ccdeck 3.28.1 → 3.29.1

package/src/server/account-health.mjs

@@ -0,0 +1,38 @@
+/** A collector's verdict is about the stored copy, not the live CLI session.
+ * In particular, an inaccessible Keychain does not make the stored copy dead:
+ * treating it as dead starts a futile peer-healing loop on every LAN round. */
+const LOST_COPY = new Set(["no_credentials", "relogin_required", "foreign_credential"]);
+
+export function storedCopyAlive(alive, verdict) {
+  // An unreadable keychain or a deferred token refresh is a failure to CHECK,
+  // not evidence that the stored login has died. Do not repeatedly overwrite
+  // that slot with copies from a peer while the check is unavailable.
+  if (verdict === "keychain_unavailable" || verdict === "token_expired") return true;
+  return alive === true && !LOST_COPY.has(verdict);
+}
+
+/** When a collector verdict is present, only `ok` is positive export evidence.
+ * Unknown and transient verdict strings are therefore fail-closed. */
+export function exportVerdictOk(verdict) {
+  return verdict === "ok";
+}
+
+/** Cached preflight for the LAN hot path. A KNOWN bad or unknown verdict is
+ * refused before spawning an export. An inactive slot with no verdict may reach
+ * the bounded export itself: it exports the stored copy, which carries the
+ * slot's own identity. The ACTIVE slot may not, because its export is the live
+ * CLI login, which can belong to another account or be expired while the
+ * blob's labels still name the slot, so the identity check cannot catch it.
+ * Its verdict is refreshed in the background and the next round shares it. */
+export function cachedExportReadable(verdict, { active = false } = {}) {
+  if (verdict == null) return !active;
+  return exportVerdictOk(verdict);
+}
+
+/** Is the live CLI login the account this slot names? The active slot exports
+ * the live login, and a verdict can predate a `/login` as somebody else. */
+export function liveLoginIs(identity, email, org) {
+  const live = String(identity?.email ?? "").trim().toLowerCase();
+  if (!live || live !== String(email ?? "").trim().toLowerCase()) return false;
+  return !identity.orgId || !org || identity.orgId === org;
+}

package/src/server/account-projects.mjs

@@ -15,17 +15,18 @@
 // accounts; only the message's own timestamp, matched against the swap log,
 // says who was active when it was billed. Each transcript line carries, in one
 // JSON object, its `timestamp`, its `message.model` and its `message.usage`
-// token counts, and its `cwd` — everything a row needs.
+// token counts, and its `cwd` — everything a row needs, once the `cwd` is taken
+// back to the folder the session started in (see sessionFolder).
 //
 // The scan is incremental: a byte cursor per transcript file means a pass folds
 // only the lines appended since the last one, so opening the report is a read
 // of a small on-disk tally rather than a walk of every transcript.
 import { open, stat, readdir, readFile, writeFile, mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join, resolve, basename, dirname } from "node:path";
+import { join, resolve, basename, dirname, relative } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { renameWithRetry } from "./installer.mjs";
-import { claudeConfigDir } from "./claude-dir.mjs";
+import { ccProjectSlug, claudeConfigDir } from "./claude-dir.mjs";
 import { accountKey } from "./lan-sync.mjs";
 import { readSwapLog, accountAtTime, trackedSince, seedActive, markGap } from "./swap-log.mjs";
 
@@ -34,7 +35,7 @@ import { readSwapLog, accountAtTime, trackedSince, seedActive, markGap } from ".
  *  a per-account total is never quietly inflated by work that is not that
  *  account's. A NUL keeps it from ever colliding with a real `email@@org` key. */
 export const UNATTRIBUTED = "\u0000unattributed";
-const STATE_VERSION = 2;
+const STATE_VERSION = 3;
 
 /** Where the tally and cursors live, beside cswap-auto's own state. */
 export function statePath(home = homedir()) {
@@ -113,6 +114,51 @@ function cwdFromSlug(slug) {
   return "/" + slug.replace(/^-+/, "").replace(/-/g, "/");
 }
 
+/**
+ * The folder a transcript line's session started in, recovered exactly from the
+ * line's own `cwd` and the slug of the project directory the transcript sits in.
+ *
+ * CC writes the shell's CURRENT directory on every line, so an agent that ran
+ * `cd src/web` stamps every later line with that subfolder. Keying the tally by
+ * it split one project into a row for every folder its agent passed through —
+ * 25 rows for one repo over a month (#1278). The folder CC files the transcript
+ * under, ~/.claude/projects/<slug>, is the one the session started in, and the
+ * canvas names a session after the same one. The slug cannot be decoded (a dash
+ * in a folder name reads as a separator), but it can be MATCHED: the start
+ * folder is the nearest ancestor of the line's cwd, the cwd itself included,
+ * that encodes to that slug.
+ *
+ * Null when none does: the agent left its folder (`cd ../elsewhere`), or the
+ * slug is CC's hashed long form of a path this cwd is not under.
+ */
+export function sessionFolder(cwd, slug) {
+  if (!cwd || !slug) return null;
+  for (let dir = cwd; ;) {
+    if (ccProjectSlug(dir) === slug) return dir;
+    const up = dirname(dir);
+    if (up === dir) return null;
+    dir = up;
+  }
+}
+
+/**
+ * Which folder a line counts under. `from` describes the transcript the line
+ * came from: `slug` is its project directory's name, and `folders` maps each
+ * slug to the start folder last recovered for it. The map is shared by every
+ * transcript of one project directory and persisted, so a line written after
+ * the agent left its folder still counts under that folder. Without a slug (a
+ * direct call, as the unit tests make) the line's own cwd is used unchanged.
+ */
+function folderOf(lineCwd, { slug = "", folders = null } = {}) {
+  const found = sessionFolder(lineCwd, slug);
+  if (found) {
+    if (folders) folders[slug] = found;
+    return found;
+  }
+  if (slug && folders?.[slug]) return folders[slug];
+  return lineCwd || cwdFromSlug(slug);
+}
+
 /**
  * The project a cwd belongs to. A git worktree lives at
  * `<repo>/.claude/worktrees/<name>`, so work done in one is counted under the
@@ -135,8 +181,9 @@ export function projectPath(cwd) {
  *
  * `timeline` is the sorted swap log; the account is whoever it says was active
  * at this line's timestamp, or UNATTRIBUTED when the timestamp precedes it.
+ * `from` names the transcript's project directory — see folderOf.
  */
-export function foldLine(tally, line, timeline, fallbackCwd) {
+export function foldLine(tally, line, timeline, from) {
   if (!line || !line.includes('"usage"')) return;
   let obj = null;
   try { obj = JSON.parse(line); } catch { return; }
@@ -151,8 +198,8 @@ export function foldLine(tally, line, timeline, fallbackCwd) {
   const c = countersFrom(usage);
   if (!(c.i || c.o || c.cr || c.cc)) return;   // a usage block that billed nothing
   const model = typeof obj?.message?.model === "string" ? obj.message.model : "";
-  const rawCwd = (typeof obj?.cwd === "string" && obj.cwd) ? obj.cwd : (fallbackCwd || "");
-  const cwd = projectPath(rawCwd);   // a worktree counts under the repo it checks out
+  const lineCwd = (typeof obj?.cwd === "string" && obj.cwd) ? obj.cwd : "";
+  const cwd = projectPath(folderOf(lineCwd, from));   // a worktree counts under the repo it checks out
   const who = accountAtTime(timeline, ts);
   const key = who ? accountKey(who.email, who.orgUuid) : UNATTRIBUTED;
   const day = localDay(ts);
@@ -187,19 +234,32 @@ async function foldAppended(fh, start, size, onLine) {
   return size - Buffer.byteLength(carry, "utf8");
 }
 
-/** Every `.jsonl` under the transcript roots, de-duplicated. */
+/** Every `.jsonl` under the transcript roots, de-duplicated, mapped to the
+ *  slug of the project directory it sits in: the first folder below the root,
+ *  also for a subagent's `<slug>/<session>/subagents/agent-*.jsonl`.
+ *
+ *  Shallowest first, so a session's own transcript, whose first line carries
+ *  the folder it started in, is folded before its subagents' and a subagent
+ *  that only ever worked outside that folder still finds it in `folders`. */
 async function listTranscripts(roots) {
-  const out = new Set();
+  const found = [];
+  const seen = new Set();
   for (const root of roots) {
     let ents = null;
     try { ents = await readdir(root, { recursive: true, withFileTypes: true }); }
     catch { continue; }
     for (const e of ents) {
       if (!e.isFile() || !e.name.endsWith(".jsonl")) continue;
-      out.add(join(e.parentPath ?? e.path ?? root, e.name));
+      const dir = e.parentPath ?? e.path ?? root;
+      const path = join(dir, e.name);
+      if (seen.has(path)) continue;
+      seen.add(path);
+      const parts = relative(root, dir).split(/[\\/]/).filter(Boolean);
+      found.push({ path, slug: parts[0] ?? "", depth: parts.length });
     }
   }
-  return [...out];
+  found.sort((a, b) => a.depth - b.depth);
+  return new Map(found.map(f => [f.path, f.slug]));
 }
 
 /** Drop day buckets older than the retention window and prune the empty
@@ -316,7 +376,7 @@ export function createProjectRollup({
   setInterval: setIv = setInterval,
   clearInterval: clearIv = clearInterval,
 } = {}) {
-  let state = { version: STATE_VERSION, cursors: {}, tally: {} };
+  let state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {} };
   let timer = null;
   let running = false;
   let dirty = false;
@@ -329,10 +389,14 @@ export function createProjectRollup({
       const disk = JSON.parse(await readFile(stateFile, "utf8"));
       if (disk && disk.version === STATE_VERSION && disk.tally && disk.cursors) {
         state = disk;
-      } else if (disk && disk.version === 1) {
-        // Version 1 counted every API content block. Keep the heartbeat so a
-        // restart gap remains fenced, but rebuild the tally from transcripts.
-        state = { version: STATE_VERSION, cursors: {}, tally: {}, lastAlive: disk.lastAlive };
+        state.folders ??= {};
+      } else if (disk && (disk.version === 1 || disk.version === 2)) {
+        // Version 1 counted every API content block; version 2 keyed each row
+        // by the line's own cwd, a row per folder the agent cd'd into (#1278).
+        // Neither tally can be re-keyed, since it no longer knows which
+        // transcript a count came from. Keep the heartbeat so a restart gap
+        // remains fenced, but rebuild the tally from transcripts.
+        state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, lastAlive: disk.lastAlive };
         dirty = true;
       }
     } catch { /* first run: empty state */ }
@@ -353,7 +417,7 @@ export function createProjectRollup({
     } catch { /* a failed persist just re-folds next time; cursors stay in memory */ }
   }
 
-  async function foldFile(path, timeline) {
+  async function foldFile(path, slug, timeline) {
     let st = null;
     try { st = await stat(path); } catch { return; }
     let offset = state.cursors[path] ?? 0;
@@ -364,11 +428,11 @@ export function createProjectRollup({
     // is the rare, safe side to err on.
     if (st.size < offset) { state.cursors[path] = st.size; dirty = true; return; }
     if (st.size <= offset) return;
-    const fallback = cwdFromSlug(basename(dirname(path)));
+    const from = { slug, folders: state.folders };
     let fh = null;
     try {
       fh = await open(path, "r");
-      const consumed = await foldAppended(fh, offset, st.size, (line) => foldLine(state.tally, line, timeline, fallback));
+      const consumed = await foldAppended(fh, offset, st.size, (line) => foldLine(state.tally, line, timeline, from));
       if (consumed > offset) { state.cursors[path] = consumed; dirty = true; }
     } catch { /* unreadable this pass; cursor unchanged, tried again next pass */ }
     finally { if (fh) await fh.close().catch(() => {}); }
@@ -391,10 +455,12 @@ export function createProjectRollup({
       await seedActive({ now, path: swapLog, root: storeRoot });   // anchor the current account, once, deduped
       const timeline = await readSwapLog(swapLog);
       const files = await listTranscripts(roots);
-      for (const path of files) await foldFile(path, timeline);
-      // Forget cursors for files that are gone, so the map cannot grow forever.
-      const alive = new Set(files);
-      for (const p of Object.keys(state.cursors)) if (!alive.has(p)) { delete state.cursors[p]; dirty = true; }
+      for (const [path, slug] of files) await foldFile(path, slug, timeline);
+      // Forget cursors for files that are gone, and the folders of project
+      // directories with no transcript left, so neither map grows forever.
+      for (const p of Object.keys(state.cursors)) if (!files.has(p)) { delete state.cursors[p]; dirty = true; }
+      const slugs = new Set(files.values());
+      for (const s of Object.keys(state.folders)) if (!slugs.has(s)) { delete state.folders[s]; dirty = true; }
       // Heartbeat: record that the deck was alive now, so a later boot can see
       // how long it was down. Cheap when nothing else changed — only bumped
       // (and so only persisted) once every HEARTBEAT_MS while idle.

package/src/server/claude-accounts.mjs

@@ -16,6 +16,7 @@
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { cswapBin, cswapVersion, installHint } from "./cswap-install.mjs";
 import { run, runDetached } from "./exec.mjs";
+import { storedCopyAlive } from "./account-health.mjs";
 // The CLI identity oracle, already written and already trusted by the account
 // admin routes. #721 needs the same answer, so it reuses the same function
 // rather than shelling out a second way to ask one question.
@@ -347,14 +348,39 @@ export function nextReadAt(row, matches, fetchedAtMs, isActive, now) {
  * for `--json` and keeps the verdicts. Still not awaited by anyone — the nudge
  * stays synchronous for its callers — and still one child at a time.
  */
-let _verdicts = { at: 0, byNum: {} };
+let _verdicts = { at: 0, byNum: {}, identities: {} };
 /** Stale after this, because a verdict that outlives its cause is worse than no
  *  verdict: "no credentials" under an account somebody has since signed into is
  *  a sentence that sends them to fix what is already fixed. */
 const VERDICT_TTL_MS = 10 * 60_000;
-/** One `cswap list --json` at a time. A collection can take a while on a cold
- *  network, and a nudge landing inside one must not start a second. */
-let _verdictInFlight = false;
+/** Run one `cswap list --json` at a time. A post-write question must start
+ * after any older collection has finished; routine readers can share the
+ * latest pending answer without starting another slow collection. */
+export function createVerdictQueue(collect) {
+  let pending = null;
+  return {
+    ask({ fresh = false } = {}) {
+      if (pending && !fresh) return pending;
+      const previous = pending;
+      // Start the first poll immediately: requestCollection promises the UI that
+      // its refresh has started before it returns. Only subsequent fresh polls
+      // wait for the earlier snapshot to finish.
+      let next;
+      if (previous) next = previous.then(collect, collect);
+      else {
+        try { next = Promise.resolve(collect()); }
+        catch (error) { next = Promise.reject(error); }
+      }
+      pending = next;
+      void next.then(
+        () => { if (pending === next) pending = null; },
+        () => { if (pending === next) pending = null; },
+      );
+      return next;
+    },
+    busy() { return pending !== null; },
+  };
+}
 
 /**
  * Ask claude-swap about one account RIGHT NOW, rather than reading the cache.
@@ -374,6 +400,20 @@ let _verdictInFlight = false;
 export async function verdictNow(email, org, { runner = run, bin = cswapBin } = {}) {
   const want = String(email ?? "").trim().toLowerCase();
   if (!want) return null;
+  const all = await verdictsNow({ runner, bin, fresh: true });
+  return all?.find(a => a.email === want && a.org === (org ?? ""))?.status ?? null;
+}
+
+/**
+ * Every account's verdict from ONE `cswap list --json`, as `{ email, org,
+ * status, active }` rows (email lower-cased, status null when claude-swap gave none),
+ * or null when the question could not be asked at all.
+ *
+ * For a caller holding several identities at once — a round that imported
+ * three logins asks once, not three times, since each ask is a full usage
+ * collection that can take a minute on a cold network.
+ */
+async function collectVerdicts({ runner, bin }) {
   try {
     const out = await runner(await bin(), ["list", "--json"], { timeout: VERDICT_TIMEOUT_MS });
     if (!out?.ok) return null;
@@ -381,20 +421,47 @@ export async function verdictNow(email, org, { runner = run, bin = cswapBin } =
     // The same freshly-read answer feeds the cache the panel draws from, since
     // it cost a subprocess either way.
     const byNum = readVerdicts(out.stdout);
-    if (Object.keys(byNum).length) _verdicts = { at: Date.now(), byNum };
+    const identities = {};
     for (const a of Array.isArray(d?.accounts) ? d.accounts : []) {
-      if (String(a?.email ?? "").trim().toLowerCase() !== want) continue;
-      if ((a?.organizationUuid ?? "") !== (org ?? "")) continue;
-      return typeof a?.usageStatus === "string" ? a.usageStatus : null;
+      if (Number.isInteger(a?.number) && typeof a?.email === "string" && a.email.trim()) {
+        identities[String(a.number)] = `${a.email.trim().toLowerCase()}@@${a.organizationUuid ?? ""}`;
+      }
     }
-    return null;
+    _verdicts = { at: Date.now(), byNum, identities };
+    return (Array.isArray(d?.accounts) ? d.accounts : []).map(a => ({
+      number: a?.number,
+      email: String(a?.email ?? "").trim().toLowerCase(),
+      org: a?.organizationUuid ?? "",
+      status: typeof a?.usageStatus === "string" ? a.usageStatus : null,
+      // For the account Claude Code is signed in as, claude-swap reads the
+      // LIVE credential, not the stored copy — so its verdict there is about
+      // the live login. See checkImports.
+      active: a?.active === true,
+    }));
   } catch { return null; }
 }
 
+const verdictQueue = createVerdictQueue(() => collectVerdicts({ runner: run, bin: cswapBin }));
+
+/** Routine readers share a collection; post-write callers wait for any older
+ * collection and start a new one, so they never inspect the pre-write store. */
+export function verdictsNow({ runner = run, bin = cswapBin, fresh = false } = {}) {
+  // Tests and callers supplying their own runner must receive their own answer.
+  if (runner !== run || bin !== cswapBin) return collectVerdicts({ runner, bin });
+  return verdictQueue.ask({ fresh });
+}
+
 /** claude-swap's verdict for a slot, or null when there is none fresh enough. */
-function verdictFor(num, now) {
-  if (now - _verdicts.at > VERDICT_TTL_MS) return null;
-  const v = _verdicts.byNum[String(num)];
+function verdictFor(num, now, email, org) {
+  return cachedVerdictFor(_verdicts, num, now, email, org);
+}
+
+/** Only attach a cached slot verdict to the identity it was collected for. */
+export function cachedVerdictFor(cache, num, now, email, org) {
+  if (now - cache.at > VERDICT_TTL_MS) return null;
+  const identity = `${String(email ?? "").trim().toLowerCase()}@@${org ?? ""}`;
+  if (cache.identities[String(num)] !== identity) return null;
+  const v = cache.byNum[String(num)];
   return typeof v === "string" && v !== "" ? v : null;
 }
 
@@ -439,22 +506,12 @@ function nudgeCollector(rows, slots, now, activeNum) {
     cswapBin().then(bin => runDetached(bin, ["auto", "--once", "--dry-run", "--json"])).catch(() => {});
     return;
   }
-  if (_verdictInFlight) return;
-  _verdictInFlight = true;
+  if (verdictQueue.busy()) return;
   // Fire-and-forget: this function is deliberately synchronous so callers never
   // wait on it, and resolving the binary is the only async part. `run` rather
   // than `runDetached` only so the output can be read; the caller is no more
   // aware of it than before.
-  cswapBin()
-    .then(bin => run(bin, ["list", "--json"], { timeout: VERDICT_TIMEOUT_MS }))
-    .then(out => {
-      const byNum = out?.ok ? readVerdicts(out.stdout) : {};
-      // Replaced whole rather than merged. A slot that has gone away must not
-      // keep the verdict it had when it was last seen.
-      if (Object.keys(byNum).length) _verdicts = { at: Date.now(), byNum };
-    })
-    .catch(() => {})
-    .finally(() => { _verdictInFlight = false; });
+  void verdictsNow();
 }
 
 /** Long enough for a cold collection over a slow network, short enough that a
@@ -637,6 +694,7 @@ async function readRoster(now, gen) {
         .filter(Boolean),
     ].filter(Boolean);
 
+    const collector = verdictFor(num, now, acct.email, acct.organizationUuid);
     accounts.push({
       num:      Number(num),
       email:    acct.email ?? null,
@@ -654,7 +712,7 @@ async function readRoster(now, gen) {
       // `stale-copy` row means the live session is fine while the copy in the
       // store is dead, and the copy is what a share would carry and what a
       // peer's copy would heal. So both kinds of trouble read as not alive.
-      alive:    trouble == null,
+      alive:    storedCopyAlive(trouble == null, collector),
       active:   String(seq.activeAccountNumber) === num,
       disabled: acct.disabled === true,
       lanes,
@@ -694,7 +752,7 @@ async function readRoster(now, gen) {
       // "no_credentials", "relogin_required", "keychain_unavailable", … It is
       // what turns "not collecting" into a sentence with a next step in it, and
       // it is null on every machine where the collector has not been asked yet.
-      collector: verdictFor(num, now),
+      collector,
     });
   }
 

package/src/server/claude-dir.mjs

@@ -211,3 +211,38 @@ export function hasClaudeInstalled({
   // inside ~/.claude — so the loop above cannot reach it there.
   return exists(path.join(home, ".claude.json"));
 }
+
+/** Longest slug CC will store verbatim. Anything longer is truncated here and
+ *  given a hash suffix, so two deep paths sharing a 200-character prefix still
+ *  get separate directories. */
+const CC_SLUG_MAX = 200;
+
+/** CC's hash of the *unencoded* path, used only for the truncation suffix:
+ *  the classic h*31 + c string hash, kept in a signed 32-bit int. */
+function ccPathHash(s) {
+  let h = 0;
+  for (let i = 0; i < s.length; i++) h = ((h << 5) - h + s.charCodeAt(i)) | 0;
+  return h;
+}
+
+/** Encode an absolute path the way CC stores it under
+ *  ~/.claude/projects/<slug>/, so a scan looks in the directory CC actually
+ *  wrote — index.mjs's auto-memory scan, and the Projects rollup reading a
+ *  transcript's folder back out of it (account-projects.mjs).
+ *
+ *  CC flattens *every* non-alphanumeric character to "-", not just the path
+ *  separators and the Windows drive colon this used to replace. Dots are the
+ *  ones that bite: a worktree under .claude/worktrees/, or any folder named
+ *  like my.app, produced a slug with a literal dot in it, the auto-memory
+ *  readdir missed, and the project's auto-memory files were quietly left out
+ *  of the context panel. Underscores and spaces were wrong the same way. */
+export function ccProjectSlug(cwd) {
+  if (!cwd) return "";
+  // resolve() gives the platform's own absolute form — "/Users/…" on
+  // macOS/Linux, "C:\Users\…" on Windows — and this class covers both, so the
+  // drive colon and the backslashes fall out of the general rule.
+  const abs = resolve(cwd);
+  const slug = abs.replace(/[^a-zA-Z0-9]/g, "-");
+  if (slug.length <= CC_SLUG_MAX) return slug;
+  return `${slug.slice(0, CC_SLUG_MAX)}-${Math.abs(ccPathHash(abs)).toString(36)}`;
+}