burn-o-meter 0.6.5__tar.gz

burn_o_meter-0.6.5/.claude/RESUME.md

@@ -0,0 +1,23 @@
+# Claude Code — resume checkpoint
+
+Session: 180ada93-1c90-4b9a-9372-0311fac0c81d
+Written: 2026-08-24T17:57:57.497Z
+Trigger: near-limit
+Ref with your in-progress files: refs/claude/checkpoint-180ada93
+
+## To resume
+
+    claude --resume 180ada93-1c90-4b9a-9372-0311fac0c81d
+
+(or open Claude Code in this directory and run /resume)
+
+## Plan (from TodoWrite state)
+
+No task list was active; see transcript via the resume command above.
+
+---
+
+Don't want these changes? Resume this session (above), then run
+`/rewind` to roll back the turn's tool edits (bash-made changes
+excluded). refs/claude/checkpoint-180ada93 holds a full snapshot until this session's
+next checkpoint, or for up to ~2 weeks.

burn_o_meter-0.6.5/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,56 @@
+name: Bug report
+description: A number looks wrong, or something does not work
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Before you paste anything:** `burnometer doctor` and `--json` output are
+        designed to be safe to share — they contain aggregates only, no prompt
+        text, and no absolute paths under the default privacy setting. If you
+        want to be extra careful, set `project_paths = "hash"` in
+        `~/.burn-o-meter/config.toml` and re-run; project names become opaque.
+
+        Never paste a provider log file (`~/.claude/projects/**`,
+        `~/.codex/sessions/**`). Those contain your full conversations.
+
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+      description: What did you expect, and what did you get instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Output of `burnometer doctor`
+      render: text
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: "`burnometer --version`, plus macOS version if it is the app"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Where
+      options: [CLI, menu bar app, background agent, not sure]
+    validations:
+      required: true
+
+  - type: textarea
+    id: numbers
+    attributes:
+      label: If a number looks wrong
+      description: |
+        What does burn-o-meter say, what do you believe is correct, and where
+        does the correct figure come from? Cost figures are labelled `api_billed`
+        or `api_equivalent` — please say which you are comparing against.

burn_o_meter-0.6.5/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/devopsinside/burn-o-meter/security/advisories/new
+    about: Please report privately, not as a public issue. See SECURITY.md.
+  - name: Question or idea
+    url: https://github.com/devopsinside/burn-o-meter/discussions
+    about: Ask a question or propose something before building it.

burn_o_meter-0.6.5/.github/ISSUE_TEMPLATE/provider_request.yml

@@ -0,0 +1,36 @@
+name: Provider support
+description: Ask for a new AI tool or agent to be supported
+labels: [provider]
+body:
+  - type: input
+    id: tool
+    attributes:
+      label: Which tool
+      description: Name and link
+    validations:
+      required: true
+
+  - type: input
+    id: path
+    attributes:
+      label: Where does it write usage data
+      description: "e.g. `~/.foo/sessions/*.jsonl`. Path only — do not paste contents."
+    validations:
+      required: true
+
+  - type: textarea
+    id: shape
+    attributes:
+      label: What the usage record looks like
+      description: |
+        A **redacted** example: field names and numbers, with all message content
+        removed. Please strip anything you would not post publicly.
+      render: json
+
+  - type: checkboxes
+    id: quota
+    attributes:
+      label: Does it record rate limits or quota?
+      options:
+        - label: It writes a percentage or limit figure to disk
+        - label: I do not know

burn_o_meter-0.6.5/.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    # Wait a week before proposing a newly published version. Nearly every
+    # package-registry compromise is caught within days of the bad version going
+    # up, so the cost of a week's delay is small and the thing it avoids is
+    # merging a malicious release automatically, hours after it appears.
+    cooldown:
+      default-days: 7
+
+  # Actions are pinned to commit SHAs, which a tag cannot be repointed underneath
+  # - that is the actual mitigation. Dependabot's job here is to keep those pins
+  # from going stale, proposing a new SHA with the version in the commit message.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

burn_o_meter-0.6.5/.github/pull_request_template.md

@@ -0,0 +1,29 @@
+## What and why
+
+<!-- What changes, and what problem it solves. If a number changes, say which
+     and by how much. -->
+
+## Checklist
+
+- [ ] `ruff check src tests` and `ruff format --check src tests` pass
+- [ ] `pytest` passes
+- [ ] New behaviour has a test
+
+If this touches parsing, pricing, or anything that produces a figure:
+
+- [ ] No number is invented — unknown stays `NULL`/`—`, never `0.0`
+- [ ] Cost bases are not summed together
+- [ ] Anything derived rather than reported is labelled `est`
+- [ ] Fixtures include a malformed record and a duplicate
+
+If this touches file reading or storage:
+
+- [ ] No glob widened; no content field added to an allowlist in `safety.py`
+- [ ] No new network call outside `pricing/catalog.py`
+- [ ] Error messages carry `path:line`, never file content
+- [ ] `pytest tests/test_security.py` passes
+
+## Verification
+
+<!-- What you ran, and what it showed. Reconciling against a second source
+     (raw logs, a provider's own totals) is the strongest evidence. -->

burn_o_meter-0.6.5/.github/workflows/bottles.yml

@@ -0,0 +1,144 @@
+# Builds Homebrew bottles - prebuilt tarballs - so `brew install` needs no
+# compiler. burn-o-meter is pure Python and compiles nothing, but Homebrew builds
+# Python formulae from sdists with --no-binary=:all:, so without a bottle it
+# demands Apple's ~1GB Command Line Tools from every user. A bottle removes that.
+name: bottles
+
+# Run this BEFORE creating the release, not after. Bottles build from the tag's
+# source archive, which exists as soon as the tag is pushed — and the release must
+# be created with the bottles already attached, because GitHub releases are
+# immutable and assets cannot be added later. A `release: published` trigger was
+# removed for that reason: it fired after the only useful moment had passed, and
+# checked out the tag ref, so any formula fix made after tagging was invisible to
+# it and it failed permanently.
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to build bottles for, e.g. v0.3.4 (push the tag first)"
+        required: true
+
+permissions:
+  contents: read
+
+env:
+  HOMEBREW_NO_AUTO_UPDATE: 1
+  HOMEBREW_NO_ANALYTICS: 1
+  # Homebrew 6 refuses untrusted taps. This is our own formula, from this same
+  # repository, built by this repository's CI - there is no third party to trust.
+  HOMEBREW_NO_REQUIRE_TAP_TRUST: 1
+
+jobs:
+  build:
+    name: ${{ matrix.label }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-26
+            label: arm64_tahoe (macOS 26)
+          - runner: macos-15
+            label: arm64_sequoia (macOS 15)
+          - runner: macos-14
+            label: arm64_sonoma (macOS 14)
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Resolve the tag being bottled
+        id: tag
+        # Through env, never spliced into the script. `${{ }}` is substituted
+        # before the shell sees the text at all, so a crafted tag name would run
+        # as code on a runner holding this repository's token.
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+        run: echo "tag=${RELEASE_TAG:-$INPUT_TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Tap this checkout
+        # Tapping the workspace bottles the formula as it exists in THIS commit,
+        # rather than whatever main happens to hold.
+        run: brew tap devopsinside/burn-o-meter "$GITHUB_WORKSPACE"
+
+      - name: Build
+        run: brew install --build-bottle devopsinside/burn-o-meter/burn-o-meter
+
+      - name: Prove it runs before we ship it
+        run: |
+          brew test devopsinside/burn-o-meter/burn-o-meter
+          burn-o-meter --version
+          burn-o-meter doctor >/dev/null
+
+      - name: Bottle
+        env:
+          REPOSITORY: ${{ github.repository }}
+          RESOLVED_TAG: ${{ steps.tag.outputs.tag }}
+        run: |
+          brew bottle --json --no-rebuild \
+            --root-url="https://github.com/${REPOSITORY}/releases/download/${RESOLVED_TAG}" \
+            devopsinside/burn-o-meter/burn-o-meter
+          # brew writes `name--version.tag.bottle.tar.gz` but serves it as
+          # `name-version...`; the JSON carries both names, so rename from that
+          # rather than guessing at the string.
+          for j in *.json; do
+            jq -r '.[].bottle.tags[] | "\(.local_filename)\t\(.filename)"' "$j" |
+              while IFS=$'\t' read -r src dst; do
+                [ "$src" != "$dst" ] && mv -- "$src" "$dst"
+              done
+          done
+          ls -la *.bottle.tar.gz *.json
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: bottle-${{ matrix.runner }}
+          path: |
+            *.bottle.tar.gz
+            *.json
+          if-no-files-found: error
+
+  collect:
+    name: collect bottles
+    needs: build
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      # v8 errors on a digest mismatch instead of warning, and no longer unzips a
+      # download that is not a zip. The artifacts here are multi-file uploads, which
+      # are always zipped, so the second does not apply - verified by running this
+      # workflow against v8 before it merged, since pull-request CI never runs it.
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          pattern: bottle-*
+          merge-multiple: true
+
+      - name: Print the bottle block for the release
+        # Deliberately does NOT attach these to the release. GitHub releases are
+        # immutable once published: assets can only be added at creation time, and
+        # a tag consumed by an immutable release can never be reused - so a
+        # workflow that uploads afterwards cannot work, and retrying burns the
+        # version number. The bottles are published as workflow artifacts instead,
+        # and `scripts/release.sh` attaches them while creating the release.
+        env:
+          REPOSITORY: ${{ github.repository }}
+          RESOLVED_TAG: ${{ steps.tag.outputs.tag }}
+          INPUT_TAG: ${{ inputs.tag }}
+        run: |
+          {
+            echo "### Bottles built"
+            echo
+            echo "Download the \`bottle-*\` artifacts from this run, then create the"
+            echo "release with them attached — assets cannot be added afterwards."
+            echo
+            echo '```ruby'
+            echo '  bottle do'
+            echo "    root_url \"https://github.com/${REPOSITORY}/releases/download/${RESOLVED_TAG:-$INPUT_TAG}\""
+            for f in *.bottle.tar.gz; do
+              tag=$(echo "$f" | sed -E 's/.*\.(arm64_[a-z]+)\.bottle\.tar\.gz/\1/')
+              sum=$(shasum -a 256 "$f" | cut -d' ' -f1)
+              printf '    sha256 cellar: :any_skip_relocation, %s: "%s"\n' "$tag" "$sum"
+            done
+            echo '  end'
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          cat "$GITHUB_STEP_SUMMARY"

burn_o_meter-0.6.5/.github/workflows/ci.yml

@@ -0,0 +1,199 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  engine:
+    name: engine (py${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Lint
+        run: |
+          ruff check src tests
+          ruff format --check src tests
+
+      - name: Test
+        run: pytest -q
+
+      # Again at a different width. The report tables wrap to the terminal, so a
+      # test asserting on a sentence can pass at one width and fail at another -
+      # a real assertion was green locally at 120 and red here at 80, because 80
+      # was the only width anything ever ran at.
+      - name: Test (narrow and wide terminals)
+        run: |
+          COLUMNS=60 pytest -q
+          COLUMNS=200 pytest -q
+
+  scripts:
+    name: shell scripts lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: shellcheck
+        # install.sh and uninstall.sh are the first thing a new user runs. They get
+        # the same scrutiny as the Python, because a broken installer is a worse
+        # first impression than a broken feature.
+        run: shellcheck -S warning install.sh uninstall.sh scripts/*.sh macos/make-app.sh
+
+  security:
+    name: security guarantees
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      # The suite runs with an autouse fixture that raises on any outbound
+      # socket, so this job also proves the engine makes no network calls.
+      - name: Guarantee suite (G1-G7)
+        run: pytest tests/test_security.py -v
+
+      # Belt and braces on top of the in-test canary scan: build a database from
+      # the fixtures and grep the artefacts on disk.
+      - name: Canary scan of built artefacts
+        run: |
+          set -euo pipefail
+          export BURNOMETER_HOME="$RUNNER_TEMP/bom"
+          python - <<'PY'
+          import os, pathlib
+          from burnometer.adapters.base import LogSource
+          from burnometer.adapters.claude_code import ClaudeCodeAdapter
+          from burnometer.adapters.codex import CodexAdapter
+          from burnometer.scan import scan
+          from burnometer.snapshot import write_snapshot
+          from burnometer.store import Store
+
+          root = pathlib.Path("tests/fixtures")
+          class C(ClaudeCodeAdapter):
+              def sources(self): return [LogSource(root=root / "claude_code", glob="*.jsonl")]
+          class X(CodexAdapter):
+              def sources(self): return [LogSource(root=root / "codex", glob="*.jsonl")]
+
+          home = pathlib.Path(os.environ["BURNOMETER_HOME"])
+          with Store.open(home / "burn.db") as store:
+              scan(store, adapters=[C(), X()])
+              assert store.count_events() > 0, "fixtures produced no events"
+              write_snapshot(store)
+          PY
+          for f in "$BURNOMETER_HOME"/*; do
+            if grep -qa "CANARY" "$f"; then
+              echo "::error::content leaked into $(basename "$f")"; exit 1
+            fi
+          done
+          echo "no prompt content in any produced artefact"
+
+      - name: Dependency audit
+        run: |
+          set -euo pipefail
+          pip install pip-audit
+          # Audit the dependency tree, not the project itself. burn-o-meter is
+          # installed from local source and is not on PyPI, so pip-audit cannot
+          # look it up and --strict turns that into a failure. Excluding it keeps
+          # every real dependency strictly audited.
+          pip freeze --exclude-editable | grep -iv '^burn.o.meter' > /tmp/deps.txt
+          cat /tmp/deps.txt
+          pip-audit --strict --desc -r /tmp/deps.txt
+
+  package:
+    name: wheel installs clean
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.12"
+
+      - name: Build
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build --wheel
+
+      # A wheel missing the vendored pricing data would silently report every
+      # model as unpriced, so its presence is checked rather than assumed.
+      - name: Data files are packaged
+        run: |
+          python - <<'PY'
+          import glob, zipfile, sys
+          names = zipfile.ZipFile(glob.glob("dist/*.whl")[0]).namelist()
+          missing = [f for f in ("snapshot.json", "overlay.toml", "schema.sql")
+                     if not any(n.endswith(f) for n in names)]
+          sys.exit(f"missing from wheel: {missing}") if missing else print("all data files present")
+          PY
+
+      - name: Install into a clean environment and run
+        run: |
+          python -m venv /tmp/fresh
+          /tmp/fresh/bin/pip install --quiet dist/*.whl
+          /tmp/fresh/bin/burnometer --version
+          BURNOMETER_HOME=/tmp/bom-home /tmp/fresh/bin/burnometer doctor
+
+  app:
+    name: macOS app builds
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - name: Build
+        run: swift build --package-path macos/burn-o-meter -c release
+      - name: Bundle
+        run: macos/make-app.sh
+      - name: Popover layout fits, and nothing is clipped
+        # A view that outgrows the popover compiles cleanly and passes every
+        # engine test - AppKit clips it at runtime instead of scrolling. This
+        # renders the real view against an oversized snapshot and measures it.
+        run: macos/build/burn-o-meter.app/Contents/MacOS/burn-o-meter --check-layout
+
+      - name: A stale quota reading is never presented as current
+        # The menu bar sat at an old percentage indefinitely: a quota's age was
+        # read from the payload's own age_seconds, which the writer computes once,
+        # so it never advanced and a four-hour-old reading still classified as
+        # current. Nothing on the poll timer regenerated the payload either.
+        run: macos/build/burn-o-meter.app/Contents/MacOS/burn-o-meter --check-freshness
+
+      - name: Bundle reports the real version
+        # A hardcoded fallback in make-app.sh shipped builds labelled 0.1.0 long
+        # after 0.3.0 was out. A version string that lies is worse than a missing
+        # one, because nobody thinks to doubt it.
+        run: |
+          want=$(sed -n 's/^__version__ = "\(.*\)"/\1/p' src/burnometer/__init__.py)
+          got=$(/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" \
+                macos/build/burn-o-meter.app/Contents/Info.plist)
+          [ "$want" = "$got" ] || { echo "bundle says $got, package is $want" >&2; exit 1; }
+          echo "bundle version matches package: $got"
+
+      - name: Bundle is a status-bar app
+        run: |
+          plist=macos/build/burn-o-meter.app/Contents/Info.plist
+          /usr/libexec/PlistBuddy -c "Print :LSUIElement" "$plist" | grep -q true
+          echo "LSUIElement set: no Dock icon"

burn_o_meter-0.6.5/.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly, so a newly-published advisory is caught even without a commit.
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: analyze python
+    runs-on: ubuntu-latest
+    # Code scanning needs GitHub Advanced Security, which private repositories
+    # do not get on the free plan — the upload fails with "Resource not
+    # accessible by integration". Skipping while private keeps the workflow
+    # ready for the moment the repository goes public, without a permanently red
+    # check that trains everyone to ignore failures.
+    if: github.event.repository.private == false
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      # init and analyze must move together. They are separate pins, so Dependabot
+      # bumps them in separate PRs - and each fails alone, because analyze refuses a
+      # configuration written by a different version of init ("Loaded a
+      # configuration file for version '3.38.0', but running version '4.38.0'").
+      # v3 is deprecated in December 2026.
+      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0
+        with:
+          languages: python
+          queries: security-and-quality
+      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4.38.0

burn_o_meter-0.6.5/.github/workflows/pypi.yml

@@ -0,0 +1,51 @@
+# Publishes a GitHub release's own sdist and wheel to PyPI.
+#
+# Trusted Publishing: PyPI trusts this workflow, in this repository and
+# environment, through a short-lived OIDC token. No API token exists anywhere to
+# be leaked or rotated.
+#
+# The files uploaded are the ones already attached to the release, not a rebuild,
+# so PyPI and the release serve byte-identical artifacts. Run it after the release
+# exists (RELEASING.md step 8). Like a GitHub release, a PyPI version is immutable:
+# a file, once uploaded, can never be replaced.
+name: PyPI
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to publish, e.g. v0.6.5 (the release must exist)"
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/burn-o-meter/
+    permissions:
+      contents: read
+      id-token: write  # the OIDC token Trusted Publishing exchanges; nothing else
+    steps:
+      - name: Download the release's sdist and wheel
+        env:
+          GH_TOKEN: ${{ github.token }}
+          # Through the environment, never interpolated into the script: an
+          # expression is expanded before the shell sees the text.
+          TAG: ${{ inputs.tag }}
+        run: |
+          [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "not a release tag: $TAG"; exit 1; }
+          version="${TAG#v}"
+          mkdir dist
+          gh release download "$TAG" --repo "$GITHUB_REPOSITORY" --dir dist \
+            --pattern "burn_o_meter-$version.tar.gz" \
+            --pattern "burn_o_meter-$version-py3-none-any.whl"
+          # Exactly the two files for this version, and nothing else.
+          test -f "dist/burn_o_meter-$version.tar.gz"
+          test -f "dist/burn_o_meter-$version-py3-none-any.whl"
+          test "$(find dist -type f | wc -l)" -eq 2
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2

burn_o_meter-0.6.5/.gitignore

@@ -0,0 +1,29 @@
+# Local-only working notes — NEVER commit. Contains machine-specific paths
+# and session context, not project documentation.
+PROGRESS.md
+.scratch/
+
+__pycache__/
+*.py[cod]
+.venv/
+dist/
+build/
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+*.db
+# ...but test fixtures are source, not user data. Without this the OpenCode
+# fixture is silently untracked: tests pass on the machine that generated it and
+# fail on CI, which is the worst possible split.
+!tests/fixtures/**/*.db
+*.db-wal
+*.db-shm
+.DS_Store
+macos/**/xcuserdata/
+macos/**/.build/
+macos/build/
+*.app/
+
+# Generated from macos/make-icon.swift — the .icns is committed, the staging
+# directory it is built from is not.
+macos/burn-o-meter.iconset/