@pi-harness/pi-harness 0.1.13 → 0.1.14

package/packages/client-web/src/at-file-view.ts

@@ -0,0 +1,69 @@
+export interface AtFilePanelView {
+  readonly lastFile: { readonly path: string; readonly bytes: number } | null;
+  readonly maxBytes: number;
+  readonly truncated: boolean;
+}
+
+const limits = {
+  fileBytes: 256 * 1024,
+  pathCharacters: 512,
+  pathBytes: 512,
+};
+
+function ownDataRecord(value: unknown): Record<string, unknown> | undefined {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+    const prototype = Object.getPrototypeOf(value) as unknown;
+    if (prototype !== Object.prototype && prototype !== null) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string")) return undefined;
+    const output = Object.create(null) as Record<string, unknown>;
+    for (const [key, descriptor] of Object.entries(descriptors)) {
+      if (!("value" in descriptor)) return undefined;
+      output[key] = descriptor.value;
+    }
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function hasOnlyKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
+  const keys = new Set(expected);
+  return Object.keys(value).every((key) => keys.has(key));
+}
+
+function cleanedPath(value: unknown): { value: string | undefined; altered: boolean } {
+  if (typeof value !== "string") return { value: undefined, altered: true };
+  const sanitized = value.replaceAll(/[\p{Cc}\p{Cf}\p{Cs}]+/gu, " ").trim();
+  const codePoints = [...sanitized];
+  const cleaned = codePoints.length > limits.pathCharacters ? codePoints.slice(0, limits.pathCharacters).join("") : sanitized;
+  if (cleaned === "" || new TextEncoder().encode(cleaned).byteLength > limits.pathBytes) return { value: undefined, altered: true };
+  return { value: cleaned, altered: cleaned !== value };
+}
+
+export function atFilePanelView(data: unknown): AtFilePanelView {
+  const source = ownDataRecord(data);
+  const lastFileSource = source?.lastFile === null ? null : ownDataRecord(source?.lastFile);
+  const path = lastFileSource === null ? undefined : cleanedPath(lastFileSource?.path);
+  const bytes = lastFileSource === null ? undefined : lastFileSource?.bytes;
+  const lastFileValid =
+    lastFileSource === null ||
+    (lastFileSource !== undefined &&
+      path?.value !== undefined &&
+      typeof bytes === "number" &&
+      Number.isSafeInteger(bytes) &&
+      bytes >= 0 &&
+      bytes <= limits.fileBytes &&
+      hasOnlyKeys(lastFileSource, ["path", "bytes"]));
+  return {
+    lastFile: lastFileValid && lastFileSource !== null && path?.value !== undefined && typeof bytes === "number" ? { path: path.value, bytes } : null,
+    maxBytes: limits.fileBytes,
+    truncated:
+      source === undefined ||
+      !hasOnlyKeys(source, ["lastFile", "maxBytes"]) ||
+      source.maxBytes !== limits.fileBytes ||
+      !lastFileValid ||
+      path?.altered === true,
+  };
+}

package/packages/client-web/src/browser-fetch-view.ts

@@ -0,0 +1,114 @@
+export interface BrowserFetchPanelView {
+  readonly latest: {
+    readonly url: string;
+    readonly finalUrl: string;
+    readonly status: number;
+    readonly contentType: string;
+    readonly bytes: number;
+    readonly truncated: boolean;
+    readonly previewTruncated: boolean;
+    readonly text: string;
+  } | null;
+  readonly allowPrivate: boolean;
+  readonly limits: { readonly responseBytes: number; readonly panelTextChars: number; readonly redirects: number; readonly timeoutMs: number };
+  readonly malformed: boolean;
+}
+
+const defaults = {
+  responseBytes: 512 * 1024,
+  panelTextChars: 12_000,
+  redirects: 3,
+  timeoutMs: 20_000,
+} as const;
+const rootKeys = new Set(["latest", "allowPrivate", "maxResponseBytes", "maxPanelTextChars", "maxRedirects", "timeoutMs"]);
+const latestKeys = new Set(["url", "finalUrl", "status", "contentType", "bytes", "truncated", "previewTruncated", "text"]);
+const unsafeUnicode = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
+
+function ownDataRecord(value: unknown, allowed: ReadonlySet<string>): Record<string, unknown> | undefined {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+    const prototype = Object.getPrototypeOf(value) as unknown;
+    if (prototype !== Object.prototype && prototype !== null) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string" || !allowed.has(key))) return undefined;
+    const output = Object.create(null) as Record<string, unknown>;
+    for (const [key, descriptor] of Object.entries(descriptors)) {
+      if (!("value" in descriptor)) return undefined;
+      output[key] = descriptor.value;
+    }
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function exact(source: Record<string, unknown>, keys: ReadonlySet<string>): boolean {
+  const own = Object.keys(source);
+  return own.length === keys.size && own.every((key) => keys.has(key));
+}
+
+function boundedText(value: unknown, maximum: number, allowEmpty = false): string | undefined {
+  if (typeof value !== "string" || (!allowEmpty && value.length === 0) || unsafeUnicode.test(value)) return undefined;
+  if ([...value].length > maximum || new TextEncoder().encode(value).byteLength > maximum) return undefined;
+  return value;
+}
+
+function integer(value: unknown, minimum: number, maximum: number): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= minimum && value <= maximum ? value : undefined;
+}
+
+function limitsView(source: Record<string, unknown>): BrowserFetchPanelView["limits"] | undefined {
+  const responseBytes = integer(source.maxResponseBytes, 1, defaults.responseBytes);
+  const panelTextChars = integer(source.maxPanelTextChars, 1, defaults.panelTextChars);
+  const redirects = integer(source.maxRedirects, 0, 10);
+  const timeoutMs = integer(source.timeoutMs, 100, 60_000);
+  if (responseBytes === undefined || panelTextChars === undefined || redirects === undefined || timeoutMs === undefined) return undefined;
+  return { responseBytes, panelTextChars, redirects, timeoutMs };
+}
+
+function latestView(value: unknown, limits: BrowserFetchPanelView["limits"]): BrowserFetchPanelView["latest"] | undefined {
+  if (value === null) return null;
+  const source = ownDataRecord(value, latestKeys);
+  if (source === undefined || !exact(source, latestKeys)) return undefined;
+  const url = boundedText(source.url, 4_096);
+  const finalUrl = boundedText(source.finalUrl, 4_096);
+  const contentType = boundedText(source.contentType, 256);
+  const text = boundedText(source.text, defaults.responseBytes, true);
+  const status = integer(source.status, 100, 599);
+  const bytes = integer(source.bytes, 0, limits.responseBytes);
+  if (
+    url === undefined ||
+    finalUrl === undefined ||
+    contentType === undefined ||
+    text === undefined ||
+    status === undefined ||
+    bytes === undefined ||
+    typeof source.truncated !== "boolean" ||
+    typeof source.previewTruncated !== "boolean"
+  )
+    return undefined;
+  const displayed = [...text].slice(0, limits.panelTextChars).join("");
+  return {
+    url,
+    finalUrl,
+    status,
+    contentType,
+    bytes,
+    truncated: source.truncated,
+    previewTruncated: source.previewTruncated || text.length > limits.panelTextChars,
+    text: displayed,
+  };
+}
+
+function malformedView(): BrowserFetchPanelView {
+  return { latest: null, allowPrivate: false, limits: { ...defaults }, malformed: true };
+}
+
+export function browserFetchPanelView(data: unknown): BrowserFetchPanelView {
+  const source = ownDataRecord(data, rootKeys);
+  if (source === undefined || !exact(source, rootKeys) || typeof source.allowPrivate !== "boolean") return malformedView();
+  const limits = limitsView(source);
+  if (limits === undefined) return malformedView();
+  const latest = latestView(source.latest, limits);
+  return latest === undefined ? malformedView() : { latest, allowPrivate: source.allowPrivate, limits, malformed: false };
+}

package/packages/client-web/src/browser-session-view.ts

@@ -1,13 +1,232 @@
+const visibleTabs = 8;
+const maximumTabInventory = 256;
+const defaults = {
+  tabs: 20,
+  textPreviewCharacters: 12_000,
+  errorCharacters: 2_000,
+} as const;
+const rootKeys = new Set(["endpoint", "connected", "error", "tabs", "inventory", "limits", "latest"]);
+const tabKeys = new Set(["targetId", "title", "url"]);
+const inventoryKeys = new Set(["total", "shown", "truncated"]);
+const limitsKeys = new Set(["tabs", "textPreviewCharacters", "errorCharacters"]);
+const latestKeys = new Set(["targetId", "title", "url", "status", "truncated", "previewTruncated", "text", "clicked", "screenshot"]);
+const screenshotKeys = new Set(["bytes", "mimeType"]);
+const unsafeUnicode = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
+
 export interface BrowserSessionTab {
   readonly targetId: string;
   readonly title: string;
   readonly url: string;
 }
 
+function ownDataRecord(value: unknown, allowed: ReadonlySet<string>): Record<string, unknown> | undefined {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+    const prototype = Object.getPrototypeOf(value) as unknown;
+    if (prototype !== Object.prototype && prototype !== null) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string" || !allowed.has(key))) return undefined;
+    const output = Object.create(null) as Record<string, unknown>;
+    for (const [key, descriptor] of Object.entries(descriptors)) {
+      if (!("value" in descriptor)) return undefined;
+      output[key] = descriptor.value;
+    }
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function exact(source: Record<string, unknown>, keys: ReadonlySet<string>): boolean {
+  const own = Object.keys(source);
+  return own.length === keys.size && own.every((key) => keys.has(key));
+}
+
+function ownDataArray(value: unknown, maximum: number): unknown[] | undefined {
+  try {
+    if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value) as unknown as PropertyDescriptorMap;
+    const lengthDescriptor = descriptors.length;
+    const length: unknown = lengthDescriptor !== undefined && "value" in lengthDescriptor ? lengthDescriptor.value : undefined;
+    if (!Number.isSafeInteger(length) || (length as number) < 0 || (length as number) > maximum) return undefined;
+    if (
+      Reflect.ownKeys(descriptors).some(
+        (key) => key !== "length" && (typeof key !== "string" || !/^\d+$/u.test(key) || Number(key) >= (length as number) || String(Number(key)) !== key),
+      ) ||
+      Object.values(descriptors).some((descriptor) => !("value" in descriptor))
+    )
+      return undefined;
+    const output: unknown[] = [];
+    for (let index = 0; index < (length as number); index += 1) {
+      const descriptor = descriptors[String(index)];
+      if (descriptor === undefined || !("value" in descriptor)) return undefined;
+      output.push(descriptor.value);
+    }
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function safeText(value: unknown, maximum: number, allowEmpty = true): string | undefined {
+  if (typeof value !== "string" || (!allowEmpty && value.length === 0) || unsafeUnicode.test(value)) return undefined;
+  if ([...value].length > maximum || new TextEncoder().encode(value).byteLength > maximum) return undefined;
+  return value;
+}
+
+function integer(value: unknown, minimum: number, maximum: number): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= minimum && value <= maximum ? value : undefined;
+}
+
+function display(value: string, maximum: number): string {
+  return [...value].slice(0, maximum).join("");
+}
+
+function tabView(value: unknown): BrowserSessionTab | undefined {
+  const source = ownDataRecord(value, tabKeys);
+  if (source === undefined || !exact(source, tabKeys)) return undefined;
+  const targetId = safeText(source.targetId, 512, false);
+  const title = safeText(source.title, 4_096);
+  const url = safeText(source.url, 8_192);
+  return targetId === undefined || title === undefined || url === undefined ? undefined : { targetId, title, url };
+}
+
 export function browserSessionTabs(entries: readonly BrowserSessionTab[], limit: number): readonly BrowserSessionTab[] {
   const normalizedLimit = Math.max(0, Math.min(20, Math.trunc(limit)));
   return entries
-    .filter((entry) => entry.targetId.trim() !== "" && entry.url.trim() !== "")
-    .slice(0, normalizedLimit)
-    .map((entry) => ({ targetId: entry.targetId, title: entry.title || "未命名页面", url: entry.url }));
+    .slice(0, 32)
+    .map(tabView)
+    .filter((entry): entry is BrowserSessionTab => entry !== undefined)
+    .slice(0, normalizedLimit);
+}
+
+function screenshotView(value: unknown): { bytes: number; mimeType: string } | undefined {
+  const source = ownDataRecord(value, screenshotKeys);
+  if (source === undefined || !exact(source, screenshotKeys) || source.mimeType !== "image/png") return undefined;
+  const bytes = integer(source.bytes, 0, 8 * 1024 * 1024);
+  return bytes === undefined ? undefined : { bytes, mimeType: "image/png" };
+}
+
+function limitsView(value: unknown): BrowserSessionPanelView["limits"] | undefined {
+  const source = ownDataRecord(value, limitsKeys);
+  if (source === undefined || !exact(source, limitsKeys)) return undefined;
+  const tabs = integer(source.tabs, 1, defaults.tabs);
+  const textPreviewCharacters = integer(source.textPreviewCharacters, 1, defaults.textPreviewCharacters);
+  const errorCharacters = integer(source.errorCharacters, 1, defaults.errorCharacters);
+  return tabs === undefined || textPreviewCharacters === undefined || errorCharacters === undefined
+    ? undefined
+    : { tabs, textPreviewCharacters, errorCharacters };
+}
+
+function latestView(value: unknown, limits: BrowserSessionPanelView["limits"]): BrowserSessionPanelView["latest"] | undefined {
+  if (value === null) return null;
+  const source = ownDataRecord(value, latestKeys);
+  if (source === undefined || ![...Object.keys(source)].every((key) => latestKeys.has(key))) return undefined;
+  const targetId = safeText(source.targetId, 512, false);
+  const title = safeText(source.title, 4_096);
+  const url = safeText(source.url, 8_192);
+  if (targetId === undefined || title === undefined || url === undefined) return undefined;
+  if (source.status !== undefined && safeText(source.status, 64, false) === undefined) return undefined;
+  if (source.truncated !== undefined && typeof source.truncated !== "boolean") return undefined;
+  if (source.previewTruncated !== undefined && typeof source.previewTruncated !== "boolean") return undefined;
+  if (source.clicked !== undefined && typeof source.clicked !== "boolean") return undefined;
+  const rawText = source.text === undefined ? undefined : safeText(source.text, 128 * 1024, true);
+  if (source.text !== undefined && rawText === undefined) return undefined;
+  const screenshot = source.screenshot === undefined ? undefined : screenshotView(source.screenshot);
+  if (source.screenshot !== undefined && screenshot === undefined) return undefined;
+  const text = rawText === undefined ? undefined : display(rawText, limits.textPreviewCharacters);
+  return {
+    targetId,
+    title: display(title, 4_096),
+    url: display(url, 8_192),
+    ...(source.status === undefined ? {} : { status: display(source.status as string, 64) }),
+    truncated: source.truncated === true,
+    previewTruncated: source.previewTruncated === true || (rawText !== undefined && rawText.length > limits.textPreviewCharacters),
+    ...(text === undefined ? {} : { text }),
+    clicked: source.clicked === true,
+    ...(screenshot === undefined ? {} : { screenshot }),
+  };
+}
+
+export interface BrowserSessionPanelView {
+  readonly endpoint: string;
+  readonly connected: boolean;
+  readonly error: string | null;
+  readonly tabs: readonly BrowserSessionTab[];
+  readonly inventory: { readonly total: number; readonly shown: number; readonly truncated: boolean };
+  readonly limits: { readonly tabs: number; readonly textPreviewCharacters: number; readonly errorCharacters: number };
+  readonly latest: {
+    readonly targetId: string;
+    readonly title: string;
+    readonly url: string;
+    readonly status?: string;
+    readonly truncated: boolean;
+    readonly previewTruncated: boolean;
+    readonly text?: string;
+    readonly clicked: boolean;
+    readonly screenshot?: { readonly bytes: number; readonly mimeType: string };
+  } | null;
+  readonly malformed: boolean;
+}
+
+function malformedView(): BrowserSessionPanelView {
+  return {
+    endpoint: "",
+    connected: false,
+    error: "Panel data unavailable",
+    tabs: [],
+    inventory: { total: 0, shown: 0, truncated: false },
+    limits: defaults,
+    latest: null,
+    malformed: true,
+  };
+}
+
+export function browserSessionPanelView(data: unknown): BrowserSessionPanelView {
+  const source = ownDataRecord(data, rootKeys);
+  if (source === undefined || !exact(source, rootKeys) || typeof source.connected !== "boolean") return malformedView();
+  const endpoint = safeText(source.endpoint, 2_048, false);
+  const error = source.error === null ? null : safeText(source.error, defaults.errorCharacters, true);
+  const limits = limitsView(source.limits);
+  const rawTabs = ownDataArray(source.tabs, maximumTabInventory);
+  const inventory = ownDataRecord(source.inventory, inventoryKeys);
+  if (
+    endpoint === undefined ||
+    error === undefined ||
+    limits === undefined ||
+    rawTabs === undefined ||
+    inventory === undefined ||
+    !exact(inventory, inventoryKeys)
+  )
+    return malformedView();
+  const tabs: BrowserSessionTab[] = [];
+  for (const raw of rawTabs) {
+    const tab = tabView(raw);
+    if (tab === undefined) return malformedView();
+    tabs.push(tab);
+  }
+  const total = integer(inventory.total, tabs.length, maximumTabInventory);
+  const shown = integer(inventory.shown, 0, limits.tabs);
+  if (
+    total === undefined ||
+    shown === undefined ||
+    shown !== tabs.length ||
+    tabs.length > limits.tabs ||
+    typeof inventory.truncated !== "boolean" ||
+    total < shown
+  )
+    return malformedView();
+  const latest = latestView(source.latest, limits);
+  if (latest === undefined) return malformedView();
+  const visible = tabs.slice(0, visibleTabs);
+  return {
+    endpoint,
+    connected: source.connected,
+    error,
+    tabs: visible,
+    inventory: { total, shown: visible.length, truncated: inventory.truncated || total > shown || tabs.length > visible.length },
+    limits,
+    latest,
+    malformed: false,
+  };
 }

package/packages/client-web/src/cleaner-view.ts

@@ -0,0 +1,207 @@
+export type CleanerActivityStatus = "running" | "completed" | "failed" | "cancelled";
+
+export interface CleanerPanelView {
+  readonly capsules: ReadonlyArray<{ readonly name: string; readonly bytes: number }>;
+  readonly totalBytes: number | null;
+  readonly inventory: { readonly total: number; readonly shown: number; readonly truncated: boolean; readonly displayLimit: number } | null;
+  readonly lastCleanup: {
+    readonly status: CleanerActivityStatus;
+    readonly at: string;
+    readonly requestedKeep: number;
+    readonly removed: number;
+    readonly kept: number | null;
+    readonly error: string | null;
+  } | null;
+  readonly malformed: boolean;
+  readonly limits: { readonly capsules: 256; readonly directoryEntries: 4_096 };
+}
+
+const visibleCapsules = 12;
+const maxCapsuleNameLength = 255;
+const maxActivityErrorLength = 2_000;
+const visibleActivityErrorLength = 500;
+const defaults = { capsules: 256, directoryEntries: 4_096, displayLimit: 20 } as const;
+const rootKeys = new Set(["capsules", "inventory", "lastCleanup", "lastRemoved", "limits"]);
+const capsuleKeys = new Set(["name", "bytes"]);
+const inventoryKeys = new Set(["total", "shown", "truncated", "displayLimit"]);
+const activityKeys = new Set(["status", "at", "requestedKeep", "removed", "kept", "error"]);
+const limitKeys = new Set(["capsules", "directoryEntries"]);
+const unsafeUnicode = /[\p{Cc}\p{Cf}\p{Cs}\u2028\u2029]/u;
+
+function ownDataRecord(value: unknown, allowed: ReadonlySet<string>): Record<string, unknown> | undefined {
+  try {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) return undefined;
+    const prototype = Object.getPrototypeOf(value) as unknown;
+    if (prototype !== Object.prototype && prototype !== null) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (Reflect.ownKeys(descriptors).some((key) => typeof key !== "string" || !allowed.has(key))) return undefined;
+    const output = Object.create(null) as Record<string, unknown>;
+    for (const [key, descriptor] of Object.entries(descriptors)) {
+      if (!("value" in descriptor)) return undefined;
+      output[key] = descriptor.value;
+    }
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function hasExactly(source: Record<string, unknown>, keys: ReadonlySet<string>): boolean {
+  const own = Object.keys(source);
+  return own.length === keys.size && own.every((key) => keys.has(key));
+}
+
+function safeInteger(value: unknown, maximum: number): number | undefined {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : undefined;
+}
+
+function safeText(value: unknown, maximum: number): string | undefined {
+  if (typeof value !== "string" || value.length === 0 || value !== value.trim() || unsafeUnicode.test(value)) return undefined;
+  if ([...value].length > maximum || new TextEncoder().encode(value).byteLength > maximum) return undefined;
+  return value;
+}
+
+function timestamp(value: unknown): string | undefined {
+  if (typeof value !== "string" || value.length > 64) return undefined;
+  const milliseconds = Date.parse(value);
+  if (!Number.isFinite(milliseconds)) return undefined;
+  try {
+    return new Date(milliseconds).toISOString() === value ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function capsuleName(value: unknown): string | undefined {
+  const name = safeText(value, maxCapsuleNameLength);
+  return name?.endsWith(".patch") === true && !name.includes("/") && !name.includes("\\") ? name : undefined;
+}
+
+function capsule(value: unknown): { name: string; bytes: number } | undefined {
+  const source = ownDataRecord(value, capsuleKeys);
+  if (source === undefined || !hasExactly(source, capsuleKeys)) return undefined;
+  const name = capsuleName(source.name);
+  const bytes = safeInteger(source.bytes, Number.MAX_SAFE_INTEGER);
+  return name === undefined || bytes === undefined ? undefined : { name, bytes };
+}
+
+function capsuleArray(value: unknown): Array<{ name: string; bytes: number }> | undefined {
+  try {
+    if (!Array.isArray(value) || Object.getPrototypeOf(value) !== Array.prototype) return undefined;
+    const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+    const length: unknown = lengthDescriptor !== undefined && "value" in lengthDescriptor ? lengthDescriptor.value : undefined;
+    if (!Number.isSafeInteger(length) || (length as number) < 0 || (length as number) > defaults.displayLimit) return undefined;
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    if (
+      Reflect.ownKeys(descriptors).some(
+        (key) => key !== "length" && (typeof key !== "string" || !/^\d+$/u.test(key) || Number(key) >= (length as number) || String(Number(key)) !== key),
+      ) ||
+      Object.values(descriptors).some((descriptor) => !("value" in descriptor))
+    )
+      return undefined;
+    const output: Array<{ name: string; bytes: number }> = [];
+    for (let index = 0; index < (length as number); index += 1) {
+      const descriptor = descriptors[String(index)];
+      const item = capsule(descriptor !== undefined && "value" in descriptor ? descriptor.value : undefined);
+      if (item === undefined) return undefined;
+      output.push(item);
+    }
+    if (new Set(output.map((item) => item.name)).size !== output.length) return undefined;
+    return output;
+  } catch {
+    return undefined;
+  }
+}
+
+function inventoryView(value: unknown, capsuleCount: number): { total: number; shown: number; truncated: boolean; displayLimit: number } | undefined {
+  const source = ownDataRecord(value, inventoryKeys);
+  if (source === undefined || !hasExactly(source, inventoryKeys)) return undefined;
+  const total = safeInteger(source.total, defaults.capsules);
+  const shown = safeInteger(source.shown, defaults.displayLimit);
+  if (
+    total === undefined ||
+    shown === undefined ||
+    shown !== capsuleCount ||
+    shown > total ||
+    source.displayLimit !== defaults.displayLimit ||
+    typeof source.truncated !== "boolean" ||
+    source.truncated !== total > shown
+  )
+    return undefined;
+  return { total, shown, truncated: source.truncated, displayLimit: defaults.displayLimit };
+}
+
+function activityView(value: unknown): CleanerPanelView["lastCleanup"] | undefined {
+  const source = ownDataRecord(value, activityKeys);
+  if (source === undefined) return undefined;
+  const status = source.status;
+  const at = timestamp(source.at);
+  const requestedKeep = safeInteger(source.requestedKeep, defaults.capsules);
+  const removed = safeInteger(source.removed, defaults.capsules);
+  if (
+    (status !== "running" && status !== "completed" && status !== "failed" && status !== "cancelled") ||
+    at === undefined ||
+    requestedKeep === undefined ||
+    removed === undefined
+  )
+    return undefined;
+  const baseKeys = new Set(["status", "at", "requestedKeep", "removed"]);
+  if (status === "running" && hasExactly(source, baseKeys)) return { status, at, requestedKeep, removed, kept: null, error: null };
+  if (status === "completed" && hasExactly(source, new Set([...baseKeys, "kept"]))) {
+    const kept = safeInteger(source.kept, defaults.capsules);
+    return kept === undefined ? undefined : { status, at, requestedKeep, removed, kept, error: null };
+  }
+  if ((status === "failed" || status === "cancelled") && hasExactly(source, new Set([...baseKeys, "error"]))) {
+    const error = safeText(source.error, maxActivityErrorLength);
+    return error === undefined
+      ? undefined
+      : { status, at, requestedKeep, removed, kept: null, error: [...error].slice(0, visibleActivityErrorLength).join("") };
+  }
+  return undefined;
+}
+
+function validLimits(value: unknown): boolean {
+  const source = ownDataRecord(value, limitKeys);
+  return (
+    source !== undefined && hasExactly(source, limitKeys) && source.capsules === defaults.capsules && source.directoryEntries === defaults.directoryEntries
+  );
+}
+
+function malformedView(): CleanerPanelView {
+  return {
+    capsules: [],
+    totalBytes: null,
+    inventory: null,
+    lastCleanup: null,
+    malformed: true,
+    limits: { capsules: defaults.capsules, directoryEntries: defaults.directoryEntries },
+  };
+}
+
+export function cleanerPanelView(data: unknown): CleanerPanelView {
+  const source = ownDataRecord(data, rootKeys);
+  if (source === undefined || !hasExactly(source, rootKeys) || !validLimits(source.limits)) return malformedView();
+  const capsules = capsuleArray(source.capsules);
+  if (capsules === undefined) return malformedView();
+  const inventory = inventoryView(source.inventory, capsules.length);
+  const lastRemoved = safeInteger(source.lastRemoved, defaults.capsules);
+  if (inventory === undefined || lastRemoved === undefined) return malformedView();
+  const lastCleanup = source.lastCleanup === null ? null : activityView(source.lastCleanup);
+  if (lastCleanup === undefined || (lastCleanup === null ? lastRemoved !== 0 : lastCleanup.removed !== lastRemoved)) return malformedView();
+  const visible = capsules.slice(0, visibleCapsules);
+  const totalBytes = visible.reduce((sum, item) => sum + item.bytes, 0);
+  if (!Number.isSafeInteger(totalBytes)) return malformedView();
+  return {
+    capsules: visible,
+    totalBytes,
+    inventory: {
+      total: inventory.total,
+      shown: visible.length,
+      truncated: inventory.truncated || capsules.length > visible.length,
+      displayLimit: inventory.displayLimit,
+    },
+    lastCleanup,
+    malformed: false,
+    limits: { capsules: defaults.capsules, directoryEntries: defaults.directoryEntries },
+  };
+}