fix(monitoring): tolerate null API payloads

Normalize monitoring API responses before rendering so empty or error payloads with data:null cannot crash the dashboard. Also guard chart, token, and box session arrays before reading length/map.

web/src/app/home/monitoring/components/TokenMonitoring.tsx

@@ -164,7 +164,7 @@ export default function TokenMonitoring({
   }, [fetchStats]);
 
   const chartData = useMemo(() => {
-    if (!stats) return [];
+    if (!stats || !Array.isArray(stats.timeseries)) return [];
     return stats.timeseries.map((p) => ({
       bucket: p.bucket,
       input: p.input_tokens,
@@ -198,7 +198,7 @@ export default function TokenMonitoring({
     );
   }
 
-  if (!stats || stats.summary.total_calls === 0) {
+  if (!stats || !stats.summary || stats.summary.total_calls === 0) {
     return (
       <div className="bg-card rounded-xl border p-6">
         <div className="h-[260px] flex flex-col items-center justify-center text-muted-foreground gap-2">
@@ -209,7 +209,8 @@ export default function TokenMonitoring({
     );
   }
 
-  const { summary, by_model } = stats;
+  const summary = stats.summary;
+  const by_model = Array.isArray(stats.by_model) ? stats.by_model : [];
 
   return (
     <div className="space-y-6">

web/src/app/home/monitoring/components/overview-cards/SystemStatusCards.tsx

@@ -74,7 +74,7 @@ export default function SystemStatusCard({
         : await httpClient.getBoxSessions().catch(() => [] as BoxSessionInfo[]);
       setPluginStatus(plugin);
       setBoxStatus(box);
-      setBoxSessions(sessions);
+      setBoxSessions(Array.isArray(sessions) ? sessions : []);
     } finally {
       setLoading(false);
     }

web/src/app/home/monitoring/components/overview-cards/TrafficChart.tsx

@@ -34,14 +34,16 @@ export default function TrafficChart({
   const { t } = useTranslation();
 
   const chartData = useMemo(() => {
-    if (!messages.length && !llmCalls.length) {
+    const safeMessages = Array.isArray(messages) ? messages : [];
+    const safeLlmCalls = Array.isArray(llmCalls) ? llmCalls : [];
+    if (!safeMessages.length && !safeLlmCalls.length) {
       return [];
     }
 
     // Combine all timestamps and find the range
     const allTimestamps = [
-      ...messages.map((m) => m.timestamp.getTime()),
-      ...llmCalls.map((c) => c.timestamp.getTime()),
+      ...safeMessages.map((m) => m.timestamp.getTime()),
+      ...safeLlmCalls.map((c) => c.timestamp.getTime()),
     ];
 
     if (allTimestamps.length === 0) return [];
@@ -99,7 +101,7 @@ export default function TrafficChart({
     }
 
     // Count messages per bucket
-    messages.forEach((msg) => {
+    safeMessages.forEach((msg) => {
       const bucket =
         Math.floor(msg.timestamp.getTime() / bucketSize) * bucketSize;
       const point = buckets.get(bucket);
@@ -109,7 +111,7 @@ export default function TrafficChart({
     });
 
     // Count LLM calls per bucket
-    llmCalls.forEach((call) => {
+    safeLlmCalls.forEach((call) => {
       const bucket =
         Math.floor(call.timestamp.getTime() / bucketSize) * bucketSize;
       const point = buckets.get(bucket);