cli-consumption 0.2.0__tar.gz → 0.2.1__tar.gz

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/CONTRIBUTING.md

@@ -30,6 +30,12 @@ errors, and the documented server-first upgrade sequence. Export changes must pr
 deterministic ordering, bounded-memory CSV streaming, complete selected conversation
 graphs, and spreadsheet-formula neutralization.
 
+Provider readers must use the bounded file and JSONL helpers in `adapters/_shared.py`,
+must not follow direct provider-file symlinks, and must stay within the shared snapshot
+record budget. Every registered adapter test module must include a synthetic canary and
+assert its absence from the normalized snapshot; shared privacy tests cover all later
+output surfaces.
+
 ## Validate and review
 
 Run the quality gates documented in `AGENTS.md`, inspect the complete diff, then open a

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cli-consumption
-Version: 0.2.0
+Version: 0.2.1
 Summary: Analyze and consolidate AI coding CLI consumption across machines.
 Project-URL: Homepage, https://github.com/Guillaume-Lombardo/cli-consumption
 Project-URL: Documentation, https://github.com/Guillaume-Lombardo/cli-consumption#readme
@@ -41,7 +41,8 @@ machines, and can send metadata-only snapshots to a central collector.
 
 It never stores prompts, responses, tool arguments, credentials, or raw provider
 events. Local token counters are usage metadata, not billing records. Read the
-[privacy boundary](docs/privacy.md) before sharing a database or report.
+[privacy boundary](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/privacy.md)
+before sharing a database or report.
 
 ## Quick start
 
@@ -120,7 +121,7 @@ Use the provider name below with `--provider` to select one CLI explicitly.
 
 Provider formats are internal and can change without notice. The detailed extraction
 rules and qualification versions are documented in
-[Provider support](docs/provider-support.md).
+[Provider support](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/provider-support.md).
 
 ## Collect copied data
 
@@ -142,6 +143,11 @@ Copy only the required provider data. For Codex, copy the `sessions/` directory
 never `auth.json` or other credentials. Globally identical conversation IDs are
 deduplicated, and the most complete copy wins.
 
+Provider files are untrusted. Monolithic JSON files are limited to 64 MiB, JSONL files
+to 256 MiB with an 8 MiB per-line limit, and a snapshot to 250,000 normalized records
+while it is being built. Direct provider-file symlinks are refused. `collect --strict`
+refuses to write a snapshot when malformed records were skipped.
+
 Map original working-directory prefixes to stable project labels with repeated
 `--project NAME=PATH_PREFIX` options. The longest matching prefix wins:
 
@@ -163,7 +169,7 @@ uv run cli-consumption collect --provider plandex \
 
 The dashboard can filter by time, provider, machine, project, and model. It reports
 activity, token composition, cache efficiency, latency and duration distributions,
-technical throughput, context pressure, work-item reliability, configuration cohorts,
+turn rate, context pressure, work-item reliability, configuration cohorts,
 compactions, subagent delegation, and ingestion quality. Availability varies by
 provider, as summarized in the table above.
 
@@ -209,8 +215,14 @@ unversioned databases that exactly match a published schema are adopted before t
 upgrade; unknown or modified schemas are refused. Back up production databases before
 upgrading and do not run mixed application versions against one database while a
 migration is in progress. See the
-[migration decision](docs/decisions/0001-versioned-schema-migrations.md) for rollback
-and compatibility rules.
+[migration decision](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/decisions/0001-versioned-schema-migrations.md)
+for rollback and compatibility rules.
+
+Timezone-aware timestamps are normalized to fixed-width UTC strings during ingestion.
+Revision `0003` rewrites legacy timestamp text in bounded batches and adds an indexed
+conversation end-time path; see the
+[timestamp decision](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/decisions/0002-canonical-utc-timestamps.md)
+for the exact representation and downgrade boundary.
 
 Preview retention before deleting normalized metadata:
 
@@ -243,8 +255,9 @@ uv run cli-consumption sync --provider all \
 ```
 
 The application refuses to bind beyond localhost without a token. Production
-deployments also need TLS and standard operational controls. See
-[Architecture](docs/architecture.md) for the trade-offs.
+deployments also need TLS and standard operational controls. The sync client refuses
+plain HTTP beyond loopback unless `--allow-insecure` is passed explicitly. See
+[Architecture](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/architecture.md) for the trade-offs.
 
 Snapshots use strict schema version 1. The collector rejects request bodies larger
 than 32 MiB and snapshots containing more than 250,000 normalized records. A sync
@@ -263,7 +276,10 @@ uv run cli-consumption providers --json
 Each provider reports one of `no-data`, `detected`, `compatible`, `degraded`, or
 `unsupported-schema`. Diagnostics parse enough metadata to assess compatibility but do
 not persist it and never include paths, identifiers, record contents, counts, or parser
-errors in their output.
+errors in their output. Schema version 2 also declares whether token counters are
+additive, conversation aggregates, context snapshots, or unavailable. Dashboard token
+per-turn percentiles use only additive providers rather than treating missing measures
+as zero.
 
 ## Commands
 
@@ -278,6 +294,10 @@ errors in their output.
 
 Run `uv run cli-consumption COMMAND --help` for all options.
 
+`collect`, `export`, and `retention` accept `--json` for deterministic
+machine-readable results. `collect --strict` rejects snapshots containing malformed
+provider records before opening the destination database.
+
 ## Development
 
 ```bash
@@ -292,9 +312,12 @@ uv build
 ```
 
 Development uses short-lived branches and squash-merged pull requests into protected
-`main`. Read [CONTRIBUTING.md](CONTRIBUTING.md) and [AGENTS.md](AGENTS.md) before
-changing the project.
+`main`. Read
+[CONTRIBUTING.md](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/CONTRIBUTING.md)
+and [AGENTS.md](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/AGENTS.md)
+before changing the project. Security issues follow the private reporting guidance in
+[SECURITY.md](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/SECURITY.md).
 
 ## License
 
-Licensed under the [Apache License 2.0](LICENSE).
+Licensed under the [Apache License 2.0](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/LICENSE).

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/README.md

@@ -6,7 +6,8 @@ machines, and can send metadata-only snapshots to a central collector.
 
 It never stores prompts, responses, tool arguments, credentials, or raw provider
 events. Local token counters are usage metadata, not billing records. Read the
-[privacy boundary](docs/privacy.md) before sharing a database or report.
+[privacy boundary](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/privacy.md)
+before sharing a database or report.
 
 ## Quick start
 
@@ -85,7 +86,7 @@ Use the provider name below with `--provider` to select one CLI explicitly.
 
 Provider formats are internal and can change without notice. The detailed extraction
 rules and qualification versions are documented in
-[Provider support](docs/provider-support.md).
+[Provider support](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/provider-support.md).
 
 ## Collect copied data
 
@@ -107,6 +108,11 @@ Copy only the required provider data. For Codex, copy the `sessions/` directory
 never `auth.json` or other credentials. Globally identical conversation IDs are
 deduplicated, and the most complete copy wins.
 
+Provider files are untrusted. Monolithic JSON files are limited to 64 MiB, JSONL files
+to 256 MiB with an 8 MiB per-line limit, and a snapshot to 250,000 normalized records
+while it is being built. Direct provider-file symlinks are refused. `collect --strict`
+refuses to write a snapshot when malformed records were skipped.
+
 Map original working-directory prefixes to stable project labels with repeated
 `--project NAME=PATH_PREFIX` options. The longest matching prefix wins:
 
@@ -128,7 +134,7 @@ uv run cli-consumption collect --provider plandex \
 
 The dashboard can filter by time, provider, machine, project, and model. It reports
 activity, token composition, cache efficiency, latency and duration distributions,
-technical throughput, context pressure, work-item reliability, configuration cohorts,
+turn rate, context pressure, work-item reliability, configuration cohorts,
 compactions, subagent delegation, and ingestion quality. Availability varies by
 provider, as summarized in the table above.
 
@@ -174,8 +180,14 @@ unversioned databases that exactly match a published schema are adopted before t
 upgrade; unknown or modified schemas are refused. Back up production databases before
 upgrading and do not run mixed application versions against one database while a
 migration is in progress. See the
-[migration decision](docs/decisions/0001-versioned-schema-migrations.md) for rollback
-and compatibility rules.
+[migration decision](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/decisions/0001-versioned-schema-migrations.md)
+for rollback and compatibility rules.
+
+Timezone-aware timestamps are normalized to fixed-width UTC strings during ingestion.
+Revision `0003` rewrites legacy timestamp text in bounded batches and adds an indexed
+conversation end-time path; see the
+[timestamp decision](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/decisions/0002-canonical-utc-timestamps.md)
+for the exact representation and downgrade boundary.
 
 Preview retention before deleting normalized metadata:
 
@@ -208,8 +220,9 @@ uv run cli-consumption sync --provider all \
 ```
 
 The application refuses to bind beyond localhost without a token. Production
-deployments also need TLS and standard operational controls. See
-[Architecture](docs/architecture.md) for the trade-offs.
+deployments also need TLS and standard operational controls. The sync client refuses
+plain HTTP beyond loopback unless `--allow-insecure` is passed explicitly. See
+[Architecture](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/architecture.md) for the trade-offs.
 
 Snapshots use strict schema version 1. The collector rejects request bodies larger
 than 32 MiB and snapshots containing more than 250,000 normalized records. A sync
@@ -228,7 +241,10 @@ uv run cli-consumption providers --json
 Each provider reports one of `no-data`, `detected`, `compatible`, `degraded`, or
 `unsupported-schema`. Diagnostics parse enough metadata to assess compatibility but do
 not persist it and never include paths, identifiers, record contents, counts, or parser
-errors in their output.
+errors in their output. Schema version 2 also declares whether token counters are
+additive, conversation aggregates, context snapshots, or unavailable. Dashboard token
+per-turn percentiles use only additive providers rather than treating missing measures
+as zero.
 
 ## Commands
 
@@ -243,6 +259,10 @@ errors in their output.
 
 Run `uv run cli-consumption COMMAND --help` for all options.
 
+`collect`, `export`, and `retention` accept `--json` for deterministic
+machine-readable results. `collect --strict` rejects snapshots containing malformed
+provider records before opening the destination database.
+
 ## Development
 
 ```bash
@@ -257,9 +277,12 @@ uv build
 ```
 
 Development uses short-lived branches and squash-merged pull requests into protected
-`main`. Read [CONTRIBUTING.md](CONTRIBUTING.md) and [AGENTS.md](AGENTS.md) before
-changing the project.
+`main`. Read
+[CONTRIBUTING.md](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/CONTRIBUTING.md)
+and [AGENTS.md](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/AGENTS.md)
+before changing the project. Security issues follow the private reporting guidance in
+[SECURITY.md](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/SECURITY.md).
 
 ## License
 
-Licensed under the [Apache License 2.0](LICENSE).
+Licensed under the [Apache License 2.0](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/LICENSE).

cli_consumption-0.2.1/SECURITY.md

@@ -0,0 +1,37 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are made on the latest released version and on `main`. Older releases
+are not maintained as separate security branches. Upgrade to the latest release before
+reporting a problem that may already have been fixed.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability. Email
+`lombardo.guillaume@gmail.com` with the subject `CLI Consumption security report` and
+include:
+
+- the affected version and operating system;
+- the provider, command, or API surface involved;
+- reproduction steps using synthetic data;
+- the expected and observed impact;
+- any suggested mitigation.
+
+Do not send real prompts, responses, credentials, provider databases, or other private
+conversation data. Use a synthetic canary when demonstrating a disclosure.
+
+The maintainer will acknowledge the report, assess whether it crosses the documented
+privacy or security boundary, and coordinate a fix and disclosure when appropriate.
+
+## Security boundary
+
+Provider files and incoming snapshots are untrusted input. Relevant reports include
+content or credential disclosure, unsafe filesystem traversal, denial of service,
+authentication bypass, cross-machine data corruption, and generated dashboards that
+perform network requests or execute provider-controlled content.
+
+Operational exposure caused solely by publishing a normalized database or detailed CSV
+is outside the vulnerability boundary: those artifacts intentionally contain private
+operational metadata. The precise allowed and prohibited fields are documented in the
+[privacy boundary](https://github.com/Guillaume-Lombardo/cli-consumption/blob/main/docs/privacy.md).

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/docs/architecture.md

@@ -32,7 +32,7 @@ provider files -> adapter -> metadata-only snapshot -> SQL storage -> dashboard/
   provide an offline HTML view by default, and stream deterministic portable CSV tables
   when explicitly requested.
 - `adapters.registry`: is the single source for canonical names, aliases, adapter
-  classes, default homes, detection markers, and support state.
+  classes, default homes, detection markers, support state, and token semantics.
 - `cli`: exposes the same capabilities through one executable.
 
 When Codex exposes its local thread graph, the adapter also records metadata-only
@@ -64,28 +64,41 @@ or platform ingress. Read access is not exposed. The collector limits bodies to
 including chunked requests, accepts snapshot schema v1, and caps a snapshot at 250,000
 normalized records. `/api/v1/capabilities` publishes these limits and the supported
 schema range so clients can fail before uploading incompatible data.
+The sync client refuses plain HTTP beyond loopback unless the operator passes the
+explicit `--allow-insecure` override for a trusted network.
 
 ## Storage
 
 SQLite is the zero-configuration default. PostgreSQL is selected by passing a
 `postgresql+psycopg://` URL. Every database open upgrades through packaged Alembic
-migrations. An unversioned database is adopted only when its tables exactly match a
-published schema; an unknown, newer, or locally modified schema is refused. Migration
-revisions support SQLite and PostgreSQL and define a bounded downgrade, but application
-rollback can still require restoring a pre-upgrade backup. Operators must upgrade the
-server first and avoid mixed-version access during migration. The detailed policy is
-recorded in [ADR 0001](decisions/0001-versioned-schema-migrations.md).
+migrations. An unversioned database is adopted only when its columns, SQL types,
+nullability, primary and foreign keys, and indexes exactly match a published schema; an
+unknown, newer, or locally modified schema is refused. Migration revisions support
+SQLite and PostgreSQL and define a bounded downgrade, but application rollback can
+still require restoring a pre-upgrade backup. Operators must upgrade the server first
+and avoid mixed-version access during migration. The detailed policy is recorded in
+[ADR 0001](decisions/0001-versioned-schema-migrations.md).
 
 Conversation records use a provider-qualified stable ID. Repeated ingestion skips an
 identical or less complete record. A more complete copy atomically replaces the
 conversation and its child records.
 
+Subagent relationships have a provider-and-source-machine lifecycle. Every represented
+scope is replaced atomically on ingestion, including when its latest snapshot contains
+no edges, so deleted provider relationships do not remain indefinitely.
+
 Workflow analytics use additive child tables: `work_items`, `context_samples`,
 `turn_settings`, and `compaction_events`. Snapshot schema v1 validates every record,
 rejects unknown fields, enforces normalized labels and relationships, and exposes only
 generic validation errors. A newer client sent to an older strict API is rejected
 before ingestion, so central deployments must upgrade the server first.
 
+Provider input is bounded before persistence. Monolithic JSON files are capped at
+64 MiB, JSONL files at 256 MiB with an 8 MiB per-line limit, and the complete in-memory
+normalized snapshot at 250,000 records. Direct symlinks to provider files are rejected.
+These limits use generic error codes and apply to local collection as well as snapshots
+later sent to the API.
+
 Retention is an explicit two-step operation: `retention --keep-days N` reports what
 would be deleted, while `--apply` deletes old conversations (with cascading children),
 subagent relationships, and ingestion runs in one transaction.
@@ -103,3 +116,9 @@ each table, and neutralizes text that spreadsheet software could execute as a fo
 Adapters are introduced one at a time because local data formats are undocumented or
 can evolve independently. Each adapter must have synthetic fixtures, format detection,
 privacy tests, and a documented support level before it appears as supported.
+
+Timestamp fields are canonical fixed-width UTC strings after strict snapshot
+validation and schema revision `0003`. Reporting and retention bind values in the same
+form and use direct indexed predicates with explicit null branches. The representation,
+migration, and rollback boundary are documented in
+[ADR 0002](decisions/0002-canonical-utc-timestamps.md).

cli_consumption-0.2.1/docs/decisions/0002-canonical-utc-timestamps.md

@@ -0,0 +1,94 @@
+# ADR 0002: Canonical UTC timestamp storage
+
+- Status: Accepted and implemented in schema revision `0003`
+- Scope: normalized SQL timestamps and time-window queries
+
+## Context
+
+Snapshot schema v1 accepts timezone-aware ISO 8601 timestamps. Before revision `0003`,
+SQL stored those values as text exactly as received. Reporting and retention therefore
+called SQLite `datetime(...)` or cast PostgreSQL text to `timestamptz` for every
+comparison. Those expressions prevented the existing timestamp indexes from serving
+the common range predicates. Equivalent instants could also have different lexical
+forms because offsets and fractional-second precision were not canonicalized.
+
+The affected SQL fields are conversation and turn start/end times, model/tool/context/
+compaction event timestamps, and ingestion-run timestamps. Millisecond epoch fields on
+work items and subagent relationships already have a separate, explicit provider
+meaning and are outside this decision.
+
+An SQLite 3.53.1 query-plan check against the published schema confirmed that
+`datetime(coalesce(...))` performs a table scan, while a direct comparison against a
+canonical timestamp uses the timestamp index. This is a query-shape limitation, not a
+SQLite version-specific parsing bug.
+
+## Decision
+
+Keep timezone-aware ISO strings in snapshot schema v1 and in CSV exports, but make the
+stored representation canonical:
+
+```text
+YYYY-MM-DDTHH:MM:SS.ffffff+00:00
+```
+
+At the strict snapshot boundary, parse each timestamp, convert it to UTC, and serialize
+it with `datetime.isoformat(timespec="microseconds")`. Generate ingestion timestamps
+through the same helper. Fixed-width UTC strings sort in instant order on both SQLite
+and PostgreSQL, remain human-readable, preserve Python datetime precision, fit the
+existing `VARCHAR(64)` columns, and stay compatible with snapshot schema v1.
+
+Do not replace the fields with epoch integers or PostgreSQL-native timestamps. Epoch
+columns would either lose sub-millisecond precision or introduce JavaScript-safe-range
+considerations, while native types would create avoidable dialect and CSV differences.
+
+## Migration
+
+1. Add revision `0003` without changing column names or snapshot schema.
+2. Before mutation, read every non-null timestamp in bounded primary-key batches. Parse
+   it with the same strict helper and fail with a generic schema-compatibility error if
+   any published database contains an invalid or timezone-naive value.
+3. Rewrite valid values to fixed-width UTC form. This changes representation, never the
+   represented instant.
+4. Add an index on `conversations.ended_at`; retain the existing start/event/run
+   indexes.
+5. Change reporting overlap predicates from function-wrapped columns to direct text
+   predicates with explicit null branches. For example, “last activity at or after the
+   lower bound” becomes `ended_at >= :since OR (ended_at IS NULL AND started_at >=
+   :since)`.
+6. Change retention predicates in the same way and bind canonical UTC strings on both
+   dialects.
+7. Keep dashboard and CSV values as canonical ISO strings; no export column changes are
+   required.
+
+The migration must run with writers stopped. An older writer could reintroduce a
+non-canonical offset after revision `0003`, so the existing prohibition on mixed
+application versions remains mandatory.
+
+## Downgrade and rollback
+
+The downgrade removes the new `ended_at` index but leaves timestamps canonical. The
+original offset spelling and fractional precision cannot be reconstructed, although
+the instant is preserved exactly. Restore the pre-upgrade backup if byte-for-byte
+lexical rollback is required.
+
+## Verification
+
+- Property tests proving chronological and lexical ordering agree across offsets,
+  daylight-saving transitions, negative offsets, and microsecond boundaries.
+- Snapshot/API tests proving equivalent offsets serialize identically.
+- SQLite upgrade tests for valid legacy values, invalid-value fail-closed behavior,
+  idempotence, query results, and `EXPLAIN QUERY PLAN` index use.
+- PostgreSQL migration and runtime tests for canonical backfill, direct predicates,
+  indexes, and transaction rollback on malformed legacy data.
+- Export-window and retention regression tests around exact half-open boundaries and
+  null start/end combinations.
+- Privacy assertions confirming rejected legacy values never appear in errors or logs.
+
+## Consequences
+
+- No snapshot-version bump, public field rename, or CSV compatibility break.
+- Range queries become indexable and dialect-specific timestamp casts disappear.
+- Stored timestamps no longer retain the provider's original offset notation; CLI
+  Consumption analyzes instants, so that notation has no approved analytical purpose.
+- Upgrading to revision `0003` performs a one-time bounded rewrite before the direct
+  query predicates are used.

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/docs/privacy.md

@@ -52,6 +52,12 @@ records, constrain accepted fields, and never evaluate embedded content. The API
 constant-time bearer-token comparison when authentication is configured and refuses an
 unauthenticated non-local bind through the CLI.
 
+Local parsing caps monolithic JSON files at 64 MiB, JSONL files at 256 MiB with an
+8 MiB per-line limit, and the normalized snapshot at 250,000 records during
+construction. Direct provider file symlinks are rejected. Limit failures expose only
+generic codes, never paths or record content. The sync client requires HTTPS beyond
+loopback unless the operator uses the explicit `--allow-insecure` override.
+
 An exported database still reveals work patterns, model choices, project names, and
 activity times. Treat it as private operational data. Restrict filesystem and database
 access, use TLS for remote collection, rotate tokens, and define a retention policy
@@ -82,9 +88,14 @@ their own timestamp. CSV output neutralizes leading spreadsheet formula and cont
 prefixes with an apostrophe, but still contains detailed normalized operational data.
 
 Provider diagnostics inspect local stores transiently and emit only provider name,
-documented aliases, support state, and one coarse compatibility status. They do not
-persist snapshots or reveal paths, conversation identifiers, record counts, malformed
-values, or exception text.
+documented aliases, support state, documented token semantics, and one coarse
+compatibility status. They do not persist snapshots or reveal paths, conversation
+identifiers, record counts, malformed values, or exception text.
+
+Every registered adapter has a synthetic canary regression at the extraction boundary.
+Shared contract tests then check that prohibited content is absent from snapshots, SQL,
+API requests and errors, CSV, HTML, logs, and malformed-input diagnostics. This layered
+contract is required for every newly registered provider.
 
 Retention removes normalized rows, not provider source files, existing exports,
 database backups, database engine logs, reverse-proxy logs, or snapshots already sent

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/docs/provider-support.md

@@ -33,8 +33,11 @@ ingests each metadata-only snapshot independently. With no explicit source it ch
 the local default homes; repeated `--source` paths are filtered by detected format.
 
 Provider metadata is maintained in one registry: canonical name, aliases, adapter,
-default home, detection markers, and support state. `providers --json` uses that same
-registry to check default local stores and emits deterministic schema-v1 JSON. Its
+default home, detection markers, support state, and token semantics. `providers --json`
+uses that same registry to check default local stores and emits deterministic schema-v2
+JSON. Token semantics are one of `additive`, `conversation-aggregate`,
+`context-snapshot`, or `unavailable`; a missing counter is never presented as a measured
+zero in provider capability output. Its
 compatibility status is one of:
 
 - `no-data`: no registered detection marker was found;

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/docs/roadmap.md

@@ -14,6 +14,11 @@
 - Versioned SQLite/PostgreSQL migrations, safe legacy adoption, and retention previews
 - Central provider registry with privacy-minimized compatibility diagnostics
 - Deterministic, streamed, time-bounded exports with spreadsheet-safe CSV cells
+- Exact legacy-schema adoption, bounded provider inputs, authoritative subagent-scope
+  replacement, and HTTPS-by-default synchronization
+- Deterministic JSON results for collection, export, and retention automation
+- Canonical fixed-width UTC timestamp storage with bounded legacy migration and
+  indexable reporting and retention predicates
 
 ## Next provider increments
 

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cli-consumption"
-version = "0.2.0"
+version = "0.2.1"
 description = "Analyze and consolidate AI coding CLI consumption across machines."
 readme = "README.md"
 requires-python = ">=3.12"

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/src/cli_consumption/adapters/_shared.py

@@ -4,6 +4,7 @@ import hashlib
 import json
 import math
 import re
+from collections.abc import Iterator
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
@@ -11,9 +12,16 @@ from typing import Any
 from cli_consumption.models import empty_tokens
 
 MAX_BIGINT = 9_223_372_036_854_775_807
+MAX_PROVIDER_JSON_BYTES = 64 * 1024 * 1024
+MAX_PROVIDER_JSONL_BYTES = 256 * 1024 * 1024
+MAX_PROVIDER_JSONL_LINE_BYTES = 8 * 1024 * 1024
 SAFE_LABEL = re.compile(r"[A-Za-z0-9][A-Za-z0-9_.:/+@-]*")
 
 
+class ProviderDataLimitError(ValueError):
+    """A privacy-safe failure raised when provider input exceeds a hard limit."""
+
+
 def mapping(value: object) -> dict[str, Any]:
     return value if isinstance(value, dict) else {}
 
@@ -138,4 +146,35 @@ def digest_records(records: object) -> str:
 
 
 def read_json(path: Path) -> object:
-    return json.loads(path.read_text(encoding="utf-8"))
+    return json.loads(read_bounded_bytes(path))
+
+
+def read_bounded_bytes(path: Path, maximum: int = MAX_PROVIDER_JSON_BYTES) -> bytes:
+    reject_provider_file_symlink(path)
+    if path.stat().st_size > maximum:
+        raise ProviderDataLimitError("provider_file_too_large")
+    with path.open("rb") as handle:
+        payload = handle.read(maximum + 1)
+    if len(payload) > maximum:
+        raise ProviderDataLimitError("provider_file_too_large")
+    return payload
+
+
+def iter_bounded_jsonl_bytes(
+    path: Path,
+    maximum_line: int = MAX_PROVIDER_JSONL_LINE_BYTES,
+    maximum_file: int = MAX_PROVIDER_JSONL_BYTES,
+) -> Iterator[bytes]:
+    reject_provider_file_symlink(path)
+    if path.stat().st_size > maximum_file:
+        raise ProviderDataLimitError("provider_file_too_large")
+    with path.open("rb") as handle:
+        for line in handle:
+            if len(line) > maximum_line:
+                raise ProviderDataLimitError("provider_line_too_large")
+            yield line
+
+
+def reject_provider_file_symlink(path: Path) -> None:
+    if path.is_symlink():
+        raise ProviderDataLimitError("provider_file_symlink_not_allowed")

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/src/cli_consumption/adapters/aider.py

@@ -9,6 +9,7 @@ from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
+from cli_consumption.adapters._shared import iter_bounded_jsonl_bytes
 from cli_consumption.models import Snapshot, empty_tokens
 
 MAX_BIGINT = 9_223_372_036_854_775_807
@@ -185,32 +186,31 @@ def _read_sessions(
     active: list[dict[str, Any]] | None = None
     malformed = 0
     ordinals: dict[tuple[str, int], int] = {}
-    with path.open("rb") as handle:
-        for line in handle:
-            if not line.strip():
-                continue
-            try:
-                event = json.loads(line)
-            except (json.JSONDecodeError, UnicodeDecodeError):
-                malformed += 1
-                continue
-            if not isinstance(event, dict) or not isinstance(event.get("event"), str):
-                malformed += 1
-                continue
-            if _epoch(event.get("time")) is None:
-                malformed += 1
-                continue
-            if event["event"] == "launched":
-                if active:
-                    sessions.append(_session(active, ordinals))
-                active = [event]
-                continue
-            if active is None:
-                continue
-            active.append(event)
-            if event["event"] == "exit":
+    for line in iter_bounded_jsonl_bytes(path):
+        if not line.strip():
+            continue
+        try:
+            event = json.loads(line)
+        except (json.JSONDecodeError, UnicodeDecodeError):
+            malformed += 1
+            continue
+        if not isinstance(event, dict) or not isinstance(event.get("event"), str):
+            malformed += 1
+            continue
+        if _epoch(event.get("time")) is None:
+            malformed += 1
+            continue
+        if event["event"] == "launched":
+            if active:
                 sessions.append(_session(active, ordinals))
-                active = None
+            active = [event]
+            continue
+        if active is None:
+            continue
+        active.append(event)
+        if event["event"] == "exit":
+            sessions.append(_session(active, ordinals))
+            active = None
     if active:
         sessions.append(_session(active, ordinals))
     return sessions, malformed

{cli_consumption-0.2.0 → cli_consumption-0.2.1}/src/cli_consumption/adapters/amazon_q.py

@@ -13,6 +13,7 @@ from cli_consumption.adapters._shared import (
     mapping,
     new_turn,
     project,
+    reject_provider_file_symlink,
     timestamp,
 )
 from cli_consumption.adapters.base import UnsupportedProviderFormat
@@ -63,6 +64,7 @@ def _read_database(path: Path) -> tuple[list[tuple[str, dict[str, Any]]], int]:
     malformed = 0
     result: list[tuple[str, dict[str, Any]]] = []
     try:
+        reject_provider_file_symlink(path)
         connection = sqlite3.connect(f"{path.resolve().as_uri()}?mode=ro", uri=True)
         connection.row_factory = sqlite3.Row
         connection.execute("PRAGMA trusted_schema=OFF")