@arbiterforge/ca-pi 0.6.0

package/plugins/ca-pi/hooks/_scopelib.py

@@ -0,0 +1,262 @@
+#!/usr/bin/env python3
+# codeArbiter - path SCOPE detection: which repo paths are database migrations
+# (H-14), CI/CD workflow files (H-15), and deployment / IaC manifests (H-16),
+# including the project's own overrides declared in security-controls.md.
+#
+# Extracted from _hooklib (issue #321, architecture-002) as slice 3. The
+# cleanest seam of the four, measured the same way as the others: this cluster
+# references NOTHING from the rest of _hooklib, and NOTHING in the rest of
+# _hooklib references it. Its only dependency is norm_path, already on the
+# _pathnorm floor. Zero edges in either direction.
+#
+# WHY THESE BELONG TOGETHER: they are one mechanism wearing three labels. All
+# three predicates are `path_in_globs(rel, root, <DEFAULTS>, <DECL_RE>)` over the
+# same glob compiler, the same security-controls.md reader, and the same two
+# caches - so a change to how a project DECLARES a scope (the `<scope>-paths`
+# lines) lands in one place instead of three. The defaults differ; the machinery
+# does not.
+#
+# The caches are deliberate and mtime-keyed: every Write/Edit hook calls these,
+# and re-reading plus re-compiling security-controls.md per call showed up as
+# real latency on a large repo.
+#
+# _hooklib re-exports every public name below, so no consumer changed and the
+# pre-existing hook suites prove parity without moving.
+
+from __future__ import annotations
+
+import os
+import re
+
+from _pathnorm import norm_path
+
+
+# Migration-path detection (H-14). Shared by migration-pass.py (the producer)
+# and pre-bash.py (the backstop) so the two never drift on what counts as a
+# migration. Default globs cover the common ORM/migration ecosystems; a project
+# extends or narrows the set via a `migration-paths` block in
+# security-controls.md. `**` matches any run of path segments (including none);
+# `*`/`?` stay within one segment.
+MIGRATION_DEFAULT_GLOBS = (
+    "**/migrations/**",
+    "**/migrate/**",
+    "**/db/migrate/**",
+    "**/alembic/versions/*.py",
+    "**/prisma/migrations/**",
+)
+_MIG_DECL_RE = re.compile(
+    r"<!--\s*migration-paths\s*-->(.*?)<!--\s*/migration-paths\s*-->", re.S | re.I)
+
+# CI/CD workflow detection (H-15, #73). Advisory only — no commit gate; the
+# defaults cover the common CI ecosystems and a project extends/narrows them via
+# a `ci-paths` block in security-controls.md (same `+`/`-` grammar as migrations).
+CI_DEFAULT_GLOBS = (
+    ".github/workflows/**",
+    ".circleci/**",
+    "**/.gitlab-ci.yml",
+    "**/Jenkinsfile",
+    "**/azure-pipelines.yml",
+    "**/bitbucket-pipelines.yml",
+)
+_CI_DECL_RE = re.compile(
+    r"<!--\s*ci-paths\s*-->(.*?)<!--\s*/ci-paths\s*-->", re.S | re.I)
+
+# Deployment / IaC detection (H-16, #73). Advisory only. Defaults cover the
+# common container/orchestration/IaC manifests; extend/narrow via a
+# `deploy-paths` block in security-controls.md.
+DEPLOY_DEFAULT_GLOBS = (
+    "**/Dockerfile",
+    "**/Dockerfile.*",
+    "**/docker-compose*.yml",
+    "**/docker-compose*.yaml",
+    "**/*.tf",
+    "**/*.tfvars",
+    "**/k8s/**",
+    "**/helm/**",
+    "**/kustomization.yaml",
+    "**/kustomization.yml",
+    "**/Procfile",
+)
+_DEPLOY_DECL_RE = re.compile(
+    r"<!--\s*deploy-paths\s*-->(.*?)<!--\s*/deploy-paths\s*-->", re.S | re.I)
+
+
+def _glob_to_re(glob):
+    """Compile a forward-slash glob into a full-path regex. `**/` is an optional
+    run of leading segments, `**` is any chars, `*`/`?` stay within a segment."""
+    g = norm_path(glob)
+    out, i = ["^"], 0
+    while i < len(g):
+        if g[i:i + 3] == "**/":
+            out.append("(?:.*/)?")
+            i += 3
+        elif g[i:i + 2] == "**":
+            out.append(".*")
+            i += 2
+        elif g[i] == "*":
+            out.append("[^/]*")
+            i += 1
+        elif g[i] == "?":
+            out.append("[^/]")
+            i += 1
+        else:
+            out.append(re.escape(g[i]))
+            i += 1
+    out.append("$")
+    return re.compile("".join(out))
+
+
+# performance-002: the DEFAULT glob tuples are module constants, so compile each
+# to a regex ONCE at module load instead of per glob per path_in_globs() call.
+# A single post-write-edit.py invocation otherwise recompiled up to 44 regexes
+# (5 migration + 6 CI + 11 deploy x the calls that hit them). These compiled
+# tuples line up 1:1 with their string tuples; the matcher uses them directly
+# for the defaults and only compiles the per-controls custom globs on demand.
+_MIGRATION_DEFAULT_RES = tuple(_glob_to_re(g) for g in MIGRATION_DEFAULT_GLOBS)
+_CI_DEFAULT_RES = tuple(_glob_to_re(g) for g in CI_DEFAULT_GLOBS)
+_DEPLOY_DEFAULT_RES = tuple(_glob_to_re(g) for g in DEPLOY_DEFAULT_GLOBS)
+
+# Map each default string tuple to its precompiled regex tuple, so the matcher
+# can look up the right precompiled set from the `defaults` argument alone
+# (preserving the existing public signatures of scope_globs/path_in_globs).
+_DEFAULT_RES_BY_GLOBS = {
+    MIGRATION_DEFAULT_GLOBS: _MIGRATION_DEFAULT_RES,
+    CI_DEFAULT_GLOBS: _CI_DEFAULT_RES,
+    DEPLOY_DEFAULT_GLOBS: _DEPLOY_DEFAULT_RES,
+}
+
+
+# performance-001: hooks are EPHEMERAL single-shot processes (one invocation
+# then exit), so a module-level cache lives for exactly one invocation — there
+# is NO cross-invocation persistence. Within that one process, scope_globs reads
+# security-controls.md on every is_migration_path/is_ci_path/is_deploy_path call
+# (2-3 reads per hook). Cache the controls text keyed by (root, mtime) so a hit
+# skips the read; the mtime key keeps it correct even on an intra-process change
+# (the file is re-read when its mtime moves), and keys the absent-file state too.
+_CONTROLS_CACHE = {}
+
+
+def _controls_mtime(root):
+    """mtime of `root`'s security-controls.md, or None when absent/unreadable.
+    The cache key — distinct mtimes (and the None absent-state) bust the cache."""
+    try:
+        return os.path.getmtime(
+            os.path.join(root, ".codearbiter", "security-controls.md"))
+    except Exception:  # noqa: BLE001 — no controls file -> None (defaults only)
+        return None
+
+
+def _read_controls(root):
+    """The repo's security-controls.md text, or "" when absent/unreadable.
+
+    Process-cached keyed by (root, mtime): a cache hit skips the file read, and
+    the mtime component invalidates the entry whenever the file changes (or is
+    created/removed), so verdicts are unchanged. Single-shot hook process only —
+    no cross-invocation persistence."""
+    mtime = _controls_mtime(root)
+    key = (root, mtime)
+    cached = _CONTROLS_CACHE.get(key)
+    if cached is not None:
+        return cached[0]
+    try:
+        with open(os.path.join(root, ".codearbiter", "security-controls.md"),
+                  encoding="utf-8", errors="replace") as f:
+            text = f.read()
+    except Exception:  # noqa: BLE001 — no controls file -> defaults only
+        text = ""
+    # Cache the text AND the compiled custom globs per scope (filled lazily by
+    # scope_globs) under the same mtime key, so a custom-glob set compiles at
+    # most once per (root, mtime) instead of once per path_in_globs() call.
+    _CONTROLS_CACHE[key] = (text, {})
+    return text
+
+
+def _custom_re_cache(root):
+    """The per-(root, mtime) dict that caches compiled custom-glob regexes for
+    this controls revision. Populated lazily by scope_globs. Returns a throwaway
+    dict only if the controls entry is somehow missing (defensive; the read
+    above always seeds it first)."""
+    entry = _CONTROLS_CACHE.get((root, _controls_mtime(root)))
+    return entry[1] if entry is not None else {}
+
+
+def scope_globs(root, defaults, decl_re):
+    """(includes, excludes) for one scope category: the built-in `defaults` plus
+    any declaration block matched by `decl_re` in security-controls.md
+    (`+ glob` extends, `- glob` excludes). Shared by every path-glob scope
+    detector (migration/CI/deploy) so they never drift on the grammar."""
+    includes, excludes = list(defaults), []
+    m = decl_re.search(_read_controls(root))
+    if not m:
+        return includes, excludes
+    for ln in m.group(1).splitlines():
+        ln = ln.strip()
+        if ln.startswith("+ "):
+            includes.append(ln[2:].strip())
+        elif ln.startswith("- "):
+            excludes.append(ln[2:].strip())
+    return includes, excludes
+
+
+def _scope_res(root, defaults, decl_re):
+    """(include_res, exclude_res) as compiled regexes for one scope category.
+    Default globs use the module-precompiled regexes (zero per-call compilation);
+    any per-controls custom globs are compiled at most once per (root, mtime) and
+    cached. Equivalent to compiling each string from scope_globs() — verdicts are
+    identical; only the regex work is amortised."""
+    includes, excludes = scope_globs(root, defaults, decl_re)
+    default_res = _DEFAULT_RES_BY_GLOBS.get(defaults)
+    if default_res is None:
+        # Unknown defaults set (no precompiled tuple) — compile everything.
+        return ([_glob_to_re(g) for g in includes],
+                [_glob_to_re(g) for g in excludes])
+    # Defaults occupy the head of `includes` (scope_globs builds list(defaults)
+    # then appends customs); reuse the precompiled regexes for that head and
+    # compile only the trailing customs. Excludes are all custom.
+    custom_cache = _custom_re_cache(root)
+
+    def _compile(g):
+        r = custom_cache.get(g)
+        if r is None:
+            r = _glob_to_re(g)
+            custom_cache[g] = r
+        return r
+
+    n = len(defaults)
+    include_res = list(default_res) + [_compile(g) for g in includes[n:]]
+    exclude_res = [_compile(g) for g in excludes]
+    return include_res, exclude_res
+
+
+def path_in_globs(rel, root, defaults, decl_re):
+    """True iff `rel` (a repo-relative path) matches an include glob and no
+    exclude glob for the given scope category. Excludes win — the false-positive
+    escape hatch. The one matcher behind is_migration_path/is_ci_path/
+    is_deploy_path."""
+    rel = norm_path(rel).lstrip("/")
+    include_res, exclude_res = _scope_res(root, defaults, decl_re)
+    if any(r.match(rel) for r in exclude_res):
+        return False
+    return any(r.match(rel) for r in include_res)
+
+
+def migration_globs(root):
+    """(includes, excludes) for migration detection: defaults plus any
+    `migration-paths` declaration in security-controls.md."""
+    return scope_globs(root, MIGRATION_DEFAULT_GLOBS, _MIG_DECL_RE)
+
+
+def is_migration_path(rel, root):
+    """True iff `rel` is a database migration (H-14). Excludes win — the
+    escape hatch for a project whose `migrations/` dir holds non-DB files."""
+    return path_in_globs(rel, root, MIGRATION_DEFAULT_GLOBS, _MIG_DECL_RE)
+
+
+def is_ci_path(rel, root):
+    """True iff `rel` is a CI/CD workflow file (H-15, advisory)."""
+    return path_in_globs(rel, root, CI_DEFAULT_GLOBS, _CI_DECL_RE)
+
+
+def is_deploy_path(rel, root):
+    """True iff `rel` is a deployment / IaC manifest (H-16, advisory)."""
+    return path_in_globs(rel, root, DEPLOY_DEFAULT_GLOBS, _DEPLOY_DECL_RE)

package/plugins/ca-pi/hooks/_segmentslib.py

@@ -0,0 +1,278 @@
+#!/usr/bin/env python3
+# codeArbiter — statusline segment renderers (extracted from statusline.py,
+# architecture-004).
+#
+# Owns the individual content segments the box assembles into rows: the
+# context-window bar, the 5h/7d rate-limit cells, the model/effort pill, the
+# Session/Today usage row, the diff-churn / PR / transcript-pruner segments, and
+# the /dev redshift recolor. NOT the update-available marker (`seg_update` /
+# `plugin_root_for_render` stay in statusline.py — a test patches
+# `statusline.plugin_root_for_render` directly, so that seam must resolve through
+# the entry-point module's own globals, not a lib's).
+#
+# Design principles (mirroring _ledgerlib.py):
+#   - Stdlib only; no third-party imports ever.
+#   - Zero side effects at import time.
+#   - Never raise on malformed input — callers already wrap these in safe(), but
+#     each function still degrades on bad data rather than relying solely on that.
+#
+# Public API:
+#   seg_ctx_lines(data, w) -> [str, str]
+#   seg_window_cells(data) -> list[str]
+#   seg_window_inline(data) -> str
+#   model_pill(model, effort="") -> str
+#   usage_row(label, tin, tout, cost, trail="") -> str
+#   seg_lines(data) -> str|None
+#   seg_pr(data) -> str|None
+#   seg_prune(data, sid) -> str|None
+#   redshift(s) -> str
+
+import json
+import os
+import re
+import time
+
+try:
+    import _colorlib
+    _fg, _bg = _colorlib.fg, _colorlib.bg
+    RESET, BOLD = _colorlib.RESET, _colorlib.BOLD
+    V0, V2, V3 = _colorlib.V0, _colorlib.V2, _colorlib.V3
+    GREY, WHITE, OK, WARN, DANGER, PILL_FG = (_colorlib.GREY, _colorlib.WHITE, _colorlib.OK,
+                                              _colorlib.WARN, _colorlib.DANGER, _colorlib.PILL_FG)
+    _VBAR = _colorlib.V
+    BFULL, BEMPTY, DN, UP, ARR, BOLT = (_colorlib.BFULL, _colorlib.BEMPTY, _colorlib.DN,
+                                        _colorlib.UP, _colorlib.ARR, _colorlib.BOLT)
+    DIM = _colorlib.DIM
+except Exception:  # pragma: no cover — never let an import break the statusline
+    _colorlib = None
+    RESET = BOLD = DIM = ""
+    V0 = V2 = V3 = GREY = WHITE = OK = WARN = DANGER = PILL_FG = ""
+    _VBAR = "|"
+    BFULL, BEMPTY, DN, UP, ARR, BOLT = "#", ".", "v", "^", ">", "!"
+
+    def _bg(r, g, b):
+        return ""
+
+
+def sync_palette():
+    """Refresh captured color exports after _colorlib runtime activation."""
+    global RESET, BOLD, DIM, V0, V2, V3, GREY, WHITE, OK, WARN, DANGER, PILL_FG
+    if _colorlib is not None:
+        RESET, BOLD, DIM = _colorlib.RESET, _colorlib.BOLD, _colorlib.DIM
+        V0, V2, V3 = _colorlib.V0, _colorlib.V2, _colorlib.V3
+        GREY, WHITE, OK = _colorlib.GREY, _colorlib.WHITE, _colorlib.OK
+        WARN, DANGER, PILL_FG = _colorlib.WARN, _colorlib.DANGER, _colorlib.PILL_FG
+
+try:
+    import _fmtlib
+    fmt_tok, usd_fine, human_dur, to_epoch = (_fmtlib.fmt_tok, _fmtlib.usd_fine,
+                                              _fmtlib.human_dur, _fmtlib.to_epoch)
+    num = _fmtlib.num
+except Exception:  # pragma: no cover — never let an import break the statusline
+    _fmtlib = None
+
+    def num(x, default=0.0):
+        try:
+            return float(x)
+        except (TypeError, ValueError):
+            return default
+
+    def fmt_tok(n):
+        return str(int(num(n)))
+
+    def usd_fine(c):
+        return f"${num(c):.2f}"
+
+    def human_dur(secs):
+        return f"{int(max(0, secs))}s"
+
+    def to_epoch(v):
+        return None
+
+
+def get(d, *path, default=None):
+    cur = d
+    for k in path:
+        if not isinstance(cur, dict) or k not in cur or cur[k] is None:
+            return default
+        cur = cur[k]
+    return cur
+
+
+# --------------------------------------------------------------------------- context / rate limits
+def seg_ctx_lines(data, w):
+    """Two lines of context-window detail for the right column: a gradient bar +
+    used% on top, then resident/window + headroom-to-compaction below. The bar
+    scales to the available width w."""
+    cw = get(data, "context_window", default={}) or {}
+    pf = num(cw.get("used_percentage"), None)
+    if pf is None:
+        return [f"{GREY}ctx --{RESET}", ""]
+    pctf = max(0.0, min(100.0, pf))
+    size_raw = cw.get("context_window_size")
+    has_size = size_raw is not None
+    size = int(num(size_raw, 200000)) or 200000
+    win = "1M" if size >= 1_000_000 else f"{size // 1000}K"
+    resident = round(pctf / 100.0 * size)
+    col = V2 if pctf < 75 else (WARN if pctf < 90 else DANGER)
+    barw = max(10, min(46, w - 12))
+    filled = max(0, min(barw, round(pctf / 100 * barw)))
+    # below WARN: the violet sheen; at/over the 75/90 thresholds the FILL itself
+    # carries the threshold color so budget pressure shows on the dominant
+    # element, not just the trailing % glyph.
+    fill = _colorlib.gradient_h(BFULL * filled, max(1, filled)) if (pctf < 75 and _colorlib) else f"{col}{BFULL * filled}"
+    bar = fill + f"{V0}" + BEMPTY * (barw - filled) + RESET
+    pdisp = "<1%" if 0 < pctf < 1 else f"{pctf:.0f}%"
+    line1 = f"{GREY}ctx{RESET} {bar} {col}{pdisp}{RESET}"
+    thresh = num(os.environ.get("CODEARBITER_COMPACT_AT"), 92.0)
+    head = thresh - pctf
+    if head <= 0:
+        comp = f"{DANGER}{BOLT} compact imminent{RESET}"
+    else:
+        ccol = OK if head > 30 else (WARN if head > 12 else DANGER)
+        comp = f"{GREY}{BOLT} compact{RESET} {ccol}~{head:.0f}%{RESET}"
+    # only assert resident/window when the host actually sent the window size;
+    # otherwise show just the (percentage-based) compaction headroom, no fake /200K.
+    line2 = f"{DIM}{fmt_tok(resident)} / {win}{RESET}   {comp}" if has_size else comp
+    return [line1, line2]
+
+
+def seg_window_cells(data):
+    """5h / 7d rate-limit cells: used% + reset countdown. The countdown shows when
+    the host sends rate_limits.*.resets_at (ISO string or epoch); absent that, the
+    cell still shows the used%. Rendered wherever rate_limits exists."""
+    cells = []
+    now = time.time()
+    for key, lbl in (("five_hour", "5h"), ("seven_day", "7d")):
+        p = get(data, "rate_limits", key, "used_percentage")
+        if p is None:
+            continue
+        pf = num(p, None)
+        if pf is None:
+            continue
+        c = V2 if pf < 75 else (WARN if pf < 90 else DANGER)
+        cell = f"{GREY}{lbl}{RESET} {c}{pf:.0f}%{RESET}"
+        r = to_epoch(get(data, "rate_limits", key, "resets_at"))
+        if r:
+            dt = r - now
+            # a reset already in the past is stale data, not "rolls over now"
+            tail = f"{WHITE}{human_dur(dt)}{RESET}" if dt > 0 else f"{GREY}--{RESET}"
+            cell += f" {GREY}{ARR}{RESET} {tail}"
+        cells.append(cell)
+    return cells
+
+
+def seg_window_inline(data):
+    """Compact single-string rate-limit readout for the header line."""
+    cells = seg_window_cells(data)
+    return f" {V0}·{RESET} ".join(cells) if cells else ""
+
+
+EFF_DISP = {"low": "Low", "medium": "Medium", "high": "High",
+            "xhigh": "XHigh", "max": "Max", "ultracode": "Ultracode"}
+
+
+def model_pill(model, effort=""):
+    """A gradient-filled pill carrying the model AND its effort level, e.g.
+    " Opus 4.8 │ Ultracode ", keyed by family — Fable gold, Opus violet, Sonnet
+    blue, Haiku green. The background ramps dark->bright across the pill (a sheen
+    matching the box). Plain block ends (half-circle caps don't align in a
+    monospace cell)."""
+    m = str(model)
+    ml = m.lower()
+    if "fable" in ml:
+        c = (235, 184, 90)        # gold — the tier above Opus
+    elif "opus" in ml:
+        c = (188, 120, 255)       # violet
+    elif "sonnet" in ml:
+        c = (96, 174, 235)        # blue
+    elif "haiku" in ml:
+        c = (120, 220, 150)       # green
+    else:
+        c = (150, 150, 162)       # grey (unknown)
+    eff = str(effort).strip().lower()
+    body = f" {m} {_VBAR} {EFF_DISP.get(eff, eff.capitalize())} " if eff else f" {m} "
+    lo = tuple(int(v * 0.5) for v in c)           # dark start of the sheen
+    n = max(1, len(body) - 1)
+    cells = []
+    for idx, ch in enumerate(body):
+        t = idx / n
+        rr = int(lo[0] + (c[0] - lo[0]) * t)
+        gg = int(lo[1] + (c[1] - lo[1]) * t)
+        bb = int(lo[2] + (c[2] - lo[2]) * t)
+        cells.append(f"{_bg(rr, gg, bb)}{PILL_FG}{BOLD}{ch}")
+    return "".join(cells) + RESET
+
+
+def usage_row(label, tin, tout, cost, trail=""):
+    """One row of the Session/Today mini-table: label │ ↓in ↑out │ $cost. in/out are
+    fresh (sent) tokens; `cost` is Claude Code's real session cost (cost.total_cost_usd),
+    not an estimate. `trail` carries extras (session age, burn sparkline)."""
+    base = (f"{GREY}{label:<7}{RESET} {V0}{_VBAR}{RESET} "
+            f"{V2}{DN}{RESET} {WHITE}{fmt_tok(tin):>6}{RESET} "
+            f"{V2}{UP}{RESET} {WHITE}{fmt_tok(tout):>6}{RESET} {V0}{_VBAR}{RESET} "
+            f"{OK}{usd_fine(cost)}{RESET}")
+    return base + (f"  {trail}" if trail else "")
+
+
+def seg_lines(data):
+    add = get(data, "cost", "total_lines_added")
+    rem = get(data, "cost", "total_lines_removed")
+    if add is None and rem is None:
+        return None
+    return f"{GREY}diff{RESET} {OK}+{fmt_tok(add)}{RESET}{GREY}/{RESET}{DANGER}-{fmt_tok(rem)}{RESET}"
+
+
+def seg_pr(data):
+    num_ = get(data, "pr", "number")
+    if not num_:
+        return None
+    state = str(get(data, "pr", "state") or "").lower()
+    checks = str(get(data, "pr", "checks") or "").lower()
+    mark, col = "", V2
+    if checks in ("pass", "passing", "success", "green"):
+        mark, col = "✓", OK
+    elif checks in ("fail", "failing", "error", "red"):
+        mark, col = "✕", DANGER
+    elif checks in ("pending", "running", "queued"):
+        mark, col = "…", WARN
+    scol = OK if state == "open" else (V3 if state == "merged" else GREY)
+    tail = f" {col}{mark}{RESET}" if mark else ""
+    return f"{GREY}PR{RESET} {scol}#{num_}{RESET}{tail}"
+
+
+def seg_prune(data, sid):
+    """Transcript-pruner indicator: model-context reduction and age of the last
+    prune for this session, read from ~/.codearbiter/prune-state.json (written
+    by prune-transcript.py). Fail-soft — returns None on any problem, and never
+    raises, so it can never break statusline rendering."""
+    if not sid:
+        return None
+    try:
+        p = os.path.join(os.path.expanduser("~"), ".codearbiter", "prune-state.json")
+        with open(p, encoding="utf-8") as f:
+            st = json.load(f)
+        rec = st.get(sid) if isinstance(st, dict) else None
+        if not isinstance(rec, dict):
+            return None
+        file_freed = num(rec.get("file_bytes_freed", rec.get("freed_bytes")), 0)
+        if file_freed <= 0:
+            return None
+        age = human_dur(max(0, time.time() - num(rec.get("last_run_ts"), time.time())))
+        if "context_est_tokens_freed" not in rec:
+            pct = num(rec.get("file_pct", rec.get("pct")), 0)
+            return f"{GREY}✂{RESET} {WHITE}file:{pct:.0f}%{RESET} {GREY}{age}{RESET}"
+        context_tokens = max(0, num(rec.get("context_est_tokens_freed"), 0))
+        return (f"{GREY}✂{RESET} {WHITE}ctx:{fmt_tok(context_tokens)}{RESET} "
+                f"{GREY}{age}{RESET}")
+    except Exception:  # noqa: BLE001
+        return None
+
+
+def redshift(s):
+    """/dev tell: recolor every truecolor SGR to a red of matching brightness, so the
+    WHOLE bar turns alarm-red — a glaring sign orchestration is suspended."""
+    def repl(m):
+        lum = max(int(m.group(2)), int(m.group(3)), int(m.group(4)))
+        return f"\033[{m.group(1)};2;{min(255, 96 + lum)};{lum // 6};{lum // 7}m"
+    return re.sub(r"\033\[(38|48);2;(\d+);(\d+);(\d+)m", repl, s)