ccdeck 3.22.14 → 3.23.0

package/src/server/login-service.mjs

@@ -130,8 +130,25 @@ ${vars}
  */
 export function unitFor({ execPath, script, logPath, args = [], env = {}, product = "ccdeck" } = {}) {
   const cmd = [execPath, script, ...args].map(a => (/\s/.test(a) ? `"${a}"` : a)).join(" ");
+  // QUOTED, AND `%` ESCAPED. systemd.exec(5) splits an Environment= assignment
+  // on whitespace unless the whole thing is double-quoted, and it expands `%`
+  // specifiers in the value. ExecStart above quotes its own arguments; this
+  // line did neither, so a scope directory with a space in it was truncated at
+  // the space. Handed to systemd itself:
+  //
+  //   $ systemd-analyze verify ccdeck.service
+  //   ccdeck.service:6: Invalid environment assignment, ignoring: Configs/.claude
+  //
+  // from `Environment=CLAUDE_CONFIG_DIR=/home/ana/My Configs/.claude`. The deck
+  // then received `/home/ana/My` — neither the shell's value nor the default,
+  // which is the two-registries outcome scopeEnv's own header describes: "two
+  // decks and two LAN keys on one machine". `%b` is the boot-ID specifier, so
+  // `/home/ana/100%backup` was rewritten just as quietly.
+  //
+  // The macOS branch was always safe: plistFor puts each value in its own
+  // <string> and XML-escapes it. Windows carries none of them.
   const vars = Object.entries({ AGENTS_DECK_DETACHED: "1", ...env })
-    .map(([k, v]) => `Environment=${k}=${v}`).join("\n");
+    .map(([k, v]) => `Environment="${k}=${String(v).replace(/%/g, "%%")}"`).join("\n");
   return `[Unit]
 Description=${product} — live deck of Claude Code + Codex agents
 After=default.target
@@ -359,9 +376,19 @@ export function installService({
   // shell that installed it: launchd hands the job a minimal environment,
   // systemd --user the same. That is right in production — the deck should see
   // the user's real home — and it is exactly what makes a login item impossible
-  // to test in a sandbox without this parameter. The end-to-end test passes
-  // HOME and the deck's own directories through here; nothing else does.
-  serviceEnv = {},
+  // to test in a sandbox without this parameter.
+  //
+  // DEFAULTED, NOT LEFT TO EACH CALLER TO REMEMBER. The scope directories
+  // belong in every login item this deck writes, and two of the three callers
+  // did not pass them: `--install` and `--install-service` wrote an item keyed
+  // to the default registries while the shell that typed them was keyed to
+  // CLAUDE_CONFIG_DIR — the two-decks-on-one-machine split scopeEnv's own
+  // header describes, arrived at from the two entry points whose whole purpose
+  // is to install. Only the first-start offer carried them. A caller that
+  // genuinely wants a different job environment — the sandboxed end-to-end
+  // test, which passes HOME and the deck's own directories — still says so,
+  // and replaces this outright rather than adding to it.
+  serviceEnv = scopeEnv(env),
   product = "ccdeck",
   fs = { mkdirSync, writeFileSync },
   run = spawnSync,

package/src/server/open-url.mjs

@@ -98,8 +98,28 @@ export function launchers(url, { platform = process.platform, env = process.env,
     // not wait for openUrl.
     const tries = [{
       file: "powershell.exe",
-      // The URL as its own argv entry rather than inside a script string, where
-      // `;` and `&` are PowerShell's own operators.
+      // THIS IS NOT A SEPARATE ARGV CHANNEL, and the comment that used to sit
+      // here said it was: "the URL as its own argv entry rather than inside a
+      // script string, where `;` and `&` are PowerShell's own operators."
+      // There is no such entry. `powershell.exe -Command` documents that the
+      // value must be the LAST parameter, *"because any characters typed after
+      // the command are interpreted as the command parameters"* — everything
+      // after it is appended to the command TEXT and parsed by PowerShell, so
+      // `Start-Process` and the URL arrive as one script line whatever argv
+      // they were handed in as.
+      //
+      // The repo has already discovered this one module over. browser-react.mjs
+      // records it verbatim for the toast: the same shape, the same wrong
+      // assumption, and a notification that "never appeared on Windows, for the
+      // reaction that is the default".
+      //
+      // Nothing is broken today, which is why this is a comment repair rather
+      // than a code one: the only caller passes a loopback URL this deck built
+      // itself, and the `cmd /c start` fallback below would catch a parse
+      // failure anyway. What was wrong is a file whose stated job is to encode
+      // platform knowledge recording a safety property it does not have — and
+      // the next caller to pass a URL with a query string in it would have
+      // trusted that sentence.
       args: ["-NoProfile", "-NonInteractive", "-Command", "Start-Process", url],
     }];
     const viaCmd = startCommand(url, env);

package/src/server/output-watch.mjs

@@ -120,8 +120,11 @@ export function blocksIn(chunk) {
 export function createOutputWatch(io = {}) {
   const statFile = io.stat ?? (p => stat(p));
   const openFile = io.open ?? (p => open(p, "r"));
-  /** sid -> { path, offset, size } — where this session's file is and how far
-   *  into it the watch has already looked. */
+  /** sid -> { path, offset } — where this session's file is and how far into it
+   *  the watch has already looked. No size beside them: every decision in
+   *  `pollOnce` is made from the size its own `stat` just returned, and the one
+   *  that used to be remembered here was written four times and read by
+   *  nothing (#1089). */
   const seen = new Map();
 
   /** Remember where a session's transcript is. Called for every hook payload
@@ -135,7 +138,7 @@ export function createOutputWatch(io = {}) {
     // Start at the END of a file the watch has not seen before. Everything
     // already in it happened before the deck looked, and replaying it would
     // report a morning's thinking as having just occurred.
-    seen.set(sid, { path, offset: null, size: null });
+    seen.set(sid, { path, offset: null });
   }
 
   function forget(sid) { seen.delete(sid); }
@@ -152,8 +155,15 @@ export function createOutputWatch(io = {}) {
    * Sessions the caller believes are live, and no others: a finished session's
    * file can still be appended to by a later turn, and the deck has its own
    * rules about what counts as live. This asks no questions about that.
+   *
+   * `onLines`, when given, is handed each session's new whole lines as one
+   * string, with the file they came from. The watch is the only reader that
+   * looks at a transcript while a session is resting, and resting is exactly
+   * when Claude Code writes its recap (see session-recap.mjs). It is a tap, not
+   * a filter: nothing it does changes the blocks returned, and a throw inside
+   * it stops at the tap rather than at the watch.
    */
-  async function poll(liveSids) {
+  async function pollOnce(liveSids, onLines) {
     const out = [];
     for (const sid of liveSids) {
       const entry = seen.get(sid);
@@ -163,15 +173,15 @@ export function createOutputWatch(io = {}) {
       const size = Number(st?.size ?? 0);
       // First sight: record where the end is and report nothing. The file's
       // whole history is older than this deck's interest in it.
-      if (entry.offset == null) { entry.offset = size; entry.size = size; continue; }
+      if (entry.offset == null) { entry.offset = size; continue; }
       // TRUNCATED OR REPLACED. A file that is now shorter than the byte this
       // watch was going to read from is not the file it was reading; seeking to
       // the old offset would return whatever now lives there. Start again at
       // the new end rather than guessing which bytes are which.
-      if (size < entry.offset) { entry.offset = size; entry.size = size; continue; }
+      if (size < entry.offset) { entry.offset = size; continue; }
       if (size === entry.offset) continue;
       // Past the ceiling, skip to the end. See MAX_TAIL_BYTES.
-      if (size - entry.offset > MAX_TAIL_BYTES) { entry.offset = size; entry.size = size; continue; }
+      if (size - entry.offset > MAX_TAIL_BYTES) { entry.offset = size; continue; }
 
       const from = entry.offset;
       const want = size - from;
@@ -187,7 +197,6 @@ export function createOutputWatch(io = {}) {
         const dec = new StringDecoder("utf8");
         text = dec.write(buf.subarray(0, Math.max(0, bytesRead))) + dec.end();
         entry.offset = from + Math.max(0, bytesRead);
-        entry.size = size;
       } catch {
         continue;
       } finally {
@@ -214,9 +223,51 @@ export function createOutputWatch(io = {}) {
       // Oldest first, so a reader that refuses to move backwards accepts the
       // whole run rather than only its last member.
       for (const b of blocksIn(text)) out.push({ sid, kind: b.kind, at: b.at });
+      if (onLines) {
+        try { onLines(sid, text, entry.path); } catch { /* the tap's failure, not the watch's */ }
+      }
     }
     return out;
   }
 
+  /** Whether a call is inside `pollOnce` right now. */
+  let polling = false;
+
+  /**
+   * `pollOnce`, one call at a time (#1089).
+   *
+   * A session's offset is read at the top of `pollOnce` and written back only
+   * after the `stat`, the `open` and the `read` it waits on, so a second call
+   * that enters while the first is inside any of them reads the same offset,
+   * reads the same bytes and answers with the same blocks — and the server
+   * pushes an OutputObserved for each copy. Measured through this module's own
+   * `io` seam, with the interleave exact rather than timed: one block appended,
+   * two overlapping ticks, two events. They are persisted, so the double count
+   * lands in events.jsonl and is drawn onto the activity chart again after
+   * every restart. The server ticks this off a 1500ms setInterval, which does
+   * not wait for the last tick to finish, and a tick that outruns 1500ms needs
+   * nothing more unusual than several live sessions on a slow or
+   * network-backed transcript directory.
+   *
+   * Its two siblings in index.mjs already refused re-entry: codexScanOnce with
+   * a boolean, scanTranscript by handing a second caller the read already in
+   * flight. The second shape is wrong here — a caller handed the same answer
+   * would push the same blocks again — so this is the boolean. An overlapping
+   * call answers with nothing and the call already inside answers for both.
+   * Nothing is lost by it: whatever lands meanwhile is past the offset the
+   * first call writes back, and the next tick reads it. It sits here rather
+   * than in outputWatchOnce because this is where the offset lives, and where
+   * the suite can drive the overlap without a clock.
+   */
+  async function poll(liveSids, onLines) {
+    if (polling) return [];
+    polling = true;
+    try {
+      return await pollOnce(liveSids, onLines);
+    } finally {
+      polling = false;
+    }
+  }
+
   return { note, forget, clear, size, poll };
 }

package/src/server/purge-key.mjs

@@ -0,0 +1,135 @@
+// The one thing an uninstall leaves behind that is not data: this deck's LAN
+// private key.
+//
+// `--uninstall` is deliberately narrow — it takes the hook entries out and says
+// so, because the event log and the port registry are things somebody may still
+// want. That narrowness has bent once already, for the login item, on the
+// argument that a machine which keeps starting a deck whose hooks were just
+// removed is not data either. The key is the second case and a sharper one.
+//
+// WHAT IS ACTUALLY LEFT. `prefs.json` is the one file the deck writes with a
+// secret in it — deck-home.mjs says so where it names the mode: "0600 on the
+// preferences is load-bearing: it is the one file with a private key in it".
+// That key is this deck's LAN identity: every machine paired with it has pinned
+// the key, and it is what decrypts what crosses between them. An uninstall that
+// reports success and leaves it on the disk has left a credential behind.
+//
+// AND IT IS LEFT IN TWO PLACES, WHICH IS THE PART NOBODY COULD HAVE GUESSED.
+// `migrateDeckFiles` moved prefs.json from `~/.claude/agent-dag` to the
+// platform's data directory by COPYING it and leaving the original exactly
+// where it was — deliberately, so a downgrade finds what it had. So an upgraded
+// machine has the key twice, and the second copy sits in a directory the deck's
+// own documentation describes as holding "the forwarder and the discovery
+// directory". Deleting one of the two is not deleting the key.
+//
+// SO THIS MODULE ANSWERS TWO QUESTIONS AND NOTHING ELSE: where, on THIS machine,
+// is there still a prefs.json that could hold a key, and — when somebody asks
+// for it — take those files off the disk. It does not rewrite prefs.json to
+// strip the field: a partial rewrite of the file that holds the pairings is a
+// worse thing to get wrong than an unlink, and after an uninstall there is
+// nothing left the rest of the file is for.
+import { readFile, rm } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { deckDataDir, legacyDeckDir } from "./deck-home.mjs";
+
+/** The file. Named once, because it is spelled in deck-prefs.mjs too and the
+ *  two must not drift — see `prefsPath`, which is the same join. */
+export const KEY_FILE = "prefs.json";
+
+/**
+ * Every directory on this machine that may still hold one.
+ *
+ * Deduplicated, and that is not tidiness: on a machine with CLAUDE_CONFIG_DIR
+ * set, `deckDataDir` deliberately answers `legacyDeckDir` — those people keep
+ * one directory rather than being moved — so the two are the SAME path and
+ * reporting it twice would tell somebody there are two copies of their key when
+ * there is one.
+ */
+export function keyDirs({ env = process.env, home = homedir(), platform = process.platform } = {}) {
+  return [...new Set([deckDataDir(platform, env, home), legacyDeckDir(env, home, platform)])];
+}
+
+/**
+ * What is really on disk, per directory, and whether a key is in it.
+ *
+ * `holds` is three-valued on purpose:
+ *
+ *   "key"      parsed, and `lan.secret` is a non-empty string. This is the file
+ *              the whole module is about.
+ *   "no-key"   parsed, and there is no secret in it. A deck that never turned
+ *              LAN sync on, or one whose file predates it. Reported so a caller
+ *              can offer to remove it without claiming a key is in there —
+ *              telling somebody their private key is on the machine when it is
+ *              not is the same defect as the silence, pointing the other way.
+ *   "unknown"  there is a file and this could not read it as JSON: a BOM from
+ *              Notepad, a half-written file, a permission. UNKNOWN IS NOT
+ *              "NO": a file that cannot be parsed is exactly the one nobody can
+ *              rule a key out of, so it is offered for removal like a "key".
+ *
+ * A file that is not there at all is not in the list. ENOENT is the ordinary
+ * answer on a machine where the deck never ran, and an uninstall that announces
+ * the absence of a file is noise at the moment somebody least wants it.
+ */
+export async function findKeyFiles(dirs = keyDirs(), deps = {}) {
+  const read = deps.readFile ?? readFile;
+  const out = [];
+  for (const dir of dirs) {
+    const path = join(dir, KEY_FILE);
+    let raw;
+    try {
+      raw = await read(path, "utf8");
+    } catch (err) {
+      // Anything but "no such file" means there IS something there and this
+      // could not see into it, which is the "unknown" case with the read having
+      // failed rather than the parse.
+      if (err?.code === "ENOENT") continue;
+      out.push({ path, holds: "unknown", why: err?.message ?? String(err) });
+      continue;
+    }
+    try {
+      // The BOM, stripped the way installer.mjs strips it off settings.json:
+      // `JSON.parse` throws on one and a file Notepad saved is not damaged.
+      // Spelled out rather than imported because installer.mjs's `stripBom` is
+      // private to that module today — #1056 exports it, and this call should
+      // become that import once it lands, so the rule has one spelling.
+      const text = String(raw);
+      const parsed = JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+      const secret = parsed?.lan?.secret;
+      out.push({ path, holds: typeof secret === "string" && secret !== "" ? "key" : "no-key", why: "" });
+    } catch (err) {
+      out.push({ path, holds: "unknown", why: err?.message ?? String(err) });
+    }
+  }
+  return out;
+}
+
+/**
+ * Take those files off the disk, and never let one failure hide another.
+ *
+ * `force: true` so a file that vanished between the listing and the unlink — a
+ * second deck, a person deleting it by hand in the other window — is a removal
+ * that succeeded rather than an error somebody has to interpret. `maxRetries`
+ * is the Windows rule the rest of this repo already follows: a scanner or the
+ * indexer holds a handle for a moment after the file is touched, and the first
+ * unlink answers EBUSY. rm-temp-dir.ts paid for that knowledge twice.
+ *
+ * Returns both halves rather than throwing on the first failure, because an
+ * uninstall that removed one of two copies and stopped has to say WHICH — the
+ * caller's exit code and the user's next move both depend on it.
+ */
+export async function purgeKeyFiles(files, deps = {}) {
+  const remove = deps.rm ?? rm;
+  const removed = [];
+  const failed = [];
+  for (const file of files) {
+    const path = typeof file === "string" ? file : file.path;
+    try {
+      await remove(path, { force: true, maxRetries: 5, retryDelay: 20 });
+      removed.push(path);
+    } catch (err) {
+      failed.push({ path, why: err?.message ?? String(err) });
+    }
+  }
+  return { removed, failed };
+}

package/src/server/quota.mjs

@@ -266,6 +266,35 @@ const FORCE_POLL_MS = 60_000;
 // collector is backing off or not running — the case self-polling exists for.
 const STORE_TRUSTED_MS = 45 * 60_000;
 
+/**
+ * How long a caller may be kept waiting before this module answers anyway.
+ *
+ * Source 3 has no ceiling of its own and never had one. Its cost is the sum of
+ * every step below it — three spawns under a 15-second deadline each, with two
+ * 1.2-second sleeps between them — and nobody had ever added it up. Measured on
+ * a sandboxed deck with a `claude` that never prints (#1011):
+ *
+ *     $ curl -s -m 120 -w "[%{http_code}] time_total=%{time_total}s" .../api/quota
+ *     {"ok":false,"reason":"cli_failed",...}
+ *     [200] time_total=47.411343s
+ *
+ * 3 × 15s + 2 × 1.2s = 47.4, to the tenth. The rest of the deck stayed
+ * responsive throughout — /api/health answered in 0.0008s while that request
+ * was out — so what this bounds is one pinned request rather than a stalled
+ * server: a panel on "Checking…" for three quarters of a minute, and one fewer
+ * socket in the browser's per-origin pool for as long as it is out.
+ *
+ * FIVE SECONDS, and it is a budget rather than a guess at how long the CLI
+ * takes. A sandbox with a real `claude` and no credentials answered in 4.2s and
+ * 4.5s, which is the slow END of the good case, and the good case is already
+ * served from the store or the API in milliseconds. What is left above five
+ * seconds is the CLI in trouble, and for that the honest answer is "not yet".
+ *
+ * Nothing is cancelled when it expires — see answerWithin. The read runs on,
+ * publishes to the cache, and the panel's next poll gets the real numbers.
+ */
+export const QUOTA_DEADLINE_MS = 5_000;
+
 /**
  * claude-swap's row for the active account, in the shape the panel speaks.
  *
@@ -477,14 +506,25 @@ export function quotaClaudeBin(platform = process.platform, env = process.env,
   return "claude";
 }
 
-export async function fetchClaudeQuota({ force = false } = {}) {
+/**
+ * @param deadlineMs how long the CALLER is prepared to wait. Zero — the
+ *   default, and what every internal caller uses — waits for the read however
+ *   long it takes, which is what a test driving the chain end to end wants.
+ *   The route passes QUOTA_DEADLINE_MS; see answerWithin for what expiring
+ *   means, which is not cancelling.
+ */
+export async function fetchClaudeQuota({ force = false, deadlineMs = 0 } = {}) {
   const now = Date.now();
   if (!force && _cache && now - _cacheAt < CACHE_MS) return _cache;
 
   // If another CLI probe is already in flight, wait for it instead of spawning a
   // second concurrent process (which can return empty output and overwrite the
   // good result with 0%).
-  if (_inflight) return _inflight;
+  //
+  // Under a deadline the joiner is bounded too, and has to be: joining a read
+  // that started 46 seconds ago is the same 47-second wait reached by the other
+  // door, and it is the door the panel's own 60-second poll walks through.
+  if (_inflight) return answerWithin(_inflight, deadlineMs, now);
 
   // `_inflight === mine` rather than a bare clear: invalidateQuotaCache drops
   // `_inflight` so the next caller starts a read that knows the account moved,
@@ -495,7 +535,51 @@ export async function fetchClaudeQuota({ force = false } = {}) {
   const mine = _doFetch(now, force, _generation)
     .finally(() => { if (_inflight === mine) _inflight = null; });
   _inflight = mine;
-  return mine;
+  return answerWithin(mine, deadlineMs, now);
+}
+
+/**
+ * The read's answer, or the best thing we can say by the time the caller's
+ * patience runs out.
+ *
+ * THE READ IS NOT CANCELLED, and that is the whole design rather than a
+ * shortcut. It keeps running, keeps `_inflight` filled so nothing spawns a
+ * second Claude Code beside it, and ends in publish() like any other read — so
+ * the numbers it eventually produces are in the cache for whoever asks next.
+ * The panel polls every 60 seconds and presses ↻ into the same slot, so "not
+ * yet" is a state it leaves on its own within a poll. Cancelling would spend a
+ * whole `claude --print /usage` and throw the result away, and the budget this
+ * module is built around (28-30 requests an hour, shared with claude-swap) is
+ * the one thing it must not do.
+ *
+ * WHAT "NOT YET" SAYS. The freshest real reading this module holds, marked
+ * stale — the same answer, in the same shape, that the poll-floor branch of
+ * _doFetch already gives for the same question — and only when there is none,
+ * the `waiting` reason the panel has rendered a sentence for all along. Its
+ * timestamp is the reading's own and never `now`: an age indicator that
+ * vouches for numbers collected hours ago is what quota-held-age.test.ts
+ * exists to stop, and a deadline is not a licence to re-stamp them.
+ *
+ * Exported because a deadline nothing can point at is a deadline nobody can
+ * test.
+ */
+export function answerWithin(read, deadlineMs, now = Date.now()) {
+  if (!(deadlineMs > 0)) return read;
+  let bell;
+  const expired = new Promise(resolve => {
+    bell = setTimeout(() => resolve(notYet(now)), deadlineMs);
+    // A deadline is not a reason for the process to stay alive: this timer
+    // outlives nothing, and an exit waiting on it would be this function
+    // holding the deck open for an answer nobody is there to read.
+    bell.unref?.();
+  });
+  return Promise.race([read, expired]).finally(() => clearTimeout(bell));
+}
+
+/** What the deck can honestly say about a reading it has not finished taking. */
+function notYet(now) {
+  if (_lastGood) return { ..._lastGood, stale: true };
+  return { ok: false, reason: now < _rateLimitedUntil ? "rate_limited" : "waiting", fetchedAt: now };
 }
 
 /**
@@ -640,7 +724,13 @@ async function _execOnce(bin) {
     _saidFailure = null;
   }
   const cliOk = /subscription/i.test(combined) || /claude code usage/i.test(combined);
-  return { cliOk, missing, parsed: parseUsageText(combined) };
+  // WHETHER THE RUN ITSELF SUCCEEDED, which `cliOk` does not answer. `cliOk` is
+  // a test of the OUTPUT — it means "we recognised what came back" — and a CLI
+  // that printed its banner and then failed satisfies it. That is the right
+  // rule for the parse above (see the note there: the quota lines can be on
+  // stdout and the exit non-zero), and the wrong one for the no-numbers
+  // fallback in _doFetch, which was publishing 0% for a run that errored.
+  return { cliOk, ran: r.ok, missing, parsed: parseUsageText(combined) };
 }
 
 async function _doFetch(now, force = false, gen = _generation) {
@@ -693,11 +783,13 @@ async function _doFetch(now, force = false, gen = _generation) {
   // refreshed). The real lines appear on a subsequent call. Retry a couple
   // times before giving up so the first paint already shows real values.
   let cliOk = false;
+  let cliRan = false;
   let parsed = null;
   for (let attempt = 0; attempt < 3; attempt++) {
     if (attempt > 0) await sleep(1200);
     const r = await _execOnce(bin);
     cliOk = r.cliOk || cliOk;
+    cliRan = r.ran || cliRan;
     if (r.parsed) { parsed = r.parsed; break; }
     // The retry exists for a CLI that RAN and left the quota lines out of a cold
     // invocation. A CLI that is not installed will not be installed 1.2 seconds
@@ -734,11 +826,24 @@ async function _doFetch(now, force = false, gen = _generation) {
   //
   // A CLI that failed entirely is `ok: false` as it always was, and the reason
   // says which of the two the reader is looking at.
-  const subscribed = cliOk ? await hasSubscriptionCredential() : false;
-  const result = cliOk && subscribed
+  //
+  // `cliRan` IS WHAT MAKES THAT SENTENCE TRUE. It used to rest on `cliOk`
+  // alone, which is a regex over stdout+stderr and never looked at the exit
+  // status — so a CLI that printed its header and then failed (a network
+  // error, a rate limit, a timeout after the banner) took this branch and the
+  // panel drew two full-looking bars reading "5-hour window 0%". The deck
+  // logged `claude CLI failed` in the same second. Someone reading an empty
+  // window then starts a long run against one that is nearly spent.
+  //
+  // Only this branch is gated. The parse above still keeps its output on a
+  // non-zero exit, deliberately, because the quota lines can be printed and
+  // the exit still be non-zero — 0% is a claim made in the ABSENCE of numbers,
+  // and absence plus failure is not a measurement.
+  const subscribed = cliOk && cliRan ? await hasSubscriptionCredential() : false;
+  const result = cliOk && cliRan && subscribed
     ? { ok: true, session5hPct: 0, session5hWindowSec: 18000,
         week7dPct: 0, week7dWindowSec: 604800, fetchedAt: now }
-    : { ok: false, reason: cliOk ? "no_subscription" : "cli_failed", fetchedAt: now };
+    : { ok: false, reason: cliOk && cliRan ? "no_subscription" : "cli_failed", fetchedAt: now };
   return publish(gen, result, now - (CACHE_MS - 5_000));
 }
 

package/src/server/running-deck.mjs

@@ -61,6 +61,7 @@ import { readdir, readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { claudeConfigDir } from "./claude-dir.mjs";
 import { challengeDeck, isProcessAlive } from "./deck-probe.mjs";
+import { sameCodexTree } from "./log-writer.mjs";
 
 /**
  * Where every deck on this machine registers itself.
@@ -84,13 +85,26 @@ export function deckRegistryDir(env = process.env, home = undefined) {
  * either field existed carries `undefined` and fails — and a deck that old is
  * replaced rather than attached to, which is what a start does with any deck
  * it cannot vouch for.
+ *
+ * AND THE CODEX TREE, which is the one field that is not strict. #1110 put the
+ * tree a deck tails on its record, and until this read it a start for another
+ * tree matched on the four fields above and attached: `CODEX_HOME=/srv/codex
+ * ccdeck` opened the deck already reading ~/.codex, and the tree it was started
+ * for was never read by anything. A different tree is a different canvas, so it
+ * is a different shape. Compared by sameCodexTree, the log election's own rule
+ * for the same field — so the two cannot disagree about whether two spellings
+ * are one tree — which also means a side that does not say is taken as the
+ * same: a record written before #1110 keeps the answer it had. Every caller
+ * that asks on behalf of a start names its tree: the start itself, and
+ * `--status` marking the deck a bare start would open (#1134).
  */
 export function sameShape(record, want = {}) {
   if (!record) return false;
   return (record.workspace ?? "") === (want.workspace ?? "")
     && (record.persist ?? null) === (want.persist ?? null)
     && record.codex === (want.codex !== false)
-    && record.claude === (want.claude !== false);
+    && record.claude === (want.claude !== false)
+    && sameCodexTree(record.codexHome, want.codexHome);
 }
 
 /**