agent-dag 1.46.3 → 1.48.0

package/src/server/index.mjs

@@ -4009,6 +4009,141 @@ async function handleCodexQuota(req, res) {
  */
 export const isCliDate = (v) => v === undefined || /^\d{8}$/.test(v);
 
+/**
+ * What a program drove in this machine's browsers while nobody was browsing.
+ *
+ * A GET, and deliberately not on the event stream. The answer costs a copy of a
+ * History database that a browser holds locked, so it is pulled when the panel
+ * is open and never on a timer — the same reasoning that keeps
+ * /api/system/processes off the clock, for the same kind of cost.
+ *
+ * `refresh=1` drops the read cache. Without it a profile whose History has not
+ * been written since the last look is answered from memory, which is the normal
+ * case and the reason this route is cheap enough to poll while the panel is up.
+ */
+/**
+ * Turning the watch on or off, and how it is tuned.
+ *
+ * A POST, unlike its GET twin, because it writes to disk and because switching
+ * the watch ON starts the deck keeping its own copy of what it sees — a record
+ * of pages the user visited, which is not something a page they have open gets
+ * to arrange for them. The router's own gate is what enforces that: every
+ * non-GET goes through isTrustedMutation and isAuthorizedMutation before it
+ * reaches a handler, which is exactly the pair a GET deliberately skips.
+ */
+async function handleBrowserWatchSettings(req, res) {
+  const raw = await readBody(req).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
+
+  const { readStore, writeStore, normalise } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch-store.mjs")).href
+  );
+  const { invalidateBrowserWatchCache, noteWatchSetting } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
+  );
+  const store = await readStore();
+  // normalise() is the one place a value is judged, so a field this route has
+  // never heard of cannot arrive through it and a bad one falls back rather
+  // than reaching classify().
+  const settings = normalise({ ...store.settings, ...body });
+  // `dismissed` carried forward, and it has to be spelled: writeStore takes a
+  // whole state and writes exactly what it is handed, so a caller that omits
+  // this field ERASES it. Measured — changing the reaction wiped every
+  // dismissal, so every episode the reader had reviewed came straight back on
+  // the next poll, from a settings change that had nothing to do with them.
+  await writeStore({ settings, episodes: store.episodes, dismissed: store.dismissed });
+  // The one line in the log that is somebody acting rather than the deck
+  // reading, which is exactly why it is worth its own entry.
+  if (settings.enabled !== store.settings.enabled) {
+    noteWatchSetting(settings.enabled ? "watch on — keeping its own copy" : "watch off — reading live only");
+  } else {
+    noteWatchSetting(`settings: quiet ${settings.quietMinutes}m, gap ${settings.gapMinutes}m`);
+  }
+  invalidateBrowserWatchCache();
+  return send(res, 200, { ok: true, settings });
+}
+
+/**
+ * Mark one episode as reviewed, so it leaves the Findings list and stays gone.
+ *
+ * A DISMISSAL AND NOT A DELETION, and the difference is the whole design. The
+ * panel rebuilds episodes from the browser's own history on every poll, so
+ * removing the archived row would be undone within ten seconds by the next read
+ * of the same visits. What is stored is that the reader has seen this one.
+ *
+ * The log file is untouched. It is the append-only record the panel promises —
+ * "every address is written in full so you can check it yourself" — and a list
+ * you can tidy is not the same thing as a record you can trust.
+ */
+async function handleBrowserWatchDismiss(req, res) {
+  // No gate of its own: the router runs isTrustedMutation and
+  // isAuthorizedMutation on every non-GET before a handler sees it, which is
+  // the pair its GET twin deliberately skips. A second check here would be a
+  // second thing to keep correct.
+  const raw = await readBody(req).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  const host = typeof body?.host === "string" ? body.host : null;
+  const startMs = typeof body?.startMs === "number" && Number.isFinite(body.startMs) ? body.startMs : null;
+  if (host === null || startMs === null) return send(res, 400, { ok: false, reason: "bad_request" });
+
+  const { readStore, writeStore, episodeKey } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch-store.mjs")).href
+  );
+  const { invalidateBrowserWatchCache, noteWatchSetting } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
+  );
+  const store = await readStore();
+  const key = episodeKey(host, startMs);
+  const dismissed = [...new Set([...(store.dismissed ?? []), key])];
+  await writeStore({ settings: store.settings, episodes: store.episodes, dismissed });
+  // The reader acting on their own list, which is exactly the kind of line the
+  // `act` level exists for.
+  noteWatchSetting(`dismissed ${host}`);
+  invalidateBrowserWatchCache();
+  return send(res, 200, { ok: true });
+}
+
+async function handleBrowserWatch(req, res) {
+  const url = new URL(req.url, "http://localhost");
+  const force = url.searchParams.get("refresh") === "1";
+
+  // Numbers from a query string are refused rather than coerced: NaN would
+  // silently widen the quiet gate to "everything counts", which is the failure
+  // mode that turns this panel into noise nobody reads.
+  const minutes = name => {
+    const raw = url.searchParams.get(name);
+    if (raw === null) return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n > 0 && n <= 24 * 60 ? n * 60_000 : undefined;
+  };
+
+  // Lazily, like every other handler here, and it earns it twice: the four
+  // readers underneath reach for node:sqlite and copy files, and none of that
+  // belongs on the path between `npx ccdeck` and a listening socket.
+  //
+  // Through fetchBrowserWatch rather than the snapshot directly, because
+  // `refresh=1` drops the mtime cache and copies every profile's History
+  // database. That module carries the floor and the inflight slot which bound
+  // what a page looping this GET can spend.
+  const { deckOwnOrigins, fetchBrowserWatch, registeredDeckPorts } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
+  );
+  // The registered ports as well as the documented range: a deck started with
+  // an explicit `--port` outside 4317-4400 opens its own tab like any other,
+  // and the panel used to report it to its owner as a program driving the
+  // browser. Which it was — and the program was ccdeck.
+  const ports = await registeredDeckPorts();
+  return send(res, 200, await fetchBrowserWatch({
+    force,
+    deckOrigins: deckOwnOrigins(undefined, ports),
+    quietMs: minutes("quiet"),
+    gapMs: minutes("gap"),
+  }));
+}
+
 async function handleCcusage(req, res) {
   const url = new URL(req.url, "http://localhost");
   const force = url.searchParams.get("refresh") === "1";
@@ -4106,9 +4241,21 @@ async function handleClaudeAccountAdmin(req, res) {
     case "login":        result = await admin.startLogin({ email: parsed.email }); break;
     case "login-code":   result = await admin.submitLoginCode(parsed.code); break;
     case "login-cancel": result = await admin.cancelLogin(); break;
-    case "share":        result = await admin.shareAccount(parsed.account); break;
-    case "import":       result = await admin.importAccount(parsed.blob); break;
+    // `accounts` is a chosen set, `account` the single row's own button. Both
+    // go to shareAccounts, which treats one account as a bundle of one so the
+    // two entry points cannot drift into two envelope shapes.
+    case "share":        result = await admin.shareAccounts(parsed.accounts ?? parsed.account); break;
+    // `only` names one account inside the pasted bundle, and is the only way
+    // `force` is honoured at all - see importAccount for why the pair is
+    // required rather than the flag alone.
+    case "import":       result = await admin.importAccount(parsed.blob, {
+      force: parsed.force === true,
+      only: parsed.only ?? null,
+    }); break;
     case "remove":       result = await admin.removeAccount(parsed.account); break;
+    // #721. Re-captures the active slot's credentials in place; see
+    // recaptureActive for why this is not a login and cannot become one.
+    case "recapture":    result = await admin.recaptureActive(); break;
     case "alias":        result = await admin.setAlias(parsed.account, parsed.alias); break;
     case "move":         result = await admin.moveAccount(parsed.account, parsed.slot); break;
     default: return send(res, 400, { ok: false, reason: "unknown_action" });
@@ -4995,6 +5142,9 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     }
     if (req.method === "GET"  && url.pathname === "/api/codex-quota") return guard(handleCodexQuota(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/ccusage")     return guard(handleCcusage(req, res), res);
+    if (req.method === "GET"  && url.pathname === "/api/browser-watch") return guard(handleBrowserWatch(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/browser-watch") return guard(handleBrowserWatchSettings(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/browser-watch/dismiss") return guard(handleBrowserWatchDismiss(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/claude-accounts") return guard(handleClaudeAccounts(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/claude-accounts/switch") return guard(handleClaudeAccountSwitch(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/claude-accounts/login")  return guard(handleAccountLoginState(req, res), res);

package/src/server/installer.mjs

@@ -620,6 +620,19 @@ export async function writeDiscovery({ port, workspace, token, persist = null, c
     // than win it and record a rollout it is not even reading. See
     // writesCodexLog in src/server/log-writer.mjs.
     codex: codex !== false,
+    // Does this deck run Browser Watch? The watch elects a single writer among
+    // the decks on a machine, and it elected on port alone — so an older ccdeck
+    // that predates the feature won the election by having the lower port and
+    // then wrote nothing, while the deck that HAS the watch stood down. Measured
+    // on this machine: a v1.46 deck from an npx cache held 4317, answered the
+    // watch route with the SPA's index.html, and Browser Watch silently
+    // recorded nothing for as long as both were up. No error, no log line — the
+    // panel showed findings on screen and the disk stayed empty.
+    //
+    // Same shape as `codex` above, and for the same reason: a deck that is not
+    // doing the work must be left out of the election rather than win it. An
+    // older deck has no such field, so it is excluded by construction.
+    watch: true,
     startedAt: new Date().toISOString(),
   };
   await writeFileAtomic(file, JSON.stringify(data, null, 2) + "\n");