local-commander-agent 0.3.52 → 0.3.53

package/bin/monitor-mcp.mjs

@@ -1,136 +1,136 @@
-import { readdir, lstat } from "node:fs/promises";
-import path from "node:path";
-import { readState, presenceDirectory } from "./monitor-agents.mjs";
-
-const text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f-\u009f]/u.test(value);
-const count = value => Number.isSafeInteger(value) && value >= 0 && value <= 1e12;
-const id = value => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/.test(value);
-const nullable = (value, test) => value === null || test(value);
-const tool = value => typeof value === "string" && /^[a-z_]{1,64}$/.test(value);
-const model = value => text(value, 80) && /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,79}$/.test(value);
-const name = value => text(value, 8) && /^[A-Za-z][A-Za-z0-9]{0,7}$/.test(value);
-const preview = row => {
-  if (row.preview === undefined) return row.command;
-  if (!text(row.preview, 240)) throw Error("MCP_MONITOR_INVALID");
-  return row.preview;
-};
-const optionalModel = row => row.model === undefined || row.model === null ? null : model(row.model) ? row.model : invalid();
-const optionalExit = row => row.exitCode === undefined || row.exitCode === null ? null : Number.isInteger(row.exitCode) && Math.abs(row.exitCode) <= 2147483648 ? row.exitCode : invalid();
-const invalid = () => { throw Error("MCP_MONITOR_INVALID"); };
-function agentView(a) {
-  if (a === null) return null;
-  if (!a || !id(a.runtimeId) || !name(a.name) ||
-      !nullable(a.model, model) || !nullable(a.activity, value => text(value, 500)) ||
-      !["working", "analysis", "message", "idle"].includes(a.phase) || !nullable(a.taskId, id) || !nullable(a.project, value => text(value, 96))) invalid();
-  return { runtimeId: a.runtimeId, name: a.name, model: a.model, activity: a.activity, phase: a.phase, taskId: a.taskId, project: a.project };
-}
-export function contextView(raw) {
-  if (!raw || !nullable(raw.project, value => text(value, 96)) || !nullable(raw.directory, value => text(value, 96)) ||
-      !nullable(raw.taskId, id) || !nullable(raw.pr, value => count(value) && value > 0 && value <= 9_999_999) || typeof raw.inferred !== "boolean") invalid();
-  return { project: raw.project, directory: raw.directory, taskId: raw.taskId, pr: raw.pr, inferred: raw.inferred };
-}
-export function mcpView(raw, alive = pid => { try { process.kill(pid, 0); return true; } catch (error) { return error.code === "EPERM"; } }) {
-  if (!raw || raw.schemaVersion !== 1 || !/^[a-f0-9-]{36}$/.test(raw.instanceId) || !count(raw.pid) || !raw.pid || !text(raw.computer, 64) ||
-      typeof raw.updatedAt !== "string" || !Number.isFinite(Date.parse(raw.updatedAt)) || !nullable(raw.queue, count) ||
-      ![raw.dropped, raw.writeErrors, raw.writes].every(count) || !Array.isArray(raw.calls) || raw.calls.length > 256 ||
-      !Array.isArray(raw.events) || raw.events.length > 100 || !Array.isArray(raw.metrics) || raw.metrics.length > 64) invalid();
-  const command = row => {
-    if (!tool(row.tool) || !text(row.command, 80) || !(row.command === row.tool ||
-      row.tool === "agent_message" && /^agent_message (?:send|inbox|ack)(?: (?:status|question|answer|handoff|result_summary|blocker))?(?: -> [A-Za-z0-9_.:-]{1,8})?$/.test(row.command) ||
-      /^(?:node|npm|npx|git|rg|powershell|pwsh|cmd|tsc|python|dotnet|gh|command)(?: \[args\]| --test| (?:status|diff|log|show|fetch|pull|push|commit|test|install|ci|pack|publish)| run (?:test|build|typecheck|lint|dev|start))?$/.test(row.command))) invalid();
-    return row.command;
-  };
-  const calls = raw.calls.map(row => {
-    if (!count(row.id) || !["accepted", "queued", "running"].includes(row.state) || !Number.isSafeInteger(row.at) || row.at < 1 || row.at > Date.now() + 5000) invalid();
-    const agent = agentView(row.agent);
-    return { id: row.id, tool: row.tool, command: command(row), preview: preview(row), state: row.state, at: row.at, agent, context: contextView(row.context) };
-  });
-  const metrics = raw.metrics.map(row => {
-    if (!tool(row.tool) || ![row.calls, row.errors, row.sentBytes, row.savedBytes, row.outputBytes, row.durationMs].every(count) || row.errors > row.calls) invalid();
-    return Object.fromEntries(["tool", "calls", "errors", "sentBytes", "savedBytes", "outputBytes", "durationMs"].map(key => [key, row[key]]));
-  });
-  if (raw.agents !== undefined && (!Array.isArray(raw.agents) || raw.agents.length > 64)) invalid();
-  const agents = (raw.agents ?? []).map(row => {
-    if (!id(row.runtimeId) || !name(row.name) || !nullable(row.model, model) ||
-        ![row.calls, row.errors, row.sentBytes, row.savedBytes, row.outputBytes, row.durationMs].every(count) || row.errors > row.calls) invalid();
-    return Object.fromEntries(["runtimeId", "name", "model", "calls", "errors", "sentBytes", "savedBytes", "outputBytes", "durationMs"].map(key => [key, row[key]]));
-  });
-  if (raw.processes !== undefined && (!Array.isArray(raw.processes) || raw.processes.length > 64)) invalid();
-  const processes = (raw.processes ?? []).map(row => {
-    if (!id(row.id) || !count(row.pid) || !row.pid) invalid();
-    return { id: row.id, pid: row.pid, command: command({ tool: "process_start", command: row.command }), preview: preview(row), context: contextView(row.context), agent: agentView(row.agent) };
-  });
-  const events = raw.events.map(row => {
-    if (!count(row.id) || typeof row.at !== "string" || !Number.isFinite(Date.parse(row.at)) || !["failed", "finished"].includes(row.state) ||
-        !nullable(row.agent, id) || !nullable(row.name, name) ||
-        !nullable(row.code, value => /^[A-Z][A-Z0-9_]{0,63}$/.test(value)) || ![row.durationMs, row.sentBytes, row.savedBytes].every(count)) invalid();
-    return { id: row.id, at: row.at, tool: row.tool, command: command(row), preview: preview(row), state: row.state, agent: row.agent, name: row.name,
-      context: contextView(row.context), model: optionalModel(row), exitCode: optionalExit(row), timedOut: row.timedOut === true, code: row.code, durationMs: row.durationMs, sentBytes: row.sentBytes, savedBytes: row.savedBytes };
-  });
-  if (raw.transitions !== undefined && (!Array.isArray(raw.transitions) || raw.transitions.length > 100)) invalid();
-  const transitions = (raw.transitions ?? []).map(row => {
-    if (!count(row.seq) || !count(row.id) || row.state !== "running" || !tool(row.tool) ||
-        typeof row.at !== "string" || !Number.isFinite(Date.parse(row.at)) || !nullable(row.name, name) || !text(row.preview, 240)) invalid();
-    return { seq: row.seq, id: row.id, at: row.at, tool: row.tool, preview: row.preview, state: row.state,
-      context: contextView(row.context), name: row.name, model: optionalModel(row) };
-  });
-  return { instanceId: raw.instanceId, pid: raw.pid, computer: raw.computer, updatedAt: raw.updatedAt, running: alive(raw.pid), queue: raw.queue,
-    calls, processes, agents, metrics, events, transitions, dropped: raw.dropped, writeErrors: raw.writeErrors, writes: raw.writes };
-}
-export async function readMcpActivity(projectRoot = process.cwd()) {
-  const directory = path.join(presenceDirectory(projectRoot), "activity");
-  let entries;
-  try {
-    const stat = await lstat(directory);
-    if (!stat.isDirectory() || stat.isSymbolicLink()) invalid();
-    entries = (await readdir(directory)).filter(name => /^\d+-[a-f0-9-]{36}\.json$/.test(name)).sort();
-  } catch (error) { return { instances: [], unavailable: error.code === "ENOENT" ? 0 : 1 }; }
-  const instances = [];
-  let unavailable = Math.max(0, entries.length - 32);
-  for (const name of entries.slice(-32)) {
-    try { instances.push(mcpView(await readState(path.join(directory, name)))); } catch { unavailable++; }
-  }
-  return { instances: instances.sort((a, b) => a.instanceId.localeCompare(b.instanceId)), unavailable };
-}
-
-let healthCache;
-/** Probe only the existing loopback health route, once per 30s; idle activity age is not health. */
-export async function readMcpHealth(projectRoot = process.cwd()) {
-  if (healthCache && Date.now() - healthCache.time < 30_000) return healthCache.result;
-  let endpoint = "http://127.0.0.1:17321/health", configured = false;
-  try {
-    const file = path.resolve(projectRoot, process.env.LCMCP_CONFIG?.trim() || "local-commander.config.json");
-    const stat = await lstat(file);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65_536) throw Error("CONFIG_INVALID");
-    const config = await readState(file);
-    const host = config.server?.host ?? "127.0.0.1", port = config.server?.port ?? 17321;
-    if (!["localhost", "127.0.0.1", "::1"].includes(host) || !Number.isInteger(port) || port < 1 || port > 65535) throw Error("HEALTH_NOT_LOOPBACK");
-    endpoint = "http://" + (host === "::1" ? "[::1]" : host) + ":" + port + "/health";
-    configured = true;
-  } catch (error) {
-    if (error.code !== "ENOENT") return { state: "unavailable", status: null, at: new Date().toISOString(), latencyMs: null };
-  }
-  const start = Date.now();
-  let result;
-  try {
-    const response = await fetch(endpoint, { signal: AbortSignal.timeout(800), redirect: "error" });
-    const reader = response.body?.getReader();
-    let body = "", bytes = 0;
-    if (reader) {
-      try {
-        while (true) {
-          const chunk = await reader.read();
-          if (chunk.done) break;
-          bytes += chunk.value.byteLength;
-          if (bytes > 2048) throw Error("HEALTH_RESPONSE_LIMIT");
-          body += Buffer.from(chunk.value).toString("utf8");
-        }
-      } finally { void reader.cancel().catch(() => {}); }
-    }
-    const value = JSON.parse(body);
-    result = { state: response.ok && value.status === "ok" ? "healthy" : "failed", status: response.status,
-      at: new Date().toISOString(), latencyMs: Date.now() - start };
-  } catch { result = { state: configured ? "unreachable" : "not observed", status: null, at: new Date().toISOString(), latencyMs: Date.now() - start }; }
-  healthCache = { time: Date.now(), result };
-  return result;
-}
+import { readdir, lstat } from "node:fs/promises";
+import path from "node:path";
+import { readState, presenceDirectory } from "./monitor-agents.mjs";
+
+const text = (value, max) => typeof value === "string" && value.length <= max && !/[\u0000-\u001f\u007f-\u009f]/u.test(value);
+const count = value => Number.isSafeInteger(value) && value >= 0 && value <= 1e12;
+const id = value => typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,95}$/.test(value);
+const nullable = (value, test) => value === null || test(value);
+const tool = value => typeof value === "string" && /^[a-z_]{1,64}$/.test(value);
+const model = value => text(value, 80) && /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,79}$/.test(value);
+const name = value => text(value, 8) && /^[A-Za-z][A-Za-z0-9]{0,7}$/.test(value);
+const preview = row => {
+  if (row.preview === undefined) return row.command;
+  if (!text(row.preview, 240)) throw Error("MCP_MONITOR_INVALID");
+  return row.preview;
+};
+const optionalModel = row => row.model === undefined || row.model === null ? null : model(row.model) ? row.model : invalid();
+const optionalExit = row => row.exitCode === undefined || row.exitCode === null ? null : Number.isInteger(row.exitCode) && Math.abs(row.exitCode) <= 2147483648 ? row.exitCode : invalid();
+const invalid = () => { throw Error("MCP_MONITOR_INVALID"); };
+function agentView(a) {
+  if (a === null) return null;
+  if (!a || !id(a.runtimeId) || !name(a.name) ||
+      !nullable(a.model, model) || !nullable(a.activity, value => text(value, 500)) ||
+      !["working", "analysis", "message", "idle"].includes(a.phase) || !nullable(a.taskId, id) || !nullable(a.project, value => text(value, 96))) invalid();
+  return { runtimeId: a.runtimeId, name: a.name, model: a.model, activity: a.activity, phase: a.phase, taskId: a.taskId, project: a.project };
+}
+export function contextView(raw) {
+  if (!raw || !nullable(raw.project, value => text(value, 96)) || !nullable(raw.directory, value => text(value, 96)) ||
+      !nullable(raw.taskId, id) || !nullable(raw.pr, value => count(value) && value > 0 && value <= 9_999_999) || typeof raw.inferred !== "boolean") invalid();
+  return { project: raw.project, directory: raw.directory, taskId: raw.taskId, pr: raw.pr, inferred: raw.inferred };
+}
+export function mcpView(raw, alive = pid => { try { process.kill(pid, 0); return true; } catch (error) { return error.code === "EPERM"; } }) {
+  if (!raw || raw.schemaVersion !== 1 || !/^[a-f0-9-]{36}$/.test(raw.instanceId) || !count(raw.pid) || !raw.pid || !text(raw.computer, 64) ||
+      typeof raw.updatedAt !== "string" || !Number.isFinite(Date.parse(raw.updatedAt)) || !nullable(raw.queue, count) ||
+      ![raw.dropped, raw.writeErrors, raw.writes].every(count) || !Array.isArray(raw.calls) || raw.calls.length > 256 ||
+      !Array.isArray(raw.events) || raw.events.length > 100 || !Array.isArray(raw.metrics) || raw.metrics.length > 64) invalid();
+  const command = row => {
+    if (!tool(row.tool) || !text(row.command, 80) || !(row.command === row.tool ||
+      row.tool === "agent_message" && /^agent_message (?:send|inbox|ack)(?: (?:status|question|answer|handoff|result_summary|blocker))?(?: -> [A-Za-z0-9_.:-]{1,8})?$/.test(row.command) ||
+      /^(?:node|npm|npx|git|rg|powershell|pwsh|cmd|tsc|python|dotnet|gh|command)(?: \[args\]| --test| (?:status|diff|log|show|fetch|pull|push|commit|test|install|ci|pack|publish)| run (?:test|build|typecheck|lint|dev|start))?$/.test(row.command))) invalid();
+    return row.command;
+  };
+  const calls = raw.calls.map(row => {
+    if (!count(row.id) || !["accepted", "queued", "running"].includes(row.state) || !Number.isSafeInteger(row.at) || row.at < 1 || row.at > Date.now() + 5000) invalid();
+    const agent = agentView(row.agent);
+    return { id: row.id, tool: row.tool, command: command(row), preview: preview(row), state: row.state, at: row.at, agent, context: contextView(row.context) };
+  });
+  const metrics = raw.metrics.map(row => {
+    if (!tool(row.tool) || ![row.calls, row.errors, row.sentBytes, row.savedBytes, row.outputBytes, row.durationMs].every(count) || row.errors > row.calls) invalid();
+    return Object.fromEntries(["tool", "calls", "errors", "sentBytes", "savedBytes", "outputBytes", "durationMs"].map(key => [key, row[key]]));
+  });
+  if (raw.agents !== undefined && (!Array.isArray(raw.agents) || raw.agents.length > 64)) invalid();
+  const agents = (raw.agents ?? []).map(row => {
+    if (!id(row.runtimeId) || !name(row.name) || !nullable(row.model, model) ||
+        ![row.calls, row.errors, row.sentBytes, row.savedBytes, row.outputBytes, row.durationMs].every(count) || row.errors > row.calls) invalid();
+    return Object.fromEntries(["runtimeId", "name", "model", "calls", "errors", "sentBytes", "savedBytes", "outputBytes", "durationMs"].map(key => [key, row[key]]));
+  });
+  if (raw.processes !== undefined && (!Array.isArray(raw.processes) || raw.processes.length > 64)) invalid();
+  const processes = (raw.processes ?? []).map(row => {
+    if (!id(row.id) || !count(row.pid) || !row.pid) invalid();
+    return { id: row.id, pid: row.pid, command: command({ tool: "process_start", command: row.command }), preview: preview(row), context: contextView(row.context), agent: agentView(row.agent) };
+  });
+  const events = raw.events.map(row => {
+    if (!count(row.id) || typeof row.at !== "string" || !Number.isFinite(Date.parse(row.at)) || !["failed", "finished"].includes(row.state) ||
+        !nullable(row.agent, id) || !nullable(row.name, name) ||
+        !nullable(row.code, value => /^[A-Z][A-Z0-9_]{0,63}$/.test(value)) || ![row.durationMs, row.sentBytes, row.savedBytes].every(count)) invalid();
+    return { id: row.id, at: row.at, tool: row.tool, command: command(row), preview: preview(row), state: row.state, agent: row.agent, name: row.name,
+      context: contextView(row.context), model: optionalModel(row), exitCode: optionalExit(row), timedOut: row.timedOut === true, code: row.code, durationMs: row.durationMs, sentBytes: row.sentBytes, savedBytes: row.savedBytes };
+  });
+  if (raw.transitions !== undefined && (!Array.isArray(raw.transitions) || raw.transitions.length > 100)) invalid();
+  const transitions = (raw.transitions ?? []).map(row => {
+    if (!count(row.seq) || !count(row.id) || row.state !== "running" || !tool(row.tool) ||
+        typeof row.at !== "string" || !Number.isFinite(Date.parse(row.at)) || !nullable(row.name, name) || !text(row.preview, 240)) invalid();
+    return { seq: row.seq, id: row.id, at: row.at, tool: row.tool, preview: row.preview, state: row.state,
+      context: contextView(row.context), name: row.name, model: optionalModel(row) };
+  });
+  return { instanceId: raw.instanceId, pid: raw.pid, computer: raw.computer, updatedAt: raw.updatedAt, running: alive(raw.pid), queue: raw.queue,
+    calls, processes, agents, metrics, events, transitions, dropped: raw.dropped, writeErrors: raw.writeErrors, writes: raw.writes };
+}
+export async function readMcpActivity(projectRoot = process.cwd()) {
+  const directory = path.join(presenceDirectory(projectRoot), "activity");
+  let entries;
+  try {
+    const stat = await lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) invalid();
+    entries = (await readdir(directory)).filter(name => /^\d+-[a-f0-9-]{36}\.json$/.test(name)).sort();
+  } catch (error) { return { instances: [], unavailable: error.code === "ENOENT" ? 0 : 1 }; }
+  const instances = [];
+  let unavailable = Math.max(0, entries.length - 32);
+  for (const name of entries.slice(-32)) {
+    try { instances.push(mcpView(await readState(path.join(directory, name)))); } catch { unavailable++; }
+  }
+  return { instances: instances.sort((a, b) => a.instanceId.localeCompare(b.instanceId)), unavailable };
+}
+
+let healthCache;
+/** Probe only the existing loopback health route, once per 30s; idle activity age is not health. */
+export async function readMcpHealth(projectRoot = process.cwd()) {
+  if (healthCache && Date.now() - healthCache.time < 30_000) return healthCache.result;
+  let endpoint = "http://127.0.0.1:17321/health", configured = false;
+  try {
+    const file = path.resolve(projectRoot, process.env.LCMCP_CONFIG?.trim() || "local-commander.config.json");
+    const stat = await lstat(file);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 65_536) throw Error("CONFIG_INVALID");
+    const config = await readState(file);
+    const host = config.server?.host ?? "127.0.0.1", port = config.server?.port ?? 17321;
+    if (!["localhost", "127.0.0.1", "::1"].includes(host) || !Number.isInteger(port) || port < 1 || port > 65535) throw Error("HEALTH_NOT_LOOPBACK");
+    endpoint = "http://" + (host === "::1" ? "[::1]" : host) + ":" + port + "/health";
+    configured = true;
+  } catch (error) {
+    if (error.code !== "ENOENT") return { state: "unavailable", status: null, at: new Date().toISOString(), latencyMs: null };
+  }
+  const start = Date.now();
+  let result;
+  try {
+    const response = await fetch(endpoint, { signal: AbortSignal.timeout(800), redirect: "error" });
+    const reader = response.body?.getReader();
+    let body = "", bytes = 0;
+    if (reader) {
+      try {
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) break;
+          bytes += chunk.value.byteLength;
+          if (bytes > 2048) throw Error("HEALTH_RESPONSE_LIMIT");
+          body += Buffer.from(chunk.value).toString("utf8");
+        }
+      } finally { void reader.cancel().catch(() => {}); }
+    }
+    const value = JSON.parse(body);
+    result = { state: response.ok && value.status === "ok" ? "healthy" : "failed", status: response.status,
+      at: new Date().toISOString(), latencyMs: Date.now() - start };
+  } catch { result = { state: configured ? "unreachable" : "not observed", status: null, at: new Date().toISOString(), latencyMs: Date.now() - start }; }
+  healthCache = { time: Date.now(), result };
+  return result;
+}

package/bin/monitor-savings.d.mts

@@ -1,20 +1,20 @@
-export interface LifetimeSavings {
-  scope: "all_time";
-  coverage: "recorded_native_results";
-  since: string | null;
-  asOf: string | null;
-  calls: number;
-  originalBytes: number;
-  sentBytes: number;
-  savedBytes: number;
-}
-export function lifetimeSavingsView(raw: unknown): LifetimeSavings | null;
-export function summarizeLifetimeSavings(result: {
-  instances?: Array<{ lifetimeSavings?: unknown; savingsSourceId?: string }>;
-  unavailable?: number;
-}): { available: boolean; partial: boolean; unavailable: number; sources?: number;
-  calls?: number; originalBytes?: number; sentBytes?: number; savedBytes?: number;
-  since?: string | null; asOf?: string | null; estimatedSavedTokens?: number };
-export function formatLifetimeSavings(result: Parameters<typeof summarizeLifetimeSavings>[0] & {
-  mcp?: { instances: Array<{ instanceId: string; metrics?: Array<{ savedBytes: number }> }>; unavailable?: number };
-}): string[];
+export interface LifetimeSavings {
+  scope: "all_time";
+  coverage: "recorded_native_results";
+  since: string | null;
+  asOf: string | null;
+  calls: number;
+  originalBytes: number;
+  sentBytes: number;
+  savedBytes: number;
+}
+export function lifetimeSavingsView(raw: unknown): LifetimeSavings | null;
+export function summarizeLifetimeSavings(result: {
+  instances?: Array<{ lifetimeSavings?: unknown; savingsSourceId?: string }>;
+  unavailable?: number;
+}): { available: boolean; partial: boolean; unavailable: number; sources?: number;
+  calls?: number; originalBytes?: number; sentBytes?: number; savedBytes?: number;
+  since?: string | null; asOf?: string | null; estimatedSavedTokens?: number };
+export function formatLifetimeSavings(result: Parameters<typeof summarizeLifetimeSavings>[0] & {
+  mcp?: { instances: Array<{ instanceId: string; metrics?: Array<{ savedBytes: number }> }>; unavailable?: number };
+}): string[];

package/bin/monitor-savings.mjs

@@ -1,71 +1,71 @@
-// Scalar projections only. Never read a ledger, private state or provider data here.
-const count = value => Number.isSafeInteger(value) && value >= 0 && value <= 1e15;
-const date = value => typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
-
-/** Invalid or older optional telemetry must not hide the rest of a computer. */
-export function lifetimeSavingsView(raw) {
-  if (!raw || raw.scope !== "all_time" || raw.coverage !== "recorded_native_results" ||
-      ![raw.calls, raw.originalBytes, raw.sentBytes, raw.savedBytes].every(count) ||
-      raw.sentBytes > raw.originalBytes || raw.savedBytes !== raw.originalBytes - raw.sentBytes ||
-      (raw.calls === 0 ? raw.since !== null || raw.asOf !== null || raw.originalBytes !== 0 :
-        !date(raw.since) || !date(raw.asOf) || raw.since > raw.asOf)) return null;
-  return { scope: "all_time", coverage: "recorded_native_results", since: raw.since, asOf: raw.asOf,
-    calls: raw.calls, originalBytes: raw.originalBytes, sentBytes: raw.sentBytes, savedBytes: raw.savedBytes };
-}
-
-/** Aggregate complete scalar native histories, even when their producers have stopped. */
-export function summarizeLifetimeSavings(result) {
-  const sources = new Map(), rejected = new Set();
-  let unavailable = result.unavailable ?? 0;
-  // Ascending counts expose old conflicts too, regardless of the reader's file order.
-  const snapshots = (result.instances ?? []).map(instance => ({
-    id: instance.savingsSourceId, value: lifetimeSavingsView(instance.lifetimeSavings)
-  })).sort((a, b) => (a.value?.calls ?? 0) - (b.value?.calls ?? 0));
-  for (const { id, value } of snapshots) {
-    if (typeof id !== "string" || !/^[a-f0-9]{64}$/.test(id)) { unavailable++; continue; }
-    if (rejected.has(id)) continue;
-    const old = sources.get(id);
-    const conflict = old && (value?.calls === old.calls ?
-      Object.keys(old).some(key => value[key] !== old[key]) :
-      value && (["originalBytes", "sentBytes", "savedBytes"].some(key => value[key] < old[key]) ||
-        (old.since !== null && value.since > old.since) || (old.asOf !== null && value.asOf < old.asOf)));
-    if (!value || conflict) {
-      sources.delete(id); rejected.add(id); unavailable++; continue;
-    }
-    sources.set(id, value);
-  }
-  const values = [...sources.values()];
-  const totals = { calls: 0, originalBytes: 0, sentBytes: 0, savedBytes: 0 };
-  for (const value of values) for (const key of Object.keys(totals)) totals[key] += value[key];
-  if (!Object.values(totals).every(count)) return { available: false, partial: true, unavailable: unavailable + 1 };
-  const dates = values.map(value => value.since).filter(Boolean).sort();
-  const updates = values.map(value => value.asOf).filter(Boolean).sort();
-  return { available: values.length > 0, partial: unavailable > 0, unavailable, sources: values.length,
-    ...totals, since: dates[0] ?? null, asOf: updates.at(-1) ?? null,
-    estimatedSavedTokens: Math.round(totals.savedBytes / 4) };
-}
-
-/** Native all-time and retained personal MCP have different coverage and byte units. */
-export function formatLifetimeSavings(result) {
-  const total = summarizeLifetimeSavings(result);
-  const tokens = bytes => "~" + Math.round(bytes / 4).toLocaleString("en-US");
-  const personal = new Map();
-  for (const instance of result.mcp?.instances ?? []) personal.set(instance.instanceId, instance);
-  const personalBytes = [...personal.values()].flatMap(instance => instance.metrics ?? [])
-    .reduce((sum, metric) => sum + metric.savedBytes, 0);
-  const personalKnown = [...personal.values()].some(instance => instance.metrics?.length) && count(personalBytes);
-  const knownBytes = (total.available ? total.savedBytes : 0) + (personalKnown ? personalBytes : 0);
-  const available = (total.available || personalKnown) && count(knownBytes);
-  const partial = total.partial || !total.available || personal.size > 0 || Boolean(result.mcp?.unavailable);
-  const lines = [available ?
-    "All-time saved" + (partial ? " (partial)" : " (native)") + ": " + tokens(knownBytes) + " tokens" :
-    "All-time saved: unavailable | historical measurements not reported"];
-  if (total.available) lines.push("Native history: Raw " + tokens(total.originalBytes) + " | Sent " + tokens(total.sentBytes) +
-    " | " + (total.originalBytes ? (100 * total.savedBytes / total.originalBytes).toFixed(1) : "0.0") + "% | " +
-    (total.since ? "since " + total.since.slice(0, 10) + " | as of " + total.asOf.slice(0, 16).replace("T", " ") + "Z" : "no recorded results"));
-  lines.push(personalKnown ?
-    "Personal MCP (partial): " + tokens(personalBytes) + " tok retained" :
-    "Personal MCP saved: unavailable (historical total not reported)");
-  lines.push("Est: bytes/4; provider tokens unknown");
-  return lines;
-}
+// Scalar projections only. Never read a ledger, private state or provider data here.
+const count = value => Number.isSafeInteger(value) && value >= 0 && value <= 1e15;
+const date = value => typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value) && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value;
+
+/** Invalid or older optional telemetry must not hide the rest of a computer. */
+export function lifetimeSavingsView(raw) {
+  if (!raw || raw.scope !== "all_time" || raw.coverage !== "recorded_native_results" ||
+      ![raw.calls, raw.originalBytes, raw.sentBytes, raw.savedBytes].every(count) ||
+      raw.sentBytes > raw.originalBytes || raw.savedBytes !== raw.originalBytes - raw.sentBytes ||
+      (raw.calls === 0 ? raw.since !== null || raw.asOf !== null || raw.originalBytes !== 0 :
+        !date(raw.since) || !date(raw.asOf) || raw.since > raw.asOf)) return null;
+  return { scope: "all_time", coverage: "recorded_native_results", since: raw.since, asOf: raw.asOf,
+    calls: raw.calls, originalBytes: raw.originalBytes, sentBytes: raw.sentBytes, savedBytes: raw.savedBytes };
+}
+
+/** Aggregate complete scalar native histories, even when their producers have stopped. */
+export function summarizeLifetimeSavings(result) {
+  const sources = new Map(), rejected = new Set();
+  let unavailable = result.unavailable ?? 0;
+  // Ascending counts expose old conflicts too, regardless of the reader's file order.
+  const snapshots = (result.instances ?? []).map(instance => ({
+    id: instance.savingsSourceId, value: lifetimeSavingsView(instance.lifetimeSavings)
+  })).sort((a, b) => (a.value?.calls ?? 0) - (b.value?.calls ?? 0));
+  for (const { id, value } of snapshots) {
+    if (typeof id !== "string" || !/^[a-f0-9]{64}$/.test(id)) { unavailable++; continue; }
+    if (rejected.has(id)) continue;
+    const old = sources.get(id);
+    const conflict = old && (value?.calls === old.calls ?
+      Object.keys(old).some(key => value[key] !== old[key]) :
+      value && (["originalBytes", "sentBytes", "savedBytes"].some(key => value[key] < old[key]) ||
+        (old.since !== null && value.since > old.since) || (old.asOf !== null && value.asOf < old.asOf)));
+    if (!value || conflict) {
+      sources.delete(id); rejected.add(id); unavailable++; continue;
+    }
+    sources.set(id, value);
+  }
+  const values = [...sources.values()];
+  const totals = { calls: 0, originalBytes: 0, sentBytes: 0, savedBytes: 0 };
+  for (const value of values) for (const key of Object.keys(totals)) totals[key] += value[key];
+  if (!Object.values(totals).every(count)) return { available: false, partial: true, unavailable: unavailable + 1 };
+  const dates = values.map(value => value.since).filter(Boolean).sort();
+  const updates = values.map(value => value.asOf).filter(Boolean).sort();
+  return { available: values.length > 0, partial: unavailable > 0, unavailable, sources: values.length,
+    ...totals, since: dates[0] ?? null, asOf: updates.at(-1) ?? null,
+    estimatedSavedTokens: Math.round(totals.savedBytes / 4) };
+}
+
+/** Native all-time and retained personal MCP have different coverage and byte units. */
+export function formatLifetimeSavings(result) {
+  const total = summarizeLifetimeSavings(result);
+  const tokens = bytes => "~" + Math.round(bytes / 4).toLocaleString("en-US");
+  const personal = new Map();
+  for (const instance of result.mcp?.instances ?? []) personal.set(instance.instanceId, instance);
+  const personalBytes = [...personal.values()].flatMap(instance => instance.metrics ?? [])
+    .reduce((sum, metric) => sum + metric.savedBytes, 0);
+  const personalKnown = [...personal.values()].some(instance => instance.metrics?.length) && count(personalBytes);
+  const knownBytes = (total.available ? total.savedBytes : 0) + (personalKnown ? personalBytes : 0);
+  const available = (total.available || personalKnown) && count(knownBytes);
+  const partial = total.partial || !total.available || personal.size > 0 || Boolean(result.mcp?.unavailable);
+  const lines = [available ?
+    "All-time saved" + (partial ? " (partial)" : " (native)") + ": " + tokens(knownBytes) + " tokens" :
+    "All-time saved: unavailable | historical measurements not reported"];
+  if (total.available) lines.push("Native history: Raw " + tokens(total.originalBytes) + " | Sent " + tokens(total.sentBytes) +
+    " | " + (total.originalBytes ? (100 * total.savedBytes / total.originalBytes).toFixed(1) : "0.0") + "% | " +
+    (total.since ? "since " + total.since.slice(0, 10) + " | as of " + total.asOf.slice(0, 16).replace("T", " ") + "Z" : "no recorded results"));
+  lines.push(personalKnown ?
+    "Personal MCP (partial): " + tokens(personalBytes) + " tok retained" :
+    "Personal MCP saved: unavailable (historical total not reported)");
+  lines.push("Est: bytes/4; provider tokens unknown");
+  return lines;
+}