@m13v/s4l 1.6.197-rc.10

package/scripts/ingest_human_dm_replies.py

@@ -0,0 +1,271 @@
+#!/usr/bin/env python3
+"""Ingest human replies to DM escalation emails from Gmail into human_dm_replies.
+
+Flow:
+  1. flag_human() in dm_conversation.py sends an escalation email with subject
+     `[DM #<id>] <author> [<platform>]: <reason>` FROM matt@s4l.ai TO
+     NOTIFICATION_EMAIL (i@m13v.com).
+  2. The human reads it in i@m13v.com, hits Reply in Gmail, writes what they want
+     to say, sends. Gmail keeps `[DM #<id>]` in the subject (prefixed with Re:).
+     Because the escalation's From is matt@s4l.ai, the reply is delivered TO the
+     matt@s4l.ai mailbox as a fresh unread inbound message (the reply is sent from
+     i@m13v.com, a different account, so it lands in matt@s4l.ai's inbox, not Sent).
+  3. This script polls the matt@s4l.ai mailbox for messages matching that subject
+     token that are unread. For each, it extracts the dm_id, strips the quoted
+     history from the reply body, and inserts a row into human_dm_replies with
+     status='pending' (unique on gmail message id).
+  4. It marks the Gmail message as read so we don't re-ingest.
+  5. Phase 0 of skill/engage-dm-replies.sh then picks up pending rows and sends
+     them as DMs on the target platform.
+
+  Auth: matt@s4l.ai is reached via the keyless Domain-Wide Delegation lane (the
+  service account gmail-dwd-impersonator impersonates it; s4l.ai is a secondary
+  domain in the mediar.ai Workspace). The short-lived access token is kept warm by
+  launchd job com.m13v.gmail-dwd-keepalive-s4l; this script also refreshes inline
+  if the token is missing or about to expire.
+
+Usage:
+    python3 scripts/ingest_human_dm_replies.py             # ingest and report
+    python3 scripts/ingest_human_dm_replies.py --dry-run   # print what would be ingested, no DB writes, no label changes
+"""
+
+import argparse
+import base64
+import json
+import os
+import re
+import subprocess
+import sys
+import time
+from email import message_from_bytes
+from email.policy import default as email_default_policy
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+# HTTP-only: dms lookup + human_dm_replies dedup/insert go through the s4l.ai
+# HTTP API (scripts/http_api.py). The direct-Postgres lane was removed
+# 2026-06-01; DATABASE_URL is deliberately ignored, no DB path, no fallback.
+from http_api import api_get, api_post
+
+from google.oauth2.credentials import Credentials
+from googleapiclient.discovery import build
+
+GMAIL_SCOPES = ["https://mail.google.com/"]
+
+# matt@s4l.ai via keyless Domain-Wide Delegation. The keepalive launchd job
+# (com.m13v.gmail-dwd-keepalive-s4l) keeps this access token warm; we also
+# refresh inline below if it is missing or within 60s of expiry.
+DWD_CREDS_PATH = os.path.expanduser("~/.gmail-mcp-s4l/credentials.json")
+DWD_REFRESHER = os.path.expanduser("~/gmail-dwd-keepalive/refresh_token_s4l.py")
+DWD_PYTHON = os.path.expanduser("~/gmail-dwd-keepalive/.venv/bin/python")
+
+SELF_ADDRESSES = {"matt@s4l.ai"}
+DM_ID_RE = re.compile(r"\[DM\s*#(\d+)\]", re.IGNORECASE)
+RE_PREFIX_RE = re.compile(r"^\s*re\s*:", re.IGNORECASE)
+
+# Only fetch Gmail replies (subject starts with "Re:"). This excludes both our
+# own outgoing escalation emails (original subject, no Re:) and stale historical
+# escalations that pre-date the rewire.
+GMAIL_QUERY = 'is:unread subject:"Re: [DM #"'
+
+
+def _run_refresher():
+    subprocess.run([DWD_PYTHON, DWD_REFRESHER], check=True, timeout=60)
+
+
+def gmail_service():
+    """Build the Gmail service for matt@s4l.ai from the DWD access token.
+
+    Reads the short-lived token minted by the keepalive job. If the file is
+    missing or the token is within 60s of expiry, runs the refresher inline.
+    """
+    if not os.path.exists(DWD_CREDS_PATH):
+        _run_refresher()
+    with open(DWD_CREDS_PATH) as f:
+        payload = json.load(f)
+    expiry_ms = payload.get("expiry_date", 0)
+    if not payload.get("access_token") or (expiry_ms and expiry_ms / 1000 <= time.time() + 60):
+        _run_refresher()
+        with open(DWD_CREDS_PATH) as f:
+            payload = json.load(f)
+    creds = Credentials(token=payload["access_token"], scopes=GMAIL_SCOPES)
+    return build("gmail", "v1", credentials=creds, cache_discovery=False)
+
+
+def list_candidate_messages(service):
+    resp = service.users().messages().list(userId="me", q=GMAIL_QUERY, maxResults=50).execute()
+    return resp.get("messages", []) or []
+
+
+def fetch_raw(service, message_id):
+    msg = service.users().messages().get(userId="me", id=message_id, format="raw").execute()
+    raw = base64.urlsafe_b64decode(msg["raw"].encode("ASCII"))
+    return message_from_bytes(raw, policy=email_default_policy), msg.get("labelIds", [])
+
+
+def pick_plain_body(email_msg):
+    if email_msg.is_multipart():
+        text_part = None
+        for part in email_msg.walk():
+            ctype = part.get_content_type()
+            if ctype == "text/plain":
+                text_part = part
+                break
+        if text_part is None:
+            for part in email_msg.walk():
+                if part.get_content_type() == "text/html":
+                    text_part = part
+                    break
+        if text_part is None:
+            return ""
+        try:
+            return text_part.get_content()
+        except Exception:
+            return text_part.get_payload(decode=True).decode("utf-8", errors="replace")
+    try:
+        return email_msg.get_content()
+    except Exception:
+        payload = email_msg.get_payload(decode=True)
+        if payload:
+            return payload.decode("utf-8", errors="replace")
+        return email_msg.get_payload() or ""
+
+
+# Common "On Mon, Apr 20, 2026 at 5:30 PM X wrote:" patterns across clients.
+QUOTE_MARKER_RES = [
+    re.compile(r"^On .{5,200}\s+wrote:\s*$", re.MULTILINE | re.IGNORECASE),
+    re.compile(r"^-{2,}\s*Original Message\s*-{2,}\s*$", re.MULTILINE | re.IGNORECASE),
+    re.compile(r"^From:\s.+<.+>\s*$", re.MULTILINE),
+]
+
+
+def strip_quoted_history(body):
+    if not body:
+        return ""
+    earliest = len(body)
+    for pat in QUOTE_MARKER_RES:
+        m = pat.search(body)
+        if m and m.start() < earliest:
+            earliest = m.start()
+    trimmed = body[:earliest]
+
+    lines = []
+    for line in trimmed.splitlines():
+        if line.lstrip().startswith(">"):
+            break
+        lines.append(line)
+    return "\n".join(lines).strip()
+
+
+def extract_sender_addr(raw_from):
+    if not raw_from:
+        return ""
+    m = re.search(r"<([^>]+)>", raw_from)
+    return (m.group(1) if m else raw_from).strip().lower()
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--dry-run", action="store_true", help="Print what would be ingested, do not touch DB or labels")
+    args = parser.parse_args()
+
+    try:
+        service = gmail_service()
+    except Exception as e:
+        print(f"FATAL: could not build Gmail service: {e}", file=sys.stderr)
+        sys.exit(2)
+
+    candidates = list_candidate_messages(service)
+    if not candidates:
+        print("No candidate Gmail messages for DM escalation replies.")
+        return
+
+    ingested = 0
+    skipped = 0
+    for c in candidates:
+        gmail_id = c["id"]
+        try:
+            email_msg, labels = fetch_raw(service, gmail_id)
+        except Exception as e:
+            print(f"  SKIP {gmail_id}: fetch failed: {e}")
+            skipped += 1
+            continue
+
+        subject = email_msg.get("Subject", "") or ""
+        sender = extract_sender_addr(email_msg.get("From", ""))
+        m = DM_ID_RE.search(subject)
+        if not m:
+            print(f"  SKIP {gmail_id}: subject has no [DM #N] token ({subject!r})")
+            skipped += 1
+            continue
+        dm_id = int(m.group(1))
+
+        # Belt-and-suspenders: reject anything where the subject doesn't start
+        # with Re:. The Gmail query should already filter this, but if someone
+        # forwards an escalation, is:unread + [DM #N] would match without Re:.
+        if not RE_PREFIX_RE.match(subject):
+            print(f"  SKIP {gmail_id}: subject not a reply ({subject!r})")
+            skipped += 1
+            continue
+
+        dm_resp = api_get(f"/api/v1/dms/{dm_id}", ok_on_404=True)
+        dm_row = (dm_resp.get("data") or {}).get("dm") if dm_resp.get("ok") else None
+        if not dm_row:
+            print(f"  SKIP {gmail_id}: DM #{dm_id} not found in dms table")
+            skipped += 1
+            continue
+
+        body_raw = pick_plain_body(email_msg)
+        reply_text = strip_quoted_history(body_raw)
+        if not reply_text:
+            print(f"  SKIP {gmail_id}: empty reply after stripping quoted history")
+            skipped += 1
+            continue
+
+        project = dm_row.get("target_project") or dm_row.get("project_name")
+
+        print(f"  MATCH {gmail_id}: DM #{dm_id} ({dm_row['platform']}/{dm_row['their_author']}) reply {reply_text!r}")
+
+        if args.dry_run:
+            ingested += 1
+            continue
+
+        # Dedup-on-gmail-id + insert happen server-side in one POST: the
+        # endpoint SELECTs by resend_email_id and returns reused=true if the
+        # reply was already ingested, otherwise inserts status='pending'.
+        try:
+            resp = api_post("/api/v1/human-dm-replies", {
+                "dm_id": dm_id,
+                "platform": dm_row["platform"],
+                "their_author": dm_row["their_author"],
+                "project_name": project,
+                "instructions": reply_text,
+                "email_subject": subject,
+                "resend_email_id": gmail_id,
+            })
+        except SystemExit as e:
+            print(f"  ERROR {gmail_id}: insert failed: {e}")
+            skipped += 1
+            continue
+        data = (resp.get("data") or {}) if isinstance(resp, dict) else {}
+        reused = bool(data.get("reused"))
+        if reused:
+            print(f"  SKIP {gmail_id}: already ingested as human_dm_replies #{data.get('id')}")
+            skipped += 1
+
+        # Mark as read in both cases so the Gmail query excludes it next run.
+        try:
+            service.users().messages().modify(
+                userId="me", id=gmail_id,
+                body={"removeLabelIds": ["UNREAD"]},
+            ).execute()
+        except Exception as e:
+            print(f"  WARN {gmail_id}: could not mark as read: {e}")
+
+        if not reused:
+            ingested += 1
+
+    print(f"Done. Ingested={ingested} skipped={skipped} candidates={len(candidates)}")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/ingest_web_chat_replies.py

@@ -0,0 +1,229 @@
+#!/usr/bin/env python3
+"""Ingest human (Matt) replies to web-chat escalation emails from Gmail into Postgres.
+
+Mirror of scripts/ingest_human_dm_replies.py for the web-chat rail.
+
+Flow:
+  1. The Claude session ends a conversation by sending an escalation email with
+     subject `[WEB-CHAT #<thread_db_id>] <project>: <visitor_email>` from
+     i@m13v.com to the project's notify_email (or i@m13v.com).
+  2. Matt reads it, hits Reply in Gmail, types what he actually wants the
+     visitor to see, sends. Gmail keeps `[WEB-CHAT #<id>]` in the subject.
+  3. This script polls i@m13v.com for unread replies matching that token,
+     extracts the thread_db_id, strips quoted history, INSERTs as a
+     sender='founder' message AND fires Resend to the visitor's email.
+  4. Marks the Gmail message as read so we don't re-ingest.
+
+Usage:
+  python3 ingest_web_chat_replies.py             # ingest and report
+  python3 ingest_web_chat_replies.py --dry-run   # print, no DB writes
+"""
+
+import argparse
+import base64
+import os
+import re
+import subprocess
+import sys
+from email import message_from_bytes
+from email.policy import default as email_default_policy
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from http_api import api_get
+
+from google.auth.transport.requests import Request
+from google.oauth2.credentials import Credentials
+from googleapiclient.discovery import build
+
+GMAIL_TOKEN_PATH = os.path.expanduser("~/gmail-api/token_i_at_m13v.com.json")
+GMAIL_SCOPES = ["https://mail.google.com/"]
+
+WEB_CHAT_ID_RE = re.compile(r"\[WEB-CHAT\s*#(\d+)\]", re.IGNORECASE)
+RE_PREFIX_RE = re.compile(r"^\s*re\s*:", re.IGNORECASE)
+GMAIL_QUERY = 'is:unread subject:"Re: [WEB-CHAT #"'
+
+QUOTE_MARKER_RES = [
+    re.compile(r"^On .{5,200}\s+wrote:\s*$", re.MULTILINE | re.IGNORECASE),
+    re.compile(r"^-{2,}\s*Original Message\s*-{2,}\s*$", re.MULTILINE | re.IGNORECASE),
+    re.compile(r"^From:\s.+<.+>\s*$", re.MULTILINE),
+]
+
+NODE_BIN = os.path.expanduser("~/.nvm/versions/node/v20.19.4/bin/node")
+SEND_REPLY = os.path.expanduser("~/social-autoposter/scripts/send_web_chat_reply.py")
+
+
+def gmail_service():
+    creds = Credentials.from_authorized_user_file(GMAIL_TOKEN_PATH, GMAIL_SCOPES)
+    if creds.expired and creds.refresh_token:
+        creds.refresh(Request())
+        with open(GMAIL_TOKEN_PATH, "w") as f:
+            f.write(creds.to_json())
+    return build("gmail", "v1", credentials=creds)
+
+
+def list_candidates(service):
+    resp = service.users().messages().list(userId="me", q=GMAIL_QUERY, maxResults=50).execute()
+    return resp.get("messages", []) or []
+
+
+def fetch(service, message_id):
+    msg = service.users().messages().get(userId="me", id=message_id, format="raw").execute()
+    raw = base64.urlsafe_b64decode(msg["raw"].encode("ASCII"))
+    return message_from_bytes(raw, policy=email_default_policy)
+
+
+def pick_plain_body(email_msg):
+    if email_msg.is_multipart():
+        text_part = None
+        for part in email_msg.walk():
+            if part.get_content_type() == "text/plain":
+                text_part = part
+                break
+        if text_part is None:
+            for part in email_msg.walk():
+                if part.get_content_type() == "text/html":
+                    text_part = part
+                    break
+        if text_part is None:
+            return ""
+        try:
+            return text_part.get_content()
+        except Exception:
+            return text_part.get_payload(decode=True).decode("utf-8", errors="replace")
+    try:
+        return email_msg.get_content()
+    except Exception:
+        payload = email_msg.get_payload(decode=True)
+        if payload:
+            return payload.decode("utf-8", errors="replace")
+        return email_msg.get_payload() or ""
+
+
+def strip_quoted(body):
+    if not body:
+        return ""
+    earliest = len(body)
+    for pat in QUOTE_MARKER_RES:
+        m = pat.search(body)
+        if m and m.start() < earliest:
+            earliest = m.start()
+    trimmed = body[:earliest]
+    lines = []
+    for line in trimmed.splitlines():
+        if line.lstrip().startswith(">"):
+            break
+        lines.append(line)
+    return "\n".join(lines).strip()
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args()
+
+    try:
+        service = gmail_service()
+    except Exception as e:
+        print(f"FATAL: could not build Gmail service: {e}", file=sys.stderr)
+        sys.exit(2)
+
+    candidates = list_candidates(service)
+    if not candidates:
+        print("no candidate Gmail replies for [WEB-CHAT #...]")
+        return
+
+    ingested = skipped = 0
+    for c in candidates:
+        gmail_id = c["id"]
+        try:
+            email_msg = fetch(service, gmail_id)
+        except Exception as e:
+            print(f"  SKIP {gmail_id}: fetch failed: {e}")
+            skipped += 1
+            continue
+
+        subject = email_msg.get("Subject", "") or ""
+        m = WEB_CHAT_ID_RE.search(subject)
+        if not m:
+            print(f"  SKIP {gmail_id}: no [WEB-CHAT #N] token ({subject!r})")
+            skipped += 1
+            continue
+        if not RE_PREFIX_RE.match(subject):
+            print(f"  SKIP {gmail_id}: not a reply ({subject!r})")
+            skipped += 1
+            continue
+
+        thread_db_id = int(m.group(1))
+        thread_resp = api_get(
+            f"/api/v1/web-chat/thread-by-id/{thread_db_id}", ok_on_404=True
+        )
+        if thread_resp.get("_not_found"):
+            print(f"  SKIP {gmail_id}: thread #{thread_db_id} not found")
+            skipped += 1
+            continue
+        thread = thread_resp.get("data") or {}
+
+        body = pick_plain_body(email_msg)
+        reply_text = strip_quoted(body)
+        if not reply_text:
+            print(f"  SKIP {gmail_id}: empty after stripping quotes")
+            skipped += 1
+            continue
+
+        # Dedup on gmail id (partial unique index in schema, but pre-check anyway).
+        dedup = api_get(
+            "/api/v1/web-chat/gmail-ingested", query={"gmail_id": gmail_id}
+        )
+        already_id = (dedup.get("data") or {}).get("ingested_message_id")
+        if already_id:
+            print(f"  SKIP {gmail_id}: already ingested as msg #{already_id}")
+            skipped += 1
+            try:
+                service.users().messages().modify(
+                    userId="me", id=gmail_id, body={"removeLabelIds": ["UNREAD"]}
+                ).execute()
+            except Exception:
+                pass
+            continue
+
+        print(f"  MATCH {gmail_id}: WEB-CHAT #{thread_db_id} ({thread['project_name']}/{thread['visitor_email']}) reply {reply_text[:80]!r}")
+
+        if args.dry_run:
+            ingested += 1
+            continue
+
+        # Insert as sender='founder' AND fire visitor email via send-email.js
+        # (use send_web_chat_reply.py so the dedup + email logic stays in one place).
+        # Pass --ingested-gmail-id so the reply endpoint stamps it on the
+        # inserted row directly, keeping dedup honest on re-runs.
+        try:
+            subprocess.run(
+                [sys.executable, SEND_REPLY,
+                 "--thread", thread["thread_id"],
+                 "--text", reply_text,
+                 "--name", "matt",
+                 "--sender", "founder",
+                 "--ingested-gmail-id", gmail_id],
+                check=True,
+                timeout=60,
+            )
+        except Exception as e:
+            print(f"  ERROR {gmail_id}: send_web_chat_reply.py failed: {e}")
+            skipped += 1
+            continue
+
+        # Mark gmail as read.
+        try:
+            service.users().messages().modify(
+                userId="me", id=gmail_id, body={"removeLabelIds": ["UNREAD"]}
+            ).execute()
+        except Exception as e:
+            print(f"  WARN {gmail_id}: could not mark read: {e}")
+
+        ingested += 1
+
+    print(f"done. ingested={ingested} skipped={skipped} candidates={len(candidates)}")
+
+
+if __name__ == "__main__":
+    main()

package/scripts/install_fleet.py

@@ -0,0 +1,187 @@
+#!/usr/bin/env python3
+"""Operator fleet report: per-install plugin version + latest resource sample.
+
+Answers the two questions we kept not being able to answer:
+  - which version is each user on?
+  - who is leaking RAM / still lacks the agent-mode-session reaper (<1.6.111)?
+
+Reads the installations table directly via psql + DATABASE_URL from .env (this
+is an operator-box tool, not shipped to customers). app_version and the latest
+resource_sample only populate once a box runs a build that ships them, so rows
+predating this feature show "?" until their next heartbeat on the new build.
+
+Usage:
+    python3 scripts/install_fleet.py              # all installs, newest-seen first
+    python3 scripts/install_fleet.py --active 7   # only seen in the last 7 days
+    python3 scripts/install_fleet.py --leaking    # only rows over the RAM threshold
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+REPO_DIR = Path(__file__).resolve().parents[1]
+REAPER_FIX_VERSION = (1, 6, 111)  # social-autoposter@1.6.111 shipped the leak reaper
+LEAK_RAM_MB = 12000  # our-process RSS over this on a box smells like the session leak
+
+
+def _database_url() -> str:
+    env = REPO_DIR / ".env"
+    if env.exists():
+        for line in env.read_text().splitlines():
+            if line.startswith("DATABASE_URL="):
+                return line.split("=", 1)[1].strip()
+    if os.environ.get("DATABASE_URL"):
+        return os.environ["DATABASE_URL"]
+    sys.exit("DATABASE_URL not found in .env or environment")
+
+
+def _ver_tuple(v: str | None) -> tuple[int, ...] | None:
+    if not v:
+        return None
+    parts = v.strip().lstrip("v").split(".")
+    try:
+        return tuple(int(p) for p in parts[:3])
+    except ValueError:
+        return None
+
+
+def _reaper_flag(v: str | None) -> str:
+    t = _ver_tuple(v)
+    if t is None:
+        return "?(pre-telemetry)"
+    return "ok" if t >= REAPER_FIX_VERSION else "BEHIND<1.6.111"
+
+
+def _fnum(x) -> float | None:
+    try:
+        return float(x)
+    except (TypeError, ValueError):
+        return None
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--active", type=int, default=0, help="only installs seen in the last N days")
+    ap.add_argument("--leaking", action="store_true", help="only rows whose our-process RSS exceeds the leak threshold")
+    ap.add_argument("--json", action="store_true", help="emit raw JSON rows instead of the table")
+    args = ap.parse_args()
+
+    where = ""
+    if args.active > 0:
+        where = f"WHERE last_seen_at > NOW() - interval '{args.active} days'"
+
+    # Tab-separated so we can parse jsonb columns intact (no embedded tabs in our samples).
+    query = f"""
+      SELECT
+        install_id,
+        COALESCE(hostname, '?'),
+        COALESCE(app_version, ''),
+        COALESCE(git_email, '?'),
+        COALESCE(last_city, '?') || '/' || COALESCE(last_country, '?'),
+        EXTRACT(EPOCH FROM (NOW() - last_seen_at))::bigint,
+        request_count,
+        COALESCE(resource_sample::text, ''),
+        COALESCE(EXTRACT(EPOCH FROM (NOW() - resource_sampled_at))::bigint::text, '')
+      FROM installations
+      {where}
+      ORDER BY last_seen_at DESC;
+    """
+
+    out = subprocess.run(
+        ["psql", _database_url(), "-t", "-A", "-F", "\t", "-c", query],
+        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=30,
+    )
+    if out.returncode != 0:
+        sys.exit(f"psql failed: {out.stderr.strip()}")
+
+    rows = []
+    for line in out.stdout.splitlines():
+        if not line.strip():
+            continue
+        cols = line.split("\t")
+        if len(cols) < 9:
+            continue
+        iid, host, appv, email, geo, age_s, reqs, sample_json, sample_age_s = cols[:9]
+        sample = {}
+        if sample_json:
+            try:
+                sample = json.loads(sample_json)
+            except Exception:
+                sample = {}
+        mem = sample.get("mem") or {}
+        groups = sample.get("groups") or {}
+
+        def grp_mb(name: str) -> float | None:
+            g = groups.get(name) or {}
+            return _fnum(g.get("rss_mb"))
+
+        # "our footprint" = the S4L MCP servers + the Claude Desktop sessions that
+        # have our MCP loaded (the bucket Karol saw as "the S4L scheduled task").
+        our_mb = sum(
+            v for v in (
+                grp_mb("social_autoposter_mcp_servers"),
+                grp_mb("sessions_configured_social_autoposter_mcp"),
+            ) if v is not None
+        ) or None
+        claude_grp = groups.get("claude_cli") or {}
+        rows.append({
+            "install_id": iid,
+            "hostname": host,
+            "app_version": appv or None,
+            "reaper": _reaper_flag(appv or None),
+            "git_email": email,
+            "geo": geo,
+            "last_seen_age_h": round(int(age_s) / 3600, 1) if age_s else None,
+            "requests": int(reqs) if reqs.isdigit() else reqs,
+            "mem_used_mb": _fnum(mem.get("used_mb")),
+            "mem_total_mb": _fnum(mem.get("total_mb")),
+            "our_mb": round(our_mb, 1) if our_mb is not None else None,
+            "claude_cli_mb": _fnum(claude_grp.get("rss_mb")),
+            "claude_cli_n": claude_grp.get("count"),
+            "sample_age_min": round(int(sample_age_s) / 60, 1) if sample_age_s else None,
+        })
+
+    if args.leaking:
+        rows = [r for r in rows if (r["our_mb"] or 0) >= LEAK_RAM_MB]
+
+    if args.json:
+        print(json.dumps(rows, indent=2))
+        return 0
+
+    if not rows:
+        print("no installs match")
+        return 0
+
+    hdr = (
+        f"{'hostname':<24} {'ver':<9} {'reaper':<16} {'used/total GB':<14} "
+        f"{'ourGB':<7} {'claude(n)':<11} {'seen':<8} {'sample':<8} email"
+    )
+    print(hdr)
+    print("-" * len(hdr))
+    for r in rows:
+        used = r["mem_used_mb"]
+        total = r["mem_total_mb"]
+        used_total = f"{used/1024:.1f}/{total/1024:.0f}" if used and total else "?"
+        our = f"{r['our_mb']/1024:.1f}" if r["our_mb"] else "?"
+        claude = (
+            f"{r['claude_cli_mb']/1024:.1f}({r['claude_cli_n']})"
+            if r["claude_cli_mb"] is not None else "?"
+        )
+        seen = f"{r['last_seen_age_h']}h" if r["last_seen_age_h"] is not None else "?"
+        sample = f"{r['sample_age_min']}m" if r["sample_age_min"] is not None else "none"
+        print(
+            f"{r['hostname'][:24]:<24} {(r['app_version'] or '?'):<9} {r['reaper']:<16} "
+            f"{used_total:<14} {our:<7} {claude:<11} {seen:<8} {sample:<8} {r['git_email']}"
+        )
+    print(f"\n{len(rows)} install(s). 'reaper=BEHIND' lacks the 1.6.111 session-leak fix; "
+          f"'?' = hasn't heartbeat'd on a telemetry-capable build yet.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())