Classic confinement request: codeburn

store-requests classic-confinement
1

  • name: codeburn

  • description: CodeBurn is a local-first cost and usage tracker for AI coding tools (Claude Code, Codex CLI, Cursor, Copilot, and 40+ others). It reads the session logs those tools already write on the user’s machine and turns them into itemized cost analytics: by project, model, session, day, and pull request. Everything is parsed locally; there are no accounts and no uploads.

  • snapcraft: The snapcraft.yaml is generated at build time by electron-builder. The snap configuration lives in the repository below at app/package.json (“snap” section), and the CI build that produces the snap is at .github/workflows/build-snap.yml on the main branch.

  • upstream: GitHub - getagentseal/codeburn: Free, local tool to track AI coding token usage and cost across 31 tools and agents (Claude Code, Cursor, Codex, Gemini and more), by model, project, and task. npx codeburn · GitHub

  • upstream-relation: I am the upstream author and maintainer; the upstream project itself publishes the snap.

  • supported-category: developer tools. CodeBurn is a companion utility for development environments: its sole function is inspecting state written by other developer tools (AI coding agents) into the user’s home directory.

  • reasoning: The application’s entire purpose is reading session logs that other developer tools write into hidden directories in the user’s home: ~/.claude, ~/.codex, ~/.cursor, ~/.gemini, ~/.qwen, and more than a dozen others. Under strict confinement:

    • The home interface deliberately excludes hidden files and directories, so it grants access to none of the data the app exists to read.
    • personal-files would require enumerating every directory. The supported tool list is currently 40+ and grows with each release as new AI coding tools appear, so each addition would need a new store declaration and review round. Users of a newly supported tool would see silent empty results until that round is completed.

    Access needed is read-only and confined to per-tool state directories; the app never modifies other tools’ files. No existing interface combination provides read access to an open-ended set of hidden directories in $HOME, which is why classic confinement is requested.

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap to work under strict confinement.

2

This request has been added to the queue for review by the @reviewers team.

3

There is no such category, please see:

For the actual list of the few supported categories that will be allowed classic confinement…

But I assume you will not find a proper one for this specific tool (monitoring developer activities isn’t one)

You already noticed that personal-files could be used (despite being a slight maintenance burden), I’d suggest going down that route instead with a strictly confined snap (though note that I’m not a reviewer, others might have a different view)

You should also note that is is very very hard to properly package a classic snap (likely way more work than maintaining a list of personal-files entries) since you need to make 100% sure that nothing from the host leaks into the runtime environment of the snap and vicee versa, this often requires a lot of binary patching etc to make sure your app doesn’t accidentally use the hosts linker or libs (even a classic snap needs to be able to run on any existing Linux distro, be it Gentoo, Arch, Fedora or SuSE)

4

Thank you, that is fair on both points.

I have switched the snap to strict confinement with a single read-only personal-files plug enumerating the directories the app reads (25 dot-directories plus a few .config subpaths). The maintenance burden is real but bounded: the list only changes when we add support for a new tool, which is a release-time event anyway.

Withdrawing the classic request. Once the strictly confined snap is uploaded I will open an auto-connection request for the personal-files plug in store-requests.

1 Like
5

Following up: the snap is now strictly confined and uploaded, and I’ve opened the personal-files auto-connection request here: Auto-connect request: codeburn personal-files (ai-agent-session-logs). This classic request can be closed.

1 Like