release: v2.5.0 — upstream parity, device sharing, web dashboard

CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## 2.5.0 - 2026-07-23
+
+Major upstream-parity release. Alongside new providers and a batch of
+cost-accuracy fixes, this adds the context/acting features and two greenfield
+subsystems: opt-in LAN **device sharing** (mutual-TLS) and a local **web
+dashboard**. Nothing network-facing is on by default.
+
+### Added
+- **Device sharing (opt-in, local network).** `codeburn share` advertises this
+  Mac over mDNS; `codeburn devices` discovers, pairs with, and pulls usage from
+  your other Macs, and `status --scope combined` folds them into one view.
+  Mutual-TLS with trust-on-first-use certificate pinning, a 6-digit PIN and an
+  approve-style matching-code flow, and bearer tokens bound to the peer's cert
+  (a stolen token replayed from another device is refused). Only sanitized
+  aggregates ever leave the machine — never project names, paths, or
+  per-session detail. (upstream #532/#536/#567/#568)
+- **Local web dashboard.** `codeburn web` opens a **loopback-only** (127.0.0.1,
+  Host/Origin-guarded) React dashboard: hero + metric cards, a granular usage
+  timeline, and By Tool / Top Projects / Model Efficiency / Skills / MCP /
+  Subagents panels, plus a context explorer and the device-sharing UI.
+  (upstream #573/#582/#589/#533/#534/#554/#586)
+- **Context token breakdown** — `codeburn context [session]`: what fills the
+  window, by role, block type, and tool (Claude + Codex).
+- **Acting layer** — `codeburn optimize --apply` and `codeburn act
+  list|undo|report`: apply optimize findings as journaled, reversible edits.
+- **Overview, audit, and price-override commands**; Codex credits (CLI + a
+  cost → tokens → **credits** hero metric in the macOS menubar).
+- **Lifetime (all-time) period** across the CLI and web dashboard, with weekly
+  timeline bucketing for multi-year spans.
+- **New providers**: Grok, zcode, Hermes, Open Design, Zed, LingTai, Devin, and
+  ZeroStack. (upstream Tier 4)
+- **Cursor real composer-context tokens** and Cursor-published composer pricing.
+  (upstream #512/#575)
+
+### Fixed
+- **Cost-accuracy / data-integrity** batch: model-alias and pricing-variant
+  fixes, per-provider daily-cache accounting (cache-version bump forces a
+  one-time re-hydration), and menubar-json fast-path parse-once. (Tiers 1–2)
+- **ZeroStack** no longer ~10× undercounts (cache tokens were dropped); **Zed**
+  invalid-UTF-8 threads no longer crash the run; **Grok** prices correctly
+  (dead alias → `grok-code-fast-1`).
+
+### Security
+- Device-sharing pairing confirmation code widened **3 → 6 digits**
+  (collision-resistant); the manual host+PIN pairing path now prints a
+  trust-the-address warning and points at discover-and-approve as the safer
+  default. Egress boundary verified: the sharing path never computes the
+  enriched web-only breakdowns, and payloads are sanitized on send and re-sanitized
+  on receipt.
+
 ## 2.4.9 - 2026-06-12
 
 Sync with upstream: ten ported fixes and features, including a critical

README.md

@@ -114,6 +114,14 @@ Arrow keys switch between Today, 7 Days, 30 Days, Month, and 6 Months (use `--fr
 | <img src="assets/providers/antigravity.png" width="28" /> | Antigravity | Yes | [antigravity.md](docs/providers/antigravity.md) |
 | <img src="assets/providers/crush.png" width="28" /> | Crush | Yes | [crush.md](docs/providers/crush.md) |
 | | Mux (coder) | Yes | [mux.md](docs/providers/mux.md) |
+| | Devin | Yes | [devin.md](docs/providers/devin.md) |
+| | Grok Build | Yes | [grok.md](docs/providers/grok.md) |
+| | Hermes | Yes | [hermes.md](docs/providers/hermes.md) |
+| | LingTai | Yes | [lingtai-tui.md](docs/providers/lingtai-tui.md) |
+| | Open Design | Yes | [open-design.md](docs/providers/open-design.md) |
+| | Zed | Yes | [zed.md](docs/providers/zed.md) |
+| | ZCode (z.ai) | Yes | [zcode.md](docs/providers/zcode.md) |
+| | Zerostack | Yes | [zerostack.md](docs/providers/zerostack.md) |
 
 Paths shown are for macOS. Linux and Windows equivalents are detected automatically. If a path has changed or is wrong, please [open an issue](https://github.com/soumyadebroy3/codeburn/issues).
 
@@ -268,6 +276,7 @@ codeburn currency GBP          # set to British Pounds
 codeburn currency AUD          # set to Australian Dollars
 codeburn currency JPY          # set to Japanese Yen
 codeburn currency CNY          # set to Chinese Yuan
+codeburn currency RON          # set to Romanian Leu
 codeburn currency              # show current setting
 codeburn currency --reset      # back to USD
 ```

dash/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <link rel="icon" type="image/png" href="/codeburn-logo.png" />
+    <title>CodeBurn - Local Dashboard</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>