ccdeck 3.32.1 → 3.33.0

package/src/server/npx.mjs

@@ -37,8 +37,9 @@ import { killTree, shimPath, spawnSpec } from "./exec.mjs";
 
 /**
  * Where npm's own `npx-cli.js` sits relative to the running Node binary, most
- * likely first. Pure: the platform and the executable path are parameters, so
- * the Windows layout can be checked from any OS.
+ * likely first — or `npm-cli.js`, which `cli` names for npmCliLaunch below.
+ * Pure: the platform and the executable path are parameters, so the Windows
+ * layout can be checked from any OS.
  *
  * Windows keeps npm beside node.exe (`C:\Program Files\nodejs\node_modules\npm`,
  * and the same shape under nvm-windows). POSIX puts it in a `lib` next to the
@@ -55,20 +56,46 @@ import { killTree, shimPath, spawnSpec } from "./exec.mjs";
  * platform running the SUITE, so a Windows layout checked from macOS would come
  * back with forward slashes and a `..` nothing resolves.
  */
-export function npxCliCandidates(execPath = process.execPath, platform = process.platform) {
+export function npxCliCandidates(execPath = process.execPath, platform = process.platform, cli = "npx-cli.js") {
   if (typeof execPath !== "string" || !execPath) return [];
   const sep = platform === "win32" ? "\\" : "/";
   const dir = execPath.split(/[\\/]/);
   dir.pop(); // the binary itself
   if (!dir.length) return [];
-  const beside = [...dir, "node_modules", "npm", "bin", "npx-cli.js"].join(sep);
+  const beside = [...dir, "node_modules", "npm", "bin", cli].join(sep);
   const above = [];
   for (let up = 1; up <= 4 && dir.length - up > 0; up++) {
-    above.push([...dir.slice(0, -up), "lib", "node_modules", "npm", "bin", "npx-cli.js"].join(sep));
+    above.push([...dir.slice(0, -up), "lib", "node_modules", "npm", "bin", cli].join(sep));
   }
   return platform === "win32" ? [beside, ...above] : [...above, beside];
 }
 
+/**
+ * `npm <args>` through the `npm-cli.js` beside the running Node, or null when
+ * there is none — the caller then falls back to the name it always used.
+ *
+ * npxLaunch's rule for npx, and the reason is the same one: nothing here reads
+ * PATH. A deck started at login runs with the service manager's PATH, which on
+ * a Homebrew, nvm, fnm or Volta install does not name the directory npm is in,
+ * so a bare `npm` was `spawn npm ENOENT` for the in-app update and the managed
+ * ccusage install alike (#1777). This is also the npm that goes with the node
+ * the deck is running on, rather than whichever one PATH meets first.
+ *
+ * For POSIX callers. Windows already reaches npm by the shim's full path.
+ */
+export function npmCliLaunch(args, {
+  platform = process.platform,
+  execPath = process.execPath,
+  exists = existsSync,
+} = {}) {
+  for (const cli of npxCliCandidates(execPath, platform, "npm-cli.js")) {
+    let found = false;
+    try { found = exists(cli); } catch { found = false; }
+    if (found) return { file: execPath, args: [cli, ...args], opts: {} };
+  }
+  return null;
+}
+
 /**
  * What to hand `spawn` to run `npx <args>`.
  *

package/src/server/process-list.mjs

@@ -4,10 +4,12 @@
 // Moved out of system-metrics.mjs unchanged, because it is the one reading there
 // that never rides the sampler's timers. It is read on demand only — while the
 // process dialog is open — keeps its own one-child-at-a-time guard and its own
-// Windows CPU baseline (#544), and shares nothing with the ambient readings but
-// the command runner. system-metrics.mjs re-exports readProcesses, which is where
-// index.mjs asks for it, and its stopSystemMetrics calls resetProcessList so a
-// reset still clears this list along with everything else.
+// CPU baseline (Windows since #544, Linux since #1769), and shares nothing with
+// the ambient readings but the command runner. system-metrics.mjs re-exports
+// readProcesses, which is where index.mjs asks for it, and its stopSystemMetrics
+// calls resetProcessList so a reset still clears this list along with everything
+// else.
+import { readFile } from "node:fs/promises";
 import os from "node:os";
 import { run } from "./metrics-run.mjs";
 // What of a command line may leave this module: see process-command.mjs.
@@ -69,7 +71,14 @@ export function pickCandidates(rows, limit = CANDIDATE_N) {
  * over time is normally caught in `S`. Nothing errored and nothing was empty,
  * which is why it survived two releases (#492).
  *
- * `--sort=-pcpu` is procps' own way to say what `-r` says on BSD. The column
+ * `--sort=-pcpu` is NOT procps' way to say what `-r` says on BSD, which is what
+ * this comment used to claim. procps defines `%cpu` as CPU time over the
+ * process's whole lifetime, so a process that idled for hours and is pinning a
+ * core now reads a few percent, and one that was busy at start-up keeps its
+ * figure long after it stopped (#1769). The sort stays because it costs `ps`
+ * nothing and orders the text sensibly for anyone reading it, but the Linux
+ * column is not this one any more: readProcessesNow replaces it with a rate
+ * taken from /proc/<pid>/stat between two readings (linuxCpuSec). The column
  * order is deliberately identical on both so one parser reads both, and `comm`
  * stays last so a name containing a space survives intact.
  *
@@ -203,7 +212,9 @@ export { CMD_MAX, commandTail, redactCommand };
  *
  * `pcpu` is a percentage of ONE core on both, so a multi-threaded process runs
  * past 100 and that is information rather than an error: 157 is one and a half
- * cores. cpuFromDeltas puts the Windows column on this same scale.
+ * cores. cpuFromDeltas puts the Windows and Linux columns on this same scale —
+ * on Linux the figure parsed here is a lifetime average and is replaced before
+ * it leaves this module (see psArgs).
  *
  * There is no row limit in the query because neither `ps` has one and `run`
  * deliberately never inherits a shell, so there is no `| head` to pipe into.
@@ -376,8 +387,60 @@ export function cpuFromDeltas(rows, prev, elapsedMs, limit = Infinity) {
   return out.slice(0, limit);
 }
 
-/** Previous Windows reading, so the next one can be a rate. Cleared with the
- *  rest of the sampler state — see resetProcessList. */
+/**
+ * Cumulative CPU seconds out of one `/proc/<pid>/stat` line, or null.
+ *
+ * utime and stime are fields 14 and 15, in USER_HZ ticks. The name in field 2
+ * is the one field that can hold anything — spaces, parentheses — so the count
+ * starts after the LAST `)` rather than at a split on spaces: `(tmux: server)`
+ * would otherwise shift every field after it.
+ *
+ * USER_HZ is the kernel's fixed unit for these files, not the scheduler's tick
+ * rate, and it is 100 on every architecture Node runs on; Node has no sysconf to
+ * ask, and a `getconf CLK_TCK` child per poll to confirm a constant would cost
+ * more than the reading it serves.
+ */
+const USER_HZ = 100;
+export function cpuSecFromProcStat(text) {
+  const s = String(text ?? "");
+  const close = s.lastIndexOf(")");
+  if (close < 0) return null;
+  // Field 3 (the state) is the first after the name, so field N is at N - 3.
+  const f = s.slice(close + 1).trim().split(/\s+/);
+  const utime = Number(f[11]), stime = Number(f[12]);
+  if (f.length < 13 || !Number.isFinite(utime) || !Number.isFinite(stime)) return null;
+  return (utime + stime) / USER_HZ;
+}
+
+/**
+ * The CPU seconds each Linux row has used so far, for cpuFromDeltas to turn
+ * into a rate the way it already does for Windows (#1769).
+ *
+ * One file read per process, and no child: this is the same file `ps` itself
+ * read a moment ago to print the lifetime figure, so the cost is a few hundred
+ * small reads of a pseudo-filesystem once every four seconds, only while the
+ * process dialog is open. Reads run together rather than one after another.
+ *
+ * A read that fails — the process exited between `ps` and here, or /proc hides
+ * other users' processes — leaves `cpuSec` null, which cpuFromDeltas reports as
+ * an unknown CPU rather than as an idle one. `deps.readFile` is the seam the
+ * suite uses, so no test depends on the machine's real process table.
+ */
+async function linuxCpuSec(rows, deps = {}) {
+  const file = deps.readFile ?? readFile;
+  const secs = await Promise.all(rows.map(r =>
+    Promise.resolve()
+      .then(() => file(`/proc/${r.pid}/stat`, "utf8"))
+      .then(cpuSecFromProcStat, () => null)));
+  return rows.map((r, i) => {
+    const { cpu: _lifetime, ...rest } = r;
+    return { ...rest, cpuSec: secs[i] };
+  });
+}
+
+/** The previous reading's CPU seconds per pid, on the two platforms whose
+ *  column is a rate derived here (Windows and Linux), so the next reading can
+ *  be one. Cleared with the rest of the sampler state — see resetProcessList. */
 let prevProcCpu = null;
 let prevProcAt = 0;
 
@@ -416,7 +479,7 @@ const PROC_MIN_GAP_MS = 1_500;
  * that arrive while a run is going share its promise; callers that arrive just
  * after one finished are served that reading.
  */
-export async function readProcesses(platform = process.platform, detail = false) {
+export async function readProcesses(platform = process.platform, detail = false, deps = {}) {
   const now = Date.now();
   // A cached reading serves a caller that wants LESS than it holds, never one
   // that wants more: the panel is happy with a detailed reading, and the modal
@@ -431,7 +494,7 @@ export async function readProcesses(platform = process.platform, detail = false)
   // instead. The in-flight share still applies, so a burst arriving during a
   // failing read is one failing child, not a burst of them.
   procInFlightDetail = detail;
-  procInFlight = readProcessesNow(platform, detail)
+  procInFlight = readProcessesNow(platform, detail, deps)
     .then(read => {
       if (read.procs.length) procLast = { at: Date.now(), read, detail };
       return read;
@@ -440,6 +503,22 @@ export async function readProcesses(platform = process.platform, detail = false)
   return procInFlight;
 }
 
+/**
+ * What /api/system/processes answers for one reading.
+ *
+ * An empty reading is a failed one, by the rule readProcesses already keeps: no
+ * machine has nothing running on it, and every failure inside the reader — a
+ * spawn that never started, a non-zero exit, the deadline — resolves to an
+ * empty list. It went out as `{ ok: true, procs: [] }`, which is a claim that
+ * the machine was read and found empty, and the dialog believed it: one slow
+ * `ps` swapped a working table for a sentence blaming the platform (#1770).
+ * So a failure says it is one, and the dialog keeps what it was showing.
+ */
+export function processesReply(read) {
+  if (!read?.procs?.length) return { ok: false, reason: "read_failed" };
+  return { ok: true, ...read };
+}
+
 /**
  * The one-liner the Windows process list is read with.
  *
@@ -465,7 +544,7 @@ export async function readProcesses(platform = process.platform, detail = false)
 export const WIN_PROCESS_PS =
   "Get-Process | Select-Object Id,ProcessName,CPU,@{n='Threads';e={$_.Threads.Count}},@{n='StartedAt';e={if($_.StartTime){[int]((Get-Date)-$_.StartTime).TotalSeconds}else{$null}}},@{n='WorkingSet';e={$_.WorkingSet64}},@{n='WorkingSetPrivate';e={$_.PrivateMemorySize64}} | ConvertTo-Json -Compress";
 
-async function readProcessesNow(platform, detail = false) {
+async function readProcessesNow(platform, detail = false, deps = {}) {
   if (platform === "win32") {
     const out = await run("powershell.exe", [
       "-NoProfile", "-NonInteractive", "-Command", WIN_PROCESS_PS,
@@ -487,7 +566,18 @@ async function readProcessesNow(platform, detail = false) {
   }
   const out = await run("ps", psArgs(platform), 4_000);
   if (!out) return { procs: [], total: 0 };
-  const all = parsePsProcesses(out);
+  let all = parsePsProcesses(out);
+  if (platform === "linux") {
+    // procps' %cpu is a lifetime average (see psArgs), so the Linux column is
+    // derived here from two readings of the kernel's own counters, exactly as
+    // the Windows one is from two Get-Process readings: null on the first,
+    // then the share of one core used since the one before.
+    const rows = await linuxCpuSec(all, deps);
+    const now = Date.now();
+    all = cpuFromDeltas(rows, prevProcCpu, now - prevProcAt);
+    prevProcCpu = new Map(rows.filter(r => r.cpuSec != null).map(r => [r.pid, r.cpuSec]));
+    prevProcAt = now;
+  }
   const procs = pickCandidates(all);
   if (detail) await attachDetail(procs, platform);
   return { procs, total: all.length };
@@ -534,7 +624,7 @@ async function attachDetail(procs, platform) {
 }
 
 /**
- * Forget the Windows baseline and the last list, for stopSystemMetrics.
+ * Forget the CPU baseline and the last list, for stopSystemMetrics.
  *
  * The last list goes with the baseline it was computed against. A sampler that
  * stopped and started again must not answer the first caller with a reading

package/src/server/purge-key.mjs

@@ -28,7 +28,7 @@
 // strip the field: a partial rewrite of the file that holds the pairings is a
 // worse thing to get wrong than an unlink, and after an uninstall there is
 // nothing left the rest of the file is for.
-import { readFile, rm } from "node:fs/promises";
+import { readdir, readFile, rm } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { deckDataDir, legacyDeckDir } from "./deck-home.mjs";
@@ -38,6 +38,23 @@ import { stripBom } from "./atomic-write.mjs";
  *  two must not drift — see `prefsPath`, which is the same join. */
 export const KEY_FILE = "prefs.json";
 
+/**
+ * The other names a copy of that file can have in the same folder, and every
+ * one of them can hold the key.
+ *
+ *   `.corrupt-<ms>` and `.foreign-<ms>` are prefs-set-aside.mjs's: a file the
+ *   deck could not parse, or one another user owns, is moved aside rather than
+ *   written over — and the deck tells the user the key is in the moved file.
+ *   `.agent-dag-<pid>-<n>.tmp` is atomic-write.mjs's temp file and
+ *   `.<pid>.migrating` is migrateDeckFiles', both left by a process killed
+ *   before the copy was moved into place. The boot sweeps those two, but
+ *   after an uninstall there is no next boot.
+ *
+ * Exact shapes, anchored, so nothing else in the folder — which on some
+ * machines is also the discovery folder — is ever listed or removed.
+ */
+const KEY_COPY = /^prefs\.json\.(?:corrupt-\d+|foreign-\d+|agent-dag-\d+-\d+\.tmp|\d+\.migrating)$/;
+
 /**
  * Every directory on this machine that may still hold one.
  *
@@ -74,36 +91,47 @@ export function keyDirs({ env = process.env, home = homedir(), platform = proces
  */
 export async function findKeyFiles(dirs = keyDirs(), deps = {}) {
   const read = deps.readFile ?? readFile;
+  const list = deps.readdir ?? readdir;
   const out = [];
   for (const dir of dirs) {
-    const path = join(dir, KEY_FILE);
-    let raw;
-    try {
-      raw = await read(path, "utf8");
-    } catch (err) {
-      // Anything but "no such file" means there IS something there and this
-      // could not see into it, which is the "unknown" case with the read having
-      // failed rather than the parse.
-      if (err?.code === "ENOENT") continue;
-      out.push({ path, holds: "unknown", why: err?.message ?? String(err) });
-      continue;
-    }
-    try {
-      // The BOM, stripped by the rule settings.json, prefs.json and the
-      // browser-watch state are all read with: `JSON.parse` throws on one and
-      // a file Notepad saved is not damaged. This was a copy of it, spelled out
-      // while stripBom was private; it is exported now (atomic-write.mjs), so
-      // the rule has one spelling.
-      const parsed = JSON.parse(stripBom(String(raw)));
-      const secret = parsed?.lan?.secret;
-      out.push({ path, holds: typeof secret === "string" && secret !== "" ? "key" : "no-key", why: "" });
-    } catch (err) {
-      out.push({ path, holds: "unknown", why: err?.message ?? String(err) });
+    // prefs.json first, then its copies by name. A folder that cannot be
+    // listed still has prefs.json asked about, which reports anything but
+    // ENOENT as "unknown" below.
+    const copies = await list(dir).then(names => names.filter(n => KEY_COPY.test(n)).sort(), () => []);
+    for (const name of [KEY_FILE, ...copies]) {
+      const found = await keyFile(join(dir, name), read);
+      if (found) out.push(found);
     }
   }
   return out;
 }
 
+/** One candidate, as findKeyFiles lists it, or null when it is not there. */
+async function keyFile(path, read) {
+  let raw;
+  try {
+    raw = await read(path, "utf8");
+  } catch (err) {
+    // Anything but "no such file" means there IS something there and this
+    // could not see into it, which is the "unknown" case with the read having
+    // failed rather than the parse.
+    if (err?.code === "ENOENT") return null;
+    return { path, holds: "unknown", why: err?.message ?? String(err) };
+  }
+  try {
+    // The BOM, stripped by the rule settings.json, prefs.json and the
+    // browser-watch state are all read with: `JSON.parse` throws on one and
+    // a file Notepad saved is not damaged. This was a copy of it, spelled out
+    // while stripBom was private; it is exported now (atomic-write.mjs), so
+    // the rule has one spelling.
+    const parsed = JSON.parse(stripBom(String(raw)));
+    const secret = parsed?.lan?.secret;
+    return { path, holds: typeof secret === "string" && secret !== "" ? "key" : "no-key", why: "" };
+  } catch (err) {
+    return { path, holds: "unknown", why: err?.message ?? String(err) };
+  }
+}
+
 /**
  * Take those files off the disk, and never let one failure hide another.
  *

package/src/server/request-gates.mjs

@@ -47,11 +47,11 @@ export const HOOK_TOKEN = randomBytes(32).toString("hex");
 //
 // So the Host check runs for every method now. What it asks is only the
 // rebinding question — did this request arrive addressed to a name that can
-// only ever be this machine — and it asks it of browser-shaped requests alone,
-// meaning anything carrying an Origin, fetch metadata or a Referer. A client
-// sending none of them is not a page and has no ambient authority to borrow:
-// that is hook/hook.js, a plain Node http.request from the user's own machine,
-// and it keeps reaching the deck under whatever name it used before.
+// only ever be this machine. It was first asked of browser-shaped requests
+// alone, meaning anything carrying an Origin, fetch metadata or a Referer, on
+// the reasoning that a client sending none of them is not a page: that is
+// hook/hook.js, a plain Node http.request from the user's own machine. The
+// paragraph after next says why that is no longer the whole test.
 //
 // THE REFERER IS ON THAT LIST because on one browser it is the only mark a page
 // leaves (#1168). A same-origin GET carries no Origin, and Safari 16.0-16.3
@@ -68,18 +68,35 @@ export const HOOK_TOKEN = randomBytes(32).toString("hex");
 // bin/ send none — so nothing that reached the deck before is turned away by
 // this, and the deck's own page names a loopback Host whatever it sends.
 //
+// THE HOST IS NOW READ ON EVERY REQUEST THAT CARRIES ONE. Whether a request
+// is browser-shaped is the sending page's choice as much as the browser's — a
+// page's own GET need carry none of the three marks — so it no longer decides
+// whether the Host is asked about. Every client of this server that is not a
+// browser dials 127.0.0.1 — hook.js, the desktop app, bin/ and deck-probe.mjs
+// — so the Host Node fills in for them is a loopback one, and they are
+// answered exactly as before. Two shapes still pass under a name that is not
+// loopback:
+//
+//   - no Host at all, which is HTTP/1.0 tooling and never a browser — every
+//     browser sends one;
+//   - the deck's token (`token`, the raw x-ccdeck-token header), which only a
+//     process that read the 0600 discovery file can present, and only on a
+//     request that is not browser-shaped. A request a page chose is refused
+//     whoever else may be behind it, as isTrustedMutation's is.
+//
 // Deliberately not part of this: the Sec-Fetch-Site test that isTrustedMutation
 // applies. `cross-site` on a read is an ordinary top-level navigation — a link
 // to http://localhost:4317 clicked on any page — and the document it loads is
 // the deck's own UI on the deck's own origin, which is not an attack and used
 // to work. Rebinding does not need that test either: a rebound page's requests
 // report `same-origin`, and it is the Host that gives it away.
-export function isTrustedRead({ origin, host, secFetchSite, referer } = {}) {
+export function isTrustedRead({ origin, host, secFetchSite, referer, token } = {}) {
   const browserShaped = (typeof origin === "string" && origin !== "")
     || (typeof secFetchSite === "string" && secFetchSite.trim() !== "")
     || (typeof referer === "string" && referer.trim() !== "");
-  if (!browserShaped) return true;
-  return isLoopbackHost(host);
+  if (browserShaped) return isLoopbackHost(host);
+  if (typeof host !== "string" || host.trim() === "") return true;
+  return isLoopbackHost(host) || presentsDeckToken({ "x-ccdeck-token": token });
 }
 
 // Is this mutating request allowed to be acted on?
@@ -113,12 +130,14 @@ export function isTrustedRead({ origin, host, secFetchSite, referer } = {}) {
 // loopback identity. See isLoopbackHost for the attack that gets through
 // without it.
 //
-// A request carrying neither header is not a browser request and is allowed
-// whatever Host it names: that is hook/hook.js, a plain Node http.request from
-// the user's own machine that sends no Origin at all, plus curl and the deck's
-// own tooling. Ambient browser authority is the whole threat here, and those
-// clients have none — a process that can POST here can already run anything as
-// the user, and nothing it sends is chosen by a page.
+// A request carrying neither header is not a browser request and this gate
+// allows it whatever Host it names: that is hook/hook.js, a plain Node
+// http.request from the user's own machine that sends no Origin at all, plus
+// curl and the deck's own tooling. Ambient browser authority is the whole
+// threat here, and those clients have none — a process that can POST here can
+// already run anything as the user, and nothing it sends is chosen by a page.
+// The name such a request is addressed to is isTrustedRead's question, which
+// the router asks first, of every method.
 export function isTrustedMutation({ origin, host, secFetchSite } = {}) {
   const site = typeof secFetchSite === "string" ? secFetchSite.trim().toLowerCase() : "";
   if (site && site !== "same-origin" && site !== "none") return false;
@@ -421,6 +440,20 @@ export const GUARDED_READS = new Set([
   // Per-account, per-project token spend — the user's own work, the same class
   // of secret as the accounts list it hangs off.
   "/api/account-projects",
+  // The signed-in Codex account's email, plan type and credit balance ride on
+  // this answer (codex-quota.mjs), which is the account identity the roster
+  // route above is guarded for.
+  "/api/codex-quota",
+  // And the rest of the usage panel, by the rule /api/account-projects is here
+  // under: the active account's quota windows, Claude's spend by day and by
+  // session, Codex's token spend, and the auto-switch settings with the last
+  // account it moved to. Each is about what the user is doing rather than about
+  // the machine, and each has one caller, the deck's own page in src/web —
+  // the desktop app, bin/ and the hook never read them.
+  "/api/quota",
+  "/api/ccusage",
+  "/api/codex-usage",
+  "/api/cswap-auto",
   // Not a secret, and here for the other reason a read can be dangerous: it is
   // the one route where the caller names what the deck goes and fetches
   // (#1208). fm-station.mjs holds that to YouTube, but a page on another site

package/src/server/retire-sound-hook.mjs

@@ -33,7 +33,8 @@
 //   switch anywhere that could stop it, or crashing once the script was swept.
 //
 // Everything else in the file is the user's and is not touched. `afplay …` stays
-// exactly where they put it, and this module has no idea what it does.
+// exactly where they put it, and this module has no idea what it does — even
+// when it sits in the same group as ours (see withoutOurs).
 //
 // EXACTLY ONCE, without a stamp. Retirement is triggered by the state it
 // removes: our entry in settings.json, a parked file, or one of our scripts on
@@ -137,12 +138,52 @@ export function namesOurScript(cmd, platform = process.platform) {
   return SCRIPT_TAILS.some(tail => hay.includes(tail));
 }
 
-/** An entry this deck put there: by its mark, or by the script it runs. */
-function isOurs(entry) {
-  if (entry?.[MARK] === true) return true;
-  return commandsOf(entry).some(cmd => namesOurScript(cmd));
+/**
+ * Whether one command is our sound script. In a group we marked, under either
+ * separator and in any case: a settings.json synced from another platform
+ * spells the path that platform's way, and the mark already says whose it is.
+ */
+function isOurCommand(h, marked) {
+  const cmd = typeof h?.command === "string" ? h.command : "";
+  return namesOurScript(cmd) || (marked && namesOurScript(cmd, "win32"));
 }
 
+/** What withoutOurs answers for an entry with nothing left in it. */
+const DROP = Symbol("drop");
+
+/**
+ * One entry with our sound command taken out of it: `entry` itself when nothing
+ * in it was ours, DROP when nothing is left, and otherwise a copy holding the
+ * rest with its matcher and without our mark.
+ *
+ * PER COMMAND, NOT PER ENTRY — installer.mjs's rule for its own forwarder
+ * (#1734), for the same reason. The toggle's group had no matcher, and Claude
+ * Code's hook editor files a new matcher-less Stop hook into the first Stop
+ * group whose matcher is missing or empty, which while the toggle was on was
+ * often ours. Deciding for the whole group took the user's hook out with it, on
+ * the boot that retired the toggle and on `--uninstall`, and said nothing.
+ *
+ * A marked entry whose `hooks` is not a list is dropped, as it always was; an
+ * unmarked one is left exactly where it is.
+ */
+function withoutOurs(entry) {
+  if (!entry || typeof entry !== "object") return entry;
+  const marked = entry[MARK] === true;
+  if (!Array.isArray(entry.hooks)) return marked ? DROP : entry;
+  const kept = entry.hooks.filter(h => !isOurCommand(h, marked));
+  if (!marked && kept.length === entry.hooks.length) return entry;
+  if (kept.length === 0) return DROP;
+  const rest = {};
+  for (const [k, v] of Object.entries(entry)) {
+    if (k === MARK) continue;
+    rest[k] = k === "hooks" ? kept : v;
+  }
+  return rest;
+}
+
+/** An entry holding something this deck put there: its mark, or its script. */
+const isOurs = (entry) => withoutOurs(entry) !== entry;
+
 /** Anywhere in the file — not just `Stop` — that still runs one of our scripts.
  *  The sweep below asks this before deleting them: a stale sound is survivable
  *  and a hook pointing at nothing is not. */
@@ -237,9 +278,12 @@ export async function retireSoundHookIn(settings) {
     parkError = { reason: "parked_unreadable", parkedPath: PARKED_PATH, message: err.message };
   }
 
+  // `removed` counts the entries ours was taken out of, whether or not the
+  // user's own hooks were left behind in them.
   const group = Array.isArray(settings?.hooks?.[EVENT]) ? settings.hooks[EVENT] : [];
-  const theirs = group.filter(g => !isOurs(g));
-  const removed = group.length - theirs.length;
+  const trimmed = group.map(withoutOurs);
+  const theirs = trimmed.filter(g => g !== DROP);
+  const removed = trimmed.filter((g, i) => g !== group[i]).length;
 
   // Identical entries are not restored twice — see the note on two decks at the
   // top. `theirs` is what will be in the file, so a hook already back from an
@@ -253,10 +297,13 @@ export async function retireSoundHookIn(settings) {
   // exactly the shape a hand-written-hook filter would have swept up. Restoring
   // one would put back the hook this whole module exists to remove, pointing at
   // a script this release deletes, on the boot that was supposed to repair it.
+  // Per command here too: the toggle parked whole groups, so a hook of theirs
+  // that sat beside our script went into the park with it and comes back alone.
   const seen = new Set(theirs.map(g => JSON.stringify(g)));
   const putBack = [];
-  for (const entry of parked) {
-    if (isOurs(entry)) continue;
+  for (const parkedEntry of parked) {
+    const entry = withoutOurs(parkedEntry);
+    if (entry === DROP) continue;
     const key = JSON.stringify(entry);
     if (seen.has(key)) continue;
     seen.add(key);

package/src/server/ring-bounds.mjs

@@ -76,6 +76,16 @@ export const MAX_BUFFER = 2000;     // recent HOOK events kept for late SSE subs
  */
 const LAST_VALUE_WINS = new Set(["ModelObserved", "UsageObserved", "ContextObserved", "SessionNamed"]);
 
+/**
+ * Whether this payload is enrichment MAX_BUFFER does not count — see
+ * LAST_VALUE_WINS. One test, asked by the ring's eviction and by the boot
+ * replay's staging alike, so the replay reads back the window the ring keeps
+ * rather than a window of log lines, most of which are enrichment (#1750).
+ */
+export function isEnrichment(raw) {
+  return raw != null && typeof raw === "object" && LAST_VALUE_WINS.has(raw.hook_event_name);
+}
+
 /**
  * The ring's array-length backstop, distinct from its event budget.
  *