[wbgcoding]

What changes

Fixes from a full project review covering security and privacy, code quality and performance, UI and localization. No feature was removed or redesigned.

Security and privacy

• No secrets in the tree or the git history. The only tokens are test fakes; the update key is public.
• Runtime setup script: before starting the .NET installer with admin rights, it checks the download folder holds only that installer, so a DLL planted beside it is never loaded. It also refuses a temp folder that is a link.
• The elevated uninstall no longer removes app files from a moved data folder under ProgramData.
• A data folder the app creates when moving data is now private: current user, SYSTEM and Administrators only.
• Logs and crash text also strip the 8.3 short form of the profile path.
• Signer certificates are disposed after the chain is read.
• .gitignore now also covers binlogs, key stores, IDE state and the app's own backups.

Bugs and crashes

• Codex: a huge window_minutes value threw and broke every local read. Window lengths are now bounded.
• Codex: session-file reset times are read in seconds or milliseconds, like the web reader.
• Claude: the token sum and the waiting mark followed a running subagent's file instead of the main session.
• Claude and Codex: a fetch that timed out could run alongside its retry and corrupt shared state. Reads now honour cancellation and run one at a time.
• Antigravity: a revoked stored token showed "not signed in" until it expired. It is now refreshed once first.
• Claude discovery reports rate limiting as blocked.
• Installer: FindWindowExA never matched the app window, so a silent upgrade never relaunched the app. It now uses FindWindowExW.
• Installer: after an elevated in-app update the app came back with admin rights. It is now relaunched through the shell.
• Uninstall now also removes Task Manager's StartupApproved marker.
• Tray: an icon the shell refused at sign-in is retried.
• Status file: writes are serialised, so an older document can no longer land after the final one.
• Plan names: fused tokens like max5x are recognised.
• History: the main, settings and stats windows now share one history store. Before, deleted history could be written back and a data-folder move left the stats window reading the old folder.
• History: setting the clock back no longer stops history writes.
• Stats: a damaged stats.db is set aside and rebuilt from the session logs instead of failing forever.
• Stats: negative token counts are ignored.
• Stats: records without a project and the pooled "other" models are grouped by a neutral key, not their translated label. A project folder named like the label (e.g. "Ohne Projekt") or a model called "Other" no longer merges into those groups or toggles the wrong filter.
• Esc inside the custom-range popup no longer hides the whole stats window.
• A second sign-out while one is running no longer reports a false failure.
• The main widget no longer appears behind the open Welcome dialog.
• Settings rows are moved, not rebuilt, when tiles are reordered.

Performance

• The first stats index walk no longer scans the whole table once per new file.
• Importing another PC's history unpacks the backup's index once instead of twice.
• ~/.claude.json is cached by file stamp instead of parsed on every refresh.
• The gh output regex is generated instead of rebuilt on every call.
• Bursts of Windows colour notices apply the theme once.
• A resize drag measures the tallest content once and coalesces layout passes.

UI and localization

• The limit-reached notification no longer reads "resets in resets in".
• Day and month names follow the app language, while number and time formats keep the Windows regional format.
• Hotkey names are localized (Strg/Umschalt).
• WebView2 failure details are translated.
• New singular forms for two texts that read "1 days".
• EN percent spacing is consistent; German abbreviations are Mio./Mrd.
• German ellipsis style and the Konto/Zugang terms are consistent; several wording fixes in both languages.
• Installer messages use the formal "Sie", like Inno's own German wizard text.
• The update notice wraps instead of being cut off in German.
• Filter chips trim long text and show it as a tooltip; padding and icon dimming are consistent; sign-in buttons have accessible names.
• Stale or misplaced comments corrected.

How it was tested

• dotnet build tests/AiUsage.Tests -c Release: 0 warnings, 0 errors, with warnings as errors and analyzers on.

• Windows CI on the current head: all tests pass, and CodeQL is clean.

• WPF-free tests were also run on Linux against the built app assembly. The JS discovery scripts were run in Node against stubbed routes.

• New tests cover:

  • Providers and installer: Claude discovery rate-limit, max5x plans, the short profile path, the ProgramData exclusion.
  • Statistics and history: a negative token count, a corrupt index, the clock set back, project and model names that match the pooled labels.
  • UI and text: Esc in a popup, row reorder, limit-reached wording, hotkey display and display culture.

• No screenshots: the visible changes are small (wrapping, trimming, padding).

• dotnet test tests/AiUsage.Tests passes (CI)

• New user-facing text is in both Strings.resx and Strings.de.resx

• No call to a chat or completion endpoint, no write to another tool's files

Left open on purpose

• German duration units ("2d 3h"): changing them is a style choice, so it waits for a decision.
• High-contrast colours for charts.
• The whole index is reloaded after each walk.
• The hover dot sits slightly off the averaged line on long ranges.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NFFCwGNZt9EaKWfAt9JXjp

[wbgcoding]

Merged into main as 760d50b (squashed), with follow-up fixes on top.