pi-tokenburn 0.7.1 → 0.7.3

package/README.md

@@ -4,6 +4,8 @@
 [![npm downloads](https://img.shields.io/npm/dm/pi-tokenburn.svg)](https://www.npmjs.com/package/pi-tokenburn)
 [![CI](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/ci.yml/badge.svg)](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![Audit](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/security.yml/badge.svg)](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/security.yml)
+[![Fuzz](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/fuzz.yml/badge.svg)](https://github.com/sorinirimies/pi-tokenburn/actions/workflows/fuzz.yml)
 
 Token usage and cost monitor with budgets, directly in your [Pi](https://github.com/earendil-works/pi-coding-agent) session.
 
@@ -19,9 +21,9 @@ Totals match the `tokenburn` CLI exactly.
 - **Tables:** usage per model, provider, project and session, for any period, with cache hit %, savings, cost and share.
 - **Filter and export:** limit everything to a provider, model or project; write csv or json.
 - **Pricing:** a price table fills in (or overrides) costs the logs don't have.
-- **Report chart:** `/tokenburn` shows the summary plus a vertical column chart (y-axis, budget line, current period marked, over-budget columns in red, peak/avg footer). Daily (14 days), weekly (8 weeks) or monthly (6 months).
-- **Status line:** `/tokenburn day|week|month|year|all` (or `cycle`) changes the period shown at the bottom. Charts live under `/tokenburn chart <view>`.
-- **Window panel (optional):** Today / Week / Month / Total below the editor, with in/out tokens and cost.
+- **Report chart:** `/tokenburn` shows the summary plus a vertical column chart (y-axis, budget line, current period marked, over-budget columns in red, peak/avg footer). Daily (14 days), weekly (8 weeks), monthly (6 months), yearly (5 years) or all-time.
+- **Status line:** `/tokenburn hour|day|week|month|year|all` (or `cycle`) changes the period shown at the bottom. Charts live under `/tokenburn chart <view>`.
+- **Window panel (optional):** Today / Week / Month / Year / Total below the editor, with in/out tokens and cost.
 - **Budgets** per day, week and month, in tokens and/or dollars.
 - **Live:** the bottom line updates after every assistant message, not only when a turn ends, at no measurable cost (see Performance).
 - **Fast:** per-file cache keyed on mtime+size. First scan of ~400 MB of sessions takes under a second; refreshes after that take milliseconds. Refresh never blocks the agent loop.
@@ -44,23 +46,22 @@ pi install git:github.com/sorinirimies/pi-tokenburn
 
 | Command | What it does |
 |---|---|
-| `/tokenburn day\|week\|month\|year\|all` | **Switch the bottom status line**: today, this week, this month, this year, or the all-time total |
+| `/tokenburn hour\|day\|week\|month\|year\|all` | **Switch the bottom status line**: last 60 minutes, today, this week (from Monday), this month, this year, or the all-time total. `today` and `total` work as aliases of `day` and `all` |
 | `/tokenburn chart <view>` | Report + **chart**. Views: `day` (14 days), `week` (8 weeks), `month` (6 months), `year` (5 years), `all` (whole history; monthly columns up to 18 months, yearly beyond) |
 | `/tokenburn` | Report + daily chart (same as `/tokenburn chart day`) |
-| `/tokenburn cycle` | Rotate the status line: today → week → month → year → total |
-| `/tokenburn status <today\|week\|month\|year\|total>` | Explicit form of the first row |
-| `/tokenburn models hour|day|week|month|year|all` | **Table** of usage per model (tokens, in/out, cache hit %, cache savings, cost, share). Period (optional): `hour` (last 60 min), `day`, `week`, `month`, `year`, `all` (default `all`) |
-| `/tokenburn providers hour|day|week|month|year|all` | Same table per provider |
-| `/tokenburn projects hour|day|week|month|year|all` | Same table per project (session working directory); all projects by default |
-| `/tokenburn sessions hour|day|week|month|year|all` | Leaderboard of the `n` (default 10) costliest sessions |
+| `/tokenburn cycle` | Rotate the status line: hour → today → week → month → year → total |
+| `/tokenburn status <hour\|today\|week\|month\|year\|total>` | Explicit form of the first row |
+| `/tokenburn models hour\|day\|week\|month\|year\|all` | **Table** of usage per model (tokens, in/out, cache hit %, cache savings, cost, share). `period` (optional, default `all`): `hour` (rolling last 60 min), `day` (since local midnight), `week` (since Monday), `month`, `year`, `all`. Optional `provider=x`, `model=x`, `project=x` (substring, this call only) narrow any table, e.g. `models week provider=anthropic` |
+| `/tokenburn providers hour\|day\|week\|month\|year\|all` | Same table per provider; same period and filter arguments |
+| `/tokenburn projects hour\|day\|week\|month\|year\|all` | Same table per project (session working directory) |
+| `/tokenburn sessions hour\|day\|week\|month\|year\|all` | Leaderboard of the `n` costliest sessions: add a number for `n` (default 10), e.g. `sessions week 5` (`top` is an alias) |
 | `/tokenburn session` | Spend of the **current** session, and its share of today |
 | `/tokenburn filter <provider\|model\|project> <value>` | Limit everything (status line, report, tables, export) to matching usage (case-insensitive substring). `filter` shows it, `filter all` clears it |
-| `/tokenburn export csv|json` | Optional `[period]` and `[path]` follow the format. Writes one row per day × provider × model × project (default `tokenburn-<period>.<format>` in the current directory) |
+| `/tokenburn export csv\|json` | Optional `[period]` and `[path]` follow the format. Writes one row per day × provider × model × project (default `tokenburn-<period>.<format>` in the current directory) |
 | `/tokenburn warn <pct>` | Notify once when a budget reaches `pct` percent (default 80) and once when it is exceeded |
 | `/tokenburn rate` | Toggle the burn rate in the status line (`42k/h`: tokens per hour averaged over the status period) |
 | `/tokenburn hit` | Toggle the cache hit ratio (`95% hit`) in the status line |
 | `/tokenburn saved` | Toggle the estimated cache savings (`~$12.40 saved`) in the status line |
-| `/tokenburn hour` | Show the last 60 minutes in the status line (joins `day`, `week`, `month`, `year`, `all`) |
 | `/tokenburn pricing` | Where costs come from (session logs vs your price table) and which models are unpriced |
 | `/tokenburn price <model> <in> <out>` | Set a price in $ per million tokens (key `model` or `provider/model`); `price remove <model>` deletes it. `pricing mode <fill\|override>`: use the table only where the log has no cost (default), or always |
 | `/tokenburn window` | Toggle the panel below the editor |
@@ -75,7 +76,7 @@ pi install git:github.com/sorinirimies/pi-tokenburn
 
 Recorded from a real pi with only this plugin loaded, on synthetic data.
 
-**Switch what the bottom line shows** (`/tokenburn hour|day|week|month|year|all`, or `cycle`):
+**Switch what the bottom line shows** (`/tokenburn hour`, `day`, `week`, `month`, `year`, `all`, or `cycle`):
 
 ![Status line: week, month, year, all, day, then cycle through every period](examples/vhs/generated/status.gif)
 
@@ -152,15 +153,28 @@ Weeks start on Monday, in local time.
   "showStatus": true,
   "showWidget": false,
   "statusWindow": "today",
+  "showRate": true,
+  "showHit": true,
+  "showSaved": true,
+  "warnPct": 80,
+  "filter": { "model": "acme-large" },
+  "prices": { "acme-large": { "input": 3, "output": 15, "cacheRead": 0.3, "cacheWrite": 3.75 } },
+  "priceMode": "fill",
   "budgets": { "dayTokens": 5000000, "weekCost": 50 }
 }
 ```
 
-- `includeCache` (default `true`): count cache read/write tokens in totals, like the `tokenburn` CLI. Cache reads dominate (often 95%+ of tokens) but are billed far cheaper; set `false` to budget on input + output only.
-
 - `enabled` (default `true`): master switch, same as `/tokenburn enable|disable`.
 - `liveRefresh` (default `true`): refresh after each assistant message. `false` = only when a turn ends. `refreshMs` (default `750`, range 250 to 60000) is the coalescing delay.
+- `includeCache` (default `true`): count cache read/write tokens in totals, like the `tokenburn` CLI. Cache reads dominate (often 95%+ of tokens) but are billed far cheaper; set `false` to budget on input + output only.
 - `chartColor` (default `true`): color the chart using your pi theme (current period green, over-budget red, budget line yellow). Set `false` for plain text.
+- `showStatus` / `showWidget` (defaults `true` / `false`): the bottom status line and the panel below the editor.
+- `statusWindow` (default `today`): the status-line period, one of `hour`, `today`, `week`, `month`, `year`, `total`.
+- `showRate` / `showHit` / `showSaved` (default `true`): the burn rate, cache hit ratio and estimated savings in the status line.
+- `warnPct` (default `80`): notify once at this budget percentage and once when exceeded; `0` turns it off.
+- `filter`: only count usage whose `provider`, `model` or `project` contains the value (case-insensitive); set by the `filter` command.
+- `prices` / `priceMode` (default `fill`): price table in $ per million tokens, used where the log has no cost (`fill`) or always (`override`); set by the `price` command.
+- `budgets`: `dayTokens`, `weekTokens`, `monthTokens`, `dayCost`, `weekCost`, `monthCost`.
 
 Environment overrides for the session directory: `TOKENBURN_PI_SESSIONS`, `PI_CODING_AGENT_SESSION_DIR`, `PI_CODING_AGENT_DIR`.
 
@@ -197,7 +211,8 @@ bun install
 just check          # typecheck + tests + pack check + nushell tests (what CI runs)
 just test           # bun test only (with coverage)
 just coverage       # tests + a coverage table
-just push-all       # push main to every configured remote (origin + the Gitea instances); `just --list` has pull-all, push-tags-all, release-all, the *-force and sync-gitea-* variants
+just push-all       # push main to every configured remote (origin + the Gitea instances)
+just --list         # everything else: pull-all, push-tags-all, release-all, sync-gitea-*, the *-force variants
 ```
 
 **Coverage:** every `bun test` collects coverage (`bunfig.toml`) and **fails below 95% lines / 95% functions**. CI shows the table on the run page and uploads `lcov.info`.
@@ -232,15 +247,17 @@ CI scripts are [nushell](https://www.nushell.sh) (`scripts/`), the same ones loc
 | Workflow | When | What |
 |---|---|---|
 | **CI** | push / PR | quality gate on Linux; tests on macOS and Windows, and in extreme time zones |
+| **Fuzz** | nightly (GitHub 04:00 UTC, Gitea 04:30), and when the extension changes | seeded randomised robustness tests (`tests/fuzz.test.ts`), 200 000 runs per property nightly (5 000 when the extension changes; `just fuzz [iterations] [seed]` locally); a failure prints the seed that reproduces it |
+| **Security** | nightly (GitHub 03:00 UTC, Gitea 03:30), and when dependencies change | `bun audit`: fails on any known vulnerability |
 | **Auto-merge library updates** | CI finished on a Dependabot PR | **patch and minor** updates (GitHub Actions) are merged automatically, but only **after CI is green** on that exact commit; a **major** update waits for you. Needs the `GH_PAT` secret: action bumps change `.github/workflows/*`, which `GITHUB_TOKEN` may not merge |
 | **Gitea Actions Update** | Mondays 03:15 UTC | Gitea has no Dependabot: moves the sha pins in `.gitea/workflows` to the newest release of the **same major** and commits `ci(deps)`; a new major is only reported |
 | **Nightly Dependency Update** | every night (GitHub 02:00 UTC) and after each auto-merge | `bun update` within ranges, verify on all platforms, commit `chore(deps)`; then **build, tag and publish a new patch** whenever a library was upgraded or merged, or `feat`/`fix`/`perf` commits are waiting since the last tag |
 | **Mirror GitHub** (Gitea) | hourly | Gitea has no nightly of its own: fast-forwards its `main` to GitHub's and pushes the new tags (starting Gitea's release for each), so the hosts never diverge; fails loudly if they did |
-| **Release** | tag `vX.Y.Z` | validates the tag against `package.json`, runs the gate, `npm publish` (idempotent, with provenance), creates the release |
+| **Release** | tag `vX.Y.Z`, or run it with a bump | validates the tag against `package.json`, runs the gate, `npm publish` (idempotent, with provenance), creates the release |
 
 So library updates need no human: they are merged once CI passes, built, versioned and published as a patch. A downgrade, a failing check, or a major update stops the chain and waits for review.
 
-Manual release: `just release patch` (or `minor` / `major` / `X.Y.Z`) bumps, tags and pushes to GitHub; `just release-all patch` pushes to every configured remote; `just push-release-all` pushes an existing bump.
+Release from CI: **Actions → Release → Run workflow** with a bump (`patch`, `minor`, `major`), or `just release-ci minor`: runs the gate, bumps, writes the changelog, tags, pushes and publishes. Manual release: `just release patch` (or `minor` / `major` / `X.Y.Z`) bumps, tags and pushes to GitHub; `just release-all patch` pushes to every configured remote; `just push-release-all` pushes an existing bump.
 
 **Secrets** (repo settings): `NPM_TOKEN` is an npm *granular access token* with publish rights and "bypass 2FA" (required for CI publishing). `GH_PAT` (classic PAT, `repo` + `workflow`: needed to auto-merge GitHub Actions bumps; also lets a tag push trigger the release itself). Optional: `GITEA_TOKEN` (Gitea).
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-tokenburn",
-  "version": "0.7.1",
-  "description": "Pi extension for live token usage monitoring and budget tracking (Day / Week / Month / Total). 0 prompt tokens.",
+  "version": "0.7.3",
+  "description": "Pi extension for live token usage monitoring and budget tracking (hour / day / week / month / year / all). 0 prompt tokens.",
   "keywords": ["pi-package", "pi-extension", "tokenburn", "tokens", "analytics", "budget", "stats"],
   "license": "MIT",
   "author": "sorinirimies",
@@ -25,7 +25,8 @@
     "@earendil-works/pi-coding-agent": "*"
   },
   "overrides": {
-    "undici": "8.12.3"
+    "undici": "8.12.3",
+    "minimatch": "11.0.3"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^1.4.0",