feat(cli): add shareable stats command - #43653

AI code review — automated review for reference; please use your judgment.

1. packages/core/src/session/stats.ts:150 — total tokens/cost are summed from both assistant-message payloads and every UsageRecorded event regardless of its source — if usage events are also emitted per assistant step (not just auxiliary sources like title as in the test), totals double-count while the per-model table stays correct, producing numbers that don't add up — either filter events by source, dedupe by message id, or document the invariant and add a regression test with a step-sourced event.

2. packages/core/src/session/stats.ts:33 — the aggregation loads all user+assistant rows in range including their full data JSON into memory (--all has no lower bound), plus per-tool duration arrays kept only for a median — on a long-lived server this can be hundreds of MB and slow — consider SQL-side aggregation, projecting only required fields, or chunked iteration; at minimum document the expected scale.

3. packages/cli/src/commands/handlers/stats.ts:27 — client.session.stats(...) and client.location.get(...) are wrapped in Effect.promise with no error mapping or timeout — a refused connection or slow server surfaces as an unhandled defect/stack trace instead of a clean CLI error — use Effect.try and print "could not reach server at " with a non-zero exit code.

4. packages/core/src/session/stats.ts:88 — decodeUnknownOption silently drops rows that fail to decode — corrupt or legacy-schema messages quietly disappear from stats with no signal, which will look like "my numbers are wrong" reports later — count/log skipped rows at debug level (or expose a skipped field).

5. packages/core/src/session/stats.ts:96 vs :117 — range filtering uses SessionMessageTable.time_created, but activity/steps bucket by message.time.created and events by EventTable.created — near range boundaries the same step can be included in one view and excluded from another — pick one timestamp source per entity or widen the SQL window slightly and re-filter after decoding.

6. Nit — packages/cli/src/commands/handlers/stats.ts:214 — truncate/padEnd use .length, so CJK/wide model or tool names misalign the tables; consider string-width-aware padding.

Overall: nice feature — the privacy default (shareable card hides tool names, models, and cost; asserted by tests) is exactly right, timezone handling and streak logic are solid, and batching the event query in groups of 500 shows care. Item 1 is the one I'd verify before merge. Thanks!

AI code review - automated review for reference; please use your judgment.

• packages/cli/src/commands/handlers/stats.ts:~150 - stats.models.slice(0, limit) truncates silently; add a "+N more" footer so users know the table is clipped (toolUsage table has the same issue).
• packages/cli/src/commands/handlers/stats.ts:~110-125 - activity heatmap math is solid (Monday-aligned, 52-week clamp), but weekStarts length uses (dateOrdinal(end) - dateOrdinal(start)) / 7 which can produce one extra column at exact week boundaries; harmless visually, worth a glance if alignment ever looks off.
• Good privacy posture: default card omits cost and tool names, verified by tests asserting absence of private_tool/cost in default output.
• Flag validation (mutual exclusion of --days/--year/--all, --limit >= 1, year bounds) is thorough.