feat: v0.8.0 — batch DB writes, WAL TUI reader, security hardening, provider fix

[sorunokoe]

v0.8.0 Release

Security

• Shell hook paths are now single-quote-escaped, preventing injection via paths with $, backticks, or spaces
• Git hook hardened with set -eu and a case-pattern trailer validator

Performance

• DB writes batched per file in a single transaction — 100–1000× faster on large JSONL logs
• File offset committed atomically in the same transaction (crash-safe)
• TUI opens a read-only WAL connection, eliminating lock contention with the file watcher
• Dashboard uses get_session_aggregates instead of loading all turns into memory

Fixed

• Providers tab now shows per-provider counts (was mixing all sessions under Claude Code)
• CLAUDE_CONFIG_DIR respected by scopeon init, onboard, and auto-detection
• Context pressure 'turns remaining' clamped to 10 000
• NaN/Inf/negative costs skipped in budget aggregation
• NaN panic in anomaly sort, u128→i64 truncation, Fish shell hook unquoted path

Changed

• Docs reorganised: ARCHITECTURE, CHANGELOG, CONTRIBUTING → docs/; licenses → docs/licenses/; CODE_OF_CONDUCT, SECURITY → .github/

See docs/changelog.md for full details.

[github-actions]

👋 Thanks for your first pull request to Scopeon! 🎉

Before we review, please make sure the CI checks below pass:

• cargo fmt --all -- --check — formatting
• cargo clippy --workspace -- -D warnings — linting
• cargo test --workspace — all 145 tests must be green

Or simply run make check locally to verify everything at once.

We review PRs in order of readiness (all CI green + filled-out description).
If you get stuck, feel free to ask for help in a comment — we are happy to
guide you through the process. Thank you for contributing! 🚀

[Copilot]

Pull request overview

v0.8.0 release work focusing on faster ingestion, better concurrent read paths, and security hardening for generated shell/git hooks.

Changes:

• Harden shell and git hook generation (quote-escaping paths; set -eu + trailer validation).
• Batch DB writes per file in a single transaction and atomically persist file offsets.
• Improve dashboard/TUI behavior (read-only WAL connection; provider counts by provider; skip corrupt cost rows; clamp context-pressure predictions).

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/shell_hook.rs	Adds single-quote escaping for generated shell hook snippets.
src/serve.rs	Skips NaN/Inf/negative cost rows during snapshot aggregation.
src/onboarding.rs	Respects CLAUDE_CONFIG_DIR in provider detection.
src/main.rs	Respects CLAUDE_CONFIG_DIR for scopeon init and adds tests around MCP config JSON shape.
src/git_hook.rs	Hardens git commit-msg hook with set -eu and trailer format validation.
docs/changelog.md	Documents v0.8.0 changes and updates compare links.
crates/scopeon-tui/src/app.rs	Uses per-provider DB stats and opens a read-only DB connection for refresh.
crates/scopeon-mcp/src/server.rs	Clamps “turns remaining” predictions to a sane upper bound.
crates/scopeon-core/src/db.rs	Adds batch upsert/atomic commit APIs, provider stats query, fixes NaN sort panic, and changes interaction-event ordering.
crates/scopeon-collector/src/watcher.rs	Uses atomic commit API, logs skipped JSONL lines, and hardens mtime conversion.
crates/scopeon-collector/src/providers/generic_openai.rs	Hardens timestamp conversion against overflow.
crates/scopeon-collector/src/providers/gemini.rs	Hardens timestamp conversion against overflow.
crates/scopeon-collector/src/providers/aider.rs	Hardens timestamp conversion against overflow.
crates/scopeon-collector/src/parser.rs	Tracks count of skipped/unparseable JSONL lines.
Cargo.toml	Bumps workspace/package versions to 0.8.0.
Cargo.lock	Updates lockfile versions to 0.8.0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.