feat(git): attribute AI spend to commits

[ozymandiashh]

Summary

This adds a new codeburn git-cost command for attributing local AI coding spend to commits in the current git repository.

The goal is to answer a question that the existing aggregate reports cannot answer directly: after spending on AI sessions inside a repo, which nearby commits are those sessions most likely associated with, and how much spend remains unattributed?

What changed

• add codeburn git-cost as a new CLI command
• support --since windows for today, week / 7days / 7d, 30days / 30d, month, and custom day windows such as 14d / 14days
• support --provider filtering so attribution can be scoped to one provider
• support --window-minutes to control how long after a session ends commits can still be linked to that session
• support --json for scripts and downstream tooling
• document the command in the README and add an Unreleased changelog entry

Attribution model

git-cost only considers usage sessions whose recorded project path belongs to the current git repository. For each matched session, it looks for commits in the current checkout's git log whose committer timestamp falls between:

• the session's first usage timestamp
• the session's last usage timestamp plus the configured post-session window

If a session maps to exactly one commit, that commit receives the session's full cost. If a session maps to multiple commits, the session cost and call count are split evenly across those commits so the report does not double-count spend. Sessions without a matching commit are kept visible as unattributed spend.

The command uses git committer timestamps (%cI) because that is the same timestamp family used by git log --since/--until. That avoids dropping rebased, amended, or cherry-picked commits because of older author dates.

Output behavior

The text output shows:

• repository name and path
• selected period and attribution window
• total repo spend
• attributed and unattributed spend
• top attributed commit costs
• largest unattributed sessions

The JSON output exposes the same summary plus commit rows and unattributed session rows for automation.

Caveats

This is intentionally heuristic. It identifies commits that are close to AI usage sessions in time; it does not prove that a commit was AI-authored.

Attribution also depends on providers recording usable project paths. If a provider only exposes a project name, multiple repos share the same final directory name, or an upstream parser normalizes a path differently, some sessions may appear as unattributed.

Validation

• npx vitest run tests/git-cost.test.ts
• npm run build
• node dist/cli.js git-cost --help
• node dist/cli.js git-cost --window-minutes 1.5 exits with code 1 and the expected validation error
• npx vitest run
• git diff --cached --check

npx tsc --noEmit is still blocked by existing src/providers/copilot.ts type errors on main; this branch does not touch that provider path.