fix(parser): clamp _safe_int to non-negative for token accounting

Negative usage token values from adversarial JSONL must not reduce session
metadata totals; apply max(0, ...) in _safe_int and add regression test.

Author: clean6378-max-it

tests/test_parser_fuzz.py

@@ -266,6 +266,28 @@ def test_non_numeric_usage_tokens_do_not_crash(tmp_path: Path) -> None:
     assert session["metadata"]["total_ephemeral_5m_tokens"] == 0
 
 
+def test_negative_usage_tokens_clamp_to_zero(tmp_path: Path) -> None:
+    """Negative token counts must not reduce session metadata totals."""
+    entry = {
+        "type": "assistant",
+        "timestamp": "2026-06-11T00:00:00Z",
+        "message": {
+            "model": "claude-test",
+            "content": [{"type": "text", "text": "hi"}],
+            "usage": {
+                "input_tokens": -100,
+                "output_tokens": -1.5,
+                "cache_creation": {"ephemeral_5m_input_tokens": -50},
+            },
+        },
+    }
+    path = _write_jsonl(tmp_path / "negative_usage.jsonl", [json.dumps(entry)])
+    session = parse_session(path)
+    assert session["metadata"]["total_input_tokens"] == 0
+    assert session["metadata"]["total_output_tokens"] == 0
+    assert session["metadata"]["total_ephemeral_5m_tokens"] == 0
+
+
 def test_non_finite_usage_tokens_do_not_crash(tmp_path: Path) -> None:
     """json.loads accepts NaN/Infinity literals; int(nan)/int(inf) raise, so the
     parser must coerce them to 0 rather than propagate ValueError/OverflowError."""

utils/jsonl_parser.py

@@ -42,15 +42,15 @@
 
 
 def _safe_int(val: Any) -> int:
-    """Coerce a value to int for token accounting; non-numeric or non-finite
-    input becomes 0 so fuzzed/malformed usage fields never raise during
-    arithmetic. json.loads accepts NaN/Infinity literals, so guard against them."""
+    """Coerce a value to a non-negative int for token accounting; non-numeric,
+    non-finite, or negative input becomes 0 so fuzzed/malformed usage fields
+    never raise during arithmetic and counters cannot go below zero."""
     if isinstance(val, bool):
         return 0
     if isinstance(val, int):
-        return val
+        return max(0, val)
     if isinstance(val, float):
-        return int(val) if math.isfinite(val) else 0
+        return max(0, int(val)) if math.isfinite(val) else 0
     return 0