ccdeck 3.36.9 → 3.37.1

package/src/server/quota-oauth.mjs

@@ -9,7 +9,8 @@
 // self-poll floor; this module knows only how, and when a 429 says to stop.
 import { claudeConfigDir } from "./claude-dir.mjs";
 import { readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { createHash } from "node:crypto";
+import { join, win32 as winPath } from "node:path";
 import { mapOAuthUsage } from "./quota-shape.mjs";
 
 export const USAGE_URL   = "https://api.anthropic.com/api/oauth/usage";
@@ -100,6 +101,23 @@ export async function readOAuthToken() {
   }
 }
 
+/**
+ * Which token the credentials file holds, as a hash, or null when it holds
+ * none — expired or not, because this is a question of whose it is rather
+ * than whether it still works. The token itself is not kept.
+ *
+ * For quota.mjs, which stamps a reading with it so a held reading is not
+ * served after Claude Code has been signed in as somebody else.
+ */
+export async function credentialFingerprint() {
+  try {
+    const token = JSON.parse(await readFile(credentialsPath(), "utf8"))?.claudeAiOauth?.accessToken;
+    return typeof token === "string" && token ? createHash("sha256").update(token).digest("hex") : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * A cooldown from a `retry-after`, kept inside limits the deck can live with.
  *
@@ -136,23 +154,80 @@ export function cooldownFromHeader(raw, fallbackMs, minMs = 30_000, maxMs = 3600
  * answers this properly, with `api_key_mode` as its own reason and its own
  * sentence.
  *
- * Cheap and synchronous: environment first, because a machine configured for
- * Bedrock or Vertex says so there, then the presence of the OAuth block in the
- * credentials file. `readOAuthToken` above answers a different question — it
- * also rejects an EXPIRED token, and an expired subscription is still a
- * subscription.
+ * Cheap: configuration first, because a machine set up for Bedrock or Vertex
+ * says so there, then the presence of the OAuth block in the credentials file.
+ * `readOAuthToken` above answers a different question — it also rejects an
+ * EXPIRED token, and an expired subscription is still a subscription.
+ *
+ * THE CONFIGURATION IS CLAUDE CODE'S, not only this process's environment. The
+ * documented place for it is the `env` block of Claude Code's settings — user
+ * or managed — an API key can come from an `apiKeyHelper` there, and a deck
+ * started by the desktop app or a login item never sees the shell's exports at
+ * all. Reading process.env alone brought the two zero bars back on each of
+ * those machines. Values are read the way Claude Code reads them: "true",
+ * "yes" and "on" switch a provider on as well as "1".
+ *
+ * @param files Claude Code's settings files to read; claudeSettingsFiles() by
+ *   default, and a parameter so a test can name its own.
  */
-export async function hasSubscriptionCredential(env = process.env) {
-  if (env.CLAUDE_CODE_USE_BEDROCK === "1" || env.CLAUDE_CODE_USE_VERTEX === "1") return false;
+export async function hasSubscriptionCredential(env = process.env, files = claudeSettingsFiles()) {
+  const { cloud, apiKey } = await claudeSignIn(env, files);
+  if (cloud) return false;
   try {
     const raw = await readFile(credentialsPath(), "utf8");
     if (JSON.parse(raw)?.claudeAiOauth?.accessToken) return true;
   } catch { /* absent or unreadable, decided below */ }
-  // A key in the environment and no OAuth block beside it is the API-key
-  // install. Without either, this deck simply has not been signed in yet, and
-  // "sign in" is the right thing to say — which is the `waiting` branch, not
-  // this one.
-  return !(env.ANTHROPIC_API_KEY || env.ANTHROPIC_AUTH_TOKEN);
+  // A key — in an environment, or from a helper — and no OAuth block beside
+  // it is the API-key install. Without any, this deck simply has not been
+  // signed in yet, and "sign in" is the right thing to say — which is the
+  // `waiting` branch, not this one.
+  return !apiKey;
+}
+
+/**
+ * What Claude Code's configuration says about how it signs in, from `env` and
+ * the `env` blocks of its settings files, read as hasSubscriptionCredential
+ * explains: `cloud` when Bedrock or Vertex is switched on, `apiKey` when a key
+ * is set or an `apiKeyHelper` supplies one. The OAuth block in the credentials
+ * file is each caller's own question — it outranks a key, and only a cloud
+ * provider outranks it. Exported for the deck's own report of its plan
+ * (depth-facts.mjs), which has to answer the way the quota panel does.
+ */
+export async function claudeSignIn(env = process.env, files = claudeSettingsFiles()) {
+  const settings = await readSettings(files);
+  const envs = [env, ...settings.map(s => (s.env && typeof s.env === "object" ? s.env : {}))];
+  return {
+    cloud: envs.some(e => isOn(e.CLAUDE_CODE_USE_BEDROCK) || isOn(e.CLAUDE_CODE_USE_VERTEX)),
+    apiKey: settings.some(s => typeof s.apiKeyHelper === "string" && s.apiKeyHelper.trim())
+      || envs.some(e => e.ANTHROPIC_API_KEY || e.ANTHROPIC_AUTH_TOKEN),
+  };
+}
+
+/** On, as Claude Code reads a switch in its environment. */
+const isOn = (v) => /^(1|true|yes|on)$/i.test(String(v ?? "").trim());
+
+/**
+ * The settings files in which Claude Code can be told how to sign in: the
+ * user's, in its config dir, and the managed one an administrator deploys.
+ * Project settings are left out — a deck watches every project at once, and
+ * no one project's file speaks for the machine.
+ */
+export function claudeSettingsFiles(platform = process.platform, env = process.env) {
+  const managed = platform === "darwin" ? "/Library/Application Support/ClaudeCode/managed-settings.json"
+    : platform === "win32" ? winPath.join(env.ProgramFiles || "C:\\Program Files", "ClaudeCode", "managed-settings.json")
+    : "/etc/claude-code/managed-settings.json";
+  return [join(claudeConfigDir(env), "settings.json"), managed];
+}
+
+/** Each of `files` that parses as an object; a missing or broken one says nothing. */
+async function readSettings(files) {
+  const read = await Promise.all(files.map(async (f) => {
+    try {
+      const parsed = JSON.parse(await readFile(f, "utf8"));
+      return parsed && typeof parsed === "object" ? parsed : null;
+    } catch { return null; }
+  }));
+  return read.filter(Boolean);
 }
 
 /** The headers every request made with the Claude Code token sends. */

package/src/server/quota-shape.mjs

@@ -146,6 +146,20 @@ export function quotaFromStore(entry) {
   return out;
 }
 
+/**
+ * Whether a window this reading measured has reset since it was taken: its
+ * reset instant is at or before `now`, so the percentage beside it belongs to a
+ * window that is over, and a new one has started near empty.
+ *
+ * Both windows, because both end: a reading from before a weekly reset is as
+ * wrong about the week as one from before a 5-hour reset is about the session.
+ * A window with no reset instant cannot be said to have passed it.
+ */
+export function readingLapsed(reading, now) {
+  const past = (at) => typeof at === "number" && at * 1000 <= now;
+  return past(reading?.session5hResetAt) || past(reading?.week7dResetAt);
+}
+
 // Parse "Jun 18, 4:09pm" (local time, no tz) into unix seconds.
 // Claude shows times in the user's local timezone, so parsing as local is correct.
 // `now` is injectable so the year-boundary case is testable.
@@ -158,6 +172,20 @@ export function parseResetToSec(resetStr, now = Date.now()) {
       .replace(/(\d{1,2})(?::(\d{2}))?\s*(am|pm)/i,
                (_all, h, mm, ampm) => `${h}:${mm ?? "00"} ${ampm}`)
       .trim();
+    // A bare clock reading is what the CLI prints for a reset that falls
+    // today, and it has no date to find a year for: with one appended anyway,
+    // "4:09 pm 2027" reads as the first of January and the bar counted down
+    // to it. It means the next time that reading comes round — today, or
+    // tomorrow once today's has gone by. The CLI prints to the minute, so the
+    // minute it names is still today's.
+    const bare = /^(\d{1,2}):(\d{2}) (am|pm)$/i.exec(norm);
+    if (bare && +bare[1] >= 1 && +bare[1] <= 12 && +bare[2] < 60) {
+      const hour = (+bare[1] % 12) + (/pm/i.test(bare[3]) ? 12 : 0);
+      const d = new Date(now);
+      const on = (day) => new Date(d.getFullYear(), d.getMonth(), day, hour, +bare[2]).getTime();
+      const today = on(d.getDate());
+      return Math.floor((today + 60_000 <= now ? on(d.getDate() + 1) : today) / 1000);
+    }
     // The CLI prints no year, so we have to supply one. Stamping the current
     // year blindly puts a "Jan 2" reset read on Dec 30 eleven months in the
     // past, which hides the countdown and pins the pace marker at 100%. A

package/src/server/quota.mjs

@@ -53,12 +53,13 @@
 // quota-oauth.mjs's; running source 3 is quota-cli.mjs's; and the store path's
 // reset inventory is quota-store-resets.mjs's.
 import { activeAccountUsage, requestCollection } from "./claude-accounts.mjs";
-import { quotaFromStore, WIN_5H_SEC, WIN_7D_SEC } from "./quota-shape.mjs";
+import { quotaFromStore, readingLapsed, WIN_5H_SEC, WIN_7D_SEC } from "./quota-shape.mjs";
 import {
-  SELF_POLL_MS, clearCooldown, coolingDown, cooldownUntil, fetchOAuthUsage, hasSubscriptionCredential,
+  SELF_POLL_MS, clearCooldown, coolingDown, cooldownUntil, credentialFingerprint, fetchOAuthUsage,
+  hasSubscriptionCredential,
 } from "./quota-oauth.mjs";
 import {
-  accountOf, clearResetCreditsFloor, forgetResetCredits, heldResetCredits, refreshStoreResetCredits,
+  accountOf, clearResetCreditsFloor, forgetResetCredits, heldResetCredits, refreshStoreResetCredits, sameAccount,
 } from "./quota-store-resets.mjs";
 import { runUsageOnce, quotaClaudeBin } from "./quota-cli.mjs";
 
@@ -79,6 +80,7 @@ let _cache    = null;
 let _cacheAt  = 0;
 let _inflight = null;   // deduplicates concurrent CLI probes
 let _lastGood = null;   // last result that had real quota percentages
+let _lastGoodFor = null; // whose it is — see readFor()
 let _lastSelfPollAt = 0;
 // Which account the readings below are about — as a counter, because the
 // account's identity is not something this module holds. invalidateQuotaCache
@@ -149,7 +151,9 @@ export const QUOTA_DEADLINE_MS = 5_000;
  */
 export async function fetchClaudeQuota({ force = false, deadlineMs = 0 } = {}) {
   const now = Date.now();
-  if (!force && _cache && now - _cacheAt < CACHE_MS) return _cache;
+  // Not a reading whose window has reset since it was cached, though: inside
+  // the minute it is still the newest answer, and it is no longer a true one.
+  if (!force && _cache && now - _cacheAt < CACHE_MS && !readingLapsed(_cache, now)) return _cache;
 
   // If another CLI probe is already in flight, wait for it instead of spawning a
   // second concurrent process (which can return empty output and overwrite the
@@ -242,14 +246,41 @@ function notYet(now) {
  * survives the result cache's minute and comes back under a "stale" label for as
  * long as the store has nothing to say about the new account.
  */
-function publish(gen, result, at, { good = false } = {}) {
+function publish(gen, result, at, { good = false, who = null } = {}) {
   if (gen !== _generation) return result;
   _cache   = result;
   _cacheAt = at;
-  if (good) _lastGood = result;
+  if (good) { _lastGood = result; _lastGoodFor = who; }
   return result;
 }
 
+/**
+ * Whose numbers a read that starts now will be: claude-swap's active account
+ * when its store names one, and the token in Claude Code's credentials file.
+ *
+ * invalidateQuotaCache covers the switches the deck makes itself. The rest —
+ * `cswap switch` in a terminal, claude-swap's own auto-switch, `claude /login`
+ * as somebody else — reach nothing here, and the self-poll floor went on
+ * serving the previous account's `_lastGood` for up to five minutes, beside an
+ * accounts panel that already showed the new account as live. So `_lastGood`
+ * carries this, and a read that finds it changed does not serve it.
+ */
+async function readFor(store) {
+  return { account: _accountOfReading.get(store) ?? null, token: await credentialFingerprint() };
+}
+
+/**
+ * Whether the account in use is no longer the one `then` was read for. The
+ * account decides whenever both sides name one: a token is refreshed under
+ * the same account every few hours, and that is not a switch. Without one,
+ * a different token is the only sign there is.
+ */
+function switchedSince(then, now) {
+  if (!then) return false;
+  if (then.account && now.account) return !sameAccount(then.account, now.account);
+  return !!(then.token && now.token && then.token !== now.token);
+}
+
 /**
  * claude-swap's numbers for the active account, if it has any.
  *
@@ -363,9 +394,17 @@ async function _doFetch(now, force = false, gen = _generation) {
   // Refresh asks for newer numbers, and the honest way to get them from this
   // source is to ask the collector that owns it — which applies its own
   // schedule and backoff, so this cannot become a poll loop.
-  if (force && (!store || now - store.fetchedAt > FORCE_POLL_MS)) {
+  if (force && (!store || now - store.fetchedAt > FORCE_POLL_MS || readingLapsed(store, now))) {
     store = await nudgeAndReread(store);
   }
+  // A reading held over from an earlier read is only ever served for the
+  // account it was read for; see readFor. When the account has moved, the read
+  // that answers for the new one may go out on the refresh button's floor:
+  // the question is new, and it can be asked at most once per reading held.
+  const who = await readFor(store);
+  const switched = _lastGood != null && switchedSince(_lastGoodFor, who);
+  if (switched) { _lastGood = null; _lastGoodFor = null; }
+
   if (store && now - store.fetchedAt <= STORE_TRUSTED_MS) {
     // Keep the store moving even when the accounts panel is closed. Without
     // this the numbers only advance while something else asks — claude-swap's
@@ -373,15 +412,23 @@ async function _doFetch(now, force = false, gen = _generation) {
     // throttle inside is shared with the accounts panel, so two open panels
     // ask no more often than one.
     if (!force) requestCollection().catch(() => {});
-    // The saved limit resets are the one thing the store cannot say. Read
-    // behind this answer, never in front of it; see refreshStoreResetCredits.
-    refreshStoreResetCredits({ now, force, account: _accountOfReading.get(store) });
-    return publish(gen, store, now, { good: true });
+    // A row collected before its window reset is recent and still wrong: the
+    // 45 minutes it is trusted for are long enough to hold a 5-hour reset,
+    // and claude-swap's rows get that old exactly when its collector is
+    // backing off. It is not the answer, so the read goes on below like one
+    // for a row that is too old, and the row stays to be held if nothing
+    // newer turns up.
+    if (!readingLapsed(store, now)) {
+      // The saved limit resets are the one thing the store cannot say. Read
+      // behind this answer, never in front of it; see refreshStoreResetCredits.
+      refreshStoreResetCredits({ now, force, account: _accountOfReading.get(store) });
+      return publish(gen, store, now, { good: true, who });
+    }
   }
 
   // Nothing usable in the store. Everything below spends the user's budget, so
   // it happens on a floor, and not at all while a 429 cooldown is running.
-  if (!maySelfPoll({ now, force, lastSelfPollAt: _lastSelfPollAt, rateLimitedUntil: cooldownUntil() })) {
+  if (!maySelfPoll({ now, force: force || switched, lastSelfPollAt: _lastSelfPollAt, rateLimitedUntil: cooldownUntil() })) {
     // A stale row still beats an empty panel, and says how stale it is — but
     // it must be the freshest thing we hold, not just the store. Preferring
     // the store here threw away readings we had already paid for: after a boot
@@ -398,7 +445,7 @@ async function _doFetch(now, force = false, gen = _generation) {
   // Source 2: OAuth usage API — instant, exact, no cold-start gap.
   const api = await fetchOAuthUsage();
   if (api) {
-    return publish(gen, { ok: true, ...api, source: "api", fetchedAt: now }, now, { good: true });
+    return publish(gen, { ok: true, ...api, source: "api", fetchedAt: now }, now, { good: true, who });
   }
 
   // Source 3: parse `claude --print /usage` CLI output.
@@ -406,7 +453,7 @@ async function _doFetch(now, force = false, gen = _generation) {
 
   // Got real quota lines — cache normally and remember as last-known-good.
   if (parsed) {
-    return publish(gen, { ok: true, ...parsed, source: "cli", fetchedAt: now }, now, { good: true });
+    return publish(gen, { ok: true, ...parsed, source: "cli", fetchedAt: now }, now, { good: true, who });
   }
 
   // No quota lines after retries. If we've ever seen real values, keep showing
@@ -415,9 +462,12 @@ async function _doFetch(now, force = false, gen = _generation) {
   // now" over percentages collected hours earlier for one poll in five, then let
   // the label snap back to the true age: an age indicator that oscillates, and
   // vouches for numbers this branch already knows are stale. Short-cache so we
-  // retry the CLI again soon.
-  if (_lastGood) {
-    return publish(gen, { ..._lastGood, stale: true }, shortLived(now));
+  // retry the CLI again soon. The store's row is a candidate too, as it is on
+  // the floor above: a row passed over because its window reset is still the
+  // last thing claude-swap read, and stale says what it is.
+  const held = freshest(store, _lastGood);
+  if (held) {
+    return publish(gen, { ...held, stale: true }, shortLived(now));
   }
 
   // Never had good data. A CLI that RAN and printed no quota lines is two
@@ -498,6 +548,7 @@ export function invalidateQuotaCache() {
   _cache = null;
   _cacheAt = 0;
   _lastGood = null;
+  _lastGoodFor = null;
   _generation++;
   _inflight = null;
   // Forgotten with the rest, because it is about the account the deck just

package/src/server/rating.mjs

@@ -0,0 +1,87 @@
+// The one question the deck asks about itself: "How useful is ccdeck to you?",
+// 0 to 10, once, after about a week of use.
+//
+// WHEN. Only once the deck has heard a session on RATING_AFTER_DAYS different
+// days (usage-day.mjs keeps that count), only while reports are on — the answer
+// is a report, and a deck that sends none has nobody to tell — and never in the
+// first minutes after a launch, when the board is filling and the person came
+// to look at their sessions, not at us. The page also waits for no dialog to be
+// open (use-rating-ask.ts).
+//
+// HOW OFTEN. "Not now" puts it off by RATING_AGAIN_AFTER_MS, once. A second
+// "Not now", or an answer, and it is never asked again — even after a 3.36.x
+// deck sharing the data dir rewrites prefs.json without it: the outcome is kept
+// a second time beside that file (reports.mjs ratingFile).
+//
+// WHAT LEAVES. The number picked and how many days the deck had been used, as a
+// range (daysUsedBucket) — a "rated" event, sent once (reports.mjs). Nothing
+// about a question left unanswered or put off.
+//
+// Imports nothing, so deck-prefs.mjs can normalise with it.
+
+/** Days the deck has to have been used on before it asks. */
+export const RATING_AFTER_DAYS = 7;
+
+/** How long "Not now" puts the question off: thirty days. */
+export const RATING_AGAIN_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
+
+/** How long after a launch the question waits: the launch is the busy minute. */
+export const RATING_AFTER_LAUNCH_MS = 5 * 60 * 1000;
+
+/** How many times "Not now" may be said before the question stops for good. */
+const LATER_LIMIT = 2;
+
+/** What prefs.json keeps about the question, coerced: the answer (null until
+ *  there is one), whether it went out, and how often and when it was put off. */
+export function normaliseRating(raw) {
+  const src = raw && typeof raw === "object" ? raw : {};
+  const score = Number.isInteger(src.score) && src.score >= 0 && src.score <= 10 ? src.score : null;
+  const later = Number.isInteger(src.later) && src.later > 0 ? Math.min(src.later, LATER_LIMIT) : 0;
+  return {
+    score,
+    sent: score !== null && src.sent === true,
+    later,
+    laterAt: typeof src.laterAt === "string" && !Number.isNaN(Date.parse(src.laterAt)) ? src.laterAt : "",
+  };
+}
+
+/** How far the question has got: put off none, once or twice, then answered,
+ *  then answered and sent. Of two copies of it, the further one is the truth —
+ *  nothing ever moves it back. */
+export function ratingStage(rating) {
+  const r = normaliseRating(rating);
+  if (r.score === null) return r.later;
+  return r.sent ? LATER_LIMIT + 2 : LATER_LIMIT + 1;
+}
+
+/** A score the page may send: a whole number from 0 to 10, else null. */
+export function scoreOf(value) {
+  return Number.isInteger(value) && value >= 0 && value <= 10 ? value : null;
+}
+
+/** How long the deck had been used when it was rated, as the range the API
+ *  keeps — never the count itself. */
+export function daysUsedBucket(days) {
+  if (!Number.isInteger(days) || days < 7) return "1-6";
+  if (days < 14) return "7-13";
+  if (days < 30) return "14-29";
+  if (days < 90) return "30-89";
+  return "90+";
+}
+
+/**
+ * Is it time to ask? The saved state of the question, the days used so far, the
+ * time now, and how long this deck has been up. The reports switch is the
+ * caller's (reports.mjs), because only it knows the veto.
+ */
+export function ratingDue(rating, daysUsed, now, uptimeMs) {
+  const r = normaliseRating(rating);
+  if (r.score !== null || r.later >= LATER_LIMIT) return false;
+  if (!Number.isInteger(daysUsed) || daysUsed < RATING_AFTER_DAYS) return false;
+  if (!(uptimeMs >= RATING_AFTER_LAUNCH_MS)) return false;
+  if (r.later > 0) {
+    const at = Date.parse(r.laterAt);
+    if (Number.isNaN(at) || now.getTime() - at < RATING_AGAIN_AFTER_MS) return false;
+  }
+  return true;
+}

package/src/server/reports-routes.mjs

@@ -1,5 +1,5 @@
-// The page's ways into reports.mjs (#1853): an error the page caught and the
-// feedback dialog. (The switch in Appearance went on 2026-10-01; its route stays.) The page never
+// The page's ways into reports.mjs (#1853): an error the page caught, the
+// feedback dialog, and the one question the deck asks about itself. (The switch in Appearance went on 2026-10-01; its route stays.) The page never
 // talks to api.ccdeck.dev itself — this server does, which is also why the
 // install id never has to reach the page.
 
@@ -28,6 +28,25 @@ export async function handleReportsWrite(req, res, { report = reporter } = {}) {
   return send(res, 200, { ok: true, reports: heldPrefs.current().reports, reportsVetoed: reportsVetoed() });
 }
 
+/** `GET /api/rating`: whether the page should ask "How useful is ccdeck to
+ *  you?" now (rating.mjs says when). Nothing leaves the machine. */
+export function handleRatingRead(_req, res, { report = reporter } = {}) {
+  return send(res, 200, { ok: true, ask: report.ratingAsk() });
+}
+
+/** `POST /api/rating` `{ score }` or `{ later: true }`: the question answered,
+ *  0 to 10, or put off. An answer is sent on as a "rated" report; "Not now" is
+ *  kept here and goes nowhere. 409 when there is nothing to keep it under —
+ *  reports off, or already answered. */
+export async function handleRatingWrite(req, res, { report = reporter } = {}) {
+  const body = await readJson(req, res, 1_000);
+  if (body?.later === true) {
+    return (await report.rateLater()) ? send(res, 200, { ok: true }) : send(res, 409, { ok: false, reason: "not_asking" });
+  }
+  if (!Number.isInteger(body?.score) || body.score < 0 || body.score > 10) return send(res, 400, { ok: false, reason: "bad_request" });
+  return (await report.rate(body.score)) ? send(res, 200, { ok: true }) : send(res, 409, { ok: false, reason: "not_asking" });
+}
+
 /** `POST /api/client-error` `{ message, stack? }`: an error the page caught. Sent on only while reports are on. */
 export async function handleClientError(req, res, { report = reporter } = {}) {
   const body = await readJson(req, res, 16_000);