Security alerts in one narrow pane",
   "type": "module",
   "bin": {