Merge main into feat/omp-support-model-aliases

Second merge of main since the PR was opened. Main moved 30+ commits
(0.8.5 bump, plan tracking feature, MiniMax pricing, menubar
prefetchAll walk-back, aicrowd cache rewrite revert) so the branch
needed another reconciliation before merging to main.

Two new conflicts resolved. Took main's text in both cases per the
policy of favoring main when the feature work is neutral:

  README.md             Kept main's Node 20+ / better-sqlite3
                        Requirements wording and main's shorter src/
                        tree listing. Added OMP to the Requirements
                        line.

  src/providers/pi.ts   Main dropped the discovery-cache snapshot and
                        the rich source-metadata fields as part of the
                        aicrowd revert. Took main's simpler structure
                        and only kept the providerName parameter so
                        OMP sources still report the correct provider
                        in the session source and dedup key.

Earlier fixups carried forward from the prior merge commit:
  - Object.hasOwn guards in resolveAlias against prototype-pollution
    via a model literally named '__proto__'.
  - source.provider in the dedup key prefix so OMP rows no longer
    stamp 'pi:'.
  - Combined pi.js imports in providers/index.ts.
  - Trailing newline on pi.ts.
  - Unknown-model fallback in cursor-agent.ts from yesterday's PR #117
    fixup (preserved via main).

353 tests pass (count dropped from 378 because main deleted the
parse-progress / parser-cache / provider-colors / source-cache test
files alongside the cache-rewrite revert).

Feature work by @cgrossde.

Author: iamtoruk

.github/workflows/firstlook.yml

@@ -0,0 +1,23 @@
+name: firstlook
+on:
+  pull_request:
+    types: [opened, reopened, synchronize]
+  workflow_dispatch:
+    inputs:
+      pr-number:
+        description: 'PR number to scan (leave empty for all open PRs)'
+        required: false
+        type: string
+
+jobs:
+  assess:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: read
+    steps:
+      - uses: getagentseal/firstlook@main
+        with:
+          pr-number: ${{ inputs.pr-number }}
+          skip-users: 'dependabot[bot],renovate[bot]'
+          fail-on: 'unknown'

CHANGELOG.md

@@ -1,37 +1,18 @@
 # Changelog
 
-## 0.8.4 - 2026-04-20
+## 0.8.5 - 2026-04-21
 
 ### Fixed
-- **Menubar hang on large session histories.** Menubar-json now uses the source cache instead of re-parsing all files on every poll.
+- **Stale Today totals after 0.8.2.** The persistent source cache introduced in 0.8.2 caused Today's cost to under-report and sometimes drop between polls during active Claude Code sessions. The cache keyed entries on `(mtime, size)` fingerprints that diverged from Claude's append-mostly JSONL model, producing empty or partial entries that were served on subsequent polls. Reverted the cache rewrite to the v0.8.1 full-reparse path for Claude sessions. Both the menubar and `codeburn status` now return consistent, monotonically-increasing Today totals.
+- **Menubar and terminal status disagreed on Today.** A turn that straddled midnight (user message in one day, response in the next) was bucketed by user timestamp in one code path and by assistant timestamp in another, producing different Today values in the two surfaces. Both paths now count a turn on the day its first assistant call ran.
+- **Kept from 0.8.2-0.8.4:** subscription plan tracking, pricing accuracy and CSV injection hardening, cursor-agent provider, menubar prefetch and timezone alignment. Only the cache rewrite and its follow-up patches were reverted.
 
-## 0.8.3 - 2026-04-20
-
-### Fixed
-- **Source cache empty-session poisoning.** Cache entries with zero sessions are now treated as cache misses, forcing a fresh re-parse instead of silently dropping the session data.
-- **Date range skip on changed files.** The date range exclusion now runs only after the fingerprint matches, so files that have grown with new data are never incorrectly skipped.
-- **TUI auto-refresh not updating.** The 30-second refresh timer now bypasses the in-memory CachedWindow, which was permanently stale because the date range end is always end-of-day.
-- **Menubar showing stale or decreasing costs.** Fixed cache invalidation so the menubar receives correct, up-to-date cost data.
-- **Swift menubar observation race.** Explicit UI refresh calls after each data fetch prevent missed updates from the one-shot observation callback.
-
-## 0.8.2 - 2026-04-20
-
-### Added
-- **Persistent parse cache for all providers.** Repeated CLI runs now reuse parsed source summaries across fresh processes instead of reparsing raw logs every time. Cache lives at `~/.cache/codeburn/source-cache-v1/` with atomic writes and 0600 file permissions. Credit: @spMohanty (PR #116).
-- **`--no-cache` on parse-backed commands.** `report`, `today`, `month`, `status`, `export`, `optimize`, and `compare` can bypass cached entries for that run and rebuild them from raw logs. Credit: @spMohanty (PR #116).
-- **`Updating cache` stderr progress.** Non-JSON cold or partial cache rebuilds now show progress while CodeBurn refreshes changed sources. Credit: @spMohanty (PR #116).
-- **`codeburn plan` subscription tracking.** Set your plan (`claude-pro`, `claude-max`, `cursor-pro`, or custom) to see a usage progress bar in the dashboard. Includes 7-day trailing median projection and billing-cycle-aware period math. Credit: @tmchow (PR #74).
-
-### Changed
-- **Cursor now uses the shared parse cache.** The provider-specific Cursor cache path is gone; SQLite-backed provider data now flows through the same persistent cache layer as the other providers. Credit: @spMohanty (PR #116).
+### Removed
+- `--no-cache` flag on `report`, `today`, `month`, `status`, `export`, `optimize`, and `compare`. The flag existed to bypass the persistent source cache which no longer exists. If your scripts pass `--no-cache`, drop it; the parse runs fresh every time now.
 
-### Fixed
-- **Model pricing: removed bidirectional fuzzy match.** `canonical.startsWith(key) || key.startsWith(canonical)` could match unrelated models. Now uses one-directional prefix only. Credit: @hobostay (PR #77).
-- **Zero-cost models incorrectly filtered.** `!entry.input_cost_per_token` treated `0` as missing. Now checks `=== undefined` so free-tier models retain their pricing entry. Credit: @hobostay (PR #77).
-- **File descriptor leak in `readSessionLines`.** Generator now calls `stream.destroy()` in a `finally` block so early abandonment does not leak open handles. Credit: @hobostay (PR #77).
-- **CSV injection guard extended.** Tab and carriage return characters at cell start are now escaped alongside `=`, `+`, `-`, `@`. Credit: @hobostay (PR #77).
-- **Crash on empty export periods.** Optional chaining prevents `undefined` access when a period has no projects. Credit: @hobostay (PR #77).
-- **Config read crash on malformed JSON.** Restored catch-all error handling in `readConfig` so a corrupt `config.json` returns defaults instead of crashing.
+### Notes
+- 0.8.2, 0.8.3, and 0.8.4 on npm contain the buggy cache. Upgrade with `npm i -g codeburn@latest` or `npm i -g codeburn@0.8.5`.
+- This release uses a full reparse on every invocation, matching v0.8.1 behavior. On large corpora (5,000+ session files) expect 3 to 10 seconds per invocation. An incremental refresh design that preserves correctness is planned for a follow-up release.
 
 ## 0.8.0 - 2026-04-19
 

README.md

@@ -10,7 +10,7 @@
   <a href="https://www.npmjs.com/package/codeburn"><img src="https://img.shields.io/npm/v/codeburn.svg" alt="npm version" /></a>
   <a href="https://www.npmjs.com/package/codeburn"><img src="https://img.shields.io/npm/dt/codeburn.svg" alt="total downloads" /></a>
   <a href="https://github.com/getagentseal/codeburn/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/codeburn.svg" alt="license" /></a>
-  <a href="https://github.com/getagentseal/codeburn"><img src="https://img.shields.io/badge/node-%3E%3D22-brightgreen.svg" alt="node version" /></a>
+  <a href="https://github.com/getagentseal/codeburn"><img src="https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg" alt="node version" /></a>
 </p>
 
 <p align="center">
@@ -35,9 +35,9 @@ npx codeburn
 
 ### Requirements
 
-- Node.js 22+
+- Node.js 20+
 - Claude Code (`~/.claude/projects/`), Codex (`~/.codex/sessions/`), Cursor, OpenCode, Pi (`~/.pi/agent/sessions/`), OMP (`~/.omp/agent/sessions/`), and/or GitHub Copilot (`~/.copilot/session-state/`)
-- For Cursor/OpenCode support: uses Node's built-in `node:sqlite` (Node 22+)
+- For Cursor/OpenCode support: `better-sqlite3` is installed automatically as an optional dependency
 
 ## Usage
 
@@ -80,25 +80,6 @@ codeburn today --format json | jq '.overview.cost'
 
 For the lighter `status --format json` (today + month totals only) or file-based exports (`export -f json`), see above.
 
-## Cache behavior
-
-CodeBurn now keeps a persistent parse cache under `~/.cache/codeburn/source-cache-v1/`.
-It applies to every provider. Unchanged sources load from cache across fresh CLI runs,
-while changed sources are refreshed on demand so rolling windows like `today` stay current
-as new log entries land.
-
-Use `--no-cache` on any command that reads session data to ignore cached entries for that
-run and rebuild them from raw logs:
-
-```bash
-codeburn today --no-cache
-codeburn report --period all --no-cache
-codeburn export --no-cache
-```
-
-When a non-JSON command needs to rebuild part of the cache, CodeBurn shows an
-`Updating cache` progress bar on stderr. JSON output stays clean on stdout.
-
 ## Providers
 
 CodeBurn auto-detects which AI coding tools you use. If multiple providers have session data on disk, press `p` in the dashboard to toggle between them.
@@ -162,7 +143,7 @@ Either flag alone is valid. Inverted or malformed dates exit with a clear error.
 
 Codex tool names are normalized to match Claude's conventions (`exec_command` shows as `Bash`, `read_file` as `Read`, etc.) so the activity classifier and tool breakdown work across providers.
 
-Cursor reads token usage from its local SQLite database via Node's built-in `node:sqlite`. Since Cursor's "Auto" mode hides the actual model used, costs are estimated using Sonnet pricing (labeled "Auto (Sonnet est.)" in the dashboard). The Cursor view shows a **Languages** panel (extracted from code blocks) instead of Core Tools/Shell/MCP panels, since Cursor does not log individual tool calls. Parsed results are cached through the shared persistent cache layer.
+Cursor reads token usage from its local SQLite database. Since Cursor's "Auto" mode hides the actual model used, costs are estimated using Sonnet pricing (labeled "Auto (Sonnet est.)" in the dashboard). The Cursor view shows a **Languages** panel (extracted from code blocks) instead of Core Tools/Shell/MCP panels, since Cursor does not log individual tool calls. First run on a large Cursor database may take up to a minute; results are cached and subsequent runs are instant.
 
 GitHub Copilot only logs output tokens in its session state, so Copilot cost rows sit below actual API cost. The model is tracked via `session.model_change` events; messages before the first model change are skipped to avoid silent misattribution.
 
@@ -358,36 +339,28 @@ CodeBurn reads these files, deduplicates messages (by API message ID for Claude,
 
 ```
 src/
-  cli.ts            Commander.js entry point
-  dashboard.tsx     Ink TUI (React for terminals)
-  parser.ts         JSONL reader, dedup, date filter, provider orchestration
-  models.ts         LiteLLM pricing, cost calculation
-  classifier.ts     13-category task classifier
-  compare-stats.ts  Model comparison engine (metrics, category breakdown, working style)
-  types.ts          Type definitions
-  format.ts         Text rendering (status bar)
-  menubar-json.ts   Payload builder consumed by the native macOS menubar app in mac/
-  export.ts         CSV/JSON multi-period export
-  config.ts         Config file management (~/.config/codeburn/)
-  currency.ts       Currency conversion, exchange rates, Intl formatting
-  sqlite.ts         SQLite adapter (node:sqlite)
-  source-cache.ts   Persistent parse cache (manifest + per-source entries)
-  discovery-cache.ts Provider directory scan caching
-  parse-progress.ts Stderr progress bar for cache rebuilds
-  provider-colors.ts Provider color and label constants
-  plans.ts          Subscription plan presets and validators
-  plan-usage.ts     Billing period math and usage projection
-  fs-utils.ts       Bounded file readers with stream support
+  cli.ts          Commander.js entry point
+  dashboard.tsx   Ink TUI (React for terminals)
+  parser.ts       JSONL reader, dedup, date filter, provider orchestration
+  models.ts       LiteLLM pricing, cost calculation
+  classifier.ts   13-category task classifier
+  compare-stats.ts Model comparison engine (metrics, category breakdown, working style)
+  types.ts        Type definitions
+  format.ts       Text rendering (status bar)
+  menubar-json.ts Payload builder consumed by the native macOS menubar app in mac/
+  export.ts       CSV/JSON multi-period export
+  config.ts       Config file management (~/.config/codeburn/)
+  currency.ts     Currency conversion, exchange rates, Intl formatting
+  sqlite.ts       SQLite adapter (lazy-loads better-sqlite3)
+  cursor-cache.ts Cursor result cache (file-based, auto-invalidating)
   providers/
-    types.ts        Provider interface definitions
-    index.ts        Provider registry (lazy-loads Cursor, cursor-agent, OpenCode)
-    claude.ts       Claude Code session discovery
-    codex.ts        Codex session discovery and JSONL parsing
-    copilot.ts      GitHub Copilot session state parsing
-    cursor.ts       Cursor SQLite parsing, language extraction
-    cursor-agent.ts cursor-agent CLI transcript parsing
-    opencode.ts     OpenCode SQLite session discovery and parsing
-    pi.ts           Pi/OMP agent JSONL session discovery and parsing
+    types.ts      Provider interface definitions
+    index.ts      Provider registry (lazy-loads Cursor, OpenCode)
+    claude.ts     Claude Code session discovery
+    codex.ts      Codex session discovery and JSONL parsing
+    cursor.ts     Cursor SQLite parsing, language extraction
+    opencode.ts   OpenCode SQLite session discovery and parsing
+    pi.ts         Pi/OMP agent JSONL session discovery and parsing
 ```
 
 ## Star History

bin/codeburn

@@ -89,15 +89,6 @@ final class AppStore {
         }
     }
 
-    /// Prefetch all periods so tab switching is instant. Skips any period already cached.
-    func prefetchAll() async {
-        for period in Period.allCases {
-            let key = PayloadCacheKey(period: period, provider: .all)
-            if cache[key] != nil { continue }
-            await refreshQuietly(period: period)
-        }
-    }
-
     /// Background refresh for a period other than the visible one (e.g. keeping today fresh for the menubar badge).
     /// Does not toggle isLoading, so the popover's loading overlay is unaffected.
     /// Always uses the .all provider since the menubar badge shows total spend.

mac/Sources/CodeBurnMenubar/AppStore.swift

@@ -72,12 +72,11 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSPopoverDelegate {
     private func startRefreshLoop() {
         refreshTask = Task { [weak self] in
             guard let s = self else { return }
-            // First cycle: fetch current view, then prefetch all periods in background
+            // First cycle: fetch today so the status icon has a number within seconds of launch.
             await s.store.refreshQuietly(period: .today)
             s.refreshStatusButton()
             await s.store.refresh(includeOptimize: true)
             s.refreshStatusButton()
-            await s.store.prefetchAll()
 
             while !Task.isCancelled {
                 try? await Task.sleep(nanoseconds: refreshIntervalNanos)
@@ -88,6 +87,13 @@ final class AppDelegate: NSObject, NSApplicationDelegate, NSPopoverDelegate {
                 s.refreshStatusButton()
             }
         }
+
+        // Period tabs are fetched lazily when the user first clicks them in the popover.
+        // An earlier version prefetched every period on launch to make tab switching instant,
+        // but on large session corpora that spawned four concurrent codeburn subprocesses
+        // competing with the main refresh loop for disk and parser time, and the status label
+        // drifted stale for minutes. A per-tab first-click cost of a few seconds is the better
+        // tradeoff on user machines that track thousands of sessions.
     }
 
     private func observeStore() {

mac/Sources/CodeBurnMenubar/CodeBurnApp.swift

@@ -1,15 +1,14 @@
 {
   "name": "codeburn",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "See where your AI coding tokens go - by task, tool, model, and project",
   "type": "module",
   "main": "./dist/cli.js",
   "bin": {
-    "codeburn": "bin/codeburn"
+    "codeburn": "dist/cli.js"
   },
   "files": [
-    "dist",
-    "bin"
+    "dist"
   ],
   "scripts": {
     "build": "tsup",