@oar-sh/oar 0.9.16 → 0.9.17

package/server/server-runtime.mjs

@@ -46,6 +46,7 @@ import { createPreviewScopeResolver, registerPreviewRoutes } from './routes/prev
 import { registerRemoteRelayRoutes } from './routes/remote-relay-routes.mjs';
 import { registerRelayEventRoutes } from './routes/relay-event-routes.mjs';
 import { registerRelayScheduleRoutes } from './routes/relay-schedule-routes.mjs';
+import { registerDeepSeekUsageImportRoutes } from './routes/deepseek-usage-import-routes.mjs';
 import { registerRelayAskRoutes } from './routes/relay-ask-routes.mjs';
 import { createRemoteRelayRepository } from './repositories/remote-relay-repository.mjs';
 import { createConversationGroupRepository } from './repositories/conversation-group-repository.mjs';
@@ -64,6 +65,12 @@ import { createClaudeCloudCredentials } from '../shared/claude-cloud/credentials
 import { createClaudeCloudClient } from '../shared/claude-cloud/api-client.mjs';
 import { resolveClaudeCloudBaseUrl } from '../shared/claude-cloud/base-url.mjs';
 import { createClaudeCloudSettingsService } from './services/claude-cloud-settings-service.mjs';
+import { createDeepSeekSettingsService } from './services/deepseek-settings-service.mjs';
+import { createWorkerPostRedaction } from './services/worker-secret-redaction.mjs';
+import { createDeepSeekBalanceService } from './services/deepseek-balance-service.mjs';
+import { deepseekCardCurrency } from './services/plan-usage-deepseek.mjs';
+import { createDeepSeekUsageImportService } from './services/deepseek-usage-import.mjs';
+import { DEEPSEEK_DEFAULT_AUTO_COMPACT_WINDOW, DEFAULT_DEEPSEEK_MODEL, deepseekModelLabel } from '../shared/deepseek-models.mjs';
 import { createClaudeCloudSessionService } from './services/claude-cloud-session-service.mjs';
 import { createClaudeCloudRepoService, listRecentCloudSourcesFromStatements } from './services/claude-cloud-repo-service.mjs';
 import { createClaudeAccountUsageService } from './services/claude-account-usage-service.mjs';
@@ -138,7 +145,7 @@ import { createRelayCliLauncherService } from './services/relay-cli-launcher-ser
 import { createSessionWorkerRegistry } from './services/session-worker-registry-service.mjs';
 import { createSessionWorkerSupervisor } from './services/session-worker-supervisor-service.mjs';
 import { createSessionWorkerProcessInspector } from './services/session-worker-process-service.mjs';
-import { applyClaudeCloudProviderEnvironment, applyClaudeProviderEnvironment, applyCopilotSdkProviderEnvironment, applyCursorProviderEnvironment, applyGrokProviderEnvironment, applyOpenAIProviderEnvironment, copilotSdkEngineUnavailableReason, killTmuxSession, launchSessionCli } from './services/session-worker-launch-service.mjs';
+import { applyClaudeCloudProviderEnvironment, applyClaudeProviderEnvironment, applyCopilotSdkProviderEnvironment, applyCursorProviderEnvironment, applyDeepSeekProviderEnvironment, applyGrokProviderEnvironment, applyOpenAIProviderEnvironment, copilotSdkEngineUnavailableReason, killTmuxSession, launchSessionCli } from './services/session-worker-launch-service.mjs';
 import { createSshTunnelManager } from './services/ssh-tunnel-manager-service.mjs';
 import { createCloudflaredTunnelManager } from './services/cloudflared-tunnel-service.mjs';
 import {
@@ -2830,6 +2837,58 @@ const claudeCloudRepoService = createClaudeCloudRepoService({
   isEnabled: () => claudeCloudSettingsService.getSettings().enabled === true,
   listRecentCloudSources: () => listRecentCloudSourcesFromStatements(stmts),
 });
+// What a session worker posts loses every key a provider saved in Settings
+// (worker-secret-redaction.mjs). Built here, at the start, so it reads the
+// saved keys now, and the DeepSeek save below notes each key it writes: one
+// changed before any worker has posted is still redacted.
+const workerPostRedaction = createWorkerPostRedaction({ readSetting: readAppSettingValue });
+// DeepSeek: one API key per relay, its models and its endpoint. The key stays
+// in the settings table; GET routes answer `configured`, never the key.
+const deepseekSettingsService = createDeepSeekSettingsService({
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => {
+    stmts.upsertAppSetting.run(key, String(value), new Date().toISOString());
+    workerPostRedaction.noteSavedSetting(key, value);
+  },
+  deleteSetting: (key) => stmts.deleteAppSetting.run(key),
+  listProviderCandidates: () => stmts.listRuntimeSessionProviderCandidates?.all?.() || [],
+});
+function getDeepSeekProviderSettings() {
+  return deepseekSettingsService.getSettings();
+}
+// The DeepSeek balance for Check Usage: read with the saved key only while
+// DeepSeek is on, kept for a minute.
+const deepseekBalanceService = createDeepSeekBalanceService({ getSettings: getDeepSeekProviderSettings });
+// DeepSeek's own usage export, imported in Settings (or with
+// `npm run deepseek:import`): the usage card shows its figures for the days
+// it covers, for the saved key only, and the estimate after.
+const deepseekUsageImportService = createDeepSeekUsageImportService({
+  db,
+  getApiKey: () => getDeepSeekProviderSettings()?.apiKey || '',
+});
+// Where DeepSeek workers keep their Claude Code state (sessions, transcripts,
+// settings): a directory of the relay's own, so no Claude login is in reach
+// of a CLI that talks to DeepSeek and their sessions stay out of Claude's.
+const DEEPSEEK_CLAUDE_CONFIG_DIR = path.join(DATA_DIR, 'deepseek-claude');
+
+/**
+ * What a DeepSeek session's commits and PRs say: the DeepSeek tab's mode
+ * (OAR or off), the folder override on top, the DeepSeek model's name in the
+ * trailer. A folder set to vanilla gets OAR's: Claude Code's own lines would
+ * credit Claude for DeepSeek's work.
+ */
+function deepseekAttributionForConversation(conv, modelId) {
+  const root = String(conv?.runtime_workspace_root_path || conv?.configured_workspace_root_path || '').trim()
+    || currentWorkspaceRootPath();
+  const resolved = resolveClaudeAttributionMode({
+    providerMode: getDeepSeekProviderSettings().attribution,
+    folderMode: workspaceRootAttributionMode(root),
+  });
+  return buildClaudeAttributionSettings({
+    mode: resolved === 'vanilla' ? 'oar' : resolved,
+    modelLabel: deepseekModelLabel(modelId),
+  });
+}
 // The account's live usage for the Check Usage modal. The Claude Cloud switch
 // is the consent to use the Claude CLI's login, so nothing is read while it
 // is off.
@@ -3058,7 +3117,7 @@ function buildSessionWorkerLaunchEnvForSession(targetSessionId) {
   const providerType = String(runtimeSession?.provider_type || 'github').trim().toLowerCase();
   // Clear every provider's variables first (the appliers' kind-guarded deletes
   // keep the chained clears order-independent), then apply only the bound one.
-  const cleared = applyClaudeCloudProviderEnvironment(applyCopilotSdkProviderEnvironment(applyGrokProviderEnvironment(applyCursorProviderEnvironment(applyClaudeProviderEnvironment(applyOpenAIProviderEnvironment(sessionWorkerLaunchEnv))))));
+  const cleared = applyDeepSeekProviderEnvironment(applyClaudeCloudProviderEnvironment(applyCopilotSdkProviderEnvironment(applyGrokProviderEnvironment(applyCursorProviderEnvironment(applyClaudeProviderEnvironment(applyOpenAIProviderEnvironment(sessionWorkerLaunchEnv)))))));
   // A Claude Cloud conversation gets its own worker and nothing else: it must
   // never reach the Copilot CLI fall-through at the end of this function. The
   // environment names the worker and the model, no credential.
@@ -3088,6 +3147,19 @@ function buildSessionWorkerLaunchEnvForSession(targetSessionId) {
       dataDir: DATA_DIR,
     });
   }
+  // A DeepSeek conversation gets its own worker and must never reach the
+  // Copilot fall-through below. Without a key the applier throws, and the
+  // conversation gets the launch note.
+  if (providerType === 'deepseek') {
+    const deepseekSettings = getDeepSeekProviderSettings();
+    return applyDeepSeekProviderEnvironment(cleared, {
+      enabled: true,
+      model: String(runtimeSession?.provider_model || runtimeSession?.model || deepseekSettings.model).trim(),
+      apiKey: deepseekSettings.apiKey,
+      baseUrl: deepseekSettings.baseUrl,
+      configDir: DEEPSEEK_CLAUDE_CONFIG_DIR,
+    });
+  }
   if (providerType === 'grok') {
     const grokSettings = getGrokProviderSettings();
     const grokModel = String(runtimeSession?.provider_model || runtimeSession?.model || grokSettings.model).trim();
@@ -3316,12 +3388,13 @@ async function stopSessionWorkerForProviderRebind(sdkSessionId) {
 
 async function reconcileUnstartedConversationProviders({ enabled, model, provider = 'openai' } = {}) {
   const normalizedProvider = String(provider || 'openai').trim().toLowerCase();
-  const managedProvider = ['claude', 'cursor', 'grok'].includes(normalizedProvider) ? normalizedProvider : 'openai';
+  const managedProvider = ['claude', 'cursor', 'grok', 'deepseek'].includes(normalizedProvider) ? normalizedProvider : 'openai';
   const managedDefaultModel = {
     openai: DEFAULT_OPENAI_MODEL,
     claude: DEFAULT_CLAUDE_MODEL,
     cursor: DEFAULT_CURSOR_MODEL,
     grok: DEFAULT_GROK_MODEL,
+    deepseek: DEFAULT_DEEPSEEK_MODEL,
   }[managedProvider];
   const providerType = enabled === true ? managedProvider : 'github';
   const providerModel = enabled === true
@@ -3395,7 +3468,9 @@ async function reconcileUnstartedConversationProviders({ enabled, model, provide
           ? getCursorProviderSettings().configured === true
           : (currentProvider === 'grok'
             ? getGrokProviderSettings().enabled === true
-            : (currentProvider !== 'openai' || getOpenAIProviderSettings().configured === true)));
+            : (currentProvider === 'deepseek'
+              ? getDeepSeekProviderSettings().configured === true
+              : (currentProvider !== 'openai' || getOpenAIProviderSettings().configured === true))));
       if (providerWasUpdated && canRestorePreviousProvider) {
         stmts.updateRuntimeSessionProvider.run(
           currentProvider,
@@ -5984,6 +6059,14 @@ const readContextFromSessionEvents = contextSnapshotService.readContextFromSessi
 // Claude-provider sessions live under the Agent SDK's project layout rather than
 // ~/.copilot/session-state, so their browsable session folder resolves separately.
 const claudeSessionRootResolver = createClaudeSessionRootResolver({ fs, path });
+// DeepSeek chats run Claude Code with a config dir of their own: only that
+// root, never the host's ~/.claude.
+const deepseekSessionRootResolver = createClaudeSessionRootResolver({
+  fs,
+  path,
+  env: { CLAUDE_CONFIG_DIR: DEEPSEEK_CLAUDE_CONFIG_DIR },
+  homedir: () => '',
+});
 const cursorSessionRootResolver = createCursorSessionRootResolver({ fs, path, serverDir: __dirname, dataDir: DATA_DIR });
 
 // ─── Express + Socket.io Setup ────────────────────────────────────────────────
@@ -6371,8 +6454,12 @@ async function requestSessionWorkerSocketDelivery({ sessionId, pid, reason = 'wo
       // without a new queue column or push channel. null = Auto.
       ...((() => {
         const conv = out.conversationId ? stmts.getConvAnyStatus.get(out.conversationId) : null;
+        const deliveredProvider = String(out.providerType || '').trim().toLowerCase();
         return {
-          autoCompactWindow: parseAutoCompactWindow(conv?.auto_compact_window),
+          // DeepSeek's window is 1M; its sessions compact at 400K unless the
+          // conversation pins another window.
+          autoCompactWindow: parseAutoCompactWindow(conv?.auto_compact_window)
+            ?? (deliveredProvider === 'deepseek' ? DEEPSEEK_DEFAULT_AUTO_COMPACT_WINDOW : null),
           // Per-conversation thinking control, same delivery scoping. An
           // explicit null on thinkingEnabled means Host default — the worker
           // distinguishes it from an absent key (an older relay), so both
@@ -6384,7 +6471,14 @@ async function requestSessionWorkerSocketDelivery({ sessionId, pid, reason = 'wo
           // attribution. Always present on such a delivery, so the worker can
           // tell "left as it was" (absent) from "vanilla" (null).
           ...((() => {
-            const deliveredProvider = String(out.providerType || '').trim().toLowerCase();
+            // A DeepSeek session runs Claude Code on the host like a Claude
+            // one: the same two settings, with DeepSeek's attribution.
+            if (deliveredProvider === 'deepseek') {
+              return {
+                attribution: deepseekAttributionForConversation(conv, out.providerModel || out.model),
+                claudeBackgroundCommandLimitMs: claudeBackgroundCommandLimitMinutesToMs(getClaudeBackgroundCommandLimitMinutes()),
+              };
+            }
             if (deliveredProvider !== 'claude' && deliveredProvider !== 'claude-cloud') return {};
             return {
               attribution: claudeAttributionForConversation(conv, out.providerModel || out.model, {
@@ -6740,6 +6834,9 @@ app.use((req, _res, next) => {
   stripRequestPathPrefix(req, remotePath);
   next();
 });
+// What a session worker posts loses every key a provider saved in Settings
+// before any route stores, broadcasts or logs it (worker-secret-redaction.mjs).
+app.use(workerPostRedaction);
 function isApiRequestPath(requestPath) {
   return /^\/api(?:\/|$)/.test(String(requestPath || ''));
 }
@@ -7074,6 +7171,10 @@ const sharedRouteDeps = {
   getClaudeCloudProviderSettings,
   claudeCloudSettingsService,
   claudeCloudSessionService,
+  getDeepSeekProviderSettings,
+  deepseekSettingsService,
+  deepseekBalanceService,
+  deepseekUsageImportService,
   claudeCloudRepoService,
   // The login's state for the workers' nudge route (never the token).
   claudeCloudLoginStatus: { describe: () => claudeCloudCredentials.describe() },
@@ -7198,6 +7299,8 @@ const sharedRouteDeps = {
   relayRestartOrchestrator,
   resolveSessionStateRoot,
   resolveClaudeSessionRoot: claudeSessionRootResolver.resolveClaudeSessionRoot,
+  resolveDeepSeekSessionRoot: deepseekSessionRootResolver.resolveClaudeSessionRoot,
+  deepseekClaudeConfigDir: DEEPSEEK_CLAUDE_CONFIG_DIR,
   resolveCursorSessionRoot: cursorSessionRootResolver.resolveCursorSessionRoot,
   getTurnCeilingMinutes,
   setTurnCeilingMinutes,
@@ -7271,6 +7374,14 @@ registerRelayScheduleRoutes(app, {
   relayScheduleService,
   remoteRelayInbound,
 });
+registerDeepSeekUsageImportRoutes(app, {
+  auth,
+  deepseekUsageImportService,
+  remoteRelayInbound,
+  // The usage card's currency (the balance's), so the import's answer can
+  // say whether the card uses the export's rows.
+  getCardCurrency: async () => deepseekCardCurrency(await deepseekBalanceService.getBalance()),
+});
 registerRelayAskRoutes(app, {
   auth,
   db,
@@ -7552,10 +7663,12 @@ function ensureRuntimeSessionBinding(
           // default below and bind a GitHub (Copilot CLI) session.
           : (normalizedRequestedProviderType === 'claude-cloud'
             ? 'claude-cloud'
-            : (normalizedRequestedProviderType === 'github'
-              ? 'github'
-              : (openAISettings?.enabled ? 'openai' : 'github'))))));
-  const resolvedProviderModel = (resolvedProviderType === 'openai' || resolvedProviderType === 'claude' || resolvedProviderType === 'cursor' || resolvedProviderType === 'grok' || resolvedProviderType === 'claude-cloud')
+            : (normalizedRequestedProviderType === 'deepseek'
+              ? 'deepseek'
+              : (normalizedRequestedProviderType === 'github'
+                ? 'github'
+                : (openAISettings?.enabled ? 'openai' : 'github')))))));
+  const resolvedProviderModel = (resolvedProviderType === 'openai' || resolvedProviderType === 'claude' || resolvedProviderType === 'cursor' || resolvedProviderType === 'grok' || resolvedProviderType === 'claude-cloud' || resolvedProviderType === 'deepseek')
     ? (String(providerModel || normalizedModel || '').trim() || null)
     : null;
   try {

package/server/services/about-service.mjs

@@ -30,6 +30,7 @@ export const ABOUT_PROVIDER_LABELS = Object.freeze({
   'claude-cloud': 'Claude Cloud',
   cursor: 'Cursor',
   grok: 'Grok',
+  deepseek: 'DeepSeek',
 });
 
 // The CLI each provider runs, keyed as the CLI install service keys them.

package/server/services/claude-session-leftovers.mjs

@@ -0,0 +1,226 @@
+// What a Claude Code session leaves in its config directory besides the
+// transcript, removed when the relay deletes the conversation.
+//
+// Only for a config directory the relay owns (DeepSeek's `deepseek-claude`
+// in the data folder), never the host's ~/.claude: the user's own CLI keeps
+// its sessions there. The relay stops the worker before it deletes anything,
+// and a stopped CLI is killed without its exit cleanup, so it leaves (the
+// bundled CLI, checked 2026-10-25):
+// - `session-env/<session id>/`, the session's hook environment files;
+// - `sessions/<pid>.json`, the process's registration (`{ pid, sessionId,
+//   cwd, startedAt, ... }`), and `sessions/<pid>.<sha256>.key`, its
+//   messaging key;
+// - `shell-snapshots/snapshot-<shell>-<ms>-<random>.sh`, the shell snapshot
+//   the process took at its start, whose name carries no session id: it is
+//   matched by the time in its name against the session's CLI starts;
+// - `projects/<slug(cwd)>/` with an empty `memory/`, once its last session
+//   is gone.
+// What belongs to another session stays: a registration of a live process,
+// a snapshot that also lies in the start window of another session's CLI,
+// and a project folder that still holds anything but an empty `memory/`.
+//
+// A CLI that exits on its own removes its registration but not always its
+// snapshot: the registration goes in a synchronous `exit` handler, the
+// snapshot only in the CLI's asynchronous cleanup, which a stop does not
+// wait for (a worker restart left the first CLI's snapshot behind with no
+// registration to match it). So the relay records every CLI start of a
+// session itself (recordClaudeCliStart, from the worker's report at the
+// CLI's first init) in `oar-cli-starts.json` in the config dir, and the
+// delete matches snapshots against those starts as well as against the
+// registrations. Every recorded start of another session protects its
+// window, as a registration does.
+
+import nodeFs from 'node:fs';
+import nodePath from 'node:path';
+
+const SESSION_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const REGISTRATION_PATTERN = /^(\d{1,10})\.json$/;
+const SNAPSHOT_PATTERN = /^snapshot-[a-z]+-(\d{10,16})-[A-Za-z0-9]+(?:-[A-Za-z0-9-]+)?\.sh$/;
+// The snapshot is taken while the CLI starts, around its registration.
+const SNAPSHOT_WINDOW_BEFORE_MS = 60_000;
+const SNAPSHOT_WINDOW_AFTER_MS = 120_000;
+const MAX_ENTRIES = 2_000;
+// The relay's record of CLI starts: one file, keyed by session id inside it.
+const CLI_STARTS_FILE = 'oar-cli-starts.json';
+const MAX_STARTS_PER_SESSION = 200;
+const MAX_SESSIONS_RECORDED = 5_000;
+
+function defaultIsPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error?.code === 'EPERM';
+  }
+}
+
+function readDir(fs, dir) {
+  try {
+    return fs.readdirSync(dir).slice(0, MAX_ENTRIES);
+  } catch {
+    return [];
+  }
+}
+
+function remove(fs, target, removed) {
+  try {
+    fs.rmSync(target, { recursive: true, force: true });
+    removed.push(target);
+  } catch {}
+}
+
+/** The registrations in `sessions/`: `{ pid, sessionId, startedAt, file }`. */
+function readRegistrations(fs, path, sessionsDir) {
+  const registrations = [];
+  for (const name of readDir(fs, sessionsDir)) {
+    const match = REGISTRATION_PATTERN.exec(name);
+    if (!match) continue;
+    let parsed = null;
+    try {
+      parsed = JSON.parse(fs.readFileSync(path.join(sessionsDir, name), 'utf8'));
+    } catch {
+      continue;
+    }
+    const startedAt = Number(parsed?.startedAt);
+    registrations.push({
+      pid: Number(match[1]),
+      sessionId: String(parsed?.sessionId ?? ''),
+      startedAt: Number.isFinite(startedAt) ? startedAt : null,
+      file: name,
+    });
+  }
+  return registrations;
+}
+
+/** `{ [sessionId]: [startedAt ms, ...] }` from the relay's record, or `{}`. */
+function readCliStarts(fs, file) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const sessions = parsed?.sessions && typeof parsed.sessions === 'object' ? parsed.sessions : {};
+    const starts = {};
+    for (const [id, list] of Object.entries(sessions)) {
+      if (!SESSION_ID_PATTERN.test(id) || !Array.isArray(list)) continue;
+      starts[id] = list.map(Number).filter(Number.isFinite);
+    }
+    return starts;
+  } catch {
+    return {};
+  }
+}
+
+function writeCliStarts(fs, file, starts) {
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify({ version: 1, sessions: starts }), { encoding: 'utf8', mode: 0o600 });
+  fs.renameSync(tmp, file);
+}
+
+/**
+ * Note that a CLI started for `nativeSessionId` at `startedAt` (ms), under
+ * the relay's own config dir. Best-effort; returns whether it was noted.
+ */
+export function recordClaudeCliStart({ configRoot, nativeSessionId, startedAt, fs = nodeFs, path = nodePath } = {}) {
+  const root = String(configRoot || '').trim();
+  const sessionId = String(nativeSessionId || '').trim();
+  const at = Number(startedAt);
+  if (!root || !SESSION_ID_PATTERN.test(sessionId) || !Number.isFinite(at) || at <= 0) return false;
+  try {
+    const resolvedRoot = path.resolve(root);
+    fs.mkdirSync(resolvedRoot, { recursive: true });
+    const file = path.join(resolvedRoot, CLI_STARTS_FILE);
+    const starts = readCliStarts(fs, file);
+    const list = starts[sessionId] || [];
+    if (!list.includes(at)) list.push(at);
+    starts[sessionId] = list.slice(-MAX_STARTS_PER_SESSION);
+    // A record that outgrows its cap drops the sessions started longest ago.
+    const ids = Object.keys(starts);
+    if (ids.length > MAX_SESSIONS_RECORDED) {
+      const newest = (id) => Math.max(...starts[id], 0);
+      for (const id of ids.sort((a, b) => newest(a) - newest(b)).slice(0, ids.length - MAX_SESSIONS_RECORDED)) delete starts[id];
+    }
+    writeCliStarts(fs, file, starts);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function inStartWindow(time, startedAt) {
+  return startedAt !== null && time >= startedAt - SNAPSHOT_WINDOW_BEFORE_MS && time <= startedAt + SNAPSHOT_WINDOW_AFTER_MS;
+}
+
+/**
+ * Remove what the session `nativeSessionId` left under `configRoot`, and
+ * `projectDirPath` when nothing but an empty `memory/` is left in it.
+ * Returns the paths removed. Best-effort: a path that will not go stays.
+ */
+export function removeClaudeSessionLeftovers({
+  configRoot,
+  nativeSessionId,
+  projectDirPath = '',
+  fs = nodeFs,
+  path = nodePath,
+  isPidAlive = defaultIsPidAlive,
+} = {}) {
+  const removed = [];
+  const root = String(configRoot || '').trim();
+  const sessionId = String(nativeSessionId || '').trim();
+  if (!root || !SESSION_ID_PATTERN.test(sessionId)) return removed;
+  const resolvedRoot = path.resolve(root);
+
+  const sessionEnv = path.join(resolvedRoot, 'session-env', sessionId);
+  if (fs.existsSync(sessionEnv)) remove(fs, sessionEnv, removed);
+
+  const sessionsDir = path.join(resolvedRoot, 'sessions');
+  const registrations = readRegistrations(fs, path, sessionsDir);
+  const stale = registrations.filter((entry) => entry.sessionId === sessionId && !isPidAlive(entry.pid));
+  const others = registrations.filter((entry) => !stale.includes(entry));
+  const files = readDir(fs, sessionsDir);
+  for (const entry of stale) {
+    remove(fs, path.join(sessionsDir, entry.file), removed);
+    const keyPrefix = `${entry.pid}.`;
+    for (const name of files) {
+      if (name.startsWith(keyPrefix) && name.endsWith('.key')) remove(fs, path.join(sessionsDir, name), removed);
+    }
+  }
+
+  // The session's CLI starts: its dead registrations and every start the
+  // relay recorded. Another session's: its registrations and its recorded
+  // starts, whose windows are never touched.
+  const startsFile = path.join(resolvedRoot, CLI_STARTS_FILE);
+  const recorded = readCliStarts(fs, startsFile);
+  const ownStarts = [...stale.map((entry) => entry.startedAt), ...(recorded[sessionId] || [])];
+  const otherStarts = [
+    ...others.map((entry) => entry.startedAt),
+    ...Object.entries(recorded).filter(([id]) => id !== sessionId).flatMap(([, list]) => list),
+  ];
+  const snapshotsDir = path.join(resolvedRoot, 'shell-snapshots');
+  for (const name of readDir(fs, snapshotsDir)) {
+    const match = SNAPSHOT_PATTERN.exec(name);
+    if (!match) continue;
+    const takenAt = Number(match[1]);
+    if (!ownStarts.some((startedAt) => inStartWindow(takenAt, startedAt))) continue;
+    if (otherStarts.some((startedAt) => inStartWindow(takenAt, startedAt))) continue;
+    remove(fs, path.join(snapshotsDir, name), removed);
+  }
+  if (recorded[sessionId]) {
+    delete recorded[sessionId];
+    try {
+      writeCliStarts(fs, startsFile, recorded);
+    } catch {}
+  }
+
+  const projectDir = String(projectDirPath || '').trim() ? path.resolve(projectDirPath) : '';
+  if (projectDir && path.dirname(projectDir) === path.join(resolvedRoot, 'projects')) {
+    const entries = readDir(fs, projectDir);
+    const isEmptyDir = (dir) => {
+      try {
+        return fs.statSync(dir).isDirectory() && fs.readdirSync(dir).length === 0;
+      } catch {
+        return false;
+      }
+    };
+    const onlyEmptyMemory = entries.every((name) => name === 'memory' && isEmptyDir(path.join(projectDir, name)));
+    if (fs.existsSync(projectDir) && onlyEmptyMemory) remove(fs, projectDir, removed);
+  }
+  return removed;
+}

package/server/services/deepseek-balance-service.mjs

@@ -0,0 +1,102 @@
+'use strict';
+
+// The DeepSeek account balance for the usage card: `GET /user/balance` with
+// the saved key and base URL (shared/deepseek-api.mjs), only while DeepSeek
+// is on. An answer is kept for a minute, a failure for 15 seconds, and a
+// changed key or endpoint is read afresh. Never throws: a failure is an
+// answer of its own, `{ ok: false, code, error }`, whose text never holds the
+// key, with the last good answer beside it as `previous`.
+
+import { createDeepSeekApiClient } from '../../shared/deepseek-api.mjs';
+
+const DEFAULT_TTL_MS = 60_000;
+const DEFAULT_ERROR_TTL_MS = 15_000;
+// The usage modal waits for its slowest read, so this one is kept short.
+const DEFAULT_TIMEOUT_MS = 5_000;
+
+function redact(text, apiKey) {
+  const value = String(text ?? '');
+  const key = String(apiKey ?? '').trim();
+  return key ? value.split(key).join('[redacted]') : value;
+}
+
+export function createDeepSeekBalanceService({
+  getSettings = () => null,
+  fetchImpl = globalThis.fetch,
+  createClient = createDeepSeekApiClient,
+  now = () => Date.now(),
+  ttlMs = DEFAULT_TTL_MS,
+  errorTtlMs = DEFAULT_ERROR_TTL_MS,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  let cache = null; // { identity, entry, expiresAt }
+  let lastGood = null; // { identity, entry }
+  let inflight = null; // { identity, promise }
+
+  function readSettings() {
+    try {
+      return getSettings() || null;
+    } catch {
+      return null;
+    }
+  }
+
+  async function read(settings) {
+    const fetchedAt = new Date(now()).toISOString();
+    if (!settings.apiKey) {
+      return { ok: false, code: 'not_configured', error: 'DeepSeek API key is not configured', fetchedAt };
+    }
+    try {
+      const client = createClient({ baseUrl: settings.baseUrl, apiKey: settings.apiKey, fetchImpl, timeoutMs });
+      const { isAvailable, balances } = await client.getBalance();
+      return { ok: true, isAvailable: isAvailable === true, balances: Array.isArray(balances) ? balances : [], fetchedAt };
+    } catch (error) {
+      return {
+        ok: false,
+        code: String(error?.code || 'error'),
+        error: redact(error?.message || error || 'DeepSeek balance check failed', settings.apiKey).slice(0, 300),
+        fetchedAt,
+      };
+    }
+  }
+
+  /**
+   * The balance, or null while DeepSeek is off. `{ force: true }` skips the
+   * cache (a fresh read is still shared with one already running).
+   */
+  async function getBalance({ force = false } = {}) {
+    const settings = readSettings();
+    if (settings?.enabled !== true) return null;
+    const identity = `${settings.baseUrl || ''}\n${settings.apiKey || ''}`;
+    const answer = (entry, cached) => (entry.ok || lastGood?.identity !== identity
+      ? { ...entry, cached }
+      : { ...entry, cached, previous: lastGood.entry });
+    if (!force && cache && cache.identity === identity && cache.expiresAt > now()) {
+      return answer(cache.entry, true);
+    }
+    if (!inflight || inflight.identity !== identity) {
+      const promise = read(settings).then((entry) => {
+        cache = { identity, entry, expiresAt: now() + (entry.ok ? ttlMs : errorTtlMs) };
+        if (entry.ok) lastGood = { identity, entry };
+        return entry;
+      }).finally(() => {
+        if (inflight?.promise === promise) inflight = null;
+      });
+      inflight = { identity, promise };
+    }
+    return answer(await inflight.promise, false);
+  }
+
+  /**
+   * The last good answer for the saved key and endpoint, without reading
+   * anew; null when there is none (or DeepSeek is off).
+   */
+  function peekBalance() {
+    const settings = readSettings();
+    if (settings?.enabled !== true) return null;
+    const identity = `${settings.baseUrl || ''}\n${settings.apiKey || ''}`;
+    return lastGood?.identity === identity ? lastGood.entry : null;
+  }
+
+  return { getBalance, peekBalance };
+}