The changelog entry predates the final merges; it now covers the
no-data rendering, the cross-process refresh gate, the straddle guard,
the turn-attribution and insights accuracy fixes, the 10-year retention,
and the small cache/currency fixes. README download badges move from
0.9.16 to 0.9.18.
Co-authored-by: reviewer <review@local>
Under a saturated full-suite run, fd/CPU starvation can make the
takeover-guard fs ops report unavailable, which the fence correctly
treats as fail-closed; the 1ms-heartbeat stress test misread that as the
serialization race. Retries rescue environmental noise only: the real
race fails roughly 6 percent per verify across 300 verifies, so a
mutated build cannot pass any attempt.
The incremental-append path groups the appended region before the file's
own cached keys join the dedup set, so a streamed assistant id restated
across the append boundary counted twice, and the boundary merge could
splice it into the wrong turn (reproduced on real image-heavy sessions:
one id streamed across several records over seconds, 111 calls vs the
110 a full re-parse yields). Suppressing the restatement instead would
freeze the stale first emission, so neither shortcut matches a full
re-parse. On any id overlap between the appended entries and the cached
turns the shortcut is abandoned and the file re-parses from byte 0.
Rare (about 0.3 percent of real files) and bounded to one file per
refresh. Regression test uses the cold-reparse oracle; mutation-verified
against the unguarded code.
Co-authored-by: reviewer <review@local>
* cache: strict cross-process gate for the warm session-cache refresh transaction (#645)
* lock: serialize the fence against the owner's own heartbeat
verifyStillOwner and the heartbeat tick both take the takeover guard;
without in-process serialization the fence could observe its own
heartbeat's guard file, read it as displacement, and abort a legitimate
publication. Fail-safe, but it discarded the parse the lock exists to
protect (~6% of verifies at a 1ms heartbeat in the repro). Owner-side
guard operations now run through one serializer; cross-process guard
semantics are unchanged. Regression test at heartbeatMs 1, mutation-
verified against the unserialized code.
---------
Co-authored-by: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Co-authored-by: reviewer <review@local>
* daily-cache: coverage-gated carry on re-derive + single-slice turn attribution
P2: a tz-change re-derive no longer double-counts turns whose day bucket
moved across midnight — secondary slices are carried only outside the
provider's fresh coverage (floor widened by one day on tzChanged).
P3: a turn's editTurns/oneShotTurns/category counts are attributed to the
turn's primary provider slice only, so slice sums equal day-level counts
and partial carries cannot inflate day totals.
* daily-cache: document coverage-widening and rebuild-projects limits; cover empty-call turns
Review addendum: the one-day tz widening assumes an offset delta of at
most 24h (date-line crossings are a known limit); day-level projects of
skinny kept slices are dropped by the coverage rebuild by design. Adds a
regression test pinning the existing skip of empty-call turns.
* split: keep single-slice turn attribution, drop the coverage floor
The P2 coverage floor is reverted pending redesign: on a forced tz
re-derive against a real cache copy it dropped a genuine, non-duplicated
day (claude 2026-06-18, 399.70 USD, 1572 calls) that exists nowhere
else, and the floor also applied to every non-tz re-derive where the
same class of drop is latent. Trading a bounded midnight double-count
for unbounded history loss inverts the never-lose priority; the surgical
alternative (drop only the migrated turn's old-day contribution) is
tracked separately.
P3 stands as authored: turn-level stats attribute to exactly one slice
(majority-calls provider, tie broken by first call), restoring
slice-sums equal day-counts on fresh builds, with its regression tests.
---------
Co-authored-by: reviewer <review@local>
The one cache module still hardcoding ~/.cache/codeburn; every other
cache (session, daily, codex, pricing) honors the relocation override,
so a user moving the cache dir kept getting this single file in the
default location. Found by the pre-release functional sweep.
* fix(app,dash): render pre-history days as no data, not a currency zero
Days before the first recorded day in history.daily were painted as a real
0.00/0 calls in the daily activity heatmap and the daily spend charts. That
zero is unknown, not measured, so those cells and bars now read "No data
recorded" instead of a currency zero. Genuinely idle days within recorded
history stay as real zeros.
- app: heatmap cells, the daily spend bars, and the daily-by-model columns
get a distinct no-data style plus a "No data recorded" hover for days before
the first recorded day.
- dash: the granular line chart drops buckets before the first recorded day so
no flat zero line is drawn before any history exists.
- data-start is derived in the UI layer from history.daily; payload shape is
unchanged.
Verified: app vitest 418 pass (7 new for the no-data behavior); app, dash, and
root typecheck clean; dash and app renderer vite builds succeed.
* no-data: cap guard, timezone-free dash trim, StackedBars aria
Three hardening fixes from adversarial review of the no-data rendering:
dataStartKey returns null at the payload's 365-entry history cap, where
the oldest retained entry is no longer the true data start; classifying
past it would label real aged-out history as no data on long custom
ranges. Documented that the install-to-first-use gap reading as no data
is literally accurate: nothing was recorded then either.
The dash granular chart now trims leading zero-only buckets by value
instead of comparing bucket timestamps against date keys, so producer
and viewer timezone skew can never drop a real first-day bucket, and an
all-zero series lands in the established empty state.
StackedBars no-data columns expose their state via aria-label, not only
a title on a non-focusable div.
Three review leftovers plus one inconsistency found while fixing them.
computePace returns undefined for a non-finite usedFraction instead of
letting NaN sail through the clamp into every pace field.
Daily-cache retention goes from 730 days to 3650: the cache is the only
durable record of carried days and lifetime now reads from it, so the
2-year prune would have replayed the lost-history bug in slow motion at
that horizon. Measured cost stays small (~2.3 MB / ~11 ms parse per 730
dense days).
The vercel-gateway dashboard-range test pins a relative day instead of
2026-06-01, which would have started failing once the rolling 6-month
window moved past it around December.
Five verified findings from the #756 review, each with a regression test:
Corrections now count only follow-up prompts. The session-opening prompt
cannot be correcting this assistant, however correction-shaped its task
text reads, and the revert pattern no longer matches ordinary 'revert
the <noun>' requests (undo was already guarded; the doc claimed both
were).
Time-to-first-edit returns null when the first edit's timestamp is
unparseable instead of silently measuring to the first parseable one.
File churn normalizes backslashed paths before keying, relativizing, and
basenaming. Previously the payload's basename-only privacy redaction was
a no-op on Windows and shipped the full absolute path, username
included; mixed separators also split one file across churn entries.
Pricing coverage excludes deliberately-free models (local-looking,
local-savings mapped, zero-rate overrides) from the denominator via the
same exclusions findUnpricedModels applies, so a mostly-ollama user no
longer reads high coverage while every cost-bearing call is unpriced.
An absent coverage value now reaches the payload as null, never as a
fabricated 100%.
Also shares the one-shot minimum-edit-turns threshold between
worstOneShotCategory and the coaching gate so they cannot drift.
* feat(insights): workflow intelligence (corrections, time-to-first-edit, file churn, coverage) + dash wire-up
* menubar: propagate workflow-intelligence fields onto the cache-backed headline
The carry-forward headline (#755) serves totals from the durable day set
and merges only session-derived fields from the scan. The new workflow,
topReworkedFiles, and pricingCoverage fields were computed by the scan
but never propagated, so they silently defaulted on the all-provider
path (pricingCoverage rendered a dishonest 1.0). Propagate them like the
other scan-only fields and pin it with a carried-headline regression
test.
Claude Code deletes session transcripts after cleanupPeriodDays (default
30) at startup. Daily totals survive in the daily cache, but per-session
detail older than the cutoff is unrecoverable, and most users learn this
only after losing months of history. Doctor now reports the effective
retention and, below one year, warns with the exact settings.json edit
that preserves transcripts.
Re-apply the CLI/dashboard Lifetime split from #391/#416 on current main.
- add lifetime as a first-class period (all stays last 6 months)
- wire period through cli-date, dashboard key 6, and CLI commands
- refresh cli-date and cli-json-daily regression coverage
Part of #389. Supersedes #416.
* test(electron): isolate dev-resolution fixtures via CODEBURN_DEV_REPO_ROOT
Rework of the #681 fix per review: instead of stubbing the real repo
dist/cli.js with snapshot-restore, the Vite-dev resolution branch gains a
CODEBURN_DEV_REPO_ROOT override (matching the CODEBURN_PATH_DIRS precedent)
so the whole fixture lives in a per-test tmpdir. With the env unset the
resolution order is byte-identical to before.
- covers all three fresh-clone failures on current main, including the
resolveTarget dev-repo-beats-bundled case
- deletes the snapshot-restore machinery, the parent-path precondition and
the beforeAll repo-scanning guard
- tests assert both override-set (tmpdir wins) and override-unset behavior
Closes#681
* test(electron): drop environment-coupled null assertion for unset dev-root override
The override-unset case resolved <repo>/dist/cli.js whenever a build had
run, so the toBeNull() assertion depended on the absence of a gitignored
artifact. The override-set tests already prove the new branch and the
non-Vite test covers the null path.
Reuse one concrete six-month scan for interactive history and selected-period totals. This restores network-backed providers, removes concurrent refresh scans, and keeps non-interactive reports scoped to their requested period.
* daily-cache: never lose history the sources can no longer re-derive (v14)
Session files are ephemeral (Claude Code deletes transcripts after ~30
days), so a cached day whose sources are gone exists nowhere else. Every
invalidation path (schema bump, savings-config change, timezone change,
incomplete-hydration retry) used to discard all cached days and re-derive
from surviving sources, silently truncating history to the source
retention window. Five bumps between June 22 and July 16 erased
everything before April 24 on a machine with usage since March.
Invalidations now re-derive what they can and carry forward every
(day, provider) slice they cannot, marked 'carried'. Loading a missing or
corrupt cache file adopts days from every older daily-cache file in the
cache dir (legacy, versioned, .bak copies, orphaned .tmp) as a union per
(day, provider), higher schema version winning per pair. Provider slices
now store the full per-provider breakdown (tokens, models, categories,
sessions) so carry-forwards stay exact across future rebuilds.
Merge rules hardened by adversarial review: opaque pre-v5 days (totals
without provider slices) merge all-or-nothing so partial parses cannot
double-count into them; zero-data placeholder slices neither block nor
lose carried data (session counts deduplicated by max); a partial parse
never overwrites finalized baseline slices, only fills gaps; adoption
purges today/future entries, applies retention, and clamps a stale
lastComputedDate so a purged day cannot be skipped forever.
Verified end-to-end against a copy of a real cache dir: the rebuilt v14
cache holds every (day, provider) pair present in any older cache file,
including Claude days from early April that the July rebuilds had
dropped.
* daily-cache: per-project daily rollups in the durable record (v15)
Project history previously lived only in the session layer, so it faded
with the source files even though day totals now survive. Days and
provider slices carry a projects breakdown (cost/calls/savings/sessions
per project) filled by the day aggregator and folded through carry
merges, making the By Project dimension as durable as models and
categories. Days recorded before v15 keep their totals with no project
split; nothing can reconstruct one once sources are gone.
This is the first bump to ride the v14 carry-forward: the v14 cache is
adopted losslessly and only source-backed days re-derive (verified on a
real cache dir: identical totals, zero lost pairs, project splits on
every derivable day).
Hardening from adversarial review: placeholder-aware project session
dedup so totals reconcile; migrateDays sanitizes provider slices and
nested projects from foreign caches; all foreign-keyed map access in the
merge path uses hasOwn reads and defineProperty writes, closing a real
prototype-pollution path a regression test caught when a cache key is
named __proto__.
* menubar: serve headline totals and projects from the durable day set
Review finding on this PR: the all-provider headline built cache-backed
totals and then replaced them wholesale with a rebuild from the
surviving-session parse, so current.cost/calls, the models table, and
topProjects stayed truncated to the source-retention window even though
history.daily carried the full record. The replacement existed only to
keep the estimated-cost markers alive.
The cache-backed period data is now the authority; the scan contributes
exactly what day entries lack: estimated-cost markers, unpriced-model
detection, per-session drill-downs, and a fresher project path. Project
totals come from the same day set as the headline, with ProjectDayStats
gaining a path so carried-only projects still display a friendly name.
Sessions merge by max: the cache buckets a session on its start day, the
scan counts it on any active day, and both undercount differently.
End-to-end regression test seeds a cache whose only day is carried (no
session files exist) and asserts the headline, models, and topProjects
all reflect it. Verified on a real cache dir: the 6-month headline now
equals the history sum to the cent.
* daily-cache: close residual corrupt-input gaps in v15 ingestion sanitization
v15 sanitizes provider slices and projects at ingestion and guards merge
lookups with Object.hasOwn/setOwn. Three residual gaps versus the
invariant (no JSON-parseable cache content may throw or produce
NaN/garbage), plus one found in review:
- Day-level models/categories were not sanitized: a day with
models:'bad' survived load and buildPeriodDataFromDays iterated the
string per-character, yielding NaN in period model totals. Day-level
maps now reuse the same sanitizers as slice-level maps.
- Map keys shadowing Object.prototype (constructor, toString, ...) still
entered the cache from foreign files; modelTotals[name] ?? init in
buildPeriodDataFromDays resolves such a key to the inherited prototype
member and produces NaN. All sanitized maps now drop these keys at
ingestion (deliberate tradeoff: such names are reclassified invalid).
- Top-level lastComputedDate was unvalidated; a non-string later hit
.slice() in the gap-start parse and threw. Kept only when it is a
YYYY-MM-DD string, else null (forces a plain re-backfill).
- Stale savingsConfigHash comment still described pre-v14 discard
behavior; reworded to re-derive + carry forward.
3 regression tests, each verified to fail on the pre-fix code. Relevant
suites 71/71 green, tsc clean. Valid-input behavior unchanged except the
prototype-key reclassification above.
---------
Co-authored-by: ozymandiashh <234437643+ozymandiashh@users.noreply.github.com>
Follow-up to #719, closing the two deltas flagged in the #714 discussion:
- fs.realpathSync preserves the caller's path casing on case-insensitive
filesystems (macOS APFS, Windows), so the same repo reached through
differently cased paths produced distinct canonical keys and split into
separate groups. fs.realpathSync.native returns the on-disk casing, making
the canonical key truly canonical. Regression test creates a real repo,
references it through altered casing (guarded to case-insensitive
filesystems), and asserts one group.
- Documents the accepted residual: a main repo moved on disk after
'git worktree add' leaves git's linked-worktree metadata stale, so its
worktrees may not unify; that is git-state staleness, not a grouping bug.
Adds a provider for Kimi Code CLI (MoonshotAI/kimi-code, the successor of
kimi-cli), reading ~/.kimi-code/sessions/wd_*/session_*/: state.json for
session metadata and per-agent agents/<id>/wire.jsonl event streams.
- Usage from usage.record events: inputOther->input, output->output,
inputCacheRead->cacheRead, inputCacheCreation->cacheWrite. The store has
no cost fields, so cost is computed from tokens and flagged estimated.
- Real model attribution: usage.record.model carries the config ALIAS; the
real model id lives on llm.request events. Rows resolve the alias through
the alias->model map first, with the nearest preceding request as
fallback, so aliases never leak into reports.
- Subagent wire files parse as separate sources under one session without
double counting; multi-turn continuations in one wire.jsonl are one
session with multiple turns; retry-only failed sessions parse to zero
usage; malformed JSONL lines are skipped.
- Tool calls feed the tool breakdown; tool state resets at turn boundaries
so a failed turn cannot bleed its tools into the next row.
- KIMI_CODE_HOME override, eager registration, PROVIDER_ENV_VARS and
PROVIDER_PARSE_VERSIONS entries, probeRoots for doctor, docs page.
Two robustness fixes from the #741 telemetry audit:
- cli_error had no rate limit: one install emitted 804 timeout events in a
single day (56% of all events ever received). track() now caps cli_error
at 20 per kind per calendar day. The day and per-kind counts persist in
the telemetry state file (defensively loaded), so app relaunches within
the same day cannot reset the budget; other event names are unaffected.
- app_close almost never fired (1 close vs 48 opens): the quit path raced
the outbound POST. before-quit now defers quit once, tracks the close and
flushes with a bounded wait (1500ms race), then quits. Every step of the
handler is independently guarded so a synchronous failure can neither
skip the flush nor wedge quitting, and a full queue evicts its oldest
event rather than dropping app_close. Disabled or not-onboarded telemetry
quits instantly.
Skill attribution was gated on the turn classifying as 'general', but
classifyByToolPattern checks hasSkill last, so any turn invoking the Skill
tool alongside Read/Bash/Edit/MCP got a real category and its skill was
silently dropped. Skill turns virtually always carry other tools, which is
why skills came back empty in all 25 usage snapshots (#741) while mcpServers
populated.
subCategory is now set for any turn with Skill tool_use; category assignment
is untouched. The claude parse version is bumped so cached session summaries
(which lack skill attribution) re-parse on upgrade.
RELEASING.md: the desktop app is released manually under desktop-v<version>
tags (build on macOS, gh release upload --clobber); no CI yet.
DISTRIBUTION.md: document building deb/rpm and both arches from a macOS host,
and that the rpm target needs 'brew install rpm' (rpmbuild) — it emits
codeburn-desktop-<version>.x86_64.rpm, the name the website links.
- build stamp ignores the pricing-snapshot files the build regenerates,
so a release checkout no longer shows a false -dirty
- splash shows just the flame, CodeBurn, and the version (dropped the
commit-hash line); the clean build id stays in About only
- About 'Check for updates' uses the in-app checker and reports inline
('You're on the latest' / 'Update available: X · Download') instead
of blindly opening the releases page
392/392.
The once-daily usage_snapshot now includes each top model's primary
task category (which model for what purpose, one cheap by-model call
per day), plus MCP servers and skills used (names + coarse usage
buckets). Names + buckets only, no prompts/paths/dollars; graceful
degradation if the by-model fetch fails. /telemetry page updated.
