ccdeck 3.36.9 → 3.37.0

package/dist/web/index.html

@@ -64,8 +64,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-tVBMXvDv.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BkXTN4dZ.css">
+    <script type="module" crossorigin src="/assets/index-wCbqcRJd.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-B0SOa-XB.css">
   </head>
   <body>
     <div id="root"></div>

package/hook/hook.js

@@ -818,6 +818,15 @@ function readRecord(file, resolvedCwd, found, done) {
 
     if (!isAlive(d.pid)) return fs.unlink(full, () => done());
 
+    // A deck started with --no-claude says so in its record, and is not a
+    // target for a Claude event. Starting one removes no hooks an earlier run
+    // installed, so without this it drew every Claude session live — and could
+    // be elected to log them — while its replay, which does read the flag,
+    // dropped them all again at the next boot. Refused here, before the
+    // election, so the log goes to a deck that wants the session. A record
+    // with no `claude` field predates the flag and is taken, as it always was.
+    if (PROVIDER === "claude" && d.claude === false) return done();
+
     // Where this record lives, for the one later verdict that may forget it —
     // see forgetIfAbandoned.
     RECORD_FILE.set(d, full);
@@ -942,6 +951,66 @@ function discoverTargets(cwd, cb) {
   normPathAsync(cwd, scan);
 }
 
+// THE DECK REFUSES AN INGEST BODY OVER 5,000,000 CHARACTERS (event-routes.mjs),
+// and every deck has the same cap, so the hand-on below meets the same 413 on
+// each one and the event reaches nobody. Claude Code's PostToolUse for an Edit
+// carries the whole edited file in `tool_response.originalFile`, so editing a
+// file of a few megabytes was enough: the outcome landed on no canvas and in no
+// log, and the turn's end then settled a successful edit as failed. Kept a
+// little under the deck's figure, so the markers that replace what was cut can
+// never carry a trimmed body back over it.
+const MAX_EVENT_CHARS = 4_900_000;
+
+/**
+ * The event as one line under MAX_EVENT_CHARS, or null when cutting its fields
+ * cannot get it there. The biggest values are replaced by a marker saying how
+ * large they were, biggest first and only until it fits; a top-level object is
+ * opened one level, so an Edit keeps its file path and its strings and loses
+ * only `originalFile`. What the deck settles a call by — the event's name, the
+ * session, the tool, the call id, the cwd — is a short scalar and is never what
+ * goes. `serialized` is the event as it would have been sent whole.
+ */
+function withinSizeCap(parsed, serialized) {
+  const out = { ...parsed };
+  const slots = [];
+  for (const [key, value] of Object.entries(out)) {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const inner = out[key] = { ...value };
+      for (const [k, v] of Object.entries(inner)) slots.push({ holder: inner, key: k, size: JSON.stringify(v)?.length ?? 0 });
+    } else if (typeof value === "string" || Array.isArray(value)) {
+      slots.push({ holder: out, key, size: JSON.stringify(value).length });
+    }
+  }
+  slots.sort((a, b) => b.size - a.size);
+  out.ccdeck_truncated = true;
+  out.ccdeck_truncation_reason = "size";
+  // The two markers above add under 64 characters; the line is measured for
+  // real before it is returned, so this only has to know when to stop.
+  let size = serialized.length + 64;
+  for (const slot of slots) {
+    if (size <= MAX_EVENT_CHARS) break;
+    const marker = { ccdeck_truncated: true, chars: slot.size };
+    slot.holder[slot.key] = marker;
+    size += JSON.stringify(marker).length - slot.size;
+  }
+  const text = JSON.stringify(out);
+  return text.length <= MAX_EVENT_CHARS ? text : null;
+}
+
+/** The event's scalar top-level fields alone, marked as cut and why — what is
+ *  sent when the event cannot be sent whole and nothing gentler fits. */
+function shallowStandIn(parsed, reason) {
+  const shallow = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (value === null || ["string", "number", "boolean"].includes(typeof value)) {
+      shallow[key] = value;
+    }
+  }
+  shallow.ccdeck_truncated = true;
+  shallow.ccdeck_truncation_reason = reason;
+  return JSON.stringify(shallow);
+}
+
 // JSON.parse can accept nesting that older supported Node releases cannot
 // stringify again. Count structural nesting directly in the original text so
 // the hook never depends on a runtime-specific recursion limit. Strings are
@@ -1088,15 +1157,17 @@ function main() {
         // top-level metadata is safe to copy without walking the deep value,
         // which preserves the event/session/tool identity, canonical cwd and
         // provider while making the loss explicit to the deck. (#1180)
-        const shallow = {};
-        for (const [key, value] of Object.entries(parsed)) {
-          if (value === null || ["string", "number", "boolean"].includes(typeof value)) {
-            shallow[key] = value;
-          }
-        }
-        shallow.ccdeck_truncated = true;
-        shallow.ccdeck_truncation_reason = "serialization-depth";
-        taggedInput = JSON.stringify(shallow);
+        taggedInput = shallowStandIn(parsed, "serialization-depth");
+      }
+      // Too large for any deck to take — the same loss by the other door, and
+      // the same answer: send what fits and say what was cut. See
+      // MAX_EVENT_CHARS.
+      if (taggedInput.length > MAX_EVENT_CHARS) {
+        let fitted = null;
+        // Measuring a field walks it, and a field too deep to serialize throws
+        // here as it did above: the stand-in is the answer for that one too.
+        try { fitted = withinSizeCap(parsed, taggedInput); } catch {}
+        taggedInput = fitted ?? shallowStandIn(parsed, "size");
       }
 
       // See proveTargets for what the other order cost. A record whose pid is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.36.9",
+  "version": "3.37.0",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -68,7 +68,8 @@
     "3.36.6",
     "3.36.7",
     "3.36.8",
-    "3.36.9"
+    "3.36.9",
+    "3.37.0"
   ],
   "3.36.3": [
     {

package/src/server/account-origins.mjs

@@ -183,11 +183,18 @@ export function needsSignIn(trouble, collector) {
  * the new login has not happened yet, and saying "expired" over a sign-in that
  * just succeeded is the one moment this must stay quiet.
  */
-export function reauthFor({ entry, trouble, collector, fetchedAt = null, attemptedAt = null }) {
+export function reauthFor({ entry, trouble, collector, fetchedAt = null, attemptedAt = null, verdictAt = null }) {
   if (entry?.origin !== SIGNED_IN_HERE) return null;
   if (!needsSignIn(trouble, collector)) return null;
   const signedInAt = entry.signedInAt ?? 0;
   if (!Number.isFinite(attemptedAt) || attemptedAt <= signedInAt) return null;
+  // A collector that stopped is a dead login only on claude-swap's own
+  // verdict, and a verdict asked before the last sign-in here is about the
+  // login that sign-in replaced. Without this, the first collection after a
+  // re-sign-in — which stamps its attempt as it claims the slot, long before
+  // it records anything — read as a refusal of the new login, on a row whose
+  // last good read is still from before (`cswap add` does not move it).
+  if (trouble?.kind === "stopped" && !(Number.isFinite(verdictAt) && verdictAt > signedInAt)) return null;
   const since = Math.floor(Math.max(Number.isFinite(fetchedAt) ? fetchedAt : 0, signedInAt));
   return { since, dismissed: entry.dismissed === since };
 }

package/src/server/account-projects.mjs

@@ -29,17 +29,19 @@ import { renameWithRetry } from "./atomic-write.mjs";
 import { ccProjectSlug, claudeConfigDir } from "./claude-dir.mjs";
 import { accountKey } from "./lan-sync.mjs";
 import { readSwapLog, accountAtTime, trackedSince, seedActive, markGap } from "./swap-log.mjs";
-// The two rules the live transcript scan counts a line's usage by, so this
-// rollup and a session's card cannot disagree about which lines billed
-// anything — see transcript-scan.mjs.
-import { hasSpend, repeatsRequestUsage } from "./transcript-scan.mjs";
+// The rules the live transcript scan counts a line's usage by, so this rollup
+// and a session's card cannot disagree about which lines billed anything, nor
+// about the speed they were billed at — see transcript-scan.mjs.
+import {
+  billedSpeed, hasSpend, MAX_SPEEDS_PER_MODEL, repeatsRequestUsage, UNRECOGNISED_SPEED,
+} from "./transcript-scan.mjs";
 
 /** The pseudo-account for messages the swap log cannot place — everything
  *  before tracking began, or a gap. Shown once, apart from any real account, so
  *  a per-account total is never quietly inflated by work that is not that
  *  account's. A NUL keeps it from ever colliding with a real `email@@org` key. */
 export const UNATTRIBUTED = "\u0000unattributed";
-const STATE_VERSION = 3;
+const STATE_VERSION = 4;
 
 /** Where the tally and cursors live, beside cswap-auto's own state. */
 export function statePath(home = homedir()) {
@@ -94,12 +96,29 @@ function asUsageTotals(c) {
   };
 }
 
+/** Add `src` into `dst`, and its speed shares into `dst`'s. */
 function addInto(dst, src) {
   dst.i += src.i; dst.o += src.o; dst.cr += src.cr;
   dst.cc += src.cc; dst.c1h += src.c1h; dst.c5m += src.c5m;
+  if (src.s) for (const [speed, share] of Object.entries(src.s)) addInto(speedShareOf(dst, speed), share);
   return dst;
 }
 
+/** The share of `counters` billed at `speed` (#754), created on first sight:
+ *  `s[speed]`, a SUBSET of the counters it sits on, the way the 1h/5m split is
+ *  of `cc`, so the totals read exactly as they did and the client prices the
+ *  share at its own speed's rate. Capped like a session's buckets in
+ *  transcript-scan.mjs, the value being bytes out of a transcript; whatever is
+ *  past the cap is kept as UNRECOGNISED_SPEED, which no rate table names, so it
+ *  is counted and left unpriced rather than priced at the standard rate. */
+function speedShareOf(counters, speed) {
+  const shares = counters.s ??= {};
+  if (Object.hasOwn(shares, speed)) return shares[speed];
+  const key = Object.keys(shares).length < MAX_SPEEDS_PER_MODEL ? speed : UNRECOGNISED_SPEED;
+  if (!Object.hasOwn(shares, key)) shares[key] = zero();
+  return shares[key];
+}
+
 function zero() { return { i: 0, o: 0, cr: 0, cc: 0, c1h: 0, c5m: 0 }; }
 
 /** Local calendar day of a timestamp, `YYYY-MM-DD`. Local because that is the
@@ -227,7 +246,12 @@ export function foldLine(tally, line, timeline, from) {
   const key = who ? accountKey(who.email, who.orgUuid) : UNATTRIBUTED;
   const day = localDay(ts);
   const proj = (((tally[key] ??= {})[cwd] ??= {})[day] ??= {});
-  addInto(proj[model] ??= zero(), c);
+  const counters = addInto(proj[model] ??= zero(), c);
+  // A fast turn costs more than a standard one of the same model, and the
+  // board prices it so (#754). Kept as a share rather than a model of its own,
+  // so a row's tokens and its model read exactly as before.
+  const speed = billedSpeed(obj);
+  if (speed) addInto(speedShareOf(counters, speed), c);
 }
 
 /** Read the bytes of `path` from `start` to `size`, folding each COMPLETE line,
@@ -413,10 +437,11 @@ export function createProjectRollup({
       if (disk && disk.version === STATE_VERSION && disk.tally && disk.cursors) {
         state = disk;
         state.folders ??= {};
-      } else if (disk && (disk.version === 1 || disk.version === 2)) {
+      } else if (disk && (disk.version === 1 || disk.version === 2 || disk.version === 3)) {
         // Version 1 counted every API content block; version 2 keyed each row
-        // by the line's own cwd, a row per folder the agent cd'd into (#1278).
-        // Neither tally can be re-keyed, since it no longer knows which
+        // by the line's own cwd, a row per folder the agent cd'd into (#1278);
+        // version 3 kept no speed, so every fast turn read at the standard
+        // rate. None of them can be re-keyed, since it no longer knows which
         // transcript a count came from. Keep the heartbeat so a restart gap
         // remains fenced, but rebuild the tally from transcripts.
         state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, lastAlive: disk.lastAlive };

package/src/server/activation.mjs

@@ -18,31 +18,60 @@
 // never a time.
 //
 // The boot (bin/deck.js) is what knows the setup, and it reaches this module
-// through noteSetup. This file imports nothing, so the boot can load it early.
+// through noteSetup. A respawn installs the hooks only when the package changed,
+// so the supervisor carries the first boot's answer down to it (respawnHooksJob).
+// This file imports nothing, so the boot can load it early.
 
 /** Not known yet, until the boot says. */
 let setup = null;
 let settle;
 const known = new Promise(r => { settle = r; });
 
+/** What the boot can say about the Claude hooks. */
+const HOOK_STATES = ["ok", "failed", "off"];
+
+/** A hook job's answer as its token: null is "off" (not attempted), `{ ok }` is
+ *  "ok" or "failed", and a token — the one a respawn was handed down — is kept
+ *  when it is one. Anything else cannot be told, and is left out. */
+function hooksState(job) {
+  if (job == null) return "off";
+  if (typeof job === "string") return HOOK_STATES.includes(job) ? job : undefined;
+  return job.ok ? "ok" : "failed";
+}
+
 /**
  * What the boot set up. `claude` is the hook install job — a promise of null
- * (not attempted), `{ ok: true }` or `{ ok: false }` — or null when Claude is
- * not wanted; `codex` is whether the rollout watcher runs. Never throws, and a
- * job that rejects reads as "failed".
+ * (not attempted), `{ ok: true }` or `{ ok: false }`, or on a respawn the
+ * first boot's token (respawnHooksJob) — or null when Claude is not wanted;
+ * `codex` is whether the rollout watcher runs. Never throws, and a job that
+ * rejects reads as "failed". Resolves to the setup once it is known, for the
+ * boot to hand the hooks' answer to its supervisor.
  */
 export function noteSetup({ claude = null, codex = false } = {}) {
-  Promise.resolve(claude)
-    .then(
-      job => (job == null ? "off" : job.ok ? "ok" : "failed"),
-      () => "failed",
-    )
+  return Promise.resolve(claude)
+    .then(hooksState, () => "failed")
     .then(claudeHooks => {
-      setup = { claudeHooks, codexWatch: codex ? "on" : "off" };
+      setup = { codexWatch: codex ? "on" : "off" };
+      if (claudeHooks) setup.claudeHooks = claudeHooks;
       settle();
+      return { ...setup };
     });
 }
 
+/**
+ * A respawn's hook job, for noteSetup: what this process saw, never a success
+ * it did not. A respawn re-installs the hooks only when the package under the
+ * session has changed (respawnHooks, bin/cli/startup.js), and then it is that
+ * install's own answer. Otherwise it installed nothing, and the answer is the
+ * session's first boot's — `carried`, which the supervisor hands down in
+ * AGENTS_DECK_BOOT_HOOKS — or, under a supervisor that handed nothing down,
+ * none at all.
+ */
+export function respawnHooksJob({ wantClaude, reinstall, carried }) {
+  if (!wantClaude) return null;
+  return Promise.resolve(reinstall).then(job => job ?? String(carried ?? ""));
+}
+
 /** The setup facts, or none while the boot has not said. */
 export function setupFacts() {
   return setup ? { ...setup } : {};

package/src/server/app-host.mjs

@@ -20,6 +20,8 @@
 // Environment, not flags: the supervisor re-spawns the worker with its own
 // argv, and the environment is what both of them inherit unchanged.
 
+import { stableNodePath } from "./stable-node.mjs";
+
 /** "1" when the desktop app started this deck. */
 export const APP_ENV = "CCDECK_APP";
 
@@ -31,7 +33,10 @@ export function inApp(env = process.env) {
   return env[APP_ENV] === "1";
 }
 
-export function hookRuntime(env = process.env, execPath = process.execPath) {
+/** Outside the app, this node under the name an upgrade does not delete — see
+ *  stable-node.mjs. `execPath` is taken as given when a caller names one. */
+export function hookRuntime(env = process.env, execPath = undefined) {
   const given = env[HOOK_RUNTIME_ENV];
-  return typeof given === "string" && given.trim() ? given : execPath;
+  if (typeof given === "string" && given.trim()) return given;
+  return execPath ?? stableNodePath({ env });
 }

package/src/server/args.mjs

@@ -245,6 +245,9 @@ export function parseArgs(args) {
     else if (a === "--no-codex") out.noCodex = true;
     else if (a === "--claude") out.claude = true;
     else if (a === "--no-claude") out.noClaude = true;
+    // The ccdeck.dev page the command was copied from, for the first install
+    // report (install-ref.mjs). A value that is not a ref is dropped there.
+    else if (a === "--ref") set("ref", "a page name");
     else out.unknown.push(argv[i]);   // the token as typed, `=` half included
   }
   return out;

package/src/server/browser-watch-routes.mjs

@@ -45,30 +45,37 @@ export async function handleBrowserWatchSettings(req, res) {
   try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
   if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
 
-  const { readStore, updateStore, normalise } = await import(
+  const { updateStore, normalise } = await import(
     pathToFileURL(join(PKG_ROOT, "src/server/browser-watch-store.mjs")).href
   );
   const { invalidateBrowserWatchCache, noteWatchSetting } = await import(
     pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
   );
-  const store = await readStore();
-  // normalise() is the one place a value is judged, so a field this route has
-  // never heard of cannot arrive through it and a bad one falls back rather
-  // than reaching classify().
-  const settings = normalise({ ...store.settings, ...body });
   // `dismissed` carried forward, and it has to be spelled: writeStore takes a
   // whole state and writes exactly what it is handed, so a caller that omits
   // this field ERASES it. Measured — changing the reaction wiped every
   // dismissal, so every episode the reader had reviewed came straight back on
   // the next poll, from a settings change that had nothing to do with them.
-  // Only the settings are this route's to change. `updateStore` re-reads inside
-  // the write queue, so a poll that landed between the read above and this line
-  // cannot have its archive thrown away by a settings change — which is what
-  // writing a whole state read seconds earlier used to do.
-  await updateStore(cur => ({ ...cur, settings }));
+  // Only the settings are this route's to change.
+  //
+  // AND THE PATCH IS MERGED INSIDE THE JOB, against the state the queue hands
+  // in. Each control in the panel sends one field, and this used to read the
+  // store before the queue and build the whole settings object from that: a
+  // second change whose read came before the first one's write put the first
+  // field back — the watch switched off, the reaction changed straight after,
+  // and the watch was on again. Merged against `cur`, two one-field patches
+  // cannot lose each other, and neither can a poll's archive.
+  let before;
+  const { settings } = await updateStore(cur => {
+    before = cur.settings;
+    // normalise() is the one place a value is judged, so a field this route
+    // has never heard of cannot arrive through it and a bad one falls back
+    // rather than reaching classify().
+    return { ...cur, settings: normalise({ ...cur.settings, ...body }) };
+  });
   // The one line in the log that is somebody acting rather than the deck
   // reading, which is exactly why it is worth its own entry.
-  if (settings.enabled !== store.settings.enabled) {
+  if (settings.enabled !== before.enabled) {
     noteWatchSetting(settings.enabled ? "watch on — keeping its own copy" : "watch off — reading live only");
   } else {
     noteWatchSetting(`settings: quiet ${settings.quietMinutes}m, gap ${settings.gapMinutes}m`);
@@ -107,10 +114,10 @@ export async function handleBrowserWatchDismiss(req, res) {
   const { invalidateBrowserWatchCache, noteWatchSetting } = await import(
     pathToFileURL(join(PKG_ROOT, "src/server/browser-watch.mjs")).href
   );
-  // COMPUTED INSIDE THE JOB, like the settings route four lines up, whose
-  // comment says why: "updateStore re-reads inside the write queue, so a poll
-  // that landed between the read above and this line cannot have its archive
-  // thrown away." This read the whole `dismissed` array before the queue, so
+  // COMPUTED INSIDE THE JOB, like the settings route above, and for the same
+  // reason: updateStore re-reads inside the write queue, and only what is
+  // computed from that read can never be stale. This read the whole
+  // `dismissed` array before the queue, so
   // two Dismiss presses in one turn both read before either job ran and the
   // second wrote an array without the first key — both rows left the list,
   // both answered 200, and the first came back on the next ten-second poll.

package/src/server/browser-watch.mjs

@@ -278,8 +278,9 @@ function occupy(read) {
  *
  * It costs a `dig`, a `pgrep` per browser and an `lsof` per running one — up to
  * a dozen subprocesses — and none of what it reports moves quickly: a browser
- * does not get installed twice a minute. Thirty seconds is far below the
- * interval the badge polls on and far above the rate a person clicks Refresh.
+ * does not get installed twice a minute. Thirty seconds is far above the rate
+ * a person clicks Refresh. Only the panel's own reads come here: the badge's
+ * background poll does not survey (see browserWatchSnapshot).
  */
 const SURVEY_TTL_MS = 30_000;
 let surveyCache = { atMs: 0, rows: [] };
@@ -857,7 +858,12 @@ export async function browserWatchSnapshot({
   // database and can take a second.
   _checkedMs = now;
 
-  const browsers = await surveyBrowsers(platform, env, now, deps);
+  // THE SURVEY ONLY FOR SOMEBODY LOOKING. Its first step is a `dig` for the
+  // relay's address, a DNS query to whatever resolver the machine uses, which
+  // leaves the machine — and the badge's background poll reads none of what it
+  // finds, only the episodes and the switch. So that poll answers with the last
+  // survey the panel asked for, and asks nobody anything.
+  const browsers = readBrowsers ? await surveyBrowsers(platform, env, now, deps) : surveyCache.rows;
   // Two small reads, and the answer to the one question this panel exists
   // beside: whether somebody else's Claude Code can drive this browser (#799).
   const relay = await relayGuard(profiles, { platform, env, deps }).catch(() => null);

package/src/server/claude-accounts.mjs

@@ -42,7 +42,7 @@ import { withStoreLock } from "./store-lock.mjs";
 // read off the store. The roster puts them on each row; verdictNow and
 // verdictsNow are re-exported because cswap-admin.mjs and lan-deck.mjs reach
 // them through this module.
-import { verdictFor } from "./claude-verdicts.mjs";
+import { verdictFor, verdictsAskedAt } from "./claude-verdicts.mjs";
 export { verdictNow, verdictsNow } from "./claude-verdicts.mjs";
 // Asking claude-swap to collect, which every roster read does when something is
 // due, and when each account will next be read.
@@ -387,13 +387,20 @@ function originsNow() {
  * Local network — exactly what the mark must never be. Safe to decide off one
  * read: claude-swap replaces sequence.json whole (temp file and rename), and an
  * import refreshes a slot in place rather than removing it first. Asked of every
- * account in the store, not of the ordered list drawn above, and never of a
- * store with none: an emptied store is the one state where waiting costs
- * nothing.
+ * account in the store, not of the ordered list drawn above.
+ *
+ * AN EMPTIED STORE IS AN ANSWER TOO. Removing the last account leaves
+ * sequence.json with `accounts: {}`, and this used to be the one store the
+ * read waited out — but a mark kept there is inherited by the same address
+ * pasted from a share later, which then reads as one this deck signed in and
+ * is prompted for as one. Only a file that could not be read says nothing, and
+ * readRoster never gets this far with one. `held` that is not a map of slots is
+ * no store at all, and forgets nothing.
  */
 function tidyOrigins(origins, recovered, held) {
-  const present = new Set(Object.values(held ?? {}).map(a => accountKey(a?.email, a?.organizationUuid)));
-  const gone = present.size ? Object.keys(origins).filter(k => !present.has(k)) : [];
+  const isStore = held != null && typeof held === "object" && !Array.isArray(held);
+  const present = new Set(Object.values(isStore ? held : {}).map(a => accountKey(a?.email, a?.organizationUuid)));
+  const gone = isStore ? Object.keys(origins).filter(k => !present.has(k)) : [];
   if (!recovered.length && !gone.length) return;
   // `seen` rides along so the write changes only what this read judged: a mark
   // re-made, or an incident put off, since then is not this read's to undo.
@@ -530,7 +537,9 @@ function rosterRow({ seq, num, acct, row, identity, now, key, origin = null }) {
   ].filter(Boolean);
 
   const collector = verdictFor(num, now, acct.email, acct.organizationUuid);
-  const reauth = reauthFor({ entry: origin, trouble, collector, fetchedAt: fetchedAtMs, attemptedAt: attemptedAtMs });
+  const reauth = reauthFor({
+    entry: origin, trouble, collector, fetchedAt: fetchedAtMs, attemptedAt: attemptedAtMs, verdictAt: verdictsAskedAt(),
+  });
   return {
     num:      Number(num),
     email:    acct.email ?? null,
@@ -753,6 +762,17 @@ export function invalidateClaudeAccountsCache() {
   _lastReadAt = 0;
 }
 
+/**
+ * How many accounts the last roster read held, for the daily report's count
+ * (depth-facts.mjs): 0 when claude-swap is installed with nothing added, null
+ * before any read or when the read could not say. Answered from the cache —
+ * never starts a read, so the report costs claude-swap nothing.
+ */
+export function knownAccountCount() {
+  if (_cache?.ok && Array.isArray(_cache.accounts)) return _cache.accounts.length;
+  return _cache?.reason === "no_accounts" ? 0 : null;
+}
+
 /**
  * The slot an account argument names, as a number, or null when it names none.
  *

package/src/server/claude-verdicts.mjs

@@ -106,6 +106,10 @@ export async function verdictNow(email, org, { runner = run, bin = cswapBin } =
  * collection that can take a minute on a cold network.
  */
 async function collectVerdicts({ runner, bin }) {
+  // Stamped when the question was ASKED, not when it was answered. A
+  // collection that began before a sign-in reports on the login it began
+  // with, and the re-sign-in prompt must be able to tell (see verdictsAskedAt).
+  const asked = Date.now();
   try {
     const out = await runner(await bin(), ["list", "--json"], { timeout: VERDICT_TIMEOUT_MS });
     if (!out?.ok) return null;
@@ -119,7 +123,7 @@ async function collectVerdicts({ runner, bin }) {
         identities[String(a.number)] = accountKey(a.email, a.organizationUuid);
       }
     }
-    _verdicts = { at: Date.now(), byNum, identities };
+    _verdicts = { at: asked, byNum, identities };
     return (Array.isArray(d?.accounts) ? d.accounts : []).map(a => ({
       number: a?.number,
       email: String(a?.email ?? "").trim().toLowerCase(),
@@ -143,6 +147,13 @@ export function verdictsNow({ runner = run, bin = cswapBin, fresh = false } = {}
   return verdictQueue.ask({ fresh });
 }
 
+/** When the cached verdicts were asked for, in ms, or null before the first.
+ *  A verdict asked before the deck last signed an account in is about the
+ *  login that sign-in replaced — see reauthFor in account-origins.mjs. */
+export function verdictsAskedAt() {
+  return _verdicts.at > 0 ? _verdicts.at : null;
+}
+
 /** claude-swap's verdict for a slot, or null when there is none fresh enough. */
 export function verdictFor(num, now, email, org) {
   return cachedVerdictFor(_verdicts, num, now, email, org);

package/src/server/cli-versions.mjs

@@ -3,10 +3,12 @@
 //
 // SPAWNED, BUT NEVER ON THE BOOT PATH. claude-dir.mjs measured a Claude Code
 // child at ~3.0s and says out loud that boot is the wrong place to spend one, so
-// this is run once, lazily, in the background — reports.mjs kicks it from the
-// first check-in, which is already past boot — and its result rides along on the
-// reports that come after. A version that is not known yet is simply not sent;
-// the field is optional and the API records nothing for an absent one.
+// this runs in the background — reports.mjs starts it once the deck is listening
+// and the prefs say reports are on, and asks again on each new UTC day so a deck
+// left running reports the CLI it has now. The first report waits a few seconds
+// for the answer, beside the wait for the boot's setup, rather than going out
+// without it. A version that is not known by then is simply not sent; the field
+// is optional and the API records nothing for an absent one.
 //
 // WHAT LEAVES IS A VERSION AND NOTHING ELSE. parseVersion keeps only a
 // dotted-number token (with the `^[0-9A-Za-z.+_-]+$` shape the API enforces, and

package/src/server/codex-auth.mjs

@@ -13,6 +13,7 @@
 // new access token is never treated as success, and nothing here throws —
 // a rejected promise from a background poll would take the server down.
 import { readFile, chmod, unlink } from "node:fs/promises";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { CODEX_HOME } from "./codex-dir.mjs";
 import { createTemp, renameWithRetry, resolveWriteTarget } from "./atomic-write.mjs";
@@ -230,6 +231,16 @@ function refreshErrorCode(body) {
   return typeof raw === "string" ? raw.toLowerCase() : null;
 }
 
+// The last refresh token the endpoint refused for good, by hash — the token
+// itself is not kept. A refused token is dead until `codex login` replaces it,
+// and the expiry-driven path asks for a refresh on every poll once the access
+// token's `exp` has passed, so without this the same dead token was POSTed to
+// auth.openai.com once a minute for as long as the panel stayed open. Matched
+// against what auth.json holds at each attempt, so it lapses by itself the
+// moment the file carries a different one.
+let _refusedRefresh = null;
+const tokenHash = (token) => createHash("sha256").update(String(token)).digest("hex");
+
 /**
  * Spend the refresh token. Never throws — every failure is a return value,
  * because callers include a 60s background poll whose rejection would reach
@@ -262,6 +273,7 @@ async function doRefresh(auth) {
   if (!res.ok) {
     const code = refreshErrorCode(body);
     const permanent = (code && PERMANENT_CODES.has(code)) || res.status === 401;
+    if (permanent) _refusedRefresh = tokenHash(auth.tokens.refresh_token);
     return { ok: false, reason: permanent ? "refresh_rejected" : "refresh_failed", code };
   }
 
@@ -322,6 +334,9 @@ function refreshCredentials({ ifStale = false, staleAccessToken = null } = {}) {
     if (staleAccessToken && auth.tokens.access_token !== staleAccessToken) {
       return { ok: true, auth };  // someone else already rotated past it
     }
+    if (tokenHash(auth.tokens.refresh_token) === _refusedRefresh) {
+      return { ok: false, reason: "refresh_rejected", code: "refused_before" };
+    }
     return doRefresh(auth);
   });
 }
@@ -374,6 +389,20 @@ export async function getCodexAuth({ allowRefresh = true } = {}) {
   return identityFrom(auth, refreshed);
 }
 
+/**
+ * Which credential auth.json holds right now, as a hash of its two tokens, or
+ * null when it holds neither. Never the tokens themselves.
+ *
+ * For codex-quota.mjs, whose cooldown after a refused login is about the
+ * credential that was refused: `codex login` writes a new pair, and a wait
+ * that outlived it answered the user's ↻ with the old refusal.
+ */
+export async function codexCredentialFingerprint() {
+  const tokens = (await readAuthFile())?.tokens;
+  if (!tokens?.access_token && !tokens?.refresh_token) return null;
+  return tokenHash(`${tokens.access_token ?? ""}\n${tokens.refresh_token ?? ""}`);
+}
+
 /**
  * Refresh because the backend rejected a token that looked valid locally —
  * OpenAI revokes server-side, so the JWT's own `exp` is not the last word.