Release v1.2.3

Author: phuryn

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## v1.2.3 — 2026-05-30
+
+### Extension
+
+- Fixed CSV export (Download CSV buttons / "Download CSV to see all" links) not working inside the VS Code webview. The dashboard iframe's sandbox was missing `allow-downloads`, so Chromium silently blocked the Blob download; added the token. Keeps the export client-side, so it still respects the current model/range/sort filters.
+- The extension no longer pops a system browser tab when opening the dashboard — it passes the new `--no-browser` flag to the bundled `cli.py dashboard`. Running `python cli.py dashboard` as a script still opens the browser as before.
+- Matched the webview's pre-load / behind-iframe background to the dashboard (`#191A1B`), removing the brief `#0f1117` flash before the dashboard renders.
+
+### Scanner / CLI
+
+- Added a `--no-browser` flag to `cli.py dashboard` to start the server without opening a browser (used by the VS Code extension; standalone CLI usage is unchanged).
+
 ## v1.2.2 — 2026-05-30
 
 ### Dashboard

cli.py

@@ -357,11 +357,7 @@ def cmd_stats():
     conn.close()
 
 
-def cmd_dashboard(projects_dir=None, host=None, port=None):
-    import webbrowser
-    import threading
-    import time
-
+def cmd_dashboard(projects_dir=None, host=None, port=None, no_browser=False):
     print("Running scan first...")
     cmd_scan(projects_dir=projects_dir)
 
@@ -371,12 +367,19 @@ def cmd_dashboard(projects_dir=None, host=None, port=None):
     host = host or os.environ.get("HOST", "localhost")
     port = int(port or os.environ.get("PORT", "8080"))
 
-    def open_browser():
-        time.sleep(1.0)
-        webbrowser.open(f"http://{host}:{port}")
+    # Open a browser for users running this as a script (see README). The VS Code
+    # extension passes --no-browser since it embeds the dashboard in a webview.
+    if not no_browser:
+        import webbrowser
+        import threading
+        import time
+
+        def open_browser():
+            time.sleep(1.0)
+            webbrowser.open(f"http://{host}:{port}")
+
+        threading.Thread(target=open_browser, daemon=True).start()
 
-    t = threading.Thread(target=open_browser, daemon=True)
-    t.start()
     serve(host=host, port=port)
 
 
@@ -390,8 +393,8 @@ def open_browser():
   python cli.py today                        Show today's usage summary
   python cli.py week                         Show last 7 days (per-day + by-model)
   python cli.py stats                        Show all-time statistics
-  python cli.py dashboard [--projects-dir PATH] [--host HOST] [--port PORT]
-                                                 Scan + start dashboard
+  python cli.py dashboard [--projects-dir PATH] [--host HOST] [--port PORT] [--no-browser]
+                                                 Scan + start dashboard (opens a browser unless --no-browser)
 """
 
 COMMANDS = {
@@ -423,6 +426,7 @@ def parse_named_arg(args, flag):
             projects_dir=projects_dir,
             host=parse_named_arg(rest, "--host"),
             port=parse_named_arg(rest, "--port"),
+            no_browser="--no-browser" in rest,
         )
     elif command == "scan" and projects_dir:
         cmd_scan(projects_dir=projects_dir)

tests/test_cli.py

@@ -1,6 +1,10 @@
 """Tests for cli.py - pricing, formatting, and cost calculation."""
 
+import io
 import unittest
+from contextlib import redirect_stdout
+from unittest import mock
+import cli
 from cli import get_pricing, calc_cost, fmt, fmt_cost, PRICING
 
 
@@ -164,5 +168,18 @@ def test_haiku_pricing(self):
             self.assertEqual(p["output"], 5.00, f"{model} output price wrong")
 
 
+class TestDashboardNoBrowser(unittest.TestCase):
+    """The VS Code extension passes --no-browser; CLI users get a browser."""
+
+    def test_no_browser_suppresses_webbrowser(self):
+        with mock.patch.object(cli, "cmd_scan"), \
+             mock.patch("dashboard.serve") as mock_serve, \
+             mock.patch("webbrowser.open") as mock_open, \
+             redirect_stdout(io.StringIO()):
+            cli.cmd_dashboard(host="127.0.0.1", port=9999, no_browser=True)
+            mock_open.assert_not_called()
+            mock_serve.assert_called_once()
+
+
 if __name__ == "__main__":
     unittest.main()

vscode-extension/package-lock.json

@@ -2,7 +2,7 @@
   "name": "claude-usage-phuryn",
   "displayName": "Claude Code Usage by Paweł Huryn",
   "description": "Embed your Claude Code usage dashboard (token counts, costs, sessions, projects) directly inside VS Code. Reads local JSONL transcripts, no API calls.",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "publisher": "PawelHuryn",
   "author": {
     "name": "Paweł Huryn",

vscode-extension/package.json

@@ -111,7 +111,9 @@ class Extension {
     // Probe a dashboard-specific endpoint so we don't get fooled by some
     // other localhost service listening on the same port.
     const probeUrl = `http://${host}:${port}/api/data`;
-    const spawnArgs = dashboardSpawnArgs(mode, python, ["--host", host, "--port", String(port)]);
+    // --no-browser: the dashboard is embedded in the webview, so the bundled
+    // cli.py must not also pop a system browser (it does by default for CLI users).
+    const spawnArgs = dashboardSpawnArgs(mode, python, ["--no-browser", "--host", host, "--port", String(port)]);
     if (!spawnArgs) {
       const msg = "Could not assemble a valid command to spawn the dashboard.";
       this.output.appendLine(msg);

vscode-extension/src/extension.ts

@@ -13,6 +13,10 @@ import { ServerManager } from "./server-manager";
  * We rely on VS Code's webview Content-Security-Policy. Allowing the
  * dashboard's localhost origin via `frame-src http://127.0.0.1:* http://localhost:*`
  * is enough; the dashboard ships its own CSP for what it loads inside.
+ *
+ * The iframe sandbox includes `allow-downloads` so the dashboard's CSV export
+ * (a Blob + `a.download` click) works inside the webview — without it Chromium
+ * silently blocks the download.
  */
 export function renderHtml(url: string | null, statusText: string, nonce: string): string {
   if (url) {
@@ -24,12 +28,12 @@ export function renderHtml(url: string | null, statusText: string, nonce: string
       content="default-src 'none'; frame-src http://127.0.0.1:* http://localhost:*; style-src 'unsafe-inline'; script-src 'nonce-${nonce}';">
 <title>Claude Usage</title>
 <style>
-  html, body { margin: 0; padding: 0; height: 100%; background: #0f1117; }
+  html, body { margin: 0; padding: 0; height: 100%; background: #191A1B; }
   iframe { border: 0; width: 100%; height: 100vh; display: block; }
 </style>
 </head>
 <body>
-<iframe src="${escapeHtml(url)}" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>
+<iframe src="${escapeHtml(url)}" sandbox="allow-scripts allow-same-origin allow-forms allow-downloads"></iframe>
 </body>
 </html>`;
   }
@@ -42,7 +46,7 @@ export function renderHtml(url: string | null, statusText: string, nonce: string
       content="default-src 'none'; style-src 'unsafe-inline'; script-src 'nonce-${nonce}';">
 <title>Claude Usage</title>
 <style>
-  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #e2e8f0; background: #0f1117; padding: 24px; line-height: 1.5; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; color: #e2e8f0; background: #191A1B; padding: 24px; line-height: 1.5; }
   h2 { color: #d97757; font-weight: 600; font-size: 14px; text-transform: uppercase; letter-spacing: 0.05em; margin: 0 0 16px; }
   pre { background: #1a1d27; border: 1px solid #2a2d3a; border-radius: 6px; padding: 12px; font-size: 12px; color: #8892a4; white-space: pre-wrap; word-break: break-word; max-width: 100%; }
   p { color: #8892a4; font-size: 13px; }

vscode-extension/src/sidebar.ts

@@ -77,10 +77,11 @@ describe("renderHtml with iframe URL", () => {
     expect(html).toContain(`script-src 'nonce-${NONCE}'`);
   });
 
-  it("sandbox attribute restricts iframe to the minimum needed", () => {
+  it("sandbox grants only what the dashboard needs (incl. downloads for CSV export)", () => {
     const html = renderHtml("http://127.0.0.1:9000/", "", NONCE);
-    expect(html).toContain("sandbox=\"allow-scripts allow-same-origin allow-forms\"");
-    // Specifically NOT allow-popups (the dashboard doesn't open new windows).
+    expect(html).toContain("sandbox=\"allow-scripts allow-same-origin allow-forms allow-downloads\"");
+    // allow-downloads lets the dashboard's CSV export (a Blob + a.download click)
+    // work inside the webview. Specifically NOT allow-popups — it doesn't open windows.
     expect(html).not.toContain("allow-popups");
   });