release: 0.39.44 — projects filters and per-repo cost, plan value, quota chip fix

[pitimon]

Release tracker for 0.39.44, covering the 15 commits merged since v0.39.43.

What users get

• The Projects panel honours the date range. It read no query parameter at all: picking "24h" narrowed every other card while Projects kept showing all-time totals with nothing on screen saying so (feat(projects): the panel ignored every filter the client sent #118).
• Per-repo cost. Project rows now carry a model, so computeRowCost works per repository. Rows written before the change are named as unpriced rather than shown as a confident $0 (feat(projects): per-repo cost, and the mixed-era rule that makes it safe #121).
• Sources with no per-repo attribution are named. Cursor, Copilot, Zed, Goose and Kiro have no project story; omitting them looked identical to "that tool cost nothing here" (feat(projects): the panel ignored every filter the client sent #118).
• A plan-value card answering the question README:32 already promised — what you pay against what the same usage would cost at list price, labelled as list-price-equivalent rather than a saving (feat(dashboard): answer "is my plan worth it?", carefully #122).
• The Codex quota chip no longer vanishes on a 401. A stale sign-in produced no windows and no error, so the chip disappeared entirely — worse than never having had one (fix(limits): a 4xx made the Codex chip disappear instead of saying why #119).
• sync --compact reclaims superseded rows from the append-only queue. Measured on a real install: 34,924 lines to 5,636. Sync recommends it past a threshold and does not act on its own (feat(queue): reclaim the 84% of the queue nothing ever reclaimed #117).

What is behind the scenes

• The outbound-privacy validator: trailing comments no longer read as requests, waivers are pinned per URL instead of per file, the scan covers four kinds of file it had missed, inventory metadata is checked, and unresolvable authorities are reported rather than dropped (fix(validate): trailing comments read as requests; waivers covered whole files #111, fix(validate): the scan missed four kinds of file, and vouched for prose #114).
• The avatar proxy: redirects re-checked per hop, port-aware allowlisting, and a real download cap (fix(validate): check where a host is REQUESTED, not merely mentioned #109, fix(security): AVATAR_PROXY_MAX_BYTES read like a cap and gated only caching #112).
• A parser conformance ratchet enumerating parsers from source, so a new one cannot land untested (test(parsers): a new parser could land with no test and no CI objection #116, test(parsers): the hermes fixture the allowlist was standing in for #120).
• scripts/graph/ out of the product gate (chore(ci): the product gate ran a tool the product does not ship #115), and a capture tool for usage-limits fixtures (feat(limits): the capture tool that unblocks issue 105 Part 2 #124).

Release checklist

• Branch from origin/main, bump to 0.39.44, sync-desktop-version + validate:version-lockstep
• PR to pitimon/TokenTracker:main, CI green, merge
• Tag v0.39.44 and run release (macOS + Windows)
• npm publish; check git status for a prepublishOnly seed-snapshot timestamp
• Verify the published version actually runs, and the DMG reports 0.39.44 — not just that the workflow went green
• Repin the local LaunchAgents

The one thing to watch after this ships

#121 migrates cursors.json on every user's first sync after upgrading. Project buckets are re-keyed from project|source|hour to project|source|model|hour; without that the old bucket strands and its usage is counted twice.

Verified read-only against a real 2,015-bucket state: all keys migrated, total_tokens preserved exactly (6,281,653,062 unchanged), and all 2,015 queuedKey markers survived — losing those would re-append every row. That is one machine, though. A state shaped differently is the residual risk worth watching.