Bumps [undici](https://github.com/nodejs/undici) from 7.30.0 to 7.30.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/nodejs/undici/releases">undici's releases</a>.</em></p>
<blockquote>
<h2>v7.30.1</h2>
<h2>Security fixes</h2>
<h3>High severity</h3>
<h4>Denial of service via TLS 1.2 certificate-changing renegotiation</h4>
<p><strong>CVE-2026-87018 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm">GHSA-qrxm-fqhp-jwvm</a></strong></p>
<p>A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.</p>
<h4>TLS certificate validation bypass through dropped <code>Agent</code> options</h4>
<p><strong>CVE-2026-109383 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx">GHSA-2m5v-pch6-74hx</a></strong></p>
<p><code>Agent</code> used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as <code>checkServerIdentity</code>. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.</p>
<h4>Cache poisoning and cross-user disclosure through cross-origin redirects</h4>
<p><strong>CVE-2026-109829 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26">GHSA-4w7w-5xrc-9h26</a></strong></p>
<p>When an originless <code>Agent</code> combined redirect and shared-cache interceptors as <code>compose(redirect(), cache())</code>, a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.</p>
<h4>Denial of service through excessive <code>Content-Encoding</code> values</h4>
<p><strong>CVE-2026-109869 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c">GHSA-xjj6-f33q-929c</a></strong></p>
<p>A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although <code>fetch()</code> rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.</p>
<h3>Medium severity</h3>
<h4>Denial of service through the <code>decompress</code> interceptor</h4>
<p><strong>CVE-2026-87029 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6">GHSA-55wc-3pg8-jfw6</a></strong></p>
<p>An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when <code>decompress</code> was composed with a handler such as <code>dump</code> with a size limit. This release converts downstream handler exceptions into per-request errors.</p>
<h4>Subresource Integrity bypass with non-lowercase algorithm tokens</h4>
<p><strong>CVE-2026-109841 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472">GHSA-f72v-6w45-q472</a></strong></p>
<p><code>fetch()</code> treated valid mixed-case or uppercase SRI algorithm tokens, such as <code>SHA256</code>, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.</p>
<h4>Denial of service through unbounded EventSource parser state</h4>
<p><strong>CVE-2026-109924 · <a href="https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685">GHSA-4qv8-2p9j-2685</a></strong></p>
<p>A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny <code>data:</code> fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.</p>
<h4>Denial of service through unbounded automatic WebSocket PONG buffering</h4>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="7507102a67"><code>7507102</code></a> Bumped v7.30.1 (<a href="https://redirect.github.com/nodejs/undici/issues/6022">#6022</a>)</li>
<li><a href="7d60c7b6ee"><code>7d60c7b</code></a> [v7.x] fix(cookies): backport <a href="https://redirect.github.com/nodejs/undici/issues/5663">#5663</a>, <a href="https://redirect.github.com/nodejs/undici/issues/5808">#5808</a> and <a href="https://redirect.github.com/nodejs/undici/issues/5832">#5832</a> (<a href="https://redirect.github.com/nodejs/undici/issues/6019">#6019</a>)</li>
<li><a href="0227d5de51"><code>0227d5d</code></a> fix: avoid unbounded recursion in Set-Cookie attribute parser (<a href="https://redirect.github.com/nodejs/undici/issues/5757">#5757</a>) (<a href="https://redirect.github.com/nodejs/undici/issues/5997">#5997</a>)</li>
<li><a href="5394462446"><code>5394462</code></a> fix(websocket): bound automatic PONG writes under backpressure</li>
<li><a href="299162740d"><code>2991627</code></a> fix(eventsource): bound retained SSE parser state</li>
<li><a href="18bc8a1e09"><code>18bc8a1</code></a> fix(sri): accept non-lowercase algorithm tokens</li>
<li><a href="63cba7712c"><code>63cba77</code></a> fix(decompress): converge downstream handler throws to per-request errors</li>
<li><a href="07ded4941b"><code>07ded49</code></a> fix(fetch): abort excessive content encoding responses</li>
<li><a href="b20b82ad80"><code>b20b82a</code></a> fix(cache): prevent cross-origin redirect cache confusion</li>
<li><a href="04cb74b1db"><code>04cb74b</code></a> fix: preserve Agent connection options</li>
<li>Additional commits viewable in <a href="https://github.com/nodejs/undici/compare/v7.30.0...v7.30.1">compare view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/getagentseal/codeburn/network/alerts).
</details>
The Windows tray's Capacity Dock re-seeded its provider rail and resting
provider from whichever providers answered the last quota refresh, so one
missed Codex read made Cursor the resting provider for good. autoSeed is
now additive: providers already in the rail stay, a saved preferred
provider is kept while the CLI still knows it, and every resting pick
(ring click, Resting menu, Electron relay) is latched in the shared dock
prefs. A separate-rings Claude profile row id never enters the rail,
because autoSeed only pins ids the CLI reports.
The mac menu bar keeps its own seeding and is unchanged; it likely has the
same eviction and gets a parity follow-up. The new tests cover the seed
and latch rules; four of them fail on main.
Antigravity calls carried no user message, so every turn classified as
conversation. The provider now reads the cascade's first USER_INPUT from
the brain transcript (first 50 lines, <USER_REQUEST> unwrapped, cut to
500 chars), with the SQLite steps row as the fallback for .db sources,
and sets it as userMessage on every call of the cascade, the way the
cline-cli, goose, codewhale and mistral-vibe providers already do.
Calls, tokens and cost do not change. The activity split does: on real
data the last 30 days go from 128 conversation turns to 2, with 126 now
exploration. ANTIGRAVITY_CACHE_VERSION moves 9 to 10 and the antigravity
parse tag gets user-msg-v1, so only Antigravity re-parses once. Session
titles and optimize are unchanged. Follow-up prompts in a cascade are not
read yet; the first prompt stands for the whole cascade.
Closes#1792
Claude Code on Windows runs shell commands through a tool named PowerShell,
with the same { command } input as Bash. The shell-tool sets only knew Bash,
BashTool and PowerShellTool, and PowerShellTool never appears in a transcript:
the Claude Code binary names the tool PowerShell. compactEntry dropped the
command, so it never reached the shell breakdown, command-only turns fell
through to coding or conversation, and optimize missed read-shaped commands.
The claude parse tag gets powershell-shell-tool-v1 so cached sessions re-parse
once, as in #1791. DAILY_CACHE_VERSION is unchanged, so settled days keep
their old split until the next bump. Calls, tokens and cost do not change:
identical on a full real day, main vs branch.
Cursor 3.27 can store its app session as cursor-safe-storage:v1 ciphertext
(Chromium v10, key in the "Cursor Safe Storage" keychain item), behind
Cursor's own cursor.storage.authTokenEncryptionAtRest flag. CodeBurn read it
as an expired login. The CLI and the menu bar now unlock it with that item
and run the usual JWT checks; the newline `security -w` appends is trimmed
before the KDF.
Keychain consent is user-initiated, as for Claude: the first read happens on
`codeburn import cursor --sync`, `codeburn quota`, or Retry/Reconnect on the
menu bar's Cursor quota. Background syncs and dock refreshes read only after
one such read succeeded, reuse the opened token per blob, and the first
refused read switches that off again. Status never reads the keychain. No
service-only keychain lookup, since after a Deny it asks again.
Windows and Linux say CodeBurn cannot unlock the session there yet; the
desktop app, VS Code and the Windows tray show the new `locked` line in all
locales. Docs describe the prompt and what Always Allow grants.
Closes#1801
A provider-filtered dashboard painted the right total, then changed it
when the background index finished. Dates the shared daily cache did not
hold were dropped, so Copilot fell to $0 in #1769, and a cached day
with the same call count as the live parse kept its cached numbers, so
a cache derived under older accounting still moved the headline after
refresh. Report and the first paint did neither.
The provider-scoped index now overlays its normalized days the way
buildDurablePeriod does for report: they fill the dates and slices the
cache lacks and replace a cached slice unless a settled cached day
explains more calls, so expired history is kept and nothing is counted
twice. Against real Copilot history and a complete cache that predates
it, main refreshed 30 days from $0.355 to $0.00; it now stays at $0.355.
The all-provider path is unchanged, and a provider view still never
writes the shared cache. report, models and the first paint do not
change.
Fixes#1769
Claude Code writes one JSONL line per content block, so a message that
calls several tools in parallel spans several lines with the same message
id. dedupeStreamingMessageIds kept only the last line, which has the right
usage but only the last tool_use, so the earlier calls were missing from
the tool, MCP and shell breakdowns, turn classification, edit line counts,
tool errors and PR link evidence. On a real 7-day sample main counted
59,765 tool calls where the transcripts hold 69,376.
The last line is still the one kept. The tool_use blocks of the earlier
lines with the same id are put back in front of its content, matched by
block id, so the older shape whose final write restates every block (#110)
is not counted twice. The claude parse tag gets streamed-tool-blocks-v1,
so cached sessions re-parse once.
Calls, tokens and cost do not change; activity turns, edit and one-shot
counts and the by-PR split do. DAILY_CACHE_VERSION is not bumped (v77 is
the last bump the zstd split can carry), so days the daily cache has
already settled keep their old activity split until the next bump
re-derives them.
Today's day row comes from the live parse with session identities, but
the session-count provenance treated it like a cache row, so a Today-only
period reported its exact count as partial on the headline, the provider
rows and the project rows. Today is now left out of the cache-provenance
days at every call site (money still uses the complete day set) and the
status snapshot render version moves to 13 so stale labels are rejected.
The Overview hero count-up wrote textContent into a div whose children
React owns; when the ~ estimate marker appeared, React hit a detached text
node (insertBefore NotFoundError) and the error boundary took over. GSAP
now writes only into an empty span and React keeps the marker; a currency
change with the same raw value refreshes the text.
Fixes#1760Fixes#1785
Warp 0.2026.10 removed total_provider_cost_in_cents and now persists
total_billed_cost_in_cents. Read it after total_charged_usage, as Warp
does, so conversations without streamed charges keep their billed dollars
instead of the credits estimate. Bump the warp parse version and
DAILY_CACHE_VERSION to 77 (76 on a Node without zstd, so it re-derives
too and a zstd Node still adopts its file).
A slice with tokens but no calls, cost or savings (a Hermes or Copilot
session total) read as a placeholder, so every adoption or re-derive merge
replaced it while adding its tokens to the day and model rows again. Each
version bump multiplied them by the number of older cache files holding
the day. Count tokens as slice data, and cap day and model-row tokens at
the slices' sum on load for days whose calls and cost match their
slices, this bug's fingerprint, so caches already inflated heal without
a version bump.
A newer token-only slice now wins over an older one with calls, as the
newer-wins rule intends, instead of the two being added.
Codex now moves cold rollouts to rollout-*.jsonl.zst. Discovery, the
first-line probe, the parser, fork parent lookup, codex-tps and the context
view read them through a zstd decode; a session present in both forms
counts once from the plain file. Compressed files are parsed whole and never
resumed by byte offset. Without node:zlib zstd (Node < 22.15) they are
skipped with one notice. DAILY_CACHE_VERSION 76 so settled days pick up the
recovered Codex usage. Without zstd it stays 75, so a later Node upgrade
still adopts that cache and re-derives it.
The cold-hydration exit tests wait for the Lifetime phase to hold the hydration lock. Their sessions were 200 days old, which this week falls inside the 6 Months index window, so they parsed in that phase and Lifetime never held the lock long enough: both tests time out on every platform, also on the commit before #1761. 400 days stays outside 6 Months and inside Lifetime.
Writing a new file has nothing to read first, so teams whose subagents
write report and evidence files got a false 'edits more than it reads'
finding. The detector now counts only Edit-type calls. EDIT_TOOL_NAMES
stays as is because act report baselines were recorded with it.
The desktop app starts the tray with CODEBURN_BIN set to its own
codeburn-cli.cmd launcher, which the tray took as final. When that launcher
failed (#1750: exit 1, "The system cannot find the path specified"), the
Volta install under a relocated VOLTA_HOME was never tried.
The setup check now probes CODEBURN_BIN, every install the PATH and prefix
search finds, then the recorded launcher, and keeps the first whose
--version answers. When none does, the error lists each path with its own
failure. Export and terminal actions use the probed CLI. The desktop app no
longer overwrites a CODEBURN_BIN the person set themselves.
* Copilot: count every agent round and exact credits in VS Code chat sessions
Copilot Chat 0.69 keeps only the last model call of an agent request in result.metadata. Read the request's modelTotals (input, cache reads, output over every call) first, then root completionTokens, then metadata. Carry copilotCredits as nanoAiu so plan credits are exact. Bump the copilot parse tag so cached chat sessions re-parse.
modelKeyMatches no longer lets claude-sonnet-4 capture claude-sonnet-4-6.
* Copilot: bill chat-session credits exactly and skip agent-host twins
A chat-session request that records copilotCredits now costs credits x $0.01 through costFromBilling; requests without it stay priced from tokens. A chat session whose id matches a session-state dir is left to the agent-host path so it is counted once.
* Copilot: drop agent-host twins at serve time, rate chat requests one by one, re-derive past days
A chat-session journal request is left out when the same session has billed agent-host usage (session-state calls with tokens or nanoAiu, or session-store rows). Plan credits rate chat-session requests individually, so older requests in a mixed session keep their estimate. DAILY_CACHE_VERSION 75 with copilot pending re-derive so settled days pick up the new counts.
Electron's Node 24 undici asserts and kills the process when a server closes the socket while a piped download is paused on the file write. The menu bar zip is now read whole and written once.
When the CLI is 0.9.27 or newer, the menu bar update pill checks and updates every surface through codeburn update, and polls every 6 hours. Older CLIs keep the previous path.
The desktop app runs codeburn update for the CLI and menu bar on launch and after it updates itself, and the update banner installs and restarts in one click with a Try again path if the install fails.
Adds codeburn update [--check] [--cli|--menubar|--desktop|--all] [--local] [--json] with a fixed JSON step/result contract that the desktop app, menu bar and Windows tray call, so every surface updates in one click without Terminal. Also documents the npm-first release order and adds always-latest /download links.
* fix(pr): push evidence beats the carried pr-link, show every PR fact
Claude Code's pr-link tags a session with its latest PR and CodeBurn carried
that tag to every later turn and subagent run. A run or turn that pushes the
head branch of a PR opened in the same data (paired gh pr create --head) now
goes to that PR, same repo only; spend left only on the tag is carriedUSD.
Rows also get runList (why each run counts), a locally evidenced state and
follow-up round times, and a call opening several PRs pairs its pr-link with
the last create. The PR card states every unknown and the expanded view shows
timeline, runs, cost by phase and work as compact tables.
* fix(app): full text on hover for cropped PR cells, plainer wording for same-session spend
Truncated PR labels, run descriptions, table labels and summary figures now show their full text in the shared tooltip surface while cut off. The carried-from-session-tag wording becomes 'from other work in the same session' in all six locales.
* fix(pr): explain carried spend without the pr-link jargon
* fix(clinepass): say when the Cline login expired and how to renew it
An expired saved Cline login only said "Run cline to refresh it". It now
reads "Cline login expired 3h ago" (age from the saved expiry, when known)
and asks to send a message in Cline or run `cline auth cline`, then press
Retry. Still a retryable state, so the last quota is kept. CLI and menubar.
* fix(menubar): title an expired Cline login instead of "Retrying"
A provider failure can now carry a short status title. The expired Cline
login sets "Cline login expired", which the settings pane and the dock
caption show in place of the generic retrying text. It stays a retryable
state and keeps the last quota; the title clears with the error.
* fix(clinepass): match the expired-login hint to the visible control
"Then press Retry" only fits where a Retry button shows: the settings pane
with no last quota. Everywhere else, including the CLI, the hint now ends
with "CodeBurn picks up the new login on its next refresh."
* fix(menubar): check Cursor when its settings pane opens, keep the dock seed stable
Generic providers were only refreshed while selected in the dock, so a
signed-in Cursor outside a full dock read "Not connected". Opening a
provider's settings pane now runs a quiet probe that records nothing on
failure. Auto-seed also keeps the providers already in the dock and only
fills free slots, so a newly connected provider no longer pushes one out or
resets the preferred card. Remaining edge: after an explicit Disconnect,
reopening the pane re-probes, and a free dock slot would take it back.
* fix(menubar): keep a disconnected provider off until the user connects it
The explicit-disconnect flag Copilot already persists is now per provider.
Disconnect sets it for generic providers too, Connect clears it, and while
it is set the settings pane's quiet probe and the dock auto-seed skip that
provider, so reopening the pane no longer silently reconnects Cursor.
* fix(menubar): only the Disconnect action opts a provider out
Clear Override and Remove saved override share the disconnect path but
mean "go back to automatic", so they no longer set the explicit-disconnect
flag; the pane probe and dock auto-seed keep working after them.
* fix(menubar): the quiet pane probe hides only a missing sign-in
The Settings pane probe recorded nothing on any failure, so an expired login
opened before any refresh read "Not connected". Fetch failures now carry
whether the provider had no credentials or local data at all; the quiet probe
suppresses only that case and records every other failure like a refresh.
* fix(menubar): keep the not-signed-in flag clear of the ClinePass failure fields
Command Code's credits endpoint only reports monthly credits left, so the
monthly window was dropped. For an active subscription on a known plan the
plan price now comes from a small table (the API has no monthly cap field):
pool = max(plan, left), used = pool - left, reset = currentPeriodEnd.
Unknown plans and purchased/free credits stay out. CLI and menubar mirrored.
* fix(pr): a subagent whose description names a PR folds into that PR
A subagent run folded into whatever PR its parent's last pr-link carried, so
review runs for #1703, #1712, #1728 and #1729 landed on a stale closed#24.
The Agent description ("Review PR 1729 ...") is now read from the subagent's
.meta.json at report time; a single PR it names outranks the carried PR.
* fix(pr): date each PR by its own turns and count its agent runs
Every PR row carried the whole session's first and last timestamp, so one
long orchestrator session stamped the same span and "1 session" on all of
them. Rows now span their first to last attributed turn or folded run, and
a new `runs` field counts contributing sessions plus folded subagent runs.
* feat(pr): local one-shot, follow-up rounds, review runs, merge time and cost split per PR
Each PR row now carries signals read from cached commands, no GitHub calls:
openedAt (gh pr create paired with the PR's first pr-link), follow-up rounds
(pushes naming its --head branch, or from a run whose description names it,
in 10-minute bursts), oneShot only when the open and its branch were seen,
reviewRuns and reviewCostUSD, mergedAt and timeToMergeMs, a build/review/fixes
cost split that sums to the row, and linkEvidence to flag pr-link-only rows.
* feat(session-why): PRs the session opened, their follow-up rounds and review runs
The why view now carries prWork: each gh pr create whose output printed a PR
URL, the pushes after it on its --head branch (or from a helper whose
description names that PR) in 10-minute rounds, and the helpers that read a
PR without committing or pushing, with their cost.
* perf(pr): only parse commands that can name a push or a PR
* feat(app): local PR facts on PR cards and PR work in the session view
Each PR card gets one line of facts from the CLI's local signals: the review
run and its cost, one shot or follow-up rounds, and merge time after open.
Unknowns are left out; a pr-link-only row says so. The count shows agent runs
instead of sessions. The expanded card splits spend into building, review runs
and after first review, and lists the review runs. The session view lists the
PRs it opened and the review runs it spawned.
* perf(pr): read subagent descriptions only for PR attribution
Every report, status and menubar refresh read each subagent's .meta.json
(about 2,000 files in 30 days) and the cross-provider correlation scanned
every folded run's commands for PR signals it never uses. Sessions now carry
the sidecar path; the description is read on demand, memoized by mtime, only
for folded runs and runs that push, and correlation skips the command scan.
The by-pr footer now counts runs to match the Runs column.
