agentwaste-core 0.1.0

package/src/scanner.js

@@ -0,0 +1,1217 @@
+import { createReadStream, existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, join, relative } from "node:path";
+import { createInterface } from "node:readline";
+
+const DEFAULT_SCAN_DAYS = 365;
+const DEFAULT_MAX_FILES = Number.MAX_SAFE_INTEGER;
+const MAX_FILE_BYTES = 64 * 1024 * 1024;
+const CONTEXT_REVIEW_FRESH_INPUT_PER_TOOL_CALL = 4000;
+const DEFAULT_COST_PER_MILLION_TOKENS = 3.0;
+
+const IGNORED_DIRS = new Set([
+  ".git",
+  ".hg",
+  ".svn",
+  "node_modules",
+  ".next",
+  "dist",
+  "build",
+  "coverage",
+  ".turbo",
+  ".cache",
+  "vendor",
+]);
+
+const GLUE_EXTENSIONS = new Set([".js", ".mjs", ".cjs", ".ts", ".tsx", ".sh", ".bash", ".zsh", ".py", ".rb"]);
+const GLUE_DIR_HINTS = new Set(["scripts", "script", "bin", "tools", "tooling", "automation", ".claude", ".codex", ".cursor", ".agents", ".mcp"]);
+const GLUE_NAME_RE = /(?:agent|mcp|tool|tools|workflow|automation|script|sync|deploy|hook|runner|doctor)/i;
+const STATE_LOSS_RE = /(?:lost|forgot|missing|dropped|reset).{0,40}(?:context|state|history|memory)|(?:context|state|history|memory).{0,40}(?:lost|forgot|missing|dropped|reset)|continue from|previous session|start over|compact(?:ed|ion)?/i;
+const TRACE_RE = /(?:trace[_-]?id|span[_-]?id|run[_-]?id|structured\s+trace|opentelemetry|otel)/i;
+const AGENT_TEXT_EXTENSIONS = new Set([".json", ".jsonl", ".log", ".md", ".txt", ".env", ".toml", ".yaml", ".yml"]);
+const AGENT_DB_EXTENSIONS = new Set([".db", ".sqlite", ".sqlite3", ".vscdb"]);
+
+const SOURCE_LABELS = {
+  codex: "Codex",
+  claude: "Claude Code",
+  gemini: "Gemini CLI",
+  pi: "pi",
+  cursor: "Cursor",
+  windsurf: "Windsurf",
+  opencode: "OpenCode",
+  aider: "Aider",
+  cline: "Cline",
+  roo: "Roo Code",
+  copilot: "GitHub Copilot",
+  continue: "Continue",
+  cody: "Cody",
+  configs: "Agent config",
+};
+
+const SECRET_PATTERNS = [
+  { name: "openai", re: /\bsk-proj-[A-Za-z0-9_-]{20,}\b|\bsk-[A-Za-z0-9_-]{32,}\b/g },
+  { name: "anthropic", re: /\bsk-ant-[A-Za-z0-9_-]{24,}\b/g },
+  { name: "github", re: /\bgh[pousr]_[A-Za-z0-9_]{30,255}\b/g },
+  { name: "stripe", re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}\b/g },
+  { name: "slack", re: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/g },
+  { name: "aws", re: /\bAKIA[0-9A-Z]{16}\b/g },
+  {
+    name: "generic",
+    re: /\b(?:api[_-]?key|access[_-]?token|auth[_-]?token|secret|password)\b\s*[:=]\s*["']?([A-Za-z0-9_./+=-]{24,})/gi,
+    capture: 1,
+  },
+];
+
+export async function scanAgentWaste(input = {}) {
+  const homeDir = input.homeDir ?? homedir();
+  const projectDir = input.projectDir ?? process.cwd();
+  const days = normalizeScanDays(input.days ?? DEFAULT_SCAN_DAYS);
+  const maxFiles = input.maxFiles ?? DEFAULT_MAX_FILES;
+  const now = input.now ?? Date.now();
+  const sinceMs = days === "all" ? 0 : now - days * 24 * 60 * 60 * 1000;
+  const totals = createTotals({ homeDir, projectDir, days, sinceMs, now });
+
+  await scanCodex(homeDir, sinceMs, maxFiles, totals);
+  await scanClaude(homeDir, sinceMs, maxFiles, totals);
+  await scanPi(homeDir, sinceMs, maxFiles, totals);
+  await scanGemini(homeDir, sinceMs, maxFiles, totals);
+  await scanOpenCode(homeDir, sinceMs, maxFiles, totals);
+  await scanCursor(homeDir, sinceMs, maxFiles, totals);
+  await scanWindsurf(homeDir, sinceMs, maxFiles, totals);
+  await scanEditorExtensionAgents(homeDir, sinceMs, maxFiles, totals);
+  await scanCopilot(homeDir, sinceMs, maxFiles, totals);
+  scanAider(projectDir, sinceMs, totals);
+  scanConfigFiles(homeDir, sinceMs, totals);
+  scanGlueCode(projectDir, totals);
+  finalize(totals);
+  return totals;
+}
+
+function normalizeScanDays(value) {
+  if (String(value).toLowerCase() === "all") return "all";
+  const days = Number.parseInt(value, 10);
+  return Number.isFinite(days) && days > 0 ? days : DEFAULT_SCAN_DAYS;
+}
+
+function createTotals({ homeDir, projectDir, days, sinceMs, now }) {
+  return {
+    homeDir,
+    projectDir,
+    days,
+    sinceMs,
+    now,
+    sources: {
+      ...Object.fromEntries(Object.entries(SOURCE_LABELS).map(([key, label]) => [key, createSourceStats(label)])),
+    },
+    fileSources: new Map(),
+    files: 0,
+    sessions: 0,
+    subagentSessions: 0,
+    toolCalls: 0,
+    failedToolCalls: 0,
+    retryAfterFailure: 0,
+    tokens: {
+      total: 0,
+      active: 0,
+      input: 0,
+      freshInput: 0,
+      output: 0,
+      cached: 0,
+      reasoning: 0,
+      observedModelCalls: 0,
+    },
+    secrets: {
+      rawKeys: 0,
+      modelFacingKeys: 0,
+      byKind: {},
+      fingerprints: new Set(),
+      modelFacingFingerprints: new Set(),
+      files: new Set(),
+    },
+    stateLoss: {
+      incidents: 0,
+      compactSignals: 0,
+      abortedTurns: 0,
+      phraseSignals: 0,
+      files: new Set(),
+    },
+    traces: {
+      signals: 0,
+      files: new Set(),
+      sessionFiles: new Set(),
+      configSignals: 0,
+    },
+    glue: {
+      lines: 0,
+      files: 0,
+      roots: new Set(),
+      scriptFiles: [],
+    },
+    sessionsById: new Set(),
+    diagnostics: [],
+    derived: {},
+  };
+}
+
+function createSourceStats(label) {
+  return {
+    label,
+    files: 0,
+    sessions: 0,
+    toolCalls: 0,
+    failedToolCalls: 0,
+    tokens: 0,
+    activeTokens: 0,
+    freshInputTokens: 0,
+    cachedInputTokens: 0,
+    secrets: 0,
+    modelFacingSecrets: 0,
+    stateLoss: 0,
+    traces: 0,
+    traceFiles: new Set(),
+    tracedFiles: 0,
+    retryAfterFailure: 0,
+    unavailable: false,
+  };
+}
+
+async function scanCodex(homeDir, sinceMs, maxFiles, totals) {
+  const root = join(homeDir, ".codex", "sessions");
+  const source = totals.sources.codex;
+  if (!existsSync(root)) {
+    source.unavailable = true;
+    return;
+  }
+
+  const files = recentFiles(root, sinceMs, maxFiles, (path) => path.endsWith(".jsonl"));
+  source.files = files.length;
+  totals.files += files.length;
+  for (const path of files) await scanCodexFile(path, totals);
+}
+
+async function scanCodexFile(path, totals) {
+  const source = totals.sources.codex;
+  registerFileSource(totals, path, source);
+  const session = createSessionAccumulator("codex", path);
+  const seenTokenSnapshots = new Set();
+  const seenCalls = new Set();
+  let index = 0;
+
+  await forEachJsonLine(path, (record, rawLine) => {
+    index += 1;
+    const timestamp = parseTime(record.timestamp);
+    if (timestamp > 0 && timestamp < totals.sinceMs) return;
+    if (record.type === "session_meta") {
+      const id = record.payload?.id;
+      if (typeof id === "string") session.id = id;
+      addSession(totals, source, id ?? path);
+    }
+
+    scanTextForSecrets(rawLine, totals, { modelFacing: isCodexModelFacing(record), file: path });
+    const payload = record.payload;
+    if (!payload || typeof payload !== "object") return;
+
+    if (record.type === "turn_context" && typeof payload.summary === "string" && payload.summary.trim().length > 0 && !session.compactionCounted) {
+      session.compactionCounted = true;
+      addCompactionSignal(totals, source, path);
+    }
+
+    if (record.type === "event_msg" && (payload.type === "user_message" || payload.type === "agent_message")) {
+      scanTextForStateLoss(String(payload.message ?? ""), totals, path);
+    }
+
+    if (record.type === "response_item" && payload.type === "message" && (payload.role === "user" || payload.role === "assistant")) {
+      scanTextForStateLoss(contentText(payload.content), totals, path);
+    }
+
+    if (record.type === "event_msg" && payload.type === "token_count" && payload.info?.last_token_usage) {
+      const usage = normalizeCodexUsage(payload.info.last_token_usage);
+      const snapshotKey = [
+        usage.total,
+        payload.info.total_token_usage?.total_tokens ?? "",
+        payload.info.total_token_usage?.input_tokens ?? "",
+      ].join(":");
+      if (!seenTokenSnapshots.has(snapshotKey) && usage.total > 0) {
+        seenTokenSnapshots.add(snapshotKey);
+        addUsage(totals, source, usage);
+      }
+    }
+
+    if (record.type === "response_item" && isCodexToolStart(payload)) {
+      const callId = payload.call_id ?? `codex:${path}:${index}`;
+      if (!seenCalls.has(callId)) {
+        seenCalls.add(callId);
+        addToolCall(totals, source);
+        noteToolStart(session, callId, toolSignature(payload.name ?? payload.type, payload.arguments ?? payload.input));
+      }
+      scanTextForTrace(structuredTraceText(payload.name, payload.arguments ?? payload.input), totals, path);
+    }
+
+    if (record.type === "event_msg" && isCodexToolEnd(payload)) {
+      const callId = payload.call_id ?? `codex:end:${path}:${index}`;
+      const failed = codexEndFailed(payload);
+      const signature = session.calls.get(callId) ?? toolSignature(payload.command ?? payload.invocation?.tool ?? payload.type, payload.command ?? payload.result);
+      if (!seenCalls.has(callId)) {
+        seenCalls.add(callId);
+        addToolCall(totals, source);
+      }
+      if (failed) addFailure(totals, source);
+      noteToolEnd(totals, session, signature, failed, timestamp, index);
+      scanTextForTrace(structuredTraceText(payload.type, {
+        command: payload.command,
+        invocation: payload.invocation,
+        result: payload.result,
+        stdout: payload.stdout,
+      }), totals, path);
+    }
+
+    if (record.type === "event_msg" && payload.type === "turn_aborted") {
+      totals.stateLoss.abortedTurns += 1;
+      addStateLoss(totals, source, path);
+    }
+  });
+
+  if (!session.id) addSession(totals, source, path);
+}
+
+async function scanClaude(homeDir, sinceMs, maxFiles, totals) {
+  const root = join(homeDir, ".claude", "projects");
+  const source = totals.sources.claude;
+  if (!existsSync(root)) {
+    source.unavailable = true;
+    return;
+  }
+
+  const files = recentFiles(root, sinceMs, maxFiles, (path) => path.endsWith(".jsonl"));
+  source.files = files.length;
+  totals.files += files.length;
+  for (const path of files) await scanClaudeFile(path, totals);
+
+  const facetsRoot = join(homeDir, ".claude", "usage-data", "facets");
+  if (existsSync(facetsRoot)) {
+    for (const path of recentFiles(facetsRoot, sinceMs, 1000, (item) => item.endsWith(".json"))) {
+      try {
+        const text = readFileSync(path, "utf8");
+        scanTextForStateLoss(text, totals, path);
+      } catch {
+        // Ignore unreadable optional usage facets.
+      }
+    }
+  }
+}
+
+async function scanClaudeFile(path, totals) {
+  const source = totals.sources.claude;
+  registerFileSource(totals, path, source);
+  const session = createSessionAccumulator("claude", path);
+  let index = 0;
+
+  if (basename(path).includes("compact") || path.includes("/subagents/agent-acompact")) {
+    addCompactionSignal(totals, source, path);
+  }
+  if (path.includes("/subagents/")) totals.subagentSessions += 1;
+
+  await forEachJsonLine(path, (record, rawLine) => {
+    index += 1;
+    const timestamp = parseTime(record.timestamp);
+    if (timestamp > 0 && timestamp < totals.sinceMs) return;
+    const sessionId = record.sessionId;
+    if (typeof sessionId === "string") {
+      session.id = sessionId;
+      addSession(totals, source, sessionId);
+    }
+
+    scanTextForSecrets(rawLine, totals, { modelFacing: isClaudeModelFacing(record), file: path });
+    if (record.type === "assistant" && record.message?.usage) {
+      addUsage(totals, source, normalizeClaudeUsage(record.message.usage));
+    }
+
+    if (record.type === "user" || record.type === "assistant") {
+      scanTextForStateLoss(claudeMessageText(record.message), totals, path);
+    }
+
+    if (record.type === "assistant") {
+      for (const block of array(record.message?.content)) {
+        if (block?.type === "tool_use") {
+          addToolCall(totals, source);
+          noteToolStart(session, block.id ?? `claude:${path}:${index}`, toolSignature(block.name, block.input));
+          scanTextForTrace(structuredTraceText(block.name, block.input), totals, path);
+        }
+      }
+    }
+
+    if (record.type === "user") {
+      const failed = claudeToolResultFailed(record);
+      if (record.toolUseResult || hasToolResult(record.message?.content)) {
+        const signature = toolSignature(record.toolUseResult?.name ?? record.sourceToolUseID ?? "tool_result", record.toolUseResult ?? record.message?.content);
+        if (failed) addFailure(totals, source);
+        noteToolEnd(totals, session, signature, failed, timestamp, index);
+      }
+    }
+
+    if (record.type === "system" && /compact/i.test(String(record.subtype ?? ""))) {
+      addCompactionSignal(totals, source, path);
+    }
+  });
+
+  if (!session.id) addSession(totals, source, path);
+}
+
+async function scanPi(homeDir, sinceMs, maxFiles, totals) {
+  const source = totals.sources.pi;
+  const sessionRoot = join(homeDir, ".pi", "agent", "sessions");
+  const files = recentFilesFromRoots([sessionRoot], sinceMs, maxFiles, (path) => path.endsWith(".jsonl"));
+  if (files.length === 0 && !existsSync(sessionRoot)) source.unavailable = true;
+  for (const path of files) await scanGenericAgentFile(path, totals, source, { modelFacing: true, sessionPerFile: true });
+
+  scanKnownFiles([
+    join(homeDir, ".pi", "agent", "settings.json"),
+    join(homeDir, ".pi", "agent", "auth.json"),
+    join(homeDir, ".pi", "agent", "models.json"),
+    join(homeDir, ".pi", "agent", "AGENTS.md"),
+  ], sinceMs, totals, source, { modelFacing: false, sessionPerFile: false });
+}
+
+async function scanGemini(homeDir, sinceMs, maxFiles, totals) {
+  const source = totals.sources.gemini;
+  const root = join(homeDir, ".gemini");
+  const sessionRoots = [join(root, "tmp"), join(root, "sessions"), join(root, "exports")];
+  const files = recentFilesFromRoots(sessionRoots, sinceMs, maxFiles, (path) => {
+    const name = basename(path);
+    return path.endsWith(".jsonl") ||
+      /(?:^session-|chats\/session-).+\.json$/i.test(path) ||
+      name === "logs.json" ||
+      name === "collector.log";
+  });
+  if (files.length === 0 && !existsSync(root)) source.unavailable = true;
+  for (const path of files) await scanGenericAgentFile(path, totals, source, { modelFacing: true, sessionPerFile: /(?:session|chat|\.jsonl)/i.test(path) });
+
+  scanKnownFiles([
+    join(root, "settings.json"),
+    join(root, ".env"),
+    join(root, "GEMINI.md"),
+  ], sinceMs, totals, source, { modelFacing: false, sessionPerFile: false });
+}
+
+async function scanOpenCode(homeDir, sinceMs, maxFiles, totals) {
+  const source = totals.sources.opencode;
+  const root = join(homeDir, ".local", "share", "opencode");
+  const files = recentFilesFromRoots([join(root, "log"), join(root, "project")], sinceMs, maxFiles, isLikelyAgentDataFile);
+  if (files.length === 0 && !existsSync(root)) source.unavailable = true;
+  for (const path of files) await scanGenericAgentFile(path, totals, source, { modelFacing: true, sessionPerFile: path.includes("/project/") });
+
+  scanKnownFiles([
+    join(root, "auth.json"),
+    join(homeDir, ".config", "opencode", "opencode.json"),
+    join(homeDir, ".config", "opencode", "config.json"),
+  ], sinceMs, totals, source, { modelFacing: false, sessionPerFile: false });
+}
+
+async function scanCursor(homeDir, sinceMs, maxFiles, totals) {
+  const source = totals.sources.cursor;
+  const roots = editorUserRoots(homeDir, "Cursor");
+  const files = recentFilesFromRoots([
+    ...roots.map((root) => join(root, "globalStorage")),
+    ...roots.map((root) => join(root, "workspaceStorage")),
+    ...roots.map((root) => join(root, "..", "logs")),
+    join(homeDir, ".cursor"),
+  ], sinceMs, maxFiles, isLikelyAgentDataFile);
+  if (files.length === 0 && roots.every((root) => !existsSync(root)) && !existsSync(join(homeDir, ".cursor"))) source.unavailable = true;
+  for (const path of files) await scanGenericAgentFile(path, totals, source, { modelFacing: true, sessionPerFile: false });
+}
+
+async function scanWindsurf(homeDir, sinceMs, maxFiles, totals) {
+  const source = totals.sources.windsurf;
+  const roots = editorUserRoots(homeDir, "Windsurf");
+  const files = recentFilesFromRoots([
+    ...roots.map((root) => join(root, "globalStorage")),
+    ...roots.map((root) => join(root, "workspaceStorage")),
+    ...roots.map((root) => join(root, "..", "logs")),
+    join(homeDir, ".codeium"),
+    join(homeDir, ".windsurf"),
+  ], sinceMs, maxFiles, isLikelyAgentDataFile);
+  if (files.length === 0 && roots.every((root) => !existsSync(root)) && !existsSync(join(homeDir, ".windsurf"))) source.unavailable = true;
+  for (const path of files) await scanGenericAgentFile(path, totals, source, { modelFacing: true, sessionPerFile: false });
+}
+
+async function scanEditorExtensionAgents(homeDir, sinceMs, maxFiles, totals) {
+  const editorRoots = [
+    ...editorUserRoots(homeDir, "Code"),
+    ...editorUserRoots(homeDir, "Code - Insiders"),
+    ...editorUserRoots(homeDir, "Cursor"),
+    ...editorUserRoots(homeDir, "Windsurf"),
+  ];
+  const extensionSources = [
+    { source: totals.sources.cline, ids: ["saoudrizwan.claude-dev", "cline.cline"] },
+    { source: totals.sources.roo, ids: ["rooveterinaryinc.roo-cline", "roo-cline.roo-cline"] },
+    { source: totals.sources.continue, ids: ["continue.continue"] },
+    { source: totals.sources.cody, ids: ["sourcegraph.cody-ai"] },
+  ];
+
+  for (const item of extensionSources) {
+    const roots = [];
+    for (const editorRoot of editorRoots) {
+      for (const id of item.ids) roots.push(join(editorRoot, "globalStorage", id));
+    }
+    const files = recentFilesFromRoots(roots, sinceMs, Math.min(maxFiles, 1000), isLikelyAgentDataFile);
+    if (files.length === 0 && roots.every((root) => !existsSync(root))) item.source.unavailable = true;
+    for (const path of files) await scanGenericAgentFile(path, totals, item.source, { modelFacing: true, sessionPerFile: /(?:task|history|session|conversation)/i.test(path) });
+  }
+}
+
+async function scanCopilot(homeDir, sinceMs, maxFiles, totals) {
+  const source = totals.sources.copilot;
+  const roots = [
+    join(homeDir, ".copilot", "session-state"),
+    join(homeDir, ".copilot", "history-session-state"),
+    ...editorUserRoots(homeDir, "Code").map((root) => join(root, "workspaceStorage")),
+    ...editorUserRoots(homeDir, "Code - Insiders").map((root) => join(root, "workspaceStorage")),
+  ];
+  const files = recentFilesFromRoots(roots, sinceMs, maxFiles, (path) => {
+    if (path.includes("/workspaceStorage/")) return basename(path) === "state.vscdb";
+    return isLikelyAgentDataFile(path);
+  });
+  if (files.length === 0 && roots.every((root) => !existsSync(root))) source.unavailable = true;
+  for (const path of files) await scanGenericAgentFile(path, totals, source, { modelFacing: true, sessionPerFile: !path.endsWith(".vscdb") });
+}
+
+function scanAider(projectDir, sinceMs, totals) {
+  const source = totals.sources.aider;
+  const candidates = [
+    join(projectDir, ".aider.chat.history.md"),
+    join(projectDir, ".aider.llm.history"),
+    join(projectDir, ".aider.input.history"),
+    join(projectDir, ".aider.conf.yml"),
+    join(projectDir, ".aider.conf.yaml"),
+  ];
+  const found = scanKnownFiles(candidates, sinceMs, totals, source, { modelFacing: true, sessionPerFile: true });
+  if (found === 0) source.unavailable = true;
+}
+
+function scanConfigFiles(homeDir, sinceMs, totals) {
+  const candidates = [
+    join(homeDir, ".codex", "config.toml"),
+    join(homeDir, ".codex", "history.jsonl"),
+    join(homeDir, ".codex", "log", "codex-tui.log"),
+    join(homeDir, ".claude", "settings.json"),
+    join(homeDir, ".claude.json"),
+    join(homeDir, ".cursor", "mcp.json"),
+  ];
+  const source = totals.sources.configs;
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    if (totals.fileSources.has(path)) continue;
+    const stat = safeStat(path);
+    if (!stat || stat.size > MAX_FILE_BYTES || stat.mtimeMs < sinceMs) continue;
+    try {
+      registerFileSource(totals, path, source);
+      const text = readFileSync(path, "utf8");
+      source.files += 1;
+      totals.files += 1;
+      scanTextForSecrets(text, totals, { modelFacing: false, file: path });
+      scanTextForTrace(text, totals, path);
+    } catch {
+      totals.diagnostics.push(`Skipped unreadable config ${path}`);
+    }
+  }
+}
+
+function scanKnownFiles(paths, sinceMs, totals, source, options) {
+  let found = 0;
+  for (const path of paths) {
+    if (!existsSync(path)) continue;
+    const stat = safeStat(path);
+    if (!stat || !stat.isFile() || stat.size > MAX_FILE_BYTES || stat.mtimeMs < sinceMs) continue;
+    found += 1;
+    scanGenericAgentFileSync(path, totals, source, options);
+  }
+  return found;
+}
+
+async function scanGenericAgentFile(path, totals, source, options = {}) {
+  registerAgentDataFile(totals, source, path);
+  if (path.endsWith(".jsonl")) {
+    await scanGenericJsonLines(path, totals, source, options);
+    return;
+  }
+  scanGenericAgentFileSync(path, totals, source, options);
+}
+
+function scanGenericAgentFileSync(path, totals, source, options = {}) {
+  registerAgentDataFile(totals, source, path);
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    totals.diagnostics.push(`Skipped unreadable ${source.label} file ${path}`);
+    return;
+  }
+  scanTextForSecrets(text, totals, { modelFacing: options.modelFacing === true, file: path });
+  scanTextForStateLoss(text, totals, path);
+  scanTextForTrace(text, totals, path);
+  if (options.sessionPerFile) addSession(totals, source, path);
+  if (path.endsWith(".json")) scanGenericJsonDocument(text, totals, source, path);
+}
+
+async function scanGenericJsonLines(path, totals, source, options = {}) {
+  const session = createSessionAccumulator(source.label.toLowerCase(), path);
+  let sawRecord = false;
+  await forEachJsonLine(path, (record, rawLine) => {
+    sawRecord = true;
+    scanTextForSecrets(rawLine, totals, { modelFacing: options.modelFacing === true || isGenericModelFacing(record), file: path });
+    scanTextForStateLoss(genericRecordText(record), totals, path);
+    scanTextForTrace(rawLine, totals, path);
+    noteGenericRecordSignals(record, totals, source, session);
+  });
+  if (options.sessionPerFile || sawRecord) addSession(totals, source, session.id ?? path);
+}
+
+function scanGenericJsonDocument(text, totals, source, path) {
+  try {
+    const parsed = JSON.parse(text);
+    const session = createSessionAccumulator(source.label.toLowerCase(), path);
+    visitGenericJson(parsed, (record) => {
+      noteGenericRecordSignals(record, totals, source, session);
+    });
+  } catch {
+    // Non-JSON configs with .json suffix are not useful beyond text scanning.
+  }
+}
+
+function noteGenericRecordSignals(record, totals, source, session) {
+  if (!record || typeof record !== "object") return;
+  const id = record.sessionId ?? record.session_id ?? record.conversationId ?? record.conversation_id ?? record.chatId ?? record.chat_id ?? record.id;
+  if (typeof id === "string" && /(?:session|conversation|chat|thread|conv)/i.test(String(Object.keys(record).join(" ")))) {
+    session.id = id;
+    addSession(totals, source, id);
+  }
+
+  const usage = normalizeGenericUsage(record.usage ?? record.tokenUsage ?? record.token_usage ?? record.metadata?.usage);
+  if (usage.total > 0) addUsage(totals, source, usage);
+
+  if (isGenericToolStart(record)) {
+    const callId = record.id ?? record.call_id ?? record.tool_call_id ?? stableSnippet(record).slice(0, 64);
+    addToolCall(totals, source);
+    noteToolStart(session, callId, toolSignature(record.name ?? record.toolName ?? record.tool_name ?? record.function?.name, record.input ?? record.arguments ?? record.args));
+  }
+
+  if (isGenericToolFailure(record)) {
+    addFailure(totals, source);
+    noteToolEnd(totals, session, toolSignature(record.name ?? record.toolName ?? record.tool_name ?? record.type, record.error ?? record.result ?? record.output), true, 0, 0);
+  }
+}
+
+function visitGenericJson(value, visit, depth = 0) {
+  if (depth > 8 || value == null) return;
+  if (Array.isArray(value)) {
+    for (const item of value.slice(0, 10000)) visitGenericJson(item, visit, depth + 1);
+    return;
+  }
+  if (typeof value !== "object") return;
+  visit(value);
+  for (const item of Object.values(value)) visitGenericJson(item, visit, depth + 1);
+}
+
+function scanGlueCode(projectDir, totals) {
+  if (!existsSync(projectDir)) return;
+  const files = [];
+  walk(projectDir, (path, dirent) => {
+    if (dirent.isDirectory()) return !IGNORED_DIRS.has(dirent.name);
+    if (!dirent.isFile()) return false;
+    if (!isGlueFile(projectDir, path)) return false;
+    files.push(path);
+    return false;
+  });
+
+  for (const path of files.slice(0, 500)) {
+    try {
+      const text = readFileSync(path, "utf8");
+      const lines = countLines(text);
+      const root = relative(projectDir, path).split(/[\\/]/)[0] || ".";
+      totals.glue.lines += lines;
+      totals.glue.files += 1;
+      totals.glue.roots.add(root);
+      totals.glue.scriptFiles.push({ path: relative(projectDir, path), lines });
+    } catch {
+      totals.diagnostics.push(`Skipped unreadable glue file ${path}`);
+    }
+  }
+  totals.glue.scriptFiles.sort((a, b) => b.lines - a.lines);
+}
+
+function recentFiles(root, sinceMs, maxFiles, predicate) {
+  const files = [];
+  walk(root, (path, dirent) => {
+    if (dirent.isDirectory()) {
+      if (IGNORED_DIRS.has(dirent.name)) return false;
+      return true;
+    }
+    if (!dirent.isFile() || !predicate(path)) return false;
+    const stat = safeStat(path);
+    if (!stat || stat.size > MAX_FILE_BYTES || stat.mtimeMs < sinceMs) return false;
+    files.push({ path, mtimeMs: stat.mtimeMs });
+    return false;
+  });
+  files.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return files.slice(0, maxFiles).map((item) => item.path);
+}
+
+function recentFilesFromRoots(roots, sinceMs, maxFiles, predicate) {
+  const seen = new Set();
+  const files = [];
+  for (const root of roots) {
+    for (const path of recentFiles(root, sinceMs, maxFiles, predicate)) {
+      if (seen.has(path)) continue;
+      seen.add(path);
+      const stat = safeStat(path);
+      if (stat) files.push({ path, mtimeMs: stat.mtimeMs });
+    }
+  }
+  files.sort((a, b) => b.mtimeMs - a.mtimeMs);
+  return files.slice(0, maxFiles).map((item) => item.path);
+}
+
+function isLikelyAgentDataFile(path) {
+  const ext = extension(path);
+  const name = basename(path);
+  if (AGENT_TEXT_EXTENSIONS.has(ext) || AGENT_DB_EXTENSIONS.has(ext)) return true;
+  return name === "state.vscdb" || name === "storage.json";
+}
+
+function editorUserRoots(homeDir, appName) {
+  return [
+    join(homeDir, "Library", "Application Support", appName, "User"),
+    join(homeDir, ".config", appName, "User"),
+  ];
+}
+
+function registerAgentDataFile(totals, source, path) {
+  if (totals.fileSources.has(path)) return false;
+  registerFileSource(totals, path, source);
+  source.unavailable = false;
+  source.files += 1;
+  totals.files += 1;
+  return true;
+}
+
+function registerFileSource(totals, path, source) {
+  totals.fileSources.set(path, source);
+}
+
+function walk(root, visit) {
+  let entries;
+  try {
+    entries = readdirSync(root, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const path = join(root, entry.name);
+    const shouldDescend = visit(path, entry);
+    if (entry.isDirectory() && shouldDescend !== false) walk(path, visit);
+  }
+}
+
+async function forEachJsonLine(path, onRecord) {
+  const stream = createReadStream(path, { encoding: "utf8" });
+  const lines = createInterface({ input: stream, crlfDelay: Infinity });
+  for await (const line of lines) {
+    if (!line.trim()) continue;
+    try {
+      onRecord(JSON.parse(line), line);
+    } catch {
+      // Some logs can contain partial writes. They are not useful for metrics.
+    }
+  }
+}
+
+function createSessionAccumulator(kind, path) {
+  return {
+    kind,
+    path,
+    id: undefined,
+    calls: new Map(),
+    lastFailureBySignature: new Map(),
+    compactionCounted: false,
+  };
+}
+
+function addSession(totals, source, id) {
+  const key = `${source.label}:${id}`;
+  if (totals.sessionsById.has(key)) return;
+  totals.sessionsById.add(key);
+  source.sessions += 1;
+  totals.sessions += 1;
+}
+
+function addUsage(totals, source, usage) {
+  totals.tokens.total += usage.total;
+  totals.tokens.active += usage.active;
+  totals.tokens.input += usage.input;
+  totals.tokens.freshInput += usage.freshInput;
+  totals.tokens.output += usage.output;
+  totals.tokens.cached += usage.cached;
+  totals.tokens.reasoning += usage.reasoning;
+  totals.tokens.observedModelCalls += 1;
+  source.tokens += usage.total;
+  source.activeTokens += usage.active;
+  source.freshInputTokens += usage.freshInput;
+  source.cachedInputTokens += usage.cached;
+}
+
+function addToolCall(totals, source) {
+  totals.toolCalls += 1;
+  source.toolCalls += 1;
+}
+
+function addFailure(totals, source) {
+  totals.failedToolCalls += 1;
+  source.failedToolCalls += 1;
+}
+
+function noteToolStart(session, callId, signature) {
+  session.calls.set(callId, signature);
+  const failed = session.lastFailureBySignature.get(signature);
+  if (failed && failed.retryCounted !== true) {
+    failed.retryCounted = true;
+    session.lastRetrySignal = true;
+  }
+}
+
+function noteToolEnd(totals, session, signature, failed, timestamp, index) {
+  if (session.lastRetrySignal) {
+    totals.retryAfterFailure += 1;
+    const source = sourceForPath(totals, session.path);
+    source.retryAfterFailure += 1;
+    session.lastRetrySignal = false;
+  }
+  if (failed) {
+    session.lastFailureBySignature.set(signature, { timestamp, index, retryCounted: false });
+  }
+}
+
+function addStateLoss(totals, source, path) {
+  totals.stateLoss.incidents += 1;
+  totals.stateLoss.files.add(path);
+  source.stateLoss += 1;
+}
+
+function addCompactionSignal(totals, source, path) {
+  totals.stateLoss.compactSignals += 1;
+  totals.stateLoss.files.add(path);
+  source.stateLoss += 1;
+}
+
+function scanTextForStateLoss(text, totals, path) {
+  if (!STATE_LOSS_RE.test(text)) return;
+  totals.stateLoss.phraseSignals += 1;
+  totals.stateLoss.incidents += 1;
+  totals.stateLoss.files.add(path);
+  const source = sourceForPath(totals, path);
+  source.stateLoss += 1;
+}
+
+function scanTextForTrace(text, totals, path) {
+  if (!TRACE_RE.test(text)) return;
+  totals.traces.signals += 1;
+  totals.traces.files.add(path);
+  const source = sourceForPath(totals, path);
+  if (source === totals.sources.configs) {
+    totals.traces.configSignals += 1;
+  } else {
+    totals.traces.sessionFiles.add(path);
+    source.traceFiles.add(path);
+  }
+  source.traces += 1;
+}
+
+function scanTextForSecrets(text, totals, { modelFacing, file }) {
+  for (const pattern of SECRET_PATTERNS) {
+    pattern.re.lastIndex = 0;
+    let match;
+    while ((match = pattern.re.exec(text)) !== null) {
+      const raw = pattern.capture ? match[pattern.capture] : match[0];
+      if (!raw || looksLikePlaceholder(raw)) continue;
+      const fingerprint = `${pattern.name}:${raw.slice(0, 8)}:${raw.length}:${raw.slice(-4)}`;
+      if (!totals.secrets.fingerprints.has(fingerprint)) {
+        totals.secrets.fingerprints.add(fingerprint);
+        totals.secrets.rawKeys += 1;
+        totals.secrets.byKind[pattern.name] = (totals.secrets.byKind[pattern.name] ?? 0) + 1;
+        totals.secrets.files.add(file);
+        sourceForPath(totals, file).secrets += 1;
+      }
+      if (modelFacing && !totals.secrets.modelFacingFingerprints.has(fingerprint)) {
+        totals.secrets.modelFacingFingerprints.add(fingerprint);
+        totals.secrets.modelFacingKeys += 1;
+        sourceForPath(totals, file).modelFacingSecrets += 1;
+      }
+    }
+  }
+}
+
+function sourceForPath(totals, path) {
+  const mapped = totals.fileSources.get(path);
+  if (mapped) return mapped;
+  if (path.includes("/.codex/")) return totals.sources.codex;
+  if (path.includes("/.claude/")) return totals.sources.claude;
+  if (path.includes("/.gemini/")) return totals.sources.gemini;
+  if (path.includes("/.pi/")) return totals.sources.pi;
+  if (path.includes("/Cursor/") || path.includes("/.cursor/")) return totals.sources.cursor;
+  if (path.includes("/Windsurf/") || path.includes("/.windsurf/") || path.includes("/.codeium/")) return totals.sources.windsurf;
+  if (path.includes("/opencode/")) return totals.sources.opencode;
+  return totals.sources.configs;
+}
+
+function isCodexModelFacing(record) {
+  if (record.type !== "response_item" && record.type !== "event_msg") return false;
+  const payload = record.payload;
+  if (!payload) return false;
+  return payload.type === "message" || payload.type === "user_message" || payload.type === "function_call" || payload.type === "custom_tool_call";
+}
+
+function isClaudeModelFacing(record) {
+  return record.type === "user" || record.type === "assistant";
+}
+
+function isCodexToolStart(payload) {
+  return payload.type === "function_call" || payload.type === "custom_tool_call" || payload.type === "web_search_call";
+}
+
+function isCodexToolEnd(payload) {
+  return /_end$/.test(String(payload.type ?? "")) && (
+    payload.type === "exec_command_end" ||
+    payload.type === "patch_apply_end" ||
+    payload.type === "web_search_end" ||
+    payload.type === "mcp_tool_call_end"
+  );
+}
+
+function codexEndFailed(payload) {
+  if (payload.status && !["completed", "ok", "success"].includes(String(payload.status).toLowerCase())) return true;
+  if (typeof payload.exit_code === "number" && payload.exit_code !== 0) return true;
+  if (payload.success === false) return true;
+  const stderr = typeof payload.stderr === "string" ? payload.stderr : "";
+  return /\b(error|failed|exception|permission denied|not found)\b/i.test(stderr) && !/\b0 errors\b/i.test(stderr);
+}
+
+function claudeToolResultFailed(record) {
+  if (record.toolUseResult?.is_error === true || record.toolUseResult?.error) return true;
+  const content = array(record.message?.content);
+  return content.some((item) => item?.type === "tool_result" && (item.is_error === true || /\b(error|failed|exception|permission denied)\b/i.test(String(item.content ?? ""))));
+}
+
+function hasToolResult(content) {
+  return array(content).some((item) => item?.type === "tool_result");
+}
+
+function isGenericModelFacing(record) {
+  const role = String(record?.role ?? record?.message?.role ?? record?.type ?? "").toLowerCase();
+  return role === "user" || role === "assistant" || role === "model" || role === "tool_use" || role === "function_call";
+}
+
+function genericRecordText(record) {
+  if (!record || typeof record !== "object") return "";
+  return [
+    contentText(record.content),
+    contentText(record.message?.content),
+    record.text,
+    record.prompt,
+    record.response,
+    record.output,
+    record.error,
+  ].filter((value) => typeof value === "string" && value.length > 0).join("\n");
+}
+
+function isGenericToolStart(record) {
+  const type = String(record.type ?? record.kind ?? "").toLowerCase();
+  if (type === "tool_use" || type === "tool_call" || type === "function_call") return true;
+  if (record.functionCall || record.function_call || record.toolCall || record.tool_call) return true;
+  return typeof record.toolName === "string" || typeof record.tool_name === "string";
+}
+
+function isGenericToolFailure(record) {
+  if (record.is_error === true || record.isError === true || record.success === false) return true;
+  const status = String(record.status ?? record.state ?? "").toLowerCase();
+  if (["error", "failed", "failure", "rejected"].includes(status)) return true;
+  const text = String(record.error ?? record.stderr ?? record.output ?? record.result ?? "");
+  return /\b(error|failed|exception|permission denied)\b/i.test(text) && !/\b0 errors\b/i.test(text);
+}
+
+function contentText(content) {
+  if (typeof content === "string") return content;
+  return array(content)
+    .map((item) => {
+      if (!item || typeof item !== "object") return "";
+      return typeof item.text === "string" ? item.text : typeof item.content === "string" ? item.content : "";
+    })
+    .filter(Boolean)
+    .join("\n");
+}
+
+function claudeMessageText(message) {
+  if (!message) return "";
+  return contentText(message.content);
+}
+
+function structuredTraceText(name, payload) {
+  const tool = String(name ?? "");
+  const text = typeof payload === "string" ? payload : stableSnippet(payload);
+  if (!/(?:trace[_-]?id|span[_-]?id|run[_-]?id|opentelemetry|otel)/i.test(`${tool}\n${text}`)) return "";
+  return `${tool}\n${text}`;
+}
+
+function normalizeCodexUsage(usage) {
+  const input = number(usage.input_tokens);
+  const output = number(usage.output_tokens);
+  const cached = number(usage.cached_input_tokens);
+  const reasoning = number(usage.reasoning_output_tokens);
+  const total = number(usage.total_tokens) || input + output;
+  const freshInput = Math.max(0, input - cached);
+  const active = freshInput + output;
+  return { input, freshInput, output, cached, reasoning, total, active };
+}
+
+function normalizeClaudeUsage(usage) {
+  const input = number(usage.input_tokens);
+  const output = number(usage.output_tokens);
+  const cacheCreation = number(usage.cache_creation_input_tokens);
+  const cacheRead = number(usage.cache_read_input_tokens);
+  const total = input + output + cacheCreation + cacheRead;
+  const freshInput = input + cacheCreation;
+  const active = freshInput + output;
+  return { input: input + cacheCreation + cacheRead, freshInput, output, cached: cacheRead, reasoning: 0, total, active };
+}
+
+function normalizeGenericUsage(usage) {
+  if (!usage || typeof usage !== "object") return { input: 0, freshInput: 0, output: 0, cached: 0, reasoning: 0, total: 0, active: 0 };
+  const input = firstNumber(usage.input_tokens, usage.inputTokens, usage.prompt_tokens, usage.promptTokens, usage.promptTokenCount, usage.inputTokenCount);
+  const output = firstNumber(usage.output_tokens, usage.outputTokens, usage.completion_tokens, usage.completionTokens, usage.candidatesTokenCount, usage.outputTokenCount);
+  const cached = firstNumber(usage.cached_input_tokens, usage.cache_read_input_tokens, usage.cachedTokens, usage.cachedContentTokenCount);
+  const cacheCreation = firstNumber(usage.cache_creation_input_tokens, usage.cacheCreationInputTokens);
+  const reasoning = firstNumber(usage.reasoning_output_tokens, usage.reasoningTokens, usage.thoughtsTokenCount);
+  const total = firstNumber(usage.total_tokens, usage.totalTokens, usage.totalTokenCount) || input + output + cached + cacheCreation;
+  const freshInput = Math.max(0, input + cacheCreation - cached);
+  const active = freshInput + output;
+  return { input: input + cacheCreation, freshInput, output, cached, reasoning, total, active };
+}
+
+function finalize(totals) {
+  const avgTokensPerToolCall = totals.toolCalls > 0 ? Math.round(totals.tokens.active / totals.toolCalls) : 0;
+  const avgFreshInputPerToolCall = totals.toolCalls > 0 ? Math.round(totals.tokens.freshInput / totals.toolCalls) : 0;
+  const contextDragPercent = totals.tokens.active > 0 ? Math.round((totals.tokens.freshInput / totals.tokens.active) * 100) : 0;
+  const cacheableInput = totals.tokens.freshInput + totals.tokens.cached;
+  const cacheHitPercent = cacheableInput > 0 ? Math.round((totals.tokens.cached / cacheableInput) * 100) : 0;
+  const excessFreshInputTokens = Math.max(0, totals.tokens.freshInput - CONTEXT_REVIEW_FRESH_INPUT_PER_TOOL_CALL * totals.toolCalls);
+  const excessFreshInputPercent = totals.tokens.freshInput > 0 ? Math.round((excessFreshInputTokens / totals.tokens.freshInput) * 100) : 0;
+  const retryRatePercent = totals.toolCalls > 0 ? round((totals.failedToolCalls / totals.toolCalls) * 100, 1) : 0;
+  const avgRetriesPerFailure = totals.failedToolCalls > 0 ? round(totals.retryAfterFailure / totals.failedToolCalls, 1) : 0;
+  const retryRecoveryPercent = totals.failedToolCalls > 0 ? Math.min(100, Math.round((totals.retryAfterFailure / totals.failedToolCalls) * 100)) : 0;
+  const unresolvedFailures = Math.max(0, totals.failedToolCalls - totals.retryAfterFailure);
+  const sessionLogFiles = Object.entries(totals.sources)
+    .filter(([key]) => key !== "configs")
+    .reduce((sum, [, source]) => sum + source.files, 0);
+  const tracedSessionLogFiles = totals.traces.sessionFiles.size;
+  const traceCoveragePercent = sessionLogFiles > 0 ? Math.min(100, Math.round((tracedSessionLogFiles / sessionLogFiles) * 100)) : 0;
+  const observedDays = totals.days === "all" ? 30 : Math.max(1, totals.days);
+  const monthlyTokens = totals.tokens.active * (30 / observedDays);
+  const excessMonthlyFreshInputTokens = excessFreshInputTokens * (30 / observedDays);
+  const excessSpendMid = excessMonthlyFreshInputTokens / 1_000_000 * DEFAULT_COST_PER_MILLION_TOKENS;
+  const excessSpendLow = Math.round(excessSpendMid * 0.75);
+  const excessSpendHigh = Math.max(excessSpendLow, Math.round(excessSpendMid * 1.35));
+  const failureRecoveryMinutes = totals.failedToolCalls * 3 + totals.retryAfterFailure * 4;
+  const stateRecoveryMinutes = totals.stateLoss.incidents * 20;
+  const automationMaintenanceMinutes = Math.round(totals.glue.lines / 35);
+  const debuggingHours = Math.round((failureRecoveryMinutes + stateRecoveryMinutes + automationMaintenanceMinutes) / 60);
+  const credentialRiskScore = credentialExposureScore(totals.secrets.rawKeys, totals.secrets.modelFacingKeys);
+  const hardBreakRatePerSession = totals.sessions > 0 ? round(totals.stateLoss.incidents / totals.sessions, 2) : 0;
+  const compactionsPerSession = totals.sessions > 0 ? round(totals.stateLoss.compactSignals / totals.sessions, 2) : 0;
+
+  totals.derived = {
+    contextReviewFreshInputPerToolCall: CONTEXT_REVIEW_FRESH_INPUT_PER_TOOL_CALL,
+    avgTokensPerToolCall,
+    avgFreshInputPerToolCall,
+    contextDragPercent,
+    cacheHitPercent,
+    excessFreshInputTokens,
+    excessFreshInputPercent,
+    contextOverheadLevel: contextOverheadLevel(avgFreshInputPerToolCall, contextDragPercent, cacheHitPercent, totals.toolCalls),
+    sampleConfidence: sampleConfidence(totals),
+    retryRatePercent,
+    avgRetriesPerFailure,
+    retryRecoveryPercent,
+    unresolvedFailures,
+    reliabilityLevel: reliabilityLevel(retryRatePercent, unresolvedFailures, totals.toolCalls),
+    traceCoveragePercent,
+    traceCoverageLevel: traceCoverageLevel(traceCoveragePercent, sessionLogFiles),
+    sessionLogFiles,
+    tracedSessionLogFiles,
+    monthlyTokens: Math.round(monthlyTokens),
+    excessMonthlyFreshInputTokens: Math.round(excessMonthlyFreshInputTokens),
+    excessSpendLow,
+    excessSpendHigh,
+    costPerMillionTokens: DEFAULT_COST_PER_MILLION_TOKENS,
+    failureRecoveryMinutes,
+    stateRecoveryMinutes,
+    automationMaintenanceMinutes,
+    debuggingHours,
+    credentialRiskScore,
+    credentialRiskLevel: credentialExposureLevel(totals.secrets.rawKeys, totals.secrets.modelFacingKeys),
+    stateContinuityLevel: stateContinuityLevel(hardBreakRatePerSession, compactionsPerSession),
+    hardBreakRatePerSession,
+    compactionsPerSession,
+    automationFootprintLevel: automationFootprintLevel(totals.glue.lines, totals.glue.files, totals.glue.roots.size),
+    securityExposure: securityExposure(totals.secrets.rawKeys, totals.secrets.modelFacingKeys),
+  };
+
+  totals.secrets.fingerprints = undefined;
+  totals.secrets.modelFacingFingerprints = undefined;
+  for (const source of Object.values(totals.sources)) {
+    if (source.traceFiles instanceof Set) source.tracedFiles = source.traceFiles.size;
+    source.traceFiles = undefined;
+  }
+
+  totals.secrets.files = [...totals.secrets.files].slice(0, 10);
+  totals.stateLoss.files = [...totals.stateLoss.files].slice(0, 10);
+  totals.traces.files = [...totals.traces.files].slice(0, 10);
+  totals.traces.sessionFiles = undefined;
+  totals.glue.roots = [...totals.glue.roots].sort();
+  totals.sessionsById = undefined;
+  totals.fileSources = undefined;
+}
+
+function contextOverheadLevel(avgFreshInputPerToolCall, contextDragPercent, cacheHitPercent, toolCalls) {
+  if (toolCalls === 0) return "NO_DATA";
+  if (avgFreshInputPerToolCall >= 25000) return "CRITICAL";
+  if (avgFreshInputPerToolCall >= 12000) return "HIGH";
+  if (avgFreshInputPerToolCall >= CONTEXT_REVIEW_FRESH_INPUT_PER_TOOL_CALL) return "MEDIUM";
+  if (avgFreshInputPerToolCall >= 2000 && contextDragPercent >= 90 && cacheHitPercent < 20) return "MEDIUM";
+  return "LOW";
+}
+
+function reliabilityLevel(failureRatePercent, unresolvedFailures, toolCalls) {
+  if (toolCalls === 0) return "NO_DATA";
+  if (failureRatePercent >= 30 || unresolvedFailures >= 5) return "CRITICAL";
+  if (failureRatePercent >= 15 || unresolvedFailures >= 2) return "HIGH";
+  if (failureRatePercent >= 5 || unresolvedFailures >= 1) return "MEDIUM";
+  return "LOW";
+}
+
+function credentialExposureScore(rawKeys, modelFacingKeys) {
+  if (modelFacingKeys > 0) return 100;
+  if (rawKeys > 0) return Math.min(95, 70 + (rawKeys - 1) * 5);
+  return 0;
+}
+
+function credentialExposureLevel(rawKeys, modelFacingKeys) {
+  if (modelFacingKeys > 0) return "CRITICAL";
+  if (rawKeys > 0) return "HIGH";
+  return "LOW";
+}
+
+function stateContinuityLevel(hardBreakRatePerSession, compactionsPerSession) {
+  if (hardBreakRatePerSession >= 1) return "HIGH";
+  if (hardBreakRatePerSession >= 0.25) return "MEDIUM";
+  if (compactionsPerSession >= 1) return "MEDIUM";
+  if (compactionsPerSession > 0) return "LOW";
+  return "LOW";
+}
+
+function traceCoverageLevel(percent, sessionLogFiles) {
+  if (sessionLogFiles === 0) return "NO_DATA";
+  if (percent >= 80) return "GOOD";
+  if (percent >= 30) return "PARTIAL";
+  return "MISSING";
+}
+
+function automationFootprintLevel(lines, files, roots) {
+  if (files === 0) return "LOW";
+  if (files >= 50 || lines >= 10000 || roots >= 8) return "CRITICAL";
+  if (files >= 16 || lines >= 3000 || roots >= 5) return "HIGH";
+  if (files >= 6 || lines >= 1000 || roots >= 3) return "MEDIUM";
+  return "LOW";
+}
+
+function sampleConfidence(totals) {
+  if (totals.tokens.observedModelCalls >= 10 && totals.toolCalls >= 20) return "HIGH";
+  if (totals.tokens.observedModelCalls >= 3 && totals.toolCalls >= 5) return "MEDIUM";
+  if (totals.tokens.observedModelCalls > 0 || totals.toolCalls > 0 || totals.sessions > 0) return "LOW";
+  return "NO_DATA";
+}
+
+function securityExposure(rawKeys, modelFacingKeys) {
+  if (modelFacingKeys > 0) return "Critical: secret material reached model-facing context";
+  if (rawKeys > 0) return "High: secret material present in local logs or config";
+  return "Low";
+}
+
+function isGlueFile(projectDir, path) {
+  const rel = relative(projectDir, path);
+  const parts = rel.split(/[\\/]/);
+  const ext = extension(path);
+  if (!GLUE_EXTENSIONS.has(ext)) return false;
+  if (parts.some((part) => GLUE_DIR_HINTS.has(part))) return true;
+  return GLUE_NAME_RE.test(basename(path));
+}
+
+function extension(path) {
+  const name = basename(path);
+  const index = name.lastIndexOf(".");
+  return index === -1 ? "" : name.slice(index);
+}
+
+function toolSignature(name, payload) {
+  const value = typeof payload === "string" ? payload : stableSnippet(payload);
+  return `${String(name ?? "tool").toLowerCase()}:${value.slice(0, 120).replace(/\s+/g, " ")}`;
+}
+
+function stableSnippet(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value ?? "");
+  }
+}
+
+function looksLikePlaceholder(value) {
+  return /(?:example|placeholder|your[_-]?|xxx|redacted|token_here|api_key_here|changeme)/i.test(value);
+}
+
+function countLines(text) {
+  if (!text) return 0;
+  return text.split(/\r\n|\r|\n/).length;
+}
+
+function array(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function number(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+
+function firstNumber(...values) {
+  for (const value of values) {
+    const parsed = number(value);
+    if (parsed > 0) return parsed;
+  }
+  return 0;
+}
+
+function parseTime(value) {
+  if (typeof value !== "string") return 0;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : 0;
+}
+
+function safeStat(path) {
+  try {
+    return statSync(path);
+  } catch {
+    return null;
+  }
+}
+
+function round(value, digits) {
+  const factor = 10 ** digits;
+  return Math.round(value * factor) / factor;
+}