feat(desktop): 优化用量历史时间筛选与热力图

apps/desktop/src/main/__tests__/sessionsListIncludePinned.test.ts

@@ -52,6 +52,7 @@ const h = vi.hoisted(() => {
 
   return {
     ipcHandle: vi.fn(),
+    assertTrustedAppRendererEvent: vi.fn(),
     logDebug: vi.fn(),
     logInfo: vi.fn(),
     queryResults,
@@ -89,6 +90,9 @@ vi.mock('../agent-island/service.js', () => ({
 vi.mock('../imageCacheStore', () => ({ removeSession: vi.fn() }));
 vi.mock('../messagePersistBroadcaster', () => ({ noteSessionClearBoundary: vi.fn() }));
 vi.mock('../sessionTaskSummary.js', () => ({ backfillPinnedSessionSummaries: vi.fn() }));
+vi.mock('../security/trustedAppRenderer.js', () => ({
+  assertTrustedAppRendererEvent: h.assertTrustedAppRendererEvent,
+}));
 
 import { registerSessionIpc } from '../localDb/ipc/sessions.js';
 
@@ -195,6 +199,59 @@ describe('local-db:sessions:list includePinned', () => {
     expect(h.queryResults).toHaveLength(1);
   });
 
+  it('returns the full sessions set for the usage-history query without message projections', async () => {
+    const handler = sessionsListHandler();
+    h.queryResults.push([
+      sessionRow('recent', { totalTokenUsage: 20 }),
+      sessionRow('old', { totalTokenUsage: 200 }),
+    ]);
+
+    const result = await handler({}, 20, 'all', { usageHistory: true });
+
+    expect(result.map((s) => s.id)).toEqual(['recent', 'old']);
+    expect(result[0]).toEqual({
+      id: 'recent',
+      title: 'recent',
+      model: 'sonnet',
+      providerId: null,
+      totalTokenUsage: 20,
+      contextTokens: 0,
+      contextWindow: 0,
+      userSendAt: null,
+      updatedAt: new Date(1_700_000_000_000).toISOString(),
+    });
+    expect(result[0]).not.toHaveProperty('workingDir');
+    const selectCalls = h.fakeDb.select.mock.calls as unknown as Array<unknown[]>;
+    const projection = selectCalls[0]?.[0] as Record<string, unknown> | undefined;
+    expect(Object.keys(projection ?? {})).toEqual([
+      'id',
+      'title',
+      'model',
+      'providerId',
+      'totalTokenUsage',
+      'contextTokens',
+      'contextWindow',
+      'userSendAt',
+      'updatedAt',
+    ]);
+    expect(h.fakeDb.select).toHaveBeenCalledTimes(1);
+    expect(h.listQuery).not.toHaveBeenCalled();
+    expect(h.queryResults).toHaveLength(0);
+    expect(h.assertTrustedAppRendererEvent).toHaveBeenCalledWith({});
+  });
+
+  it('rejects an untrusted renderer before running the unbounded usage-history query', async () => {
+    const handler = sessionsListHandler();
+    h.assertTrustedAppRendererEvent.mockImplementationOnce(() => {
+      throw new Error('[PERMISSION_DENIED]');
+    });
+
+    await expect(handler({}, 20, 'all', { usageHistory: true })).rejects.toThrow(
+      '[PERMISSION_DENIED]',
+    );
+    expect(h.fakeDb.select).not.toHaveBeenCalled();
+  });
+
   it('also includes pinned rows for the all-status bucket used by mobile detail filters', async () => {
     const handler = sessionsListHandler();
     h.queryResults.push(