feat: update mcode-usage-monitor to 1.3.0 and add a usage-query skill

[yanhy2000]

Updates plugins/yanhy2000/mcode-usage-monitor/ from 1.2.0 to 1.3.0. Plugin ID, package layout, data sources and privacy behaviour are unchanged.

What changed

Filtering

• The model and session lists now cross-filter each other: each list narrows to what the other side selected, and shows its full range list when the other side is set to all. This stops a session from looking like it used several models at once.
• A selection that the other filter temporarily hides is kept instead of being dropped, and the dropdown reports how many are hidden.
• Select-all is dimmed only when everything is selected, invert is always available, and selecting nothing is allowed (the page then shows zero data).

Interface

• Icon-only header controls (theme, refresh interval, manual refresh). Every card can be collapsed and expanded, and the layout editor reorders or removes both the KPI tiles and the cards, remembering the arrangement.
• The model comparison card gained an empty state; the recent-calls table escapes its values; toasts no longer cover the header icons; Esc closes dropdown panels.

Agent skill (new)

• The package now ships one Agent skill, skills/usage-query/. It teaches the Agent to locate and run the bundled data backend (miniapp/node/api.py), so usage questions — "how many tokens did this chat use?", "which model do I use most?" — can be answered directly without opening the dashboard first. It documents the parameters, the JSON field map, the counting rules, and failure handling, and points back to the dashboard when charts or hands-on filtering are wanted.
• exampleQueries was rewritten to cover four entry points: opening the dashboard, this conversation's usage, a specific time range, and a per-model question.
• README.md / README.zh-CN.md document the skill and add it to the verified list.

Robustness

• Dropdown panels are no longer rebuilt by auto-refresh while open, so a click in progress is not lost.
• Data loading is decoupled from the chart library: KPI tiles and the table render immediately, charts follow once ECharts is ready (bounded wait).
• fetch has an in-flight guard and a 35 s abort, so slow queries no longer pile up and a hung connection cannot block refresh.
• Preferences are written atomically and serialized; the query cache has a size cap; keep-alive timeouts are raised to avoid a 5 s idle-close race.
• Python is probed as python then py -3, and a missing SQLite JSON1 extension is reported together with its SQLite version.
• Snapshot fallback no longer leaks temporary directories; unused payload fields were removed.

Test environment

• MiniMax Code desktop 3.1.0 on Windows (10.0.26200, x64), Python 3.10.10 / SQLite 3.39.4, Node.js 24.18. The dashboard and the bundled skill were re-tested on this release.
• npm run validate on this branch: 0 errors, 2 warnings (explained below).
• Backend: cross-filtering verified against /api/data — selecting models narrows the session list to the sessions that used them while the model list stays complete, selecting sessions narrows the model list the same way, per-session totals match a single-session query, and the explicit empty selection returns zero rows.
• Frontend, in a browser: hidden selections survive later checkbox changes and the hidden-count hint appears; a dropdown stays interactive across an auto-refresh; Esc closes panels; the model comparison empty state renders; the footer shows the version injected from plugin.json; prefs.json stays valid after repeated filter changes.
• Agent skill: verified end to end on this machine by asking usage questions in a conversation — the Agent finds the backend, runs the documented command, and answers from the JSON. The field names in SKILL.md were checked against the real payload (today: 881 calls, 16 sessions, 147.1M tokens, 97.8% cache hit rate).
• Preview image regenerated from a synthetic local database (a fabricated runtime-state.sqlite plus fabricated messages.jsonl files, injected through MINIMAX_DATA_DIR). It contains no real session records, project names or personal data.
• Diff checked before pushing: no secrets, no real data, no local paths.

Not verified: macOS and Linux; the py -3 probe fallback (the primary python command is available here); a Python build without the SQLite JSON1 extension; and the keep-alive / fetch-abort fixes are preventive — they were not reproduced under sustained load.

Warnings

npm run validate reports two README_HEADING_MISSING warnings:

warning README_HEADING_MISSING README.md should contain the heading "## Tested environment"
warning README_HEADING_MISSING README.md should contain the heading "## Data & access"

This package's README has used ## Data access and counting and ## Source and verification since 1.1.0 and carries the same information. The headings were left as they are to keep the README stable across releases; happy to rename them to the example's wording if you prefer.

---

中文摘要：mcode-usage-monitor 由 1.2.0 更新至 1.3.0。模型与会话筛选改为互相牵制（各侧只列出另一侧所选范围内出现过的项），被另一侧暂时隐藏的已选项不再丢失；顶栏改为图标按钮并加入编辑布局；新增内置技能 usage-query，Agent 可直接调用包内数据后端回答用量问题，不必先打开看板，示例问法同步覆盖打开看板 / 本对话用量 / 时间范围 / 模型维度四类；同时修复下拉被自动刷新打断、取数依赖图表库、请求堆积、偏好写入非原子等问题。插件 ID、数据来源与隐私行为不变，预览图已用合成数据重新生成。已在 Windows 桌面端 3.1.0 正式版实测（看板与内置技能均通过）；macOS/Linux 与部分防御性改动未验证。

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[MyPrototypeWhat]

感谢更新！1.3.0 的交叉筛选和布局编辑思路很清楚。我在本地拉了这个分支，npm run check 通过；另外用一个合成的 sqlite 跑了 api.py，交叉筛选、__none__ 全不选和 99.99% 封顶都和描述一致。有几处想请你看看：

需要修改

1. 在途闸会吞掉筛选变更后的那次加载（miniapp/client/index.html:713，详见行内评论）：筛选或时间范围变化时，如果恰好有一轮自动刷新还没返回，新的 load() 会被直接丢掉，页面显示的是旧筛选的数据；在手动刷新模式下会一直停在旧数据。
2. 新增的子进程命令没有在 README 里披露（miniapp/node/server.mjs:12-25，详见行内评论）：py -3 回退和启动时的 --version 探测是这次新加的，docs/security.md 要求 "Disclose every command in the README"。
3. 技能文档在 macOS/Linux 上给的命令不对（skills/usage-query/SKILL.md:30、46–50、84，详见行内评论）：示例统一写的是 python，但服务端在非 Windows 上先试 python3，而 macOS 默认没有 python 命令。

建议（可选）

• server.mjs:25 的 pickPython() 在模块加载时同步执行 spawnSync，最坏情况会阻塞两次 5 秒超时，而且页面还没查询就先起了进程。可以考虑改成第一次查询时再异步探测，并缓存结果。
• "全不选"目前有 null、[]、'none'（偏好）、'__none__'（URL 和 CLI）几种表示，分散在 index.html、server.mjs、api.py 三处，以后改语义要动好几个地方。统一成一种哨兵值或一个小结构会更好维护。
• startKpiDrag 和 startCardDrag 的拖拽处理几乎一样，可以抽成一个公共函数。KPI_KEYS 和 PREF_KPIS 这两份列表也可以考虑像 __VERSION__ 那样由服务端注入，省得手动同步。

再次感谢，有问题随时交流～

[yanhy2000]

修改需求与建议均已改好，提交在 836a23f

1. 在途闸拆成了 load() / reload()。改筛选、切时间范围走 reload()，取消在途请求、直接发最新的；自动刷新和首次加载还是 load()，在途就跳过（URL 一样，没必要打断）。加了序号，只有最新一次的结果会上屏，被取代的旧请求不再弹提示了。
2. README 加了 Processes 一节，启动时的 --version 探测和每次查询的 api.py 命令都列上了。
3. SKILL.md 改成先给按平台的候选顺序，示例统一用 占位，macOS 上不会再照着 python 调用直接失败了。

关于建议部分：

1. pickPython() 挪到第一次查询时异步探测并缓存，不再卡在模块加载。
2. 拖拽抽成了 startSortDrag + moveInOrder，KPI 和卡片共用一份。
3. KPI_KEYS / CARD_IDS 改由 server.mjs 注入，跟 VERSION 一个机制。哨兵值先在三个文件里各提成了同名常量，没动偏好文件格式。

已在本地跑npm run validate与实装测试验证

[MyPrototypeWhat]

感谢这么快就改好了！我在本地拉了 836a23f 复测，npm run check 通过：

• 在途闸：自动刷新或手动刷新在途时改筛选、切范围，渲染的都是最新选择，被取代的请求不再弹提示；真正的网络失败和 35s 超时仍有提示。
• README 的 Processes 一节和实际执行的命令一致。
• SKILL.md 的跨平台说明没问题。
• 异步探测在并发首查时只探测一次。

需要修改

1. 拖拽往后挪会多挪一格（miniapp/client/index.html:1131-1134，详见行内评论）：moveInOrder 在去掉被拖项之前就取了目标的下标，KPI 方块和卡片往后拖都会落到目标的下一位；往前拖不受影响。这是这次合并拖拽代码时引入的，之前的两份实现都是对的。

建议（可选）

• reload() 目前只取消了浏览器端的请求，被取消的查询仍会在服务端串行队列里跑完，新查询排在它后面。查询慢时，切换筛选的等待其实没有缩短。可以考虑在请求 close 时结束对应的子进程，或者跳过还没开始的排队项。不改也不影响正确性。

改完这一处我这边就没有其他问题了，谢谢！

[yanhy2000]

两处都改好了，提交至 3d54f95

1. moveInOrder 改成先 filter 再取下标，往前往后都对齐目标了，已经过实装后测试。
2. 服务端也加了取消：请求断开时，还在排队的直接跳过，已经跑起来的就结束子进程，新查询不用再排在死请求后面。多个请求共用同一条查询时按等待计数，全断了才取消。

另外这次自测还发现两个问题一起修了：整行卡片的拖拽前后判定实际一直在按左右半区算（跨行分支是死代码），会导致手感很奇怪，目前改成按上下半区判定；工具卡片的滚动图例翻页按钮配色不跟主题、翻页和选中状态每 5s 被刷新清掉，换成了自绘色块图例，直接内联显示占比、点击切换工具显示。

[MyPrototypeWhat]

感谢这几轮细致的修改！我在本地拉了 3d54f95 复测，npm run check 通过：

• 拖拽排序：KPI 方块和卡片往前、往后拖都落在正确位置；整行卡片按上下半区、半宽卡片按左右半区判定，宽屏和单列布局下都正常。
• 服务端取消：排队中断开的查询不再起进程；运行中断开会结束子进程，后面的查询马上开始；多个请求共用一条查询时，只断开一个不影响另一个拿结果，全部断开才取消；取消后同一查询再请求能拿到完整结果，没有异常日志或残留进程。
• 工具图例：占比正确，点击切换后经过自动刷新状态也保持；工具名会被转义；浅色、深色主题下显示都正常。

一个不阻塞的小点（可选）：server.mjs:275 被取消的旧查询稍后 reject 时会按 key 删掉缓存里已经换上的新查询，导致同一查询紧接着再请求时会重复跑一遍。改成 if (cache.get(key) === entry) cache.delete(key); 就可以了。

辛苦了！