Reuse one concrete six-month scan for interactive history and selected-period totals. This restores network-backed providers, removes concurrent refresh scans, and keeps non-interactive reports scoped to their requested period.
* daily-cache: never lose history the sources can no longer re-derive (v14)
Session files are ephemeral (Claude Code deletes transcripts after ~30
days), so a cached day whose sources are gone exists nowhere else. Every
invalidation path (schema bump, savings-config change, timezone change,
incomplete-hydration retry) used to discard all cached days and re-derive
from surviving sources, silently truncating history to the source
retention window. Five bumps between June 22 and July 16 erased
everything before April 24 on a machine with usage since March.
Invalidations now re-derive what they can and carry forward every
(day, provider) slice they cannot, marked 'carried'. Loading a missing or
corrupt cache file adopts days from every older daily-cache file in the
cache dir (legacy, versioned, .bak copies, orphaned .tmp) as a union per
(day, provider), higher schema version winning per pair. Provider slices
now store the full per-provider breakdown (tokens, models, categories,
sessions) so carry-forwards stay exact across future rebuilds.
Merge rules hardened by adversarial review: opaque pre-v5 days (totals
without provider slices) merge all-or-nothing so partial parses cannot
double-count into them; zero-data placeholder slices neither block nor
lose carried data (session counts deduplicated by max); a partial parse
never overwrites finalized baseline slices, only fills gaps; adoption
purges today/future entries, applies retention, and clamps a stale
lastComputedDate so a purged day cannot be skipped forever.
Verified end-to-end against a copy of a real cache dir: the rebuilt v14
cache holds every (day, provider) pair present in any older cache file,
including Claude days from early April that the July rebuilds had
dropped.
* daily-cache: per-project daily rollups in the durable record (v15)
Project history previously lived only in the session layer, so it faded
with the source files even though day totals now survive. Days and
provider slices carry a projects breakdown (cost/calls/savings/sessions
per project) filled by the day aggregator and folded through carry
merges, making the By Project dimension as durable as models and
categories. Days recorded before v15 keep their totals with no project
split; nothing can reconstruct one once sources are gone.
This is the first bump to ride the v14 carry-forward: the v14 cache is
adopted losslessly and only source-backed days re-derive (verified on a
real cache dir: identical totals, zero lost pairs, project splits on
every derivable day).
Hardening from adversarial review: placeholder-aware project session
dedup so totals reconcile; migrateDays sanitizes provider slices and
nested projects from foreign caches; all foreign-keyed map access in the
merge path uses hasOwn reads and defineProperty writes, closing a real
prototype-pollution path a regression test caught when a cache key is
named __proto__.
* menubar: serve headline totals and projects from the durable day set
Review finding on this PR: the all-provider headline built cache-backed
totals and then replaced them wholesale with a rebuild from the
surviving-session parse, so current.cost/calls, the models table, and
topProjects stayed truncated to the source-retention window even though
history.daily carried the full record. The replacement existed only to
keep the estimated-cost markers alive.
The cache-backed period data is now the authority; the scan contributes
exactly what day entries lack: estimated-cost markers, unpriced-model
detection, per-session drill-downs, and a fresher project path. Project
totals come from the same day set as the headline, with ProjectDayStats
gaining a path so carried-only projects still display a friendly name.
Sessions merge by max: the cache buckets a session on its start day, the
scan counts it on any active day, and both undercount differently.
End-to-end regression test seeds a cache whose only day is carried (no
session files exist) and asserts the headline, models, and topProjects
all reflect it. Verified on a real cache dir: the 6-month headline now
equals the history sum to the cent.
* daily-cache: close residual corrupt-input gaps in v15 ingestion sanitization
v15 sanitizes provider slices and projects at ingestion and guards merge
lookups with Object.hasOwn/setOwn. Three residual gaps versus the
invariant (no JSON-parseable cache content may throw or produce
NaN/garbage), plus one found in review:
- Day-level models/categories were not sanitized: a day with
models:'bad' survived load and buildPeriodDataFromDays iterated the
string per-character, yielding NaN in period model totals. Day-level
maps now reuse the same sanitizers as slice-level maps.
- Map keys shadowing Object.prototype (constructor, toString, ...) still
entered the cache from foreign files; modelTotals[name] ?? init in
buildPeriodDataFromDays resolves such a key to the inherited prototype
member and produces NaN. All sanitized maps now drop these keys at
ingestion (deliberate tradeoff: such names are reclassified invalid).
- Top-level lastComputedDate was unvalidated; a non-string later hit
.slice() in the gap-start parse and threw. Kept only when it is a
YYYY-MM-DD string, else null (forces a plain re-backfill).
- Stale savingsConfigHash comment still described pre-v14 discard
behavior; reworded to re-derive + carry forward.
3 regression tests, each verified to fail on the pre-fix code. Relevant
suites 71/71 green, tsc clean. Valid-input behavior unchanged except the
prototype-key reclassification above.
---------
Co-authored-by: ozymandiashh <234437643+ozymandiashh@users.noreply.github.com>
Follow-up to #719, closing the two deltas flagged in the #714 discussion:
- fs.realpathSync preserves the caller's path casing on case-insensitive
filesystems (macOS APFS, Windows), so the same repo reached through
differently cased paths produced distinct canonical keys and split into
separate groups. fs.realpathSync.native returns the on-disk casing, making
the canonical key truly canonical. Regression test creates a real repo,
references it through altered casing (guarded to case-insensitive
filesystems), and asserts one group.
- Documents the accepted residual: a main repo moved on disk after
'git worktree add' leaves git's linked-worktree metadata stale, so its
worktrees may not unify; that is git-state staleness, not a grouping bug.
Adds a provider for Kimi Code CLI (MoonshotAI/kimi-code, the successor of
kimi-cli), reading ~/.kimi-code/sessions/wd_*/session_*/: state.json for
session metadata and per-agent agents/<id>/wire.jsonl event streams.
- Usage from usage.record events: inputOther->input, output->output,
inputCacheRead->cacheRead, inputCacheCreation->cacheWrite. The store has
no cost fields, so cost is computed from tokens and flagged estimated.
- Real model attribution: usage.record.model carries the config ALIAS; the
real model id lives on llm.request events. Rows resolve the alias through
the alias->model map first, with the nearest preceding request as
fallback, so aliases never leak into reports.
- Subagent wire files parse as separate sources under one session without
double counting; multi-turn continuations in one wire.jsonl are one
session with multiple turns; retry-only failed sessions parse to zero
usage; malformed JSONL lines are skipped.
- Tool calls feed the tool breakdown; tool state resets at turn boundaries
so a failed turn cannot bleed its tools into the next row.
- KIMI_CODE_HOME override, eager registration, PROVIDER_ENV_VARS and
PROVIDER_PARSE_VERSIONS entries, probeRoots for doctor, docs page.
Two robustness fixes from the #741 telemetry audit:
- cli_error had no rate limit: one install emitted 804 timeout events in a
single day (56% of all events ever received). track() now caps cli_error
at 20 per kind per calendar day. The day and per-kind counts persist in
the telemetry state file (defensively loaded), so app relaunches within
the same day cannot reset the budget; other event names are unaffected.
- app_close almost never fired (1 close vs 48 opens): the quit path raced
the outbound POST. before-quit now defers quit once, tracks the close and
flushes with a bounded wait (1500ms race), then quits. Every step of the
handler is independently guarded so a synchronous failure can neither
skip the flush nor wedge quitting, and a full queue evicts its oldest
event rather than dropping app_close. Disabled or not-onboarded telemetry
quits instantly.
Skill attribution was gated on the turn classifying as 'general', but
classifyByToolPattern checks hasSkill last, so any turn invoking the Skill
tool alongside Read/Bash/Edit/MCP got a real category and its skill was
silently dropped. Skill turns virtually always carry other tools, which is
why skills came back empty in all 25 usage snapshots (#741) while mcpServers
populated.
subCategory is now set for any turn with Skill tool_use; category assignment
is untouched. The claude parse version is bumped so cached session summaries
(which lack skill attribution) re-parse on upgrade.
RELEASING.md: the desktop app is released manually under desktop-v<version>
tags (build on macOS, gh release upload --clobber); no CI yet.
DISTRIBUTION.md: document building deb/rpm and both arches from a macOS host,
and that the rpm target needs 'brew install rpm' (rpmbuild) — it emits
codeburn-desktop-<version>.x86_64.rpm, the name the website links.
- build stamp ignores the pricing-snapshot files the build regenerates,
so a release checkout no longer shows a false -dirty
- splash shows just the flame, CodeBurn, and the version (dropped the
commit-hash line); the clean build id stays in About only
- About 'Check for updates' uses the in-app checker and reports inline
('You're on the latest' / 'Update available: X · Download') instead
of blindly opening the releases page
392/392.
The once-daily usage_snapshot now includes each top model's primary
task category (which model for what purpose, one cheap by-model call
per day), plus MCP servers and skills used (names + coarse usage
buckets). Names + buckets only, no prompts/paths/dollars; graceful
degradation if the by-model fetch fails. /telemetry page updated.
Per owner decision: the binary 'burning code' flame is the mark
everywhere, matching the app's identity as a code-cost tool. Desktop
app icon + FlameMark (splash/sidebar/About/dock), menubar dock icon,
brand logo, and local dashboard all use the binary flame.
Adds an eager provider for Amazon Quick Desktop (aws.amazon.com/quick/desktop),
which stores local data under ~/.quickwork. Usage source of truth is the
per-day EMF metrics JSONL (Model, InputTokens, OutputTokens, CostUSD,
session_id); real CostUSD passes through the cache like kiro/devin/hermes.
sessions.db (SQLite, read-only) enriches calls with titles, first user
message, and tool names, and provides estimated usage (quickdesk-auto,
costIsEstimated) for sessions that predate metrics coverage. Multi-profile
layout via profiles.json entries plus the migrated legacy root; honors
QUICKWORK_HOME; schema-tolerant (sqlite_master and PRAGMA introspection,
per-line JSONL error isolation). The on-disk schema is reverse-engineered and
documented as such in docs/providers/quickdesk.md.
Patch release: Windows bundled-CLI fix (was not-found on 100% of
Windows), enriched cli_error telemetry, and the unified solid-flame
brand. CLI/menubar stay 0.9.16 (no changes needing an npm/menubar
republish; the desktop bundles current main's CLI).
path.startsWith('/') POSIX guard rejected the Windows bundled-CLI path
(C:\...\launch.js), so 100% of Windows installs got not-found
(confirmed in telemetry: 84 events, all win32/x64). Use path.isAbsolute
everywhere. cli_error now carries {cmd, kind, detail?} for
self-diagnosing errors, never paths/args/stderr.
Retires the binary-digit flame (which muddied below ~256px) in favor
of the original solid flame everywhere: desktop app icon + FlameMark
(splash, sidebar, About, dock), menubar dock icon, brand logo. One
consistent mark that stays crisp at every size, matching the website
favicon and local dashboard.
The dashboard header logo and favicon render at 24px where the binary
flame muddies; use the solid flame like the site favicon. Menubar dock
icon keeps the binary squircle (large-icon context).
Local web dashboard favicon + header (dash/public/codeburn-logo.png)
and the menubar dock/app-icon source (assets/menubar-logo.png,
assets/logo.png) now use the binary-flame mark, matching the desktop
app and website. The menu-bar status item stays monochrome-template by
Apple convention; the new dock icon lands on the next menubar release.
The AppImage-only Linux build hit users with a no-application-installed
error on double-click, because AppImages do not self-register and need
chmod plus libfuse2 on newer distros. Add deb and rpm electron-builder
targets so Linux users get a native install that lands in the app menu
with no manual steps; the deb ships a .desktop entry for exactly that.
README hero grid now lists Debian/.deb, Fedora/.rpm, and AppImage
alongside the macOS and Windows buttons, and the desktop release notes
explain the deb/rpm path plus the AppImage FUSE requirement.
Checks the GitHub releases for newer desktop-v tags once per launch
and every 24h (15s timeout, no identifying headers, offline = silent
retry). A dismissible banner and a Settings About row surface the
newer version and link the release page; dismissal persists per
version so each release nags at most once. No auto-install: unsigned
builds cannot, by platform constraint; the checker only notifies.
App 364/364 (+24), typechecks + build green.
Bump the version and refresh the bundled LiteLLM pricing snapshots.
Since 0.9.15, roughly sixty merged changes: the /advisor escalation
billing and unified large-line scanners for Claude, Copilot CLI
session.shutdown billing and skill extraction, the CodeWhale provider,
kiro v2 credit pricing, OpenCode custom dirs and legacy-store merging,
archived Codex sessions, antigravity timestamp stability, estimated-cost
markers across every surface, the doctor command, spend budgets, act
apply-model with a per-project quality tripwire, honest yield attribution
with an ambiguous bucket, MCP tool-deferral detection and fixes, agent by
model cross-breakdowns and per-record exports, granular dashboard
timelines, a scrollable daily history, the Electron desktop app with mac,
Windows and Linux packaging, menubar rate-limit handling and idle-cadence
energy fixes, team sync in preview, and the four-surface README.
Every merged PR was re-verified against this exact tree before the bump:
full JS suite (3527 tests), Swift suite (97), release build smoked, and
eight area audits with live functional probes.
* feat(optimize): mcp-deferral-gaps finding family
Add three read-only detectors for MCP tool-def deferral coverage gaps:
- mcp-deferral-off: sessions carrying MCP tool-def overhead with zero
ToolSearch invocations and no deferred_tools_delta inventory across
the window. Cause attribution, each with its own message and fix:
stale ENABLE_TOOL_SEARCH=false (settings env, any scope, or shell
profile), non-first-party ANTHROPIC_BASE_URL (reported as unknown
proxy — never assumes capability), Vertex AI config, all observed
Claude Code versions predating default-on tool search (v2.1.7), or
a generic deferral-appears-inactive fallback.
- mcp-alwaysload-hygiene: alwaysLoad-pinned servers whose observed
call rate is below 1 call per 5 sessions (named constant). Notes the
5s startup-blocking cost of alwaysLoad in the explanation.
- mcp-defer-threshold: ENABLE_TOOL_SEARCH=auto/auto:N overrides whose
threshold the estimated def volume never reaches, so tools load
upfront; recommends the tightest auto:N that would defer.
Detection only: no FindingApply payloads, no act-layer changes, no
file mutation. Users without deferral gaps see zero new output —
deferral-active evidence (ToolSearch calls or inventory) suppresses
the findings, and each detector gates on conservative named
thresholds. Config readers take an injectable homeDir (PlanContext
style) for hermetic tests.
Discrepancies vs the design notes, codebase/live-docs win:
- The Claude Code changelog records default-on (2.1.7), not first
ship, so the version cause uses the default-on boundary.
- Per-tool "anthropic/alwaysLoad" lives in server-served tool _meta,
not static config; server-level only, limitation documented.
- Live docs confirm auto default threshold 10% of context window and
the alwaysLoad v2.1.121+ requirement.
Refs getagentseal/codeburn#614
* feat(act): defer-* plan kinds for native deferral config
Wire the mcp-deferral-gaps findings to the act machinery with three
new plan kinds, all through the existing ConfigDocs/runAction path
(journaled, backed up, stale-guarded, dry-run previewable, undo
restores byte-identical files):
- defer-enable: removes a stale ENABLE_TOOL_SEARCH=false from the
settings env of the scope where the finding recorded it. Refusal
paths render as manual notes instead of plans: shell-profile lines
(codeburn only appends marker blocks to shell files, never edits
user lines), unknown proxies (setting the override blind makes
requests fail outright on proxies that don't forward tool_reference
blocks — the note says to verify first), Vertex, and old versions.
A proxy-verified cause (set by the part-3 verifier) produces a real
ENABLE_TOOL_SEARCH=true plan in user settings.
- defer-alwaysload: strips alwaysLoad: true from the named servers in
the exact config files the finding recorded. Gated on an injectable
installed-version probe (default: claude --version); below v2.1.121,
unparseable, or probe failure all refuse with a note naming the
required version. Preview notes the removed up-to-5s startup block.
- defer-threshold: rewrites the auto override to the recommended
auto:N, or deletes it when the finding says the default already
defers (removeOverride).
Findings now carry FindingApply payloads (path, scope, cause, servers,
recommended N); detector text is unchanged, so plain optimize renders
byte-identically to before. Every plan links its findingId into the
ActionRecord and states that changes take effect on the next session
(the config is read at Claude Code start).
Discrepancy vs the design notes: no existing version-check helper was
found in guard/ or act/ to reuse, so the detector's parseVersion/
versionPredates are exported and shared instead of adding a parallel
comparator.
Refs getagentseal/codeburn#614
---------
Co-authored-by: AgentSeal <hello@agentseal.org>
Sessions launched from monorepo subdirectories or separate worktrees
of one repository formed independent attribution groups, each awarding
the same commit (double-counted productive sessions; the duplicate
owner was not even flagged ambiguous). Groups now key on the realpath
of git-common-dir, so all subdirs and worktrees of a repo collapse
into one group while distinct repos stay separate; ambiguity semantics
unchanged, now correctly spanning the whole repo. rev-parse results
cached per directory.
Fixes#713. Regression tests fail on the unfixed code.
