release: v3.5.4 — Apache 2.0 attribution shipped to npm (#120)

Apache 2.0 attribution release. Adds THIRD_PARTY_LICENSES (already merged in #116) to the npm tarball. No behavior changes; cache-fix overall remains MIT.

Closes #115. Approved by Lead and Codex.

Author: vsits-proxy-builder[bot]

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [3.5.4] - 2026-05-09
+
+### Added
+
+- **`THIRD_PARTY_LICENSES`: Apache 2.0 attribution for the NDJSON proxy log schema (#116, closes #115).** The schema used by `tools/usage-to-dashboard-ndjson.mjs` (field names, structure, `proxy-YYYY-MM-DD.ndjson` file naming convention, `cache_health` semantics, and `cost_factor` methodology) originates from [@fgrosswig](https://github.com/fgrosswig)'s [claude-usage-dashboard](https://github.com/fgrosswig/claude-usage-dashboard) (Apache License 2.0). This release adds the formal Section 4 attribution as a `THIRD_PARTY_LICENSES` file and ensures it ships in the npm tarball via the `package.json` `files` array. cache-fix overall remains MIT-licensed; only the NDJSON schema portion is governed by Apache 2.0. Reported and authored by [@fgrosswig](https://github.com/fgrosswig); the `package.json` packaging fix was pushed to his branch via maintainer-edits. Thank you, Falk.
+
+### Changed
+
+- `tools/usage-to-dashboard-ndjson.mjs`: file header acknowledges the Apache 2.0 origin of the NDJSON schema portion (the rest of the file remains under cache-fix's MIT license per the repo `LICENSE`).
+
 ## [3.5.3] - 2026-05-08
 
 ### Fixed

docs/code-reviews/release-v3.5.4-codex-review-2026-05-09.md

@@ -0,0 +1,26 @@
+# Review: release v3.5.4
+
+Date: 2026-05-09
+Reviewed: PR #120 / commit 287091b598e554d435ad3c79cbcc12f4ae28e0bc
+Label applied: reviewed-by-codex-agent, approved-by-codex-agent
+
+## What Is Correct
+- `git log --oneline v3.5.3..HEAD` shows one user-facing change since `v3.5.3`: #116 (Apache 2.0 attribution plus npm tarball packaging fix). The other two commits in range, #117 and #118, are internal/operator-only and are correctly omitted from `CHANGELOG.md`.
+- The version bump from `3.5.3` to `3.5.4` is scoped correctly as a patch release: attribution/documentation, npm packaging, and no behavior, API, env-var, or compatibility changes.
+- `git show --stat 287091b` is clean and limited to `CHANGELOG.md` and `package.json`; `package-lock.json` is not tracked and is not part of the release commit.
+- `git show 287091b -- proxy/extensions.json` is empty, confirming the visits-01 local `usage-log` / `rate-limit-log` enablement is not present in this release commit.
+- The new `## [3.5.4]` changelog entry matches what shipped in #116: `#115` and `#116` are the right references, `@fgrosswig` is the PR author, the maintainer-edit packaging fix is accurately reflected by commit `4f4773a`, and the license language correctly scopes Apache 2.0 to the NDJSON schema portion while the repo overall remains MIT.
+- `npm pack --dry-run` includes `THIRD_PARTY_LICENSES` in the tarball contents.
+- `npm test` passes at this commit: 788 tests, 788 passing, 0 failing.
+
+## Blockers
+None
+
+## What Needs Attention
+- None.
+
+## Recommendations
+- Merge and publish `v3.5.4` as the npm carrier release for the already-merged #116 attribution work.
+
+## Bottom Line
+Ship it. This release-prep PR accurately packages the previously merged Apache 2.0 attribution work for npm users, the changelog is complete and correctly scoped, the release commit is clean, and the branch passes both tarball and test verification.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-cache-fix",
-  "version": "3.5.3",
+  "version": "3.5.4",
   "description": "Cache optimization proxy and interceptor for Claude Code. Fixes prompt cache bugs, stabilizes prefix, reduces quota burn.",
   "type": "module",
   "exports": "./preload.mjs",