agent-dag 3.2.0 → 3.3.0

package/src/server/browser-watch.mjs

@@ -27,14 +27,14 @@
 // is running, so a deck that was closed all weekend still answers Monday's
 // question completely — which is why there is no process to keep alive and no
 // gap to apologise for.
-import { readFileSync, statSync } from "node:fs";
+import { statSync } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { claudeConfigDir } from "./claude-dir.mjs";
 import { discoverProfiles } from "./browser-profiles.mjs";
-import { readVisitsSince } from "./browser-history.mjs";
+import { msToChromeTime, readVisitsSince } from "./browser-history.mjs";
 import { classify, toEpisodes, defaultExclusions, isProgramNavigation } from "./agent-activity.mjs";
-import { appendLog, logPath, mergeEpisodes, readStore, undismissed, writeStore } from "./browser-watch-store.mjs";
+import { appendLog, logPath, mergeEpisodes, readStore, undismissed, updateStore, writeStore } from "./browser-watch-store.mjs";
 import { browserSurvey } from "./browser-presence.mjs";
 import { available, performable, react } from "./browser-react.mjs";
 import { RELAY_HOST } from "./relay-guard.mjs";
@@ -86,6 +86,22 @@ function mtimeMs(file, deps) {
  * schedule. `stale` is reported so the panel can say when it last actually
  * looked rather than implying the answer is a live one.
  */
+/**
+ * Is that pid still running?
+ *
+ * A bare `catch { continue; }` used to stand where this is called, which threw
+ * away the one distinction that matters: a process this account may not signal
+ * answers EPERM on POSIX and EACCES on Windows (libuv maps
+ * ERROR_ACCESS_DENIED), and both mean ALIVE. Treating them as gone made an
+ * elevated deck invisible to the writer election below, which is how a machine
+ * ends up with two elected writers — duplicate log lines, duplicate reactions,
+ * and two writers racing the same rename.
+ */
+function pidAlive(pid) {
+  try { process.kill(pid, 0); return true; }
+  catch (e) { return !!e && (e.code === "EPERM" || e.code === "EACCES"); }
+}
+
 async function visitsFor(profile, { sinceChromeTime, copyDir, deps = {} }) {
   const stamp = mtimeMs(profile.historyPath, deps);
   if (stamp === null) return { rows: [], degraded: true, reason: "no-history-file", stamp: null };
@@ -227,7 +243,7 @@ export async function registeredDeckPorts(deps = {}) {
     try {
       const d = JSON.parse(await readFile(join(dir, f), "utf8"));
       if (typeof d?.pid !== "number" || typeof d?.port !== "number") continue;
-      try { process.kill(d.pid, 0); } catch { continue; }
+      if (!pidAlive(d.pid)) continue;
       ports.push(d.port);
     } catch { /* corrupt, or gone between listing and read */ }
   }
@@ -283,7 +299,7 @@ function note(level, text, atMs = Date.now(), parts = null) {
   if (logLines.length > LOG_MAX) logLines.length = LOG_MAX;
 }
 
-export function watchLog() {
+function watchLog() {
   return logLines.slice();
 }
 
@@ -341,7 +357,7 @@ async function isReactingDeck(deps = {}) {
       // than by a version comparison this would otherwise have to keep.
       if (d.watch !== true) continue;
       // A record whose process is gone is a leftover, not a rival.
-      try { process.kill(d.pid, 0); } catch { continue; }
+      if (!pidAlive(d.pid)) continue;
       if (!best || d.port < best.port || (d.port === best.port && d.pid < best.pid)) best = d;
     } catch { /* corrupt, or gone between listing and read */ }
   }
@@ -438,6 +454,24 @@ export async function browserWatchSnapshot({
   now = Date.now(),
   platform = process.platform,
   env = process.env,
+  // WHETHER TO READ THE BROWSERS AT ALL ON THIS CALL.
+  //
+  // The panel's badge polls this route every five minutes from the moment the
+  // page loads, and the read is not free or invisible: it copies each Chromium
+  // profile's whole History database into a temp file, queries it, and deletes
+  // the copy. That happened whether or not the watch was switched on, because
+  // `enabled` gates only what is KEPT and what is REACTED to.
+  //
+  // A switch that says off while the deck goes on copying the user's browsing
+  // history every five minutes is not a switch. So the background poll asks for
+  // `live=0`, and with the watch off that is honoured: the archive answers, and
+  // nothing touches a browser. Two things still read live — a watch that is ON,
+  // because recording in the background is the whole feature, and the panel
+  // itself, because that is the user looking.
+  //
+  // Named for what it does rather than `live`, which is already the local name
+  // for the episodes this poll built.
+  readBrowsers = true,
   deps = {},
 } = {}) {
   // The store answers first and the caller's arguments override it, so the
@@ -458,6 +492,36 @@ export async function browserWatchSnapshot({
   if (quietMs === undefined) quietMs = minutes(store.settings.quietMinutes);
   if (gapMs === undefined) gapMs = minutes(store.settings.gapMinutes);
 
+  // The archive alone, for a poll that has not asked to look and a watch that
+  // is not recording. Everything below this line reads browsers.
+  if (!readBrowsers && !enabled) {
+    const archived = undismissed(store.episodes, store.dismissed);
+    return {
+      ok: true,
+      settings: store.settings,
+      reactions: available(platform),
+      log: watchLog(),
+      profiles: [],
+      browsers: [],
+      episodes: archived,
+      coverage: {
+        startedMs: STARTED_MS,
+        oldestVisitMs: null,
+        lastHumanMs: null,
+        quietMs: quietMs ?? 15 * 60_000,
+        logPath: logPath(),
+        checkedMs: _checkedMs,
+        checks: _checks,
+        archived: archived.length,
+        now,
+        // Said rather than implied: a reader who wonders why the profile list
+        // is empty gets the reason, in the same word the switch uses.
+        why: "the watch is off, so no browser was read on this poll",
+      },
+      degraded: false,
+    };
+  }
+
   const profiles = (deps.discoverProfiles ?? discoverProfiles)(platform, env, undefined, deps.fs);
   // Fixed for the life of the process, which is also what keeps the mtime cache
   // working: a floor computed from `now` moves every millisecond and would land
@@ -465,9 +529,11 @@ export async function browserWatchSnapshot({
   // it re-read and re-copied every database on every request while looking
   // perfectly correct, because only the cost was wrong.
   const sinceMs = STARTED_MS;
-  // Chrome counts microseconds from 1601. Built here rather than imported so the
-  // window is one expression the reader can check against the reader's own.
-  const sinceChromeTime = String((BigInt(sinceMs) + 11644473600000n) * 1000n);
+  // Chrome counts microseconds from 1601, and `msToChromeTime` is where that
+  // conversion lives — its own doc names this caller. The inline copy that used
+  // to stand here duplicated both constants and, unlike the helper, had no
+  // guard for a non-finite input: it threw where the helper returns "0".
+  const sinceChromeTime = msToChromeTime(sinceMs);
 
   const exclude = defaultExclusions(deckOrigins);
   const opts = {};
@@ -632,7 +698,21 @@ export async function browserWatchSnapshot({
     if (fresh.length > 0) {
       note("find", `${fresh.length} new episode${fresh.length === 1 ? "" : "s"} · ${kept.length} kept`, now);
     }
-    await (deps.writeStore ?? writeStore)({ settings: store.settings, episodes: kept, dismissed: store.dismissed }, undefined, deps);
+    // THE ARCHIVE IS OURS TO WRITE; THE OTHER TWO FIELDS ARE NOT. This poll
+    // takes about 400ms — a 21 MB History copy plus the sqlite read — and it
+    // used to write back the `dismissed` and `settings` it had read at the
+    // start, so a dismissal or a watch-off toggle made while it ran was
+    // reverted ten seconds later by the next poll. Re-merging inside the update
+    // keeps this function's own answer and takes the other two from disk as
+    // they are at the moment of the write.
+    const merge = cur => ({
+      settings: cur.settings,
+      episodes: mergeEpisodes(cur.episodes, live, now),
+      dismissed: cur.dismissed,
+    });
+    if (deps.updateStore) await deps.updateStore(merge, undefined, deps);
+    else if (deps.writeStore) await deps.writeStore(merge(store), undefined, deps);
+    else await updateStore(merge, undefined, deps);
     await (deps.appendLog ?? appendLog)(fresh, undefined, deps);
 
     // REACT ONLY TO WHAT IS NEW, AND ONLY ONCE. `fresh` is the set that was not

package/src/server/ccusage.mjs

@@ -823,6 +823,34 @@ let _byAgentUnsupported = false;
  */
 const blamesByAgent = (text) => /by-agent/i.test(String(text ?? ""));
 
+/**
+ * BOTH REPORTS FROM ONE LOAD.
+ *
+ * `daily` answers "what did this range cost" and `session` answers "which
+ * session spent it". They used to be two commands and therefore two children —
+ * two npx resolutions, two Node starts, and two full walks of every transcript
+ * on the machine for the same set of files.
+ *
+ * `--sections` is ccusage's own answer to that: one load, several report
+ * sections in one JSON object. Measured against this machine's logs, asking for
+ * `daily,session` returns exactly what the two runs returned — `daily` (with
+ * its `agents` split when `--by-agent` rides along), `session`, and one
+ * `totals` — so the deck reads the same fields off one child.
+ *
+ * Not on `session` alone: the panel's totals and its per-model split come from
+ * `daily`, so `daily` is the command and the sessions are the extra section.
+ */
+const SECTIONS = ["--sections", "daily,session"];
+const blamesSections = (text) => /sections/i.test(String(text ?? ""));
+
+/**
+ * A ccusage too old for `--sections`, remembered for the life of the process —
+ * the same narrow memory `_byAgentUnsupported` keeps, for the same reason: the
+ * retry costs one process on a machine that is already failing, and the memory
+ * costs the extra section for as long as the deck runs.
+ */
+let _sectionsUnsupported = false;
+
 /**
  * Run `daily` for a range, asking for the per-agent split, and give up the
  * split rather than the whole answer when this ccusage will not produce one.
@@ -937,6 +965,38 @@ export async function fetchCcusageDaily({ since, until, force = false } = {}) {
  * waited its turn. With an empty queue that is the same instant the caller
  * asked, which is what this always did.
  */
+/**
+ * The same range, grouped by session rather than by day.
+ *
+ * Returns `[]` for every failure, including a ccusage too old to have the
+ * subcommand. The panel's totals and its per-model split come from `daily`, and
+ * losing the session names must not lose those — an empty list draws one
+ * section short, which is the same thing that happens on a machine with no
+ * ccusage at all and is already a state the panel knows.
+ *
+ * WHAT `period` IS HERE, and it is the whole reason this is worth a second
+ * child: on a session row ccusage puts the SESSION ID in `period` — the same
+ * uuid Claude Code writes into every hook payload, and therefore the same key
+ * the canvas already files its agents under. So these rows join to the board by
+ * id, which is what lets the panel show ccusage's money against the deck's own
+ * project names. Without that join a session row is a uuid and a number.
+ */
+async function readSessions(sinceArg, until) {
+  try {
+    const args = ["session", "--json", "--since", sinceArg];
+    if (until) args.push("--until", until);
+    const ran = await runCcusage(args);
+    const raw = extractJson(ran.out);
+    // `session`, singular — ccusage names the array after the command, not
+    // after its contents, and `sessions` reads as the obvious guess and is
+    // always undefined.
+    return Array.isArray(raw.session) ? raw.session : [];
+  } catch (err) {
+    note("session read failed", err);
+    return [];
+  }
+}
+
 async function readRange(sinceArg, until, key) {
   const now = Date.now();
   let result;
@@ -944,8 +1004,40 @@ async function readRange(sinceArg, until, key) {
   try {
     const args = ["daily", "--json", "--since", sinceArg];
     if (until) args.push("--until", until);
-    ran = await runDaily(args);
-    const raw = extractJson(ran.out);
+    let raw;
+    if (_sectionsUnsupported) {
+      ran = await runDaily(args);
+      raw = extractJson(ran.out);
+    } else {
+      try {
+        ran = await runDaily([...args, ...SECTIONS]);
+        raw = extractJson(ran.out);
+      } catch (err) {
+        // A ccusage that could not run at all fails the same way with or
+        // without the flag, so only a complaint naming the flag is worth a
+        // second child — and `reason` set means the run never started, which is
+        // not something a flag can fix.
+        if (err?.reason !== undefined || !blamesSections(err?.message)) throw err;
+        _sectionsUnsupported = true;
+        ran = await runDaily(args);
+        raw = extractJson(ran.out);
+      }
+    }
+    // Already here on any ccusage that knows `--sections`: one load answered
+    // both questions. The second child is the fallback for the older ones, and
+    // it stays deliberately after the first rather than beside it — a failure
+    // to name the sessions must not cost the totals, which are what the panel
+    // is mostly for, and two ccusage processes at once on a cold machine is the
+    // shape #476 spent a release removing from the boot path.
+    // The second child belongs to the OLD ccusage and to nothing else. A build
+    // that took `--sections` answered with the section — empty for a range with
+    // no sessions in it — so a missing `session` key there means this deck
+    // asked for something that build does not report, and asking again as a
+    // separate command would get the same silence for the price of a second
+    // walk of every transcript on the machine.
+    const sessions = Array.isArray(raw.session)
+      ? raw.session
+      : (_sectionsUnsupported ? await readSessions(sinceArg, until) : []);
     // Passed through whole, `agents` array and all. Every day ccusage returns
     // under `--by-agent` is a superset of the day it returns without one, so
     // there is nothing here to reshape: the browser reads the merged totals it
@@ -957,6 +1049,7 @@ async function readRange(sinceArg, until, key) {
     result = {
       ok: true,
       days,
+      sessions,
       totals: raw.totals ?? null,
       since: sinceArg,
       until: until ?? null,

package/src/server/codex-quota.mjs

@@ -8,6 +8,8 @@
 // optional, unknown values pass through verbatim, and a `partial` flag tells
 // the UI when something was dropped instead of silently showing less.
 import { readFile } from "node:fs/promises";
+// One clamp for both quota readers: see the note on cooldownFromHeader.
+import { cooldownFromHeader } from "./quota.mjs";
 import { join } from "node:path";
 import { CODEX_HOME } from "./codex-dir.mjs";
 import { getCodexAuth, forceCodexRefresh, isCredentialHost } from "./codex-auth.mjs";
@@ -335,8 +337,10 @@ async function doFetchCodexQuota() {
   // than the ordinary floor before asking again. `retry-after` is honoured when
   // the backend sends one, because it knows better than the constant does.
   const cooldown = (res) => {
-    const after = parseInt(res?.headers?.get?.("retry-after") ?? "", 10);
-    _rateLimitedUntil = Date.now() + (Number.isFinite(after) ? after * 1000 : COOLDOWN_MS);
+    // Clamped, for the reason quota.mjs states at cooldownFromHeader: a `0`
+    // defeats the cooldown a 429 exists to impose, and a day freezes this
+    // poller for the life of the process.
+    _rateLimitedUntil = Date.now() + cooldownFromHeader(res?.headers?.get?.("retry-after"), COOLDOWN_MS);
   };
 
   let auth, base, res;

package/src/server/codex-usage.mjs

@@ -201,11 +201,33 @@ async function readCompressedTokenSeries(filePath) {
     }
     return null;
   }
+  // THE SOURCE IS HELD, and both halves of that matter.
+  //
+  // `Readable.pipe` attaches its error handling to the DESTINATION. The source
+  // got neither an 'error' listener nor a destroy, so a read that failed — the
+  // file removed between the listing and this call, EACCES, EMFILE — emitted
+  // an unhandled 'error' and took the process down, in a reader whose
+  // uncompressed twin deliberately survives those same errnos. A torn archive
+  // errors on the destination instead, which the catch below swallows while the
+  // source stays open: twenty reads of one corrupt file left twenty handles,
+  // against a sixty-second poll. On Windows a held handle also blocks the
+  // unlink, which is the case the plain path's `finally { await fd?.close() }`
+  // names.
+  let source = null;
   try {
     const series = [];
     const decoder = new StringDecoder("utf8");
     let pending = "";
-    const stream = createReadStream(filePath).pipe(createZstdDecompress());
+    source = createReadStream(filePath);
+    const stream = source.pipe(createZstdDecompress());
+    // THE ERROR HAS TO REACH THE LOOP, not merely be caught. A bare
+    // `on("error", () => {})` here stops the process dying and hangs the read
+    // instead: `pipe` does not forward a source failure to the destination, so
+    // the `for await` below waits forever for an 'end' that cannot come — which
+    // is what a missing file did on the first Windows run of this code, at 30
+    // seconds per poll. Destroying the destination WITH the error makes the
+    // iteration reject, which is what the catch is for.
+    source.on("error", err => { stream.destroy(err); });
     for await (const chunk of stream) {
       pending += decoder.write(chunk);
       let from = 0;
@@ -220,6 +242,7 @@ async function readCompressedTokenSeries(filePath) {
     if (pending) foldTokenLine(series, pending);
     return series.length ? series : null;
   } catch { return null; }
+  finally { source?.destroy(); }
 }
 
 /** The reader, exported under a test-only name. The compressed path cannot be

package/src/server/cswap-admin.mjs

@@ -986,20 +986,6 @@ export async function shareAccounts(nums) {
   };
 }
 
-/**
- * The one-account case, which is a bundle of one and takes the same path.
- *
- * That path PARSES what cswap wrote, where this used to hand its stdout on
- * opaquely — the cost of `shared` being able to promise that the count on the
- * copy button is the count in the blob. So an export shape the fold cannot read
- * now fails the single share too, not just the bundle. Deliberate: one path
- * means the two cannot drift into two envelope shapes, and a share that
- * silently carried something this deck could not account for is the failure
- * the count exists to prevent.
- */
-export async function shareAccount(num) {
-  return shareAccounts([num]);
-}
 
 /**
  * The identities a bundle carries, or `[]` when it cannot be read.

package/src/server/cswap-auto.mjs

@@ -229,7 +229,13 @@ const MODEL_LIST_OK = /^(?!-)[A-Za-z0-9 ,._-]{1,120}$/;
 
 /** Validate against SETTINGS, then hand to `cswap config set`. */
 export async function setCswapConfig(key, value) {
-  const spec = SETTINGS[key];
+  // `Object.hasOwn`, not a bare read. `SETTINGS["constructor"]` is truthy and
+  // its `.type` is undefined, so a prototype member passed the allowlist and
+  // fell through to the free-text branch — reaching `cswap config set
+  // constructor <value>` and skipping the type-specific range check on the way.
+  // Nothing reachable that way was dangerous; an allowlist that does not hold
+  // is.
+  const spec = Object.hasOwn(SETTINGS, key) ? SETTINGS[key] : null;
   if (!spec) return { ok: false, reason: "unknown_setting" };
 
   let str;
@@ -253,6 +259,17 @@ export async function setCswapConfig(key, value) {
   // nothing. The panel reloads this route immediately afterwards and gets a real
   // read; see invalidateCswapAutoCache.
   invalidateCswapAutoCache();
+  // A NEW INTERVAL HAS TO REACH THE TIMER. `tickInterval()` is read once, at
+  // startLoop, so changing this setting used to update what the panel reports
+  // and nothing else: set 3600 with auto-switch on and the panel read back an
+  // hour while the loop kept firing every sixty seconds for the life of the
+  // process — sixty `cswap auto --once` spawns an hour instead of one, against
+  // the shared per-account request budget this subsystem exists to protect.
+  // Lowering it was equally inert.
+  if (r.ok && key === "autoswitch.intervalSeconds" && _enabled) {
+    stopLoop();
+    await startLoop();
+  }
   return r.ok ? { ok: true } : { ok: false, reason: "set_failed", detail: (r.stderr || r.stdout).trim().slice(0, 300) };
 }
 
@@ -291,6 +308,15 @@ function summarise(stdout) {
 /** Evaluate a tick for real. May switch the active account. */
 async function runAutoTick() {
   const r = await run(await cswapBin(), ["auto", "--once", "--json"], { timeout: TICK_TIMEOUT_MS });
+  // A KILLED RUN IS NOT A QUIET ONE. `run`'s timeout path deliberately keeps an
+  // 8 KB tail of whatever the child managed to print, so `!r.ok && !r.stdout`
+  // is false for a tick that emitted its `{"event":"poll"}` line and then
+  // stalled — and the killed run fell through to `ok: true`. The panel then
+  // showed a healthy `no-switch` every two minutes, forever, while the engine
+  // did nothing at all: exactly the trap exec.mjs's own header names.
+  if (r.timedOut) {
+    return { ok: false, reason: "tick_timeout", detail: `cswap auto --once did not finish within ${TICK_TIMEOUT_MS / 1000}s` };
+  }
   if (!r.ok && !r.stdout) {
     return { ok: false, reason: "tick_failed", detail: (r.stderr || "").trim().slice(0, 300) };
   }
@@ -477,6 +503,18 @@ async function runTick() {
     _lastTick = { at: Date.now(), event: "skipped", reason: "external-engine" };
     return;
   }
+  // AND RE-CHECK THE SWITCH ITSELF, after that await. `stopLoop` clears the
+  // interval and nothing else, so a tick already running went on to move the
+  // user's live account seconds after the panel had drawn itself as off. The
+  // await above is not short: ticks are at least fifteen seconds apart against
+  // a ten-second floor, so every one pays a real process-table read — on
+  // Windows a PowerShell Get-CimInstance with an eight-second deadline. The
+  // panel then showed `enabled: false` beside a `lastTick` of
+  // `{event: "switch", from, to}` stamped after the user turned it off.
+  if (!_enabled) {
+    _lastTick = { at: Date.now(), event: "skipped", reason: "disabled" };
+    return;
+  }
   const result = await runAutoTick();
   // Before `_lastTick`, not after. This is the only path in the deck that moves
   // the live account without a click behind it, so nothing else is in a position

package/src/server/cswap-install.mjs

@@ -597,8 +597,13 @@ export async function ensureCswap({ onInstalling = null } = {}) {
     // Installed — the only question left is whether it's stale. One PyPI
     // request a day, and the upgrade itself never blocks startup.
     if (!updateCheckDue()) return { state: "present", version: existing };
-    touchMarker();
+    // The marker is stamped AFTER the request, not before it. Stamped first, a
+    // boot with no network yet — a laptop opened on a train, the ten seconds
+    // before Wi-Fi associates — burned the whole shared 24-hour window on a
+    // check that never reached PyPI, and the next real chance was the day
+    // after. self-update.mjs states this rule for itself in as many words.
     const latest = await latestOnPypi();
+    touchMarker();
     if (latest && existing !== "installed" && isOlder(existing, latest)) {
       // Who owns it, not what is installed on the machine: an upgrade aimed at
       // a tool that never installed this package is refused where runDetached

package/src/server/exec.mjs

@@ -28,6 +28,30 @@
 import { execFile, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 
+// WINDOWS SEARCHES THE WORKING DIRECTORY FIRST, and this turns that off.
+//
+// libuv's PATH search calls `NeedCurrentDirectoryForExePathW("")`, which is
+// true unless this variable is set — so `spawn("cswap", …)` on Windows tries
+// `.\cswap.exe` before anything on PATH, and the deck's working directory is
+// wherever `npx ccdeck` was run: normally the user's project, often a repo they
+// just cloned. `cswapBin()` probes the bare name before any known install path
+// and memoises whatever answered, so a planted binary would then receive every
+// later `cswap switch` and `cswap export -` — the commands that carry account
+// credentials. The same search reaches py.exe, where.exe, claude.exe and
+// powershell.exe.
+//
+// Set on this process rather than per spawn, because the search is done by the
+// PARENT: one assignment covers every child this deck ever starts, including
+// the ones spawned outside this module. An explicit value in the environment is
+// left alone — someone who set it meant it.
+//
+// POSIX never had this behaviour: execvp does not search `.` unless PATH says
+// so, so this is a no-op there and is skipped rather than written.
+if (process.platform === "win32" && !("NoDefaultCurrentDirectoryInExePath" in process.env)) {
+  process.env.NoDefaultCurrentDirectoryInExePath = "1";
+}
+
+
 // Extensions Windows will execute, most specific first. `.com` is omitted —
 // nothing ships one, and every extra candidate costs a failed spawn.
 const WIN_EXTS = [".exe", ".cmd", ".bat", ""];
@@ -682,6 +706,12 @@ export function run(cmd, args, { timeout = 20_000, maxBuffer = 4 << 20, env } =
         // the shell command it replaced had to end in `< /dev/null`. Closing
         // the pipe is that redirection without a shell to parse it.
         try { cp.stdin?.on("error", () => {}); cp.stdin?.end(); } catch { /* no stdin to close */ }
+        // Decoded as a stream rather than per chunk: a chunk boundary falls
+        // wherever the pipe broke, and a multi-byte character split across two
+        // of them becomes two replacement characters in the tail this keeps for
+        // the timeout message.
+        cp.stdout?.setEncoding?.("utf8");
+        cp.stderr?.setEncoding?.("utf8");
         cp.stdout?.on("data", (d) => { sawOut = (sawOut + d).slice(-TIMEOUT_TAIL); });
         cp.stderr?.on("data", (d) => { sawErr = (sawErr + d).slice(-TIMEOUT_TAIL); });
         // The deadline states the outcome itself and only then kills, which is
@@ -814,6 +844,15 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
       return tryNext(err) ? attempt(i + 1) : finish(-1, err);
     }
     child = proc;
+    // EPIPE ON STDIN IS NOT A CRASH. `write` below is wrapped in a try/catch,
+    // and that catch can never fire for the case that matters: a broken pipe
+    // arrives asynchronously, as an 'error' event on the Writable, and an
+    // unhandled 'error' on a stream is an uncaught exception with no
+    // process-level net anywhere in this deck. `cswap import -` reading a
+    // prefix of a bad bundle and exiting before it drains is exactly that
+    // shape, so a rejected paste in the import dialog took the dashboard down
+    // with it. `run` has carried this same line since it was written.
+    proc.stdin?.on("error", () => {});
     // A spelling that fails to spawn emits 'error' AND THEN 'close' — with code
     // -2 after an ENOENT. Once the error handler has moved on to the next
     // candidate, that trailing 'close' is news about a child nobody is waiting
@@ -845,6 +884,11 @@ export function runInteractive(cmd, args, { timeout = 300_000, maxOutput = 256 <
     // Capped so a runaway child cannot grow the heap without bound; the tail is
     // what carries the error, so the head is what gets dropped.
     const keep = (buf, text) => (buf + text).slice(-maxOutput);
+    // Same reason as `run`'s tails: the login prompt this reader is waiting for
+    // arrives mid-chunk, and a UTF-8 sequence cut by a pipe boundary must not
+    // become two replacement characters in the line it emits.
+    proc.stdout?.setEncoding?.("utf8");
+    proc.stderr?.setEncoding?.("utf8");
     proc.stdout?.on("data", (d) => { if (stale()) return; const t = String(d); stdout = keep(stdout, t); emitLines(t); });
     proc.stderr?.on("data", (d) => { if (stale()) return; const t = String(d); stderr = keep(stderr, t); emitLines(t); });
     proc.on("close", (code) => {