12 commits

Author	SHA1	Message	Date
Resham Joshi	efac2bfa15	Live quota bar inside AgentTab + Claude OAuth refresh gate (#255) ... * Gate Claude OAuth refresh attempts on terminal failures Anthropic returns invalid_grant (HTTP 400) when the user's refresh token has been revoked or rotated, typically after they re-ran claude login on another device. The previous code rethrew the raw error every refresh cycle, leaving the Plan UI stuck on a Swift error string and pummeling Anthropic's token endpoint forever. The new SubscriptionRefreshGate captures a fingerprint of ~/.claude/.credentials.json on terminal failure and stops trying until that fingerprint changes (the user re-logs-in). Transient 5xx/network failures get exponential backoff capped at 6 hours. Two new SubscriptionError cases let the UI distinguish "user must reconnect" from "Anthropic is flaky right now" and show a clean reconnect CTA instead of raw HTTP guts. * Inline live-quota progress bar inside each AgentTab chip When a provider exposes a live quota source, the AgentTab chip grows by ~3pt to host a thin weekly-utilization bar directly under the label. Hovering the chip reveals a popover with all four Anthropic windows (5-hour, weekly, weekly Opus, weekly Sonnet) plus reset countdowns. Click still switches the tab as before. Today only Claude has a quota source (the existing /api/oauth/usage path); other providers' chips render unchanged. The QuotaSummary abstraction lets us bolt on Cursor/Copilot/Codex meters in follow-up commits. Subscription is now refreshed eagerly on the periodic loop so the bar lights up without forcing the user to open a deep view first. The previous SubscriptionRefreshGate keeps a dead refresh token from spamming Anthropic. Adds two new SubscriptionLoadState cases (terminalFailure, transientFailure) so the deep Plan view shows a "reconnect" message instead of a raw Swift error string when the user's claude login expired. * Replace SubscriptionClient with credential-store + service architecture The previous SubscriptionClient never persisted refreshed access tokens, so every 30s tick read the expired token from Keychain, refreshed it (1 call), fetched usage with the new token (2nd call), and threw the new token away — 3 API calls per cycle, which burned through Anthropic's per-account rate budget and produced the 429s and `invalid_grant` loops users were seeing. The replacement mirrors CodexBar's proven pattern: - ClaudeCredentialStore owns the credential lifecycle. Bootstrap is strictly user-initiated (Connect button in the Plan tab); the menubar does not touch Claude's keychain at startup. After bootstrap, refreshed tokens — including rotated refresh tokens — are persisted to a local cache file under ~/Library/Application Support/CodeBurn (mode 0600). Using a file instead of our own keychain item means rebuild signature changes don't trigger a startup keychain prompt; the only prompt the user ever sees is the one for Claude Code-credentials on Connect. - ClaudeUsageFetcher (folded into the service) is a pure /api/oauth/usage call with one allowed 401-recovery roundtrip. 429s record an explicit backoff window honouring Retry-After. - ClaudeSubscriptionService orchestrates bootstrap / refresh / disconnect, applies the 429 backoff, and surfaces terminal vs transient failures so the UI can show the right CTA. - Reading Claude's keychain now tries the entry keyed by NSUserName() first and falls back to the unscoped query, so users who re-ran /login and ended up with two Claude Code-credentials items pick up the fresh one. This was the actual cause of "I logged in but the menubar still shows stale data". User-facing additions: - A proper Settings window (right-click → Settings…) with General / Claude / About tabs. Provider quota cadence is configurable (Manual / 1m / 2m / 5m / 15m). New providers plug in as additional tabs. - Plan tab: notBootstrapped → "Connect Claude subscription" CTA; terminalFailure → "Reconnect Claude" with the correct /login instruction for Claude Code 2.1; transientFailure preserves the last loaded view with a retrying badge. - AgentTab quota bar slot is always reserved so chip height doesn't jitter when the user connects for the first time. Hover popover has 250ms enter / 150ms exit debounce so swiping across chips doesn't pop a popover for every chip touched. - Disconnect requires confirmation, clears capacityEstimates and the subscription snapshot store so a reconnect under a different account doesn't surface "Based on last cycle" projections from the old account. Validator findings applied: cadence anchor only updates on successful refresh (not every attempt), refresh-token rotation persists in memory before keychain write so a write failure doesn't lock the user out, server error bodies are sanitized (token redaction + 240-char cap) before they reach the UI or NSLog, and Refresh Now refreshes both the menubar payload and quota. * Add Codex live quota + multi-provider warning, with validator fixes CodexCredentialStore reads ~/.codex/auth.json (ChatGPT-mode only) on user-initiated Connect, caches under Application Support like Claude. CodexSubscriptionService hits chatgpt.com/backend-api/wham/usage with the bearer token + ChatGPT-Account-Id header, parses primary/secondary windows, additional per-model rate limits (e.g. GPT-5.3-Codex-Spark), and credits balance with a Double-or-String fallback. Plan-tier enum captures the full ChatGPT plan list including prolite, free_workspace, education, quorum, k12, plus an unknown(String) case that preserves the raw plan name when OpenAI ships a tier we haven't mapped yet. Multi-provider warning system: - Menubar flame tints from neutral to yellow (70%) → orange (90%) → red (100%) based on the worst-affected connected provider's worst window. Uses NSImage.SymbolConfiguration palette colors. - Popover header gains a warning row when any provider is at 70%+. "Claude 79% of quota used", "Claude 79% · Codex 92%", or "Claude over limit (105%)" when severity hits .danger. - Hover popover gains a plan-name badge in the top-right corner so users know which subscription is feeding the bar. - Codex chip surfaces the credits balance and any non-zero per-model additional rate limits as footer rows. Validator fixes applied in the same commit: - Provider-specific reconnect / disconnected copy in QuotaDetailPopover (was hardcoded to Claude). - Generation-token guard on refreshSubscriptionReportingSuccess and refreshCodexReportingSuccess so a Disconnect during an in-flight fetch can't resume after the await and re-populate the cleared state. - Codex codexQuotaSummary promotes secondary to primary when only one window is returned, so free / guest tiers don't render an empty bar. - Memory-cache TTL is now actually consulted in currentRecord (the isFresh check was dead code, leaving cached records valid forever). - sanitizeForUI now redacts OpenAI sk-* keys, JWT tokens, and Bearer headers in addition to Claude sk-ant-*. - Removed diagnostic NSLog that wrote raw chatgpt.com response bodies to the unified log. - Codex Connect / Reconnect copy in Settings explains the auth.json prerequisite and the API-key vs ChatGPT-mode distinction. - Disconnect dialogs now state explicitly that the auth.json / credentials keychain entry is left untouched. - Plan badge in the popover gets line-limit + truncation + max-width so a long unknown plan name can't overflow the row. - Renamed shadowing `let max` to `let worst` in aggregateQuotaStatus. * Add Codex Plan tab + size plan badge to content The Plan tab is now visible when the Codex chip is selected, mirroring the Claude tab's deep view. CodexPlanInsight renders the user's plan tier ("Pro Lite", "Plus", etc.), the primary and secondary rate-limit windows with reset countdowns, and any non-zero per-model additional limits (e.g. GPT-5.3-Codex-Spark) so power users see them. The "On pace at reset" projection that Claude's Plan view shows is not included here — that math feeds from local Claude per-message spend extrapolated against API quota windows, and our local Codex spend is not a 1:1 signal for the ChatGPT-subscription rate windows reported by wham/usage. Wiring a Codex extrapolator is a follow-up. Drop the maxWidth=90 frame on the plan badge in the hover popover. It was stretching short labels like "Pro Lite" to fill the full 90pt slot; fixedSize makes the badge hug the text. Plan names are bounded short strings, so truncation is a non-issue in practice.	2026-05-06 19:57:17 -07:00
Resham Joshi	afd0ee7011	Validator hardenings on the bug-hunt batch (#254) ... * Five correctness fixes from multi-agent bug hunt A multi-agent audit of the codeburn correctness surface found five real bugs each producing visibly wrong numbers or risking data loss. All five fixes were validated by parallel review agents and exercised end-to-end against real session data on this machine. - src/cli.ts: --refresh <seconds> was using bare parseInt as the commander callback. Commander invokes the callback as parseInt(value, previous), so previous becomes the radix: --refresh 30 was being parsed as parseInt('30', 30) = 90, and --refresh 60 became NaN. Replaced with parseInteger (already defined at line 48 with radix locked to 10) at all three sites. - src/providers/cursor.ts: parseAgentKv was timestamping every agentKv call as new Date().toISOString() because the Cursor SQLite schema has no per-message timestamp. Result: every Cursor agent call regardless of when it happened landed in today's date bucket. Now uses statSync(dbPath).mtimeMs as a bounded ceiling so calls land at the actual last-write time of the Cursor database, not today. Verified locally: a 1904-call Cursor history with March 22 mtime now correctly bucket into all-time only and shows 0 calls for today/week/30days. - src/providers/codex.ts: prev token counters were only updated inside the cumulative-fallback branch, so a session emitting N events with last_token_usage followed by one cumulative-only event computed the next delta against prev=0 and double-counted the entire cumulative window. Cost could be inflated 10-100x for any mixed-format Codex session. Now prev advances to the current cumulative state regardless of which branch ran. - src/providers/gemini.ts: totalOutput accumulated output+thoughts while totalThoughts was tracked separately. The result was outputTokens = output+thoughts AND reasoningTokens = thoughts; any consumer summing the two double-counted thoughts. Now totalOutput holds just output, reasoningTokens holds thoughts, and the cost calc folds thoughts into the output count to keep pricing correct (Google bills thoughts at the output rate; calculateCost has no reasoning parameter). - src/export.ts: exportJson had no safety check before writeFile, so codeburn export -f json -o ~/important.json would silently clobber the user's file. CSV path had a marker-file guard; JSON did not. Now refuses to overwrite a file unless its first 4KB contain the codeburn schema marker. Uses a streaming partial read so a large existing file does not OOM Node's ~512MB string limit. Refuses directories outright. Skipped intentionally: cursor-auto/copilot-auto/cline-auto/ qwen-auto are aliased to claude-sonnet-4-5. The audit flagged this as wrong pricing for non-Anthropic auto-routed turns, but Cursor's "auto" mode does not expose the actual model and any alternative estimate is equally arbitrary. README already documents this as a Sonnet-based estimate. vitest run: 38 files, 529 tests pass. * Five more correctness fixes from the bug-hunt round This commit closes out the remaining critical-tier findings from the multi-agent audit, with one item documented as a known limitation. - src/providers/cursor.ts: bubble dedup key included mutable inputTokens/outputTokens. Cursor mutates token counts on the row in place when streaming completes, so re-parsing the same DB produced a fresh dedup key per bubble and silently double-counted. Switched to the SQLite row key (`bubbleId:<unique>`) which is stable per bubble. Adjusted BubbleRow type and BUBBLE_QUERY_BASE to expose `key as bubble_key`. - src/providers/pi.ts: usage fields were destructured non-optionally, but real Pi/OMP session files sometimes omit individual fields. `calculateCost(model, undefined, ...)` returned NaN, and that NaN propagated into every aggregate cost total. Coerce each field to 0 with `?? 0`. - src/models.ts: getShortModelName and the getModelCosts startsWith fallback both walked the dictionary in insertion order. A model id like `gpt-5-mini` could resolve to the entry for `gpt-5` (matched by startsWith first) and silently get GPT-5's display name and pricing tier. Iterate longest keys first so more-specific prefixes win. Tightened the cost fallback's match condition from `startsWith(key) || startsWith(key + '-')` to require either an exact match or a `key + '-'` continuation, removing accidental matches like `gpt-50` against `gpt-5`. - src/models.ts: calculateCost returned 0 silently for any model missing from the pricing snapshot. New Anthropic / OpenAI models shipped between snapshot refreshes look free until the user notices. Now warns once per unknown model name per process to stderr. Skips the warning for the `<synthetic>` placeholder so the noise floor stays low. - src/yield.ts: revert detection was broken on the canonical case. Two problems: (1) `subject.toLowerCase().includes('revert')` matched any commit whose subject mentioned the word ("Add revert button" was misclassified). (2) The window logic only counted reverts within the original session's 1-hour boundary, but real `git revert` commits land in later sessions, so original sessions always looked productive. Now: getRevertedShas runs once with `--grep=^This reverts commit` and parses bodies to build a Set of SHAs that were the target of a revert anywhere in history. CommitInfo.wasReverted is set when this commit's SHA appears in that set. categorizeSession then flags a session as reverted when its in-main commits were later reverted, regardless of when the revert itself happened. - src/providers/droid.ts: SKIPPED with comment. Droid records token usage only at session level. The current behavior splits evenly across emitted assistant calls and prices all of them at settings.model (the latest model). For sessions where the user switched models mid-stream, costs are approximate. Added an inline comment documenting this; a real fix requires per-message model data that isn't in the Droid JSONL schema. Verified end-to-end on this machine: - vitest run: 38 files, 529 tests pass - `codeburn report --format json` produces valid JSON - `codeburn yield -p week` runs without crashing, finds 0 reverts in the user's recent git history (plausible — fix changed the detection from "subject contains revert" to "this commit's SHA appears in a later 'This reverts commit ...' body") - Stderr now warns for unknown model ids: `openai/gpt-5.3`, `qwen3.6:35b-a3b-bf16`, `big-pickle`. These previously priced silently at $0. * Four high-severity fixes from the bug-hunt round - src/currency.ts: getExchangeRate wrapped fetchRate and cacheRate in one try/catch. If fetchRate succeeded but cacheRate threw (disk full, ENOSPC, no permissions on the cache dir), the catch block swallowed the error and returned 1. Every cost rendered after that point became USD-equivalent silently. Now the fetch and the cache write live in separate paths: a successful fetch returns the rate even if the persist fails, and the cache-write error is dropped to a fire-and-forget so transient disk problems do not corrupt the user's currency display. - src/cursor-cache.ts: writeFile was non-atomic. Two concurrent codeburn invocations writing to cursor-results.json could interleave bytes mid-write, leaving a truncated file that parsed-error on next read and forced a full SQLite re-scan every run. Switched to the temp-file + rename pattern with a randomized temp name so each writer gets its own staging file and the rename is atomic on POSIX. Crash mid-write also leaves only a leftover temp file, which gets unlinked in the catch path; the destination is never half-written. - mac/.../CodeBurnApp.swift refresh loop on sleep: the loop's Task.sleep keeps a wakeup pending across system sleep, so on wake the natural tick fires the same instant the wake observers do. Combined with didWakeNotification, screensDidWakeNotification, and the launchd com.codeburn.refresh distributed notification, that produced 2-3 concurrent CLI spawns within ms of every wake. Now: willSleepNotification cancels the loop task; didWakeNotification restarts it. The loop also reads lastRefreshTime and skips its natural tick if a wake/manual/distributed-notification refresh ran within the last 5 seconds, coalescing the two sources of refresh into one CLI spawn per wake event. - mac/.../CodeBurnApp.swift observeStore: the read closure had an implicit strong self capture (it accessed store.* without a capture annotation), pinning self for the lifetime of any unfired observation. Added [weak self] and a guard to make the capture explicit. withObservationTracking is one-shot per call, so there is at most one active subscription at a time; the earlier audit's claim of an unbounded leak overstated the issue, but tightening the capture pattern is still cleaner. Verified: - vitest run: 38 files, 529 tests pass - swift build -c release --arch arm64 --arch x86_64: clean, no diagnostics, no MainActor warnings - mac/Scripts/package-app.sh dev produces a valid universal bundle - Menubar launches and runs without crash * Eleven medium-severity fixes from the bug-hunt round - src/format.ts formatTokens: guard against Infinity, NaN, and negative input. Previously a corrupt aggregate could leak into the UI as the literal strings "NaN" or "Infinity". Negatives now render as "0" rather than "-500" with no scaling. - src/cli-date.ts parseDateRangeFlags: the missing-from default was new Date(0), which opened a 55-year scan from 1970 epoch whenever the user passed only --to. Default now anchors at 6 months back from now, matching the dashboard's all-time period. Test updated to assert the new bounded window. - src/cli-date.ts toPeriod: previously fell back silently to "week" for any unknown input, so a typo like `-p mounth` produced a quiet 7-day report while the user thought they were viewing the month. Now exits with a clear stderr error and exit code 1. Test updated to assert the loud-failure behavior. - src/optimize.ts urgencyScore: rebalanced weights so a high-impact finding with zero observed tokens cannot outrank a medium-impact finding with millions of tokens. Old 0.7/0.3 split made high+0 (0.70) beat medium+1B (0.65). New 0.5/0.5 split makes medium+1B (0.75) beat high+0 (0.50). Token normalization lifted to 5M so the ramp covers a realistic spend range. - src/models.ts calculateCost: clamp negative or non-finite token inputs to 0 before pricing. A corrupt JSONL emitting a negative count would otherwise produce a negative cost that silently subtracted from real spend in aggregates. - src/currency.ts convertCost: stop rounding during aggregation. For zero-fraction currencies (JPY, KRW, CLP) this clamped every per-session cost to a whole unit before sum, so a project of 1000 sessions averaging ¥0.4 each aggregated to ¥0 instead of ¥400. formatCost still rounds at the display boundary. - src/config.ts saveConfig: the temp file path was a fixed `${configPath}.tmp` suffix. Two simultaneous saveConfig calls (overlapping menubar and CLI runs) raced on the same staging file and could leave one writer reading partial bytes from the other. Randomized the temp suffix per call. - src/providers/antigravity.ts flushCache: the early return on `!cacheDirty` short-circuited eviction when liveCascadeIds was supplied but no cascade had been added or updated this run. As a result, deleted .pb files persisted in the cache forever once the user stopped writing to it. Eviction now runs whenever liveCascadeIds is provided, marks the cache dirty if anything was removed, and only then short-circuits if there is nothing to write. - src/daily-cache.ts addNewDays: cap retention at 2 years. The days array previously merged forever, growing the cache file by hundreds of bytes per day until JSON parse on every CLI invocation became measurable. The 6-month UI period plus the 365-day BACKFILL_DAYS bootstrap both fit comfortably inside the cap, with headroom for a future longer window. - src/dashboard.tsx useInput: period number keys (1-5) and arrow keys triggered a reload while the compare view was mounted. The parent's data state changed underneath the user with no visual affordance back to the dashboard. Now those keys are gated on view !== 'compare', and `b` / Esc inside compare returns to the dashboard. - mac/.../HeatmapSection.swift formatters: prettyDate, buildTrend Bars, computeTrendStats, computeForecast, and computeAllStats each allocated a fresh DateFormatter (and Calendar) on every call. SwiftUI re-evaluates these views many times per second during hover scrubbing on the trend chart, so the allocations were a measurable hot spot. Lifted the yyyy-MM-dd / "EEE MMM d" / "MMM d" formatters and the gregorian Calendar to fileprivate cached singletons. Two findings from the same bucket were not addressed here: - UpdateChecker SHA-256 / codesign verification is already performed by src/menubar-installer.ts (verifyChecksum at line 85). The Swift side just kicks off `codeburn menubar --force` which runs that path. The audit's claim of missing verification was a misread. - NSDistributedNotificationCenter sender validation: the `com.codeburn.refresh` listener accepts from any sender, but forceRefresh has a 5-second rate-limit gate so the abuse ceiling is one CLI spawn per 5 seconds. Mitigations (Mach IPC, per-launch shared secret) are disproportionate to the impact. vitest run: 38 files, 529 tests pass. swift build -c release: clean, no warnings. * Validator hardenings on the bug-hunt batch Hoist the per-call sort in getModelCosts and getShortModelName to module scope so model lookups on the hot path stop reallocating sorted key arrays. Sanitize the unknown-model stderr warning by stripping C0/C1 controls and capping length, so a hostile or corrupt JSONL cannot inject terminal escape sequences via the model field. Skip the daily-cache prune when newestDate fails to parse. The previous code produced a NaN cutoff and silently dropped every cached day on the next merge. Adds tests locking down the stable resolution of common model names (gpt-5-mini vs gpt-5, claude-haiku-4-5 vs claude-3-5-haiku, etc.) and the prune NaN guard.	2026-05-06 19:50:40 -07:00
iamtoruk	87b660e584	Fix hardcoded $ in forecast comparison text ... The "vs last month" line in the forecast section used a hardcoded $ instead of the user's selected currency symbol and rate. Use asCompactCurrency() which handles both. Closes #197	2026-05-02 16:16:43 -07:00
iamtoruk	39fc05595c	Harden menubar: fix refresh loop, concurrency, data sync, and edge cases ... - Fix refresh loop: proper while loop with 30s sleep and force:true instead of single-fire Task that never repeated - Fix loading overlay: counter-based isLoading so concurrent fetches don't flicker the overlay on/off - Fix rapid tab switching: cancel previous switchTask, check Task.isCancelled after CLI returns to discard stale results - Fix tab strip vs hero desync: fetch provider-specific and all-provider data in parallel so costs arrive from same data snapshot - Fix stale menubar icon after wake: forceRefresh now fetches today/all in parallel alongside the current selection - Fix accent color: ThemeState is now @Observable so color changes propagate via observation, removing .id() view hierarchy teardown - Fix currency flash: defer store.currency and symbol update until a rate is available so symbol and rate apply atomically - Fix export: terminationHandler instead of waitUntilExit (no UI freeze), HHmmss in filename to prevent overwrite on double-export - Fix CurrencyState: @MainActor isolation with proper Sendable conformance, nonisolated on pure static functions - Fix streak count: iterate calendar days instead of sparse history entries so gaps are counted as streak-breakers - Fix TrendBar identity: stable date-based id instead of UUID - Add GPT-5.3 and DeepSeek model display names	2026-05-01 08:01:25 -07:00
AgentSeal	d7c92225e5	Revert "Fix trend chart to show days matching selected period" ... This reverts commit c10484fe2b.	2026-04-25 01:56:51 +02:00
iamtoruk	c10484fe2b	Fix trend chart to show days matching selected period	2026-04-25 01:47:30 +02:00
AgentSeal	68daad5dfa	Fix menubar crashes and add reliable auto-refresh ... Fixes crash when switching timeframes or providers by handling duplicate dates in history data gracefully. Adds LaunchAgent that posts a distributed notification every 15 seconds to keep prices fresh even after long idle periods.	2026-04-23 21:09:46 +02:00
iamtoruk	3c2aab2207	fix(menubar): prefetch periods and align dashboard dates with local timezone ... Loading overlay no longer flashes on every 15s poll. isLoading now only toggles when the cache is cold, and all periods prefetch once on launch so tab switching is instant. Heatmap tooltip, trend bars, forecast, and all-time stats were computing on UTC dates while the CLI reports on local dates, so the two disagreed at day boundaries. Switched every date formatter and calendar in these paths to .current so the menubar matches codeburn today output.	2026-04-20 19:25:14 -07:00
iamtoruk	bc92b49c1b	feat(mac): auto-update checker and Plan pane button cleanup ... Remove the broken "Connect Claude" / "Reconnect Claude" buttons from the Plan pane -- they opened a terminal session that did nothing useful for already-logged-in users. Keep only the "Retry" button. Add an auto-update checker that queries GitHub releases every 2 days in the background. When a newer menubar build is available, an "Update" pill appears in the header. Clicking it runs the existing installer flow (download, replace, relaunch) with no manual steps.	2026-04-19 03:33:37 -07:00
AgentSeal	94240f5341	fix(mac): show correct cost in trend tooltip for per-provider views ... The trend chart tooltip always displayed `bar.tokens` in its header, which is zero for provider-filtered history (the CLI only carries per-provider cost+calls in the daily cache, not tokens). Result: when you selected Claude/Codex/Cursor/Pi, hovering a bar showed $0.00 even on days with real spend. The trend chart's main metric already falls back to cost when tokens are zero. Pass that same metric value through to the tooltip so both stay consistent. Also removed the misleading "No model breakdown available" fallback line. For provider-filtered views the per-model breakdown legitimately doesn't exist in the payload, so the tooltip now just shows date + cost without the error-sounding message.	2026-04-18 13:18:11 -07:00
AgentSeal	43a938ff9e	feat(mac): add Connect Claude button to Plan pane ... The Plan pane previously told users to "run claude login in your terminal, then retry" with no way to start the flow from the app. Added a primary Connect Claude button on both the no-credentials and failed states that launches Terminal.app with `claude login`, so the OAuth flow is one click away. TerminalLauncher.openClaudeLogin() uses a hardcoded literal, so no user input reaches AppleScript. Refactored the common path into runInTerminal(command:preValidated:) which re-validates any non- literal input against CodeburnCLI.isSafe as defense-in-depth. On machines without Terminal.app (iTerm/Ghostty/Warp), the button surfaces an inline instruction to run `claude login` manually instead of failing silently.	2026-04-18 06:54:57 -07:00
Resham Joshi	495a254338	feat(mac): native Swift menubar app + one-command install ... Introduces mac/ with a native SwiftUI menubar app that replaces the previous SwiftBar plugin entirely. Install via `npx codeburn menubar`, which downloads the .app from GitHub Releases, strips Gatekeeper quarantine, and drops it into ~/Applications. Highlights - mac/ SwiftUI app: agent tabs, Today/7/30/Month/All period switcher, Trend/Forecast/Pulse/Stats/Plan insights, activity + model breakdowns, optimize findings, CSV/JSON export, Star-on-GitHub banner, live 60s refresh, instant currency switching with offline FX cache. - Security: CodeburnCLI argv-based spawn (no shell interpretation), SafeFile symlink guards + O_NOFOLLOW writes, FX rate clamping to [0.0001, 1_000_000], keychain filtered to account == "default", removed byte-window credential log, in-flight refresh guard, POSIX flock on config.json writes, TerminalLauncher validates argv before AppleScript interpolation. - Performance: shared static NumberFormatter (thousands of allocations per popover redraw eliminated), concurrent pipe drain with 20 MB cap + 60s timeout in DataClient, Observation-tracked reactive UI, 5-min payload cache keyed on (period, provider). - CLI: new `codeburn menubar` subcommand that downloads + installs + launches the .app (no clone, no build). New `status --format menubar-json` payload builder. `export` rewritten to produce a folder of one-table-per-file CSVs with a `.codeburn-export` marker so arbitrary -o paths cannot be silently deleted. - Removed: src/menubar.ts (SwiftBar plugin generator), install-menubar / uninstall-menubar subcommands, `status --format menubar` directive output, tests/menubar.test.ts, tests/security/menubar-injection.test.ts. - Release: .github/workflows/release-menubar.yml builds universal binary, assembles .app, ad-hoc signs, zips, uploads on mac-v* tag push. Runs on the free macos-latest runner. Tests - 230 TypeScript tests pass - 10 Swift CapacityEstimator tests pass - TypeScript typecheck clean - Swift release build clean	2026-04-17 16:55:56 -07:00