ccdeck 3.26.4 → 3.27.0

package/src/server/index.mjs

@@ -6065,10 +6065,49 @@ async function handleClaudeAccountSwitch(req, res) {
       pathToFileURL(join(PKG_ROOT, "src/server/quota.mjs")).href
     );
     invalidateQuotaCache();
+    // Note who became active, and when, for the account-projects report. Best
+    // effort — a failed log write must never fail the switch — so it is not
+    // awaited into the response.
+    import(pathToFileURL(join(PKG_ROOT, "src/server/swap-log.mjs")).href)
+      .then(({ recordSwap }) => recordSwap(parsed.account, "manual"))
+      .catch(() => {});
   }
   send(res, result.ok ? 200 : 400, result);
 }
 
+// The account-projects rollup, started once and shared. Its timer is unref'd
+// inside start(), so holding the instance here never keeps the process alive.
+let _projectRollup = null;
+function getProjectRollup() {
+  if (!_projectRollup) {
+    _projectRollup = import(pathToFileURL(join(PKG_ROOT, "src/server/account-projects.mjs")).href)
+      .then(m => { const r = m.createProjectRollup(); r.start().catch(() => {}); return r; });
+  }
+  return _projectRollup;
+}
+
+/**
+ * The "Projects" report for one account: how many tokens it spent per project
+ * over a window. The server tallies only tokens (per model); the web side
+ * prices them with its own table, so cost never lives in two places. `num` is
+ * the account's slot, resolved to its `(email, org)` key here; `days` is 7, 30,
+ * or 0 for all tracked.
+ */
+async function handleAccountProjects(req, res) {
+  const url = new URL(req.url, "http://localhost");
+  const num = Number(url.searchParams.get("num"));
+  const d = Number(url.searchParams.get("days"));
+  const days = d === 30 ? 30 : d === 0 ? 0 : 7;
+  if (!Number.isInteger(num) || num <= 0) return send(res, 400, { ok: false, reason: "bad_account" });
+  const { identityForSlot } = await import(pathToFileURL(join(PKG_ROOT, "src/server/swap-log.mjs")).href);
+  const id = await identityForSlot(num);
+  if (!id) return send(res, 400, { ok: false, reason: "bad_account" });
+  const { accountKey } = await import(pathToFileURL(join(PKG_ROOT, "src/server/lan-sync.mjs")).href);
+  const rollup = await getProjectRollup();
+  const report = await rollup.report(accountKey(id.email, id.orgUuid), days);
+  send(res, 200, { ok: true, ...report });
+}
+
 function cswapAdminModule() {
   return import(pathToFileURL(join(PKG_ROOT, "src/server/cswap-admin.mjs")).href);
 }
@@ -6181,6 +6220,12 @@ const PINNED_MODULES = [
   "macmon.mjs",
   "hwmonitor.mjs",
   "retire-sound-hook.mjs",
+  // The account-projects report: the rollup and the swap log its attribution
+  // reads, plus lan-sync for the account key — all reached only through
+  // import() from the report's route.
+  "account-projects.mjs",
+  "swap-log.mjs",
+  "lan-sync.mjs",
 ];
 
 let _pinned = null;
@@ -7127,6 +7172,9 @@ const GUARDED_READS = new Set([
   "/api/browser-watch",
   "/api/lan",
   "/api/prefs",
+  // Per-account, per-project token spend — the user's own work, the same class
+  // of secret as the accounts list it hangs off.
+  "/api/account-projects",
 ]);
 
 function isAuthorizedMutation(req) {
@@ -7483,6 +7531,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/api/browser-watch") return guard(handleBrowserWatch(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/browser-watch") return guard(handleBrowserWatchSettings(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/browser-watch/dismiss") return guard(handleBrowserWatchDismiss(req, res), res);
+    if (req.method === "GET"  && url.pathname === "/api/account-projects") return guard(handleAccountProjects(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/claude-accounts") return guard(handleClaudeAccounts(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/claude-accounts/switch") return guard(handleClaudeAccountSwitch(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/claude-accounts/login")  return guard(handleAccountLoginState(req, res), res);
@@ -7603,6 +7652,11 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       // being installed or upgraded underneath them (#1043) — null from every
       // caller with nothing to wait for.
       cswapAutoModule().then(m => m.initCswapAuto({ after: cswapQuiet })).catch(() => {});
+      // The account-projects rollup: fold Claude transcripts into a per-account,
+      // per-project token tally, incrementally. Claude only — it reads Claude
+      // transcripts — best effort, and its timer is unref'd so it never holds
+      // the process open.
+      if (claude) getProjectRollup().catch(() => {});
       return server;
     } catch (err) {
       lastErr = err;

package/src/server/installer.mjs

@@ -403,15 +403,37 @@ async function writeFileAtomic(rawTarget, text) {
  * identical content skips the write and the file is not replaced at all.
  */
 async function installScript(src, dst) {
-  const text = await readFile(src, "utf8");
+  return installText(await readFile(src, "utf8"), dst);
+}
+
+async function installText(text, dst) {
   const current = await readFile(dst, "utf8").catch(() => null);
   if (current === text) return false;
   await writeFileAtomic(dst, text);
   return true;
 }
 
+/**
+ * What makes the installed hook.js a CommonJS file wherever the config dir is.
+ *
+ * Node decides whether a `.js` file is CommonJS or an ES module from the nearest
+ * package.json above it, and hook.js is CommonJS. With none in agent-dag/, that
+ * nearest one is whatever the user has further up: a `"type": "module"` in
+ * ~/package.json, or in the repo a relocated CLAUDE_CONFIG_DIR lives in, loads
+ * the hook as an ES module, and it dies on its first `require` before main()
+ * has installed a single handler. Exit 1 and `require is not defined in ES
+ * module scope` on every tool call, and no deck receives anything (#1172). One
+ * file here answers the question before Node looks any further.
+ *
+ * Written before the hook, so a first install never has a hook.js without it,
+ * and through the same atomic write, because a half-written package.json is a
+ * load error of its own for every hook that starts while it is being written.
+ */
+const HOOK_PACKAGE_JSON = '{ "type": "commonjs" }\n';
+
 async function installHookScript(installDir) {
   await ensureDir(installDir);
+  await installText(HOOK_PACKAGE_JSON, join(installDir, "package.json"));
   const src = join(PKG_ROOT, "hook", "hook.js");
   const dst = join(installDir, "hook.js");
   await installScript(src, dst);

package/src/server/retire-sound-hook.mjs

@@ -91,8 +91,17 @@ const EVENT = "Stop";
 // writes this any more; retirement reads it once and deletes it.
 const PARKED_PATH = join(homedir(), ".agents-deck", "parked-sound-hooks.json");
 
+// `Array.isArray`, not `?? []`, and that is a crash fix rather than a style
+// choice. A group whose `hooks` is not an array — hand-edited settings.json,
+// something else's schema, a half-finished edit — made this `.map` throw
+// `TypeError: … .map is not a function`, out of `retireSoundHookIn`, out of
+// `installHooks`, on the unconditional install every boot runs: the deck would
+// not start at all until the user found and fixed the entry, with nothing but a
+// stack to say which one. installer.mjs's own `isOurEntry` has always read the
+// same field with the same guard, and its answer for a group it cannot read is
+// to leave it exactly where it is.
 const commandsOf = (entry) =>
-  (entry?.hooks ?? []).map(h => (typeof h?.command === "string" ? h.command : ""));
+  (Array.isArray(entry?.hooks) ? entry.hooks : []).map(h => (typeof h?.command === "string" ? h.command : ""));
 
 /**
  * THE TAIL, NOT THE WHOLE PATH — and this is a data-loss fix, not a tidy-up.

package/src/server/swap-log.mjs

@@ -0,0 +1,188 @@
+// The timeline of which account was active, and when.
+//
+// Nothing in claude-swap or the deck ever recorded this. sequence.json holds a
+// single `activeAccountNumber` — who is active *now* — and overwrites it on
+// every switch, so the moment a swap happens the previous truth is gone. The
+// account-projects report needs the opposite: a durable, append-only record of
+// "at time T the active account became X", so a transcript message written at
+// some past instant can be attributed to whoever was active *then*.
+//
+// The deck is the one thing that performs a swap (it drives `cswap switch` and
+// the auto tick), so it does not have to reconstruct or guess: it writes one
+// line each time it moves the live account. The past before this file existed
+// is unrecoverable — there is no timestamped history anywhere to mine — so the
+// report is honest only from the first line here onward, and everything earlier
+// is left unattributed.
+//
+// One line per swap, JSON:
+//   { "at": <ms>, "slot": <n>, "email": "...", "orgUuid": "...", "source": "manual"|"auto"|"start" }
+// `source` "start" is the anchor the rollup writes once at boot for whoever is
+// already active, so a machine that never swaps still attributes its work.
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { backupRoot } from "./claude-accounts.mjs";
+
+/** The log the deck appends swaps to. Under ~/.agents-deck like cswap-auto's
+ *  own state, not under the claude-swap store — this is the deck's record, not
+ *  claude-swap's. */
+export function swapLogPath(home = homedir()) {
+  return join(home, ".agents-deck", "log", "account-active.jsonl");
+}
+
+/** Read one JSON value from a file, or null if it is missing or unparseable. */
+async function readJsonSafe(path) {
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+/** The `(email, organizationUuid)` a slot number points at right now, read from
+ *  claude-swap's sequence.json. Null when the store or the slot is not there. */
+export async function identityForSlot(slot, root = backupRoot()) {
+  const seq = await readJsonSafe(join(root, "sequence.json"));
+  const acc = seq?.accounts?.[String(slot)];
+  if (!acc) return null;
+  return {
+    email: typeof acc.email === "string" ? acc.email : "",
+    orgUuid: typeof acc.organizationUuid === "string" ? acc.organizationUuid : "",
+  };
+}
+
+/** The slot claude-swap says is active right now, or null. */
+export async function currentActiveSlot(root = backupRoot()) {
+  const seq = await readJsonSafe(join(root, "sequence.json"));
+  const n = Number(seq?.activeAccountNumber);
+  return Number.isInteger(n) && n > 0 ? n : null;
+}
+
+/** Parse the log into swap entries sorted oldest-first. A truncated or garbage
+ *  last line (a crash mid-append) is skipped, never fatal. */
+export async function readSwapLog(path = swapLogPath()) {
+  const text = await readFile(path, "utf8").catch(() => "");
+  const out = [];
+  for (const line of text.split("\n")) {
+    if (!line) continue;
+    let obj = null;
+    try { obj = JSON.parse(line); } catch { continue; }
+    if (!obj || typeof obj !== "object") continue;
+    const at = Number(obj.at);
+    if (!Number.isFinite(at)) continue;
+    out.push({
+      at,
+      slot: Number(obj.slot) || 0,
+      email: typeof obj.email === "string" ? obj.email : "",
+      orgUuid: typeof obj.orgUuid === "string" ? obj.orgUuid : "",
+      source: typeof obj.source === "string" ? obj.source : "",
+    });
+  }
+  out.sort((a, b) => a.at - b.at);
+  return out;
+}
+
+/** Append one swap line. Creates the log directory on first use. Best-effort:
+ *  a failure to record must never break a switch, so callers ignore rejection. */
+export async function appendSwap(entry, path = swapLogPath()) {
+  await mkdir(join(path, ".."), { recursive: true });
+  await appendFile(path, JSON.stringify(entry) + "\n", "utf8");
+}
+
+/**
+ * Record that `slot` became the active account, resolving its identity from the
+ * store. `source` says which path moved it. Returns the entry written, or null
+ * when the slot has no identity (nothing worth attributing to).
+ *
+ * Best-effort by contract: every caller sits on a hot path (a click, an auto
+ * tick) that must not fail because a log write did. Errors are swallowed here
+ * so callers can `void recordSwap(...)` without a catch.
+ */
+export async function recordSwap(slot, source, { now = Date.now, root, path } = {}) {
+  try {
+    const store = root ?? backupRoot();
+    // Trust the store's own idea of who is active over a caller-supplied slot
+    // when that slot is missing or malformed — after a switch, sequence.json's
+    // activeAccountNumber is the authoritative new slot, so the auto tick can
+    // record without threading the number through cswap's JSON.
+    let n = Number(slot);
+    if (!Number.isInteger(n) || n <= 0) n = await currentActiveSlot(store);
+    if (!n) return null;
+    const id = await identityForSlot(n, store);
+    if (!id) return null;
+    const entry = { at: now(), slot: n, email: id.email, orgUuid: id.orgUuid, source };
+    await appendSwap(entry, path ?? swapLogPath());
+    return entry;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Seed an anchor for the currently-active account, once, if the log does not
+ * already end on that account. Called at boot so a deck that never swaps still
+ * attributes its work to the account it launched on, and so the very first
+ * upgrade writes a "tracked since" point.
+ *
+ * Deduped against the last entry's `(email, orgUuid)`: a restart on the same
+ * account adds nothing, but a manual switch made while the deck was down (so no
+ * line was written for it) is still captured here on the next boot.
+ */
+export async function seedActive({ now = Date.now, root, path } = {}) {
+  try {
+    const logPath = path ?? swapLogPath();
+    const slot = await currentActiveSlot(root ?? backupRoot());
+    if (!slot) return null;
+    const id = await identityForSlot(slot, root ?? backupRoot());
+    if (!id) return null;
+    const entries = await readSwapLog(logPath);
+    const last = entries[entries.length - 1];
+    if (last && last.email === id.email && last.orgUuid === id.orgUuid) return null;
+    const entry = { at: now(), slot, email: id.email, orgUuid: id.orgUuid, source: "start" };
+    await appendSwap(entry, logPath);
+    return entry;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Which account was active at millisecond `ts`: the last entry at or before it.
+ * Null when `ts` precedes every entry — before tracking began — OR when the
+ * governing entry is a `stop` marker, which the rollup writes to fence off the
+ * time the deck was not running: nothing recorded who was active then, so work
+ * with a timestamp inside a stop→start gap is honestly unattributable rather
+ * than charged to whichever account happened to be active when the deck closed.
+ * `entries` must be sorted oldest-first, as `readSwapLog` returns them.
+ */
+export function accountAtTime(entries, ts) {
+  if (!Array.isArray(entries) || !entries.length) return null;
+  if (ts < entries[0].at) return null;
+  // Binary search for the rightmost entry with at <= ts.
+  let lo = 0, hi = entries.length - 1, ans = 0;
+  while (lo <= hi) {
+    const mid = (lo + hi) >> 1;
+    if (entries[mid].at <= ts) { ans = mid; lo = mid + 1; }
+    else hi = mid - 1;
+  }
+  const e = entries[ans];
+  if (e.source === "stop") return null;   // inside a gap the deck was not running
+  return { email: e.email, orgUuid: e.orgUuid, slot: e.slot };
+}
+
+/** Fence off a stretch of time as "the deck was not running" from `at`, so
+ *  work timestamped after it is unattributed until the next real entry. */
+export async function markGap(at, path = swapLogPath()) {
+  try {
+    await appendSwap({ at, slot: 0, email: "", orgUuid: "", source: "stop" }, path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** The earliest instant the log covers — what the report shows as "tracked
+ *  since". Null on an empty log. */
+export function trackedSince(entries) {
+  return Array.isArray(entries) && entries.length ? entries[0].at : null;
+}