Dashboard docs
The bookmarkable URL at localhost:24842 only exists after setup-daemon has been run, but the README and dashboard skill presented it unconditionally as "always current". Users who never ran setup-daemon got ERR_CONNECTION_REFUSED from the one thing the docs told them to bookmark. The skill now probes daemon-status before mentioning any URL.
Docs also stopped hardcoding the dashboard file path. measure.py resolves SNAPSHOT_DIR three ways (env override, plugin data dir, legacy _backups), so no literal is correct for every install; phase0-setup.md even labelled the legacy path "(always works)" when plugin-marketplace installs never write there.
OpenCode: global data directory (opencode 1.1.0)
Session DBs and trends.db were written into {project}/token-optimizer/, polluting repos and preventing cross-project trend aggregation. Data now lives in the platform-global location, overridable via TOKEN_OPTIMIZER_DATA_DIR or PluginOptions.dataDir, with session DBs scoped per project.
Existing data migrates automatically. Migration is non-destructive (copies, leaving originals recoverable), runs once behind an atomic lock, copies WAL sidecars alongside each database, and writes via temp-file plus rename so a crash cannot leave a truncated DB.
Problem reported by @cawa0505 in #90; addresses #94.
Security
- All migration filesystem checks use
lstat. Following symlinks would let a repo shiptrends.db -> ../../../../.ssh/id_ed25519and have it copied into the data directory on plugin init. - Project slugs append a SHA-256 prefix. The readable slug alone collapsed
client-a,client.aandclient_aonto one value, and the slug is the only boundary between projects in a shared data directory.