pi-daddy 0.48.3 → 0.49.1

package/dist/products/diagnostic-export.js

@@ -0,0 +1,264 @@
+/** Offline, explicit-selection export. Original files are read only; output is private and never training data. */
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, realpath, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { readBoundedBytes } from "../kernel/bounded-read.js";
+import { parseRetentionJson } from "../governance/retention-json.js";
+import { parseExecutionRetentionManifest, RETENTION_CONTENT_KINDS } from "../governance/retention-contract.js";
+import { filterDiagnostic } from "./diagnostic-filter.js";
+const MAX_FILE = 16 * 1024 * 1024;
+const MAX_TOTAL = 128 * 1024 * 1024;
+const MAX_SOURCES = 1024;
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const object = (x) => x !== null && typeof x === "object" && !Array.isArray(x);
+const pathValue = (x) => typeof x === "string" && x.length > 0 && x.length <= 4096 && !/[\x00-\x1f]/.test(x);
+const hashValue = (x) => typeof x === "string" && /^[a-f0-9]{64}$/.test(x);
+export function parseDiagnosticSelection(text, base) {
+    const value = parseRetentionJson(text, 256 * 1024);
+    if (!object(value) ||
+        value.version !== 1 ||
+        !Array.isArray(value.sources) ||
+        Object.keys(value).some((key) => !["version", "sources", "retentionRoots"].includes(key)) ||
+        value.sources.length > MAX_SOURCES ||
+        (value.retentionRoots !== undefined && (!Array.isArray(value.retentionRoots) || value.retentionRoots.length > 16)))
+        throw new Error("invalid diagnostic selection v1");
+    const sources = value.sources.map((source) => {
+        if (!object(source) ||
+            !pathValue(source.path) ||
+            !["session", "json", "jsonl", "text"].includes(String(source.format)) ||
+            Object.keys(source).some((key) => !["path", "format", "sha256"].includes(key)) ||
+            (source.sha256 !== undefined && !hashValue(source.sha256)))
+            throw new Error("invalid diagnostic source");
+        return {
+            path: resolve(base, source.path),
+            format: source.format,
+            ...(source.sha256 ? { sha256: source.sha256 } : {}),
+        };
+    });
+    const retentionRoots = (value.retentionRoots ?? []).map((path) => {
+        if (!pathValue(path))
+            throw new Error("invalid retention root");
+        return resolve(base, path);
+    });
+    return { version: 1, sources, retentionRoots };
+}
+async function readSource(path, limit = MAX_FILE) {
+    const before = await lstat(path);
+    if (!before.isFile() || (await realpath(path)) !== resolve(path))
+        throw new Error("source-must-be-canonical-regular-file");
+    const result = await readBoundedBytes(path, { maxBytes: limit, timeoutMs: 10000 }, {
+        open: (file, flags) => open(file, flags | constants.O_NOFOLLOW),
+        read: (handle, buffer, offset, length, position) => handle.read(buffer, offset, length, position),
+        close: (handle) => handle.close(),
+    });
+    if (!result.ok)
+        throw new Error(`source-${result.why}`);
+    const after = await lstat(path);
+    if (!after.isFile() ||
+        before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.size !== after.size ||
+        before.mtimeMs !== after.mtimeMs ||
+        before.ctimeMs !== after.ctimeMs ||
+        after.size !== result.bytes.length)
+        throw new Error("source-changed-during-read");
+    return result.bytes;
+}
+const reason = (error) => {
+    const code = object(error) && typeof error.code === "string" ? error.code : undefined;
+    if (code)
+        return code;
+    return error instanceof Error && /^source-[a-z-]+$/.test(error.message)
+        ? error.message
+        : "invalid-or-unreadable-source";
+};
+export async function exportDiagnostics(selectionPath, destination) {
+    const selectedPath = resolve(selectionPath);
+    const selectedBytes = await readSource(selectedPath, 256 * 1024);
+    const selection = parseDiagnosticSelection(new TextDecoder("utf-8", { fatal: true }).decode(selectedBytes), dirname(selectedPath));
+    const choices = new Map();
+    for (const source of selection.sources) {
+        const prior = choices.get(source.path);
+        if (prior && (prior.format !== source.format || prior.sha256 !== source.sha256))
+            throw new Error("conflicting diagnostic selection for one source");
+        choices.set(source.path, source);
+    }
+    const target = resolve(destination);
+    if ((await realpath(dirname(target))) !== dirname(target))
+        throw new Error("destination parent must be canonical");
+    await mkdir(target, { mode: 0o700 }); // Exclusive: never overwrite or remove an existing directory.
+    await mkdir(join(target, "objects"), { mode: 0o700 });
+    const inventory = [];
+    const objects = new Map();
+    const seen = new Map();
+    let total = 0;
+    let readTotal = 0;
+    const read = async (source) => {
+        if (readTotal >= MAX_TOTAL)
+            throw new Error("source-total-size-limit");
+        const raw = await readSource(source.path, Math.min(MAX_FILE, MAX_TOTAL - readTotal));
+        readTotal += raw.length;
+        return raw;
+    };
+    const add = async (source, expectedBytes, traverse = false) => {
+        const prior = seen.get(source.path);
+        const expected = (digest, bytes) => {
+            if (source.sha256 && digest !== source.sha256)
+                throw new Error("source-digest-mismatch");
+            if (expectedBytes !== undefined && bytes !== expectedBytes)
+                throw new Error("source-size-mismatch");
+        };
+        if (prior) {
+            if (prior.source.format !== source.format)
+                throw new Error("conflicting diagnostic selection for one source");
+            if (prior.row.status !== "included")
+                return undefined;
+            try {
+                expected(prior.row.sourceSha256, prior.row.sourceBytes);
+                if (!traverse)
+                    return undefined;
+                // A selected manifest still needs traversal. Re-read and compare rather than caching all raw payloads.
+                const raw = await read(source);
+                if (sha256(raw) !== prior.row.sourceSha256 || raw.length !== prior.row.sourceBytes)
+                    throw new Error("source-changed-before-traversal");
+                return raw;
+            }
+            catch (error) {
+                inventory.push({ source: source.path, format: source.format, status: "missing", reason: reason(error) });
+                return undefined;
+            }
+        }
+        if (seen.size >= MAX_SOURCES)
+            throw new Error("diagnostic source count exceeds bounds");
+        const row = { source: source.path, format: source.format, status: "missing" };
+        seen.set(source.path, { source, row });
+        inventory.push(row);
+        try {
+            const raw = await read(source);
+            row.sourceSha256 = sha256(raw);
+            row.sourceBytes = raw.length;
+            expected(row.sourceSha256, row.sourceBytes);
+            const filtered = filterDiagnostic(raw, source.format);
+            const hash = sha256(filtered.bytes), path = `objects/${hash}`;
+            if (!objects.has(hash)) {
+                if (total + filtered.bytes.length > MAX_TOTAL)
+                    throw new Error("source-export-size-limit");
+                await writeFile(join(target, path), filtered.bytes, { flag: "wx", mode: 0o600 });
+                objects.set(hash, filtered.bytes.length);
+                total += filtered.bytes.length;
+            }
+            Object.assign(row, {
+                status: "included",
+                path,
+                sha256: hash,
+                bytes: filtered.bytes.length,
+                omissions: filtered.omissions,
+            });
+            return raw;
+        }
+        catch (error) {
+            row.reason = reason(error);
+            return undefined;
+        }
+    };
+    for (const source of [...choices.values()].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)))
+        await add(source);
+    const captures = [];
+    for (const root of [...new Set(selection.retentionRoots)].sort()) {
+        try {
+            if ((await realpath(root)) !== root || !(await lstat(root)).isDirectory())
+                throw new Error("source-invalid-retention-root");
+            const entries = await readdir(root, { withFileTypes: true });
+            if (entries.length > MAX_SOURCES)
+                throw new Error("source-directory-size-limit");
+            for (const entry of entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
+                if (!entry.isDirectory())
+                    continue;
+                const manifestPath = join(root, entry.name, "manifest.json");
+                const raw = await add({ path: manifestPath, format: "json" }, undefined, true);
+                if (!raw)
+                    continue;
+                let manifest;
+                try {
+                    manifest = parseExecutionRetentionManifest(raw.toString("utf8"));
+                }
+                catch {
+                    inventory.push({
+                        source: `${manifestPath}#manifest`,
+                        format: "retention-manifest",
+                        status: "missing",
+                        reason: "invalid-retention-manifest",
+                    });
+                    captures.push({ source: manifestPath, status: "invalid-retention-manifest" });
+                    continue;
+                }
+                const losses = manifest.coverage.losses;
+                captures.push({
+                    source: manifestPath,
+                    nativeSession: manifest.nativeSession,
+                    state: manifest.state,
+                    currentLosses: losses.filter((loss) => loss !== "native-session-read-failed-earlier"),
+                    recoveredObservations: losses.filter((loss) => loss === "native-session-read-failed-earlier"),
+                    acceptance: "not-assessed",
+                });
+                for (const kind of RETENTION_CONTENT_KINDS) {
+                    const value = manifest.content[kind];
+                    const format = kind === "session" ? "session" : kind === "checkReceipt" ? "json" : "text";
+                    const source = `${manifestPath}#${kind}`;
+                    if (!object(value) || value.status !== "retained") {
+                        inventory.push({ source, format, status: "missing", reason: "not-retained" });
+                        continue;
+                    }
+                    if (!["session", "checkReceipt", "result"].includes(kind)) {
+                        inventory.push({
+                            source,
+                            format,
+                            status: "excluded",
+                            reason: "raw-stream-or-pane",
+                            sourceSha256: hashValue(value.sha256) ? value.sha256 : undefined,
+                        });
+                        continue;
+                    }
+                    await add({ path: join(dirname(manifestPath), value.path), format, sha256: value.sha256 }, value.bytes);
+                }
+            }
+        }
+        catch (error) {
+            inventory.push({ source: root, format: "retention-root", status: "missing", reason: reason(error) });
+        }
+    }
+    // Capture metadata is also filtered; an untrusted manifest must not smuggle fields past the projection.
+    const manifest = {
+        version: 1,
+        policy: "pi-daddy-visible-diagnostic-v1",
+        selectionSha256: sha256(selectedBytes),
+        entries: inventory,
+        objects: objects.size,
+        exportedBytes: total,
+        captures,
+        private: true,
+        trainingEligible: false,
+        exportEligible: false,
+        acceptance: "not-assessed",
+        limitations: [
+            "Not an atomic filesystem snapshot; sources are checked individually.",
+            "Known reasoning/environment fields omitted; free-text secret detection is heuristic. Review before sharing.",
+            "Raw streams, images, unsupported native entries and unselected files are not exported.",
+            "Source hashes identify original bytes; object hashes identify filtered bytes. Neither grants approval or training rights.",
+        ],
+    };
+    const safeManifest = filterDiagnostic(Buffer.from(JSON.stringify(manifest)), "json").bytes;
+    await writeFile(join(target, "inventory.json"), safeManifest, { mode: 0o600, flag: "wx" });
+    const missing = inventory.filter((entry) => entry.status === "missing").length;
+    return {
+        directory: target,
+        inventory: join(target, "inventory.json"),
+        sha256: sha256(safeManifest),
+        entries: inventory.length,
+        objects: objects.size,
+        missing,
+        trainingEligible: false,
+    };
+}
+//# sourceMappingURL=diagnostic-export.js.map

package/dist/products/diagnostic-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-export.js","sourceRoot":"","sources":["../../src/products/diagnostic-export.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,+BAA+B,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAyB,MAAM,wBAAwB,CAAC;AAEjF,MAAM,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAClC,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACpC,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACtH,MAAM,SAAS,GAAG,CAAC,CAAU,EAAe,EAAE,CAC5C,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACtF,MAAM,SAAS,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAwBjG,MAAM,UAAU,wBAAwB,CAAC,IAAY,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;IACnD,IACE,CAAC,MAAM,CAAC,KAAK,CAAC;QACd,KAAK,CAAC,OAAO,KAAK,CAAC;QACnB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzF,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW;QAClC,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;QAElH,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAU,EAAE;QACnD,IACE,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;YACvB,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9E,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAE1D,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;YAChC,MAAM,EAAE,MAAM,CAAC,MAA0B;YACzC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAI,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC9E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAK,GAAG,QAAQ;IACtD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CACnC,IAAI,EACJ,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EACrC;QACE,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;QAC/D,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjG,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAClC,CACF,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IACE,CAAC,KAAK,CAAC,MAAM,EAAE;QACf,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACxB,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QACxB,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAC1B,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAChC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;QAChC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM;QAElC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAU,EAAE;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACtB,OAAO,KAAK,YAAY,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACrE,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,aAAqB,EAAE,WAAmB;IAChF,MAAM,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,wBAAwB,CACxC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAC/D,OAAO,CAAC,YAAY,CAAC,CACtB,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACnH,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,8DAA8D;IACpG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAqB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmD,CAAC;IACxE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACpC,IAAI,SAAS,IAAI,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC;QACrF,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC;QACxB,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,MAAc,EAAE,aAAsB,EAAE,QAAQ,GAAG,KAAK,EAA+B,EAAE;QAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,MAA0B,EAAE,KAAyB,EAAE,EAAE;YACzE,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACzF,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,KAAK,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtG,CAAC,CAAC;QACF,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC9G,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YACtD,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACxD,IAAI,CAAC,QAAQ;oBAAE,OAAO,SAAS,CAAC;gBAChC,uGAAuG;gBACvG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW;oBAChF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACrD,OAAO,GAAG,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACzG,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,IAAI,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAmB,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC9F,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,GAAG,CAAC,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/B,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC;YAC7B,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EACjC,IAAI,GAAG,WAAW,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvB,IAAI,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC3F,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjF,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACzC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE;gBACjB,MAAM,EAAE,UAAU;gBAClB,IAAI;gBACJ,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM;gBAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjE,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;gBACvE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7F,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACnC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;gBAC7D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBAC/E,IAAI,CAAC,GAAG;oBAAE,SAAS;gBACnB,IAAI,QAAQ,CAAC;gBACb,IAAI,CAAC;oBACH,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,IAAI,CAAC;wBACb,MAAM,EAAE,GAAG,YAAY,WAAW;wBAClC,MAAM,EAAE,oBAAoB;wBAC5B,MAAM,EAAE,SAAS;wBACjB,MAAM,EAAE,4BAA4B;qBACrC,CAAC,CAAC;oBACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;oBAC9E,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,YAAY;oBACpB,aAAa,EAAE,QAAQ,CAAC,aAAa;oBACrC,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oCAAoC,CAAC;oBACrF,qBAAqB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,oCAAoC,CAAC;oBAC7F,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,uBAAuB,EAAE,CAAC;oBAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;oBAC1F,MAAM,MAAM,GAAG,GAAG,YAAY,IAAI,IAAI,EAAE,CAAC;oBACzC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;wBAClD,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;wBAC9E,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC1D,SAAS,CAAC,IAAI,CAAC;4BACb,MAAM;4BACN,MAAM;4BACN,MAAM,EAAE,UAAU;4BAClB,MAAM,EAAE,oBAAoB;4BAC5B,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;yBACjE,CAAC,CAAC;wBACH,SAAS;oBACX,CAAC;oBACD,MAAM,GAAG,CACP,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,IAAc,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAO,EAAE,EAC1F,KAAK,CAAC,KAAe,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IACD,wGAAwG;IACxG,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,gCAAgC;QACxC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC;QACtC,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK;QACpB,QAAQ;QACR,OAAO,EAAE,IAAI;QACb,gBAAgB,EAAE,KAAK;QACvB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,cAAc;QAC1B,WAAW,EAAE;YACX,sEAAsE;YACtE,6GAA6G;YAC7G,wFAAwF;YACxF,2HAA2H;SAC5H;KACF,CAAC;IACF,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC;IAC3F,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IAC/E,OAAO;QACL,SAAS,EAAE,MAAM;QACjB,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC;QAC5B,OAAO,EAAE,SAAS,CAAC,MAAM;QACzB,OAAO,EAAE,OAAO,CAAC,IAAI;QACrB,OAAO;QACP,gBAAgB,EAAE,KAAK;KACxB,CAAC;AACJ,CAAC"}

package/dist/products/diagnostic-filter.d.ts

@@ -0,0 +1,7 @@
+export interface DiagnosticFilterResult {
+    bytes: Buffer;
+    omissions: Record<string, number>;
+}
+export type DiagnosticFormat = "session" | "json" | "jsonl" | "text";
+export declare function filterDiagnostic(bytes: Uint8Array, format: DiagnosticFormat): DiagnosticFilterResult;
+//# sourceMappingURL=diagnostic-filter.d.ts.map

package/dist/products/diagnostic-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-filter.d.ts","sourceRoot":"","sources":["../../src/products/diagnostic-filter.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AACD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AAErE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,GAAG,sBAAsB,CA0HpG"}

package/dist/products/diagnostic-filter.js

@@ -0,0 +1,135 @@
+/** Local diagnostic projection. Known private fields are omitted; free-text secret detection is heuristic. */
+import { parseRetentionJson } from "../governance/retention-json.js";
+const object = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+const privateKey = new RegExp("^(?:thinking|reasoning|reasoning_content|reasoning_details|encrypted_content|thoughtSignature|thinkingSignature|signature|" +
+    "env|environment|environ|credentials?|authorization|api[-_]?key|token|access[-_]?token|refresh[-_]?token|password|secret)$", "i");
+const privateType = /^(?:thinking|reasoning|redacted_thinking|reasoning_content|reasoning_details)$/i;
+export function filterDiagnostic(bytes, format) {
+    const omissions = {};
+    const note = (reason) => (omissions[reason] = (omissions[reason] ?? 0) + 1);
+    const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    const redact = (input) => {
+        let output = input.replace(/\b(?:sk-(?:or-v1-)?[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g, () => {
+            note("credential-pattern");
+            return "[REDACTED]";
+        });
+        output = output.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/<>"']+@/gi, (_match, scheme) => {
+            note("credential-url-userinfo");
+            return `${scheme}[REDACTED]@`;
+        });
+        output = output.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, () => {
+            note("credential-pattern");
+            return "Bearer [REDACTED]";
+        });
+        output = output.replace(/\b([A-Z][A-Z0-9_]*(?:API_KEY|TOKEN|PASSWORD|SECRET)|API_KEY|TOKEN|PASSWORD|SECRET)(\s*[=:]\s*)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^\s,;]+)/gi, (_match, key, separator) => {
+            note("credential-assignment");
+            return `${key}${separator}[REDACTED]`;
+        });
+        return output;
+    };
+    const clean = (value, depth = 0) => {
+        if (depth > 64)
+            throw new Error("diagnostic nesting exceeds bounds");
+        if (typeof value === "string") {
+            // JSON embedded in a packet is a byte-bearing string. Keep it exactly when no redaction is needed.
+            if (/^\s*[\[{]/.test(value)) {
+                let parsed;
+                try {
+                    parsed = parseRetentionJson(value, 16 * 1024 * 1024);
+                }
+                catch {
+                    return redact(value);
+                }
+                const filtered = clean(parsed, depth + 1);
+                return JSON.stringify(filtered) === JSON.stringify(parsed) ? value : JSON.stringify(filtered);
+            }
+            return redact(value);
+        }
+        if (Array.isArray(value))
+            return value.flatMap((item) => {
+                if (object(item) && typeof item.type === "string" && privateType.test(item.type)) {
+                    note("private-reasoning");
+                    return [];
+                }
+                return [clean(item, depth + 1)];
+            });
+        if (!object(value))
+            return value;
+        if (typeof value.type === "string" && privateType.test(value.type)) {
+            note("private-reasoning");
+            return null;
+        }
+        const result = Object.create(null);
+        for (const [key, item] of Object.entries(value)) {
+            if (privateKey.test(key) || /(?:^|_)(?:API_KEY|ACCESS_TOKEN|REFRESH_TOKEN|PASSWORD|SECRET)$/.test(key)) {
+                note("private-field");
+                continue;
+            }
+            result[key] = clean(item, depth + 1);
+        }
+        return result;
+    };
+    const pick = (value, keys) => Object.fromEntries(keys.filter((key) => Object.hasOwn(value, key)).map((key) => [key, value[key]]));
+    const session = (value) => {
+        if (!object(value))
+            throw new Error("invalid native session record");
+        const envelope = pick(value, ["type", "id", "parentId", "timestamp"]);
+        if (value.type === "session")
+            return clean({ ...envelope, ...pick(value, ["version", "cwd", "parentSession"]) });
+        if (value.type === "message" && object(value.message)) {
+            const message = value.message;
+            if (!["user", "assistant", "toolResult"].includes(String(message.role))) {
+                note("unsupported-message");
+                return { ...envelope, omitted: "unsupported-message" };
+            }
+            const content = typeof message.content === "string" ? [{ type: "text", text: message.content }] : message.content;
+            if (!Array.isArray(content))
+                throw new Error("invalid native message content");
+            const visible = content.flatMap((block) => {
+                if (!object(block))
+                    throw new Error("invalid native content block");
+                if (block.type === "text" && typeof block.text === "string")
+                    return [pick(block, ["type", "text"])];
+                if (block.type === "toolCall")
+                    return [pick(block, ["type", "id", "name", "arguments"])];
+                note(typeof block.type === "string" && privateType.test(block.type) ? "private-reasoning" : "non-text-content");
+                return [];
+            });
+            return clean({
+                ...envelope,
+                message: {
+                    ...pick(message, ["role", "toolCallId", "toolName", "isError", "provider", "model", "stopReason", "usage"]),
+                    content: visible,
+                },
+            });
+        }
+        if (["model_change", "thinking_level_change", "session_info"].includes(String(value.type)))
+            return clean({ ...envelope, ...pick(value, ["provider", "modelId", "thinkingLevel", "name"]) });
+        note("unsupported-session-entry");
+        return clean({ ...envelope, omitted: "unsupported-session-entry" });
+    };
+    let output;
+    if (format === "text")
+        output = redact(text);
+    else if (format === "json")
+        output = JSON.stringify(clean(parseRetentionJson(text, 16 * 1024 * 1024))) + "\n";
+    else {
+        const lines = text.split("\n");
+        if (lines.at(-1) === "")
+            lines.pop();
+        if (format === "session") {
+            const header = parseRetentionJson(lines[0] ?? "", 16 * 1024 * 1024);
+            if (!object(header) || header.type !== "session" || header.version !== 3 || typeof header.id !== "string")
+                throw new Error("expected native Pi session v3");
+        }
+        output =
+            lines
+                .map((line) => {
+                const value = parseRetentionJson(line, 16 * 1024 * 1024);
+                return JSON.stringify(format === "session" ? session(value) : clean(value));
+            })
+                .join("\n") + "\n";
+    }
+    return { bytes: Buffer.from(output), omissions };
+}
+//# sourceMappingURL=diagnostic-filter.js.map

package/dist/products/diagnostic-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-filter.js","sourceRoot":"","sources":["../../src/products/diagnostic-filter.ts"],"names":[],"mappings":"AAAA,8GAA8G;AAC9G,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAClE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACvE,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,4HAA4H;IAC1H,2HAA2H,EAC7H,GAAG,CACJ,CAAC;AACF,MAAM,WAAW,GAAG,iFAAiF,CAAC;AAOtG,MAAM,UAAU,gBAAgB,CAAC,KAAiB,EAAE,MAAwB;IAC1E,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,CAAC,KAAa,EAAU,EAAE;QACvC,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CACxB,mGAAmG,EACnG,GAAG,EAAE;YACH,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC3B,OAAO,YAAY,CAAC;QACtB,CAAC,CACF,CAAC;QACF,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,0CAA0C,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE;YAC7F,IAAI,CAAC,yBAAyB,CAAC,CAAC;YAChC,OAAO,GAAG,MAAM,aAAa,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC/D,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC3B,OAAO,mBAAmB,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,OAAO,CACrB,sIAAsI,EACtI,CAAC,MAAM,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE;YACzC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC9B,OAAO,GAAG,GAAG,GAAG,SAAS,YAAY,CAAC;QACxC,CAAC,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC,EAAW,EAAE;QACnD,IAAI,KAAK,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,mGAAmG;YACnG,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,IAAI,MAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBACvD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC1C,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACtB,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gBAC5B,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjF,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBAC1B,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,gEAAgE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvG,IAAI,CAAC,eAAe,CAAC,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAA8B,EAAE,IAAc,EAAE,EAAE,CAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,OAAO,GAAG,CAAC,KAAc,EAAW,EAAE;QAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QACtE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QACjH,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACxE,IAAI,CAAC,qBAAqB,CAAC,CAAC;gBAC5B,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;YACzD,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YAClH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAc,EAAE,EAAE;gBACjD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACpE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBACpG,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;oBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;gBACzF,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAChH,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;gBACX,GAAG,QAAQ;gBACX,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;oBAC3G,OAAO,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxF,OAAO,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,IAAI,MAAc,CAAC;IACnB,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;SACxC,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;SACzG,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,KAAK,CAAC,GAAG,EAAE,CAAC;QACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ;gBACvG,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrD,CAAC;QACD,MAAM;YACJ,KAAK;iBACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC"}

package/extensions/dashboard-session-server.ts

@@ -1,3 +1,4 @@
+import { dashboardSettingsSnapshot, dashboardJev, setDashboardLimit } from "./dashboard-settings.ts";
 import { randomBytes } from "node:crypto";
 import { chmod, rm } from "node:fs/promises";
 import { createServer, type Server } from "node:net";
@@ -69,9 +70,22 @@ async function start(session: GrantsSession): Promise<DashboardSessionEndpoint>
 }
 
 async function respond(session: GrantsSession, token: string, line: string): Promise<Record<string, unknown>> {
-  const request = JSON.parse(line) as { token?: unknown; action?: unknown; edits?: unknown; enabled?: unknown };
+  const request = JSON.parse(line) as {
+    token?: unknown;
+    action?: unknown;
+    edits?: unknown;
+    enabled?: unknown;
+    key?: unknown;
+    seconds?: unknown;
+  };
   if (request.token !== token) return { ok: false, error: "unauthorised dashboard request" };
-  if (request.action === "set-auto") {
+  let jev;
+  if (request.action === "set-limit") {
+    setDashboardLimit(session, request.key, request.seconds);
+  } else if (request.action === "set-jev") {
+    if (typeof request.enabled !== "boolean") return { ok: false, error: "JEV requires an explicit boolean" };
+    jev = await dashboardJev(session, request.enabled ? "enable" : "disable");
+  } else if (request.action === "set-auto") {
     if (typeof request.enabled !== "boolean") return { ok: false, error: "Auto mode requires an explicit boolean" };
     await setAutoApproval(session, request.enabled, "dashboard");
   } else if (request.action === "set") {
@@ -91,6 +105,7 @@ async function respond(session: GrantsSession, token: string, line: string): Pro
     ...(session.activity ? { activity: { ...session.activity } } : {}),
     rows: sessionModelRows(session, [...session.definitions.keys()].sort()),
     versions: versionSnapshot(session),
+    settings: await dashboardSettingsSnapshot(session, jev),
     cost: null, // Live complete episode cost is unavailable; retained usage remains in the episode report.
   };
 }

package/extensions/dashboard-settings.ts

@@ -0,0 +1,149 @@
+/** Owner-bound dashboard settings. No provider call, global env edit, or permission inference. */
+import { randomUUID } from "node:crypto";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { GrantsSession } from "./session.ts";
+import type { DashboardJevState, DashboardSettingsSnapshot } from "../src/products/dashboard-settings.ts";
+import { MAX_CHILDREN_PER_CALL } from "../src/kernel/fanout.ts";
+import {
+  ENV_CHILD_TIMEOUT,
+  ENV_CHILD_IDLE_TIMEOUT,
+  timeoutFromEnv,
+  idleTimeoutFromEnv,
+} from "../src/kernel/run-child.ts";
+
+const bridges = new WeakMap<GrantsSession, Pick<ExtensionAPI, "events">>();
+const unavailable = (error?: string): DashboardJevState => ({
+  available: false,
+  enabled: false,
+  pending: false,
+  ...(error ? { error } : {}),
+});
+export function registerDashboardSettings(pi: Pick<ExtensionAPI, "events">, session: GrantsSession): void {
+  bridges.set(session, pi);
+}
+function owner(session: GrantsSession, edit = false) {
+  const current = session.reloadLifecycle?.autoMode;
+  if (!session.ownerBound || !current || current.reader !== session.autoMode)
+    throw new Error("Session settings owner is unavailable");
+  if (edit && !current.authority) throw new Error("Only the owning root session may edit settings");
+  return current;
+}
+export function childExecutionLimits(session: GrantsSession, env: NodeJS.ProcessEnv = process.env) {
+  const configured = session.reloadLifecycle?.executionSettings;
+  const current = session.reloadLifecycle?.autoMode;
+  const selected = configured?.nativeSessionId === current?.nativeSessionId ? configured : undefined;
+  return Object.freeze({
+    wallMs: selected?.wallMs ?? timeoutFromEnv(env[ENV_CHILD_TIMEOUT]),
+    idleMs: selected?.idleMs ?? idleTimeoutFromEnv(env[ENV_CHILD_IDLE_TIMEOUT]),
+    wallSource: selected?.wallMs === undefined ? ("startup" as const) : ("session" as const),
+    idleSource: selected?.idleMs === undefined ? ("startup" as const) : ("session" as const),
+  });
+}
+export function setDashboardLimit(session: GrantsSession, key: unknown, seconds: unknown): void {
+  const current = owner(session, true);
+  if (key !== "wall" && key !== "idle") throw new Error("Only child wall and idle limits are editable in this session");
+  if (
+    typeof seconds !== "number" ||
+    !Number.isSafeInteger(seconds) ||
+    seconds < 0 ||
+    seconds > Math.floor(2_147_483_647 / 1000)
+  )
+    throw new Error("Child limit must be whole seconds from 0 to 2147483; 0 restores the default");
+  const existing = session.reloadLifecycle.executionSettings;
+  const settings =
+    existing?.nativeSessionId === current.nativeSessionId
+      ? { ...existing }
+      : { nativeSessionId: current.nativeSessionId };
+  const ms = key === "wall" ? timeoutFromEnv(String(seconds)) : idleTimeoutFromEnv(String(seconds));
+  session.reloadLifecycle.executionSettings = { ...settings, [key === "wall" ? "wallMs" : "idleMs"]: ms };
+}
+const safeText = (value: unknown) => (typeof value === "string" ? value.slice(0, 120) : undefined);
+export async function dashboardJev(
+  session: GrantsSession,
+  action: "status" | "enable" | "disable",
+): Promise<DashboardJevState> {
+  const current = owner(session, action !== "status");
+  const pi = bridges.get(session);
+  if (!pi?.events?.emit) {
+    if (action !== "status") throw new Error("JEV bridge unavailable; load skill-harness in the owner Pi session");
+    return unavailable();
+  }
+  const requestId = randomUUID();
+  return new Promise((resolve, reject) => {
+    const timer = setTimeout(
+      () => (action === "status" ? resolve(unavailable()) : reject(new Error("JEV control was not acknowledged"))),
+      200,
+    );
+    const reply = (input: unknown) => {
+      const value = input as {
+        version?: number;
+        requestId?: string;
+        sessionId?: string;
+        pending?: boolean;
+        error?: string;
+        status?: {
+          enabled?: boolean;
+          mode?: string;
+          storage?: string | null;
+          remaining?: number;
+          availability?: string;
+          providerReadiness?: string;
+        };
+      };
+      if (!value || value.version !== 1 || value.requestId !== requestId || value.sessionId !== current.nativeSessionId)
+        return;
+      clearTimeout(timer);
+      if (session.reloadLifecycle.autoMode !== current || session.autoMode !== current.reader) {
+        reject(new Error("JEV settings owner changed"));
+        return;
+      }
+      if (!value.status || typeof value.status.enabled !== "boolean") {
+        if (action !== "status") reject(new Error("JEV owner could not apply the request"));
+        else resolve(unavailable("JEV owner is not bound to this session"));
+        return;
+      }
+      resolve({
+        available: true,
+        enabled: value.status.enabled,
+        pending: value.pending === true,
+        mode: safeText(value.status.mode),
+        storage: value.status.storage === null ? null : safeText(value.status.storage),
+        remaining: Number.isSafeInteger(value.status.remaining) ? value.status.remaining : undefined,
+        availability: safeText(value.status.availability),
+        providerReadiness: safeText(value.status.providerReadiness),
+        ...(value.error ? { error: "JEV request declined or unavailable; inspect the owner Pi session." } : {}),
+      });
+    };
+    try {
+      pi.events.emit("skill-harness:jev-control-v1", {
+        version: 1,
+        requestId,
+        sessionId: current.nativeSessionId,
+        action,
+        reply,
+      });
+    } catch {
+      clearTimeout(timer);
+      reject(new Error("JEV control bridge failed"));
+    }
+  });
+}
+export async function dashboardSettingsSnapshot(
+  session: GrantsSession,
+  jev?: DashboardJevState,
+): Promise<DashboardSettingsSnapshot> {
+  const current = owner(session);
+  const limits = childExecutionLimits(session);
+  return {
+    editable: Boolean(current.authority),
+    wallSeconds: limits.wallMs / 1000,
+    idleSeconds: limits.idleMs / 1000,
+    wallSource: limits.wallSource,
+    idleSource: limits.idleSource,
+    descendants: session.capacity?.total ?? 0,
+    reserved: session.capacity?.reserved ?? 0,
+    maxDepth: session.maxDepth ?? 0,
+    perCall: MAX_CHILDREN_PER_CALL,
+    jev: jev ?? (await dashboardJev(session, "status")),
+  };
+}