pi-tokenburn 0.7.0 → 0.7.2

package/README.md

@@ -4,6 +4,8 @@
 [![npm downloads](https://img.shields.io/npm/dm/pi-tokenburn.svg)](https://www.npmjs.com/package/pi-tokenburn)
 [![CI](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/ci.yml/badge.svg)](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![Audit](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/security.yml/badge.svg)](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/security.yml)
+[![Fuzz](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/fuzz.yml/badge.svg)](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/fuzz.yml)
 
 Token usage and cost monitor with budgets, directly in your [Pi](https://github.com/earendil-works/pi-coding-agent) session.
 
@@ -232,15 +234,19 @@ CI scripts are [nushell](https://www.nushell.sh) (`scripts/`), the same ones loc
 | Workflow | When | What |
 |---|---|---|
 | **CI** | push / PR | quality gate on Linux; tests on macOS and Windows, and in extreme time zones |
-| **Auto-merge library updates** | CI finished on a Dependabot PR | **patch and minor** updates (GitHub Actions) are merged automatically, but only **after CI is green** on that exact commit; a **major** update waits for you. Then it starts the nightly workflow so the update ships |
-| **Nightly Dependency Update** | every night (GitHub 02:00 UTC, Gitea 02:30) and after each auto-merge | `bun update` within ranges, verify on all platforms, commit `chore(deps)`; then **build, tag and publish a new patch** whenever a library was upgraded or merged, or `feat`/`fix`/`perf` commits are waiting since the last tag |
-| **Release** | tag `vX.Y.Z` | validates the tag against `package.json`, runs the gate, `npm publish` (idempotent, with provenance), creates the release |
+| **Fuzz** | nightly (GitHub 04:00 UTC, Gitea 04:30), and when the extension changes | seeded randomised robustness tests (`tests/fuzz.test.ts`), 200 000 runs per property; a failure prints the seed that reproduces it |
+| **Security** | nightly (GitHub 03:00 UTC, Gitea 03:30), and when dependencies change | `bun audit`: fails on any known vulnerability |
+| **Auto-merge library updates** | CI finished on a Dependabot PR | **patch and minor** updates (GitHub Actions) are merged automatically, but only **after CI is green** on that exact commit; a **major** update waits for you. Needs the `GH_PAT` secret: action bumps change `.github/workflows/*`, which `GITHUB_TOKEN` may not merge |
+| **Gitea Actions Update** | Mondays 03:15 UTC | Gitea has no Dependabot: moves the sha pins in `.gitea/workflows` to the newest release of the **same major** and commits `ci(deps)`; a new major is only reported |
+| **Nightly Dependency Update** | every night (GitHub 02:00 UTC) and after each auto-merge | `bun update` within ranges, verify on all platforms, commit `chore(deps)`; then **build, tag and publish a new patch** whenever a library was upgraded or merged, or `feat`/`fix`/`perf` commits are waiting since the last tag |
+| **Mirror GitHub** (Gitea) | hourly | Gitea has no nightly of its own: fast-forwards its `main` to GitHub's and pushes the new tags (starting Gitea's release for each), so the hosts never diverge; fails loudly if they did |
+| **Release** | tag `vX.Y.Z`, or run it with a bump | validates the tag against `package.json`, runs the gate, `npm publish` (idempotent, with provenance), creates the release |
 
 So library updates need no human: they are merged once CI passes, built, versioned and published as a patch. A downgrade, a failing check, or a major update stops the chain and waits for review.
 
-Manual release: `just release patch` (or `minor` / `major` / `X.Y.Z`) bumps, tags and pushes to GitHub; `just release-all patch` pushes to every configured remote; `just push-release-all` pushes an existing bump.
+Release from CI: **Actions → Release → Run workflow** with a bump (`patch`, `minor`, `major`), or `just release-ci minor`: runs the gate, bumps, writes the changelog, tags, pushes and publishes. Manual release: `just release patch` (or `minor` / `major` / `X.Y.Z`) bumps, tags and pushes to GitHub; `just release-all patch` pushes to every configured remote; `just push-release-all` pushes an existing bump.
 
-**Secrets** (repo settings): `NPM_TOKEN` is an npm *granular access token* with publish rights and "bypass 2FA" (required for CI publishing). Optional: `GH_PAT` (lets a tag push trigger the release itself), `GITEA_TOKEN` (Gitea).
+**Secrets** (repo settings): `NPM_TOKEN` is an npm *granular access token* with publish rights and "bypass 2FA" (required for CI publishing). `GH_PAT` (classic PAT, `repo` + `workflow`: needed to auto-merge GitHub Actions bumps; also lets a tag push trigger the release itself). Optional: `GITEA_TOKEN` (Gitea).
 
 Commits follow [Conventional Commits](https://www.conventionalcommits.org); the changelog is generated by git-cliff.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-tokenburn",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Pi extension for live token usage monitoring and budget tracking (Day / Week / Month / Total). 0 prompt tokens.",
   "keywords": ["pi-package", "pi-extension", "tokenburn", "tokens", "analytics", "budget", "stats"],
   "license": "MIT",
@@ -25,7 +25,8 @@
     "@earendil-works/pi-coding-agent": "*"
   },
   "overrides": {
-    "undici": "8.12.3"
+    "undici": "8.12.3",
+    "minimatch": "11.0.3"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^1.4.0",