@rosthq/cli 0.7.95 → 0.7.97

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAoR3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAsR3D,CAAC"}

package/dist/index.js

@@ -41569,6 +41569,7 @@ var compassImportOutputSchema = external_exports.object({
   citations: external_exports.number().int().nonnegative()
 }).strict();
 var goalStatusSchema = external_exports.enum(["on", "off", "done", "dropped"]);
+var goalStatusSourceSchema = external_exports.enum(["human", "agent", "rollup", "signal"]);
 var goalListInputSchema = external_exports.object({
   cycle_id: uuidSchema9.optional(),
   seat_id: uuidSchema9.optional()
@@ -41584,7 +41585,7 @@ var goalSummarySchema = external_exports.object({
   parent_goal_id: uuidSchema9.nullable(),
   title: external_exports.string(),
   status: goalStatusSchema,
-  status_source: external_exports.enum(["human", "agent", "rollup"])
+  status_source: goalStatusSourceSchema
 }).strict();
 var goalListOutputSchema = external_exports.object({
   goals: external_exports.array(goalSummarySchema)
@@ -41604,7 +41605,7 @@ var goalMutationOutputSchema = external_exports.object({
   parent_goal_id: uuidSchema9.nullable(),
   title: external_exports.string(),
   status: goalStatusSchema,
-  status_source: external_exports.enum(["human", "agent", "rollup"])
+  status_source: goalStatusSourceSchema
 }).strict();
 var goalUpdateInputSchema = external_exports.object({
   goal_id: uuidSchema9,
@@ -41655,7 +41656,6 @@ var goalListAtRiskOutputSchema = external_exports.object({
   goals: external_exports.array(goalAtRiskSchema)
 }).strict();
 var goalSignalStateSchema = external_exports.enum(["ok", "risk", "crit", "pending"]);
-var goalStatusSourceSchema = external_exports.enum(["human", "agent", "rollup", "signal"]);
 var goalMeasurableRoleSchema = external_exports.enum(["drives_status", "informs"]);
 var goalDriverAnchorSchema = external_exports.object({
   // The closed period being anchored on (an ISO date / period label — free-form so a
@@ -42746,6 +42746,20 @@ var confirmationSummarySchema = external_exports.object({
 var confirmationListOutputSchema = external_exports.object({
   confirmations: external_exports.array(confirmationSummarySchema)
 }).strict();
+var confirmationDismissInputSchema = external_exports.object({
+  confirmation_id: uuidSchema11
+}).strict();
+var confirmationDismissOutputSchema = external_exports.object({
+  dismissed: external_exports.object({
+    id: uuidSchema11,
+    status: external_exports.literal("dismissed")
+  }).strict()
+}).strict();
+var confirmationDismissStaleInputSchema = external_exports.object({}).strict();
+var confirmationDismissStaleOutputSchema = external_exports.object({
+  dismissed_count: external_exports.number().int().min(0),
+  dismissed_ids: external_exports.array(uuidSchema11)
+}).strict();
 var credentialIngressInputSchema = external_exports.object({
   seat_id: uuidSchema11.optional(),
   provider: external_exports.string().trim().min(1),
@@ -43438,7 +43452,11 @@ var fleetDigestAgentSchema = fleetOverviewRowSchema.extend({
   spend_7d_usd: external_exports.string(),
   spend_30d_usd: external_exports.string(),
   cost_drift_percent: external_exports.number().int().nullable(),
-  health_status: external_exports.enum(["needs_review", "stale", "setup_gap", "awaiting_data", "awaiting_data_overdue", "healthy"]),
+  // DER-1905: "idle" added — cadence-aware grading now distinguishes an
+  // on-demand agent with nothing pending (idle, neutral) from a scheduled
+  // agent that missed its cron (stale, alarming). Purely additive to this
+  // enum; no other field on this schema changed.
+  health_status: external_exports.enum(["needs_review", "stale", "idle", "setup_gap", "awaiting_data", "awaiting_data_overdue", "healthy"]),
   health_reasons: external_exports.array(external_exports.string()),
   recent_failed_runs: external_exports.array(fleetDigestRunSchema),
   unresolved_errors: external_exports.array(fleetDigestErrorSchema),
@@ -43509,8 +43527,11 @@ var seatRunDetailSchema = seatRunSchema.extend({
   task_id: uuidSchema14.nullable(),
   work_order_id: uuidSchema14.nullable(),
   transcript_ref: external_exports.string(),
-  input_tokens: external_exports.number().int().nonnegative(),
-  output_tokens: external_exports.number().int().nonnegative(),
+  // DER-1913: null = usage UNKNOWN — a Codex / read-status / timeout / spawn-error
+  // runner turn reports no model-usage envelope, so the run records no token count.
+  // Never coerced to a fabricated 0; surfaces (CLI/MCP/UI) render it as unknown.
+  input_tokens: external_exports.number().int().nonnegative().nullable(),
+  output_tokens: external_exports.number().int().nonnegative().nullable(),
   outcome: external_exports.record(external_exports.string(), external_exports.unknown()),
   error_logs: external_exports.array(seatRunErrorLogSchema),
   skill_activations: external_exports.array(external_exports.object({
@@ -50113,11 +50134,11 @@ Keep agent scope tight at first. Approve more autonomy only after evidence. Use
     order: 71,
     title: "Confirmations and human gates guide",
     summary: "How {{brand}} routes authority-changing work through human confirmation, and why agents never approve their own requests.",
-    version: "2026-07-15.2",
+    version: "2026-07-17.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "charter_design", "staffing", "operating_rhythm"],
-    relatedCommandIds: ["confirmation.approve", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve", "task.confirm_proposal", "task.decline_proposal"],
+    relatedCommandIds: ["confirmation.approve", "confirmation.dismiss", "confirmation.dismiss_stale", "confirmation.list", "confirmation.reject", "confirmation.remint", "charter.approve", "agent.go_live", "credential.ingress", "mcp_token.create", "staffing.assign_user", "goal.reparent", "friction.resolve", "task.confirm_proposal", "task.decline_proposal"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native human-gate guidance."] },
     sources: [
       {
@@ -50165,6 +50186,10 @@ A held tool call actuates the same way regardless of which command backs it \u20
 
 The \`/approvals\` page is one place a human clears every pending decision across the company. It unions still-pending confirmations, open steward escalations, and agent-proposed draft tasks into a single queue, each item shown with its risk or proposal type, the source or proposing seat, and redacted arguments \u2014 secret material is never displayed. You see only items for seats you have authority over: an owner sees all of them; a member sees confirmations for the seats they occupy, escalations routed to their steward chain, and task proposals where they occupy or steward the target seat. Confirming a task proposal runs \`task.confirm_proposal\` and moves the draft to Offered; declining runs \`task.decline_proposal\` and records a human reason. Neither action accepts the task, schedules a run, or executes agent work. Approve and reject route through the same \`confirmation.approve\` / \`confirmation.reject\` and escalation decision commands the CLI and per-seat surfaces use, so the audit trail and the agents-recommend-humans-decide rule are identical wherever you act. The queue also unions pending Forge software-credential requests (owner-scoped, read-only, deep-linking to \`/forge\`) \u2014 it surfaces the ask and links to the vault-backed fulfillment flow, never collecting the secret itself. A confirmation that fails on approval shows the actual execution error inline as a \`failed\` card instead of a dead generic banner, and its Retry re-runs \`confirmation.approve\` against current state; re-minting the same request supersedes the older card instead of leaving a duplicate behind.
 
+## Clearing expired confirmations
+
+A confirmation that expires before a human acts on it is dead \u2014 it can no longer be approved. Re-mint revives one; dismiss is the opposite gesture for a card you do *not* want to revive. \`confirmation.dismiss\` clears one obsolete expired card from the queue, and \`confirmation.dismiss_stale\` clears every currently-expired card in your authority scope at once (bulk "dismiss all stale"). Dismiss is human-only queue hygiene: it never re-executes the original command and never records a decision \u2014 it just marks the dead card \`dismissed\`, notes who dismissed it, and writes an audit event for each row (\`dismiss_stale\` writes one per card). Only an already-expired card is dismissable; a still-live pending confirmation is refused, because its decision is approve or reject, not dismiss. You can only dismiss cards you already have authority over \u2014 an owner over any, a member over the seats they occupy.
+
 ## The rule for agents
 
 An agent never approves or rejects its own request. \`decisions.decided_by\` is always a human. The steward decision commands (\`escalation.resolve\`, \`escalation.reject\`) and proposal decision commands (\`task.confirm_proposal\`, \`task.decline_proposal\`) are not exposed over MCP. When an agent hits a gate, it prepares the evidence and the recommended action, returns the approve link, and waits for a human. Draft task proposals follow the same rule: the agent can propose the commitment, but a target-side human confirms or declines it unless a bounded Trusted grant applies.
@@ -52525,6 +52550,8 @@ var COMMAND_MANIFEST = [
   { "id": "compass.show_markdown", "namespace": "compass", "action": "show_markdown", "title": "Show Compass as markdown", "description": "Compose the current Compass and its open gaps into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Render the current Compass and its open gaps as a clean markdown card to show your human a quick review." },
   { "id": "compass.update_draft", "namespace": "compass", "action": "update_draft", "title": "Update Compass draft", "description": "Replace a draft Compass document.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "draft_id", "flag": "draft-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Pass the compass_version_id returned by compass.draft as draft_id; update_draft replaces only an unpublished draft in this tenant." },
   { "id": "confirmation.approve", "namespace": "confirmation", "action": "approve", "title": "Approve pending confirmation", "description": "Approve an in-flight confirmation and execute the original command as the approving human.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reviewed", "flag": "reviewed", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Approve pending confirmations only when the requested durable change is clear to the human owner." },
+  { "id": "confirmation.dismiss", "namespace": "confirmation", "action": "dismiss", "title": "Dismiss an expired confirmation", "description": "Clear a single expired, unactioned confirmation from the queue without re-executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Clear a single expired, unactioned confirmation from the queue. Dismiss is human-only queue hygiene \u2014 it never re-executes the original command." },
+  { "id": "confirmation.dismiss_stale", "namespace": "confirmation", "action": "dismiss_stale", "title": "Dismiss all expired confirmations", "description": "Clear every expired, unactioned confirmation in your authority scope from the queue without re-executing any command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Clear every expired, unactioned confirmation in your authority scope at once. Each dismissal is audited; none re-executes the original command." },
   { "id": "confirmation.list", "namespace": "confirmation", "action": "list", "title": "List pending confirmations", "description": "List in-flight confirmations awaiting a human decision, scoped to the caller's authority (owner sees all; a member sees seats they occupy; an agent sees its own seat).", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List pending confirmations awaiting a human decision before approving or rejecting them." },
   { "id": "confirmation.reject", "namespace": "confirmation", "action": "reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear." },
   { "id": "confirmation.remint", "namespace": "confirmation", "action": "remint", "title": "Re-mint an expired confirmation", "description": "Stage a fresh confirmation for the same command as an expired one, re-running the normal minting authorization checks.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-mint an expired confirmation into a fresh one before approving, instead of re-running the original command from scratch." },
@@ -56383,7 +56410,8 @@ function parseSemver2(value) {
 // src/runner-serve.ts
 import { execFile as execFileCallback5, spawn } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
+import { constants as fsConstants2 } from "node:fs";
+import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
 import { cpus, homedir as homedir4, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
 import path7 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
@@ -57699,11 +57727,43 @@ function resolveSandboxPosture(env, homeDir) {
 function resolveSandboxNetworkFlag(env) {
   return parseSandboxNetwork(env.RUNNER_SANDBOX_NETWORK).allowNetwork ? "allow" : "deny";
 }
+var CAPABILITY_PROBE_TIMEOUT_MS = 1e4;
+function classifyProbeError(err) {
+  if (!err || typeof err !== "object") {
+    return "absent";
+  }
+  const candidate = err;
+  const message = typeof candidate.message === "string" ? candidate.message.toLowerCase() : "";
+  if (candidate.code === "ENOENT" || message.includes("not found")) {
+    return "absent";
+  }
+  if (candidate.killed === true || candidate.code === "ETIMEDOUT" || candidate.signal === "SIGTERM") {
+    return "present_slow";
+  }
+  return "absent";
+}
+async function isResolvableOnPath(command) {
+  const dirs = (process.env.PATH ?? "").split(path7.delimiter).filter((dir) => dir.length > 0);
+  const suffixes = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter((ext) => ext.length > 0) : [""];
+  for (const dir of dirs) {
+    for (const suffix of suffixes) {
+      try {
+        await access3(path7.join(dir, `${command}${suffix}`), fsConstants2.X_OK);
+        return true;
+      } catch {
+      }
+    }
+  }
+  return false;
+}
 async function probe(command) {
   try {
-    const { stdout, stderr } = await execFile5(command, ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile5(command, ["--version"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS });
     return { installed: true, version: (stdout || stderr).trim() || null, auth_state: "ready" };
-  } catch {
+  } catch (err) {
+    if (classifyProbeError(err) === "present_slow" && await isResolvableOnPath(command)) {
+      return { installed: true, version: null, auth_state: "unknown" };
+    }
     return { installed: false, version: null, auth_state: "unknown" };
   }
 }
@@ -57739,7 +57799,7 @@ async function probeClaude() {
 }
 async function probeClaudeStreamJsonInterface() {
   try {
-    const { stdout, stderr } = await execFile5("claude", ["--help"], { timeout: 1500, maxBuffer: 1024 * 1024 });
+    const { stdout, stderr } = await execFile5("claude", ["--help"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS, maxBuffer: 1024 * 1024 });
     return supportsClaudeStreamJsonInterface(`${stdout ?? ""}
 ${stderr ?? ""}`);
   } catch {
@@ -57751,7 +57811,7 @@ function supportsClaudeStreamJsonInterface(helpText2) {
 }
 async function probeGit() {
   try {
-    const { stdout, stderr } = await execFile5("git", ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile5("git", ["--version"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS });
     const raw = (stdout || stderr).trim();
     return { installed: true, version: /(\d+\.\d+(?:\.\d+)?)/.exec(raw)?.[1] ?? (raw || null) };
   } catch {
@@ -57760,7 +57820,7 @@ async function probeGit() {
 }
 async function probeGh() {
   try {
-    const { stdout, stderr } = await execFile5("gh", ["--version"], { timeout: 1500 });
+    const { stdout, stderr } = await execFile5("gh", ["--version"], { timeout: CAPABILITY_PROBE_TIMEOUT_MS });
     const raw = (stdout || stderr).trim().split("\n")[0]?.trim() ?? "";
     const authenticated = await probeGhAuth();
     return { installed: true, version: /(\d+\.\d+\.\d+)/.exec(raw)?.[1] ?? (raw || null), authenticated };
@@ -57886,6 +57946,11 @@ async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtim
     summary: capResultSummary(result.summary),
     log_ref: input.logRef(id),
     model: (turnRuntime ?? runtime) === "codex" ? "codex-cli" : "claude-cli",
+    // DER-1915: token usage lifted from the claude JSON envelope (extractClaudeUsage), sent for
+    // BOTH kinds when present — never defaulted to 0 (see RunnerTurnResult.inputTokens/outputTokens).
+    // Both result routes (work-orders and turn-executions) accept these snake_case fields.
+    ...result.inputTokens != null ? { input_tokens: result.inputTokens } : {},
+    ...result.outputTokens != null ? { output_tokens: result.outputTokens } : {},
     // Artifact-bearing result fields (T1.5) — only sent when the harness produced them, so
     // the result route's `.strict()` schema still accepts a plain read-status report.
     ...result.prUrl ? { pr_url: result.prUrl } : {},
@@ -58019,9 +58084,14 @@ function resolveTurnPlan(input) {
     ],
     codexSandbox: execution.local_tools === "workspace_write" ? "workspace-write" : "read-only",
     // Forge build/review turns emit a structured JSON envelope (reusing the AICOS
-    // --output-format json pattern) so their summary is a real contract, not a stdout
-    // slice; read_status AND seat_work (DER-1333) turns keep free-form text status.
-    outputFormat: execution.profile === "forge_build" || execution.profile === "forge_review" ? "json" : "text",
+    // --output-format json pattern) so their summary is a real contract, not a stdout slice.
+    // DER-1915: seat_work ALSO uses the JSON envelope now, purely so its usage block
+    // (extractClaudeUsage) is reportable — the DER-1333 intent (a free-form status summary,
+    // not a structured contract) is unchanged, because `extractRunnerSummary` unwraps the
+    // envelope down to the model's own `result` text either way; json just adds parseable
+    // metadata (usage, session_id) alongside it. Only read_status (a read-only status stub,
+    // not a real MCP turn) still uses plain text.
+    outputFormat: execution.profile === "forge_build" || execution.profile === "forge_review" || execution.profile === "seat_work" ? "json" : "text",
     // Only a Forge workspace grants a repo cwd; a needs_repo contract with no prepared
     // workspace (broker/clone failed upstream) falls back to tmpdir rather than a bad cwd.
     repoDir: execution.needs_repo ? input.repoDir : null,
@@ -58702,11 +58772,21 @@ function runModelProcess(input) {
     let err = "";
     const timer = setTimeout(() => {
       killProcessTree(child);
+      const seconds = Math.round(input.timeoutMs / 1e3);
       const partial2 = scrubTranscriptSessionIds(redactForLog((out || err || "").trim()));
+      let transcriptBody = partial2;
+      if (transcriptBody.length === 0) {
+        const redactedErr = scrubTranscriptSessionIds(redactForLog(err.trim()));
+        transcriptBody = `turn timed out after ${seconds}s; no model output was captured before the process was killed.`;
+        if (redactedErr.length > 0) {
+          transcriptBody += `
+${redactedErr}`;
+        }
+      }
       finish({
         ok: false,
-        summary: `turn timed out after ${Math.round(input.timeoutMs / 1e3)}s`,
-        ...partial2.length > 0 ? { transcript: partial2.slice(0, MAX_TRANSCRIPT_CHARS) } : {}
+        summary: `turn timed out after ${seconds}s`,
+        transcript: transcriptBody.slice(0, MAX_TRANSCRIPT_CHARS)
       });
     }, input.timeoutMs);
     child.stdout.on("data", (data) => {
@@ -58721,18 +58801,30 @@ function runModelProcess(input) {
       const redacted = redactForLog(rawOutput);
       const evidence = input.collectEvidence && code === 0 ? extractRunnerEvidence(rawOutput) : [];
       const planArtifact = input.collectEvidence && code === 0 ? extractForgePlanArtifact(rawOutput) : void 0;
+      const transcriptSource = !input.collectEvidence && redacted.trim().startsWith("{") ? extractRunnerSummary(redacted) : redacted;
       finish({
         ok: code === 0,
         summary: extractRunnerSummary(redacted).slice(0, 12e3),
-        transcript: scrubTranscriptSessionIds(redacted).slice(0, MAX_TRANSCRIPT_CHARS),
+        transcript: scrubTranscriptSessionIds(transcriptSource).slice(0, MAX_TRANSCRIPT_CHARS),
         ...evidence.length > 0 ? { evidence } : {},
         ...input.expectSessionEnvelope ? extractClaudeSessionId(rawOutput) : {},
-        ...planArtifact ? { planArtifact } : {}
+        ...planArtifact ? { planArtifact } : {},
+        // DER-1915: attempt the token-usage extraction for BOTH work_order and turn_execution
+        // kinds (unlike the session id, which is scoped to expectSessionEnvelope/resume) — a
+        // Forge build/review work order runs claude with the same JSON envelope and its usage
+        // is just as reportable. Safe to attempt unconditionally: non-JSON/no-usage output
+        // yields {}, never a fabricated zero.
+        ...extractClaudeUsage(rawOutput)
       });
     });
     child.on("error", (error51) => {
       clearTimeout(timer);
-      finish({ ok: false, summary: `spawn error: ${redactForLog(error51.message)}` });
+      const message = redactForLog(error51.message);
+      finish({
+        ok: false,
+        summary: `spawn error: ${message}`,
+        transcript: `spawn error: ${message}`.slice(0, MAX_TRANSCRIPT_CHARS)
+      });
     });
   });
 }
@@ -58852,6 +58944,30 @@ function extractClaudeSessionId(output) {
     return {};
   }
 }
+function extractClaudeUsage(output) {
+  const trimmed = output.trim();
+  if (!trimmed.startsWith("{")) {
+    return {};
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    const usage2 = parsed.usage;
+    if (!usage2 || typeof usage2 !== "object" || Array.isArray(usage2)) {
+      return {};
+    }
+    const record2 = usage2;
+    const result = {};
+    if (typeof record2.input_tokens === "number" && Number.isFinite(record2.input_tokens) && record2.input_tokens >= 0) {
+      result.inputTokens = Math.floor(record2.input_tokens);
+    }
+    if (typeof record2.output_tokens === "number" && Number.isFinite(record2.output_tokens) && record2.output_tokens >= 0) {
+      result.outputTokens = Math.floor(record2.output_tokens);
+    }
+    return result;
+  } catch {
+    return {};
+  }
+}
 function runtimeSessionKey(state, workOrder) {
   const seatId = extractSeatId(workOrder);
   const userId = extractTurnUserId(workOrder);