feat: optimize loaders with memory-mapped SQLite and parallel workers, add build.sh automation, and integrate release-please

Author: jadmadi

.github/workflows/release-please.yml

@@ -0,0 +1,47 @@
+name: release-please
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - uses: google-github-actions/release-please-action@v4
+        id: release
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  goreleaser:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.22"
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          version: "~> v2"
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,5 +1,6 @@
 # Binaries
 thermal
+/dist/
 *.exe
 
 # Go

.goreleaser.yml

@@ -12,8 +12,13 @@ builds:
     goarch:
       - amd64
       - arm64
+    flags:
+      - -trimpath
     ldflags:
       - -s -w
+      - -X github.com/jadmadi/thermal/internal/version.Version={{ .Version }}
+      - -X github.com/jadmadi/thermal/internal/version.Commit={{ .Short_commit }}
+      - -X github.com/jadmadi/thermal/internal/version.Date={{ .Date }}
 
 archives:
   - format: tar.gz

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}

CHANGELOG.md

@@ -0,0 +1,70 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- **`build.sh` build automation script** — versatile build script supporting `--release` (`-ldflags="-s -w" -trimpath`), `--dev`, and `--upx` modes, cross-compilation (`--target` and `--all`), and detailed `--help` documentation explaining build trade-offs and binary sizes.
+- **`--verbose` / `-v` diagnostic flag** — outputs non-fatal tool loading failures, missing databases, and parsing warnings directly to `os.Stderr`.
+- **`thermal upgrade` command** — self-upgrade by checking GitHub Releases, downloading the matching binary for your OS/arch, and atomically replacing the running executable.
+- **`thermal version` command** — prints version, commit hash, and build date (injected via ldflags at build time).
+- **`internal/version` package** — build-time version embedding via `-ldflags`.
+- **Token Warriors / Activity Hunters split** — the leaderboard now separates tools with real token consumption data from tools that only track activity (messages, steps). Tools are auto-categorized based on whether token data is available.
+- **Cost column** in the leaderboard for tools that track cost (OpenCode, MiMoCode, codewhale). Sub-cent formatting shows costs like `$0.0032`.
+- **Devin loader** — extracts real token metrics from `message_nodes.metadata.metrics` (input, output, cache, reasoning tokens), session duration from `sessions` table, and engagement from `prompt_history`. Devin moved from Activity Hunters to Token Warriors.
+- **Codex loader rewrite** — reads `state_5.sqlite` (`threads.tokens_used`, `model`, `source`, `reasoning_effort`, `agent_role`, session duration) as the primary source, supplements with rollout JSONL for the input/output/reasoning/cache token breakdown. Codex moved from Activity Hunters to Token Warriors.
+- **codewhale loader rewrite** — extracts `metadata.total_tokens`, `metadata.cost.session_cost_usd`, `metadata.model`, `metadata.mode`, and `metadata.cumulative_turn_secs` from session JSON files. codewhale moved from Activity Hunters to Token Warriors.
+- **OpenCode loader rewrite** — leverages pre-aggregated `session.tokens_*` columns, `cost`, `agent`, and `summary_additions/deletions/files` for faster and more comprehensive data extraction.
+- **MiMoCode loader** — aggregates from `message.data.tokens` and surfaces `session.summary_additions/deletions/files` and agent distribution.
+- **Agy loader rewrite** — reads `overview.txt` from all brain sessions (was only reading `transcript.jsonl` from 1 of 14 sessions). Now surfaces 304 steps across 14 sessions instead of 57 steps from 1 session. Extracts model info from `transcript.jsonl` USER_SETTINGS_CHANGE events.
+- **Session duration tracking** — `LongestSessionMs` field added to Summary, surfaced in dashboard for all tools that have session timestamps.
+- **Model breakdown** — `ModelBreakdown` field shows which models were used per tool (e.g., Codex: gpt-5.4-mini:6, gpt-5.4:1).
+- **Agent/source breakdown** — `AgentBreakdown` field shows source distribution (e.g., Codex: cli:7, vscode:3, exec:1).
+- **Lines added/deleted and files touched** — `LinesAdded`, `LinesDeleted`, `FilesTouched` fields added to Summary for tools that track code diffs (OpenCode, MiMoCode).
+- **Progress bar** — new `internal/render/progress.go` for loading indicator, hardened with `atomic.Bool` and `sync.Once` for thread safety.
+- **Session cache** — `internal/loaders/cache.go` for caching loader results.
+- **GitHub Actions release workflow** and **GoReleaser config** for cross-platform binary builds with version injection.
+
+### Performance & Optimization
+
+- **Devin SQLite database optimization** — added incremental delta scanning (`row_id > c.MaxRowID`), memory-mapped I/O (`PRAGMA mmap_size`), and byte-string pre-filtering (`chat_message LIKE '%"assistant"%'`), reducing query times on large (7GB+) databases from ~11s down to `< 2ms`.
+- **SQLite memory-mapped I/O across all loaders** — `LoadOpenCodeData` and `LoadMiMoCodeData` benefit from `PRAGMA cache_size = -64000` and `PRAGMA mmap_size = 30GB` alongside raw string pre-filters.
+- **Parallel multi-worker loaders** — `internal/loaders/agy.go`, `commandcode.go`, and `codex.go` use bounded parallel worker pools (limit of 8 concurrent workers) to scan multi-file directories and JSONL rollouts simultaneously.
+- **Binary size reduction** — configured `-trimpath` and `-ldflags="-s -w"` in `.goreleaser.yml` and `build.sh` to strip DWARF symbol tables and host filepaths, reducing release binaries from ~15MB to ~9.8MB (35% reduction).
+
+### Changed
+
+- **Leaderboard format** — now split into two sections (Token Warriors, Activity Hunters) with a Cost column. Old format was a single flat list.
+- **Tool registry architecture (`DataSubdir`)** — refactored tool registry path resolution (`internal/loaders/registry.go`) to use clean `DataSubdir` property mappings instead of hardcoded switch cases.
+- **README** — updated supported tools table, leaderboard example, build instructions (`build.sh`), and How It Works section to reflect the new data sources, metrics, and optimizations.
+- **`.goreleaser.yml`** — added `-trimpath` and ldflags (`-s -w`) to inject version, commit, and date into the binary while minimizing size.
+
+### Fixed
+
+- **Daylight Saving Time (DST) streak accuracy** — replaced 24-hour time subtraction (`24*time.Hour`) in streak logic (`internal/thermal/streak.go`) with calendar date arithmetic (`AddDate(0, 0, 1)`) to guarantee accuracy during spring-forward (23h) and fall-back (25h) transitions. Ensured strictly ascending quartile thresholds.
+- **Self-upgrader network and decompression guards** — hardened `thermal upgrade` (`cmd/thermal/upgrade.go`) with package-wide 30-second HTTP timeouts, context propagation across requests, exact OS/arch asset checking, and `io.LimitReader(tr, 250*1024*1024)` decompression limits against disk starvation attacks.
+- **Codex token over-counting (260x)** — the old parser summed ALL cumulative `total_token_usage` values from every `token_count` event in every rollout file, producing 11.6B instead of the correct 43.9M. The new loader uses `state_5.sqlite` as the source of truth and only reads the LAST `token_count` event per rollout file for the breakdown.
+- **command-code session inflation** — the old glob `*.jsonl` matched 115 files (54 sessions + 54 checkpoints + 7 hooks-audit), inflating counts to 61 sessions and 6,303 messages. Now correctly filters to 54 sessions and 5,614 messages.
+- **Agy session under-counting** — the old loader only read `transcript.jsonl` (1 of 14 sessions = 57 steps). Now reads `overview.txt` from all 14 sessions (304 steps).
+- **SQLite NULL handling** — Codex `state_5.sqlite` has NULL values in `model`, `reasoning_effort`, and `agent_role` columns. Switched to `sql.NullString` to avoid scan errors.
+
+## [v0.1.0] - 2026-06-12
+
+### Added
+
+- Initial open source release.
+- GitHub-style contribution heatmap for AI coding tools: MiMoCode, OpenCode, Codex, Agy, command-code, codewhale.
+- Leaderboard mode (`thermal`) showing all installed tools ranked by activity.
+- Per-tool heatmap mode (`thermal --tool <name>`).
+- JSON output (`thermal --json`).
+- Configurable weeks range (`thermal --weeks 26`).
+- Auto-detect mode (`thermal --tool auto`).
+- MIT license.
+
+[Unreleased]: https://github.com/jadmadi/thermal/compare/v0.1.0...HEAD
+[v0.1.0]: https://github.com/jadmadi/thermal/releases/tag/v0.1.0

README.md

@@ -12,13 +12,15 @@ See your coding streaks, daily activity, and usage patterns rendered as a beauti
 
 | Tool | Data Source | Metrics |
 |------|-------------|---------|
-| **MiMoCode** | SQLite DB | Token usage, sessions, cost |
+| **Devin** | SQLite DB (sessions + message_nodes) | Token usage, sessions, cost |
 | **OpenCode** | SQLite DB | Token usage, sessions, cost |
-| **Codex** | JSONL history | Command activity |
-| **Devin** | SQLite DB (sessions) | Session activity |
-| **Agy** | Transcript JSONL | Conversation steps |
-| **command-code** | JSONL history | Command activity |
-| **codewhale** | JSON sessions | Session activity |
+| **MiMoCode** | SQLite DB | Token usage, sessions, cost |
+| **Codex** | SQLite DB (state_5.sqlite) + rollout JSONL | Token usage, sessions, model/source breakdown |
+| **codewhale** | JSON sessions | Token usage, sessions, cost |
+| **command-code** | JSONL transcripts | Message activity, sessions, model breakdown |
+| **Agy** | Overview logs (JSONL) | Step activity, sessions, model breakdown |
+
+Tools with token data appear in the **Token Warriors** leaderboard; activity-only tools appear in **Activity Hunters**.
 
 Each tool also accepts short aliases: `mimo`, `oc`, `cmd`/`cc`, `whale`.
 
@@ -32,12 +34,40 @@ go install github.com/jadmadi/thermal/cmd/thermal@latest
 
 Or download a pre-built binary from [Releases](https://github.com/jadmadi/thermal/releases).
 
-Or build from source:
+Or build from source using the included build script:
 
 ```bash
 git clone https://github.com/jadmadi/thermal
 cd thermal
-go build -o thermal ./cmd/thermal
+./build.sh --release   # Builds stripped production binary (~9.8MB) with embedded version tags
+```
+
+You can run `./build.sh --help` to explore available build modes (`--release`, `--dev`, `--upx`) and cross-compilation targets. Or build manually with Go:
+
+```bash
+CGO_ENABLED=0 go build -ldflags="-s -w" -trimpath -o thermal ./cmd/thermal
+```
+
+## Update
+
+If you installed via binary or `go install`:
+
+```bash
+thermal upgrade
+```
+
+This checks GitHub for a newer release, downloads the matching binary for your OS/arch, and atomically replaces the running binary.
+
+If you installed via `go install`, you can also update with:
+
+```bash
+go install github.com/jadmadi/thermal/cmd/thermal@latest
+```
+
+Check your current version:
+
+```bash
+thermal version
 ```
 
 ## Usage
@@ -63,29 +93,34 @@ thermal --weeks 26
 # Output raw JSON
 thermal --json
 
+# Enable verbose diagnostic warnings (outputs non-fatal loading errors to stderr)
+thermal --verbose
+
 # Disable colors
 thermal --no-color
 ```
 
 ## Example: Leaderboard
 
 ```
-  THERMAL — Don't break the streak.
-  Thursday, June 11 2026
-
-  #  Tool            Streak    Best      Active    Activity
-  ──────────────────────────────────────────────────────────────
-  🥇 OpenCode        4d        13d       40d       1.6B tok
-     ████████████████████ 🔥🔥
-  🥈 command-code    2d        9d        23d       374 cmd
-     ██████████
-  🥉 MiMoCode        2d        2d        3d        339M tok
-     ██████████
-     Codex           0d        2d        4d        62 msg
-     Agy             0d        1d        1d        57 step
-     codewhale       0d        0d        0d        0 sess
-
-  🏆 OpenCode is on fire with a 4-day streak!
+  THERMAL  — Don't break the streak.
+
+  Token Warriors
+   #    Tool           Strk    Best    Days     Tokens      Cost
+   ─────────────────────────────────────────────────────────────────
+   1. Devin             38d     38d     67d   57.2B tok   —
+   2. OpenCode           2d     10d     46d   1.8B tok    $234.37
+   3. MiMoCode           1d      7d     23d   1.7B tok    $419.00
+   4. Codex              1d      2d      9d   44.0M tok   —
+   5. codewhale          1d      1d      1d   22.7K tok   $0.0032
+
+  Activity Hunters
+   #    Tool           Strk    Best    Days     Activity
+   ───────────────────────────────────────────────────────
+   1. command-code       1d      9d     28d   5.6K msg
+   2. Agy                1d      1d      2d   304 step
+
+  >> Devin is on fire with a 38-day streak!
 
   Keep the heat going. Don't break the streak.
 ```
@@ -112,13 +147,14 @@ thermal --no-color
 
 Thermal reads usage data from installed AI coding tools:
 
-- **MiMoCode / OpenCode**: Queries SQLite databases for assistant message token usage
-- **Devin**: Queries the Devin CLI sessions SQLite database for session activity
-- **Codex / command-code**: Parses JSONL command history for activity timestamps
-- **Agy**: Reads transcript JSONL files from conversation logs
-- **codewhale**: Reads JSON session files
+- **Devin**: Queries the Devin CLI SQLite database, joining `message_nodes` (assistant `metadata.metrics` for real input/output/cache token counts) against `sessions` (duration, count) and `prompt_history` (engagement)
+- **OpenCode / MiMoCode**: Queries SQLite databases for pre-aggregated token usage, cost, and code diff stats
+- **Codex**: Reads `state_5.sqlite` (`threads.tokens_used`, model, source, reasoning_effort) as the primary source, supplements with rollout JSONL for the input/output/reasoning/cache token breakdown
+- **codewhale**: Reads JSON session files for `metadata.total_tokens`, `metadata.cost.session_cost_usd`, model, and mode
+- **command-code**: Parses JSONL session transcripts for message activity and model distribution (from `.meta.json` sidecars)
+- **Agy**: Reads `overview.txt` logs from all brain sessions for step activity, supplements with `transcript.jsonl` for model info
 
-Databases are opened **read-only** — Thermal never modifies your data.
+All SQLite databases are opened **read-only** (`?mode=ro`) with memory-mapped I/O (`PRAGMA mmap_size`) and incremental delta-caching. Multi-file directory and JSONL scanners (`Agy`, `command-code`, `codex`) run concurrently via bounded parallel worker pools. Thermal never modifies your data and processes multi-gigabyte historical databases in milliseconds.
 
 ## Requirements