feat: ratio-based growth display and per-agent tokens in scope chips

.github/workflows/release.yml

@@ -1,33 +1,133 @@
 name: Release
 
-# Push a version tag (e.g. v0.1.0) to build the app and publish a GitHub Release.
+# A version bump on main creates its tag and publishes automatically. Pushing a
+# matching v* tag remains supported for manual recovery/re-runs.
 on:
   push:
+    branches:
+      - main
     tags:
       - "v*"
+    paths:
+      - package.json
+      - src-tauri/Cargo.toml
+      - src-tauri/tauri.conf.json
   workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing version tag to publish, for example v1.3.0
+        required: true
+        type: string
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
+  prepare:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      publish: ${{ steps.version.outputs.publish }}
+      tag: ${{ steps.version.outputs.tag }}
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Validate version and prepare tag
+        id: version
+        shell: bash
+        run: |
+          set -euo pipefail
+          VERSION=$(node scripts/version.mjs)
+          TAG="v${VERSION}"
+
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            if [ "${GITHUB_REF_NAME}" != "$TAG" ]; then
+              echo "::error::Tag ${GITHUB_REF_NAME} does not match app version ${VERSION}"
+              exit 1
+            fi
+          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            if [ "${{ inputs.tag }}" != "$TAG" ]; then
+              echo "::error::Requested tag ${{ inputs.tag }} does not match app version ${VERSION}"
+              exit 1
+            fi
+            if ! git rev-parse "$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag $TAG does not exist"
+              exit 1
+            fi
+          else
+            BEFORE="${{ github.event.before }}"
+            PREVIOUS_PACKAGE=$(git show "${BEFORE}:package.json" 2>/dev/null || true)
+            PREVIOUS_VERSION=""
+            if [ -n "$PREVIOUS_PACKAGE" ]; then
+              PREVIOUS_VERSION=$(printf '%s' "$PREVIOUS_PACKAGE" | node -e \
+                'let s=""; process.stdin.on("data",d=>s+=d).on("end",()=>process.stdout.write(JSON.parse(s).version))')
+            fi
+            if [ "$VERSION" = "$PREVIOUS_VERSION" ]; then
+              echo "Version unchanged at $VERSION; nothing to publish."
+              echo "publish=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            if git ls-remote --exit-code --tags origin "refs/tags/$TAG" >/dev/null 2>&1; then
+              echo "::error::Tag $TAG already exists; choose a new version"
+              exit 1
+            fi
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag -a "$TAG" -m "Tokenscope $TAG"
+            git push origin "$TAG"
+          fi
+
+          echo "publish=true" >> "$GITHUB_OUTPUT"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      # Create the release once, here, before the platform jobs run. Two
+      # concurrent "create release" calls for the same tag race (one gets a
+      # 403 "Resource not accessible by integration"); pre-creating a draft
+      # lets every platform job find it and upload its assets, and the
+      # publish job flips it public only after all of them succeeded.
+      - name: Create draft release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ steps.version.outputs.tag }}
+        run: |
+          if ! gh release view "$TAG" >/dev/null 2>&1; then
+            gh release create "$TAG" \
+              --draft \
+              --title "Tokenscope $TAG" \
+              --notes "Work in progress — assets are uploaded by the platform build jobs; the release becomes public once every platform succeeds." \
+              --repo "${{ github.repository }}"
+          fi
+
   release:
-    # Only build/publish for version tags. workflow_dispatch from a branch would
-    # otherwise set the version/tag to the branch name and publish a malformed
-    # release (and fail the Homebrew step on the resulting 404).
-    if: startsWith(github.ref, 'refs/tags/v')
+    needs: prepare
+    if: needs.prepare.outputs.publish == 'true'
     permissions:
       contents: write
     strategy:
-      # One platform's failure must not cancel the other — a broken Windows
-      # bundler shouldn't block the macOS .dmg from publishing (and vice versa).
+      # One platform's failure must not cancel the other.
       fail-fast: false
       matrix:
         include:
+          # Build one app per CPU architecture so each package contains the
+          # matching single-architecture HappyUsage binary.
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            rust-targets: aarch64-apple-darwin
           - os: macos-latest
-            target: universal-apple-darwin
-            rust-targets: aarch64-apple-darwin,x86_64-apple-darwin
-          - os: windows-latest
-            target: x86_64-pc-windows-msvc
-            rust-targets: x86_64-pc-windows-msvc
+            target: x86_64-apple-darwin
+            rust-targets: x86_64-apple-darwin
     runs-on: ${{ matrix.os }}
+    env:
+      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
+      TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+      TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
     steps:
       - uses: actions/checkout@v6
 
@@ -53,107 +153,124 @@ jobs:
           workspaces: "./src-tauri -> target"
 
       - name: Install frontend deps
-        run: pnpm install
+        run: pnpm install --frozen-lockfile
+
+      - name: Validate updater signing
+        shell: bash
+        run: |
+          if [ -z "$TAURI_SIGNING_PRIVATE_KEY" ]; then
+            echo "::error::TAURI_SIGNING_PRIVATE_KEY is required for updater artifacts"
+            exit 1
+          fi
 
-      - name: Build & publish release
+      - name: Prepare release notes
+        id: release_notes
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gen=$(gh api --method POST \
+            "repos/${{ github.repository }}/releases/generate-notes" \
+            -f tag_name="$RELEASE_TAG" --jq '.body' || true)
+
+          {
+            cat <<'BODY'
+          Menu-bar / system-tray dashboard for local AI coding agent token usage (Claude Code + Codex).
+
+          ## Install
+
+          **macOS**: download `Tokenscope_*_aarch64.dmg` on Apple Silicon or `Tokenscope_*_x64.dmg` on Intel. Unsigned — right-click → **Open** on first launch, or install via `brew install --cask sunchj/tokenscope/tokenscope`.
+
+          BODY
+            if [ -n "$gen" ]; then
+              printf '\n%s\n' "$gen"
+            else
+              printf '\n## What changed\n\n- Changes included since the previous release.\n'
+            fi
+          } > release-body.md
+
+          {
+            echo "body<<RELEASE_BODY"
+            cat release-body.md
+            echo "RELEASE_BODY"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Build and upload release (draft)
         uses: tauri-apps/tauri-action@v0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # --- Code signing + notarization (optional, macOS only) ---
-          # UNSIGNED BUILD BY DEFAULT. Do NOT uncomment these until the matching
-          # secrets actually exist: tauri's bundler treats an empty
-          # APPLE_CERTIFICATE env var as "a certificate is present" and then
-          # fails on `security import` ("SecKeychainItemImport ... not valid").
-          #
-          # Once you have an Apple Developer ID, add these in repo
-          # Settings → Secrets and uncomment to get signed + notarized builds:
-          #
-          #   APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}                    # base64 of Developer ID .p12
-          #   APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}  # .p12 export password
-          #   APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}          # "Developer ID Application: Name (TEAMID)"
-          #   APPLE_ID: ${{ secrets.APPLE_ID }}                                      # Apple ID email
-          #   APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}                          # app-specific password
-          #   APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}                            # 10-char Team ID
-          # Windows builds are also unsigned — users get a SmartScreen warning
-          # on first launch, see README "Install on Windows".
         with:
-          tagName: ${{ github.ref_name }}
-          releaseName: "Tokenscope ${{ github.ref_name }}"
-          releaseBody: |
-            Menu-bar / system-tray dashboard for Claude CLI token usage.
-
-            **macOS**: download `Tokenscope_*_universal.dmg` (Apple Silicon + Intel). Unsigned — right-click → **Open** on first launch, or install via `brew install --cask hdusy/tokenscope/tokenscope`.
-
-            **Windows**: download `Tokenscope_*_x64-setup.exe`. Unsigned — on first launch click **More info → Run anyway** to dismiss SmartScreen.
-          # Publish immediately (not a draft): the asset's public download URL
-          # must be live for the Homebrew Cask step below to fetch it and for
-          # `brew install` to work.
-          releaseDraft: false
+          tagName: ${{ env.RELEASE_TAG }}
+          releaseName: "Tokenscope ${{ env.RELEASE_TAG }}"
+          releaseBody: ${{ steps.release_notes.outputs.body }}
+          # Draft until every platform has uploaded: a failed job must not
+          # leave a partial public release with only one macOS architecture.
+          releaseDraft: true
           prerelease: false
-          args: --target ${{ matrix.target }}
-
-      # Append an auto-generated changelog (PRs/commits since the previous tag)
-      # to the release notes. Best-effort: never fail the release over notes.
-      # Only run once (on the macOS leg) — both jobs publish to the same release.
-      - name: Add changelog to release
-        if: matrix.os == 'macos-latest'
-        continue-on-error: true
+          includeUpdaterJson: true
+          args: --target ${{ matrix.target }} --config src-tauri/tauri.release.conf.json
+
+  publish:
+    needs: [prepare, release]
+    if: needs.prepare.outputs.publish == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      RELEASE_TAG: ${{ needs.prepare.outputs.tag }}
+      RELEASE_VERSION: ${{ needs.prepare.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+
+      # Every platform uploaded its draft assets; flip the release public.
+      - name: Publish release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gen=$(gh api --method POST \
-            "repos/${{ github.repository }}/releases/generate-notes" \
-            -f tag_name="${{ github.ref_name }}" --jq '.body' || true)
-          cur=$(gh release view "${{ github.ref_name }}" --json body --jq '.body' || true)
-          {
-            printf '%s\n' "$cur"
-            if [ -n "$gen" ]; then printf '\n%s\n' "$gen"; fi
-          } > release-body.md
-          gh release edit "${{ github.ref_name }}" --notes-file release-body.md
+          gh release edit "$RELEASE_TAG" --draft=false
+          echo "Published $RELEASE_TAG"
 
       - name: Update Homebrew Cask
-        if: matrix.os == 'macos-latest'
         env:
           HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
         run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          DMG_NAME="Tokenscope_${VERSION}_universal.dmg"
-          DOWNLOAD_URL="https://github.com/HduSy/tokenscope/releases/download/${GITHUB_REF_NAME}/${DMG_NAME}"
-
-          # Wait for the release asset to be available, then compute sha256.
-          # -f makes curl fail (non-zero) on a 404 so we keep retrying instead
-          # of hashing GitHub's error page and writing a bogus checksum.
-          SHA256=""
-          for i in $(seq 1 10); do
-            if curl -fsSL "$DOWNLOAD_URL" -o /tmp/tokenscope.dmg; then
-              SHA256=$(shasum -a 256 /tmp/tokenscope.dmg | cut -d' ' -f1)
-              break
-            fi
-            echo "Retry $i: asset not ready yet..."
-            sleep 10
-          done
-          if [ -z "$SHA256" ]; then
-            echo "::error::Release asset $DMG_NAME never became available"; exit 1
+          if [ -z "$HOMEBREW_TAP_TOKEN" ]; then
+            echo "HOMEBREW_TAP_TOKEN not set; skipping tap update."
+            exit 0
           fi
+          BASE_URL="https://github.com/${{ github.repository }}/releases/download/${RELEASE_TAG}"
+          fetch_sha() {
+            arch="$1"
+            name="Tokenscope_${RELEASE_VERSION}_${arch}.dmg"
+            for i in $(seq 1 10); do
+              if curl -fsSL "${BASE_URL}/${name}" -o "/tmp/tokenscope-${arch}.dmg"; then
+                shasum -a 256 "/tmp/tokenscope-${arch}.dmg" | cut -d' ' -f1
+                return 0
+              fi
+              echo "Retry $i: $name not ready yet..." >&2
+              sleep 10
+            done
+            echo "::error::Release asset $name never became available" >&2
+            return 1
+          }
+          SHA_ARM="$(fetch_sha aarch64)"
+          SHA_INTEL="$(fetch_sha x64)"
 
-          # Clone the tap repo and update the cask
-          git clone https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/HduSy/homebrew-tokenscope.git /tmp/homebrew-tap
+          git clone https://x-access-token:${HOMEBREW_TAP_TOKEN}@github.com/SunChJ/homebrew-tokenscope.git /tmp/homebrew-tap
           cat > /tmp/homebrew-tap/Casks/tokenscope.rb <<CASK
           cask "tokenscope" do
-            version "${VERSION}"
-            sha256 "${SHA256}"
+            version "${RELEASE_VERSION}"
+            arch arm: "aarch64", intel: "x64"
+            sha256 arm: "${SHA_ARM}", intel: "${SHA_INTEL}"
 
-            url "${DOWNLOAD_URL}"
+            url "${BASE_URL}/Tokenscope_#{version}_#{arch}.dmg"
             name "Tokenscope"
-            desc "macOS menu-bar dashboard for Claude CLI token usage"
-            homepage "https://github.com/HduSy/tokenscope"
-
-            depends_on macos: ">= :catalina"
+            desc "Menu-bar dashboard for local AI coding agent token usage (Claude Code, Codex)"
+            homepage "https://github.com/${{ github.repository }}"
 
+            depends_on macos: :catalina
             app "Tokenscope.app"
 
-            # Unsigned/unnotarized build: strip the quarantine flag Homebrew
-            # adds so the app opens without the "Apple cannot verify" prompt.
             postflight do
               system_command "/usr/bin/xattr",
                              args: ["-cr", "#{appdir}/Tokenscope.app"],
@@ -166,5 +283,5 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add Casks/tokenscope.rb
-          git diff --cached --quiet || git commit -m "Update cask to v${VERSION}"
+          git diff --cached --quiet || git commit -m "Update cask to ${RELEASE_TAG}"
           git push

.gitignore

@@ -14,3 +14,5 @@ public/dev-dashboard.json
 .history/
 *.log
 claude-design-files/
+
+src-tauri/bin/hu