Track multiple provider plans

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+## Summary
+
+<!-- What does this PR do? 1-3 bullet points. -->
+
+## Testing
+
+- [ ] I have tested this locally against real data (not just unit tests)
+- [ ] `npm test` passes
+- [ ] `npm run build` succeeds
+
+### For new providers only:
+
+- [ ] I installed the tool and generated real sessions by using it
+- [ ] `npm run dev -- today` shows correct costs and session counts for this provider
+- [ ] `npm run dev -- models --provider <name>` shows correct model names and pricing
+- [ ] Screenshot or terminal output attached below proving it works with real data
+
+<!-- Paste screenshot / terminal output here -->

.github/workflows/release-menubar.yml

@@ -2,8 +2,8 @@ name: Release macOS Menubar
 
 # Triggers on a `mac-v*` tag push (e.g. `git tag mac-v0.8.0 && git push origin mac-v0.8.0`),
 # or manually via the Actions tab. Builds a universal arm64+x86_64 bundle, ad-hoc signs it,
-# zips via `ditto`, and uploads the zip to the GitHub Release. `npx codeburn menubar` clears
-# the download quarantine flag on install so Gatekeeper stays quiet.
+# zips via `ditto`, and uploads the zip to the GitHub Release. The installer verifies
+# the checksum and bundle identity before replacing the local app.
 on:
   push:
     tags:
@@ -45,7 +45,9 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: CodeBurnMenubar-${{ steps.version.outputs.value }}
-          path: mac/.build/dist/CodeBurnMenubar-*.zip
+          path: |
+            mac/.build/dist/CodeBurnMenubar-${{ steps.version.outputs.value }}.zip
+            mac/.build/dist/CodeBurnMenubar-${{ steps.version.outputs.value }}.zip.sha256
           if-no-files-found: error
 
       - name: Create / update GitHub Release
@@ -58,14 +60,16 @@ jobs:
             Install with:
 
             ```
-            npx codeburn menubar
+            npm install -g codeburn
+            codeburn menubar
             ```
 
-            That command drops the app into `~/Applications`, clears the download
-            quarantine, and launches it. If you download the zip from this page directly
-            and macOS shows "cannot verify developer", right-click the app in Finder and
-            pick Open to whitelist it once.
+            That command drops the app into `~/Applications`, records the persistent
+            `codeburn` CLI path used by the menubar, verifies the downloaded checksum,
+            clears quarantine after bundle verification, and launches it. If you download
+            the zip from this page directly and macOS shows "cannot verify developer",
+            right-click the app in Finder and pick Open to whitelist it once.
           files: |
-            mac/.build/dist/CodeBurnMenubar-*.zip
-            mac/.build/dist/CodeBurnMenubar-*.zip.sha256
+            mac/.build/dist/CodeBurnMenubar-${{ steps.version.outputs.value }}.zip
+            mac/.build/dist/CodeBurnMenubar-${{ steps.version.outputs.value }}.zip.sha256
           fail_on_unmatched_files: true

.gitignore

@@ -40,3 +40,6 @@ assets/discord-*.png
 
 # Desktop app experiments
 desktop/
+
+# WIP / not ready
+src/summit.ts

CHANGELOG.md

@@ -1,8 +1,100 @@
 # Changelog
 
+## Unreleased
+
+### Added (CLI)
+- **Multiple subscription plans can be tracked at the same time.**
+  `codeburn plan set` now stores plans in a provider-keyed `plans` map, so
+  setting a Codex custom plan no longer overwrites an existing Claude plan.
+  `codeburn plan reset --provider <name>` removes only that provider's plan,
+  while `codeburn plan reset` remains a full reset. The dashboard and JSON
+  outputs include one overage summary per active provider plan. Aggregate
+  `all` plans remain mutually exclusive with provider-specific plans to avoid
+  double-counted overage rows. Existing single-plan `plan` config files
+  continue to load as a backward-compatible fallback, and subsequent writes
+  save the new `plans` map format. Preset plans now reject mismatched
+  `--provider` scopes instead of silently ignoring them. Closes #299.
+- **Mistral Vibe provider.** CodeBurn now reads Mistral Vibe session folders
+  from `$VIBE_HOME/logs/session/` or `~/.vibe/logs/session/`, using
+  `meta.json` for cumulative prompt/completion tokens, model pricing, and
+  timestamps, and `messages.jsonl` for user prompts and tool calls. Subagent
+  sessions under a parent session's `agents/` folder are tracked separately.
+  Closes #283.
+- **Kimi Code CLI provider.** CodeBurn now reads Kimi session usage from
+  `$KIMI_SHARE_DIR/sessions/` or `~/.kimi/sessions/`, including subagent
+  `wire.jsonl` files. The parser consumes Kimi's official `StatusUpdate`
+  token usage fields (`input_other`, `input_cache_read`,
+  `input_cache_creation`, `output`), normalizes Kimi tool names such as
+  `Shell`, `ReadFile`, and `WriteFile`, and maps hidden managed Kimi Code
+  model aliases to priced Kimi K2 entries.
+
+## 0.9.9 - 2026-05-15
+
+### Added (CLI)
+- **IBM Bob provider.** Discovers IBM Bob IDE task history, reuses the
+  Cline-family parser for token/cost records, extracts model tags and
+  workspace-based project names from session data. Closes #248.
+
+### Fixed (CLI)
+- **Reduced Claude parser OOM risk.** Large Claude JSONL sessions retained
+  full entry objects (text, thinking blocks, tool results) in memory during
+  parsing, causing V8 heap exhaustion on heavy usage months. Entries are now
+  compacted immediately after JSON.parse, keeping only the fields needed for
+  cost/token aggregation. This is a mitigation - very heavy users may still
+  need the streaming parser refactor planned next.
+- **Eager daily-cache hydration caused OOM on most CLI commands.** Eight
+  commands (report, today, month, export, optimize, compare, models, yield)
+  called `hydrateCache()` which parses a 365-day backfill, even though only
+  `status --format menubar-json` consumes the daily cache. Removed from all
+  paths that parse their own date ranges via `parseAllSessions`.
+- **Session cache retained between status parses.** The `status --format json`
+  path parsed today and month ranges without clearing the in-process session
+  cache between them, keeping both result sets pinned. Cache is now cleared
+  after each period is consumed.
+- **Claude 1-hour cache write pricing.** 1-hour cache writes are now priced
+  at 2x base input (previously used the 5-minute 1.25x rate for all writes).
+  Daily cache bumped to v6 so stale totals are recomputed. Closes #276.
+- **OpenCode MCP usage now counted.** OpenCode stores MCP tool calls as
+  `<server>_<tool>` names, which the shared MCP pipeline did not recognize.
+  The provider now normalizes these to the canonical `mcp__<server>__<tool>`
+  form so MCP breakdowns and `optimize` work correctly. Closes #308.
+- **Antigravity Windows language-server discovery.** Antigravity detection now
+  supports Windows process discovery, `--extension_server_port`,
+  `--extension_server_csrf_token`, `--flag=value` syntax, and both wrapped and
+  unwrapped Connect-RPC response shapes. Closes #249.
+- **Mangled project names in dashboard.** The By Project and Top Sessions
+  panels decoded slugs by splitting on `-`, which broke directory names
+  containing dashes or dots (e.g. `my-project` rendered as `my/project`).
+  Now uses the real project path instead. Closes #320.
+- **Cursor undated bubble rows misattributed to Today.** Bubble rows without
+  a `createdAt` timestamp were defaulting to the current date, inflating
+  Today's spend. Now skipped at both the SQL and application level.
+- **Node version guard.** Running on Node < 22.13.0 now prints a clear
+  upgrade message instead of crashing with a cryptic `node:sqlite` parse
+  error. Closes #319.
+
+### Fixed (macOS menubar)
+- **All-provider refresh OOM.** Refreshing with provider set to "All" could
+  exhaust the V8 heap on accounts with heavy session history.
+- **Tab refresh recovery.** Switching tabs during a refresh no longer leaves
+  the panel in a stale loading state.
+- **Stale cache recovery.** The menubar now detects and discards a corrupt or
+  outdated on-disk cache instead of rendering zeroes until the next restart.
+- **Refresh timer hardening.** The 30-second auto-refresh timer is now
+  cancelled on sleep/wake and restarted cleanly, preventing overlapping
+  refreshes after lid-open.
+- **Version display.** The settings panel now shows the version without the
+  `v` prefix for consistency with `codeburn --version`.
+
 ## 0.9.8 - 2026-05-10
 
 ### Added (CLI)
+- **Cline provider support.** CodeBurn now reads Cline task usage from both
+  VS Code globalStorage (`saoudrizwan.claude-dev`) and Cline's
+  `~/.cline/data` task root. It reuses the existing Cline-family parser for
+  `ui_messages.json` usage entries, deduplicates migrated tasks by the newest
+  `ui_messages.json`, and exposes Cline in CLI provider filters, docs, and the
+  macOS menubar provider tabs. Closes #130.
 - **Multiple Claude config directories.** Set `CLAUDE_CONFIG_DIRS` to an
   OS-delimited list of paths (`:`-separated on POSIX, `;`-separated on
   Windows) to scan more than one Claude data directory in a single run.

CONTRIBUTING.md

@@ -84,6 +84,23 @@ The `.github/workflows/block-claude-coauthor.yml` workflow rejects any PR whose
 
 If a flagged PR rejects on this check, the workflow prints the exact rebase command to fix it.
 
+## Before You Start
+
+**Comment on the issue first.** Before writing code for a feature or new provider, leave a comment on the relevant issue saying what you plan to do. Wait for a maintainer to confirm the approach. Unsolicited PRs that duplicate work already in progress or take an incompatible approach will be closed.
+
+**One PR at a time.** We will not review a second PR from you until the first is merged or closed. This keeps the review queue manageable and ensures each contribution gets proper attention.
+
+## Adding a New Provider
+
+New providers have the highest bar because broken parsing silently produces wrong data for users. Before opening a PR:
+
+1. **Install the tool and use it.** Generate real sessions by actually coding with the provider. We do this ourselves for every provider we ship.
+2. **Test against real data.** Run `npm run dev -- today` and `npm run dev -- models` with your real sessions and confirm the output looks correct — costs are non-zero, model names resolve, session counts match what you see in the tool.
+3. **Include proof in the PR.** Attach a screenshot or terminal output showing codeburn correctly parsing your real sessions. PRs for new providers without evidence of local testing will not be reviewed.
+4. **Do not rely on AI-generated guesses about storage paths or schemas.** Tools change their data formats between versions. The only way to know the current schema is to install the tool and inspect the actual files on disk.
+
+PRs that add a provider based solely on online documentation or AI-generated code, without evidence of testing against real data, will be closed.
+
 ## Pull Requests
 
 1. Fork or branch from `main`.