ccdeck 3.38.2 → 3.38.4

package/src/server/account-projects.mjs

@@ -33,7 +33,9 @@ import { readSwapLog, accountAtTime, trackedSince, seedActive, markGap } from ".
 // and a session's card cannot disagree about which lines billed anything, nor
 // about the speed they were billed at — see transcript-scan.mjs.
 import {
-  billedSpeed, hasSpend, MAX_SPEEDS_PER_MODEL, repeatsRequestUsage, UNRECOGNISED_SPEED,
+  billedSpeed, hasSpend, MAX_SPEEDS_PER_MODEL, UNRECOGNISED_SPEED,
+  requestBilling, newRequestLedger, noteRequestRecord, streamingRequestId,
+  BILL_LINE, REBILL_REQUEST, SKIP_LINE,
 } from "./transcript-scan.mjs";
 
 /** The pseudo-account for messages the swap log cannot place — everything
@@ -41,7 +43,7 @@ import {
  *  a per-account total is never quietly inflated by work that is not that
  *  account's. A NUL keeps it from ever colliding with a real `email@@org` key. */
 export const UNATTRIBUTED = "\u0000unattributed";
-const STATE_VERSION = 4;
+const STATE_VERSION = 6;
 
 /** Where the tally and cursors live, beside cswap-auto's own state. */
 export function statePath(home = homedir()) {
@@ -104,6 +106,16 @@ function addInto(dst, src) {
   return dst;
 }
 
+/** Take `src`'s six counters back out of `dst`. */
+function takeFrom(dst, src) {
+  dst.i -= src.i; dst.o -= src.o; dst.cr -= src.cr;
+  dst.cc -= src.cc; dst.c1h -= src.c1h; dst.c5m -= src.c5m;
+}
+
+function isZero(c) {
+  return !c.i && !c.o && !c.cr && !c.cc && !c.c1h && !c.c5m;
+}
+
 /** The share of `counters` billed at `speed` (#754), created on first sight:
  *  `s[speed]`, a SUBSET of the counters it sits on, the way the 1h/5m split is
  *  of `cc`, so the totals read exactly as they did and the client prices the
@@ -112,11 +124,18 @@ function addInto(dst, src) {
  *  past the cap is kept as UNRECOGNISED_SPEED, which no rate table names, so it
  *  is counted and left unpriced rather than priced at the standard rate. */
 function speedShareOf(counters, speed) {
+  const key = speedShareKey(counters, speed);
+  return counters.s[key];
+}
+
+/** The key `speed`'s share is kept under in `counters`, the share created on
+ *  first sight — see speedShareOf. */
+function speedShareKey(counters, speed) {
   const shares = counters.s ??= {};
-  if (Object.hasOwn(shares, speed)) return shares[speed];
+  if (Object.hasOwn(shares, speed)) return speed;
   const key = Object.keys(shares).length < MAX_SPEEDS_PER_MODEL ? speed : UNRECOGNISED_SPEED;
   if (!Object.hasOwn(shares, key)) shares[key] = zero();
-  return shares[key];
+  return key;
 }
 
 function zero() { return { i: 0, o: 0, cr: 0, cc: 0, c1h: 0, c5m: 0 }; }
@@ -223,22 +242,32 @@ export function projectPath(cwd) {
  *
  * `timeline` is the sorted swap log; the account is whoever it says was active
  * at this line's timestamp, or UNATTRIBUTED when the timestamp precedes it.
- * `from` names the transcript's project directory — see folderOf.
+ * `from` names the transcript's project directory — see folderOf — and, as
+ * `requests` and `path`, where what this file has read of its requests is kept
+ * between passes: the newest request record, which a resumed subagent's replay
+ * of its history is told apart by, and the request still waiting on a final
+ * record (newRequestLedger in transcript-scan.mjs).
  */
 export function foldLine(tally, line, timeline, from) {
   if (!line || !line.includes('"usage"')) return;
   let obj = null;
   try { obj = JSON.parse(line); } catch { return; }
-  // Claude writes one assistant record for each content block in a request,
-  // and every block repeats the request's usage, so only block 0 is billable
-  // — see repeatsRequestUsage.
-  if (repeatsRequestUsage(obj)) return;
+  // A request is billed once, from its final record, which in a subagent's
+  // file follows a streaming snapshot, and not again when a resumed subagent
+  // restates it — see requestBilling. A call that keeps no requests for the
+  // file never sees one replaced or restated, and bills block 0.
+  const requests = from?.requests ?? null;
+  const ledger = requests?.[from.path] ?? null;
+  const billing = requestBilling(obj, ledger);
+  if (requests && billing !== BILL_LINE) noteRequestRecord(requests[from.path] ??= newRequestLedger(), obj);
+  if (billing === SKIP_LINE) return;
   const usage = obj?.message?.usage;
   if (!usage || typeof usage !== "object") return;
   const ts = Date.parse(obj?.timestamp);
   if (!Number.isFinite(ts)) return;
   const c = countersFrom(usage);
   if (!hasSpend(asUsageTotals(c))) return;   // a usage block that billed nothing
+  if (billing === REBILL_REQUEST) refund(tally, ledger.streaming);
   const model = typeof obj?.message?.model === "string" ? obj.message.model : "";
   const lineCwd = (typeof obj?.cwd === "string" && obj.cwd) ? obj.cwd : "";
   const cwd = projectPath(folderOf(lineCwd, from));   // a worktree counts under the repo it checks out
@@ -251,7 +280,40 @@ export function foldLine(tally, line, timeline, from) {
   // board prices it so (#754). Kept as a share rather than a model of its own,
   // so a row's tokens and its model read exactly as before.
   const speed = billedSpeed(obj);
-  if (speed) addInto(speedShareOf(counters, speed), c);
+  const share = speed ? speedShareKey(counters, speed) : null;
+  if (share) addInto(counters.s[share], c);
+  if (billing === REBILL_REQUEST) dropIfEmpty(tally, ledger.streaming);
+  if (billing === BILL_LINE || !requests) return;
+  // What a request still streaming was charged, and where, so its final
+  // record can take that back, in this pass or a later one.
+  const id = streamingRequestId(obj);
+  requests[from.path].streaming = id === null ? null : { id, at: [key, cwd, day, model], s: share, c };
+}
+
+/** Take a streaming request's charge back out of the row it was charged to,
+ *  for its later record to charge in its place. A row pruned since has
+ *  nothing left to take back. */
+function refund(tally, { at: [key, cwd, day, model], s, c }) {
+  const counters = tally[key]?.[cwd]?.[day]?.[model];
+  if (!counters) return;
+  takeFrom(counters, c);
+  if (s && counters.s?.[s]) takeFrom(counters.s[s], c);
+}
+
+/** Remove what a refund left at zero — a speed share, or a whole row whose
+ *  request's final record landed on another day or account — so the report
+ *  never lists an empty row. */
+function dropIfEmpty(tally, { at: [key, cwd, day, model], s }) {
+  const days = tally[key]?.[cwd];
+  const counters = days?.[day]?.[model];
+  if (!counters) return;
+  if (s && counters.s?.[s] && isZero(counters.s[s])) delete counters.s[s];
+  if (counters.s && !Object.keys(counters.s).length) delete counters.s;
+  if (!isZero(counters)) return;
+  delete days[day][model];
+  if (!Object.keys(days[day]).length) delete days[day];
+  if (!Object.keys(days).length) delete tally[key][cwd];
+  if (!Object.keys(tally[key]).length) delete tally[key];
 }
 
 /** Read the bytes of `path` from `start` to `size`, folding each COMPLETE line,
@@ -423,7 +485,7 @@ export function createProjectRollup({
   setInterval: setIv = setInterval,
   clearInterval: clearIv = clearInterval,
 } = {}) {
-  let state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {} };
+  let state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, requests: {} };
   let timer = null;
   let running = false;
   let dirty = false;
@@ -437,14 +499,19 @@ export function createProjectRollup({
       if (disk && disk.version === STATE_VERSION && disk.tally && disk.cursors) {
         state = disk;
         state.folders ??= {};
-      } else if (disk && (disk.version === 1 || disk.version === 2 || disk.version === 3)) {
+        state.requests ??= {};
+      } else if (disk && [1, 2, 3, 4, 5].includes(disk.version)) {
         // Version 1 counted every API content block; version 2 keyed each row
         // by the line's own cwd, a row per folder the agent cd'd into (#1278);
         // version 3 kept no speed, so every fast turn read at the standard
-        // rate. None of them can be re-keyed, since it no longer knows which
-        // transcript a count came from. Keep the heartbeat so a restart gap
-        // remains fenced, but rebuild the tally from transcripts.
-        state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, lastAlive: disk.lastAlive };
+        // rate; version 4 billed a subagent's request from its streaming
+        // snapshot, most of its output and its speed missing (#1883); version
+        // 5 billed a resumed subagent's request again each time its file
+        // restated its history. None of them can be re-keyed, since it no
+        // longer knows which transcript a count came from. Keep the heartbeat
+        // so a restart gap remains fenced, but rebuild the tally from
+        // transcripts.
+        state = { version: STATE_VERSION, cursors: {}, tally: {}, folders: {}, requests: {}, lastAlive: disk.lastAlive };
         dirty = true;
       }
     } catch { /* first run: empty state */ }
@@ -474,9 +541,9 @@ export function createProjectRollup({
     // resync the cursor to the current end: the replaced content is lost, never
     // counted twice. Transcripts append and do not shrink in normal use, so this
     // is the rare, safe side to err on.
-    if (st.size < offset) { state.cursors[path] = st.size; dirty = true; return; }
+    if (st.size < offset) { state.cursors[path] = st.size; delete state.requests[path]; dirty = true; return; }
     if (st.size <= offset) return;
-    const from = { slug, folders: state.folders };
+    const from = { slug, folders: state.folders, requests: state.requests, path };
     let fh = null;
     try {
       fh = await open(path, "r");
@@ -504,9 +571,11 @@ export function createProjectRollup({
       const timeline = await readSwapLog(swapLog);
       const files = await listTranscripts(roots);
       for (const [path, slug] of files) await foldFile(path, slug, timeline);
-      // Forget cursors for files that are gone, and the folders of project
-      // directories with no transcript left, so neither map grows forever.
+      // Forget the cursors and request ledgers of files that are gone, and
+      // the folders of project directories with no transcript left, so none of
+      // the three maps grows forever.
       for (const p of Object.keys(state.cursors)) if (!files.has(p)) { delete state.cursors[p]; dirty = true; }
+      for (const p of Object.keys(state.requests)) if (!files.has(p)) { delete state.requests[p]; dirty = true; }
       const slugs = new Set(files.values());
       for (const s of Object.keys(state.folders)) if (!slugs.has(s)) { delete state.folders[s]; dirty = true; }
       // Heartbeat: record that the deck was alive now, so a later boot can see

package/src/server/account-watch.mjs

@@ -0,0 +1,169 @@
+// The account notifier this process runs: where its records live, what reads
+// quota for it while no page does, and the doors the rest of the server reaches
+// it through.
+//
+// The decisions are account-notify.mjs's. This file is the wiring around them,
+// kept light on purpose: event-pipeline.mjs connects it as the server module
+// loads, and the auto-switch loop reports every tick to it, so everything heavy
+// it uses — the two quota modules and the accounts store — is reached by
+// `import()` and only when a reading is wanted. Those three are pinned with the
+// rest (pinned-build.mjs).
+//
+// NOTHING HERE MAY COST A POLL OR A TICK. Every door returns at once and does
+// its work on a promise that is caught; a notification that cannot be raised,
+// a record that cannot be written and a store that cannot be read all end as
+// a line on stderr at most.
+import { readFile, mkdir } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import {
+  claudeAccountKey, claudeWindows, codexAccountKey, codexWindows, createAccountNotifier,
+} from "./account-notify.mjs";
+import { deckDataDir } from "./deck-home.mjs";
+import { writeFileAtomic } from "./atomic-write.mjs";
+
+const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+/** Where the records are kept: beside prefs.json, in the deck's own data. */
+export function recordsPath(home = deckDataDir()) {
+  return join(home, "account-notify.json");
+}
+
+/**
+ * How often quota is read for the notifier while it wants readings.
+ *
+ * Only while the threshold or the reset switch is on — both start off — and
+ * every read goes through the same caches and floors as the Usage panel's, so
+ * with a page open this adds nothing and with none it costs half of what an
+ * open page does.
+ */
+export const WATCH_MS = 2 * 60_000;
+
+let _deps = null;
+let _notifier = null;
+let _autoOn = false;
+let _timer = null;
+let _watching = null;
+
+/**
+ * Hand the notifier its OS call, its product name and its switches. Called
+ * once, as the server module loads; until it is, every door below is a no-op —
+ * which is what keeps a test that drives the auto-switch loop on its own from
+ * writing records or raising anything.
+ */
+export function connectAccountNotify({ notify, settings, product, onError }) {
+  _deps = { notify, settings, product, onError };
+}
+
+function notifier() {
+  if (_notifier || !_deps) return _notifier;
+  const path = recordsPath();
+  _notifier = createAccountNotifier({
+    notify: _deps.notify,
+    settings: _deps.settings,
+    product: _deps.product,
+    onError: _deps.onError,
+    load: async () => {
+      try { return JSON.parse(await readFile(path, "utf8")); } catch { return null; }
+    },
+    save: async records => {
+      await mkdir(dirname(path), { recursive: true });
+      await writeFileAtomic(path, `${JSON.stringify(records)}\n`);
+    },
+  });
+  _notifier.autoSwitch(_autoOn);
+  return _notifier;
+}
+
+/** The deck's auto-switch loop was switched on or off (cswap-auto-loop.mjs). */
+export function noteAutoSwitch(enabled) {
+  _autoOn = enabled === true;
+  try { _notifier?.autoSwitch(_autoOn); } catch { /* never the loop's problem */ }
+}
+
+/**
+ * A finished tick of the deck's own auto-switch loop. The only way a swap
+ * notification is raised: a switch somebody pressed never comes through here.
+ * After a switch, claude-swap's roster is read for the two accounts' names and
+ * keys — the store, which the deck already reads, rather than anything more out
+ * of the tick's own output.
+ */
+export function noteAutoTick(result) {
+  const n = notifier();
+  if (!n || !result) return Promise.resolve();
+  return (result.switched ? storeAccounts() : Promise.resolve(null))
+    .then(accounts => n.tick(result, accounts))
+    .catch(() => {});
+}
+
+/** claude-swap's roster, number → `{ email, organizationUuid, alias }`, or null. */
+async function storeAccounts() {
+  try {
+    const { backupRoot } = await import(pathToFileURL(join(PKG_ROOT, "src/server/claude-accounts.mjs")).href);
+    const seq = JSON.parse(await readFile(join(backupRoot(), "sequence.json"), "utf8"));
+    return seq?.accounts && typeof seq.accounts === "object" ? seq.accounts : null;
+  } catch {
+    return null;
+  }
+}
+
+/** What the deck calls a Claude account: its alias in claude-swap, else its
+ *  address. */
+function claudeName(account, accounts) {
+  const entry = Object.values(accounts ?? {}).find(a =>
+    typeof a?.email === "string" && a.email.toLowerCase() === account.email.toLowerCase()
+    && a.organizationUuid === account.organizationUuid);
+  const alias = typeof entry?.alias === "string" ? entry.alias.trim() : "";
+  return alias || account.email;
+}
+
+async function observeClaude(n) {
+  const quota = await import(pathToFileURL(join(PKG_ROOT, "src/server/quota.mjs")).href);
+  const reading = await quota.fetchClaudeQuota();
+  const who = quota.quotaAccount(reading);
+  const key = who ? claudeAccountKey(who.email, who.organizationUuid) : null;
+  if (!key) return;
+  await n.observe("claude", { key, name: claudeName(who, await storeAccounts()) }, claudeWindows(reading));
+}
+
+async function observeCodex(n) {
+  const quota = await import(pathToFileURL(join(PKG_ROOT, "src/server/codex-quota.mjs")).href);
+  const reading = await quota.fetchCodexQuota();
+  const who = quota.codexQuotaAccount(reading);
+  const key = who ? codexAccountKey(who.accountId, who.email) : null;
+  if (!key) return;
+  await n.observe("codex", { key, name: who.email || null }, codexWindows(reading));
+}
+
+/**
+ * One look at the live accounts' quota, when a switch wants it. One at a time:
+ * a Claude read can take a while, and the next interval joins it rather than
+ * stacking a second behind it.
+ */
+export function watchOnce(providers) {
+  if (_watching) return _watching;
+  const s = _deps?.settings?.();
+  const n = notifier();
+  if (!n || !s || (!s.quota && !s.reset)) return Promise.resolve();
+  const { claude = true, codex = true } = providers?.() ?? {};
+  _watching = (async () => {
+    // A failed read is the quota modules' to report, and the Usage panel says
+    // it; here it only means there is nothing to compare this time.
+    if (claude) await observeClaude(n).catch(() => {});
+    if (codex) await observeCodex(n).catch(() => {});
+  })().finally(() => { _watching = null; });
+  return _watching;
+}
+
+/**
+ * Start reading quota on a timer, from startServer once the port is bound —
+ * never at import, because a launcher imports the server module only to ask
+ * whether a deck is already up. Unref'd like every other timer the deck keeps.
+ */
+export function startAccountWatch({ providers } = {}) {
+  if (_timer) return;
+  _timer = setInterval(() => { watchOnce(providers).catch(() => {}); }, WATCH_MS);
+  _timer.unref?.();
+  const first = setTimeout(() => { watchOnce(providers).catch(() => {}); }, 15_000);
+  first.unref?.();
+}

package/src/server/codex-quota.mjs

@@ -498,6 +498,19 @@ async function doFetchCodexQuota() {
   };
 
   result.resetCredits = await fetchResetCredits(base, auth);
+  _accountOfQuota.set(result, { accountId: auth.accountId ?? null, email: result.email });
 
   return finish(result);
 }
+
+// Which account a reading was taken for — the ChatGPT account id and the
+// address — kept beside it rather than on it, as quota.mjs keeps Claude's, so
+// the panel is sent nothing new. A reading held over and re-served as stale is
+// a copy and is not tagged.
+const _accountOfQuota = new WeakMap();
+
+/** The account a fetchCodexQuota reading was taken for, or null — for
+ *  account-watch.mjs, whose notifications are about one account at a time. */
+export function codexQuotaAccount(reading) {
+  return (reading && typeof reading === "object" && _accountOfQuota.get(reading)) || null;
+}

package/src/server/cswap-auto-loop.mjs

@@ -16,6 +16,10 @@ import { invalidateQuotaCache } from "./quota.mjs";
 // The one store mutex. A tick is the only thing in the deck that moves the live
 // account with nobody watching, which is why it of all writers must queue.
 import { withStoreLock } from "./store-lock.mjs";
+// Told about every finished tick and about the switch itself, so a tick that
+// moved the account is said once on the desktop (account-notify.mjs). Both
+// doors return at once and never throw.
+import { noteAutoSwitch, noteAutoTick } from "./account-watch.mjs";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -239,7 +243,10 @@ async function runTick() {
  */
 function tick() {
   if (_ticking) return _ticking;
-  _ticking = runTick().finally(() => { _ticking = null; });
+  // The notifier hears what every tick did, the ones that switched nothing
+  // included: a threshold notice it is holding waits for exactly that answer.
+  // Not awaited, and caught inside: a notification never delays a tick.
+  _ticking = runTick().then(() => { noteAutoTick(_lastTick); }).finally(() => { _ticking = null; });
   return _ticking;
 }
 
@@ -332,6 +339,7 @@ export function lastTick() {
 /** Turn the deck-managed loop on or off, persisting the choice. */
 export async function setAutoEnabled(enabled) {
   _enabled = Boolean(enabled);
+  noteAutoSwitch(_enabled);
   await saveState({ ...(await loadState()), enabled: _enabled });
   if (_enabled) await startLoop(); else stopLoop();
   return { ok: true, enabled: _enabled };
@@ -351,5 +359,5 @@ export async function setAutoEnabled(enabled) {
 export async function initCswapAuto({ after = null } = {}) {
   _toolQuiet = Promise.resolve(after).then(() => {}, () => {});
   const state = await loadState();
-  if (state.enabled) { _enabled = true; await startLoop(); }
+  if (state.enabled) { _enabled = true; noteAutoSwitch(true); await startLoop(); }
 }

package/src/server/deck-prefs.mjs

@@ -72,6 +72,16 @@ export { prefsPath };
  */
 export const DEFAULTS = Object.freeze({
   notifications: false,
+  // ACCOUNT NOTIFICATIONS, one switch each (account-notify.mjs). Not part of
+  // `notifications` above, which is about a deck nobody is looking at: these
+  // are said whether a page is open or not, because no page says them. The
+  // swap is ON — it fires only when the deck itself moved the live Claude
+  // account, which is rare and which nothing else announces; the quota two are
+  // OFF, because turning either on is also what starts the deck reading quota
+  // with no page open (account-watch.mjs). The owner's choice, 2026-10-07.
+  notifySwap: true,
+  notifyQuota: false,
+  notifyReset: false,
   // The Electron window can open on a new localhost port after an update.
   // Its tour marker must outlive that origin; browser tabs still use their
   // own localStorage marker and never read this preference.
@@ -304,6 +314,9 @@ export function normalise(raw) {
   const src = raw && typeof raw === "object" ? raw : {};
   return {
     notifications: flagOr(src.notifications, DEFAULTS.notifications),
+    notifySwap: flagOr(src.notifySwap, DEFAULTS.notifySwap),
+    notifyQuota: flagOr(src.notifyQuota, DEFAULTS.notifyQuota),
+    notifyReset: flagOr(src.notifyReset, DEFAULTS.notifyReset),
     tourSeen: flagOr(src.tourSeen, DEFAULTS.tourSeen),
     autoUpdate: flagOr(src.autoUpdate, DEFAULTS.autoUpdate),
     reports: flagOr(src.reports, DEFAULTS.reports),
@@ -688,7 +701,7 @@ export function publicPrefs(prefs) {
  * here — prefs-route-fields.test.ts lists them.
  */
 export const PAGE_FIELDS = Object.freeze({
-  top: Object.freeze(["notifications", "tourSeen", "autoUpdate"]),
+  top: Object.freeze(["notifications", "notifySwap", "notifyQuota", "notifyReset", "tourSeen", "autoUpdate"]),
   lan: Object.freeze([
     "enabled", "name", "shared", "manual", "shareActive", "pairingMode",
     "autoAsk", "autoAccept", "tailscale", "tailscaleAsk", "tailscaleAccept",
@@ -721,6 +734,18 @@ export function notificationsOn(prefs, env = process.env) {
   return normalise(prefs).notifications;
 }
 
+/**
+ * Which account notifications may go out right now: the three switches, each
+ * on its own, and all three off when the machine vetoed notifications at
+ * launch — AGENTS_DECK_NO_NOTIFY=1 keeps the deck off the desktop whatever
+ * else it was told, and these are desktop notifications too.
+ */
+export function accountNotifySettings(prefs, env = process.env) {
+  if (notificationsVetoed(env)) return { swap: false, quota: false, reset: false };
+  const p = normalise(prefs);
+  return { swap: p.notifySwap, quota: p.notifyQuota, reset: p.notifyReset };
+}
+
 /**
  * Should the LAN engine run? The file's answer, unless the machine said no.
  *

package/src/server/event-pipeline.mjs

@@ -12,7 +12,10 @@
 import { PRODUCT } from "./brand.mjs";
 import { createBlockNotifier } from "./block-notify.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
-import { notificationsOn } from "./deck-prefs.mjs";
+import { accountNotifySettings, notificationsOn } from "./deck-prefs.mjs";
+// The account notifier — a switch, a quota threshold, a reset — connected below
+// to the same OS call the block notifier uses.
+import { connectAccountNotify } from "./account-watch.mjs";
 // The settings as this process holds them — see prefs-state.mjs.
 import { heldPrefs } from "./prefs-state.mjs";
 // The deck's own token, taken back out of every event before the ring, the
@@ -49,6 +52,13 @@ import { connectEventSink } from "./event-sink.mjs";
 // emits until a request or a timer startServer arms asks it to.
 connectEventSink(pushEvent);
 
+/**
+ * Where a notification goes. The desktop app, while it is connected, raises it
+ * itself — under its own name, icon and permission, with a click that opens its
+ * window. Only when no app is listening does the OS helper speak.
+ */
+const deskNotify = (title, body, meta) => (trayClients.size > 0 ? notifyTrays(title, body, meta) : osNotify(title, body));
+
 /**
  * The desktop notifier, built once per process.
  *
@@ -65,10 +75,7 @@ connectEventSink(pushEvent);
  * every in-page surface still says everything it said before.
  */
 const blockNotifier = createBlockNotifier({
-  // The desktop app, while it is connected, raises the notification itself —
-  // under its own name, icon and permission, with a click that opens its
-  // window. Only when no app is listening does the OS helper speak.
-  notify: (title, body, meta) => (trayClients.size > 0 ? notifyTrays(title, body, meta) : osNotify(title, body)),
+  notify: deskNotify,
   product: PRODUCT,
   // A function, not a boolean: this is a switch a person flips from the sound
   // menu while the deck is running, and a mute that waited for a restart would
@@ -80,6 +87,21 @@ const blockNotifier = createBlockNotifier({
   onError: err => console.error(`${PRODUCT}: could not raise a desktop notification:`, err?.message ?? err),
 });
 
+/**
+ * The account notifier's half of the same channel. Not gated on a page being
+ * open, as the block notifier is: an open page plays a tone for a blocked
+ * session, so the desktop stays out of its way, but no page says that the deck
+ * moved your account or that a quota window filled — so these go out either
+ * way. Each of its three switches is asked per notification, and the launch
+ * veto still wins inside `accountNotifySettings`.
+ */
+connectAccountNotify({
+  notify: deskNotify,
+  product: PRODUCT,
+  settings: () => accountNotifySettings(heldPrefs.current()),
+  onError: err => console.error(`${PRODUCT}: could not raise an account notification:`, err?.message ?? err),
+});
+
 export function pushEvent(raw, source, opts = {}) {
   // First, before anything below can see it: the deck's own credential does not
   // belong in a store that is served without one. Every entry point to the

package/src/server/index.mjs

@@ -129,6 +129,9 @@ export { markDeckReady, releaseRestart } from "./lifecycle.mjs";
 // The settings as this process holds them, and every write that changes them —
 // see prefs-state.mjs.
 import { prefsRead } from "./prefs-state.mjs";
+// Quota read for the account notifications while no page reads it — only while
+// one of their quota switches is on (account-watch.mjs).
+import { startAccountWatch } from "./account-watch.mjs";
 // This deck's LAN engine, what the settings may tell it, and the probe that
 // asks whether other decks can reach it — see lan-deck.mjs. startServer hands
 // it the prefs at boot; the settings route does after every write.
@@ -513,6 +516,10 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       // being installed or upgraded underneath them (#1043) — null from every
       // caller with nothing to wait for.
       cswapAutoModule().then(m => m.initCswapAuto({ after: cswapQuiet })).catch(() => {});
+      // The account notifications' own quota reads, for the providers this deck
+      // watches. Idle — a check of two switches every couple of minutes — unless
+      // the threshold or the reset notification is on.
+      startAccountWatch({ providers: deckProviders });
       // The account-projects rollup: fold Claude transcripts into a per-account,
       // per-project token tally, incrementally. Claude only — it reads Claude
       // transcripts — best effort, and its timer is unref'd so it never holds

package/src/server/lan-engine.mjs

@@ -41,7 +41,7 @@
 // anything.
 import {
   addTrusted, ANNOUNCE_MS, credentialAad, dropTrusted, identityFrom, open, peerWhy, plan, PRESENT_MS,
-  stillListed, transferChallenge, trustedPeer,
+  sharedWith, stillListed, transferChallenge, trustedPeer,
 } from "./lan-sync.mjs";
 import { mintInvite, readInvite } from "./lan-invite.mjs";
 import { createInviteOffer } from "./lan-invite-offer.mjs";
@@ -1028,13 +1028,25 @@ export function createEngine({
       had.met = had.met || row.met;
       if (row.name && !had.name) had.name = row.name;
     };
+    // WHAT IS TICKED HERE AND NOT OFFERED THAT DECK, so its dialog draws no
+    // lane going out for it: what an arrival ticked, when the accept switch
+    // paired it — see sharedWith in lan-sync.mjs. The page never sees `onward`
+    // or which pin a switch made, so the engine says the difference itself,
+    // and only where there is one, which on most decks is nowhere.
+    const notOfferedTo = id => {
+      const offered = sharedWith(cfg, id);
+      const held = cfg.shared.filter(key => !offered.includes(key));
+      return held.length ? { notOffered: held } : {};
+    };
     // WHAT THE DECK'S OWN DIALOG DRAWS, by identity: the card it sent,
-    // the logins it offered last, and when somebody here said yes. All
-    // three are keyed by the fingerprint that proved itself, so both
-    // halves of a merged row read the same answer.
+    // the logins it offered last, when somebody here said yes, and what
+    // this deck does not offer it. All four are keyed by the fingerprint
+    // that proved itself, so both halves of a merged row read the same
+    // answer.
     const card = id => ({
       ...heardOf(id),
       pairedAt: trustedPeer(cfg.trusted, id)?.at ?? null,
+      ...notOfferedTo(id),
     });
     for (const p of [...beacon.peers.values(), ...dials.rows()]) {
       if (!stillListed(p, now())) continue;

package/src/server/quota.mjs

@@ -247,6 +247,10 @@ function notYet(now) {
  * long as the store has nothing to say about the new account.
  */
 function publish(gen, result, at, { good = false, who = null } = {}) {
+  // Tagged before the generation check: a read that finished after a switch is
+  // still a true reading of the account it was taken for, and whoever asked is
+  // still handed it.
+  if (who?.account) _accountOfQuota.set(result, who.account);
   if (gen !== _generation) return result;
   _cache   = result;
   _cacheAt = at;
@@ -303,6 +307,20 @@ async function storeQuota() {
   }
 }
 
+// Which account a published reading was taken for, as `{ email,
+// organizationUuid }` — beside the reading, like `_accountOfReading` below, so
+// the panel is not sent an identity it has no use for. Only readings taken this
+// time are tagged: one held over and re-served as `stale` is a copy, and says
+// nothing new about anybody.
+const _accountOfQuota = new WeakMap();
+
+/** The account a reading fetchClaudeQuota returned was taken for, or null when
+ *  the deck could not tell — for account-watch.mjs, whose notifications are
+ *  about one account and must never land on another. */
+export function quotaAccount(reading) {
+  return (reading && typeof reading === "object" && _accountOfQuota.get(reading)) || null;
+}
+
 // Which account a store reading is about, for the inventory read it starts.
 // Beside the reading rather than on it: the reading is sent to the browser as
 // it is, and an identity is not something the panel needs. Weak, so a reading

package/src/server/sse-clients.mjs

@@ -25,9 +25,12 @@ function pageCount() {
 
 /** A notification for the desktop app to raise as itself, instead of the OS
  *  helper raising it as Script Editor (osascript) or PowerShell. */
-function notifyTrays(title, body, { chime = null, who = null } = {}) {
+function notifyTrays(title, body, { chime = null, who = null, silent = false } = {}) {
   // The app names itself above the notification, so the title is the session.
-  const line = `event: notify\ndata: ${JSON.stringify({ title: who ?? title, body, chime })}\n\n`;
+  // `silent` only when asked for: the account notifications make no sound, and
+  // an app that did not send it would get the system's default one.
+  const frame = silent === true ? { title: who ?? title, body, chime, silent: true } : { title: who ?? title, body, chime };
+  const line = `event: notify\ndata: ${JSON.stringify(frame)}\n\n`;
   for (const res of trayClients) writeSse(res, line);
   return true;
 }