agent-dag 3.19.0 → 3.21.0

package/dist/web/index.html

@@ -40,8 +40,8 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DTbVC1d9.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CE-8EKi6.css">
+    <script type="module" crossorigin src="/assets/index-G0ntHhBn.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BYMVIG6f.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.19.0",
+  "version": "3.21.0",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -31,6 +31,18 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.21.0": [
+    {
+      "title": "🖼️ The deck explains itself in pictures",
+      "body": "🎬 First run opens an eight-picture tour instead of the changelog — who is waiting on you, the tree, a node's inside, cost and quota, this machine, accounts, local network, how to start. `Take the tour` on an empty canvas brings it back.\n\n📡 **Local network** has a guide: a card while it is off, `How it works` under an empty list, four pictures ending on `Turn it on`. A machine's row opens its own dialog — address, version and system, the logins it offers, and a name of your own for it. Setup ends on Done.\n\n🔄 The deck updates itself when nobody is looking: no tab focused, no agent mid-turn, thirty seconds quiet. The banner's `auto when idle` switch governs it.\n\n🔑 An account whose numbers were paused resumes on its own, and the panel is titled **Claude accounts** — a Codex login is not in it."
+    }
+  ],
+  "3.20.0": [
+    {
+      "title": "🟢 The deck keeps running after you close the terminal",
+      "body": "`ccdeck` prints the same boot report and gives you the prompt back. The deck stays up, and starts again when you log in.\n\n🛑 **`ccdeck --stop` is the off switch now** — Ctrl+C only cancels a start that is still printing. `--status` says what is running, `--logs` shows what the deck wrote while you were away, and `--foreground` holds the terminal the way every version before this one did.\n\n🔁 Typing `ccdeck` beside a deck that is already up opens **that deck's tab** instead of building a second one. `ccdeck --stop --all` clears any older deck still running from before this version. An `npx` run cannot start at login — `npx ccdeck --install` puts it on your PATH and sets that up.\n\n🔑 An account that will not collect now says which of three things is wrong: **no stored login**, a **login that expired**, or a **keychain the deck cannot open** — with the fix beside it. One with no stored login is filled over the local network by a paired deck that has it.\n\n📡 And decks find each other again on a machine with a VPN up: the beacon was going to an address that never left the machine, so this deck could hear colleagues and none of them could hear it."
+    }
+  ],
   "3.19.0": [
     {
       "title": "🟢 Local network: fixes and improvements",

package/src/server/activity.mjs

@@ -0,0 +1,52 @@
+// Whether any agent is mid-turn, from the hook stream alone.
+//
+// For the one decision the server takes on its own that must not land in the
+// middle of a turn: restarting into a new version while nobody is looking
+// (auto-update.mjs). A restart mid-turn drops the hook events fired during the
+// gap, and the canvas shows those tools in flight until the stale sweeper
+// reaps them — restart.ts states the rule for the page, which decides it from
+// its reducer's `active` state.
+//
+// With no page open there is no reducer, so this keeps the smallest version of
+// it: a session is open from the first event of a turn until the turn ends
+// (`Stop`, `SessionEnd`). SessionStart and Notification move nothing — a CLI
+// sitting at its prompt is not busy, and the idle reminder arrives after the
+// turn it is about. An open session whose last event is older than
+// OPEN_CAP_MS counts as gone rather than busy: a CLI that crashed never sends
+// its Stop, and waiting on one forever would mean never updating.
+export const OPEN_CAP_MS = 30 * 60_000;
+
+const OPENS = new Set([
+  "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "SubagentStart", "SubagentStop",
+]);
+const CLOSES = new Set(["Stop", "SessionEnd"]);
+
+export function createActivity({ openCapMs = OPEN_CAP_MS } = {}) {
+  /** session id → when its turn last produced an event */
+  const open = new Map();
+  let lastAt = 0;
+  return {
+    /** One hook payload, as pushEvent receives it. Anything else is ignored. */
+    note(raw, at) {
+      const name = raw?.hook_event_name;
+      if (!OPENS.has(name) && !CLOSES.has(name)) return;
+      if (at > lastAt) lastAt = at;
+      const id = raw?.session_id;
+      if (typeof id !== "string" || !id) return;
+      if (CLOSES.has(name)) open.delete(id);
+      else open.set(id, at);
+    },
+    /** Whether any turn is still running. */
+    busy(now) {
+      for (const [id, at] of open) {
+        if (Math.abs(now - at) > openCapMs) open.delete(id);
+        else return true;
+      }
+      return false;
+    },
+    /** How long since the last turn event of any session — Infinity before the first. */
+    quietMs(now) {
+      return lastAt ? Math.max(0, now - lastAt) : Infinity;
+    },
+  };
+}

package/src/server/args.mjs

@@ -110,6 +110,25 @@ export function isPortValue(raw) {
  * C:\Users\John Smith\proj` reaches the parser as two arguments, and the second
  * one used to be dropped in silence (see launchNpx in bin/agent-dag.js).
  */
+/**
+ * The flags that do a thing and exit, rather than starting a deck.
+ *
+ * bin/agent-dag.js reads this before it decides whether to detach, and that is
+ * the whole reason it exists as a list rather than as a condition written out
+ * at the call site: a one-shot that detached would print its answer into a log
+ * file and hand the terminal back empty. `ccdeck --version` detaching itself is
+ * the shape of the bug this prevents.
+ */
+export const ONE_SHOT = Object.freeze([
+  "help", "version", "uninstall", "stop", "status", "logs",
+  "install", "installService", "uninstallService",
+]);
+
+/** Is this a command line that answers and leaves? */
+export function isOneShot(flags = {}) {
+  return ONE_SHOT.some((k) => flags[k] === true);
+}
+
 export function parseArgs(args) {
   const out = { unknown: [], incomplete: [] };
   for (let i = 0; i < args.length; i++) {
@@ -140,6 +159,14 @@ export function parseArgs(args) {
     else if (a === "-v" || a === "--version") out.version = true;
     else if (a === "-p" || a === "--port") set("port", "a port number");
     else if (a === "--no-open") out.noOpen = true;
+    else if (a === "--new") out.new = true;
+    else if (a === "--foreground") out.foreground = true;
+    else if (a === "--stop") out.stop = true;
+    else if (a === "--status") out.status = true;
+    else if (a === "--logs") out.logs = true;
+    else if (a === "--install") out.install = true;
+    else if (a === "--install-service") out.installService = true;
+    else if (a === "--uninstall-service") out.uninstallService = true;
     else if (a === "--uninstall") out.uninstall = true;
     else if (a === "--workspace") set("workspace", "a path");
     else if (a === "--scope") out.scope = true;

package/src/server/auto-update.mjs

@@ -0,0 +1,79 @@
+// Updating the deck while nobody is looking at it.
+//
+// The update path had one automatic step, and it needed a page: the banner's
+// `auto when idle` restarted the deck once an install had landed, and only in a
+// tab somebody was looking at. An install itself never happened unless a person
+// pressed `Update now`, and a deck with no tab open stayed on its old code for
+// good. Since 3.20.0 the deck outlives its terminal and runs for days with no
+// tab at all, which made that the common case.
+//
+// So the server does it, at the one moment it cannot interrupt anybody: no tab
+// has focus (presence.mjs), no agent is mid-turn, and no turn has produced an
+// event for AWAY_QUIET_MS (activity.mjs). The same switch governs it — the
+// banner's `auto when idle`, kept in prefs.json as `autoUpdate` now so the
+// server can read it with no page open. A person looking at the deck still gets
+// the banner and its buttons; this is only for when they are not.
+//
+// Every effect goes through the code a press uses — startUpgrade, and the
+// launcher's restart — so an unattended update cannot do anything a person
+// could not have done from the banner. Pure rules here; index.mjs owns the
+// timer and the effects.
+
+/** Quiet before the deck may act: the page's IDLE_BEFORE_RESTART_MS, so the
+ *  two paths agree on what idle means. */
+export const AWAY_QUIET_MS = 30_000;
+
+/** How long a deck that has just started waits before acting at all. A
+ *  relaunch that came back on the version it left would otherwise try again a
+ *  minute later, and again after that; this caps any such loop at one attempt
+ *  per boot grace, under the launcher's own two-strike rule for npx
+ *  (supervisor.mjs, upgradeAttempt). */
+export const AWAY_BOOT_GRACE_MS = 5 * 60_000;
+
+/** How long the same attempt is left alone after it was made: an install that
+ *  failed, a fetch the launcher refused, a restart it could not run. A newer
+ *  version is a different attempt and is not held back by this. */
+export const AWAY_RETRY_MS = 30 * 60_000;
+
+/** How often the server asks. The gate below is answered from memory; only
+ *  when it passes does the tick read the version report, which touches disk. */
+export const AWAY_TICK_MS = 60_000;
+
+/** How long a report that found nothing newer is taken as the answer. The npm
+ *  lookup behind it is hourly anyway, and the report is not free: on Windows
+ *  upgradeBlock proves the npm prefix writable by creating a file in it, and a
+ *  deck left alone overnight would otherwise do that once a minute. */
+export const AWAY_RECHECK_MS = 5 * 60_000;
+
+/**
+ * Whether the deck may consider updating itself right now. Every input is
+ * already in memory, so this runs every tick at no cost.
+ */
+export function awayGate({
+  enabled, supervised, restarting, sinceBootMs, looking, busy, quietMs,
+  graceMs = AWAY_BOOT_GRACE_MS, quietNeedMs = AWAY_QUIET_MS,
+}) {
+  return enabled === true && supervised === true && !restarting
+    && sinceBootMs >= graceMs && !looking && !busy && quietMs >= quietNeedMs;
+}
+
+/**
+ * What to do about the version report, once the gate has passed.
+ *
+ *   restart  the newer code is already on disk (an install landed, or a
+ *            checkout was pulled) — the free half, as pickNotice says
+ *   install  `npm i -g` over a global install; the next tick restarts into it
+ *   npx      the launcher fetches the new version and hands it the port
+ *   null     nothing newer, an install already running, the same attempt
+ *            made too recently, or a copy that only a person can update
+ */
+export function awayUpdateStep({ notice, mode, installing, lastTry, now, retryMs = AWAY_RETRY_MS }) {
+  if (!notice || installing) return { act: null };
+  const target = `${notice.kind}:${notice.to}`;
+  // A clock that moved backwards counts as time elapsed, as everywhere else in
+  // the update path: a deck must not wait out a window it cannot measure.
+  if (lastTry?.target === target && now >= lastTry.at && now - lastTry.at < retryMs) return { act: null, target };
+  if (notice.kind === "restart") return { act: "restart", target };
+  if (notice.kind === "upgrade" && (mode === "install" || mode === "npx")) return { act: mode, target };
+  return { act: null, target };
+}

package/src/server/claude-accounts.mjs

@@ -151,6 +151,27 @@ function heldReading(now) {
 // without a marker would misrepresent them (its own trust ceiling is 3600s).
 const STALE_AFTER_MS = 15 * 60_000;
 
+/**
+ * How long a collector may produce nothing before that is a fault rather than a
+ * cadence.
+ *
+ * TWELVE HOURS, and the number is chosen from what the failure actually looks
+ * like rather than from taste. Measured on the machine that reported this: three
+ * accounts last collected 21 hours, 40 hours and 28 days ago, every one of them
+ * with `consecutiveFailures: 0` — because the thing stopping them was
+ * `keychain_unavailable`, which is claude-swap failing to OPEN the credential
+ * rather than having it rejected, and which never touches that counter.
+ *
+ * Long enough that a laptop closed overnight does not trip it. Short enough that
+ * an account nobody can read stops being advertised to the group as one they
+ * can. And the cost of being wrong is deliberately lopsided: a false "not
+ * collecting" asks a peer for a blob that `cswap import` then declines, because
+ * a plain import skips an account that is present and healthy — while the false
+ * negative this replaces is an account that is never repaired by anything, ever,
+ * and is published to every paired deck as good.
+ */
+const COLLECTION_STOPPED_AFTER_MS = 12 * 60 * 60_000;
+
 // Nudging the collector.
 //
 // Two throttles, because the cost of asking is not the cost of fetching. When
@@ -289,6 +310,94 @@ export function nextReadAt(row, matches, fetchedAtMs, isActive, now) {
  * Either way claude-swap decides whether a network call actually happens, and
  * this is throttled on top of that.
  */
+/**
+ * What claude-swap says about each slot, in its own words.
+ *
+ * `usage.json` records numbers and a failure COUNTER; `cswap list --json`
+ * records a per-slot VERDICT, and the two answer different questions. Measured
+ * on the machine this was written for, at one instant, for the same account:
+ *
+ *   usage.json  ->  consecutiveFailures: 0, lastError: null
+ *   cswap list  ->  usageStatus: "no_credentials"
+ *
+ * Three verdicts, three different things for a person to do — `no_credentials`
+ * is an account to receive or re-add, `relogin_required` is one to sign into,
+ * `keychain_unavailable` is not about the account at all but about the process
+ * asking. The counter can tell none of them apart, and for two of the three it
+ * reads zero.
+ *
+ * WHERE IT COMES FROM COSTS NOTHING EXTRA. nudgeCollector already spawns
+ * `cswap list` when a collection is due, and threw the output away. It now asks
+ * for `--json` and keeps the verdicts. Still not awaited by anyone — the nudge
+ * stays synchronous for its callers — and still one child at a time.
+ */
+let _verdicts = { at: 0, byNum: {} };
+/** Stale after this, because a verdict that outlives its cause is worse than no
+ *  verdict: "no credentials" under an account somebody has since signed into is
+ *  a sentence that sends them to fix what is already fixed. */
+const VERDICT_TTL_MS = 10 * 60_000;
+/** One `cswap list --json` at a time. A collection can take a while on a cold
+ *  network, and a nudge landing inside one must not start a second. */
+let _verdictInFlight = false;
+
+/**
+ * Ask claude-swap about one account RIGHT NOW, rather than reading the cache.
+ *
+ * The cached verdicts are ten minutes old at worst, which is right for a label
+ * and wrong for a decision that writes a credential: somebody who signed in two
+ * minutes ago still reads as `no_credentials` there, and acting on that would
+ * replace the login they just created with a peer's.
+ *
+ * Matched on IDENTITY rather than on the slot number, because a number is a
+ * position in one machine's store and the caller is holding an account.
+ *
+ * Returns null when the question cannot be answered — no claude-swap, a refusal,
+ * an account it does not know. Null is not `no_credentials`, and the one caller
+ * treats it as "do not act".
+ */
+export async function verdictNow(email, org, { runner = run, bin = cswapBin } = {}) {
+  const want = String(email ?? "").trim().toLowerCase();
+  if (!want) return null;
+  try {
+    const out = await runner(await bin(), ["list", "--json"], { timeout: VERDICT_TIMEOUT_MS });
+    if (!out?.ok) return null;
+    const d = JSON.parse(out.stdout);
+    // The same freshly-read answer feeds the cache the panel draws from, since
+    // it cost a subprocess either way.
+    const byNum = readVerdicts(out.stdout);
+    if (Object.keys(byNum).length) _verdicts = { at: Date.now(), byNum };
+    for (const a of Array.isArray(d?.accounts) ? d.accounts : []) {
+      if (String(a?.email ?? "").trim().toLowerCase() !== want) continue;
+      if ((a?.organizationUuid ?? "") !== (org ?? "")) continue;
+      return typeof a?.usageStatus === "string" ? a.usageStatus : null;
+    }
+    return null;
+  } catch { return null; }
+}
+
+/** claude-swap's verdict for a slot, or null when there is none fresh enough. */
+function verdictFor(num, now) {
+  if (now - _verdicts.at > VERDICT_TTL_MS) return null;
+  const v = _verdicts.byNum[String(num)];
+  return typeof v === "string" && v !== "" ? v : null;
+}
+
+/** Read the verdicts out of a `cswap list --json` payload. Tolerant by
+ *  construction: this is another tool's output, and a shape we do not recognise
+ *  means no verdicts rather than a thrown boot. */
+export function readVerdicts(stdout) {
+  try {
+    const d = JSON.parse(stdout);
+    const out = {};
+    for (const a of Array.isArray(d?.accounts) ? d.accounts : []) {
+      if (typeof a?.number === "number" && typeof a?.usageStatus === "string") {
+        out[String(a.number)] = a.usageStatus;
+      }
+    }
+    return out;
+  } catch { return {}; }
+}
+
 function nudgeCollector(rows, slots, now, activeNum) {
   // Did the last ask accomplish anything? Cheap proxy: the newest collection
   // timestamp in the store.
@@ -307,12 +416,35 @@ function nudgeCollector(rows, slots, now, activeNum) {
   if (!due && !freshen) return;
 
   _lastNudge = now;
-  const args = due ? ["list"] : ["auto", "--once", "--dry-run", "--json"];
+  // The due path asks for JSON and KEEPS it — see _verdicts. The dry-run path
+  // stays detached: it is the engine's own collect pass, its JSON is a different
+  // shape, and nothing here reads it.
+  if (!due) {
+    cswapBin().then(bin => runDetached(bin, ["auto", "--once", "--dry-run", "--json"])).catch(() => {});
+    return;
+  }
+  if (_verdictInFlight) return;
+  _verdictInFlight = true;
   // Fire-and-forget: this function is deliberately synchronous so callers never
-  // wait on it, and resolving the binary is the only async part.
-  cswapBin().then(bin => runDetached(bin, args)).catch(() => {});
+  // wait on it, and resolving the binary is the only async part. `run` rather
+  // than `runDetached` only so the output can be read; the caller is no more
+  // aware of it than before.
+  cswapBin()
+    .then(bin => run(bin, ["list", "--json"], { timeout: VERDICT_TIMEOUT_MS }))
+    .then(out => {
+      const byNum = out?.ok ? readVerdicts(out.stdout) : {};
+      // Replaced whole rather than merged. A slot that has gone away must not
+      // keep the verdict it had when it was last seen.
+      if (Object.keys(byNum).length) _verdicts = { at: Date.now(), byNum };
+    })
+    .catch(() => {})
+    .finally(() => { _verdictInFlight = false; });
 }
 
+/** Long enough for a cold collection over a slow network, short enough that a
+ *  wedged claude-swap does not hold a child for the rest of the day. */
+const VERDICT_TIMEOUT_MS = 90_000;
+
 async function readJson(path) {
   try {
     const parsed = JSON.parse(await readFile(path, "utf8"));
@@ -372,6 +504,34 @@ export async function fetchClaudeAccounts({ force = false } = {}) {
   return mine;
 }
 
+// ── the repair nobody should have to press ───────────────────────────────────
+//
+// A `stale-copy` row — claude-swap's stored copy of the signed-in account's
+// login was rejected, while the login itself works — has exactly one repair,
+// and it asks the user nothing: re-capture the copy from the login they already
+// have (cswap-admin's recaptureActive). It was a button, `resume`, which asked a
+// person to confirm the only answer there is. So the read that finds the state
+// starts the repair, and the row carries how it is going instead of a button.
+//
+// HANDED IN, NOT IMPORTED. The repair writes a credential into claude-swap's
+// store, and this module is read by dozens of tests against fixture stores. The
+// server hands it in when it starts listening (index.mjs) and nothing else does,
+// so no test run can reach `cswap add` through a read.
+let _repairStaleCopy = null;
+
+/** Called with `{ num, email, now }` for a `stale-copy` row, and returns that
+ *  row's `repair`. Null unregisters. */
+export function repairStaleCopyWith(fn) {
+  _repairStaleCopy = typeof fn === "function" ? fn : null;
+}
+
+/** The registered repair's state for one row. A repair that throws costs the
+ *  row its state, never the read. */
+function repairFor(num, email, now) {
+  if (!_repairStaleCopy) return null;
+  try { return _repairStaleCopy({ num, email, now }) ?? null; } catch { return null; }
+}
+
 /**
  * The read itself, split out from the admission control above it so the guard is
  * readable as the four lines it is.
@@ -449,7 +609,9 @@ async function readRoster(now, gen) {
 
     const fetchedAtMs = matches && typeof row.fetchedAt === "number" ? row.fetchedAt * 1000 : null;
     const isActive = String(seq.activeAccountNumber) === num;
-    const trouble = authTrouble(row, { matches, isActive, identity, email: acct.email });
+    const trouble = authTrouble(row, {
+      matches, isActive, identity, email: acct.email, fetchedAt: fetchedAtMs, now,
+    });
 
     const lanes = [
       lane("five_hour", "5h", good?.five_hour),
@@ -502,6 +664,21 @@ async function readRoster(now, gen) {
       // in as it anyway. The panel says so quietly instead of offering to log
       // them in again.
       staleCopy: trouble?.kind === "stale-copy",
+      // How the deck's own repair of that is going — `{ state: "running" }` or
+      // `{ state: "failed", reason, retryAt }` — and null on every other row.
+      // Asking is what starts it; see repairStaleCopyWith.
+      repair: trouble?.kind === "stale-copy" ? repairFor(Number(num), acct.email ?? null, now) : null,
+      // Nothing has been collected for this account in half a day, and nothing
+      // says why. Its own word because the two existing ones would both be
+      // wrong: `error` claims a rejection that was never reported, and
+      // `staleCopy` promises the user is signed in as it, which is only
+      // knowable for the active account.
+      stopped:   trouble?.kind === "stopped",
+      // claude-swap's own verdict for this slot, when there is a fresh one:
+      // "no_credentials", "relogin_required", "keychain_unavailable", … It is
+      // what turns "not collecting" into a sentence with a next step in it, and
+      // it is null on every machine where the collector has not been asked yet.
+      collector: verdictFor(num, now),
     });
   }
 
@@ -541,8 +718,24 @@ async function readRoster(now, gen) {
  * evidence of anything, so the stored verdict stands: refusing to show a real
  * expiry because a subprocess failed is the opposite mistake.
  */
-export function authTrouble(row, { matches, isActive, identity, email } = {}) {
-  if (!matches || !((row?.consecutiveFailures ?? 0) > 0)) return null;
+export function authTrouble(row, {
+  matches, isActive, identity, email,
+  fetchedAt = null, now = Date.now(), stoppedAfterMs = COLLECTION_STOPPED_AFTER_MS,
+} = {}) {
+  if (!matches) return null;
+  const failing = (row?.consecutiveFailures ?? 0) > 0;
+  // A COLLECTOR THAT HAS PRODUCED NOTHING IN HALF A DAY IS FAILING, whatever
+  // its counter says — see COLLECTION_STOPPED_AFTER_MS. `consecutiveFailures`
+  // counts rejections, and the failure found on the reporting machine was not a
+  // rejection: `cswap list` answered `usageStatus: keychain_unavailable` for
+  // three accounts whose counters all read zero.
+  //
+  // `fetchedAt == null` is deliberately NOT this. That is an account nobody has
+  // ever collected — usually one added a minute ago — and the panel already has
+  // a word for it. Calling a new account broken is a worse first impression than
+  // saying nothing.
+  const stopped = !failing && fetchedAt != null && now - fetchedAt > stoppedAfterMs;
+  if (!failing && !stopped) return null;
 
   const signedInHere = isActive
     && identity
@@ -555,6 +748,12 @@ export function authTrouble(row, { matches, isActive, identity, email } = {}) {
     // fix under a red badge, and it must not offer to sign them in again.
     return { kind: "stale-copy", error: null };
   }
+  // A SILENCE, NOT A DIAGNOSIS. All that is known is that nothing has been
+  // collected for half a day; the reason lives in claude-swap and may be a dead
+  // login, a keychain it cannot open, or a machine that was off. Putting
+  // `invalid_grant` on it would be inventing evidence, and the panel would then
+  // offer "sign in again" for a problem that may not be a sign-in at all.
+  if (stopped) return { kind: "stopped", error: null };
   return { kind: "auth", error: row.lastError ?? "error" };
 }
 

package/src/server/cswap-admin.mjs

@@ -987,6 +987,23 @@ export async function shareAccounts(nums) {
 }
 
 
+/**
+ * Did anything actually arrive in the store?
+ *
+ * THREE STATES MEAN YES AND THEY ARE NOT INTERCHANGEABLE. `imported` is a slot
+ * that did not exist; `healed` and `updated` are one that did and was rewritten,
+ * which is what a forced import produces and what `added` — counting `imported`
+ * alone — reports as nothing having happened. A caller that asked for a replace
+ * and read `added` would conclude its own success had failed.
+ *
+ * `present` is the decline: claude-swap kept what it had. `failed` is the
+ * refusal. Neither is an arrival.
+ */
+export function landed(results) {
+  return (Array.isArray(results) ? results : [])
+    .some(r => r?.state === "imported" || r?.state === "healed" || r?.state === "updated");
+}
+
 /**
  * The identities a bundle carries, or `[]` when it cannot be read.
  *
@@ -1199,26 +1216,39 @@ export function removePromptMatches(line, num) {
  * refresh token dies it quarantines the row: no further collection is
  * attempted, so the numbers freeze and every Refresh re-reads a store that
  * cannot change. #721 fixed the sentence the panel said about that state; this
- * is the button that ends it.
+ * is what ends it — started by the deck itself (autoRecapture, below) the
+ * moment a read finds the state, and still reachable from the admin route.
  *
  * `cswap add` on an account already in the store is an idempotent credential
  * refresh — registerSignedIn above says so in its own words: "No new slot means
  * the account was already managed and cswap refreshed its credentials in
- * place." It captures whatever is signed in RIGHT NOW, which for the active
- * slot is the account the row belongs to, with the working credentials the user
- * already has. Nobody is signed in or out, no browser opens, and the active
- * account does not change.
+ * place." It captures whatever is signed in RIGHT NOW, with the working
+ * credentials the user already has. Nobody is signed in or out, no browser
+ * opens, and the active account does not change.
  *
- * It only ever repairs the ACTIVE slot, because "what is signed in right now"
- * is the only thing `cswap add` can see. The panel offers it nowhere else.
+ * WHICH IS WHY IT ASKS WHO THAT IS FIRST. "Whatever is signed in" is the active
+ * slot's account only while the two agree. Somebody who signed in as another
+ * account in a terminal has made it a different one, and `cswap add` would then
+ * refresh — or add — that account instead. Behind a press that was a narrow
+ * race; with the deck starting it on its own it is the one thing that must be
+ * ruled out. So the capture runs only when the CLI's account is the active
+ * slot's, and, when the caller names an account, that one too.
  */
-export async function recaptureActive() {
+export async function recaptureActive({ expect = null } = {}) {
   return withStoreLock(async () => {
-    // Who is actually signed in, asked before and after, because `cswap add`
-    // captures the live credentials and this is the one check that the thing it
-    // captured is the thing the user meant.
+    // Who is signed in right now: `cswap add` captures THAT, whoever it is.
     const before = await currentIdentity();
     if (!before?.email) return { ok: false, reason: "not_signed_in" };
+    const who = before.email.toLowerCase();
+    const store = await readStore();
+    const activeNum = String(store.activeNum);
+    const activeEmail = String(store.emails[activeNum] ?? "").toLowerCase();
+    // One address under two organizations is two accounts to claude-swap, so a
+    // matching email in another org is still somebody else's slot.
+    const sameOrg = !before.orgId || !store.orgs[activeNum] || before.orgId === store.orgs[activeNum];
+    if (who !== activeEmail || !sameOrg || (expect != null && who !== String(expect).toLowerCase())) {
+      return { ok: false, reason: "not_active_account", email: before.email };
+    }
 
     const add = await run(await cswapBin(), ["add"], { timeout: CSWAP_TIMEOUT_MS });
     if (!add.ok) return { ok: false, reason: "add_failed", error: addFailureText(add) };
@@ -1242,6 +1272,69 @@ export async function recaptureActive() {
   });
 }
 
+// ── the same repair, without the press ──────────────────────────────────────
+
+/**
+ * How long one account is left alone after the deck re-captured it on its own.
+ *
+ * Ten minutes: past claude-swap's longest ordinary poll interval, so a capture
+ * that took has been collected before this could fire again, and one that did
+ * not — a collector that still cannot read the login — costs one `claude auth
+ * status` and one `cswap add` per ten minutes rather than one per panel poll.
+ */
+const AUTO_RECAPTURE_RETRY_MS = 10 * 60_000;
+
+/** Emails whose automatic attempt is under way. Per account rather than one
+ *  flag: after an auto-switch a second account can pause while the first's
+ *  attempt still waits on the store lock, and it must not borrow that attempt's
+ *  `running`. The lock serialises the attempts themselves. */
+const _autoRunning = new Set();
+/** Lower-cased email → the last automatic attempt: when, and why it failed. */
+const _autoTried = new Map();
+
+/**
+ * What the deck's own re-capture of a paused account should do now, given its
+ * last attempt. Pure; exported for tests.
+ *
+ *   running  an attempt is under way
+ *   start    none has been made, or the last is old enough to try again
+ *   failed   one was made inside the window and the row is still paused;
+ *            `reason` is why it failed, or null when the capture itself held
+ */
+export function autoRecaptureState(last, now, { inFlight = false, retryMs = AUTO_RECAPTURE_RETRY_MS } = {}) {
+  if (inFlight) return { state: "running" };
+  if (!last || now - last.at >= retryMs) return { state: "start" };
+  return { state: "failed", reason: last.reason ?? null, retryAt: last.at + retryMs };
+}
+
+/**
+ * Re-capture a paused account because a read found it paused — the repair the
+ * `resume` button used to wait for.
+ *
+ * Synchronous for its caller, which is building a roster row: it starts the
+ * attempt and returns the state to draw. At most one attempt per account under
+ * way and one per AUTO_RECAPTURE_RETRY_MS, always for the account the row names,
+ * which recaptureActive checks against who is signed in inside the store lock.
+ */
+export function autoRecapture({ email, now = Date.now() } = {}) {
+  const key = String(email ?? "").trim().toLowerCase();
+  if (!key) return null;
+  const next = autoRecaptureState(_autoTried.get(key), now, { inFlight: _autoRunning.has(key) });
+  if (next.state !== "start") return next;
+  _autoRunning.add(key);
+  _autoTried.set(key, { at: now, reason: null });
+  recaptureActive({ expect: key })
+    .then(
+      r => { if (!r?.ok) _autoTried.set(key, { at: now, reason: r?.reason ?? "failed" }); },
+      () => { _autoTried.set(key, { at: now, reason: "failed" }); },
+    )
+    // And the roster forgets the row it drew as `running`, so the next read —
+    // forced or not — says how the attempt went, instead of the cache or a
+    // forced read's one-minute floor holding `resuming…` over a failure.
+    .finally(() => { _autoRunning.delete(key); invalidateClaudeAccountsCache(); });
+  return { state: "running" };
+}
+
 export async function removeAccount(num) {
   const n = Number(num);
   if (!Number.isInteger(n) || n < 1 || n > 999) return { ok: false, reason: "bad_account" };