v1.4.0

新增

• 外观设置弹窗（顶栏 ⚙ 按钮）：主题配色改成可视化色块网格（10 个主题各自的
  强调色圆点 + 高亮选中态），新增界面字体（系统默认/等宽/衬线/圆体）和
  界面字号（12～18px 滑块）两个之前完全没有的设置项，弹窗里带实时预览文字，
  两个新设置存 localStorage，刷新后保留；原来顶栏那个主题下拉框还在，两边保持
  同步，不是二选一的替换关系。
• 单次额度（5 小时窗口）改成显示"剩余百分比"（原来是"已使用"），颜色换成
  conky 风格的分段色阶——5% 以下很红、85% 以上很绿，中间每 10% 一档，固定鲜艳色值，
  不跟主题走（这是专门给这一个进度条用的，跟其它额度条的连续渐变是两套独立配色）。
  其它额度条（周额度全部模型/Sonnet/Opus/Fable）颜色改成红→黄→绿连续渐变，换算
  成"健康度"（已用越多越红），渐变的三个锚点直接读当前主题的 --red/--yellow/
  --green，换主题这套颜色也跟着联动。所有额度卡片的文字标签都补上"已用"/"剩余"
  前缀，不会再看不出这个百分比到底是哪个方向。
• Fable 模型的额度信息：Anthropic 的用量接口没有给 Fable 专门的顶层字段（不像
  Opus/Sonnet 那样有 seven_day_opus/seven_day_sonnet），额度只挂在 limits[]
  里一条 kind="weekly_scoped" 的记录上——现在会动态从这条记录里摘取模型名和额度，
  不写死"Fable"，以后 Anthropic 加别的按模型限额也能自动跟着显示出来。
• 状态信息页新增"模型使用统计"表格：按模型（Sonnet/Opus/…）汇总所有已监测会话
  的 token 用量（输入/输出/缓存/总计），同一 session 中途换过模型的话分开算。
• 状态信息页新增"额度明细（limits）"表格（跟首页那份同一份数据），进度条也用
  加长加粗的版本；"重置时间"那一列新增一条紫色的"这个窗口已经过去多少"进度条。
• 状态信息页会话状态行新增"上下文窗口使用率"和"Context compaction 次数"：前者
  是当前对话实际带着的上下文大小占比，按 200K 标准上下文窗口估算（Claude Code 只在
  它自己的 statusLine 输入里才带精确窗口大小，我们的 hooks 拿不到，这是近似值，
  UI 上用 hover 提示说清楚）；后者是真的从 transcript 里检测
  type=system, subtype=compact_boundary 事件数出来的，含自动/手动次数拆分和
  累计精简的 token 数，不是估算。
• 网络流量域名捕获改用 uprobe:libc:getaddrinfo：之前只对连上的 IP 做事后反向
  DNS（PTR 记录），很多云厂商/CDN 出口 IP 根本没配 PTR，反向解析注定拿不到域名
  （实测 Anthropic 自己的 API IP 就是这样）；现在改成在应用层调用 getaddrinfo()
  解析域名的那一刻就用 uprobe 记下来，按 pid 存最近一次问的域名，接到 CONNECT 事件
  时直接查表——域名从连接真正发生之前就已经知道了，不管出口 IP 有没有配 PTR 都能
  拿到（用一个改名成 "claude" 的可执行文件模拟真实调用链，实测抓到了 Cloudflare
  出口 IP 上的 example.com，验证有效）。
• 网络流量页"连接次数"可以点开看明细：每个目标地址一行的连接次数、以及页面
  顶部"总连接次数"/"不同 IP 数"两张汇总卡片，现在都能点开看这个目标/全部目标的
  每次连接时间、发起进程、PID。
• 首页新增"GitHub 操作统计"：git push / git clone / git commit / git pull-fetch
  / gh CLI（PR/Issue/API…）/ 其它 git 操作六张卡片。大部分 git/gh 命令本来就不会
  命中任何规则（不违反任何 policy，压根不会打上 matched_rule），没法像软件安装
  统计那样直接复用规则引擎的判断结果，改成新写一个按子命令分类的识别函数（;/
  &/|/换行 切开分别看开头，避免把 echo "git push 很危险" 这种字符串输出也
  当成真的执行了 git push），注册成 SQLite 自定义函数 cc_github_op()直接在查询
  里用。点开每张卡片能看到具体是哪个 session、哪个文件夹、什么时候、执行的什么
  命令（复用文件操作/软件安装统计已经在用的下钻渲染逻辑）。

修复

• 额度明细（limits）表格里"已使用百分比"和"级别"两列文字重叠——加长版进度条用
  width: 100% 在表格的自动布局里跟其它列打架（百分比宽度的 flex 子元素不参与
  表格列的内在宽度计算，列被判定得很窄，导致条又想撑满又撑不开），改成固定
  220px 宽度，两边都不会再互相挤。
• Log 审计 / Claude Tap 的内容列表容器之前写死 max-width: 900px（明明叫
  ".wide"却限死宽度），宽屏下右边留一大截空白、滚动条也卡在页面中间不上不下，
  去掉这个限制改成撑满可用宽度。
• 首页"Claude Code 运行身份检测"和"Anthropic 账号信息"标题旁边两句冗长的说明
  文字按反馈精简掉了。

---

English

Added

• Appearance settings dialog (⚙ button in the top bar): the color theme picker is now
  a visual swatch grid (each of the 10 themes shown as its own accent-color dot, with an
  active highlight) instead of only a plain dropdown; added interface font (system
  default / monospace / serif / rounded) and interface font size (12–18px slider) —
  neither existed before. The dialog includes a live preview. Both new settings persist to
  localStorage and survive a reload; the original top-bar theme dropdown still works too
  and stays in sync, it's not a replacement.
• Session quota (5-hour window) now shows "remaining %" (was "used"), colored with a
  conky-style stepped palette — very red below 5%, very green above 85%, one fixed vivid
  color step per 10% in between. The other quota bars (weekly all-models/Sonnet/Opus/Fable)
  switched to a continuous red→yellow→green gradient computed from "health" (more used =
  more red), with the three gradient anchors read live from the current theme's
  --red/--yellow/--green tokens so it re-colors on a theme switch. Every quota card's
  label now carries an explicit "Used"/"Remaining" prefix.
• Fable model quota: the usage API has no dedicated top-level field for Fable (unlike
  Opus/Sonnet, which get seven_day_opus/seven_day_sonnet) — its quota only shows up as
  one kind="weekly_scoped" entry inside limits[]. This is now extracted dynamically by
  model name rather than hardcoding "Fable", so any future per-model quota Anthropic adds
  shows up automatically too.
• Model Usage table on the Status page: token usage (input/output/cache/total) summed
  per model (Sonnet/Opus/…) across every monitored session; a session that switched models
  mid-way counts separately per model.
• Limits table on the Status page (same data as the Home page's), with a longer, bolder
  progress bar; the "Resets" column gained a purple "how far through this window" progress
  bar.
• Context window usage % and Context compaction count on each session row on the Status
  page: the former is how much context the conversation is actually carrying right now,
  estimated against a standard 200K context window (Claude Code only reports the exact
  window size to its own statusLine input, which our hooks don't receive — this is an
  approximation, called out with a hover hint); the latter is a real detection of
  type=system, subtype=compact_boundary events in the transcript, with auto/manual counts
  split out and cumulative tokens reclaimed — not an estimate.
• Network domain capture switched to uprobe:libc:getaddrinfo: previously relied on
  reverse DNS (a PTR lookup) after the fact, which fails for most cloud/CDN egress IPs that
  never had a PTR record configured (confirmed on Anthropic's own API IP, among others); now
  the actual hostname the application asked to resolve is captured the moment it calls
  getaddrinfo(), keyed by pid, and looked up when the matching CONNECT event fires — the
  domain is known before the connection even happens, regardless of whether the egress IP
  has a PTR record (verified live against a Cloudflare-fronted IP for example.com using an
  executable renamed to "claude" to simulate the real process-tree ancestry check).
• "Connections" is now clickable on the Network tab, both per target-row and on the two
  summary cards ("Total connections" / "Distinct IPs") — opens a detail list of every
  connection's time, originating process, and PID.
• New "GitHub Operations" stats on the Home page: git push / git clone / git commit /
  git pull-fetch / gh CLI (PR/Issue/API…) / other git operations, six cards. Most git/gh
  commands don't violate any policy rule, so they never get a matched_rule and couldn't
  reuse the same trick as the install-ops stats — classification is done with a new
  per-sub-command matcher (split on ;/&/|/newline and check each segment's start, so
  echo "git push is dangerous" doesn't get miscounted as a real git push), registered as
  a SQLite custom function cc_github_op() used directly in the query. Each card drills down
  to the exact session, folder, timestamp, and command (reusing the same detail rendering
  already used by file-ops/install-ops).

Fixed

• The limits table's "Used %" and "Severity" columns visually overlapped — the enlarged
  progress bar used width: 100%, which doesn't participate in a table's automatic column
  sizing (a percentage-width flex child contributes no intrinsic width, so the column was
  sized far too narrow while the bar still tried to fill 100% of it), causing it to spill
  into the next column. Switched to a fixed 220px so neither column crowds the other.
• The Log Audit / Claude Tap content-list containers had a leftover max-width: 900px
  (despite the class being named ".wide") that left a huge dead gutter on wide screens with
  the scrollbar stranded mid-page — removed, now fills the available width.
• Trimmed two overly long hint captions next to "Claude Code identity check" and "Anthropic
  account info" on the Home page.

---

完整更新日志见 CHANGELOG.md （English）。