ccdeck 3.22.14 → 3.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.22.14",
+  "version": "3.23.0",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -29,7 +29,68 @@
     "a colour glyph is drawn edge to edge inside its advance and one word space",
     "after one reads as none. A second space here would be a lie in the data",
     "about a defect in the type, and the suite refuses both it and no space at",
-    "all."
+    "all.",
+    "",
+    "A release that genuinely has nothing to say is spelled TWICE: no key here,",
+    "and its version written into \"//nothing-to-say\" below. One spelling on its",
+    "own is ambiguous — a missing key reads the same whether it was a decision",
+    "or a forgotten step, and five releases in a row were once forgotten. The list",
+    "is what tells the two apart, and release-notes-current-version.test.ts fails",
+    "the release whose version is in neither place. Any key opening with // is a",
+    "note to the author and never a release."
+  ],
+  "//nothing-to-say": [],
+  "3.23.0": [
+    {
+      "title": "🧭 The accounts column leads with accounts",
+      "body": "The live account is the open row: its windows as bars, when each one resets, and how old the numbers are. Every other account rests on the two figures a switch is decided by, and opens with a click when you want the rest.\n\nA problem stays on the row — an expired login, one that was never stored, a keychain the deck cannot open — with the reason and the sign-in one press away. Auto-switch is one row now: its threshold and its switch. Local network moved out of the column into a view of its own, reached from a row at the foot that says how many machines are paired and how many are not responding."
+    },
+    {
+      "title": "💬 A resting session shows Claude Code's recap beside its card",
+      "body": "When a session stops, Claude Code's own recap of what it did is drawn beside the card — so a board you come back to says what happened without opening anything."
+    },
+    {
+      "title": "🪟 The chrome went quiet",
+      "body": "The topbar is borderless, one set of corners runs through the app, the canvas ground is flat, and the minimap, the zoom controls, the type filter and the Machine and Usage panels read as tooling rather than as cards.\n\nThe canvas also says when auto-fit is off, with one press to bring new sessions back into view."
+    },
+    {
+      "title": "🔍 A tool call's detail reads as the call",
+      "body": "A tool call's arguments are shown as the call rather than as escaped JSON, and can be copied."
+    },
+    {
+      "title": "🔐 Saying yes to every deck that asks takes two presses",
+      "body": "The switch that accepts every pairing request arms first and says what it hands over, so one stray click cannot put this machine's logins on another deck."
+    },
+    {
+      "title": "🖐️ Targets, themes and contrast",
+      "body": "The panel's smallest controls reach the 24px target floor, and grow further under a finger. A first run follows the system's light or dark setting instead of picking one. Status dots, meters and switch knobs survive a Windows Contrast theme."
+    }
+  ],
+  "3.22.15": [
+    {
+      "title": "🖱️ Clicking a card opens its details",
+      "body": "Selecting an agent is inspecting it: a click, `j`/`k`, a session picked from the list and Enter on a focused card all open the detail panel — prompt, every tool call, tokens, timing. It used to open only with `D`, so anybody who closed it with its × and never found the key did not get it back. The × still closes it until the next selection, and `D` still toggles it.\n\n`D` with nothing selected now picks a card first — the session that has waited longest, or the one `j` would land on — instead of flipping a switch with nothing on screen to show for it."
+    },
+    {
+      "title": "⌨️ The keyboard and screen readers reach the whole deck",
+      "body": "Shortcuts keep working after a mouse click on a button. A click left focus on the button it pressed, and the key handler leaves a focused control its own keys, so every single-key shortcut was dead until you pressed Esc — with nothing on screen to say so.\n\nTab follows the page now — topbar, the accounts column, the canvas, usage, machine — instead of zig-zagging left and right across it, and a canvas card reached by Tab draws the focus ring. A screen reader hears each card by name, with its kind, state, model and cost, rather than every word on it run together; the machine panel has a heading its region is named by; and the theme button is named for the theme it switches to.\n\nWith **Reduce motion** set, the camera no longer flies across the canvas to a card."
+    },
+    {
+      "title": "💵 The money figures say what they measure",
+      "body": "The usage header's **$/min** is spend over a trailing window, and says which span it measured: `$3.54/min · 2 min`. It used to divide the live agents' cost by how long the longest of them had been running, so one deck read $2.39/min in a tab left open and $19.49/min in a tab opened minutes later.\n\nA quota bar's pace says **over pace** or **under pace**. It said `ahead`, which is how plain English says winning, on the very line meant to warn you that you are burning the window faster than it lasts.\n\nA card's clock reads `≥ 53m 52s` for a session this page joined after it had started, instead of presenting the part it saw as the whole of it — and that card's per-minute burn is left out rather than divided by the short clock."
+    },
+    {
+      "title": "↔️ Narrow windows keep every topbar control on screen",
+      "body": "At 400px six of the topbar's buttons sat past the right edge and the page scrolled sideways. The readouts give way first now and the controls stay; below 640px the side panels span the window instead of leaving the canvas a sliver; and the category filter wraps inside the canvas rather than being clipped by it.\n\nZoomed out, a card's name and a cluster's label stay readable instead of shrinking to about four pixels — which is the view a board of any size actually sits at."
+    },
+    {
+      "title": "🔑 A paired deck's dialog says which account that machine is on",
+      "body": "The lane of the account the other machine is working on takes the accent and a slow ring on that machine's end. An account is named only if that deck shares it: on one it does not share, the dialog reads \"on another account\" and never which. A new switch under **SHARE THESE ACCOUNTS**, on by default, turns the telling off, and paired decks then read \"current account hidden\".\n\n**This deck on the network** prints this deck's own fingerprint again. A pairing request asks you to match it against the one on the other machine's screen, and no screen here was showing it — so the one check a person can make against a rogue deck could not be made, on the step that hands over logins."
+    },
+    {
+      "title": "💬 The deck's messages send you somewhere worth going",
+      "body": "An empty canvas no longer ends with \"Make sure ccdeck is running\" while the page is plainly connected to it. The capture hints under that line, one per CLI, are the real reasons a canvas stays empty, and they stay. With the stream down the screen says whether this page lost a deck that was there or never found one, in those words, rather than naming the `/events` route nobody who typed `npx ccdeck` has seen.\n\nAnd a slow `claude-swap` now reads as a slow answer — \"still waiting on the deck server\" — instead of \"couldn't reach the deck server\", which sent people off to restart a server that was fine."
+    }
   ],
   "3.22.10": [
     {

package/src/server/activity.mjs

@@ -21,8 +21,20 @@ const OPENS = new Set([
 ]);
 const CLOSES = new Set(["Stop", "SessionEnd"]);
 
+/** More turns open at once than any machine runs — the same figure as the
+ *  deck's own working limit for the sessions it tracks (MAX_TRACKED_SESSIONS in
+ *  index.mjs). A bound because the ids arrive from outside: this is fed from
+ *  pushEvent for every live event, and `/api/event` takes them without a
+ *  credential. presence.mjs caps its map of tab ids for the same reason.
+ *
+ *  Past it the turn heard from least recently goes, and that costs `busy` no
+ *  accuracy at all: the map is kept in the order turns were last heard from
+ *  (see `note`), so every turn that stays is at least as recent as the one that
+ *  left, and if the one that left was live, so is everything behind it. */
+export const MAX_OPEN_TURNS = 256;
+
 export function createActivity({ openCapMs = OPEN_CAP_MS } = {}) {
-  /** session id → when its turn last produced an event */
+  /** session id → when its turn last produced an event, least recent first */
   const open = new Map();
   let lastAt = 0;
   return {
@@ -33,10 +45,31 @@ export function createActivity({ openCapMs = OPEN_CAP_MS } = {}) {
       if (at > lastAt) lastAt = at;
       const id = raw?.session_id;
       if (typeof id !== "string" || !id) return;
-      if (CLOSES.has(name)) open.delete(id);
-      else open.set(id, at);
+      // DELETE, THEN SET (#1089), which is what presence.mjs has always done
+      // and this did not. `Map.set` on a key that is already there updates it
+      // IN PLACE, so a turn kept its position from its first event for as long
+      // as it ran — and `busy` below stops at the first live entry it meets,
+      // which is also the only place an entry ever expires. One long-running
+      // turn therefore sat at the head of the iteration order and shielded
+      // every turn that went quiet behind it: measured with 200,000 abandoned
+      // turns queued behind one that kept working, fifty sweeps at 150 minutes
+      // past the cap freed nothing, and when the long turn finally ended the
+      // next call swept the whole backlog in one synchronous loop — 175ms of an
+      // event loop that is also serving SSE and `/api/event`, off the timer the
+      // away-update runs on. Re-inserting moves the turn to the young end, so
+      // the map stays in the order turns were last heard from and the early
+      // return is sound: whatever is behind a live entry is younger than it.
+      open.delete(id);
+      if (OPENS.has(name)) {
+        open.set(id, at);
+        while (open.size > MAX_OPEN_TURNS) open.delete(open.keys().next().value);
+      }
     },
-    /** Whether any turn is still running. */
+    /** Whether any turn is still running. Expires what it walks past, and may
+     *  stop at the first live entry only because `note` keeps the map oldest
+     *  first — everything after that entry was heard from more recently. A turn
+     *  stamped by a clock that has since moved either way is as expired as an
+     *  old one, which is why the difference is absolute. */
     busy(now) {
       for (const [id, at] of open) {
         if (Math.abs(now - at) > openCapMs) open.delete(id);
@@ -48,5 +81,10 @@ export function createActivity({ openCapMs = OPEN_CAP_MS } = {}) {
     quietMs(now) {
       return lastAt ? Math.max(0, now - lastAt) : Infinity;
     },
+    /** How many turns are being held. For the suite: the map is private, and
+     *  what it holds is the whole of what #1089 was about. */
+    size() {
+      return open.size;
+    },
   };
 }

package/src/server/args.mjs

@@ -122,6 +122,11 @@ export function isPortValue(raw) {
 export const ONE_SHOT = Object.freeze([
   "help", "version", "uninstall", "stop", "status", "logs",
   "install", "installService", "uninstallService",
+  // `--purge` is here on its own rather than only as a modifier of
+  // `--uninstall`, because bin/deck.js runs the uninstall path for either of
+  // them. A one-shot that detached would print where somebody's private key is
+  // into a log file and hand the terminal back empty.
+  "purge",
 ]);
 
 /** Is this a command line that answers and leaves? */
@@ -131,13 +136,33 @@ export function isOneShot(flags = {}) {
 
 export function parseArgs(args) {
   const out = { unknown: [], incomplete: [] };
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
+  // END OF OPTIONS. A bare `--` is the POSIX separator, and reporting it as an
+  // unknown option warned about a token the user typed on purpose.
+  const end = args.indexOf("--");
+  const argv = end === -1 ? args : args.slice(0, end);
+  for (let i = 0; i < argv.length; i++) {
+    // `--port=4400`, split here so the dispatch below sees the two halves it
+    // already knows how to read.
+    //
+    // WHY IT MATTERS MORE THAN THE CONVENTION. Unsplit, `--port=4400` landed in
+    // `unknown` and `flags.port` stayed undefined — and bin/deck.js reads "no
+    // usable port" and "no port asked for" as the same thing, so
+    // `ccdeck --stop --port=4317` did not narrow the stop, it ended every deck
+    // on the machine. The `=` form is the commonest CLI convention there is,
+    // and this module's own header names this class of mistake as its reason
+    // for existing: "`ccdeck --prot 4500` booted on 4317 and said nothing."
+    const eq = argv[i].startsWith("--") ? argv[i].indexOf("=") : -1;
+    const a = eq > 2 ? argv[i].slice(0, eq) : argv[i];
+    const joined = eq > 2 ? argv[i].slice(eq + 1) : undefined;
     // The value of the flag just matched, or `undefined` when there is nothing
     // usable there. Closes over `i` so it can decline to advance it: not
     // consuming is what hands the token back to the loop.
     const value = (expects) => {
-      const next = args[i + 1];
+      if (joined !== undefined) {
+        if (joined.trim() === "") { out.incomplete.push({ flag: a, expects }); return undefined; }
+        return joined;
+      }
+      const next = argv[i + 1];
       if (next === undefined || looksLikeFlag(next)) {
         out.incomplete.push({ flag: a, expects });
         return undefined;
@@ -168,6 +193,7 @@ export function parseArgs(args) {
     else if (a === "--install-service") out.installService = true;
     else if (a === "--uninstall-service") out.uninstallService = true;
     else if (a === "--uninstall") out.uninstall = true;
+    else if (a === "--purge") out.purge = true;
     else if (a === "--workspace") set("workspace", "a path");
     else if (a === "--scope") out.scope = true;
     else if (a === "--all") out.all = true; // legacy no-op (now default)
@@ -177,7 +203,7 @@ export function parseArgs(args) {
     else if (a === "--no-codex") out.noCodex = true;
     else if (a === "--claude") out.claude = true;
     else if (a === "--no-claude") out.noClaude = true;
-    else out.unknown.push(a);
+    else out.unknown.push(argv[i]);   // the token as typed, `=` half included
   }
   return out;
 }

package/src/server/browser-history.mjs

@@ -64,14 +64,16 @@
 // falls back to the file's mtime — "something navigated at 09:06, no URL" is a
 // weaker signal than a list of URLs and it is a great deal better than a blank
 // panel and a crash.
-import { copyFile, mkdir, rm } from "node:fs/promises";
+import { chmod, copyFile, mkdir, mkdtemp, rm } from "node:fs/promises";
 import { createRequire } from "node:module";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
 import { constants as fsConstants } from "node:fs";
 const { COPYFILE_EXCL } = fsConstants;
 import { pathLookup, run } from "./exec.mjs";
+// The staging root is under the tree the user already owns rather than under
+// os.tmpdir(). See `stagingRoot` and the note inside readVisitsSince.
+import { claudeConfigDir } from "./claude-dir.mjs";
 
 /**
  * 1601-01-01 → 1970-01-01, in microseconds.
@@ -145,6 +147,34 @@ const visitsSql = (floor) =>
   ` WHERE v.visit_time > ${floor}` +
   " ORDER BY v.visit_time";
 
+/**
+ * How many visits the profile still holds above `floor`, for `opts.countSince`.
+ *
+ * WHAT IT IS FOR (#989). The caller used to floor every read at the moment the
+ * deck started, so the number of rows a read returned was a running total, and
+ * a DROP in it was how the watch noticed a browsing history being cleared — the
+ * one action that destroys the evidence this feature collects. A caller whose
+ * floor advances gets only what is new, and a cleared history then answers zero
+ * rows, which is exactly what a quiet minute answers. This is the running total
+ * again, without the rows.
+ *
+ * FLOORED, NEVER THE WHOLE TABLE. Chrome deletes visits older than ninety days
+ * on its own schedule, and a person can delete one old page from their history
+ * without clearing anything. A count of every visit would fall for both, and
+ * the caller would report each as a history "cleared or trimmed". Counted above
+ * the moment the caller started watching, it falls only when something it has
+ * already seen is deleted, which is the only fall the old running total could
+ * ever show.
+ *
+ * A SECOND STATEMENT, NOT A COLUMN ON THE ONE ABOVE: a column would come back
+ * on no rows at all for the read that matched nothing, and that read is the one
+ * that has to see a cleared history. Same copy, so the count and the rows
+ * describe the same moment of a file another program is still writing. CAST for
+ * the header's reason, so the CLI and node:sqlite hand it over in one spelling.
+ */
+const countSql = (floor) =>
+  `SELECT CAST(COUNT(*) AS TEXT) n FROM visits WHERE visit_time > ${floor}`;
+
 /**
  * The floor as a run of digits, or "0".
  *
@@ -283,17 +313,50 @@ async function probeBackend({
 
 /** Distinguishes this deck's copies from a sibling deck's in a shared copyDir.
  *  pid alone is not enough — one deck polls repeatedly and must not read a copy
- *  it is still writing. */
+ *  it is still writing. Kept beside the `mkdtemp` directory rather than replaced
+ *  by it: the directory is what makes the name unreachable to anybody else, and
+ *  this is what keeps it readable to a person looking at one. */
 let copySeq = 0;
 
+/**
+ * Where a copy of somebody's browsing history is allowed to be staged.
+ *
+ * NOT `os.tmpdir()`, and the reason is one platform out of three. On macOS that
+ * is a per-user `/var/folders/…/T` and on Windows it is inside the profile; on
+ * Linux it is `/tmp`, mode 1777, writable by every account on the box. A fixed
+ * name under a shared, world-writable directory is a name any other account can
+ * take first — and `mkdir` with `recursive: true` does not fail on a directory
+ * that is already there, it succeeds and keeps whatever mode and owner that
+ * directory already had. So the `mode: 0o700` this call passes was applied only
+ * on the run that created the directory and was a silent no-op on every run
+ * after it, and on every run where somebody else got there first.
+ *
+ * `~/.claude/agent-dag/browser-watch/staging` is inside a tree the user already
+ * owns, which removes the shared namespace rather than defending against it —
+ * the same move #551 made for `uv-bootstrap` and `macmon`, and the last stager
+ * left in the system temp directory after it. The parent is the Browser Watch
+ * directory browser-watch-store.mjs writes `state.json` into; `staging/` is a
+ * subdirectory of it so a transient copy is never mistaken for the archive.
+ *
+ * Resolved per call rather than at module load, because `claudeConfigDir` reads
+ * CLAUDE_CONFIG_DIR and the suite moves it.
+ */
+export const stagingRoot = (home = claudeConfigDir()) =>
+  join(home, "agent-dag", "browser-watch", "staging");
+
 /**
  * Every navigation newer than `sinceChromeTime`.
  *
- * `{ rows, watermark, degraded, reason }`
+ * `{ rows, watermark, total, degraded, reason }`
  *   rows       [{ url, timeMs, transition }], oldest first
  *   watermark  the newest chrome time seen, as a string, or the input unchanged
  *              when there was nothing to see — store it and hand it back next
  *              poll
+ *   total      how many visits the profile holds above `opts.countSince`, read
+ *              from the same copy as `rows`; null when no count was asked for
+ *              or none could be read, and NEVER 0 for "could not read", because
+ *              a caller comparing totals would take that zero for a history
+ *              somebody emptied. See `countSql`.
  *   degraded   true when no rows could be read for a reason that is not "no new
  *              navigations": no SQLite reader on this machine, no readable copy,
  *              a torn image. The caller falls back to the file's mtime in all of
@@ -303,20 +366,25 @@ let copySeq = 0;
  *   reason     null on success, otherwise a stable slug and a detail:
  *              "no-sqlite-reader: …" | "copy-failed: …" | "unreadable-copy: …"
  *
- * `opts.copyDir` is where the copy of the locked file goes; `opts.backend` skips
- * the probe when the caller already resolved it; `opts.deps` injects the
- * filesystem, the runner and the import for tests.
+ * `opts.copyDir` is the root the copy of the locked file is staged UNDER — each
+ * call gets its own `mkdtemp` directory inside it, so the copy's own path is
+ * never one a caller or anybody else can predict. `opts.countSince` is a chrome
+ * time to count visits above, and asks for `total`; left out, no count runs.
+ * `opts.backend` skips the probe when the caller already resolved it;
+ * `opts.deps` injects the filesystem, the runner and the import for tests.
  *
  * NEVER THROWS. Not "rarely" — this is called from a poll in the deck's own
  * process and the inputs are a file another program owns, so the failure modes
  * are ordinary rather than exceptional.
  */
 export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
-  const { copyDir = join(tmpdir(), "ccdeck-browser-watch"), backend } = opts;
+  const { copyDir = stagingRoot(), backend, countSince } = opts;
   const deps = opts.deps ?? {};
   const {
     copyFile: copy = copyFile,
     mkdir: makeDir = mkdir,
+    mkdtemp: makeTemp = mkdtemp,
+    chmod: setMode = chmod,
     rm: remove = rm,
     run: exec = run,
     importSqlite = loadSqlite,
@@ -328,29 +396,31 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
   // normalised floor where it was not, so the answer is always a string a later
   // call can be handed.
   const unchanged = floor === String(sinceChromeTime ?? "").trim() ? String(sinceChromeTime) : floor;
+  // Through the same validation as the floor, for the same reason: on the CLI
+  // path it is pasted into SQL text.
+  const countFloor = countSince === undefined ? null : chromeFloor(countSince);
 
   const chosen = backend ?? await sqliteBackend(opts.deps);
   if (!chosen || chosen.kind === "none") {
     return {
       rows: [],
       watermark: unchanged,
+      total: null,
       degraded: true,
       reason: "no-sqlite-reader: node:sqlite needs Node 22.5+ and no sqlite3 was found on PATH",
     };
   }
 
   let copyPath = null;
+  let stage = null;
   try {
-    // MODE 0700, AND A NAME NOBODY ELSE CAN PREDICT.
+    // A DIRECTORY NOBODY ELSE COULD HAVE MADE, IN A TREE NOBODY ELSE CAN WRITE.
     //
-    // `os.tmpdir()` is per-user on macOS (/var/folders/…, 0700) and on Windows,
-    // and on Linux it is the shared, world-writable /tmp. A fixed directory
-    // name and `history-<pid>-<n>.sqlite` inside it meant three things there,
-    // all of them avoidable:
+    // Three things a fixed name under `os.tmpdir()` meant on Linux, where that
+    // is `/tmp`, mode 1777:
     //
-    //   * a complete, unencrypted copy of the user's browsing history, mode
-    //     0644, under a predictable path, readable by every other account on
-    //     the machine for the life of the poll;
+    //   * a complete, unencrypted copy of the user's browsing history under a
+    //     predictable path, in a directory chosen by whoever created it first;
     //   * another UID can create the directory first — `mkdir` with `recursive`
     //     swallows EEXIST and keeps THEIR mode — and then read every copy, or
     //     plant a symlink at the name and have this overwrite a file the user
@@ -358,10 +428,33 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
     //   * a second user on the same box then fails EACCES on a directory they
     //     cannot write, and their deck is degraded for good.
     //
-    // The mode is set on creation AND after, because the directory may already
-    // exist from an earlier run of this same deck.
+    // The second is closed by COPYFILE_EXCL below. The other two were not, and
+    // the comment that used to stand here claimed a mitigation the file did not
+    // contain: "the mode is set on creation AND after" — `grep -c chmod` on this
+    // module answered 0. That mattered exactly where it said it did, because
+    // POSIX `mkdir` applies a mode ONLY when it creates the directory. Measured:
+    // a directory already at 0777 was still 0777 after
+    // `mkdir(copyDir, { recursive: true, mode: 0o700 })`. So on every run after
+    // the first, and on every run where another account had got there first, the
+    // mode argument did nothing at all, and an account that pre-created
+    // `/tmp/ccdeck-browser-watch` 0755 under its own uid left every other user's
+    // deck failing `copy-failed:` on every poll, permanently, with the panel
+    // saying only that the history could not be read.
+    //
+    // Both are gone with the shared namespace: `copyDir` now defaults under
+    // `~/.claude`, and `mkdtemp` CREATES — it cannot be handed a directory
+    // somebody else made, it picks the six random characters itself, and the
+    // directory it makes is 0700 by construction rather than by an argument
+    // that may be ignored. The chmod is kept and is now real, so the directory
+    // ABOVE the staging one is pinned on the runs where it already existed; it
+    // is best-effort because a home on a filesystem with no POSIX modes (a
+    // Windows profile, an exFAT volume, a network mount) must not lose the
+    // feature over a permission it cannot express, and mkdtemp is what the
+    // guarantee actually rests on.
     await makeDir(copyDir, { recursive: true, mode: 0o700 });
-    copyPath = join(copyDir, `history-${process.pid}-${++copySeq}-${randomUUID().slice(0, 8)}.sqlite`);
+    try { await setMode(copyDir, 0o700); } catch { /* best-effort, see above */ }
+    stage = await makeTemp(join(copyDir, "history-"));
+    copyPath = join(stage, `history-${process.pid}-${++copySeq}-${randomUUID().slice(0, 8)}.sqlite`);
     // COPYFILE_EXCL: refuse rather than write through a symlink or over a file
     // that is already there. A refusal is one degraded poll; the alternative is
     // clobbering whatever the name pointed at.
@@ -370,27 +463,31 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
     // The browser is not installed, the profile moved, the disk is full. All of
     // them are "no rows this poll", none of them is a reason to stop polling.
     await discard(remove, copyPath);
-    return { rows: [], watermark: unchanged, degraded: true, reason: `copy-failed: ${why(err)}` };
+    await discard(remove, stage);
+    return { rows: [], watermark: unchanged, total: null, degraded: true, reason: `copy-failed: ${why(err)}` };
   }
 
-  let raw;
+  let read;
   try {
-    raw = chosen.kind === "node-sqlite"
-      ? await readViaNode(copyPath, floor, importSqlite)
-      : await readViaCli(copyPath, floor, chosen.bin, exec);
+    read = chosen.kind === "node-sqlite"
+      ? await readViaNode(copyPath, floor, countFloor, importSqlite)
+      : await readViaCli(copyPath, floor, countFloor, chosen.bin, exec);
   } catch (err) {
-    return { rows: [], watermark: unchanged, degraded: true, reason: `unreadable-copy: ${why(err)}` };
+    return { rows: [], watermark: unchanged, total: null, degraded: true, reason: `unreadable-copy: ${why(err)}` };
   } finally {
-    // A 21 MB file per poll. Left behind, this fills the user's temp directory
-    // at the rate the deck polls — and the copy is a full, unencrypted list of
+    // A 21 MB file per poll. Left behind, this fills the staging directory at
+    // the rate the deck polls — and the copy is a full, unencrypted list of
     // everywhere they have been, which is not a thing to leave lying around
-    // under a predictable name.
+    // under a predictable name. The staging DIRECTORY goes with it: `mkdtemp`
+    // makes one per call, so a poll that removed only the file would leave an
+    // empty directory behind every ten seconds for as long as the deck is up.
     await discard(remove, copyPath);
+    await discard(remove, stage);
   }
 
   const rows = [];
   let top = floor;
-  for (const row of raw) {
+  for (const row of read.raw) {
     const timeMs = chromeTimeToMs(row?.t);
     // A row with no URL or an unreadable time is dropped rather than repaired.
     // It cannot be drawn and it must not become the watermark, because a
@@ -407,7 +504,7 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
   // today, and the watermark is the one value whose being wrong loses rows
   // forever rather than for one poll — so it is computed from what was read
   // instead of from an assumption about how it was sorted.
-  return { rows, watermark: rows.length ? top : unchanged, degraded: false, reason: null };
+  return { rows, watermark: rows.length ? top : unchanged, total: read.total, degraded: false, reason: null };
 }
 
 /**
@@ -417,13 +514,17 @@ export async function readVisitsSince(historyPath, sinceChromeTime, opts = {}) {
  * closing — see __tests__/rm-temp-dir.ts, which paid for that knowledge twice.
  * The catch is on top of it because a leftover 21 MB file in a temp directory is
  * not worth a failed poll.
+ *
+ * `recursive` because this is handed BOTH the copy and the `mkdtemp` directory
+ * it sits in, and `rm` refuses a directory without it (ERR_FS_EISDIR) even with
+ * `force`. On a plain file it changes nothing.
  */
 async function discard(remove, path) {
   if (!path) return;
   try {
-    await remove(path, { force: true, maxRetries: 5, retryDelay: 20 });
+    await remove(path, { force: true, recursive: true, maxRetries: 5, retryDelay: 20 });
   } catch {
-    // The OS still has it. It is in a temp directory and it is one file.
+    // The OS still has it. It is one file, or one directory holding one file.
   }
 }
 
@@ -444,16 +545,25 @@ async function discard(remove, path) {
  * conversion that the schema happens to ask for — and that is a thing to rely on
  * only when there is no alternative. Here there is one.
  */
-async function readViaNode(file, floor, importSqlite) {
+async function readViaNode(file, floor, countFloor, importSqlite) {
   const { DatabaseSync } = await importSqlite();
   const db = new DatabaseSync(file, { readOnly: true });
   try {
-    return db.prepare(visitsSql("?")).all(BigInt(floor));
+    const raw = db.prepare(visitsSql("?")).all(BigInt(floor));
+    const total = countFloor === null ? null : countOf(db.prepare(countSql("?")).get(BigInt(countFloor))?.n);
+    return { raw, total };
   } finally {
     try { db.close(); } catch { /* already closed, or never opened cleanly */ }
   }
 }
 
+/** A count as a number, or null. Both backends hand it over as a run of digits
+ *  — `countSql` casts it — and anything else is not a count this can vouch for. */
+function countOf(n) {
+  const digits = String(n ?? "").trim();
+  return /^\d+$/.test(digits) ? Number(digits) : null;
+}
+
 // sqlite3 -ascii separators: 0x1F between columns, 0x1E after every row
 // including the last. Chosen over `-json` because `-json` needs sqlite3 3.33
 // (2020) and Ubuntu 20.04 still ships 3.31, while `-ascii` has been there since
@@ -476,8 +586,13 @@ const RECORD = "\u001e";
  * default is ENOBUFS, which arrives looking like a broken database rather than
  * like a large one.
  */
-async function readViaCli(file, floor, bin, exec) {
-  const res = await exec(bin, ["-readonly", "-ascii", file, visitsSql(floor)], {
+async function readViaCli(file, floor, countFloor, bin, exec) {
+  // BOTH STATEMENTS IN ONE INVOCATION, COUNT FIRST. sqlite3(1) runs its SQL
+  // argument as a script, and a second spawn per poll is the cost this backend
+  // is already the fallback for. COUNT(*) answers exactly one row on any table,
+  // empty included, so the first record is the count and the rest are visits.
+  const sql = countFloor === null ? visitsSql(floor) : `${countSql(countFloor)};${visitsSql(floor)}`;
+  const res = await exec(bin, ["-readonly", "-ascii", file, sql], {
     timeout: 15_000,
     maxBuffer: 64 << 20,
   });
@@ -487,11 +602,22 @@ async function readViaCli(file, floor, bin, exec) {
     const said = why(res?.stderr || res?.stdout || "");
     throw new Error(`sqlite3 exited ${res?.code ?? "?"}${said ? `: ${said}` : ""}`);
   }
+  const records = String(res.stdout ?? "").split(RECORD);
+  // Checked rather than trusted. A count record is a bare run of digits and a
+  // visit record never is — it carries two 0x1F separators — so a first record
+  // that is not one is left in place to be read as a visit, and the count comes
+  // back null: a sqlite3 that printed it some other way costs the count, not a
+  // URL.
+  let total = null;
+  if (countFloor !== null) {
+    total = countOf(records[0]);
+    if (total !== null) records.shift();
+  }
   const out = [];
-  for (const record of String(res.stdout ?? "").split(RECORD)) {
+  for (const record of records) {
     if (!record) continue;
     const [url, t, tr] = record.split(UNIT);
     out.push({ url, t, tr });
   }
-  return out;
+  return { raw: out, total };
 }

package/src/server/browser-presence.mjs

@@ -98,6 +98,66 @@ export function processName(key, platform = process.platform) {
   return table[key] ?? null;
 }
 
+/**
+ * The other browser keys this platform cannot tell apart from `key` by process
+ * name alone.
+ *
+ * Read the win32 table above and the collision is plain: four keys, one name.
+ * Chrome, Chrome Beta, Chrome Canary and Chromium all ship their executable as
+ * `chrome.exe` on Windows — and so does every renderer any of them starts — so
+ * `tasklist /FI "IMAGENAME eq chrome.exe"` and `taskkill /IM chrome.exe` are
+ * both answers about ALL FOUR. The Linux table has the same three-way collision
+ * on `chrome`.
+ *
+ * Exported so the reaction can ask the question before it acts, rather than
+ * each caller re-deriving it from a table it would have to be looking at. An
+ * empty list is the ordinary answer — `msedge`, `brave` and `vivaldi` name one
+ * browser each — and it means the image name IS the install.
+ */
+export function sharesProcessName(key, platform = process.platform) {
+  const table = APP_NAME[platform] ?? APP_NAME.linux;
+  const mine = table[key];
+  if (!mine) return [];
+  return Object.keys(table).filter(k => k !== key && table[k] === mine);
+}
+
+/**
+ * The path fragment that tells one Windows install of a shared image name from
+ * another.
+ *
+ * The four Chrome-family channels collide on `chrome.exe` and do NOT collide on
+ * where they are installed: the installer gives each channel its own directory,
+ * and the same directory name is the one that appears in the user-data root
+ * `browser-profiles.mjs` already knows — `Google\Chrome SxS\User Data` beside
+ * `Google\Chrome SxS\Application\chrome.exe`. So a process's own executable
+ * path names its channel even when its image name does not.
+ *
+ * WITH THE SEPARATORS ON BOTH SIDES, which is the whole of the discrimination:
+ * `\Google\Chrome\` does not occur in `…\Google\Chrome Beta\Application\…` or in
+ * `…\Google\Chrome SxS\Application\…`, while a bare `Chrome` occurs in all
+ * three. A fragment rather than a full path because the same channel installs
+ * per-machine under `%ProgramFiles%` and per-user under `%LOCALAPPDATA%`, and
+ * anchoring on either one would miss the other half of the installs.
+ *
+ * REASONED FROM DOCUMENTED INSTALLER LAYOUT, NOT MEASURED HERE: this table says
+ * where Google's installer puts each channel, and no Windows machine was
+ * available to confirm it. What the code does with a non-match is therefore the
+ * important half, and it is deliberately the safe one — see quitBrowser, which
+ * falls back to asking rather than to killing, and never widens its reach on a
+ * miss.
+ */
+const WIN_INSTALL_DIR = {
+  chrome: "\\Google\\Chrome\\",
+  "chrome-beta": "\\Google\\Chrome Beta\\",
+  "chrome-canary": "\\Google\\Chrome SxS\\",
+  chromium: "\\Chromium\\",
+};
+
+/** Where this browser is installed, as a path fragment, or null when the
+ *  platform has no such distinction to make or the deck does not know one. */
+export const installMarker = (key, platform = process.platform) =>
+  platform === "win32" ? (WIN_INSTALL_DIR[key] ?? null) : null;
+
 /** Every address the relay currently resolves to.
  *
  *  Empty is not an error — a machine with no `dig`, or one where the name is