agent-dag 1.43.0 → 1.44.1

package/src/server/cswap-auto.mjs

@@ -11,6 +11,8 @@
 // on and the setting survives restarts.
 import { run } from "./exec.mjs";
 import { cswapBin } from "./cswap-install.mjs";
+import { invalidateClaudeAccountsCache } from "./claude-accounts.mjs";
+import { invalidateQuotaCache } from "./quota.mjs";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -62,6 +64,29 @@ export async function readCswapConfig() {
   return out;
 }
 
+/**
+ * What the model list may be made of before it becomes an argv element.
+ *
+ * The character class is the same one this field has always had — a
+ * comma-separated list of plain model names, bounded at 120 — with the one rule
+ * #543 wrote down at cswap-admin.mjs's EMAIL_OK added to the front: *"The
+ * leading-character rule is the same argv-position rule ALIAS_OK now carries."*
+ *
+ * This is the THIRD free-text field to reach an argument vector and the first
+ * one that pass missed, because it lives in a different module. It is not a
+ * different question. `{ key: "autoswitch.model", value: "-h" }` produced
+ * `cswap config set autoswitch.model -h`; argparse on the other side reads the
+ * leading dash as an option rather than as data, prints help, exits 0 — so
+ * `r.ok` is true and the deck reports a setting saved that was never written,
+ * after which the panel's optimistic value disagrees with the next read (#584).
+ *
+ * Only the first character is constrained, so `claude-3-5-sonnet` and every
+ * other dash-bearing model name still works. cswap-argv-position.test.ts
+ * enumerates every field this rule covers, so a fourth cannot be added without
+ * one.
+ */
+const MODEL_LIST_OK = /^(?!-)[A-Za-z0-9 ,._-]{1,120}$/;
+
 /** Validate against SETTINGS, then hand to `cswap config set`. */
 export async function setCswapConfig(key, value) {
   const spec = SETTINGS[key];
@@ -78,7 +103,7 @@ export async function setCswapConfig(key, value) {
   } else {
     // Model names: a comma-separated list of plain words, or "all".
     str = String(value ?? "").trim();
-    if (str && !/^[A-Za-z0-9 ,._-]{1,120}$/.test(str)) return { ok: false, reason: "bad_value" };
+    if (str && !MODEL_LIST_OK.test(str)) return { ok: false, reason: "bad_value" };
   }
 
   const r = await run(await cswapBin(), ["config", "set", key, str]);
@@ -98,6 +123,14 @@ function summarise(stdout) {
 
   return {
     event:     action?.event ?? "no-switch",
+    // Whether the LIVE ACCOUNT MOVED, which is a narrower question than which
+    // event came last and the only one the caches care about. Taken over every
+    // event rather than over `action`, so a quarantine or an error emitted after
+    // the switch cannot hide it; and `dryRun` is checked even though this
+    // module's ticks never pass `--dry-run`, because the engine emits the same
+    // `switch` event for a decision it did not carry out, and a false positive
+    // here throws away readings that cost a subprocess each.
+    switched:  events.some(e => e.event === "switch" && e.dryRun !== true),
     reason:    action?.reason ?? null,
     detail:    action?.detail ?? null,
     from:      action?.from ?? null,
@@ -120,6 +153,68 @@ async function runAutoTick() {
 
 // ── external engine detection ──────────────────────────────────────────────
 
+/**
+ * One command line, as a list of the words a process was actually launched
+ * with.
+ *
+ * The quote characters are separators here, not delimiters, and that is the
+ * whole point of #552. `Win32_Process.CommandLine` reports what the CREATOR
+ * wrote, and every launcher on Windows except a human typing at `cmd.exe`
+ * quotes the executable:
+ *
+ *     "C:\Users\dorin\.local\bin\cswap.exe" auto
+ *
+ * — which is what .NET's `Process.Start` writes, so PowerShell, Windows
+ * Terminal's default profile, Task Scheduler and an Explorer shortcut all
+ * produce it. A pattern that wanted whitespace immediately after `cswap.exe`
+ * saw a `"` there and answered no, for every one of them.
+ *
+ * The deck's own spawns are the same shape from the other side: viaCmd in
+ * src/server/exec.mjs launches a `.cmd` shim as
+ * `cmd.exe /d /s /c ""C:\…\cswap.cmd" "auto" "--once""`, with the whole line
+ * wrapped in one more pair of quotes because that is what `cmd /c` wants.
+ * Treating `"` as a separator takes both apart with no parser and no knowledge
+ * of which launcher wrote the line — the outer pair, the per-argument pairs and
+ * the bare case all collapse to the same token list.
+ *
+ * What it deliberately does NOT do is respect a quoted path containing spaces:
+ * `"C:\Program Files\cswap\cswap.exe" auto` splits into three tokens rather than
+ * two. That costs nothing here — the tail token is still `cswap.exe` followed by
+ * `auto`, which is the only question asked — and the alternative is a real
+ * command-line parser for a probe whose wrong answer must never be a crash.
+ */
+export function commandTokens(line) {
+  return String(line ?? "").split(/["\s]+/).filter(Boolean);
+}
+
+/** The last path component of a token: `C:\bin\cswap.exe` → `cswap.exe`. */
+const leaf = (token) => token.split(/[\\/]/).pop() ?? "";
+
+/** Every spelling of the executable, on every platform. */
+const CSWAP_EXE = /^cswap(\.exe|\.cmd|\.bat)?$/i;
+
+/**
+ * True when this command line is a long-lived `cswap auto` loop.
+ *
+ * The rule, stated over tokens rather than characters: some token IS the cswap
+ * executable — its last path component, so `/opt/bin/mycswap` and `notcswap`
+ * are somebody else's program — and the token straight after it is exactly
+ * `auto`, so `autopilot` and `automate` are not this. `--once` anywhere rules
+ * the line out: the deck's own ticks carry it, and so does a cron user's.
+ *
+ * Pure and exported so the Windows shapes can be checked from a Mac. The
+ * residual false positive is a line that mentions cswap as an ARGUMENT and then
+ * `auto` — `myprog --exe cswap auto`. That direction is the safe one: a wrong
+ * `true` is a deck that stays quiet, while a wrong `false` is two engines moving
+ * the same live Claude account.
+ */
+export function looksLikeAutoLoop(line) {
+  if (/--once/i.test(String(line ?? ""))) return false;
+  const tokens = commandTokens(line);
+  return tokens.some((token, i) =>
+    CSWAP_EXE.test(leaf(token)) && String(tokens[i + 1] ?? "").toLowerCase() === "auto");
+}
+
 /**
  * True when the user is already running `cswap auto` themselves.
  *
@@ -138,17 +233,25 @@ async function runAutoTick() {
  */
 export async function externalAutoRunning() {
   // A line is the user's loop if it runs `cswap auto` without --once. Our own
-  // ticks are --once, and so is a cron user's.
-  const isLoop = (line) => /(^|[\\/])cswap(\.exe|\.cmd|\.bat)?\s+auto(\s|$)/i.test(line.trim())
-                        && !/--once/i.test(line);
+  // ticks are --once, and so is a cron user's. See looksLikeAutoLoop.
+  const isLoop = looksLikeAutoLoop;
 
   if (process.platform === "win32") {
     // No `ps` on Windows, and `tasklist` reports the image name only — every
     // Python tool shows up as python.exe, which cannot tell cswap from
     // anything else. CIM is the one place the full command line is available.
+    //
+    // `Out-String -Width 32767` is not decoration. `-ExpandProperty` emits
+    // strings, and strings leave PowerShell through its console FORMATTER,
+    // which hard-wraps at the host buffer width — 80 columns on a redirected
+    // stdout, which is what a spawned child always has. A real command line
+    // (`"C:\Users\dorin\AppData\Local\Programs\Python\Python312\Scripts\cswap.exe" auto`)
+    // is longer than that, so the executable and its subcommand arrived on
+    // SEPARATE LINES and no per-line match could ever see both. 32767 is the
+    // maximum length Windows allows a command line, so nothing real can wrap.
     const r = await run("powershell.exe", [
       "-NoProfile", "-NonInteractive", "-Command",
-      "Get-CimInstance Win32_Process | Select-Object -ExpandProperty CommandLine",
+      "Get-CimInstance Win32_Process | Select-Object -ExpandProperty CommandLine | Out-String -Width 32767",
     ], { timeout: 8_000 });
     if (!r.ok) return false;   // no PowerShell, or the query was refused
     return r.stdout.split("\n").some(isLoop);
@@ -166,6 +269,12 @@ export async function externalAutoRunning() {
 let _timer   = null;
 let _lastTick = null;
 let _enabled  = false;
+// Set the instant startLoop is entered and cleared when it settles, because
+// `_timer` cannot do that job: it is assigned AFTER an await, and the window in
+// between is what #537 was. See startLoop.
+let _starting = false;
+// The tick in flight, so the interval can skip rather than stack. See tick.
+let _ticking = null;
 
 async function loadState() {
   try { return JSON.parse(await readFile(STATE_PATH, "utf8")); } catch { return {}; }
@@ -183,7 +292,31 @@ async function tickInterval() {
   return Math.max(MIN_INTERVAL_S, Number.isFinite(raw) ? raw : 60) * 1000;
 }
 
-async function tick() {
+/**
+ * Everything the deck holds that belongs to ONE Claude account, dropped.
+ *
+ * The accounts roster is keyed on whichever account claude-swap says is active,
+ * and every quota percentage was read for whoever was active when it was
+ * collected. A switch makes both of them the wrong account's, and neither cache
+ * has any way to find that out for itself: they are refreshed on timers, by
+ * panels that were not told.
+ *
+ * The two caches decay at very different rates, which is why saying nothing was
+ * visibly wrong rather than briefly wrong. claude-accounts.mjs holds its roster
+ * for CACHE_MS = 5s, so the panel flips to the new account almost at once, while
+ * quota.mjs holds its result for a CACHE_MS of its own = 60s — and `_lastGood`
+ * outlives even that, coming back under a "stale" label every five seconds until
+ * the store has something to say about the account the deck moved TO. So for up
+ * to a minute, and for longer than that in the fallback, two panels on one screen
+ * described two different accounts, and the wrong one was the big quota bars:
+ * sitting at the 90% that triggered the switch, for an account nobody is on.
+ */
+function forgetAccountScopedCaches() {
+  invalidateClaudeAccountsCache();
+  invalidateQuotaCache();
+}
+
+async function runTick() {
   // Re-check each time: the user can start their own loop at any point, and
   // the deck should fall silent rather than compete with it.
   if (await externalAutoRunning()) {
@@ -191,14 +324,80 @@ async function tick() {
     return;
   }
   const result = await runAutoTick();
+  // Before `_lastTick`, not after. This is the only path in the deck that moves
+  // the live account without a click behind it, so nothing else is in a position
+  // to make the call — and `_lastTick` is what /api/cswap-auto reports, so
+  // dropping the caches first means anything that can see the tick happened is
+  // already looking at caches that know about it.
+  //
+  // Only on a tick that actually switched. A tick is mostly a poll that decides
+  // to do nothing — cooldown, no candidates, nothing over the threshold — and
+  // invalidating on those would throw away readings the deck paid a subprocess
+  // for, every interval, forever.
+  if (result.switched) forgetAccountScopedCaches();
   _lastTick = { at: Date.now(), ...result };
 }
 
+/**
+ * One tick at a time, whatever the interval is.
+ *
+ * The interval floor is 15 seconds (MIN_INTERVAL_S, and SETTINGS allows exactly
+ * that), while a single tick can legitimately take 8 for externalAutoRunning's
+ * `Get-CimInstance`/`ps` plus 120 for runAutoTick's own timeout. Nothing capped
+ * the fan-out, so a slow `cswap auto --once` — one that is refreshing a token
+ * and switching an account — could have eight copies of itself running against
+ * each other two minutes later, each with a PowerShell process beside it on
+ * Windows. `_lastTick` was then written by whichever finished last rather than
+ * by the most recent tick, so the panel's "last tick" could go backwards.
+ *
+ * A skipped tick is not a lost one: the next interval is at most 15 seconds
+ * away, and the work this schedules is idempotent by design.
+ */
+function tick() {
+  if (_ticking) return _ticking;
+  _ticking = runTick().finally(() => { _ticking = null; });
+  return _ticking;
+}
+
+/**
+ * Start the deck-managed loop, at most once.
+ *
+ * `if (_timer) return` looked like a guard and was not one: `_timer` is assigned
+ * after `await tickInterval()`, which shells out to `cswap config`, so two
+ * callers could both be past the check before either had set it. Two ways in
+ * during that window, both reachable from the UI:
+ *
+ *   - enable then disable, a few hundred milliseconds apart. The disable set
+ *     `_enabled = false` and called stopLoop, which cleared nothing because
+ *     `_timer` was still null — and then the enable came back and installed the
+ *     interval. autoStatus() reported `enabled: false` and the toggle read off
+ *     while every tick went on running `cswap auto --once`, which switches the
+ *     user's live Claude account. A control that says it is off while it moves
+ *     credentials is the worst shape this bug could take.
+ *
+ *   - two enables (a double click, or two tabs). Two intervals, only the second
+ *     reachable from `_timer`, so the first could never be cleared again for the
+ *     life of the process.
+ *
+ * initCswapAuto is a third way in: index.mjs fires it unawaited while the server
+ * is already accepting requests.
+ *
+ * `_starting` is set before the await, so the guard covers the whole function.
+ * `_enabled` is re-read after it, because the answer may have changed while this
+ * was waiting on a subprocess — and a loop that installs itself after the user
+ * has turned it off is the same defect from the other side.
+ */
 async function startLoop() {
-  if (_timer) return;
-  const ms = await tickInterval();
-  _timer = setInterval(() => { tick().catch(() => {}); }, ms);
-  _timer.unref?.();
+  if (_timer || _starting) return;
+  _starting = true;
+  try {
+    const ms = await tickInterval();
+    if (!_enabled) return;   // turned off while we were asking cswap
+    _timer = setInterval(() => { tick().catch(() => {}); }, ms);
+    _timer.unref?.();
+  } finally {
+    _starting = false;
+  }
   tick().catch(() => {});   // don't make the user wait a full interval for the first one
 }
 

package/src/server/cswap-install.mjs

@@ -14,7 +14,7 @@ import { run, runDetached } from "./exec.mjs";
 // file already imports itself.
 import { isOlder } from "./self-update.mjs";
 import { bootstrapUv, existingBootstrappedUv } from "./uv-bootstrap.mjs";
-import { existsSync, mkdirSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { join, posix as posixPath, win32 as winPath } from "node:path";
 import { homedir } from "node:os";
 
@@ -25,6 +25,42 @@ const INSTALL_TIMEOUT_MS = 180_000; // uv resolves + builds a Python env
 const UPDATE_CHECK_MS = 24 * 3600_000;
 const MARKER = join(homedir(), ".agents-deck", ".cswap-update-check");
 
+/**
+ * The subdirectories of `dir`, newest-looking first, or [] when it cannot be
+ * read at all.
+ *
+ * Injected into cswapCandidates below rather than called from it, for the reason
+ * the platform is a parameter there: a Windows layout has to be describable from
+ * a Mac. A missing directory, a disconnected network drive and a profile the
+ * process cannot read are all the same answer — nothing here — never a throw,
+ * because this runs unprompted at startup for an optional panel.
+ *
+ * The sort is numeric so `Python313` sorts above `Python39` rather than below
+ * it: when two interpreters both have a cswap, the newer one is the one the user
+ * most likely installed it with, and the order this returns is the order the
+ * caller probes in.
+ *
+ * Exported for its test rather than for a caller. Every part of it that can be
+ * wrong — which names count as an interpreter, what order they come back in,
+ * what a directory that cannot be read answers — is invisible from
+ * cswapCandidates, which injects a substitute precisely so its own Windows
+ * layout can be checked from a Mac. Driven against real directories in
+ * cswap-admin.test.ts, on whichever OS is running the suite.
+ */
+export function pythonVersionDirs(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true })
+      .filter(e => e.isDirectory() || e.isSymbolicLink())
+      .map(e => e.name)
+      // `Python312`, and the tagged builds the installer also writes:
+      // `Python312-32`, `Python313-arm64`.
+      .filter(n => /^Python\d[\w.-]*$/i.test(n))
+      .sort((a, b) => b.localeCompare(a, "en", { numeric: true }));
+  } catch {
+    return [];
+  }
+}
+
 /**
  * How to invoke cswap: the bare name when PATH resolves it, otherwise an
  * absolute path to where its installers actually put it.
@@ -40,12 +76,14 @@ const MARKER = join(homedir(), ".agents-deck", ".cswap-update-check");
  * up without a restart.
  */
 /**
- * Every place an installer is known to leave cswap. Pure, and the platform is a
- * parameter, so the Windows list can be checked from a Mac — which is the only
- * way this list stays right, since it exists entirely for machines the author is
- * not sitting at.
+ * Every place an installer is known to leave cswap. The platform is a parameter
+ * and the directory listing is injected, so the Windows list can be checked from
+ * a Mac — which is the only way this list stays right, since it exists entirely
+ * for machines the author is not sitting at.
  */
-export function cswapCandidates(platform = process.platform, env = process.env, home = homedir()) {
+export function cswapCandidates(platform = process.platform, env = process.env, home = homedir(), {
+  versionDirs = pythonVersionDirs,
+} = {}) {
   // The path flavour follows the PLATFORM ARGUMENT, not the host: node's `join`
   // would emit forward slashes when this is exercised from a Mac, which is both
   // wrong for the caller and invisible in a test.
@@ -60,8 +98,31 @@ export function cswapCandidates(platform = process.platform, env = process.env,
   if (platform === "win32") {
     // pipx before 1.5, and any `pip install --user`. APPDATA is respected when
     // set because a roaming profile moves it off the home directory.
-    dirs.push(join(env.APPDATA || join(home, "AppData", "Roaming"), "Python", "Scripts"));
-    dirs.push(join(env.LOCALAPPDATA || join(home, "AppData", "Local"), "Programs", "Python", "Scripts"));
+    //
+    // THE VERSION SEGMENT IS NOT OPTIONAL (#552). CPython on Windows always
+    // puts the interpreter between the root and `Scripts`:
+    //
+    //     %APPDATA%\Python\Python312\Scripts               pip install --user
+    //     %LOCALAPPDATA%\Programs\Python\Python312\Scripts per-user installer
+    //
+    // — `{userbase}\Python{version_nodot}\Scripts` is sysconfig's `nt_user`
+    // scheme, not a convention. The two paths this used to build omitted it, so
+    // NEITHER could exist on a real machine: every candidate missed,
+    // `cswapVersion` answered null, `ensureCswap` reported `not_on_path`, and
+    // the deck re-ran a whole install attempt on every launch for a user who
+    // already had cswap.exe sitting there. The POSIX side never had the bug —
+    // `~/.local/bin` carries no version — which is why this stayed a Windows
+    // false negative in the one function whose whole purpose is to not depend
+    // on PATH.
+    //
+    // Which versions exist is a fact about the machine, so it is read rather
+    // than guessed: enumerating Python38…Python315 would be eight wrong paths
+    // and a ninth wrong one next year.
+    const appData = env.APPDATA || join(home, "AppData", "Roaming");
+    const localAppData = env.LOCALAPPDATA || join(home, "AppData", "Local");
+    for (const root of [join(appData, "Python"), join(localAppData, "Programs", "Python")]) {
+      for (const version of versionDirs(root)) dirs.push(join(root, version, "Scripts"));
+    }
     dirs.push(join(home, "scoop", "shims"));
   } else {
     dirs.push(join(home, ".pyenv", "shims"));
@@ -73,6 +134,137 @@ export function cswapCandidates(platform = process.platform, env = process.env,
   return dirs.map(d => join(d, exe));
 }
 
+// The distribution name, which is what both installers key their directories on
+// — `cswap` is only the console script.
+const PKG = "claude-swap";
+
+/** True when `child` is `dir` or lives under it, in `platform`'s path flavour. */
+function underDir(child, dir, platform) {
+  const { sep, normalize } = platform === "win32" ? winPath : posixPath;
+  const norm = p => {
+    // Windows paths compare case-insensitively, and `C:\x\` and `C:\x` are one
+    // directory.
+    let s = normalize(String(p));
+    if (platform === "win32") s = s.toLowerCase();
+    return s.length > 1 && s.endsWith(sep) ? s.slice(0, -sep.length) : s;
+  };
+  const c = norm(child), d = norm(dir);
+  return c === d || c.startsWith(d + sep);
+}
+
+/**
+ * Where `uv tool install claude-swap` puts the tool's own venv.
+ *
+ * UV_TOOL_DIR wins outright; otherwise uv's persistent data directory, which is
+ * `$XDG_DATA_HOME/uv` or `~/.local/share/uv` on Unix — macOS included, uv does
+ * not use `~/Library` — and `%APPDATA%\uv\data` on Windows. The `data` segment
+ * is Windows-only and is not optional there.
+ */
+function uvToolVenvs(platform, env, home) {
+  const { join } = platform === "win32" ? winPath : posixPath;
+  if (env.UV_TOOL_DIR) return [join(env.UV_TOOL_DIR, PKG)];
+  if (platform === "win32") {
+    const appData = env.APPDATA || join(home, "AppData", "Roaming");
+    return [join(appData, "uv", "data", "tools", PKG)];
+  }
+  return [join(env.XDG_DATA_HOME || join(home, ".local", "share"), "uv", "tools", PKG)];
+}
+
+/**
+ * Where `pipx install claude-swap` puts the package's venv.
+ *
+ * Read off pipx's own `paths.py`: the venvs are always `<home>/venvs`, and the
+ * home is PIPX_HOME when set, else the first EXISTING legacy fallback
+ * (`~/.local/pipx`, plus `~/pipx` on Windows), else platformdirs'
+ * `user_data_path("pipx")`. Since what gets asked here is whether one specific
+ * venv is on disk, every candidate home can simply be tried rather than
+ * replaying pipx's precedence.
+ *
+ * platformdirs on Windows appends the app name twice when no author is given,
+ * which pipx does not give — `%LOCALAPPDATA%\pipx\pipx`, not `%LOCALAPPDATA%\
+ * pipx`. That doubled segment is real and is the whole path on a modern
+ * Windows pipx.
+ */
+function pipxVenvs(platform, env, home) {
+  const { join } = platform === "win32" ? winPath : posixPath;
+  if (env.PIPX_HOME) return [join(env.PIPX_HOME, "venvs", PKG)];
+  const homes = [join(home, ".local", "pipx")];
+  if (platform === "win32") {
+    homes.push(join(home, "pipx"));
+    homes.push(join(env.LOCALAPPDATA || join(home, "AppData", "Local"), "pipx", "pipx"));
+  } else if (platform === "darwin") {
+    homes.push(join(home, "Library", "Application Support", "pipx"));
+  } else {
+    homes.push(join(env.XDG_DATA_HOME || join(home, ".local", "share"), "pipx"));
+  }
+  return homes.map(h => join(h, "venvs", PKG));
+}
+
+function realpathOrSelf(p) {
+  try { return realpathSync(p); } catch { return p; }
+}
+
+/**
+ * Which installer OWNS the claude-swap this machine runs — "uv", "pipx", or
+ * null when nothing offered here does, or when the evidence is ambiguous.
+ *
+ * The daily upgrade used to be handed to `findInstaller()`, which returns the
+ * first tool that answers `--version`. That is the right question when choosing
+ * something to install WITH and the wrong one when upgrading something already
+ * installed: on a machine with uv present and claude-swap installed some other
+ * way — a `pip install --user` copy, which #574 taught cswapBin to find, or a
+ * pipx one — the upgrade went to uv, which answers
+ *
+ *     error: Failed to upgrade claude-swap
+ *       Caused by: `claude-swap` is not installed; run `uv tool install …`
+ *
+ * and pipx, given someone else's package, answers "Package is not installed.
+ * Expected to find <PIPX_HOME>/venvs/claude-swap, but it does not exist." Both
+ * go through runDetached, which reads no output and waits for no exit, so the
+ * refusal reached nobody while ensureCswap still reported "upgrading" and the
+ * marker was already burned for the day. The version never moved and the deck
+ * said it was moving, every launch, forever.
+ *
+ * Two signals, strongest first. The executable the deck actually runs, with its
+ * symlinks followed, sitting inside one installer's directory is decisive —
+ * that is the POSIX case, where both installers link `~/.local/bin/cswap` at
+ * their own venv. Windows copies the launcher instead, so there the layout
+ * question is asked directly: exactly one of the two venv directories exists.
+ * Zero means nothing offered here owns it — a `pip install --user` copy is the
+ * common shape, and `installers()` deliberately refuses to offer bare pip — and
+ * two means the machine has both and the resolved path did not say which is on
+ * PATH. Both answer null, because a silent boot is better than a daily sentence
+ * that is not true.
+ *
+ * Pure, and platform/env/home/filesystem all arrive as arguments, for the reason
+ * cswapCandidates gives: a Windows layout has to be checkable from a Mac.
+ */
+export function cswapOwner(bin, platform = process.platform, env = process.env, home = homedir(), {
+  exists = existsSync,
+  realpath = realpathOrSelf,
+} = {}) {
+  const roots = [
+    ...uvToolVenvs(platform, env, home).map(dir => ({ owner: "uv", dir })),
+    ...pipxVenvs(platform, env, home).map(dir => ({ owner: "pipx", dir })),
+  ];
+
+  // cswapBin answers the bare word whenever PATH resolved it, and a bare word
+  // points at no layout at all — only a path can be followed.
+  if (typeof bin === "string" && /[\\/]/.test(bin)) {
+    // BOTH sides get resolved, or the comparison is between two spellings of one
+    // directory rather than between two directories. A symlinked home is the
+    // ordinary way that happens — /var → /private/var on macOS, a network or
+    // container-mounted profile on Linux — and it would silently turn the
+    // strongest signal here into no signal at all.
+    const real = realpath(bin);
+    const hit = roots.find(r => underDir(real, realpath(r.dir), platform));
+    if (hit) return hit.owner;
+  }
+
+  const owners = new Set(roots.filter(r => exists(r.dir)).map(r => r.owner));
+  return owners.size === 1 ? [...owners][0] : null;
+}
+
 let _bin = null;
 export async function cswapBin() {
   // An explicit path wins over everything and is never cached away — someone
@@ -196,11 +388,20 @@ async function safePythons() {
  * derivation did not recognise fell through to `-m pipx upgrade` — so the
  * bundled uv, which is the only installer present on a machine that had neither
  * uv nor pipx nor a usable python, was asked to run a pipx command it rejects.
+ *
+ * Every entry also carries the `owner` it speaks for, which is what an upgrade
+ * is matched against. It is a field rather than something read back off `via`
+ * because deriving behaviour from that label is precisely what went wrong the
+ * first time: three of these five spellings are one uv and two are one pipx,
+ * and a fourth spelling arriving later must not silently mean "pipx" by
+ * default. Several entries can share an owner — the bundled uv upgrades what
+ * the system uv installed and vice versa, since both read UV_TOOL_DIR — so the
+ * probe still decides WHICH of an owner's spellings runs.
  */
 async function installers() {
   const out = [
-    { cmd: "uv",   probe: ["--version"], args: ["tool", "install", "claude-swap"], upgrade: ["tool", "upgrade", "claude-swap"], via: "uv" },
-    { cmd: "pipx", probe: ["--version"], args: ["install", "claude-swap"],         upgrade: ["upgrade", "claude-swap"],         via: "pipx" },
+    { cmd: "uv",   probe: ["--version"], args: ["tool", "install", "claude-swap"], upgrade: ["tool", "upgrade", "claude-swap"], via: "uv",   owner: "uv" },
+    { cmd: "pipx", probe: ["--version"], args: ["install", "claude-swap"],         upgrade: ["upgrade", "claude-swap"],         via: "pipx", owner: "pipx" },
   ];
   // A uv fetched on an earlier run counts as installed tooling from here on.
   const own = existingBootstrappedUv();
@@ -211,6 +412,7 @@ async function installers() {
       args: ["tool", "install", "claude-swap"],
       upgrade: ["tool", "upgrade", "claude-swap"],
       via: "uv (bundled)",
+      owner: "uv",
     });
   }
   for (const py of await safePythons()) {
@@ -220,6 +422,7 @@ async function installers() {
       args: ["-m", "pipx", "install", "claude-swap"],
       upgrade: ["-m", "pipx", "upgrade", "claude-swap"],
       via: `${py} -m pipx`,
+      owner: "pipx",
     });
   }
   return out;
@@ -299,17 +502,30 @@ async function latestOnPypi() {
  * take tens of seconds, which is not a thing to put in front of the server
  * starting. The running copy keeps working; the new one is there next launch.
  *
- * The command line comes from the installer entry rather than from its label:
- * runDetached captures nothing, so an upgrade aimed at the wrong tool fails
- * where nobody can see it while the caller still reports "upgrading".
+ * The command line comes from the installer entry rather than from its label,
+ * and the ENTRY comes from cswapOwner rather than from whichever tool answers a
+ * probe first: runDetached captures nothing, so an upgrade aimed at the wrong
+ * tool fails where nobody can see it while the caller still reports
+ * "upgrading". Those are the two halves of "aimed at the wrong tool" — a right
+ * argv sent to a tool that does not own the package is just as invisible as a
+ * wrong argv, and was the longer-lived of the two.
  */
 function upgradeInBackground({ cmd, upgrade }) {
   runDetached(cmd, upgrade);
 }
 
-/** Whichever Python tool installer is available, or null. */
-async function findInstaller() {
-  for (const { cmd, probe, upgrade, via } of await installers()) {
+/**
+ * A runnable spelling of the installer that OWNS this claude-swap, or null.
+ *
+ * The owner is decided from the install layout before anything is probed, and
+ * only that owner's entries are then tried — so a uv sitting on a machine whose
+ * claude-swap came from pipx is skipped rather than handed an upgrade it will
+ * refuse. A null owner probes nothing at all: there is no tool here to ask.
+ */
+async function findUpgrader(owner) {
+  if (!owner) return null;
+  for (const { cmd, probe, upgrade, via, owner: speaksFor } of await installers()) {
+    if (speaksFor !== owner) continue;
     if ((await run(cmd, probe, { timeout: 8_000 })).ok) return { cmd, upgrade, via };
   }
   return null;
@@ -335,7 +551,12 @@ export async function ensureCswap() {
     touchMarker();
     const latest = await latestOnPypi();
     if (latest && existing !== "installed" && isOlder(existing, latest)) {
-      const found = await findInstaller();
+      // Who owns it, not what is installed on the machine: an upgrade aimed at
+      // a tool that never installed this package is refused where runDetached
+      // cannot see it, and "upgrading" would then be a sentence printed daily
+      // about nothing. When nobody offered here owns it, "present" is the whole
+      // truth and is what gets said.
+      const found = await findUpgrader(cswapOwner(await cswapBin()));
       if (found) {
         upgradeInBackground(found);
         return { state: "upgrading", version: existing, latest, via: found.via };