ccdeck 3.39.1 → 3.39.4

package/dist/web/index.html

@@ -66,8 +66,8 @@
         document.documentElement.setAttribute("data-color-scheme", lightThemes.indexOf(theme) >= 0 ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DGMP4S3t.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-WHHCRAB3.css">
+    <script type="module" crossorigin src="/assets/index-CxIdVCPz.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-TDFtmv7q.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.39.1",
+  "version": "3.39.4",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -73,7 +73,18 @@
     "3.38.0",
     "3.38.1",
     "3.38.2",
-    "3.38.6"
+    "3.38.6",
+    "3.39.4"
+  ],
+  "3.39.3": [
+    {
+      "title": "A cleaner desktop window",
+      "body": "The desktop app now has one compact toolbar that follows your theme, with native window controls and an application menu. Wider side rails give icons more room; the Local network footer and unread badges are more compact."
+    },
+    {
+      "title": "Clearer account usage and Telemetry Radar",
+      "body": "Account usage shows reset times together with capacity. Telemetry Radar has a clearer monitoring workspace and keeps history for up to 24 hours. Radar remains Beta."
+    }
   ],
   "3.39.1": [
     {
@@ -116,7 +127,7 @@
   "3.38.4": [
     {
       "title": "🔔 A notification when Auto-switch changes your account",
-      "body": "When Auto-switch moves Claude Code to another account, ccdeck now tells you once, with where it went and why, for example \"Switched to work \u00b7 personal@example.com reached 90%\". You can turn it off in the sound settings, where two more wait, off until you turn them on: one when a quota window of the Claude or Codex account you are on reaches 90% and again at 100%, and one when a window that had reached 90% is available again. Each is said once per window and a restart does not repeat it. With either quota notification on, the deck reads quota about every two minutes even while no page is open."
+      "body": "When Auto-switch moves Claude Code to another account, ccdeck now tells you once, with where it went and why, for example \"Switched to work · personal@example.com reached 90%\". You can turn it off in the sound settings, where two more wait, off until you turn them on: one when a quota window of the Claude or Codex account you are on reaches 90% and again at 100%, and one when a window that had reached 90% is available again. Each is said once per window and a restart does not repeat it. With either quota notification on, the deck reads quota about every two minutes even while no page is open."
     }
   ],
   "3.38.3": [

package/src/server/desktop-update-routes.mjs

@@ -22,7 +22,7 @@ function cleanDesktopUpdate(value) {
     ? value.version.trim().slice(0, 80)
     : null;
   if (value.status === "ready" && !version) return null;
-  return { status: value.status, version };
+  return { status: value.status, version, ...(value.canCheck === true ? { canCheck: true } : {}) };
 }
 
 function broadcastDesktopUpdate() {
@@ -70,6 +70,19 @@ async function handleDesktopUpdateRequest(req, res, event) {
   send(res, 202, { ok: true });
 }
 
+// Checking is routed to the same native updater as the tray menu. The existing
+// mutation gate protects the request; only authenticated tray subscribers receive it.
+let lastCheckAt = 0;
+export function handleDesktopUpdateCheck(_req, res) {
+  if (trayClients.size === 0) return send(res, 409, { ok: false, reason: 'app_disconnected' });
+  if (!desktopUpdateState.canCheck) return send(res, 409, { ok: false, reason: 'app_update_required' });
+  if (Date.now() - lastCheckAt >= 1000) {
+    lastCheckAt = Date.now();
+    for (const client of trayClients) writeSse(client, 'event: desktop-update-check\ndata: {}\n\n');
+  }
+  send(res, 202, { ok: true });
+}
+
 // The four routes index.mjs dispatches to these. Listed rather than marked at
 // each declaration, so the declarations read as they did where they came from.
 export { handleDesktopUpdateRead, handleDesktopUpdateReport, handleDesktopUpdateRequest };

package/src/server/index.mjs

@@ -20,6 +20,7 @@ export { challengeDeck, challengeProof, isProcessAlive };
 // The gates in front of the route table — see src/server/request-gates.mjs,
 // which also holds the per-process token the strictest of them checks.
 import { GUARDED_READS, OPEN_MUTATIONS, isAuthorizedDataRead, isAuthorizedMutation, isTrustedMutation, isTrustedRead } from "./request-gates.mjs";
+import { trafficCapture } from "./traffic-radar-capture.mjs";
 import { trafficRadar } from "./traffic-radar.mjs";
 import { handleTrafficCapture, isAuthorizedTrafficIngest } from "./traffic-radar-routes.mjs";
 // How much the event ring may hold and what one event is charged against it —
@@ -71,7 +72,7 @@ import { handleFeature, noteRouteFeature } from "./feature-use.mjs";
 export { HARD_TRACKED_SESSIONS } from "./session-tracking.mjs";
 // The desktop app's update as its window sees it — the state the app reports
 // and the window's answers relayed back to it. See desktop-update-routes.mjs.
-import { handleDesktopUpdateRead, handleDesktopUpdateReport, handleDesktopUpdateRequest } from "./desktop-update-routes.mjs";
+import { handleDesktopUpdateCheck, handleDesktopUpdateRead, handleDesktopUpdateReport, handleDesktopUpdateRequest } from "./desktop-update-routes.mjs";
 // The one spelling of `--workspace`, and of a rollout's cwd — see
 // canonical-path.mjs. Both were exported from this file before they moved,
 // and still are.
@@ -308,6 +309,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/api/version")     return guard(handleVersion(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/desktop-update") return handleDesktopUpdateRead(req, res);
     if (req.method === "POST" && url.pathname === "/api/desktop-update") return guard(handleDesktopUpdateReport(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/desktop-update/check") return guard(handleDesktopUpdateCheck(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/desktop-update/restart") return guard(handleDesktopUpdateRequest(req, res, "desktop-update-restart"), res);
     if (req.method === "POST" && url.pathname === "/api/desktop-update/seen") return guard(handleDesktopUpdateRequest(req, res, "desktop-update-seen"), res);
     if (req.method === "POST" && url.pathname === "/api/upgrade")     return guard(handleUpgrade(req, res), res);
@@ -497,6 +499,8 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       // and that will differ on the next boot. Every test in this suite boots
       // that way. Comparing the candidate would hand those decks a manifest.
       boundPort = server.address()?.port ?? candidate;
+      void trafficCapture.resume(boundPort).catch(() => {});
+      server.once("close", () => trafficCapture.dispose());
       // Codex has no working hooks on Windows — tail its rollout files instead.
       if (codex) startCodexWatcher(workspace);
       // What a session is producing between its tool calls. Claude only — it

package/src/server/lan-beacon.mjs

@@ -243,7 +243,11 @@ export function createBeacon({
     // broadcast is filtered, and it is what Syncthing sends — and every
     // interface's own directed broadcast goes out beside it. A duplicate packet
     // costs one datagram; a missing one costs the whole feature.
-    const plan = broadcastPlan(ifaces());
+    // Adapter enumeration may fail transiently on Windows. The limited
+    // broadcast still works without an interface map; retry next announce.
+    let faces;
+    try { faces = ifaces(); } catch { faces = {}; }
+    const plan = broadcastPlan(faces);
     // Asked behind the send, and read from what was last answered: the first
     // beacon after a start goes as it always did, and the ones after it know.
     void routes?.want?.(plan.map(p => p.to));

package/src/server/lan-engine.mjs

@@ -119,7 +119,12 @@ export function defaultName() {
  * `internal` is node's word for loopback, and a link-local 169.254 address is a
  * machine whose DHCP failed — reachable by nobody worth telling about.
  */
-export function localAddresses(faces = networkInterfaces()) {
+export function localAddresses(faces) {
+  if (faces === undefined) {
+    // Windows can temporarily fail to enumerate adapters. Keep status and
+    // invite reads usable, and ask the OS again on the next read.
+    try { faces = networkInterfaces(); } catch { return []; }
+  }
   const out = [];
   for (const list of Object.values(faces ?? {})) {
     for (const n of list ?? []) {

package/src/server/traffic-radar-capture.mjs

@@ -1,24 +1,21 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
-import { execFile } from "node:child_process";
 import { isIP } from "node:net";
 import { fileURLToPath } from "node:url";
+import { captureInterface, captureInterfaceValid, captureTool, CaptureSetupError } from './traffic-radar-platform.mjs';
+import { monitorDestination, capturePreferences } from "./traffic-radar-monitor.mjs";
 import { createWireCapture } from "./traffic-radar-wire.mjs";
 
-const WINDOW = 300_000;
-const DURATION = 600_000;
-const MAX_CHARS = 4_000_000;
+const WINDOW = 24 * 60 * 60 * 1000;
+const MAX_EXPORTS = 2000;
+
+const MAX_CHARS = 32 * 1024 * 1024;
 const quote = value => `'${String(value).replaceAll("'", "'\\''")}'`;
+const psQuote = value => `'${String(value).replaceAll("'", "''")}'`;
 export function captureDestination(value) {
   const match = /^(\d{1,3}(?:\.\d{1,3}){3}):(\d{1,5})$/.exec(String(value));
   if (!match || isIP(match[1]) !== 4 || +match[2] < 1 || +match[2] > 65535) throw new Error('Choose an IPv4 address and TCP port.');
   return { host: match[1], port: +match[2] };
 }
-async function networkInterface(host) {
-  return new Promise(resolve => execFile('/sbin/route', ['-n', 'get', host], { timeout: 2000, maxBuffer: 16_384 }, (error, stdout) => {
-    const name = !error && /interface:\s+([a-zA-Z0-9_.:-]{1,32})/.exec(stdout)?.[1];
-    resolve(name || null);
-  }));
-}
 export function exportSummary(payload, signal) {
   const group = signal === 'traces' ? 'Spans' : signal === 'logs' ? 'Logs' : 'Metrics';
   const item = signal === 'traces' ? 'spans' : signal === 'logs' ? 'logRecords' : 'metrics';
@@ -45,60 +42,93 @@ export function exportSummary(payload, signal) {
   }
   return { count: records.length, name: String(records[0]?.eventName || records[0]?.name || signal).slice(0, 200), content: [...fields], sessionIds: [...sessionIds] };
 }
-export function createTrafficCapture({ now = Date.now, platform = process.platform, findInterface = networkInterface, wire = createWireCapture } = {}) {
-  let session = null, parsers = [], timer = null, nextId = 1, chars = 0;
+export function createTrafficCapture({ now = Date.now, platform = process.platform, findInterface = host => captureInterface(host, platform), findTool = () => captureTool(platform), wire = createWireCapture, execPath = process.execPath, electron = !!process.versions.electron, managed = false, preferences = null, monitor = monitorDestination } = {}) {
+  let session = null, parsers = [], timer = null, nextId = 1, chars = 0, evictedExports = 0;
   const events = new Map();
   let observations = [];
+  let monitors = [], localPort = null, generation = 0;
+  const persist = enabled => preferences && localPort ? preferences.write(localPort, { enabled, destinations: session?.sources.map(s => s.destination) ?? [] }) : Promise.resolve();
   function prune() {
     observations = observations.filter(entry => now() - entry.observedAt <= WINDOW);
     for (const [id, event] of events) if (now() - event.observedAt > WINDOW) { events.delete(id); chars -= event.chars; }
-    if (session?.token && now() >= session.expiresAt) stop('expired');
-    else if (session?.token && session.sources.some(s => s.lastInputAt !== null) &&
-      session.sources.filter(s => s.lastInputAt !== null).every(s => now() - s.lastInputAt > 5000)) stop('interrupted');
+    if (session?.token && session.sources.some(s => s.lastInputAt !== null) &&
+      session.sources.filter(s => s.lastInputAt !== null).every(s => now() - s.lastInputAt > 5000)) session.state = 'interrupted';
     if (!session?.token && !events.size && !observations.length && timer) { clearInterval(timer); timer = null; }
   }
-  function stop(state = 'stopped') {
+  function stop(state = 'stopped', save = true) {
+    generation++;
+    for (const cancel of monitors) cancel(); monitors = [];
+    const saved = save ? persist(false) : Promise.resolve();
     if (session) { session.state = state; session.token = null; for (const source of session.sources) source.command = null; }
     for (const parser of parsers) parser.close(); parsers = [];
+    return saved;
   }
   function addExport(value) {
     const text = JSON.stringify(value.payload);
-    const cost = text.length + value.protobufBase64.length;
+    const cost = Buffer.byteLength(text, 'utf8') + Buffer.byteLength(value.protobufBase64, 'utf8');
     if (cost > 1_000_000) { session.issues.payload_limit = (session.issues.payload_limit ?? 0) + 1; return null; }
     const id = nextId++;
-    while (events.size >= 100 || (chars + cost > MAX_CHARS && events.size)) {
+    while (events.size >= MAX_EXPORTS || (chars + cost > MAX_CHARS && events.size)) {
       const first = events.keys().next().value; chars -= events.get(first).chars; events.delete(first);
+      evictedExports++;
     }
     events.set(id, { ...value, id, observedAt: now(), chars: cost, ...exportSummary(value.payload, value.signal), outcome: 'unconfirmed', response: null });
     chars += cost;
     return id;
   }
-  return {
-    async prepare(destination, localPort) {
-      if (platform !== 'darwin') throw new Error('Passive capture setup is available on macOS.');
+  const api = {
+    async prepare(destination, requestedPort) {
+      const operation = ++generation;
+      if (!['darwin', 'linux', 'win32'].includes(platform)) throw new CaptureSetupError('Live capture is available on macOS, Linux and Windows.');
       const targets = [...new Set((Array.isArray(destination) ? destination : [destination]).map(String))];
       if (!targets.length || targets.length > 8) throw new Error('Choose between one and eight destinations.');
       const addresses = targets.map(captureDestination);
-      if (!Number.isInteger(localPort) || localPort < 1 || localPort > 65535) throw new Error('Local ccdeck port unavailable.');
+      if (!Number.isInteger(requestedPort) || requestedPort < 1 || requestedPort > 65535) throw new Error('Local ccdeck port unavailable.');
+      const tool = await findTool();
       const names = await Promise.all(addresses.map(({ host }) => findInterface(host)));
-      if (names.some(name => !name || !/^[a-zA-Z0-9_.:-]{1,32}$/.test(name))) throw new Error('Network interface unavailable. Check the destination and retry.');
-      stop(); events.clear(); observations = []; chars = 0;
+      if (names.some(name => !captureInterfaceValid(name, platform))) throw new Error('Network interface unavailable. Check the destination and retry.');
+      if (operation !== generation) throw new CaptureSetupError("Monitoring setup was cancelled.");
+      stop("stopped", false); const activeGeneration = generation; localPort = requestedPort;
+      prune();
       const token = randomBytes(32).toString('hex');
       const helper = fileURLToPath(new URL('./traffic-radar-helper.mjs', import.meta.url));
       const sources = addresses.map(({ host, port }, index) => {
         const filter = `host ${host} and tcp port ${port}`;
-        const command = `sudo /usr/sbin/tcpdump -i ${quote(names[index])} -nn -U -s 0 -w - ${quote(filter)} | ${quote(process.execPath)} ${quote(helper)} ${quote(`http://127.0.0.1:${localPort}`)} ${quote(token)} ${quote(index)}`;
+        let command = platform === 'win32'
+          ? `& ${psQuote(execPath)} ${psQuote(helper)} --capture ${psQuote(tool)} ${psQuote(names[index])} ${psQuote(host)} ${port} ${psQuote(`http://127.0.0.1:${localPort}`)} ${psQuote(token)} ${index}`
+          : `sudo ${quote(tool)} -i ${quote(names[index])} -nn -U -s 0 -w - ${quote(filter)} | ${quote(execPath)} ${quote(helper)} ${quote(`http://127.0.0.1:${localPort}`)} ${quote(token)} ${quote(index)}`;
+        if (electron) command = platform === 'win32'
+          ? `& { $previous=$env:ELECTRON_RUN_AS_NODE; try { $env:ELECTRON_RUN_AS_NODE='1'; ${command} } finally { $env:ELECTRON_RUN_AS_NODE=$previous } }`
+          : command.replace(`| ${quote(execPath)}`, `| env ELECTRON_RUN_AS_NODE=1 ${quote(execPath)}`);
         return { destination: `${host}:${port}`, interface: names[index], command, lastInputAt: null, bytes: 0 };
       });
       session = { id: randomBytes(8).toString('hex'), state: 'awaiting', destination: sources[0].destination, interface: sources[0].interface,
-        sources, startedAt: now(), expiresAt: now() + DURATION, lastInputAt: null, token, bytes: 0, issues: {} };
-      parsers = addresses.map(({ host, port }) => wire({ host, port, onExport: addExport, onResponse: (id, response) => {
+        sources, startedAt: now(), expiresAt: null, lastInputAt: null, token, bytes: 0, issues: {} };
+      const parser = ({ host, port }) => wire({ host, port, onExport: addExport, onResponse: (id, response) => {
         const event = events.get(id);
         if (event) { event.response = response; event.outcome = response.outcome; }
-      }, onObservation: value => { observations.unshift({ id: nextId++, ...value, observedAt: now() }); observations = observations.slice(0, 100); }, onIssue: code => { session.issues[code] = (session.issues[code] ?? 0) + 1; } }));
+      }, onObservation: value => { observations.unshift({ id: nextId++, ...value, observedAt: now() }); observations = observations.slice(0, MAX_EXPORTS); }, onIssue: code => { session.issues[code] = (session.issues[code] ?? 0) + 1; } });
+      parsers = addresses.map(parser);
+      await persist(true);
+      if (activeGeneration !== generation) throw new CaptureSetupError("Monitoring setup was cancelled.");
+      if (managed) monitors = addresses.map(({ host, port }, index) => monitor({ platform, tool, host, port, resolveInterface: findInterface,
+        reset: iface => { parsers[index]?.close(); parsers[index] = parser({ host, port }); session.sources[index].interface = iface; },
+        ingest: bytes => api.ingest(token, bytes, index),
+        status: error => { const source = session.sources[index]; source.error = error; if (error) { source.lastInputAt = null; session.state = 'interrupted'; } },
+      }));
       if (!timer) { timer = setInterval(prune, 1000); timer.unref?.(); }
       return { command: sources[0].command, commands: sources.map(({ command, destination }) => ({ command, destination })), expiresAt: session.expiresAt, sessionId: session.id };
     },
+    async resume(port) {
+      const operation = generation;
+      localPort = port;
+      const saved = await preferences?.read(port);
+      if (operation !== generation) return;
+      if (saved?.enabled && Array.isArray(saved.destinations)) {
+        try { await api.prepare(saved.destinations, port); }
+        catch { session = { state: "error", sources: [], issues: {}, token: null }; }
+      }
+    },
     accepts(token) {
       prune();
       return typeof token === 'string' && /^[a-f0-9]{64}$/.test(token) && !!session?.token
@@ -111,26 +141,28 @@ export function createTrafficCapture({ now = Date.now, platform = process.platfo
       session.sources[source].lastInputAt = now();
       session.sources[source].bytes += chunk.length;
       session.lastInputAt = now();
-      if (chunk.length) session.state = 'capturing';
-      else if (session.state === 'awaiting') session.state = 'receiving';
+      if (chunk.length && (!managed || session.sources[source].bytes > 24)) session.state = 'capturing';
+      else if (['awaiting', 'interrupted'].includes(session.state)) session.state = 'receiving';
       session.bytes += chunk.length;
-      try { parsers[source].feed(chunk); } catch { stop('error'); return false; }
+      try { parsers[source].feed(chunk); } catch { void stop('error').catch(() => {}); return false; }
       return true;
     },
     read() {
       prune();
-      return { ok: true, sessionId: session?.id ?? null, state: session?.state ?? 'idle', destination: session?.destination ?? null, interface: session?.interface ?? null,
+      return { ok: true, managed, enabled: !!session?.token, platform, backend: platform === 'win32' ? 'dumpcap' : 'tcpdump', shell: platform === 'win32' ? 'PowerShell' : 'Terminal', sessionId: session?.id ?? null, state: session?.state ?? 'idle', destination: session?.destination ?? null, interface: session?.interface ?? null,
         startedAt: session?.startedAt ?? null, expiresAt: session?.expiresAt ?? null, lastInputAt: session?.lastInputAt ?? null,
         sources: session?.sources.map(({ command, ...source }) => ({ ...source, active: source.lastInputAt !== null && now() - source.lastInputAt <= 5000 && !!session.token })) ?? [],
         observations: [...observations],
+        retention: { windowMs: WINDOW, maxExports: MAX_EXPORTS, payloadBudgetBytes: MAX_CHARS, evictedExports },
         bytes: session?.bytes ?? 0, issues: { ...session?.issues },
         events: [...events.values()].reverse().map(({ payload, protobufBase64, chars, flow, ...event }) => event),
       };
     },
     detail(id) { prune(); const event = events.get(id); return event ? { payload: event.payload, protobufBase64: event.protobufBase64 } : null; },
     stop,
-    clear() { events.clear(); observations = []; chars = 0; },
-    dispose() { stop(); events.clear(); observations = []; if (timer) clearInterval(timer); timer = null; },
+    clear() { events.clear(); observations = []; chars = 0; evictedExports = 0; },
+    dispose() { stop("stopped", false); events.clear(); observations = []; if (timer) clearInterval(timer); timer = null; },
   };
+  return api;
 }
-export const trafficCapture = createTrafficCapture();
+export const trafficCapture = createTrafficCapture({ managed: true, preferences: capturePreferences() });

package/src/server/traffic-radar-config.mjs

@@ -1,6 +1,6 @@
 import { open } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { posix, win32 } from "node:path";
 import { claudeConfigDir } from "./claude-dir.mjs";
 
 const BOOLEAN_KEYS = [
@@ -68,12 +68,15 @@ async function readBoundedJson(path) {
   } finally { await file.close(); }
 }
 
-export async function readRadarConfig({ home = homedir(), env = process.env, readJson = readBoundedJson } = {}) {
-  const dir = claudeConfigDir(env, home);
+export async function readRadarConfig({ home = homedir(), env = process.env, platform = process.platform, readJson = readBoundedJson } = {}) {
+  const pathJoin = platform === 'win32' ? win32.join : posix.join;
+  const dir = claudeConfigDir(env, home, platform);
+  const managed = platform === 'win32' ? pathJoin(env.ProgramFiles || 'C:\\Program Files', 'ClaudeCode', 'managed-settings.json')
+    : platform === 'linux' ? '/etc/claude-code/managed-settings.json' : '/Library/Application Support/ClaudeCode/managed-settings.json';
   const files = [
-    ["User settings", join(dir, "settings.json")],
-    ["Cached organization settings", join(dir, "remote-settings.json")],
-    ["Managed settings", "/Library/Application Support/ClaudeCode/managed-settings.json"],
+    ["User settings", pathJoin(dir, "settings.json")],
+    ["Cached organization settings", pathJoin(dir, "remote-settings.json")],
+    ["Managed settings", managed],
   ];
   const sources = await Promise.all(files.map(async ([name, path]) => {
     try {

package/src/server/traffic-radar-helper.mjs

@@ -1,3 +1,6 @@
+import { spawn } from 'node:child_process';
+import { captureDestination } from './traffic-radar-capture.mjs';
+import { captureInterfaceValid } from './traffic-radar-platform.mjs';
 import { pathToFileURL } from "node:url";
 
 export async function streamCapture({ base, token, source = 0, input = process.stdin, send = fetch, report = message => process.stderr.write(message + '\n') }) {
@@ -20,8 +23,7 @@ export async function streamCapture({ base, token, source = 0, input = process.s
     return sequence;
   };
   const heartbeat = setInterval(() => { if (!stopped) void post(Buffer.alloc(0)); }, 1000);
-  const deadline = setTimeout(finish, 600_000);
-  report('Telemetry Radar: sending capture bytes only to local ccdeck; no file is written. Press Ctrl+C to stop tcpdump.');
+  report('Telemetry Radar: sending capture bytes only to local ccdeck; no file is written. Press Ctrl+C to stop capture.');
   try {
     for await (const chunk of input) {
       for (let offset = 0; offset < chunk.length && !stopped; offset += 65_536) await post(chunk.subarray(offset, offset + 65_536));
@@ -31,13 +33,35 @@ export async function streamCapture({ base, token, source = 0, input = process.s
   } catch {
     if (!stopped) report('Capture input interrupted.');
   } finally {
-    stopped = true; clearInterval(heartbeat); clearTimeout(deadline);
-    report('Telemetry Radar: local receiver stopped. Press Ctrl+C if tcpdump is still running.');
+    stopped = true; clearInterval(heartbeat);
+    report('Telemetry Radar: local receiver stopped. Press Ctrl+C if the capture tool is still running.');
   }
 }
 
+// PowerShell 5 pipelines convert binary output to text. Stream dumpcap directly in Node.
+export async function runCaptureTool({ tool, interface: iface, host, port, base, token, source = 0, launch = spawn, send = fetch, report = message => process.stderr.write(message + '\n') }) {
+  captureDestination(`${host}:${port}`);
+  if (!captureInterfaceValid(iface, 'win32') || !tool || /[\r\n]/.test(tool)) throw new Error('Invalid capture tool or interface.');
+  // Validate before launching a child, not after it has started capturing.
+  const url = new URL(base);
+  if (url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || url.pathname !== '/' || url.search || url.hash || url.username || url.password || !/^[a-f0-9]{64}$/.test(token) || !Number.isInteger(source) || source < 0 || source > 7) throw new Error('Invalid local capture destination.');
+  const child = launch(tool, ['-i', iface, '-F', 'pcap', '-s', '0', '-f', `host ${host} and tcp port ${port}`, '-w', '-'], { stdio: ['ignore', 'pipe', 'inherit'], windowsHide: true, shell: false });
+  let failure = null;
+  child.on('error', error => { failure = error; child.stdout.destroy(error); });
+  child.on('exit', code => { if (code) failure = new Error('Capture tool failed. Check Npcap and capture permissions.'); });
+  const stop = () => { child.kill(); child.stdout.destroy(); };
+  process.once('SIGINT', stop); process.once('SIGTERM', stop);
+  try {
+    await streamCapture({ base, token, source, input: child.stdout, send, report });
+    if (failure) throw failure;
+  } finally {
+    child.kill(); process.removeListener('SIGINT', stop); process.removeListener('SIGTERM', stop);
+  }
+}
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  streamCapture({ base: process.argv[2], token: process.argv[3], source: Number(process.argv[4] ?? 0) }).catch(() => {
-    process.stderr.write('Could not start the local capture helper.\n'); process.exitCode = 1;
-  });
+  const args = process.argv.slice(2);
+  const job = args[0] === '--capture'
+    ? runCaptureTool({ tool: args[1], interface: args[2], host: args[3], port: Number(args[4]), base: args[5], token: args[6], source: Number(args[7] ?? 0) })
+    : streamCapture({ base: args[0], token: args[1], source: Number(args[2] ?? 0) });
+  job.catch(() => { process.stderr.write('Could not start capture. Check that the capture tool is installed and its permissions allow this user.\n'); process.exitCode = 1; });
 }

package/src/server/traffic-radar-monitor.mjs

@@ -0,0 +1,77 @@
+import { spawn } from 'node:child_process';
+import { readFile, mkdir, writeFile, chmod } from 'node:fs/promises';
+import { renameWithRetry } from './atomic-write.mjs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+// Only destinations and the opt-in survive a restart. Tokens and packets never do.
+export function capturePreferences(directory = join(homedir(), '.agents-deck')) {
+  let writes = Promise.resolve();
+  const file = port => join(directory, `radar-monitor-${port}.json`);
+  return {
+    async read(port) { try { return JSON.parse(await readFile(file(port), 'utf8')); } catch { return null; } },
+    write(port, value) {
+      writes = writes.catch(() => {}).then(async () => {
+        await mkdir(directory, { recursive: true });
+        const target = file(port), temp = target + `.${process.pid}.tmp`;
+        await writeFile(temp, JSON.stringify(value), { mode: 0o600 });
+        await chmod(temp, 0o600); await renameWithRetry(temp, target);
+      });
+      return writes;
+    },
+  };
+}
+
+const activeMonitors = new Set();
+const stopAtExit = () => { for (const stop of activeMonitors) stop(); };
+
+// A child per destination keeps pcap headers and TCP decoders independent.
+// Retry after a crash or adapter change; an explicit stop cancels every retry.
+export function monitorDestination({ platform, tool, host, port, resolveInterface, reset, ingest, status, launch = spawn, retryMs = 3000 }) {
+  let stopped = false, child = null, retry = null, heartbeat = null, ready = false;
+  const stopHeartbeat = () => { clearInterval(heartbeat); heartbeat = null; };
+  const retryLater = () => { if (!stopped) { retry = setTimeout(start, retryMs); retry.unref?.(); } };
+  async function start() {
+    if (stopped) return;
+    try {
+      const iface = await resolveInterface(host);
+      if (stopped) return;
+      if (!iface) throw new Error('interface');
+      reset(iface); ready = false;
+      const args = platform === 'win32'
+        ? ['-i', iface, '-F', 'pcap', '-s', '0', '-f', `host ${host} and tcp port ${port}`, '-w', '-']
+        : ['-i', iface, '-nn', '-U', '-s', '0', '-w', '-', `host ${host} and tcp port ${port}`];
+      child = launch(tool, args, { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, shell: false });
+      const capturing = child;
+      let ended = false, error = '', stderr = '';
+      const listening = () => {
+        if (ready || stopped || ended) return;
+        ready = true; status(null); ingest(Buffer.alloc(0));
+        heartbeat = setInterval(() => { if (!stopped) ingest(Buffer.alloc(0)); }, 1000); heartbeat.unref?.();
+      };
+      const end = () => {
+        if (ended) return; ended = true; stopHeartbeat(); capturing.stdout.destroy(); capturing.kill();
+        if (!stopped) { status(error || 'Capture disconnected. Retrying automatically.'); retryLater(); }
+      };
+      child.stderr.on('data', bytes => {
+        stderr = (stderr + bytes.toString()).slice(-4096);
+        if (/permission|access.*denied|not permitted|administrator/i.test(stderr)) error = 'Packet capture permission is required.';
+        if (/listening on|Capturing on/i.test(stderr)) listening();
+      });
+      child.stdout.on('data', bytes => {
+        if (stopped) return;
+        listening();
+        for (let i = 0; i < bytes.length; i += 65536) ingest(bytes.subarray(i, i + 65536));
+      });
+      child.stdout.on('error', end);
+      child.once('error', reason => { if (['EACCES', 'EPERM'].includes(reason.code)) error = 'Packet capture permission is required.'; end(); }); child.once('exit', end);
+    } catch { if (!stopped) { status('Capture interface unavailable. Retrying automatically.'); retryLater(); } }
+  }
+  const stop = () => {
+    stopped = true; clearTimeout(retry); stopHeartbeat(); child?.stdout.destroy(); child?.kill();
+    activeMonitors.delete(stop); if (!activeMonitors.size) process.removeListener("exit", stopAtExit);
+  };
+  if (!activeMonitors.size) process.once("exit", stopAtExit);
+  activeMonitors.add(stop); void start();
+  return stop;
+}

package/src/server/traffic-radar-platform.mjs

@@ -0,0 +1,80 @@
+// OS-specific inspection stays here; the Radar history and decoder share one model.
+import { execFile } from 'node:child_process';
+import { readdir, readFile, readlink } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { win32 } from 'node:path';
+
+export function systemCommand(file, args) {
+  return new Promise(resolve => execFile(file, args, { timeout: 8000, maxBuffer: 262144, encoding: 'utf8', windowsHide: true }, (error, stdout, stderr) => {
+    if (!error || (file === '/usr/sbin/lsof' && error.code === 1 && !stdout && !stderr)) resolve(stdout);
+    else resolve(null);
+  }));
+}
+export const powershell = script => ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', "$ErrorActionPreference='Stop'; " + script];
+export const WINDOWS_PROCESSES = "Get-Process | Where-Object { $_.ProcessName -in @('claude','claude-native') } | ForEach-Object { '{0} {1}' -f $_.Id,$_.ProcessName }";
+export function windowsSockets(pids) {
+  return `$ids=@(${pids.join(',')}); Get-NetTCPConnection -ErrorAction Stop | Where-Object { $_.State -eq 'Established' -and $_.OwningProcess -in $ids } | ForEach-Object { $peer=$_.RemoteAddress; if($peer.Contains(':')){$peer='['+$peer+']'}; 'p'+$_.OwningProcess; 'nlocal->'+$peer+':'+$_.RemotePort }`;
+}
+
+// /proc avoids an ss/lsof dependency and reads socket ownership only for selected Claude PIDs.
+export async function linuxSockets(pids, { read = readFile, list = readdir, link = readlink } = {}) {
+  const sockets = [], cwd = [];
+  let unavailable = false;
+  await Promise.all(pids.map(async pid => {
+    try {
+      const descriptors = await list(`/proc/${pid}/fd`);
+      const owned = new Set((await Promise.all(descriptors.map(fd => link(`/proc/${pid}/fd/${fd}`).catch(() => ''))))
+        .map(value => /^socket:\[(\d+)\]$/.exec(value)?.[1]).filter(Boolean));
+      for (const family of ['tcp', 'tcp6']) {
+        const table = await read(`/proc/${pid}/net/${family}`, 'utf8');
+        for (const row of table.trim().split('\n').slice(1)) {
+          const fields = row.trim().split(/\s+/);
+          if (fields[3] !== '01' || !owned.has(fields[9])) continue;
+          const [hex, port] = fields[2].split(':');
+          const bytes = Buffer.from(hex, 'hex');
+          for (let i = 0; i < bytes.length; i += 4) bytes.subarray(i, i + 4).reverse();
+          const address = family === 'tcp' ? [...bytes].join('.') : '[' + Array.from({ length: 8 }, (_, i) => bytes.readUInt16BE(i * 2).toString(16)).join(':') + ']';
+          sockets.push(`p${pid}\nnlocal->${address}:${parseInt(port, 16)}`);
+        }
+      }
+      const path = await link(`/proc/${pid}/cwd`).catch(() => null);
+      if (path) cwd.push(`p${pid}\nn${path}`);
+    } catch (error) { if (error.code !== 'ENOENT' && error.code !== 'ESRCH') unavailable = true; }
+  }));
+  return { sockets: unavailable ? null : sockets.join('\n'), cwd: cwd.join('\n') };
+}
+export function captureInterfaceValid(name, platform) {
+  return typeof name === 'string' && (platform === 'win32'
+    ? /^\\Device\\NPF_(?:Loopback|\{[a-fA-F0-9-]{36}\})$/.test(name)
+    : /^[a-zA-Z0-9_.:-]{1,32}$/.test(name));
+}
+export async function captureInterface(host, platform, run = systemCommand) {
+  if (platform === 'linux') return 'any'; // tcpdump's cooked capture includes loopback and every routed adapter.
+  if (platform === 'darwin') {
+    const text = await run('/sbin/route', ['-n', 'get', host]);
+    return /interface:\s+([a-zA-Z0-9_.:-]{1,32})/.exec(text ?? '')?.[1] ?? null;
+  }
+  if (platform === 'win32') {
+    if (host.startsWith('127.')) return '\\Device\\NPF_Loopback';
+    const text = await run('powershell.exe', powershell(`if(Get-NetIPAddress -IPAddress '${host}' -ErrorAction SilentlyContinue) { '\\Device\\NPF_Loopback'; exit }; $route=Find-NetRoute -RemoteIPAddress '${host}'; $index=($route | Select-Object -First 1).InterfaceIndex; $adapter=Get-NetAdapter -IncludeHidden | Where-Object { $_.ifIndex -eq $index } | Select-Object -First 1; '\\Device\\NPF_{'+$adapter.InterfaceGuid.ToString().Trim('{}')+'}'`));
+    return text?.trim() ?? null;
+  }
+  return null;
+}
+export function dumpcapPath(env = process.env, exists = existsSync) {
+  for (const root of [env.ProgramW6432, env.ProgramFiles, env['ProgramFiles(x86)'], 'C:\\Program Files']) {
+    if (!root) continue;
+    const file = win32.join(root, 'Wireshark', 'dumpcap.exe');
+    if (exists(file)) return file;
+  }
+  return 'dumpcap.exe'; // Custom installs may expose it on PATH.
+}
+export class CaptureSetupError extends Error {}
+export async function captureTool(platform, run = systemCommand) {
+  const file = platform === 'win32' ? dumpcapPath() : platform === 'darwin' ? '/usr/sbin/tcpdump' : 'tcpdump';
+  if (await run(file, [platform === 'win32' ? '-v' : '--version']) === null)
+    throw new CaptureSetupError(platform === 'win32' ? 'Install Wireshark with Npcap to capture traffic, then retry. Configuration and file inspection work without it.' : 'Install tcpdump to capture traffic, then retry. Configuration and file inspection work without it.');
+  if (platform === 'win32' && await run(file, ['-D']) === null)
+    throw new CaptureSetupError('Npcap interfaces are unavailable. Check that Npcap is installed and its capture permissions allow this user.');
+  return file;
+}

package/src/server/traffic-radar-routes.mjs

@@ -1,4 +1,5 @@
 import { trafficCapture } from "./traffic-radar-capture.mjs";
+import { CaptureSetupError } from './traffic-radar-platform.mjs';
 const BASE = '/api/system/traffic-radar';
 const loopback = req => ['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(req.socket.remoteAddress);
 export function isAuthorizedTrafficIngest(req, url) {
@@ -33,8 +34,8 @@ export async function handleTrafficCapture(req, res, url, capture = trafficCaptu
       const data = JSON.parse((await body(req, 4096)).toString());
       return reply(res, 200, await capture.prepare(data.destination, req.socket.localPort));
     }
-    if (req.method === 'POST' && action === '/capture/stop') { capture.stop(); return reply(res, 200, { ok: true }); }
+    if (req.method === 'POST' && action === '/capture/stop') { await capture.stop(); return reply(res, 200, { ok: true }); }
     if (req.method === 'POST' && action === '/capture/clear') { capture.clear(); return reply(res, 200, { ok: true }); }
     return reply(res, 404, { error: 'Unknown capture action.' });
-  } catch { return reply(res, 400, { error: 'Could not complete capture setup. Use a valid IPv4 destination and check its network route.' }); }
+  } catch (error) { return reply(res, 400, { error: error instanceof CaptureSetupError ? error.message : 'Could not complete capture setup. Use a valid IPv4 destination and check its network route.' }); }
 }