ccdeck 3.29.11 → 3.30.0

package/src/server/browser-watch-routes.mjs

@@ -0,0 +1,172 @@
+// The three routes Browser Watch answers on: the panel's read, the settings
+// write, and the dismissal of one episode.
+//
+// These lived in src/server/index.mjs between the usage routes. They own no
+// state of their own — the watch, its read cache and its log are
+// browser-watch.mjs's, and the stored settings, archive and dismissals are
+// browser-watch-store.mjs's — so what is here is the boundary: how a query or a
+// body is judged before either module sees it, and which of the two a route is
+// allowed to change. Both are still imported lazily and by the package-root URL
+// PINNED_MODULES loads, because the readers underneath reach for node:sqlite
+// and copy files, and none of that belongs on the way to a listening socket.
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { readBody, send } from "./http-io.mjs";
+
+// Resolved the way pinned-build.mjs resolves it, from a file in the same
+// directory, so every lazy import below is the URL the pin has already evaluated.
+const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+/**
+ * What a program drove in this machine's browsers while nobody was browsing.
+ *
+ * A GET, and deliberately not on the event stream. The answer costs a copy of a
+ * History database that a browser holds locked, so it is pulled when the panel
+ * is open and never on a timer — the same reasoning that keeps
+ * /api/system/processes off the clock, for the same kind of cost.
+ *
+ * `refresh=1` drops the read cache. Without it a profile whose History has not
+ * been written since the last look is answered from memory, which is the normal
+ * case and the reason this route is cheap enough to poll while the panel is up.
+ */
+/**
+ * Turning the watch on or off, and how it is tuned.
+ *
+ * A POST, unlike its GET twin, because it writes to disk and because switching
+ * the watch ON starts the deck keeping its own copy of what it sees — a record
+ * of pages the user visited, which is not something a page they have open gets
+ * to arrange for them. The router's own gate is what enforces that: every
+ * non-GET goes through isTrustedMutation and isAuthorizedMutation before it
+ * reaches a handler, which is exactly the pair a GET deliberately skips.
+ */
+export async function handleBrowserWatchSettings(req, res) {
+  const raw = await readBody(req, res).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
+
+  const { readStore, updateStore, normalise } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch-store.mjs")).href
+  );
+  const { invalidateBrowserWatchCache, noteWatchSetting } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
+  );
+  const store = await readStore();
+  // normalise() is the one place a value is judged, so a field this route has
+  // never heard of cannot arrive through it and a bad one falls back rather
+  // than reaching classify().
+  const settings = normalise({ ...store.settings, ...body });
+  // `dismissed` carried forward, and it has to be spelled: writeStore takes a
+  // whole state and writes exactly what it is handed, so a caller that omits
+  // this field ERASES it. Measured — changing the reaction wiped every
+  // dismissal, so every episode the reader had reviewed came straight back on
+  // the next poll, from a settings change that had nothing to do with them.
+  // Only the settings are this route's to change. `updateStore` re-reads inside
+  // the write queue, so a poll that landed between the read above and this line
+  // cannot have its archive thrown away by a settings change — which is what
+  // writing a whole state read seconds earlier used to do.
+  await updateStore(cur => ({ ...cur, settings }));
+  // The one line in the log that is somebody acting rather than the deck
+  // reading, which is exactly why it is worth its own entry.
+  if (settings.enabled !== store.settings.enabled) {
+    noteWatchSetting(settings.enabled ? "watch on — keeping its own copy" : "watch off — reading live only");
+  } else {
+    noteWatchSetting(`settings: quiet ${settings.quietMinutes}m, gap ${settings.gapMinutes}m`);
+  }
+  invalidateBrowserWatchCache();
+  return send(res, 200, { ok: true, settings });
+}
+
+/**
+ * Mark one episode as reviewed, so it leaves the Findings list and stays gone.
+ *
+ * A DISMISSAL AND NOT A DELETION, and the difference is the whole design. The
+ * panel rebuilds episodes from the browser's own history on every poll, so
+ * removing the archived row would be undone within ten seconds by the next read
+ * of the same visits. What is stored is that the reader has seen this one.
+ *
+ * The log file is untouched. It is the append-only record the panel promises —
+ * "every address is written in full so you can check it yourself" — and a list
+ * you can tidy is not the same thing as a record you can trust.
+ */
+export async function handleBrowserWatchDismiss(req, res) {
+  // No gate of its own: the router runs isTrustedMutation and
+  // isAuthorizedMutation on every non-GET before a handler sees it, which is
+  // the pair its GET twin deliberately skips. A second check here would be a
+  // second thing to keep correct.
+  const raw = await readBody(req, res).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  const host = typeof body?.host === "string" ? body.host : null;
+  const startMs = typeof body?.startMs === "number" && Number.isFinite(body.startMs) ? body.startMs : null;
+  if (host === null || startMs === null) return send(res, 400, { ok: false, reason: "bad_request" });
+
+  const { readStore, updateStore, episodeKey } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch-store.mjs")).href
+  );
+  const { invalidateBrowserWatchCache, noteWatchSetting } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
+  );
+  // COMPUTED INSIDE THE JOB, like the settings route four lines up, whose
+  // comment says why: "updateStore re-reads inside the write queue, so a poll
+  // that landed between the read above and this line cannot have its archive
+  // thrown away." This read the whole `dismissed` array before the queue, so
+  // two Dismiss presses in one turn both read before either job ran and the
+  // second wrote an array without the first key — both rows left the list,
+  // both answered 200, and the first came back on the next ten-second poll.
+  const key = episodeKey(host, startMs);
+  await updateStore(cur => ({
+    ...cur,
+    dismissed: [...new Set([...(cur.dismissed ?? []), key])],
+  }));
+  // The reader acting on their own list, which is exactly the kind of line the
+  // `act` level exists for.
+  noteWatchSetting(`dismissed ${host}`);
+  invalidateBrowserWatchCache();
+  return send(res, 200, { ok: true });
+}
+
+export async function handleBrowserWatch(req, res) {
+  const url = new URL(req.url, "http://localhost");
+  const force = url.searchParams.get("refresh") === "1";
+  // `live=0` is the badge's five-minute poll saying "the archive is enough".
+  // With the watch OFF that is honoured and no browser is read at all — see
+  // browserWatchSnapshot: the switch used to gate only what was KEPT, so a deck
+  // nobody had switched on still copied every History database every five
+  // minutes. A forced read overrides it, because that is the user pressing ↻.
+  const readBrowsers = force || url.searchParams.get("live") !== "0";
+
+  // Numbers from a query string are refused rather than coerced: NaN would
+  // silently widen the quiet gate to "everything counts", which is the failure
+  // mode that turns this panel into noise nobody reads.
+  const minutes = name => {
+    const raw = url.searchParams.get(name);
+    if (raw === null) return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n > 0 && n <= 24 * 60 ? n * 60_000 : undefined;
+  };
+
+  // Lazily, like every other handler here, and it earns it twice: the four
+  // readers underneath reach for node:sqlite and copy files, and none of that
+  // belongs on the path between `npx ccdeck` and a listening socket.
+  //
+  // Through fetchBrowserWatch rather than the snapshot directly, because
+  // `refresh=1` drops the mtime cache and copies every profile's History
+  // database. That module carries the floor and the inflight slot which bound
+  // what a page looping this GET can spend.
+  const { deckOwnOrigins, fetchBrowserWatch, registeredDeckPorts } = await import(
+    pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
+  );
+  // The registered ports as well as the documented range: a deck started with
+  // an explicit `--port` outside 4317-4400 opens its own tab like any other,
+  // and the panel used to report it to its owner as a program driving the
+  // browser. Which it was — and the program was ccdeck.
+  const ports = await registeredDeckPorts();
+  return send(res, 200, await fetchBrowserWatch({
+    force,
+    readBrowsers,
+    deckOrigins: deckOwnOrigins(undefined, ports),
+    quietMs: minutes("quiet"),
+    gapMs: minutes("gap"),
+  }));
+}

package/src/server/browser-watch-seen.mjs

@@ -0,0 +1,127 @@
+// What one browser profile has contributed to Browser Watch since the deck
+// started, and how a read is folded into it.
+//
+// Since #989 a read of a profile's History returns only what is newer than the
+// read before it, so there is no whole answer left to keep a copy of: each real
+// read is folded into one accumulator per profile by `absorb`, and every poll —
+// cached, degraded or real — answers from what has built up. The snapshot in
+// browser-watch.mjs holds those accumulators (`_lastRead`) and decides when to
+// fold. This module is the fold, and it is pure: the rows and the gate in, the
+// accumulator changed in place, nothing read or written anywhere else.
+//
+// browser-watch.mjs re-exports both names, which is where the tests that check
+// what is held between polls (#989, #1131) import them from.
+import { classify, isProgramNavigation } from "./agent-activity.mjs";
+
+/** What a profile has contributed before its first read. */
+export function nothingSeen() {
+  return {
+    /** The oldest and newest visit times seen, and the newest a PERSON made. */
+    oldest: null,
+    newest: null,
+    human: null,
+    /** How many of those visits Chrome marked as coming from an API. */
+    byProgram: 0,
+    /**
+     * Findings whose verdict can no longer change, and those that still can.
+     *
+     * THE QUIET GATE IS WHY THIS IS TWO LISTS. `classify` reports a program
+     * navigation only when no HUMAN visit falls within `quietMs` of it, on
+     * either side, so a verdict depends on visits that may arrive in a later
+     * read. Classifying each read's rows on their own is a different
+     * computation, and wrong in the direction that matters: the person's visits
+     * from the read before would be missing from the gate, and a program page
+     * opened while they sat at the browser would be reported.
+     *
+     * What saves it is that the question SETTLES. Only a human visit less than
+     * `quietMs` from a candidate can silence it, and every later read returns
+     * visits newer than `newest`, so once `newest` is `quietMs` past a candidate
+     * nothing still to come can change its answer. Verdicts up to `settledTo`
+     * are final and kept; the ones after it are recomputed on every read from
+     * `window`, the same computation the whole-history classify was.
+     */
+    settled: [],
+    open: [],
+    settledTo: -Infinity,
+    /**
+     * The only raw visits this module keeps between polls: every visit newer
+     * than `settledTo`, and the TIME of the newest visit a person made at or
+     * before it. Bounded by the clock, where the cache before #989 held every
+     * visit since the deck booted.
+     *
+     * NOT PRUNED BY THE GATE IN FORCE, SINCE #1131. It was everything newer
+     * than `settledTo - quietMs`, which is what that gate needs and less than a
+     * longer one does. With the gate lengthened from 15 minutes to 60, the
+     * person's visit forty minutes before a program page had already been
+     * dropped, and the next poll reported two pages that `classify` over the
+     * same rows under the 60-minute gate reports none of.
+     *
+     * Every verdict still open is newer than `settledTo`, so of the visits a
+     * person made at or before that line the newest is the nearest to every one
+     * of them, and the rest can never decide anything, under any gate: the hour
+     * the panel offers, or the day `normalise` accepts from a hand edit. Kept,
+     * that one visit makes the evidence complete whatever the gate is changed
+     * to. It is kept as a time and nothing else, because the gate asks when a
+     * person was at the browser and never where. What is held comes to one gate
+     * of browsing and one timestamp, where it was two gates of addresses.
+     */
+    window: [],
+    /** The gate the open verdicts were last judged under, so a changed one is
+     *  applied on the next poll whether or not that poll read anything. */
+    judgedUnder: null,
+  };
+}
+
+/** Fold one real read's rows into what the profile has contributed, and judge
+ *  again whatever is still open. Mutates `seen`, which is the object `_lastRead`
+ *  holds. Exported for tests, with `nothingSeen`: what is held between polls
+ *  is the question #989 was about, and a snapshot cannot see it. */
+export function absorb(seen, rows, { quietMs, classifyOpts, browser }) {
+  // NOTHING NEW UNDER THE SAME GATE IS NOTHING TO DO. A gate that has changed
+  // since the open verdicts were judged is applied with no new rows at all
+  // (#1131): the settings route drops the cache, the read after it finds the
+  // file as it was and returns nothing, and returning here on that left a
+  // lengthened gate unapplied until the browser next wrote — the panel still
+  // listing a page the new gate hides.
+  if (rows.length === 0 && (seen.newest === null || seen.judgedUnder === quietMs)) return;
+  for (const row of rows) {
+    if (seen.oldest === null || row.timeMs < seen.oldest) seen.oldest = row.timeMs;
+    if (seen.newest === null || row.timeMs > seen.newest) seen.newest = row.timeMs;
+    // PAGES A PROGRAM OPENED, which is not the same as findings. A finding also
+    // has to clear the quiet gate; this is every navigation Chrome marked as
+    // coming from an API, whether or not anybody was at the keyboard. It is the
+    // figure the overview shows, because a panel about what programs did should
+    // count what programs did — the total row count it showed before was, on a
+    // measured profile, 78% the reader's own browsing.
+    if (isProgramNavigation(row.transition)) seen.byProgram += 1;
+    else if (seen.human === null || row.timeMs > seen.human) seen.human = row.timeMs;
+  }
+  // The visits still in play from earlier reads, then this read's.
+  const evidence = seen.window.concat(rows);
+  // MONOTONIC, so a quiet gate the reader has just lengthened cannot move the
+  // line back and re-open a verdict already kept, which would list that finding
+  // twice: once settled and once open.
+  const settleTo = Math.max(seen.settledTo, seen.newest - quietMs);
+  const verdicts = classify(evidence, classifyOpts)
+    // Tagged with the browser they came from, which is the one thing a reaction
+    // cannot work out for itself: closing a tab means telling ONE application
+    // to close it, and a finding that has forgotten which browser it was in can
+    // only be guessed at.
+    .map(f => ({ ...f, browser }));
+  for (const f of verdicts) {
+    if (f.timeMs > seen.settledTo && f.timeMs <= settleTo) seen.settled.push(f);
+  }
+  seen.open = verdicts.filter(f => f.timeMs > settleTo);
+  seen.settledTo = settleTo;
+  seen.judgedUnder = quietMs;
+  // Everything newer than the line, and of what a person did at or before it
+  // only the newest, as a time: `window` in `nothingSeen` says why that one
+  // visit is all any gate can ask for.
+  let person = null;
+  for (const r of evidence) {
+    if (r.timeMs > settleTo || isProgramNavigation(r.transition)) continue;
+    if (person === null || r.timeMs > person) person = r.timeMs;
+  }
+  seen.window = evidence.filter(r => r.timeMs > settleTo);
+  if (person !== null) seen.window.unshift({ url: "", timeMs: person, transition: 0 });
+}

package/src/server/browser-watch-store.mjs

@@ -25,14 +25,14 @@
 // then let the next ten-second poll write that emptiness over it. A file that
 // cannot be parsed is now moved aside and said out loud; only a genuinely
 // ABSENT file starts clean. See loadStore.
-import { appendFile, mkdir, open, readFile, stat, unlink } from "node:fs/promises";
-// The rename, with the Windows retry ladder installer.mjs wrote for exactly
+import { mkdir, open, readFile, unlink } from "node:fs/promises";
+// The rename, with the Windows retry ladder atomic-write.mjs keeps for exactly
 // this call. See the note over `writeNow` (#786). `stripBom` comes from the same
 // module for the reason its export block gives: a rule spelled twice is a rule
 // that drifts, and "a BOM is not damage" has to mean the same thing here as it
 // does on settings.json, or a state.json somebody opened in Notepad gets
 // quarantined for a mark the settings reader has ignored since it was written.
-import { renameWithRetry, stripBom } from "./installer.mjs";
+import { renameWithRetry, stripBom } from "./atomic-write.mjs";
 import { join } from "node:path";
 import { claudeConfigDir } from "./claude-dir.mjs";
 import { PRODUCT } from "./brand.mjs";
@@ -85,141 +85,6 @@ export const storePath = (home = claudeConfigDir()) => join(storeDir(home), "sta
 export const quarantinePath = (home = claudeConfigDir(), at = Date.now()) =>
   `${storePath(home)}.corrupt-${at}`;
 
-/** The plain-text log, which is the one file here a person opens themselves.
- *  state.json is the deck's own record and is JSON because the deck reads it
- *  back; this is the same events in the shape `tail -f` wants. */
-export const logPath = (home = claudeConfigDir()) => join(storeDir(home), "watch.log");
-
-/** The one generation kept behind it. `.1` rather than a datestamp because this
- *  is `tail -f`'s file and `logrotate`'s convention is the one a person reading
- *  it already knows — and because a name that changes is a name nothing can
- *  overwrite, which is how a rotation that bounds nothing gets written. */
-export const rolledLogPath = (home = claudeConfigDir()) => `${logPath(home)}.1`;
-
-/**
- * How large watch.log may grow before it is rolled over (#989).
- *
- * EVERY OTHER STORE IN THIS MODULE HAS A CAP. `KEEP` holds the archive to 500
- * episodes, `DISMISS_KEEP` holds dismissals to 2000, and the panel's feed is
- * held to 200 lines — while this file, the one that writes out EVERY ADDRESS in
- * full, grew for the life of the install and nothing ever trimmed it. With the
- * watch on by default, a machine where something drives a browser in a loop
- * builds a plaintext list of every address it touched, without end.
- *
- * TWO MEBIBYTES. An episode of twenty addresses with query strings is about
- * 2 KB of this file, so the cap is on the order of a thousand episodes: twice
- * the archive beside it, which `KEEP` sizes at about two years of the measured
- * rate. It is only reached where something drives a browser far more often than
- * that, and that machine must not fill its disk reporting it.
- *
- * ONE GENERATION, `watch.log.1`, so the most this costs on disk is a number a
- * reader can state: twice the cap, plus one append that was larger on its own.
- */
-const LOG_MAX_BYTES = 2 * 1024 * 1024;
-
-/**
- * What the log holds on disk right now, both generations, in bytes — for the
- * panel, which names the file and now its size. Never throws: 0 is the answer
- * for a log never written, and a coverage field is not where a stat error goes.
- */
-export async function logSize(home = claudeConfigDir(), deps = {}) {
-  const st = deps.stat ?? stat;
-  let total = 0;
-  for (const file of [logPath(home), rolledLogPath(home)]) {
-    try { total += (await st(file)).size; } catch { /* not there, or not readable */ }
-  }
-  return total;
-}
-
-/**
- * Append one episode, and EVERY ADDRESS IN IT, oldest first.
- *
- * THE URLs ARE THE POINT OF THE FILE. A summary line — host, count, duration —
- * says something happened and leaves the reader unable to act on it: the
- * question three days later is not "did a program touch gitlab" but "WHICH
- * pages", because a jobs list and a settings page mean different things. So
- * every address is written in full, unshortened and unescaped, exactly as
- * Chrome recorded it.
- *
- * Query strings and fragments included. They are frequently the whole content
- * of the visit — `?scope=all`, `#servicii` — and a log that dropped them would
- * be tidier and useless for the one job it has.
- *
- * Indented under their episode so the shape survives `grep`: a summary line
- * starts at column zero, a URL line does not, which is what lets
- * `grep -v '^ '` give the summary alone and `grep '^  '` give the addresses.
- *
- * Append-only and never rewritten: a log a program edits is not a log. It is
- * the only part of this feature that outlives the process by design — the panel
- * shows what this deck has seen, this file is what somebody reads three days
- * later without opening the panel at all.
- *
- * ROLLED OVER, NOT EDITED, at LOG_MAX_BYTES (#989), which keeps that rule: the
- * whole file moves to `watch.log.1` and the next append starts a new one. No
- * line this function wrote is ever changed. Trimming the oldest lines out in
- * place was the other way to bound it, and it is the edit the rule forbids.
- */
-export async function appendLog(episodes, home = claudeConfigDir(), deps = {}) {
-  if (!episodes.length) return;
-  const mk = deps.mkdir ?? mkdir;
-  const add = deps.appendFile ?? appendFile;
-  // Local time, not UTC. The reader's question is "what was happening at four
-  // yesterday afternoon", and their afternoon is not UTC's — the ISO stamp this
-  // replaced was off by the offset for everyone outside London.
-  const stamp = ms => {
-    const d = new Date(ms);
-    const p = n => String(n).padStart(2, "0");
-    return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} `
-         + `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
-  };
-  const block = e => {
-    const span = e.endMs - e.startMs >= 60_000
-      ? ` over ${Math.round((e.endMs - e.startMs) / 60_000)}m`
-      : "";
-    const where = e.browser ? ` [${e.browser}]` : "";
-    const head = `${stamp(e.startMs)}  ${e.host}  ${e.count} page${e.count === 1 ? "" : "s"}${span}${where}`;
-    const rows = (e.urls ?? []).map(u => `    ${stamp(u.timeMs).slice(11)}  ${u.url}`);
-    return [head, ...rows].join("\n");
-  };
-  await mk(storeDir(home), { recursive: true });
-  const text = episodes.map(block).join("\n") + "\n";
-  await rollIfFull(home, Buffer.byteLength(text, "utf8"), deps);
-  await add(logPath(home), text, "utf8");
-}
-
-/**
- * Move the log aside when this append would carry it past the cap.
- *
- * MEASURED BEFORE THE WRITE, so the cap is a ceiling rather than a line the file
- * sits above until the next append. The one overshoot left is a single append
- * larger than the whole cap, written whole on purpose: an episode split across
- * two files would leave addresses under no summary line, and that line and its
- * indented addresses are what `grep -v '^ '` and `grep '^  '` separate.
- *
- * A ROTATION THAT FAILS MUST NOT COST THE APPEND. This is the record of what a
- * program did in somebody's browser. A full disk, a Windows handle still open on
- * `watch.log.1`, a permission on the directory: each is a reason to write a
- * larger file than intended, and none is a reason to write nothing. The next
- * append tries again.
- *
- * `renameWithRetry` for the reason #786 gives over `writeNow`: on Windows a
- * rename loses to anything still holding a handle, and this is a file people
- * open to read.
- */
-async function rollIfFull(home, adding, deps) {
-  const st = deps.stat ?? stat;
-  const mv = deps.rename ?? renameWithRetry;
-  try {
-    const { size } = await st(logPath(home));
-    if (size === 0 || size + adding <= LOG_MAX_BYTES) return;
-    await mv(logPath(home), rolledLogPath(home));
-  } catch {
-    // No log yet (the ordinary first call), or the filesystem refused. Either
-    // way the append is the thing that matters and it is not this function's to
-    // cancel.
-  }
-}
-
 /**
  * Settings as they will be used, whatever the file said.
  *
@@ -269,17 +134,23 @@ function archivable(e) {
 
 /** Two episodes are the same one when they start at the same moment on the same
  *  host. Not the count or the end, both of which grow while a program is still
- *  working — keyed on those, one run would archive itself a dozen times. */
+ *  working — keyed on those, one run would archive itself a dozen times.
+ *
+ *  From the two fields rather than from an episode, and exported, because the
+ *  route that dismisses an episode is handed a host and a start, not an
+ *  episode. */
 // Separated by an escaped NUL rather than a space: a host cannot contain one,
 // so no two different episodes can collide on the joined string. Written as an
 // ESCAPE and never as the raw byte — source-nul-bytes.test.ts exists because a
 // raw NUL makes grep skip the whole file without ever saying so.
-const keyOf = e => `${e.host}\u0000${e.startMs}`;
-
-/** The same key, from the two fields a caller has. Exported because the route
- *  that dismisses an episode is handed a host and a start, not an episode. */
 export const episodeKey = (host, startMs) => `${host}\u0000${startMs}`;
 
+/** The same key, for an episode in hand. It spells nothing itself: the merge,
+ *  the dismissal filter and the route that stores a dismissal all end in
+ *  `episodeKey`, so the key a dismissal is saved under and the key it is
+ *  compared against cannot drift apart. */
+const keyOf = e => episodeKey(e.host, e.startMs);
+
 /** How many dismissals are remembered. A dismissal is a few dozen bytes and
  *  the archive it filters is capped at 500, so this is generous — but it is
  *  capped all the same, because a set that only grows is a file that only