claude-code-runrate 0.2.4 → 0.4.0

package/scripts/launch.sh

@@ -12,6 +12,8 @@
 # state dirs keep concurrent profiles from colliding.
 #
 # Env overrides: CC_BIN, CCR_SESSION, CCR_STATE_DIR, CCR_SIDEBAR_PCT (default 34).
+# The tmux socket name follows the session name — each instance runs its own
+# tmux server, so `tmux ls` won't list ccr sessions (`tmux -L ccr-<profile> ls`).
 
 set -euo pipefail
 
@@ -25,6 +27,11 @@ if [ -n "$PROFILE" ] && ! printf '%s' "$PROFILE" | grep -qE '^[A-Za-z0-9._-]+$';
   exit 1
 fi
 
+# Escape a value for a SINGLE-QUOTED shell context: ' becomes '\''.
+# Correct for anything we pass through `sh -c`, which is one parsing layer.
+# NOT sufficient inside a tmux config string — see the F3 binding below for why.
+sq() { printf "%s" "$1" | sed "s/'/'\\\\''/g"; }
+
 # State lives under the user's home, never world-shared /tmp; create it
 # owner-only so other local users can't read captured status.
 umask 077
@@ -35,7 +42,14 @@ chmod +x "$REPO/sidecar/ccr-statusline" 2>/dev/null || true
 
 # Prefer the newest nvm-installed node; `sort -V` is a GNU-ism, so suppress its
 # error on BSD/macOS and fall back to PATH node below.
-NODE="$(ls -d "$HOME"/.nvm/versions/node/*/bin/node 2>/dev/null | sort -V 2>/dev/null | tail -1)"
+#
+# The `|| true` is load-bearing, not defensive habit: with `set -e` and
+# `pipefail`, `ls` failing on a machine with no ~/.nvm makes the whole pipeline
+# non-zero, and a failing command substitution in an assignment aborts the
+# script. That killed the launcher outright — exit 2, no message, no sidebar —
+# for exactly the user who has plain Claude Code and no nvm, who then never
+# reaches the PATH fallback two lines below. Reproduced 2026-08-04.
+NODE="$(ls -d "$HOME"/.nvm/versions/node/*/bin/node 2>/dev/null | sort -V 2>/dev/null | tail -1 || true)"
 [ -x "$NODE" ] || NODE="$(command -v node || true)"
 [ -n "$NODE" ] || { echo "ccr: node not found" >&2; exit 1; }
 command -v tmux >/dev/null 2>&1 || { echo "ccr: tmux not found (required for the sidebar)" >&2; exit 1; }
@@ -48,17 +62,40 @@ if [ -n "$PROFILE" ]; then
     exit 1
   fi
   CC_CMD="ccs $PROFILE"
-  SESSION="${CCR_SESSION:-ccr-$PROFILE}"
-  STATE="${CCR_STATE_DIR:-$HOME/.ccr/$PROFILE}"
 else
   CC_CMD="${CC_BIN:-claude}"
-  SESSION="${CCR_SESSION:-ccr}"
-  STATE="${CCR_STATE_DIR:-$HOME/.ccr}"
 fi
+# The launcher normally arrives with CCR_SESSION/CCR_STATE_DIR already set by
+# the slot allocator (bin/ccr.js — every launch slots, profiled or bare). The
+# fallbacks cover only a direct invocation of this script, and they point at
+# slot 1's member dir: ~/.ccr itself is a container now, never a state dir.
+SESSION="${CCR_SESSION:-ccr}"
+STATE="${CCR_STATE_DIR:-$HOME/.ccr/instances/1}"
+
+# Every instance gets its OWN tmux server, on a socket named after the session
+# (-L puts it under /tmp/tmux-$UID/). On a shared server, one server death —
+# a kill-server (2026-08-02: an agent inside one instance ran exactly that as
+# "cleanup" after a config parse check), a crash, a cgroup teardown — takes
+# down every concurrent profile at once; and root-table bindings like F2 are
+# server-global, so the last launch would steal the hotkey for all instances.
+# Isolation costs one visible thing: `tmux ls` won't list ccr sessions —
+# use `tmux -L ccr-<profile> ls`.
+SOCKET="$SESSION"
 
 mkdir -p "$STATE"
 chmod 700 "$HOME/.ccr" "$STATE" 2>/dev/null || true
 rm -f "$STATE/exited"
+# The directory ccr was launched in — the tab's stable identity for the git
+# pane (src/state-dir.js: recordLaunchDir does the same for the other two
+# launchers). Best-effort: a tab that cannot record it falls back to naming
+# only the repo the session is in.
+# The rm is load-bearing, not tidiness: `>` on a planted FIFO blocks until a
+# reader appears and hangs the launcher here, before Claude is ever spawned, and
+# on a planted symlink it overwrites the link's target. Removing first turns both
+# into an ordinary create. src/state-dir.js does the same for the other two
+# launchers, and both sibling writers in <stateDir> already guard this way.
+rm -f "$STATE/launch-cwd" 2>/dev/null || true
+printf '%s\n' "$PWD" > "$STATE/launch-cwd" 2>/dev/null || true
 
 SETTINGS='{"statusLine":{"type":"command","command":"'"$REPO/sidecar/ccr-statusline"'"}}'
 
@@ -69,17 +106,36 @@ trap 'rm -f "$RUN_CONF"' EXIT
 cp "$REPO/sidecar/ccr.tmux.conf" "$RUN_CONF"
 
 # Clean re-launch.
-tmux kill-session -t "$SESSION" 2>/dev/null || true
-
-ENV_PREAMBLE="export CCR_STATE_DIR='$STATE'"
+tmux -L "$SOCKET" kill-session -t "$SESSION" 2>/dev/null || true
+
+# These strings are handed to `sh -c` by tmux — ONE parsing layer, so ordinary
+# shell escaping is both necessary and sufficient. $STATE and $SESSION are not
+# validated the way a profile name is (they come from $HOME and the CCR_SESSION
+# / CCR_STATE_DIR overrides), and an apostrophe in either would otherwise end
+# the quoting and run the remainder as a command.
+STATE_Q="$(sq "$STATE")"
+SESSION_Q="$(sq "$SESSION")"
+SOCKET_Q="$(sq "$SOCKET")"
+ENV_PREAMBLE="export CCR_STATE_DIR='$STATE_Q'"
 
 # Pane 0: claude/ccs with --settings. On exit, drop the sentinel then close.
-tmux new-session -d -s "$SESSION" \
-  "$ENV_PREAMBLE; $CC_CMD --settings '$SETTINGS'; touch '$STATE/exited'; sleep 2; tmux kill-session -t '$SESSION' 2>/dev/null"
-tmux set-environment -t "$SESSION" CCR_STATE_DIR "$STATE"
+# Capture its pane id: the F2 hotkey below must target %N, never a relative
+# index (see the binding comment further down).
+CLAUDE_PANE="$(tmux -L "$SOCKET" new-session -d -P -F '#{pane_id}' -s "$SESSION" \
+  "$ENV_PREAMBLE; $CC_CMD --settings '$SETTINGS'; touch '$STATE_Q/exited'; sleep 2; tmux -L '$SOCKET_Q' kill-session -t '$SESSION_Q' 2>/dev/null")"
+tmux -L "$SOCKET" set-environment -t "$SESSION" CCR_STATE_DIR "$STATE"
+
+# The tab's ADDRESS: composed once by the launcher (CCR_TITLE = "[profile / ]name",
+# both halves allow-listed), never retitled mid-session. set-titles-string is a
+# literal — deliberately NOT a tmux format that would follow the session; the
+# pane and the status line are the surfaces honest about movement.
+if [ -n "${CCR_TITLE:-}" ]; then
+  tmux -L "$SOCKET" set-option -t "$SESSION" set-titles on
+  tmux -L "$SOCKET" set-option -t "$SESSION" set-titles-string "$CCR_TITLE"
+fi
 
 # Pane 1: the live economy sidebar. Capture its pane id so we can scope a hook to it.
-SIDEBAR_PANE="$(tmux split-window -t "$SESSION:0" -h -p "${CCR_SIDEBAR_PCT:-34}" -P -F '#{pane_id}' \
+SIDEBAR_PANE="$(tmux -L "$SOCKET" split-window -t "$SESSION:0" -h -p "${CCR_SIDEBAR_PCT:-34}" -P -F '#{pane_id}' \
   "$ENV_PREAMBLE; \"$NODE\" \"$REPO/bin/ccr.js\" sidecar; read -r -p 'sidebar exited — Enter to close '")"
 
 # The sidebar is a live dashboard — there is nothing to scroll. A stray mouse-wheel
@@ -91,10 +147,59 @@ SIDEBAR_PANE="$(tmux split-window -t "$SESSION:0" -h -p "${CCR_SIDEBAR_PCT:-34}"
 # re-fires this hook with pane_in_mode=0, so the guard stops it recursing. Best-effort:
 # pane-scoped hooks need tmux >= 3.2; older tmux just skips the guard (|| true).
 if [ -n "$SIDEBAR_PANE" ]; then
-  tmux set-hook -p -t "$SIDEBAR_PANE" pane-mode-changed \
+  tmux -L "$SOCKET" set-hook -p -t "$SIDEBAR_PANE" pane-mode-changed \
     "if-shell -F '#{pane_in_mode}' 'send-keys -t $SIDEBAR_PANE -X cancel'" 2>/dev/null || true
 fi
 
-tmux select-pane -t "$SESSION:0.0"
-tmux source-file -t "$SESSION" "$RUN_CONF"
-tmux attach -t "$SESSION"
+# F2 → /clear: the one hotkey ccr ships. The text is a CONSTANT in this script —
+# never configuration, never a prompt file, never blob content (the pane
+# subsystem has no path to a key binding at all; docs/PANE-CONTRACT.md). It
+# targets the pane id captured above, because a relative index like `.0`
+# retargets after any split or swap. confirm-before makes a stray F2 cost one
+# keypress rather than a whole context. If no pane id came back (a tmux too old
+# for `new-session -P`), NO hotkey is bound — never an approximate target.
+if [ -n "$CLAUDE_PANE" ]; then
+  printf "bind-key -n F2 confirm-before -p 'send /clear to Claude? (y/n) ' \"send-keys -t %s '/clear' Enter\"\n" \
+    "$CLAUDE_PANE" >> "$RUN_CONF"
+fi
+
+# F3 → cycle the sidebar's view (economy ⇄ each configured external pane).
+# It runs `ccr cycle-view`, which records a request the sidecar picks up on its
+# next tick; the sidecar never reads a keystroke itself, because an input
+# channel is precisely the capability the pane threat model denies it
+# (docs/PANE-CONTRACT.md). No confirm gate: cycling costs nothing and is undone
+# by pressing again.
+#
+# The paths go in a generated SCRIPT, not into the binding. $STATE, $REPO and
+# $NODE derive from $HOME, $CCR_STATE_DIR and the checkout location — none of
+# which this script validates the way it validates a profile name — and a lone
+# apostrophe in any of them used to close the quoting so the rest ran as a
+# command (reproduced 2026-08-02, and again after a first "fix").
+#
+# Shell-escaping alone is NOT enough here, which is the subtle part: a binding
+# in this file passes through TWO parsers. tmux reads the config line first and
+# processes backslashes inside its double quotes, so a shell-level '\'' arrives
+# at sh already stripped to '' — closing the quote after all. Escaping correctly
+# for both layers at once is the kind of thing that looks right and isn't.
+#
+# So: one parsing layer each. The helper script holds the paths with ordinary
+# shell quoting (sq is exactly right for that), and the config line names only
+# the helper's own mktemp path inside tmux SINGLE quotes, where tmux performs no
+# escape processing at all. If that path could itself contain a quote we bind
+# nothing rather than emit a line we cannot reason about.
+CYCLE_SH="$(mktemp "${TMPDIR:-/tmp}/ccr-cycle.XXXXXX")"
+trap 'rm -f "$RUN_CONF" "$CYCLE_SH"' EXIT
+{
+  printf '#!/bin/sh\n'
+  printf "exec '%s' '%s' cycle-view --state-dir '%s'\n" \
+    "$(sq "$NODE")" "$(sq "$REPO/bin/ccr.js")" "$(sq "$STATE")"
+} > "$CYCLE_SH"
+chmod 700 "$CYCLE_SH"
+case "$CYCLE_SH" in
+  *\'*) echo "ccr: TMPDIR contains a quote — F3 (cycle view) not bound" >&2 ;;
+  *) printf "bind-key -n F3 run-shell '%s'\n" "$CYCLE_SH" >> "$RUN_CONF" ;;
+esac
+
+tmux -L "$SOCKET" select-pane -t "$SESSION:0.0"
+tmux -L "$SOCKET" source-file -t "$SESSION" "$RUN_CONF"
+tmux -L "$SOCKET" attach -t "$SESSION"

package/sidecar/ccr.tmux.conf

@@ -1,8 +1,16 @@
-# sidecar/ccr.tmux.conf — applies ONLY to ccr's own tmux session, never your
-# global tmux config. Minimal bindings — just F2 → /clear.
+# sidecar/ccr.tmux.conf — sourced into ccr's OWN tmux server (each instance
+# runs on its own -L socket; scripts/launch.sh), so the `set -g` lines and the
+# root-table binding below can never touch your personal tmux server or
+# another ccr profile's. Minimal bindings.
 
-# F2 — send /clear to the Claude pane (reset context before compaction hits).
-bind-key -n F2 send-keys -t .0 '/clear' Enter
+# The F2 → /clear hotkey is deliberately NOT bound here. scripts/launch.sh
+# appends it to the per-session copy of this file, because that is the only
+# place that knows the Claude pane's id (%N), captured when the session is
+# created. A binding written here could only name a RELATIVE index like `.0`,
+# which silently retargets after any split or swap — sending /clear to
+# whichever pane happens to be first at the time. See docs/PANE-CONTRACT.md
+# ("Hotkeys are a host capability"): configuration chooses which key, ccr's
+# own code chooses the text, and the target is always the captured id.
 
 set -g mouse on
 set -g status off

package/src/account-limits.js

@@ -33,7 +33,8 @@ const { parseResetsAt } = require('./burn');
 const { modelScope } = require('./rate-limits');
 
 const MAX_SNAPSHOT_BYTES = 1_000_000; // a status JSON is a few KB; bound parse/disk
-const MAX_PROFILES = 32;              // sanity cap on how many siblings we scan
+const MAX_PROFILES = 32;              // sanity cap on how many siblings we merge
+const MAX_SCAN_ENTRIES = 512;         // sanity cap on how many dir entries we inspect
 
 /**
  * Canonical reset instant for fingerprinting/matching — tolerant of CC reporting
@@ -127,12 +128,14 @@ function readSiblingRateLimits(file) {
  * reconcile the local meters against them. Best-effort — returns `localRl` on any
  * problem so it can wrap the render path without a guard at the call site.
  *
- * Engages ONLY for the launcher's profile layout (`~/.ccr/<profile>`): the state
- * dir's parent must be `~/.ccr`. For ad-hoc `~/.ccr` or a custom CCR_STATE_DIR we
- * have no sibling set to trust, so we behave exactly as before (no merge).
+ * Engages ONLY for the launcher's layout: instances under `~/.ccr/instances/`
+ * (the 0.4.0 container/member split — src/instance-slot.js). A custom
+ * CCR_STATE_DIR elsewhere has no sibling set to trust, so it behaves as
+ * before (no merge). There is no slot-1 special case any more: slot 1 is an
+ * ordinary member of instances/, which is exactly why the layout changed.
  *
  * @param {any} localRl the local snapshot's `rate_limits`
- * @param {string} stateDir the local profile's state dir (CCR_STATE_DIR)
+ * @param {string} stateDir the local instance's state dir (CCR_STATE_DIR)
  * @param {{ home?: string }} [opts]
  * @returns {any}
  */
@@ -140,21 +143,26 @@ function freshenAccountLimits(localRl, stateDir, opts = {}) {
   try {
     if (!localRl || typeof localRl !== 'object') return localRl;
     const home = opts.home || os.homedir();
-    const root = path.dirname(path.resolve(stateDir));
-    if (root !== path.resolve(path.join(home, '.ccr'))) return localRl; // not a profile layout
+    const root = path.resolve(path.join(home, '.ccr', 'instances'));
+    const self = path.resolve(stateDir);
+    if (path.dirname(self) !== root) return localRl; // not the launcher's layout
     const selfFile = path.resolve(path.join(stateDir, 'last-status.json'));
 
     /** @type {any[]} */
     const siblings = [];
+    // Bound the WALK, not just the harvest: MAX_PROFILES alone counts collected
+    // siblings, so entries that yield nothing — slot dirs with no snapshot yet,
+    // junk — would all be stat'd on every tick. This runs inside the sidecar's
+    // ~1s draw loop, so the scan stays capped by entries seen even though
+    // instances/ holds only instance dirs under the 0.4.0 layout.
+    let seen = 0;
     for (const name of fs.readdirSync(root)) {
-      if (siblings.length >= MAX_PROFILES) break;
+      if (siblings.length >= MAX_PROFILES || ++seen > MAX_SCAN_ENTRIES) break;
       const p = path.join(root, name);
       let st; try { st = fs.statSync(p); } catch { continue; }
-      // A sibling profile dir (~/.ccr/<name>/last-status.json) or the ad-hoc
-      // ~/.ccr/last-status.json file itself.
-      const file = st.isDirectory() ? path.join(p, 'last-status.json')
-        : (name === 'last-status.json' ? p : null);
-      if (!file || path.resolve(file) === selfFile) continue;
+      if (!st.isDirectory()) continue;
+      const file = path.join(p, 'last-status.json');
+      if (path.resolve(file) === selfFile) continue;
       const rl = readSiblingRateLimits(file);
       if (rl) siblings.push(rl);
     }

package/src/burn.js

@@ -131,11 +131,15 @@ function clearROI(o) {
     return { boughtMinutes: 0, projectedBurn: o.rate };
   }
   let ratio;
-  if (o.calib) {
-    const w = (x) => Math.max(o.calib.a * x + o.calib.b, 1e-9);
+  // Bind the calibration outside the closure: narrowing does not survive into a
+  // function body (the callback could in principle run after o.calib changed),
+  // and binding it also means the reader need not reason about reentrancy.
+  const calib = o.calib;
+  if (calib) {
+    const w = (/** @type {number} */ x) => Math.max(calib.a * x + calib.b, 1e-9);
     ratio = w(o.baselineB) / w(o.contextC);
   } else {
-    const w = (x) => READ_WEIGHT * x + K_TAIL;
+    const w = (/** @type {number} */ x) => READ_WEIGHT * x + K_TAIL;
     ratio = w(o.baselineB) / w(o.contextC);
   }
   // A clear can't shed the output/write tail or the retained baseline, so burn

package/src/cycle-view.js

@@ -0,0 +1,78 @@
+// @ts-check
+'use strict';
+// src/cycle-view.js — ask the running sidecar to show its next view.
+//
+// The sidecar reads no stdin, by construction: an input channel is exactly the
+// capability the pane threat model refuses it (docs/PANE-CONTRACT.md,
+// "Structural invariants"). So the host binds a key, the key runs this, and
+// this leaves a REQUEST the sidecar picks up on its next tick.
+//
+// WHY A FILE AND NOT A SIGNAL. The first version of this read the sidecar's pid
+// from its heartbeat file and sent SIGUSR1. That was wrong, and an adversarial
+// review reproduced the consequence: the heartbeat lives in a directory
+// anything running as the user can write (src/safe-read.js says so in its own
+// header), so writing "<victim_pid>:<now>" into it redirected the signal at any
+// process of the user's choosing — and SIGUSR1's default disposition is
+// terminate. A cosmetic "show me the next pane" key was a kill primitive.
+//
+// No guard fixes that, because the pid and its freshness both come from the
+// attacker's own file: a liveness probe only proves the victim exists. The
+// mechanism had to change, not gain checks. Writing a request costs the same
+// attacker exactly what they should get — the ability to change which pane is
+// on screen — and nothing else.
+//
+// The cost is latency: the sidecar notices on its next tick, so up to ~1s. That
+// is the honest price for not holding a loaded weapon, and a keypress that
+// repaints within a second reads as responsive anyway.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { readTextCapped } = require('./safe-read');
+
+/** The request file the sidecar polls. Content is a counter, not a command. */
+const REQUEST_FILE = 'view-request';
+
+/**
+ * Record a request to advance the view. Never throws: a keypress that cannot
+ * write is a no-op, not an error worth painting over the user's terminal.
+ * @param {string} stateDir
+ * @returns {{ ok: boolean, reason?: string, count?: number }}
+ */
+function cycleView(stateDir) {
+  const file = path.join(stateDir, REQUEST_FILE);
+  // Monotonic counter rather than a timestamp: two presses inside the same
+  // millisecond must still read as two requests.
+  // Capped, regular-files-only: a fifo planted here would otherwise block this
+  // process forever, and under tmux run-shell every keypress would leak another
+  // hung node. Same rule as every other file the sidecar reads.
+  let count = 0;
+  const cur = (readTextCapped(file, 64) || '').trim();
+  if (/^\d+$/.test(cur)) count = Number(cur);
+  if (!Number.isSafeInteger(count) || count < 0) count = 0;
+
+  try {
+    // Never write THROUGH a symlink planted at this path.
+    try { if (fs.lstatSync(file).isSymbolicLink()) fs.rmSync(file, { force: true }); } catch { /* absent */ }
+    fs.writeFileSync(file, String(count + 1));
+    return { ok: true, count: count + 1 };
+  } catch {
+    return { ok: false, reason: 'state dir not writable' };
+  }
+}
+
+/**
+ * How many advance-requests have been recorded. The sidecar calls this each
+ * tick and advances its view by the DIFFERENCE since the previous tick, so a
+ * request that arrives while the pane is busy is never lost, and a burst of
+ * presses advances by the number pressed.
+ * @param {string} stateDir
+ * @returns {number}
+ */
+function readViewRequests(stateDir) {
+  const cur = (readTextCapped(path.join(stateDir, REQUEST_FILE), 64) || '').trim();
+  if (!/^\d+$/.test(cur)) return 0;
+  const n = Number(cur);
+  return Number.isSafeInteger(n) && n >= 0 ? n : 0;
+}
+
+module.exports = { cycleView, readViewRequests, REQUEST_FILE };

package/src/doctor.js

@@ -82,6 +82,7 @@ function run(opts = {}) {
 
   const ccs = hasFn('ccs');
   if (ccs) {
+    /** @type {string[]} */
     let profiles = [];
     try { profiles = fs.readdirSync(path.join(homedir, '.ccs', 'instances')).filter((p) => !p.startsWith('.')); } catch { /* none */ }
     // Profile + path come from the filesystem; sanitize before display.
@@ -90,8 +91,12 @@ function run(opts = {}) {
     out.push(dim('· ccs not installed (optional — only for `ccr <profile>`)'));
   }
 
-  // newest captured snapshot across ~/.ccr and its per-profile subdirs (state
-  // lives under the user's home now, never world-shared /tmp).
+  // newest captured snapshot across the container. Instances live TWO levels
+  // down under the 0.4.0 layout (~/.ccr/instances/<n>/last-status.json) — the
+  // one-level scan alone would report "no status captured" while instances run
+  // fine (features/instance-lifecycle.feature: "doctor finds a live instance's
+  // captured status"). The root and one-level entries are still scanned so a
+  // pre-migration home keeps diagnosing.
   const ccrDir = path.join(homedir, '.ccr');
   const dirs = [ccrDir];
   try {
@@ -100,12 +105,20 @@ function run(opts = {}) {
       try { if (fs.statSync(sub).isDirectory()) dirs.push(sub); } catch { /* ignore */ }
     }
   } catch { /* none */ }
+  try {
+    const inst = path.join(ccrDir, 'instances');
+    for (const d of fs.readdirSync(inst)) {
+      const sub = path.join(inst, d);
+      try { if (fs.statSync(sub).isDirectory()) dirs.push(sub); } catch { /* ignore */ }
+    }
+  } catch { /* none */ }
   let newest = null;
   for (const d of dirs) {
     try { const m = fs.statSync(path.join(d, 'last-status.json')).mtimeMs; if (!newest || m > newest.m) newest = { d, m }; } catch { /* none */ }
   }
   if (newest) {
     const ageMin = Math.round((Date.now() - newest.m) / 60000);
+    /** @type {string[]} */
     let keys = [];
     try { keys = Object.keys(JSON.parse(fs.readFileSync(path.join(newest.d, 'last-status.json'), 'utf8')).rate_limits || {}); } catch { /* ignore */ }
     // Defense-in-depth: sanitize the dir + bucket keys before display even

package/src/economy-model.js

@@ -38,6 +38,9 @@ function band(min) {
  * @returns {{ rows: any[], next: any }}
  */
 function classifyWindows(view) {
+  // Annotated because Array.isArray does not narrow an `any`: without this the
+  // whole chain below decays to `any` and the row callbacks lose their types.
+  /** @type {any[]} */
   const windows = Array.isArray(view.windows) ? view.windows : [];
   const rows = windows.map((/** @type {any} */ wd) => {
     const est = windowEstimate({ usedPct: wd.usedPct, rate: wd.rate, minutesToReset: wd.minutesToReset, windowMinutes: wd.windowMinutes });