@astrale-os/cli 1.0.0-beta.32 → 1.0.0-beta.43

package/src/telemetry/recorder.ts

@@ -1,68 +0,0 @@
-/**
- * Recorder: the shim-facing telemetry entrypoint. beginInvocation captures a
- * start time and returns a finalizer that appends one TelemetryEvent line when
- * the process ends. Fully synchronous (safe inside process 'exit') and never
- * throws — a telemetry failure can't affect the CLI.
- */
-import { appendFileSync } from 'node:fs'
-
-import type { SessionScan } from './store'
-import type { TelemetryEvent } from './types'
-
-import { redactArgv } from './redact'
-import { ensureSession } from './session'
-import { telemetryEnabled } from './settings'
-import { eventsPath } from './store'
-
-/** Called once the command has resolved: records exit code + optional error. */
-export type Finalizer = (exitCode: number, errorName?: string) => void
-
-const NOOP: Finalizer = () => {}
-const HELP_VERSION = new Set([
-  '-h',
-  '--help',
-  '-V',
-  '--version',
-  '--cli-version',
-  'help',
-  'version',
-])
-
-/** Bare invocation (every() is true for []) or only help/version tokens — skip. */
-function isHelpOrVersion(args: string[]): boolean {
-  return args.every((a) => HELP_VERSION.has(a))
-}
-
-/** Begin recording an invocation; returns a finalizer to call at process end.
- *  `sessions` is an already-paid-for store scan the caller shares with
- *  retention — see bin/astrale.ts. */
-export function beginInvocation(argv: string[], sessions?: readonly SessionScan[]): Finalizer {
-  try {
-    const args = argv.slice(2)
-    if (!telemetryEnabled() || isHelpOrVersion(args)) return NOOP
-    const startMs = Date.now()
-    const ts = new Date(startMs).toISOString()
-    const cwd = process.cwd()
-    const { id, root } = ensureSession(cwd, sessions)
-    return (exitCode: number, errorName?: string) => {
-      try {
-        const event: TelemetryEvent = {
-          v: 1,
-          ts,
-          argv: redactArgv(args),
-          exitCode,
-          durationMs: Date.now() - startMs,
-          cwd,
-          root,
-          surface: 'cli',
-        }
-        if (errorName) event.errorName = errorName
-        appendFileSync(eventsPath(id), JSON.stringify(event) + '\n')
-      } catch {
-        /* telemetry must never affect the CLI */
-      }
-    }
-  } catch {
-    return NOOP
-  }
-}

package/src/telemetry/redact.ts

@@ -1,53 +0,0 @@
-/**
- * Argv redaction for telemetry: strips secret-looking values before an
- * invocation is recorded, then bounds per-arg length and array size. Pure —
- * no fs, no env, safe to call from any path.
- */
-
-const SECRET_KEY = /(token|secret|key|password|auth|bearer|jwk|credential)/i
-// Secret-shaped VALUES regardless of the key they travel under: JWTs (the
-// `eyJ` base64 of `{"`) and provider API keys. Deliberately no generic
-// long-base64 rule — absolute paths share that alphabet and would false-hit.
-const SECRET_VALUE_SHAPES = [
-  /eyJ[A-Za-z0-9_-]{14,}(?:\.[A-Za-z0-9_-]{8,}){0,2}/g,
-  /\bsk-[A-Za-z0-9_-]{16,}\b/g,
-]
-const REDACTED = '<redacted>'
-const MAX_ARG_LEN = 200
-const MAX_ITEMS = 40
-
-/** Replace secret-shaped substrings anywhere in an arg (positional JWTs etc.). */
-function redactValueShapes(arg: string): string {
-  let out = arg
-  for (const shape of SECRET_VALUE_SHAPES) out = out.replace(shape, REDACTED)
-  return out
-}
-
-/** Redact secret values in argv, truncate long args, cap the array length. */
-export function redactArgv(argv: string[]): string[] {
-  const out: string[] = []
-  let redactNext = false
-  for (const arg of argv) {
-    if (redactNext) {
-      out.push(REDACTED)
-      redactNext = false
-      continue
-    }
-    const eq = arg.indexOf('=')
-    if (eq > 0 && SECRET_KEY.test(arg.slice(0, eq).replace(/^-+/, ''))) {
-      out.push(arg.slice(0, eq + 1) + REDACTED)
-      continue
-    }
-    if (eq < 0 && arg.startsWith('-') && SECRET_KEY.test(arg.replace(/^-+/, ''))) {
-      out.push(arg)
-      redactNext = true
-      continue
-    }
-    out.push(redactValueShapes(arg))
-  }
-  const bounded = out.map((a) => (a.length > MAX_ARG_LEN ? a.slice(0, MAX_ARG_LEN) + '…' : a))
-  if (bounded.length > MAX_ITEMS) {
-    return [...bounded.slice(0, MAX_ITEMS), `…+${bounded.length - MAX_ITEMS}`]
-  }
-  return bounded
-}

package/src/telemetry/retention.ts

@@ -1,176 +0,0 @@
-/**
- * Session-store retention: two bounds, applied in that order.
- *
- * Age is a RELEVANCE bound — a session idle for a month has nothing left to
- * say, and the harness transcripts its report would cite are long gone. It is
- * free to enforce (scanSessions already stats every events.jsonl), so it runs
- * on every CLI start, telemetry on or off: switching telemetry off must mean
- * "and clean up what is already there", not "freeze the store forever".
- *
- * Size is a SAFETY bound — the analyzer runs with Write inside the session
- * directory, so one pathological session can grow without limit. Enforcing it
- * means stat-ing every file of every session, so it runs only in the detached
- * analyzer, never on the user's critical path.
- *
- * Neither bound replaces the other: age bounds what is worth keeping, size
- * bounds what can go wrong. Both are configurable — see settings.ts.
- */
-import { type Dirent, readdirSync, rmSync } from 'node:fs'
-import { join } from 'node:path'
-
-import type { RetentionBudget } from './settings'
-import type { SessionScan } from './store'
-
-import { retentionBudget } from './settings'
-import { readMarker, scanSessions, sessionBytes, sessionDir } from './store'
-
-/** What an analyzed session is allowed to keep. Everything else is scratch: the
- *  analyzer runs with Write inside the session directory, so without this a
- *  session's size is whatever the agent felt like writing — one here was left
- *  holding a 462 KB calls.txt, a quarter of the entire store. */
-const KEEP = new Set(['meta.json', 'events.jsonl', 'report.md', '.analyzed', 'analyzer.log'])
-
-/** Reproducible from events.jsonl in the normal case, and dropped there — but
- *  it is the only record of what the analyzer was actually asked when it
- *  failed, which is exactly when someone will want to look. */
-const ANALYZER_PROMPT = 'analyzer-prompt.md'
-
-/**
- * Reduce one session to its durable artifacts, called once the analyzer has
- * written its marker. This is what makes a session's footprint a property of
- * the CLI rather than of whatever the agent decided to leave behind.
- */
-export function tidySession(id: string, options: { keepPrompt?: boolean } = {}): string[] {
-  const dir = sessionDir(id)
-  let entries: Dirent[]
-  try {
-    entries = readdirSync(dir, { withFileTypes: true })
-  } catch {
-    return []
-  }
-  const removed: string[] = []
-  for (const entry of entries) {
-    if (KEEP.has(entry.name)) continue
-    if (entry.name === ANALYZER_PROMPT && options.keepPrompt === true) continue
-    try {
-      rmSync(join(dir, entry.name), { recursive: true, force: true })
-      removed.push(entry.name)
-    } catch {
-      /* best effort — tidying must never fail the analysis it follows */
-    }
-  }
-  return removed
-}
-
-/** Cap for the age sweep on the CLI's critical path, so a large backlog drains
- *  over several runs instead of stalling one command on hundreds of rmSync. */
-export const MAX_REMOVALS_ON_START = 20
-
-export type SweepOptions = {
-  /** Defaults to the resolved config budget. */
-  budget?: RetentionBudget
-  now?: number
-  /** Cap on removals; unbounded when omitted. */
-  limit?: number
-  /** Ids that must survive — the session being recorded or analyzed right now. */
-  protect?: ReadonlySet<string>
-}
-
-/** Session ids removed, in removal order. */
-export type SweepResult = { removed: string[] }
-
-function remove(id: string, into: string[]): void {
-  try {
-    rmSync(sessionDir(id), { recursive: true, force: true })
-    into.push(id)
-  } catch {
-    /* best effort — retention must never affect the CLI */
-  }
-}
-
-/**
- * Drop every session whose last activity predates the age bound, analyzed or
- * not: a session that went a month without being analyzed never will be.
- * Sessions with no events yet are exempt — one of them is the invocation
- * running right now, created by ensureSession and not written until exit.
- */
-export function sweepByAge(
-  sessions: readonly SessionScan[],
-  options: SweepOptions = {},
-): SweepResult {
-  const { maxAgeMs } = options.budget ?? retentionBudget()
-  const cutoff = (options.now ?? Date.now()) - maxAgeMs
-  const limit = options.limit ?? Number.POSITIVE_INFINITY
-  const protect = options.protect
-  const removed: string[] = []
-  for (const session of sessions) {
-    if (removed.length >= limit) break
-    if (protect?.has(session.id)) continue
-    if (session.lastEventAt !== null && session.lastEventAt.getTime() < cutoff) {
-      remove(session.id, removed)
-    }
-  }
-  return { removed }
-}
-
-/**
- * Trim the store to the size bound, evicting oldest-first and analyzed before
- * unanalyzed — an analyzed session has already handed its evidence to a report,
- * an unanalyzed one has not. Open sessions are never touched: one of them is
- * being recorded right now.
- */
-export function sweepToBudget(
-  sessions: readonly SessionScan[],
-  options: SweepOptions = {},
-): SweepResult {
-  const { maxBytes } = options.budget ?? retentionBudget()
-  const protect = options.protect
-  const removed: string[] = []
-
-  const sized = sessions.map((session) => ({ session, bytes: sessionBytes(session.id) }))
-  let total = sized.reduce((sum, entry) => sum + entry.bytes, 0)
-  if (total <= maxBytes) return { removed }
-
-  // Oldest first; a session with no events yet sorts to the front — it holds
-  // nothing but a meta.json, so it is the cheapest thing to lose.
-  const evictable = sized
-    .filter((entry) => entry.session.closed && !protect?.has(entry.session.id))
-    .sort(
-      (a, b) => (a.session.lastEventAt?.getTime() ?? 0) - (b.session.lastEventAt?.getTime() ?? 0),
-    )
-
-  for (const analyzedFirst of [true, false]) {
-    for (const entry of evictable) {
-      if (total <= maxBytes) return { removed }
-      if (entry.session.analyzed !== analyzedFirst) continue
-      const before = removed.length
-      remove(entry.session.id, removed)
-      if (removed.length > before) total -= entry.bytes
-    }
-  }
-  return { removed }
-}
-
-/**
- * Both bounds over the live store, for the detached analyzer: age first (cheap,
- * and it may free enough on its own), then size over whatever survives.
- */
-export function sweepStore(options: SweepOptions = {}): SweepResult {
-  const budget = options.budget ?? retentionBudget()
-  const sessions = scanSessions()
-  const byAge = sweepByAge(sessions, { ...options, budget })
-  const gone = new Set(byAge.removed)
-  const survivors = sessions.filter((session) => !gone.has(session.id))
-
-  // Tidy before measuring. Doing it after would let a session be evicted for
-  // holding scratch that was about to be deleted anyway — and it is what makes
-  // the artifact bound retroactive rather than only applying to new analyses.
-  for (const session of survivors) {
-    if (session.analyzed) {
-      tidySession(session.id, { keepPrompt: readMarker(session.id)?.outcome === 'error' })
-    }
-  }
-
-  const bySize = sweepToBudget(survivors, { ...options, budget })
-  return { removed: [...byAge.removed, ...bySize.removed] }
-}

package/src/telemetry/session.ts

@@ -1,94 +0,0 @@
-/**
- * Session identity: buckets CLI invocations by workspace (git root, else cwd).
- * ASTRALE_SESSION pins an explicit id owned by a surface; otherwise an ambient
- * session is reused within the idle window or minted per root. Never spawns a
- * child process; every fs touch is swallowed so telemetry can't break the CLI.
- */
-import { createHash } from 'node:crypto'
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-
-import type { SessionMeta } from './types'
-
-import { metaPath, readMeta, scanSessions, sessionDir, type SessionScan } from './store'
-
-export type ResolvedSession = { id: string; root: string; explicit: boolean }
-
-const MAX_ID_LEN = 64
-
-/** Nearest ancestor of `start` (inclusive) containing a `.git` entry, else null. */
-function findGitRoot(start: string): string | null {
-  let dir = start
-  for (;;) {
-    if (existsSync(join(dir, '.git'))) return dir
-    const parent = dirname(dir)
-    if (parent === dir) return null
-    dir = parent
-  }
-}
-
-/** Keep only id-safe chars, capped to 64. */
-function sanitizeId(raw: string): string {
-  return raw.replace(/[^a-zA-Z0-9._-]/g, '').slice(0, MAX_ID_LEN)
-}
-
-/** Local-time yyyymmddHHmm stamp for a minted ambient id. */
-function stamp(d = new Date()): string {
-  const p = (n: number, w = 2) => String(n).padStart(w, '0')
-  return `${p(d.getFullYear(), 4)}${p(d.getMonth() + 1)}${p(d.getDate())}${p(d.getHours())}${p(d.getMinutes())}`
-}
-
-/** id of an open, ambient session already bucketed to `root`, else null.
- *  Analyzed sessions are never reused — a straggler event may "reopen" one
- *  after its report, and new work funneled there would never be analyzed.
- *  Only the open, unanalyzed candidates get their meta.json read: on a store of
- *  hundreds at most a couple qualify, and this runs before every command. */
-function findOpenAmbient(root: string, sessions: readonly SessionScan[]): string | null {
-  for (const s of sessions) {
-    if (s.closed || s.analyzed) continue
-    const meta = readMeta(s.id)
-    if (meta?.root === root && meta.explicit === false) return s.id
-  }
-  return null
-}
-
-function mintAmbientId(root: string): string {
-  const hash8 = createHash('sha256').update(root).digest('hex').slice(0, 8)
-  return `amb-${hash8}-${stamp()}`
-}
-
-/** Resolve the session identity for `cwd` without creating anything on disk.
- *  `sessions` lets the caller hand over a scan it already paid for — the CLI
- *  start path shares one between recording and retention. */
-export function resolveSession(cwd: string, sessions?: readonly SessionScan[]): ResolvedSession {
-  const root = findGitRoot(cwd) ?? cwd
-  const pinned = process.env.ASTRALE_SESSION
-  if (pinned) {
-    const id = sanitizeId(pinned)
-    if (id.length > 0) return { id, root, explicit: true }
-  }
-  // Only scan when a pinned id did not already settle it.
-  const scan = sessions ?? scanSessions()
-  return { id: findOpenAmbient(root, scan) ?? mintAmbientId(root), root, explicit: false }
-}
-
-/** Resolve, then create the session dir + meta.json on first sight. */
-export function ensureSession(cwd: string, sessions?: readonly SessionScan[]): ResolvedSession {
-  const resolved = resolveSession(cwd, sessions)
-  const dir = sessionDir(resolved.id)
-  if (!existsSync(dir)) {
-    try {
-      mkdirSync(dir, { recursive: true })
-      const meta: SessionMeta = {
-        id: resolved.id,
-        root: resolved.root,
-        explicit: resolved.explicit,
-        createdAt: new Date().toISOString(),
-      }
-      writeFileSync(metaPath(resolved.id), JSON.stringify(meta, null, 2) + '\n')
-    } catch {
-      /* telemetry never breaks the CLI */
-    }
-  }
-  return resolved
-}

package/src/telemetry/settings.ts

@@ -1,79 +0,0 @@
-/**
- * Telemetry kill-switch and retention budget, both read synchronously from
- * `~/.astrale/config.json` with env overrides. Off when ASTRALE_TELEMETRY is
- * 0/false/off, or when config telemetry.enabled is false; on by default.
- * Every read silent-fails to the default — a broken config must never break
- * the CLI, and must never leave the session store unbounded.
- */
-import { readFileSync } from 'node:fs'
-
-import { createPaths } from '../state/index'
-
-const OFF_VALUES = new Set(['0', 'false', 'off'])
-
-/** Sessions idle longer than this are dropped: a month-old session has nothing
- *  left to say, and the harness transcripts its report would cite are gone. */
-export const DEFAULT_MAX_AGE_DAYS = 30
-
-/** Hard ceiling on the whole session store. At ~35 KB per session that is some
- *  1,400 sessions — never reached in normal use. It exists for the pathological
- *  case: the analyzer runs with Write inside the session directory, so a single
- *  session can grow without bound. */
-export const DEFAULT_MAX_BYTES = 50 * 1024 * 1024
-
-type TelemetryConfig = {
-  enabled?: boolean
-  maxAgeDays?: number
-  maxBytes?: number
-}
-
-/** The `telemetry` block, or {} when the config is missing or unreadable. */
-function readConfig(): TelemetryConfig {
-  try {
-    // Call-time path resolution — see sessionsRoot() in store.ts for why.
-    const parsed = JSON.parse(readFileSync(createPaths().config, 'utf-8')) as {
-      telemetry?: TelemetryConfig
-    }
-    const telemetry = parsed.telemetry
-    return typeof telemetry === 'object' && telemetry !== null ? telemetry : {}
-  } catch {
-    /* missing or broken config → defaults */
-    return {}
-  }
-}
-
-/** Whether telemetry recording is enabled for this process. */
-export function telemetryEnabled(): boolean {
-  const env = process.env.ASTRALE_TELEMETRY
-  if (env !== undefined && OFF_VALUES.has(env.trim().toLowerCase())) return false
-  return readConfig().enabled !== false
-}
-
-/** The two bounds on the session store — see retention.ts for how they apply. */
-export type RetentionBudget = {
-  maxAgeMs: number
-  maxBytes: number
-}
-
-/** First finite, strictly positive candidate. Zero, negatives and garbage fall
- *  through to the next candidate (ultimately the default) rather than
- *  disabling the bound, so a typo can never make the store unbounded. */
-function firstPositive(candidates: (number | string | undefined)[]): number | null {
-  for (const candidate of candidates) {
-    if (candidate === undefined) continue
-    const n = typeof candidate === 'string' ? Number(candidate.trim()) : candidate
-    if (Number.isFinite(n) && n > 0) return n
-  }
-  return null
-}
-
-/** Resolved retention budget: env over config over defaults. */
-export function retentionBudget(): RetentionBudget {
-  const config = readConfig()
-  const days =
-    firstPositive([process.env.ASTRALE_TELEMETRY_MAX_AGE_DAYS, config.maxAgeDays]) ??
-    DEFAULT_MAX_AGE_DAYS
-  const bytes =
-    firstPositive([process.env.ASTRALE_TELEMETRY_MAX_BYTES, config.maxBytes]) ?? DEFAULT_MAX_BYTES
-  return { maxAgeMs: days * 24 * 60 * 60 * 1000, maxBytes: bytes }
-}

package/src/telemetry/store.ts

@@ -1,174 +0,0 @@
-/**
- * Session store layout under `~/.astrale/sessions/<id>/`:
- *   events.jsonl   append-only CLI events; its mtime IS the session's last-activity
- *   meta.json      SessionMeta, written once at creation
- *   .analyzed      AnalyzedMarker, written by the analyzer (any outcome)
- *   report.md      analyzer output
- * A session is CLOSED when events.jsonl's mtime is older than IDLE_WINDOW_MS.
- *
- * Two ways to read it, deliberately kept apart. scanSessions() answers the
- * questions the CLI's start path asks — how old, open or closed, analyzed yet —
- * from two stats per session and no file reads. listSessions() adds the parsed
- * meta.json and marker, which only `session list` and the analyzer need. The
- * start path runs before EVERY command, so the difference is not academic.
- */
-import { type Dirent, existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
-import { join } from 'node:path'
-
-import type { AnalyzedMarker, SessionMeta } from './types'
-
-import { createPaths } from '../state/index'
-
-export const IDLE_WINDOW_MS = 30 * 60 * 1000
-
-// Resolved at CALL time (not import time) so ASTRALE_HOME set late — notably
-// by tests whose module-load order is out of their control — always applies.
-// The env can't change mid-process in real CLI runs, so behavior is identical.
-export function sessionsRoot(): string {
-  return join(createPaths().home, 'sessions')
-}
-
-export function sessionDir(id: string): string {
-  return join(sessionsRoot(), id)
-}
-
-export function eventsPath(id: string): string {
-  return join(sessionDir(id), 'events.jsonl')
-}
-
-export function metaPath(id: string): string {
-  return join(sessionDir(id), 'meta.json')
-}
-
-export function markerPath(id: string): string {
-  return join(sessionDir(id), '.analyzed')
-}
-
-export function reportPath(id: string): string {
-  return join(sessionDir(id), 'report.md')
-}
-
-/**
- * The cheap facts about one session: enough to bucket an invocation, sweep the
- * store, and pick an analysis target. `analyzed` records that a marker EXISTS,
- * not what it says — a stat, not a read.
- */
-export type SessionScan = {
-  id: string
-  lastEventAt: Date | null
-  closed: boolean
-  analyzed: boolean
-}
-
-/** Session directory names, newest-first ordering applied by the callers. */
-function sessionIds(): string[] {
-  try {
-    return readdirSync(sessionsRoot()).filter((name) => !name.startsWith('.'))
-  } catch {
-    return []
-  }
-}
-
-/** Newest activity first. Two stats per session, no file reads, no parsing. */
-export function scanSessions(now = Date.now()): SessionScan[] {
-  return sessionIds()
-    .map((id) => {
-      let lastEventAt: Date | null = null
-      try {
-        lastEventAt = statSync(eventsPath(id)).mtime
-      } catch {
-        /* no events yet */
-      }
-      return {
-        id,
-        lastEventAt,
-        closed: lastEventAt !== null && now - lastEventAt.getTime() > IDLE_WINDOW_MS,
-        analyzed: existsSync(markerPath(id)),
-      }
-    })
-    .sort((a, b) => (b.lastEventAt?.getTime() ?? 0) - (a.lastEventAt?.getTime() ?? 0))
-}
-
-/** Bytes on disk under `dir`. Unreadable entries count as zero — a directory
- *  racing away mid-walk is normal, not an error worth propagating. */
-function directoryBytes(dir: string): number {
-  let entries: Dirent[]
-  try {
-    entries = readdirSync(dir, { withFileTypes: true })
-  } catch {
-    return 0
-  }
-  let total = 0
-  for (const entry of entries) {
-    const path = join(dir, entry.name)
-    if (entry.isDirectory()) {
-      total += directoryBytes(path)
-    } else if (entry.isFile()) {
-      try {
-        total += statSync(path).size
-      } catch {
-        /* raced away mid-walk */
-      }
-    }
-  }
-  return total
-}
-
-/** Bytes one session occupies. The analyzer runs with Write inside the session
- *  directory and may nest, so this walks rather than listing one level. */
-export function sessionBytes(id: string): number {
-  return directoryBytes(sessionDir(id))
-}
-
-export type SessionInfo = {
-  id: string
-  meta: SessionMeta | null
-  lastEventAt: Date | null
-  closed: boolean
-  analyzed: AnalyzedMarker | null
-}
-
-/** One session's meta.json, or null when absent or unparseable. */
-export function readMeta(id: string): SessionMeta | null {
-  return readJsonSafe<SessionMeta>(metaPath(id))
-}
-
-/** One session's analyzer marker, or null when absent or unparseable. */
-export function readMarker(id: string): AnalyzedMarker | null {
-  return readJsonSafe<AnalyzedMarker>(markerPath(id))
-}
-
-function readJsonSafe<T>(path: string): T | null {
-  try {
-    return JSON.parse(readFileSync(path, 'utf-8')) as T
-  } catch {
-    return null
-  }
-}
-
-export function inspectSession(id: string, now = Date.now()): SessionInfo | null {
-  const dir = sessionDir(id)
-  if (!existsSync(dir)) return null
-  let lastEventAt: Date | null = null
-  try {
-    lastEventAt = statSync(eventsPath(id)).mtime
-  } catch {
-    /* no events yet */
-  }
-  return {
-    id,
-    meta: readJsonSafe<SessionMeta>(metaPath(id)),
-    lastEventAt,
-    closed: lastEventAt !== null && now - lastEventAt.getTime() > IDLE_WINDOW_MS,
-    analyzed: readJsonSafe<AnalyzedMarker>(markerPath(id)),
-  }
-}
-
-/** All sessions, newest activity first, fully parsed. Missing store dir → empty
- *  list. Prefer scanSessions() anywhere latency matters — see the file header. */
-export function listSessions(now = Date.now()): SessionInfo[] {
-  return sessionIds()
-    .map((id) => inspectSession(id, now))
-    .filter((s): s is SessionInfo => s !== null)
-    .sort((a, b) => (b.lastEventAt?.getTime() ?? 0) - (a.lastEventAt?.getTime() ?? 0))
-}