v5.11.51

Dashboard docs

The bookmarkable URL at localhost:24842 only exists after setup-daemon has been run, but the README and dashboard skill presented it unconditionally as "always current". Users who never ran setup-daemon got ERR_CONNECTION_REFUSED from the one thing the docs told them to bookmark. The skill now probes daemon-status before mentioning any URL.

Docs also stopped hardcoding the dashboard file path. measure.py resolves SNAPSHOT_DIR three ways (env override, plugin data dir, legacy _backups), so no literal is correct for every install; phase0-setup.md even labelled the legacy path "(always works)" when plugin-marketplace installs never write there.

OpenCode: global data directory (opencode 1.1.0)

Session DBs and trends.db were written into {project}/token-optimizer/, polluting repos and preventing cross-project trend aggregation. Data now lives in the platform-global location, overridable via TOKEN_OPTIMIZER_DATA_DIR or PluginOptions.dataDir, with session DBs scoped per project.

Existing data migrates automatically. Migration is non-destructive (copies, leaving originals recoverable), runs once behind an atomic lock, copies WAL sidecars alongside each database, and writes via temp-file plus rename so a crash cannot leave a truncated DB.

Problem reported by @cawa0505 in #90; addresses #94.

Security

• All migration filesystem checks use lstat. Following symlinks would let a repo ship trends.db -> ../../../../.ssh/id_ed25519 and have it copied into the data directory on plugin init.
• Project slugs append a SHA-256 prefix. The readable slug alone collapsed client-a, client.a and client_a onto one value, and the slug is the only boundary between projects in a shared data directory.