ccdeck 3.32.1 → 3.33.0

package/src/server/browser-react.mjs

@@ -19,6 +19,7 @@
 // already loaded the page and sent the user's cookies. Closing it is cleanup.
 // The session that opened it is still attached and can still read every other
 // tab. Only quitting takes anything back.
+import { homedir } from "node:os";
 import { run } from "./exec.mjs";
 import { notificationsVetoed } from "./deck-prefs.mjs";
 // The one table of process names, shared with the presence probe so the reaction
@@ -26,7 +27,10 @@ import { notificationsVetoed } from "./deck-prefs.mjs";
 // and, with it, the two questions that table cannot answer on its own: which
 // browsers this platform cannot tell apart by name, and where each of those is
 // installed.
-import { installMarker, processName, sharesProcessName } from "./browser-presence.mjs";
+import { installMarker, processName, rootOwner, sharesProcessName } from "./browser-presence.mjs";
+// Where each browser keeps its profiles, which on Linux is where the lock that
+// names its process is (see quitLinux).
+import { browserRoots } from "./browser-profiles.mjs";
 
 /** Reactions this platform can actually carry out, in the order the panel
  *  should offer them. Never a list the caller has to filter again. */
@@ -251,8 +255,39 @@ export async function quitBrowser(browserKey, platform = process.platform, deps
   const proc = processName(browserKey, platform);
   if (!proc) return { ok: false, reason: "unknown_browser" };
   if (platform === "win32") return await quitWindows(browserKey, proc, exec);
-  const r = await exec("pkill", ["-x", proc]).catch(() => null);
-  return { ok: r?.ok === true, reason: r?.ok ? "quit" : "pkill_failed" };
+  return await quitLinux(browserKey, platform, exec, deps);
+}
+
+/**
+ * Quit a browser on Linux — the one process holding the profile, and no other.
+ *
+ * WHAT THIS USED TO BE (#1752): `exec("pkill", ["-x", proc])`. Chrome, Chrome
+ * Beta and Chrome Canary all run as `chrome`, and so does every Playwright or
+ * Puppeteer browser, headless or not — so a finding in one Chrome sent SIGTERM
+ * to all three channels and to whatever test run was in progress, and the feed
+ * said it had quit "the browser". The Windows leg was narrowed for the same
+ * collision in #1028; this one never asked.
+ *
+ * Now it asks the profile. `rootOwner` reads the lock the browser keeps in its
+ * user-data root and checks the process it names, and only that pid is sent
+ * SIGTERM — still the polite signal, which Chrome answers by saving its
+ * session. When it cannot name that process it does nothing and says why. It
+ * does not fall back to the name, as the Windows leg can: on this platform the
+ * name is exactly the thing that reaches the wrong browsers, and a reaction that
+ * quit a test run or a second Chrome is worse than one that reports it could
+ * not act.
+ *
+ * `deps.home` and `deps.env` say where the roots are, for a test; the deck's own
+ * are the ones its profiles were read from.
+ */
+async function quitLinux(browserKey, platform, exec, deps) {
+  const root = browserRoots(platform, deps.env ?? process.env, deps.home ?? homedir())
+    .find(r => r.key === browserKey)?.root;
+  if (!root) return { ok: false, reason: "unknown_browser" };
+  const owner = await rootOwner(root, deps);
+  if (owner.pid === null) return { ok: false, reason: owner.reason };
+  const r = await exec("kill", ["-TERM", String(owner.pid)]).catch(() => null);
+  return { ok: r?.ok === true, reason: r?.ok ? "quit" : "kill_failed" };
 }
 
 /**
@@ -339,7 +374,7 @@ export function pickInstallPids(json, marker) {
  * `/F` is TerminateProcess. It is not a request and nothing gets to refuse it:
  * no beforeunload, no session write, no "restore pages?" on the next launch.
  * The other two legs of this same function are graceful — macOS sends the
- * AppleScript `quit`, Linux sends SIGTERM through `pkill -x` — so Windows was
+ * AppleScript `quit`, Linux sends SIGTERM — so Windows was
  * the one platform where arming this reaction meant losing whatever was typed
  * into every open form. Without `/F`, taskkill posts WM_CLOSE, which is the
  * Windows spelling of the same polite request the other two legs make, and

package/src/server/browser-watch-seen.mjs

@@ -69,14 +69,48 @@ export function nothingSeen() {
     /** The gate the open verdicts were last judged under, so a changed one is
      *  applied on the next poll whether or not that poll read anything. */
     judgedUnder: null,
+    /**
+     * The moment every visit before which is known to have been read, or null
+     * before the first complete look.
+     *
+     * THE OTHER WAY A VERDICT SETTLES (#1751). `settledTo` moves only when the
+     * browser records something newer, and a browser nobody is using records
+     * nothing — so on the one machine this feature is for, a program page left
+     * alone stayed open until its owner came back, and was only final once they
+     * had. The clock settles it instead: a visit is written down when it
+     * happens, so once a complete look has been taken `quietMs` past a
+     * candidate, no visit still to be read can fall inside its window.
+     * `decided` reads this; `settledTo` and the lists above are untouched by
+     * it, so a gate changed afterwards re-judges the open verdicts as before.
+     */
+    readTo: null,
   };
 }
 
+/**
+ * The findings no later read can withdraw: every settled one, and every open
+ * one whose quiet window had closed by the last complete look.
+ *
+ * Only these are written down, logged and reacted to. An open verdict is still
+ * shown — it is what the browser holds right now — but a person's visit in the
+ * minutes after it cancels it, and a reaction that quit the browser in the
+ * middle of their own login cannot be taken back when the visit arrives.
+ */
+export function decided(seen) {
+  if (seen.readTo === null || seen.judgedUnder === null) return seen.settled.slice();
+  const line = seen.readTo - seen.judgedUnder;
+  return seen.settled.concat(seen.open.filter(f => f.timeMs <= line));
+}
+
 /** Fold one real read's rows into what the profile has contributed, and judge
  *  again whatever is still open. Mutates `seen`, which is the object `_lastRead`
  *  holds. Exported for tests, with `nothingSeen`: what is held between polls
  *  is the question #989 was about, and a snapshot cannot see it. */
-export function absorb(seen, rows, { quietMs, classifyOpts, browser }) {
+export function absorb(seen, rows, { quietMs, classifyOpts, browser, readTo = null }) {
+  // Before the early return, because a poll that read nothing still moves the
+  // clock: see `readTo` in `nothingSeen`. Null from a read that was not
+  // complete, which leaves the line where the last complete one put it.
+  if (readTo !== null && (seen.readTo === null || readTo > seen.readTo)) seen.readTo = readTo;
   // NOTHING NEW UNDER THE SAME GATE IS NOTHING TO DO. A gate that has changed
   // since the open verdicts were judged is applied with no new rows at all
   // (#1131): the settings route drops the cache, the read after it finds the

package/src/server/browser-watch.mjs

@@ -48,7 +48,7 @@ import { note, watchLog } from "./browser-watch-feed.mjs";
 export { noteWatchSetting } from "./browser-watch-feed.mjs";
 // What each profile has contributed since the deck started, and the fold that
 // adds one read to it.
-import { absorb, nothingSeen } from "./browser-watch-seen.mjs";
+import { absorb, decided, nothingSeen } from "./browser-watch-seen.mjs";
 export { absorb, nothingSeen } from "./browser-watch-seen.mjs";
 
 /**
@@ -95,6 +95,18 @@ const STARTED_MS = Date.now() - Math.round(process.uptime() * 1000);
  */
 const _floor = new Map();
 
+/**
+ * How long a visit may sit in the browser before it reaches the History file,
+ * and so how far behind a complete look the quiet windows it closes are drawn.
+ *
+ * A browser writes its history in batches, on a timer measured in seconds, so
+ * a person's click just before a poll can still be missing from the copy it
+ * takes. A minute is several of those timers, and against a fifteen-minute
+ * gate it costs a reaction a minute of delay, where a window closed too early
+ * would let that click arrive after the verdict it should have cancelled.
+ */
+const WRITE_LAG_MS = 60_000;
+
 /** One cached read per profile: the mtime it was taken at, and what it found.
  *  Keyed by history path, so two browsers and two profiles never share an
  *  entry. Module-level because a snapshot is a request and the point is to
@@ -275,7 +287,9 @@ let surveyCache = { atMs: 0, rows: [] };
 async function surveyBrowsers(platform, env, now, deps) {
   if (deps.browserSurvey) return deps.browserSurvey();
   if (now - surveyCache.atMs < SURVEY_TTL_MS) return surveyCache.rows;
-  const rows = await browserSurvey({ relayHost: RELAY_HOST, platform, env, deps }).catch(() => []);
+  // `deps.home` for a test, as the quit reaction reads it: without it the
+  // survey looked in the real home whatever else it had been handed (#1825).
+  const rows = await browserSurvey({ relayHost: RELAY_HOST, platform, env, home: deps.home, deps }).catch(() => []);
   surveyCache = { atMs: now, rows };
   return rows;
 }
@@ -326,6 +340,21 @@ const _lastRead = new Map();
  *  read, so a row can report what was ADDED rather than the running total. */
 const _lastCount = new Map();
 
+/**
+ * The reason each profile was last reported unreadable, until a read of it
+ * succeeds (#1754).
+ *
+ * An unreadable profile usually STAYS unreadable — no SQLite reader on this
+ * Node, a profile folder with no History file, a copy that keeps failing — and
+ * each poll said so again, every ten seconds with the panel open. The feed is
+ * bounded at 200, so within half an hour it was that one warning 200 times and
+ * the reader's own lines were gone. A state is reported when it begins or
+ * changes. Kept across a Refresh, like `_lastCount`: it is a record of what the
+ * feed has already said, and the profile's row in the panel still shows the
+ * reason on every poll.
+ */
+const _warned = new Map();
+
 /** Whether the archive gained or altered anything worth a disk write. Compared
  *  on the shape a card is drawn from, so a re-read that found exactly the same
  *  episodes writes nothing — which is most polls, most of the time. */
@@ -344,17 +373,25 @@ function changedFrom(before, after) {
  *
  * One function because it is one rule: the delta is computed against the same
  * map it then writes, so the deltas the feed shows add up to the total the
- * overview shows (#989). A degraded read says why, a cached one — the file has
- * not moved — says nothing at all, and a real read says what it added, if it
- * added anything. `key` is the profile's browser/profile, the key `_lastCount`
+ * overview shows (#989). A degraded read says why, once until the reason
+ * changes or a read succeeds (#1754); a cached one — the file has not moved —
+ * says nothing at all, and a real read says what it added, if it added
+ * anything. `key` is the profile's browser/profile, the key `_lastCount`
  * and `_lastRead` are kept under.
  */
 function noteRead(profile, key, read, findings, now) {
   const where = `${profile.name}/${profile.profile}`;
-  if (read.degraded) note("warn", `${where} — ${read.reason ?? "could not read"}`, now);
+  if (read.degraded) {
+    // Once per reason, cached poll or not: see `_warned`.
+    const reason = read.reason ?? "could not read";
+    if (_warned.get(key) !== reason) note("warn", `${where} — ${reason}`, now);
+    _warned.set(key, reason);
+  }
   // A poll that found the file unchanged says nothing at all.
   else if (read.cached) { /* silent */ }
   else {
+    // Read, so the next failure is news again.
+    _warned.delete(key);
     // `, 0 flagged` on every line is what made them all look alike: the
     // count that matters is the one that is not zero, and printing the zero
     // beside it buried the difference. Absence is the message.
@@ -414,16 +451,40 @@ function noteRead(profile, key, read, findings, now) {
   }
 }
 
+/**
+ * The episodes built from every finding, each one that holds a page whose
+ * verdict can still change marked `provisional`.
+ *
+ * Compared page by page against the decided findings, since one run can be
+ * decided up to its fifth page and open after it — and that run is still the
+ * one card, under the key the archive and the dismissals use.
+ */
+function provisionalOf(episodes, decidedFindings) {
+  const final = new Set(decidedFindings.map(f => `${f.browser ?? ""}\u0000${f.url}\u0000${f.timeMs}`));
+  return episodes.map(e => (
+    e.urls.every(u => final.has(`${e.browser ?? ""}\u0000${u.url}\u0000${u.timeMs}`)) ? e : { ...e, provisional: true }
+  ));
+}
+
+/** The archive, with this poll's provisional episodes drawn over it: a card
+ *  already written down that has gained open pages since is shown with them,
+ *  and a verdict nobody has decided yet is shown beside what has been. */
+function overProvisional(kept, live) {
+  const byKey = new Map(kept.map(e => [episodeKey(e.host, e.startMs), e]));
+  for (const e of live) if (e.provisional) byKey.set(episodeKey(e.host, e.startMs), e);
+  return [...byKey.values()].sort((a, b) => b.startMs - a.startMs);
+}
+
 /**
  * Write down what this poll found that the archive did not have, and react to
  * it: the elected deck's half of a poll, taken only when the archive changed.
  *
  * Only the deck isReactingDeck elects gets here, so an episode is written and
  * reacted to once however many decks are open — the others still show it,
- * because reading the store is free. `live` is this poll's episodes and `kept`
- * the archive with them merged in.
+ * because reading the store is free. `final` is this poll's decided episodes
+ * and `kept` the archive with them merged in.
  */
-async function recordAndReact(store, kept, live, { platform, now, deps }) {
+async function recordAndReact(store, kept, final, { platform, now, deps }) {
   // Only what is NEW gets a log line. mergeEpisodes replaces a run that has
   // grown, so writing the whole set every time would repeat one episode once
   // per page it gained. "The same episode" is the store's own key, the one
@@ -446,7 +507,7 @@ async function recordAndReact(store, kept, live, { platform, now, deps }) {
   // they are at the moment of the write.
   const merge = cur => ({
     settings: cur.settings,
-    episodes: mergeEpisodes(cur.episodes, live, now),
+    episodes: mergeEpisodes(cur.episodes, final, now),
     dismissed: cur.dismissed,
   });
   if (deps.updateStore) await deps.updateStore(merge, undefined, deps);
@@ -532,7 +593,7 @@ async function coverageOf({ oldestVisitMs, lastHumanMs, quietMs, archived, now,
  * degraded, or overtaken and demoted to cached), the browser/profile key the
  * accumulators are kept under, and the accumulator itself, already folded.
  */
-async function readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, opts, exclude }) {
+async function readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, opts, exclude, now }) {
   // From where this profile's last read finished, or from the deck's start
   // on its first. The count is always taken above the deck's start, which
   // is what makes it the running total noteRead's delta comes out of.
@@ -558,9 +619,11 @@ async function readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, o
   // millisecond compare equal and the later is dropped as a copy of the
   // first. The floor is exact, being the value every row of the read was
   // selected against.
+  let overtaken = false;
   if (!read.cached && !read.degraded && (_floor.get(profile.historyPath) ?? sinceChromeTime) !== floor) {
     cache.delete(profile.historyPath);
     read = { ...read, rows: [], cached: true };
+    overtaken = true;
   }
   const key = `${profile.browser}/${profile.profile}`;
   // Everything this profile has contributed since the deck started. A read
@@ -568,7 +631,18 @@ async function readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, o
   // "nothing": the list must not empty itself because one poll found the file
   // untouched or the browser holding a lock.
   const seen = _lastRead.get(key) ?? nothingSeen();
-  const judge = { quietMs, classifyOpts: { ...opts, exclude }, browser: profile.browser };
+  // HOW FAR THIS POLL HAS SEEN, which is what closes a quiet window (#1751). A
+  // read that succeeded has every visit up to now, and so has a cached one: the
+  // file has not moved since a read that was absorbed. A degraded read has
+  // nothing, and an overtaken one dropped its rows, so neither moves the line.
+  // Less WRITE_LAG_MS, for a visit the browser has made and not written yet.
+  const complete = !read.degraded && !overtaken;
+  const judge = {
+    quietMs,
+    classifyOpts: { ...opts, exclude },
+    browser: profile.browser,
+    readTo: complete ? now - WRITE_LAG_MS : null,
+  };
   if (!read.cached && !read.degraded) {
     // THE FLOOR MOVES HERE, and only on a read that succeeded. A read with
     // nothing new hands its floor back as the watermark, so storing that
@@ -692,6 +766,9 @@ export async function browserWatchSnapshot({
 
   const reports = [];
   let allFindings = [];
+  // The part of them no later read can withdraw, which is all that is written
+  // down or reacted to (#1751). See `decided`.
+  let allDecided = [];
   let anyDegraded = false;
   let oldestSeen = null;
   // The newest visit a PERSON made, across every profile. It is what the quiet
@@ -702,12 +779,13 @@ export async function browserWatchSnapshot({
   let lastHuman = null;
 
   for (const profile of profiles) {
-    const { read, key, seen } = await readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, opts, exclude });
+    const { read, key, seen } = await readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, opts, exclude, now });
     if (read.degraded) anyDegraded = true;
     const findings = seen.settled.concat(seen.open);
     const { oldest, human, byProgram } = seen;
     noteRead(profile, key, read, findings, now);
     allFindings = allFindings.concat(findings);
+    allDecided = allDecided.concat(decided(seen));
     if (oldest !== null && (oldestSeen === null || oldest < oldestSeen)) oldestSeen = oldest;
     if (human !== null && (lastHuman === null || human > lastHuman)) lastHuman = human;
     reports.push({
@@ -743,7 +821,14 @@ export async function browserWatchSnapshot({
   // are not "nothing happened".
   _checks += 1;
 
-  const live = toEpisodes(allFindings, gapMs === undefined ? undefined : { gapMs });
+  const grouping = gapMs === undefined ? undefined : { gapMs };
+  const live = provisionalOf(toEpisodes(allFindings, grouping), allDecided);
+  // WHAT IS WRITTEN DOWN IS ONLY WHAT IS DECIDED (#1751). This was `live`: an
+  // open verdict was archived, logged and reacted to on the poll that first saw
+  // it, and a person's visit a minute later withdrew it from the list and left
+  // it everywhere else — in state.json, in watch.log, and in a browser that had
+  // already been quit under them.
+  const final = toEpisodes(allDecided, grouping);
 
   // THE UNION, AND WHY IT IS NOT JUST THE LIVE READ. Chrome's history is the
   // better source right up to the moment somebody clears it — and whoever can
@@ -754,16 +839,18 @@ export async function browserWatchSnapshot({
   // Only while it is ON. An archive that filled itself whether or not the user
   // had asked for a watch would be a record they never consented to keep, of
   // pages they visited, on disk. The switch means what it says.
-  const kept = enabled ? mergeEpisodes(store.episodes, live, now) : store.episodes;
+  const kept = enabled ? mergeEpisodes(store.episodes, final, now) : store.episodes;
   // Only one deck records and reacts; the others still SHOW everything, because
   // reading the store is free and a second panel that went blank would be a
   // worse bug than the one this prevents.
   const acting = enabled ? await isReactingDeck(deps) : false;
-  if (acting && changedFrom(store.episodes, kept)) await recordAndReact(store, kept, live, { platform, now, deps });
+  if (acting && changedFrom(store.episodes, kept)) await recordAndReact(store, kept, final, { platform, now, deps });
   // FILTERED ON BOTH PATHS, because the panel builds episodes from the
   // browser's own history on every poll: dropping only the archived copy would
-  // be undone within ten seconds by the next read of the same visits.
-  const episodes = undismissed(enabled ? kept : live, store.dismissed);
+  // be undone within ten seconds by the next read of the same visits. With the
+  // watch on, what is still open is drawn over the archive, so a run that has
+  // gained pages since it was written down shows them.
+  const episodes = undismissed(enabled ? overProvisional(kept, live) : live, store.dismissed);
 
   // Stamped after the work, so it means "a poll finished" rather than "a poll
   // began" — the difference shows on the first look, which copies every

package/src/server/cafe-music-bgm.mjs

@@ -26,7 +26,8 @@ function currentLiveVideo(html) {
 
 export async function fetchCafeMusicBgm({ fetchImpl } = {}) {
   const now = Date.now();
-  if (cache && now - cacheAt < cacheTtl) return cache;
+  // The stamp, not the value: a miss is remembered too, as null.
+  if (cacheAt && now - cacheAt < cacheTtl) return cache;
   if (inflight) return inflight;
   const get = fetchImpl ?? fetch;
   inflight = (async () => {

package/src/server/ccusage-install.mjs

@@ -17,6 +17,7 @@ import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync }
 import path from "node:path";
 import os from "node:os";
 import { killTree, shimPath, spawnSpec } from "./exec.mjs";
+import { npmCliLaunch } from "./npx.mjs";
 import { oneLine } from "./term.mjs";
 import { note } from "./ccusage-failure.mjs";
 
@@ -56,11 +57,14 @@ export const winShim = (name, deps) => shimPath(name, deps) ?? name;
 // routes the .cmd through cmd.exe with every argument quoted, and hands back
 // the argument vector untouched everywhere else.
 //
-// POSIX is untouched by any of this: `npm` there is a real executable on PATH,
-// not a batch file, so isBatch is false, viaCmd never runs, and the vector goes
-// to spawn exactly as it always has.
+// POSIX is untouched by any of this: `npm` there is a real executable, not a
+// batch file, so isBatch is false, viaCmd never runs, and the vector goes to
+// spawn intact. It is run as the npm-cli.js beside this node, though, and by
+// the bare name only when there is none: a deck started at login has no PATH
+// that finds npm on a Homebrew or nvm install (#1777). See npmCliLaunch.
 function npmSpec(args, platform = process.platform, deps) {
-  return spawnSpec(platform === "win32" ? winShim("npm.cmd", deps) : "npm", args, platform);
+  if (platform !== "win32") return npmCliLaunch(args, { platform, ...deps }) ?? spawnSpec("npm", args, platform);
+  return spawnSpec(winShim("npm.cmd", deps), args, platform);
 }
 
 /**

package/src/server/ccusage.mjs

@@ -32,7 +32,9 @@ const _cache = new Map(); // key `${since}|${until}` → { result, at }
 // thirty permanent Map entries. isCliDate admits all 10^8 eight-digit strings
 // on purpose (a date outside the logs is ccusage's question to answer, not the
 // deck's to guess at), so the map's key space was 10^8 and its eviction policy
-// was none.
+// was none. The route is a guarded read now (GUARDED_READS in
+// request-gates.mjs), so another site's page is refused before it starts
+// anything; the ceiling stays for the deck's own page and the token's holders.
 //
 // Both numbers are set against what the feature does rather than against the
 // attack. The usage-history modal asks for one range at a time and offers three

package/src/server/claude-accounts.mjs

@@ -14,7 +14,7 @@
 // and cannot lose a login. Switching shells out to `cswap` rather than
 // reimplementing the lock protocol its correctness depends on.
 import { readFile, writeFile, mkdir } from "node:fs/promises";
-import { cswapBin, cswapInstalling, cswapVersion, installHint } from "./cswap-install.mjs";
+import { cswapBin, cswapInstalling, cswapRefusal, cswapVersion, installHint } from "./cswap-install.mjs";
 import { run, runDetached } from "./exec.mjs";
 import { failureDetail } from "./exec-output.mjs";
 import { storedCopyAlive } from "./account-health.mjs";
@@ -140,19 +140,29 @@ let _generation = 0;
 /**
  * Whether we may go to disk for the roster again.
  *
- * The same shape and the same minute as quota.mjs's `maySelfPoll`, and exported
- * for the same reason it is: this is the rule, it is pure, and it belongs
- * somewhere a test can point at it.
- *
- * Two intervals, like `maySelfPoll`'s. A forced read may beat the cache, but not
- * turn into a poll loop when the button is held down, so it takes the minute the
- * other four forcible routes use. An unforced read takes the cache's own
- * interval — it is the panel's ordinary poll, the cache above has already
- * answered it, and measuring from the START of the last read rather than from
- * its end is the only difference between the two rules.
+ * The same shape as quota.mjs's `maySelfPoll`, and exported for the same reason
+ * it is: this is the rule, it is pure, and it belongs somewhere a test can
+ * point at it.
+ *
+ * An unforced read takes the cache's own interval — it is the panel's ordinary
+ * poll, the cache above has already answered it, and measuring from the START
+ * of the last read rather than from its end is the only difference between the
+ * two rules.
+ *
+ * A forced read takes the SHORTER of the minute the other forcible routes use
+ * and that same interval, which is the cache's (#1798). It had the minute on its
+ * own, and the panel's fifteen-second poll stamps `_lastReadAt` every time, so
+ * while the panel was open ↻ was always inside its floor and was handed the held
+ * reading — even at a moment when an ordinary poll would have gone to disk. The
+ * deck's own mutations got past that by invalidating; a `cswap switch` typed in
+ * a terminal, or the user's own engine moving the account, has nothing to
+ * invalidate with, and the press did nothing exactly when it was wanted. What
+ * #604 was protecting still holds: a button held down or a page looping on
+ * `?refresh=1` costs one pair of small JSON reads per five seconds, which is
+ * what the unforced poll was already allowed.
  */
 export function mayReadAccounts({ now, force, lastReadAt }) {
-  return now - lastReadAt >= (force ? FORCE_POLL_MS : CACHE_MS);
+  return now - lastReadAt >= (force ? Math.min(FORCE_POLL_MS, CACHE_MS) : CACHE_MS);
 }
 
 /**
@@ -281,12 +291,13 @@ function lane(id, label, win) {
 /**
  * Every managed account with whatever usage claude-swap last saw for it.
  *
- * When there is nothing to show, says which of the three reasons it is:
+ * When there is nothing to show, says which of the four reasons it is:
  * "cswap_installing" (the deck is installing the tool and there is nothing to
  * do), "no_cswap" (the tool is not installed, and here is the command for this
- * machine) or "no_accounts" (it is installed but nothing has been added yet).
- * They need different things from the user, and reporting them as one empty
- * panel leaves whichever one they are in with nowhere to go.
+ * machine), "no_accounts" (it is installed but nothing has been added yet) or
+ * "cswap_refused" (the copy that answers is one the deck installed and refused
+ * to drive). They need different things from the user, and reporting them as
+ * one empty panel leaves whichever one they are in with nowhere to go.
  */
 export async function fetchClaudeAccounts({ force = false } = {}) {
   const now = Date.now();
@@ -366,6 +377,14 @@ async function readRoster(now, gen) {
     return r;
   };
 
+  // A COPY THE DECK REFUSED (#1799), before the store is even read. Its roster
+  // would be a panel whose every button — Add, Switch, Remove — runs that copy,
+  // and its empty store read as `no_accounts`, which is "installed, add one".
+  const refused = await cswapRefusal();
+  if (refused) {
+    return finish({ ok: false, reason: "cswap_refused", version: refused.version, want: refused.want ?? null, fetchedAt: now });
+  }
+
   const root = backupRoot();
   const seq  = await readSequence(root);
   if (!seq?.accounts) {
@@ -759,6 +778,9 @@ const SEED_MARKER = join(homedir(), ".agents-deck", ".cswap-seeded");
 export async function seedFirstAccount() {
   if (process.env.AGENTS_DECK_NO_INSTALL === "1") return { state: "skipped" };
   if (existsSync(SEED_MARKER)) return { state: "already-tried" };
+  // Before the marker, so a refused copy does not also spend the one attempt
+  // (#1799). The boot does not seed one either; this is the seed saying so.
+  if (await cswapRefusal()) return { state: "refused" };
 
   // THE TEST AND THE WRITE ARE ONE CRITICAL SECTION (#1039). The whole guard
   // below is a read of sequence.json — "only when the store holds no accounts

package/src/server/codex-dir.mjs

@@ -129,8 +129,8 @@ export const STOP = Symbol("stop-rollout-walk");
  * blocks and differed only in the last few lines: find the file carrying a
  * given session id (now codex-enrichment.mjs), collect everything in the newest
  * two day directories (codex-watch.mjs, for the watcher), and collect
- * everything whose filename timestamp falls inside a rolling window
- * (codex-usage.mjs). The walk is the part that has to agree — a deck that tails
+ * everything whose filename timestamp falls inside a rolling window, or whose
+ * mtime does (codex-usage.mjs). The walk is the part that has to agree — a deck that tails
  * one set of files and reports usage from another is reporting on a session it
  * is not showing.
  *
@@ -141,10 +141,12 @@ export const STOP = Symbol("stop-rollout-walk");
  * is a reason to stop reading the other 364 days. A missing sessions/ directory
  * is not an error at all — it is simply a machine where Codex has not run yet.
  *
- * `onYear` exists for the one caller that can rule out a whole year without
- * opening it. Years arrive newest-first, so returning STOP from it ends the
- * walk rather than skipping a year, which is what the caller wants: once the
- * years are older than the window, so is everything after them.
+ * `onYear` exists for a caller that can rule out a whole year without opening
+ * it. Years arrive newest-first, so returning STOP from it ends the walk rather
+ * than skipping a year: once the years are older than what is wanted, so is
+ * everything after them. codex-usage.mjs used it to stop at the first year too
+ * old to hold a name inside its window, and no longer does — a resumed session
+ * writes into the rollout it started in, however old that is (#1731).
  */
 export async function walkRolloutDays(onDay, { sessionsDir = CODEX_SESSIONS_DIR, onYear = null } = {}) {
   let years;

package/src/server/codex-quota.mjs

@@ -259,8 +259,10 @@ let _inflight = null;
 // then asks again got a fresh round trip every time — two authenticated HTTPS
 // GETs carrying the user's live ChatGPT session, as fast as the round trip
 // allows, from any page the user happens to have open (#580). Reads on this
-// server are deliberately open (isTrustedRead), so "any page" is the real
-// threat model rather than a hypothetical one.
+// server were deliberately open (isTrustedRead), so "any page" was the real
+// threat model rather than a hypothetical one. The route is a guarded read now
+// (GUARDED_READS in request-gates.mjs), and the floor stays for the callers
+// that still reach it: the deck's own page and a client holding the token.
 //
 // The sharper half is the credential rather than the traffic. On a 401
 // doFetchCodexQuota spends the SINGLE-USE refresh token via forceCodexRefresh,