ccdeck 3.41.3 → 3.42.0

package/dist/web/index.html

@@ -53,8 +53,8 @@
     <script>
       (function () {
         // Generated from JSON alongside the CSS and Settings catalog.
-        var themes = /* theme-ids:start */ ["light","dark","rider-black","vscode-black","omarchy","matrix","black-contrast","white-contrast","catppuccin-mocha"] /* theme-ids:end */;
-        var lightThemes = /* theme-light-ids:start */ ["light","white-contrast"] /* theme-light-ids:end */;
+        var themes = /* theme-ids:start */ ["light","dark","rider-black","vscode-black","omarchy","matrix","black-contrast","white-contrast","catppuccin-mocha","gruvbox-dark","gruvbox-light","gruvbox-material"] /* theme-ids:end */;
+        var lightThemes = /* theme-light-ids:start */ ["light","white-contrast","gruvbox-light"] /* theme-light-ids:end */;
         var stored = null;
         // `window.localStorage` is a GETTER that throws where site data is
         // blocked, so the property read is inside the try, not just getItem.
@@ -66,8 +66,19 @@
         document.documentElement.setAttribute("data-color-scheme", lightThemes.indexOf(theme) >= 0 ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-C80Hp_2s.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BgSnAnP6.css">
+    <script>
+      (function () {
+        var size = null, density = null;
+        try {
+          size = window.localStorage.getItem("agent-dag.text-size");
+          density = window.localStorage.getItem("agent-dag.density");
+        } catch (e) {}
+        document.documentElement.setAttribute("data-text-size", size === "smallest" || size === "smaller" || size === "larger" || size === "largest" ? size : "default");
+        document.documentElement.setAttribute("data-density", density === "tightest" || density === "tighter" || density === "compact" || density === "comfortable" ? density : "default");
+      })();
+    </script>
+    <script type="module" crossorigin src="/assets/index-DzDnLqDX.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BPLXy9SO.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.41.3",
+  "version": "3.42.0",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -78,6 +78,24 @@
     "3.40.1",
     "3.41.3"
   ],
+  "3.42.0": [
+    {
+      "title": "🔠 Text size and density, in Settings",
+      "body": "Five text sizes and five spacing levels, under Settings › Text & density."
+    },
+    {
+      "title": "🛠️ Tool activity: which tools your agents use, how long they take and what fails",
+      "body": "A new page on the stripe on the right. Its history is kept on this device only."
+    },
+    {
+      "title": "🎨 Gruvbox Dark, Light and Material themes",
+      "body": "Pick one in Settings › General. Switching themes now fades instead of snapping."
+    },
+    {
+      "title": "✨ A session-list drawer on phones, whole dates in usage history, the waiting session in the minimap",
+      "body": "Smaller fixes for the phone layout, the usage history chart and the canvas minimap."
+    }
+  ],
   "3.41.1": [
     {
       "title": "🪟 More reliable Windows updates",

package/src/server/agent-activity.mjs

@@ -33,10 +33,16 @@
 //     the same GitLab project — settings, jobs, branches. Fourteen rows
 //     describe that worse than one card does. That is what toEpisodes is for.
 //   * Without exclusions the deck reports ITSELF: 41 visits to 127.0.0.1:4317
-//     and 34 to 127.0.0.1:4399 carry FROM_API, because ccdeck opens its own tab
-//     through `open` on every start (bin/deck.js) and the listen fallback range
+//     and 34 to 127.0.0.1:4399 carry FROM_API, and the listen fallback range
 //     means it is not always the same port. defaultExclusions() is that, and
-//     only that.
+//     only that. This note used to say `open` was the reason — ccdeck opens its
+//     own tab with it on every start (bin/deck.js). Retested on 2026-10-14, a
+//     URL that `open` (macOS, Chrome 155) or `xdg-open` (Linux, Brave 1.95)
+//     hands to a running Chromium is recorded as AUTO_TOPLEVEL WITHOUT the bit,
+//     so those 75 visits most likely came from something else that loaded the
+//     deck's page (they were FROM_API over LINK, the shape an extension's
+//     tabs.update leaves). The exclusion stands either way: the deck's own
+//     origin does collect FROM_API visits.
 //
 // WHAT "NOBODY WAS AT THE BROWSER" MEANS HERE. It is derived from the visit
 // list itself: a human visit is any visit WITHOUT the bit. There is no OS idle
@@ -65,8 +71,25 @@
 // reports program navigation; the person reading the card decides what it was.
 
 /** Chrome's PAGE_TRANSITION_FROM_API qualifier — bit 27 of `visits.transition`.
- *  Set when the navigation was started through an API rather than by a person
- *  in the UI, which covers `open`, the debugger protocol, and an extension. */
+ *  Chromium defines it only as "originated from an external application", so
+ *  what sets it is Chrome's own code, and it is narrower than "any API":
+ *
+ *    SET by a page loaded with the DevTools protocol's `Page.navigate`, whatever
+ *    transition type was asked for (content/browser/devtools/protocol/
+ *    page_handler.cc), which is how Playwright and Puppeteer go to an address,
+ *    and by an extension's `chrome.tabs.update` with a URL
+ *    (chrome/browser/extensions/api/tabs/tabs_api.cc).
+ *
+ *    NOT SET by `Target.createTarget` with a URL (AUTO_TOPLEVEL,
+ *    chrome/browser/devtools/chrome_devtools_manager_delegate.cc), an
+ *    extension's `chrome.tabs.create` (LINK, extensions/open_tab_helper.cc), a
+ *    link a program clicks, or a URL handed over by `open` or `xdg-open`
+ *    (AUTO_TOPLEVEL, chrome/browser/ui/startup/startup_browser_creator_impl.cc).
+ *
+ *  Tested on 2026-10-14 on Brave 1.95 (Chromium 153, Linux) and Chrome 155
+ *  (macOS 26.6) with throwaway profiles. The NOT SET ones are invisible to this
+ *  module, and since a visit without the bit counts as a person (classify),
+ *  they can also cancel a program's flagged page within the quiet window. */
 export const FROM_API = 0x08000000;
 
 /** The same bit for the arbitrary-precision path below. */
@@ -227,11 +250,11 @@ function hostParts(text) {
  * Exclusion matchers for the deck's own pages, from the origins it is listening
  * on — `["http://127.0.0.1:4317"]`, or whatever the fallback range settled on.
  *
- * This is not politeness. ccdeck opens its own tab through `open`, so every
- * start writes a FROM_API visit to the deck's own origin, and those visits land
- * exactly where the rule is most sensitive: nobody is browsing at the moment a
- * background process opens a tab. Unfiltered, the feature's loudest and most
- * frequent finding is the feature itself.
+ * This is not politeness. The measured profile held FROM_API visits to the
+ * deck's own origin (the header's note says why `open` is not their cause),
+ * and those visits land exactly where the rule is most sensitive: nobody is
+ * browsing while a program loads the deck's page. Unfiltered, the feature's
+ * loudest and most frequent finding is the feature itself.
  *
  * Each origin expands to its port on all three loopback spellings, because the
  * deck opens 127.0.0.1 and a returning user may have typed localhost, and one

package/src/server/browser-watch-decks.mjs

@@ -34,8 +34,9 @@ import { isProcessAlive } from "./deck-probe.mjs";
  * `portRange`), so a machine that has been running decks for a month has tabs
  * on several. The real profile this feature was tuned against carried 41 visits
  * to 127.0.0.1:4317 and 34 to 127.0.0.1:4399 — two ports, both this deck, both
- * FROM_API because `open` is an API call, and every one of them a card the
- * panel would have shown its owner about itself.
+ * FROM_API (not from `open`, which left no FROM_API when tested: see FROM_API in
+ * agent-activity.mjs), and every one of them a card the panel would have shown
+ * its owner about itself.
  *
  * The whole range rather than the ports seen: the alternative is to remember
  * which ports past decks used, which is a file to keep, a file to migrate, and

package/src/server/browser-watch.mjs

@@ -664,10 +664,9 @@ async function readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, o
  * Everything the panel draws, in one object.
  *
  * `deckOrigins` are the addresses this deck is listening on. They are excluded
- * by default and it is not an optimisation: ccdeck opens its own tab through
- * `open` on every start, which Chrome records with the same FROM_API bit as any
- * other program, so a watch without them reports the deck as the intruder every
- * time it launches.
+ * by default and it is not an optimisation: the deck's own origin collects
+ * FROM_API visits like any other program's page (see defaultExclusions), so a
+ * watch without them reports the deck as the intruder.
  */
 export async function browserWatchSnapshot({
   deckOrigins = [],

package/src/server/codex-watch.mjs

@@ -244,8 +244,8 @@ async function readCodexHeader(path) {
 // write it to the log they share. The event is still buffered and broadcast —
 // every deck watching the session draws it — it is only the second copy on disk
 // that is dropped. See writesCodexLog in log-election.mjs.
-function emitCodexEvent(payload, persist) {
-  pushEvent(payload, "codex", { persist });
+function emitCodexEvent(payload, persist, toolAuditAt) {
+  pushEvent(payload, "codex", { persist, toolAuditAt });
 }
 
 /**
@@ -405,7 +405,7 @@ function emitCodexLines(state, consume, persist) {
     }
     if (payload) {
       ensureCodexRoot(state, persist);
-      emitCodexEvent(payload, persist);
+      emitCodexEvent(payload, persist, typeof obj.timestamp === "string" ? Date.parse(obj.timestamp) : undefined);
     }
   }
 }

package/src/server/event-pipeline.mjs

@@ -9,6 +9,7 @@
 // imports reach pushEvent through event-sink.mjs, connected below as this
 // module loads; index.mjs's routes import it from here. The bodies are
 // unchanged.
+import { noteToolAudit } from "./tool-audit.mjs";
 import { PRODUCT } from "./brand.mjs";
 import { createBlockNotifier } from "./block-notify.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
@@ -122,6 +123,7 @@ export function pushEvent(raw, source, opts = {}) {
   // Numbered, charged, held, and the ring evicted behind it — see admitEvent.
   const evt = admitEvent(raw, source, opts.receivedAt ?? Date.now());
   const seq = evt.seq;
+  noteToolAudit(raw, source, opts);
 
   // Does this event reach the log at all? Not on a replay (it came from
   // there), not when the hook told us another deck owns this session's log,

package/src/server/feedback-form.mjs

@@ -139,6 +139,7 @@ export function upstreamForm({ fields, images }, facts) {
   if (contact) text("contact", contact);
   text("appVersion", facts.appVersion);
   text("platform", facts.platform);
+  if (facts.deviceId) text("deviceId", facts.deviceId);
   for (const [index, { data, format }] of images.entries()) {
     const { type, extension } = FORMAT[format];
     parts.push(`${head(IMAGES_FIELD, `; filename="image-${index + 1}.${extension}"`)}Content-Type: ${type}\r\n\r\n`, data, "\r\n");

package/src/server/index.mjs

@@ -164,6 +164,8 @@ import { handleBrowserWatch, handleBrowserWatchDismiss, handleBrowserWatchSettin
 // The music routes, every one behind AGENTS_DECK_NO_MUSIC — see music-routes.mjs.
 import { handleBestOfNostalgia, handleCafeMusicBgm, handleClaudeFm, handleFmStation, handleGoodLifeRadio, handleLiveRadioMix, handleLofiGirl, handleRadioStations, handleRadioClick, handleMusicConfig } from "./music-routes.mjs";
 // The usage panel's quota and history reads — see usage-routes.mjs.
+import { startToolAudit } from "./tool-audit.mjs";
+import { handleToolAudit } from "./tool-audit-routes.mjs";
 import { startQuotaHistory } from "./quota-history.mjs";
 import { handleCcusage, handleCcusageSession, handleCodexQuota, handleCodexUsage, handleProviderStatus, handleQuota, handleQuotaHistory } from "./usage-routes.mjs";
 // The port fallback, one listen attempt, and the words for a failed one — see
@@ -192,6 +194,7 @@ export function requestUrl(rawUrl) {
 
 export async function startServer({ port = 4317, host = "127.0.0.1", persist = null, portRange = [4318, 4400], workspace = "", codex = true, claude = true, onRestart = null, onStop = null, cswapQuiet = null } = {}) {
   startQuotaHistory();
+  await startToolAudit();
   armLifecycle({ onRestart, onStop, persist, onSelfUpdate: () => reporter.noteSelfUpdate() });
   // Which tree and which CLIs, normalised once — see setDeckScope.
   setDeckScope({ workspace, claude, codex });
@@ -318,6 +321,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "POST" && url.pathname === "/api/restart")     return guard(handleRestart(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/presence")    return guard(handlePresence(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/shutdown")    return guard(handleStop(req, res), res);
+    if (["GET", "POST"].includes(req.method) && ["/api/tool-audit", "/api/tool-audit/storage"].includes(url.pathname)) return guard(handleToolAudit(req, res), res);
     if (req.method === "GET" && url.pathname === "/api/quota/history") return guard(handleQuotaHistory(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/quota")       return guard(handleQuota(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-usage")  return guard(handleCodexUsage(req, res), res);

package/src/server/pinned-build.mjs

@@ -53,6 +53,7 @@ const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
  */
 const PINNED_MODULES = [
   "self-update.mjs",
+  "tool-audit.mjs",
   "claude-accounts.mjs",
   "account-health.mjs",
   "cswap-admin.mjs",

package/src/server/reports-routes.mjs

@@ -7,7 +7,7 @@ import { reportsVetoed } from "./deck-prefs.mjs";
 import { MAX_REQUEST_BYTES, isMultipart, readFeedbackForm, upstreamForm } from "./feedback-form.mjs";
 import { readBody, readBytes, send } from "./http-io.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
-import { REPORTS_API, installFacts, reporter } from "./reports.mjs";
+import { REPORTS_API, deviceIdToken, installFacts, reporter, reportsOn } from "./reports.mjs";
 
 async function readJson(req, res, limit) {
   const raw = await readBody(req, res, limit).catch(() => null);
@@ -72,35 +72,54 @@ export async function handleClientError(req, res, { report = reporter } = {}) {
  * one message. AGENTS_DECK_NO_INSTALL=1 still wins, because the README promises
  * that it "turns off everything but the quota reads", and a launch script's
  * word about the machine outranks a button on the page.
+ *
+ * `device` is the fingerprint feedbackDeviceId picks; a test passes its own,
+ * or null for none.
  */
-export async function handleFeedback(req, res, { fetchImpl = globalThis.fetch, env = process.env } = {}) {
+export async function handleFeedback(req, res, { fetchImpl = globalThis.fetch, env = process.env, device = feedbackDeviceId({ env }) } = {}) {
   if (env.AGENTS_DECK_NO_INSTALL === "1") return send(res, 403, { ok: false, reason: "vetoed" });
+  // Left out of the post entirely when there is none: JSON drops an undefined.
+  const deviceId = device || undefined;
   const contentType = req.headers?.["content-type"];
-  if (isMultipart(contentType)) return forwardFeedbackForm(req, res, contentType, { fetchImpl, env });
+  if (isMultipart(contentType)) return forwardFeedbackForm(req, res, contentType, { fetchImpl, env, deviceId });
   const body = await readJson(req, res, 32_000);
   if (!body) return send(res, 400, { ok: false, reason: "bad_request" });
   const facts = feedbackFacts({ env });
   const contact = typeof body.contact === "string" && body.contact.trim() ? body.contact.trim() : undefined;
   return forwardFeedback(res, fetchImpl, {
     headers: { "content-type": "application/json", "user-agent": `ccdeck/${facts.appVersion}` },
-    body: JSON.stringify({ kind: body.kind, title: body.title, body: body.body, contact, ...facts }),
+    body: JSON.stringify({ kind: body.kind, title: body.title, body: body.body, contact, ...facts, deviceId }),
     timeoutMs: JSON_TIMEOUT_MS,
   });
 }
 
 /**
- * What this deck adds to a piece of feedback, and all it adds: the ccdeck
- * version, and the system as `os-arch` — `darwin-arm64`. installFacts knows
- * more than that (the channel, the runtime, a locale, a device fingerprint)
- * and none of it goes with feedback. One function for both posts and for the
- * line the dialog draws before Send, so what the page says is sent and what
- * the API is sent are one answer and cannot drift apart.
+ * What the dialog says, before Send, that this deck adds to a piece of
+ * feedback: the ccdeck version, and the system as `os-arch` — `darwin-arm64`.
+ * Both posts carry these two, from this one function, so what the line shows
+ * and what the API gets for them cannot drift apart.
+ *
+ * The posts also carry the device fingerprint (feedbackDeviceId), and the line
+ * does not show it: the owner's decision of 2026-10-14, so a report can be
+ * tied to the install that sent it. installFacts' other fields (the channel,
+ * the runtime, a locale) never go with feedback.
  */
 export function feedbackFacts({ env = process.env } = {}) {
   const facts = installFacts({ env });
   return { appVersion: facts.version, platform: `${facts.os}-${facts.arch}` };
 }
 
+/**
+ * The device fingerprint a piece of feedback carries: the same one-way hash
+ * every usage report sends (deviceIdToken), and under the same rule — only
+ * while reports are on. Switched off, or vetoed with AGENTS_DECK_NO_REPORTS=1,
+ * the fingerprint stays home here as it does everywhere else, and the feedback
+ * still goes. It is read here, never taken from the page.
+ */
+export function feedbackDeviceId({ env = process.env, prefs = heldPrefs.current() } = {}) {
+  return reportsOn(prefs, env) ? deviceIdToken() : undefined;
+}
+
 /** `GET /api/feedback`: what a report sent from here would carry besides its
  *  words, for the dialog to say before Send. Nothing leaves the machine. */
 export function handleFeedbackFacts(_req, res, { env = process.env } = {}) {
@@ -113,7 +132,7 @@ const JSON_TIMEOUT_MS = 20_000;
  *  seconds of upload before the API has read a byte of it. */
 const FORM_TIMEOUT_MS = 120_000;
 
-async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env }) {
+async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env, deviceId }) {
   // Over the cap, readBytes has already answered 413 too_large and the 400
   // below is a no-op; this is the answer to a read that failed some other way.
   const bytes = await readBytes(req, res, MAX_REQUEST_BYTES, { ok: false, reason: "too_large" }).catch(() => null);
@@ -125,7 +144,7 @@ async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env }) {
   return forwardFeedback(res, fetchImpl, {
     // No content type: fetch writes the form's own, boundary and all.
     headers: { "user-agent": `ccdeck/${facts.appVersion}` },
-    body: upstreamForm(form, facts),
+    body: upstreamForm(form, { ...facts, deviceId }),
     timeoutMs: FORM_TIMEOUT_MS,
   });
 }

package/src/server/request-gates.mjs

@@ -430,6 +430,8 @@ export function isAuthorizedDataRead(req) {
  *  costs nothing: every fetch of both is in src/web, and a page's own GET
  *  carries Sec-Fetch-Site: same-origin. */
 export const GUARDED_READS = new Set([
+  "/api/tool-audit",
+  "/api/tool-audit/storage",
   "/api/system/traffic-radar",
   "/api/system/traffic-radar/capture",
   "/api/system/traffic-radar/capture/event",

package/src/server/tool-audit-operations.mjs

@@ -0,0 +1,112 @@
+// Classify shell operations without evaluating shell syntax or retaining arguments.
+const safe = value => typeof value === 'string' && /^[A-Za-z0-9_./:+-]{1,100}$/.test(value) ? value : null;
+const basename = value => value.split(/[\\/]/).at(-1).replace(/\.exe$/i, '');
+const takesValue = new Set(['-C', '-c', '--git-dir', '--work-tree', '--namespace', '--config-env']);
+
+function shellWords(command) {
+  const segments = [[]]; let token = '', quote = '', escaped = false;
+  const word = () => { if (token) segments.at(-1).push(token); token = ''; };
+  for (const ch of command.slice(0, 32768)) {
+    if (escaped) { token += ch; escaped = false; continue; }
+    if (ch === '\\' && quote !== "'") { escaped = true; continue; }
+    if (quote) { if (ch === quote) quote = ''; else token += ch; continue; }
+    if (ch === '"' || ch === "'") { quote = ch; continue; }
+    if (/\s/.test(ch)) { if (ch === '\n') { word(); segments.push([]); } else word(); }
+    else if (';&|'.includes(ch)) { word(); if (segments.at(-1).length) segments.push([]); }
+    else token += ch;
+  }
+  word();
+  return { segments: segments.filter(s => s.length), uncertain: !!quote || escaped || /\$\(|`|<<|\b(?:if|for|while|case|function)\b/.test(command) };
+}
+function operation(words, depth = 0) {
+  let i = 0;
+  while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i] ?? '')) i++;
+  if (words[i] === 'env') { i++; while (words[i]?.startsWith('-') || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[i] ?? '')) i++; }
+  if (words[i] === 'sudo') { i++; if (words[i] === '-u') i += 2; }
+  if (words[i] === 'timeout') { i++; while (words[i]?.startsWith('-')) i++; i++; }
+  const exe = safe(words[i]); if (!exe) return 'shell (unclassified)';
+  const program = basename(exe); const args = words.slice(i + 1);
+  if (['sh', 'bash', 'zsh', 'pwsh', 'powershell'].includes(program) && depth < 2) {
+    const at = args.findIndex(a => /^-(?:[a-z]*c|Command)$/i.test(a));
+    if (at >= 0 && args[at + 1]) return shellOperations(args[at + 1], depth + 1);
+  }
+  if (program === 'git') {
+    let j = 0;
+    while (args[j]?.startsWith('-')) { const a = args[j++]; if (takesValue.has(a)) j++; }
+    const sub = safe(args[j]); return sub && /^[a-z][a-z-]*$/.test(sub) ? `git ${sub}` : 'git';
+  }
+  if (['npm', 'pnpm', 'yarn', 'bun', 'dotnet', 'cargo', 'docker', 'kubectl', 'gh', 'uv'].includes(program)) {
+    const sub = args.find(a => !a.startsWith('-'));
+    if (!safe(sub) || !/^[a-z][a-z-]*$/.test(sub)) return program;
+    const at = args.indexOf(sub);
+    if (['run', 'run-script'].includes(sub) && safe(args[at + 1])) return `${program} run ${args[at + 1]}`;
+    if (program === 'docker' && ['compose', 'container', 'image'].includes(sub) && /^[a-z][a-z-]*$/.test(args[at + 1] ?? '')) return `${program} ${sub} ${args[at + 1]}`;
+    return `${program} ${sub}`;
+  }
+  return safe(program) ?? 'shell (unclassified)';
+}
+export function shellOperations(command, depth = 0) {
+  const { segments, uncertain } = shellWords(command);
+  if (uncertain || !segments.length || segments.length > 32) return ['shell (unclassified)'];
+  return [...new Set(segments.flatMap(words => operation(words, depth)))].slice(0, 16);
+}
+export function auditOperations(name, input) {
+  const tool = safe(name) ?? 'tool (unclassified)';
+  if (['exec', 'functions.exec'].includes(name) && typeof input?.script === 'string') return { tool, operations: scriptOperations(input.script), shell: true, wrapped: true };
+  if (/^(?:Bash|Shell|exec_command|run|shell_command|functions\.exec_command|mcp__.*__exec_command)$/i.test(name ?? '')) {
+    const command = input?.command ?? input?.cmd;
+    if (typeof command === 'string' && command.length <= 32768) return { tool, operations: shellOperations(command), shell: true };
+    return { tool, operations: ['shell (unclassified)'], shell: true };
+  }
+  return { tool, operations: [tool], shell: false };
+}
+
+// Tokenize the wrapper without running it. Strings/comments cannot masquerade
+// as tools calls; only literal cmd values are classified as shell operations.
+export function scriptOperations(script) {
+  if (typeof script !== 'string' || script.length > 32768) return ['exec (unclassified)'];
+  const tokens = []; let i = 0;
+  while (i < script.length) {
+    const c = script[i];
+    if (/\s/.test(c)) { i++; continue; }
+    if (script.slice(i, i + 2) === '//') { i = script.indexOf('\n', i); if (i < 0) break; continue; }
+    if (script.slice(i, i + 2) === '/*') { const end = script.indexOf('*/', i + 2); if (end < 0) break; i = end + 2; continue; }
+    if (['"', "'", '`'].includes(c)) {
+      const quote = c; i++; let value = '', valid = true, closed = false;
+      while (i < script.length) {
+        const ch = script[i++];
+        if (ch === quote) { closed = true; break; }
+        if (quote === '`' && ch === '$' && script[i] === '{') valid = false;
+        if (ch !== '\\') { value += ch; continue; }
+        const escaped = script[i++];
+        if (escaped === undefined) { valid = false; break; }
+        const simple = { n: '\n', r: '\r', t: '\t', '\\': '\\', '"': '"', "'": "'", '`': '`' };
+        if (Object.hasOwn(simple, escaped)) value += simple[escaped];
+        else if (escaped === '\n') continue;
+        else valid = false;
+      }
+      tokens.push({ kind: 'string', value: valid && closed ? value : null }); continue;
+    }
+    const id = /^[A-Za-z_$][\w$]*/.exec(script.slice(i));
+    if (id) { tokens.push({ kind: 'id', value: id[0] }); i += id[0].length; }
+    else { tokens.push({ kind: 'punct', value: c }); i++; }
+  }
+  const operations = [];
+  for (let j = 0; j < tokens.length - 4; j++) {
+    if (tokens[j].kind !== 'id' || tokens[j].value !== 'tools' || tokens[j + 1].value !== '.' || tokens[j + 2].kind !== 'id' || tokens[j + 3].value !== '(') continue;
+    const method = tokens[j + 2].value;
+    if (method !== 'exec_command') { operations.push(safe(method) ?? 'tool (unclassified)'); continue; }
+    let cmd = null, depth = 0;
+    if (tokens[j + 4].value === '{') {
+      for (let k = j + 4; k < tokens.length; k++) {
+        const t = tokens[k];
+        if (t.kind === 'punct' && t.value === '{') depth++;
+        if (t.kind === 'punct' && t.value === '}' && --depth <= 0) break;
+        if (depth === 1 && t.value === 'cmd' && ['id', 'string'].includes(t.kind) && tokens[k + 1]?.value === ':' && tokens[k + 2]?.kind === 'string'
+            && [',', '}'].includes(tokens[k + 3]?.value)) { cmd = tokens[k + 2].value; break; }
+      }
+    }
+    operations.push(...(cmd === null ? ['shell (unclassified)'] : shellOperations(cmd)));
+  }
+  return operations.length ? [...new Set(operations)].slice(0, 16) : ['exec (unclassified)'];
+}

package/src/server/tool-audit-report.mjs

@@ -0,0 +1,115 @@
+// Runs in a worker: complete local journals, not the canvas's bounded call list.
+export async function buildToolAuditReport({ files, query, now, meta }, { createReadStream, createInterface }) {
+const DAY = 86400000;
+const finite = n => typeof n === 'number' && Number.isFinite(n);
+const valid = r => /^[a-f0-9]{64}$/.test(r?.id ?? '') && ['claude', 'codex'].includes(r.provider)
+  && ['start', 'end'].includes(r.kind) && finite(r.t) && (r.at === null || finite(r.at))
+  && ['hook', 'rollout'].includes(r.clock)
+  && (r.kind === 'end' ? typeof r.failed === 'boolean' : typeof r.tool === 'string' && r.tool.length <= 100
+    && Array.isArray(r.operations) && r.operations.length > 0 && r.operations.length <= 16
+    && r.operations.every(s => typeof s === 'string' && s.length <= 150));
+const percentile = (sorted, p) => sorted.length ? sorted[Math.max(0, Math.ceil(sorted.length * p) - 1)] : null;
+  const calls = new Map(); let corrupt = 0, duplicates = 0;
+  // Explicit failure rather than a convincing-looking partial report.
+  for (const file of files) {
+    if (file.size > 64 * 1024 * 1024) throw new Error('Daily tool history exceeds report capacity');
+    if (!file.size) continue;
+    const stream = createReadStream(file.path, { start: 0, end: file.size - 1, encoding: 'utf8' });
+    const lines = createInterface({ input: stream, crlfDelay: Infinity });
+    try {
+      for await (const line of lines) {
+        if (!line) continue;
+        let r; try { r = JSON.parse(line); } catch { corrupt++; continue; }
+        if (!valid(r)) { corrupt++; continue; }
+        let call = calls.get(r.id);
+        if (!call) { if (calls.size >= 500000) throw new Error('Tool history exceeds report capacity; choose shorter retention in Settings'); call = {}; calls.set(r.id, call); }
+        if (call[r.kind]) { duplicates++; continue; }
+        call[r.kind] = r;
+      }
+    } finally { lines.close(); stream.destroy(); }
+  }
+  const since = query.since ?? now - (query.days ?? 7) * DAY;
+  const until = query.until ?? now;
+  const retainedSince = Math.max(meta.startedAt, Math.floor(now / DAY) * DAY - (meta.retentionDays - 1) * DAY);
+  const daily = new Map();
+  const dayFormatter = query.history ? new Intl.DateTimeFormat('en-CA', { timeZone: query.timeZone ?? 'UTC', year: 'numeric', month: '2-digit', day: '2-digit', hour: '2-digit', minute: '2-digit', second: '2-digit', hourCycle: 'h23' }) : null;
+  const dayKey = time => {
+    const parts = Object.fromEntries(dayFormatter.formatToParts(new Date(time)).map(part => [part.type, part.value]));
+    return `${parts.year}-${parts.month}-${parts.day}`;
+  };
+  // Calendar labels advance independently of offsets: DST days may be 23 or 25 hours.
+  if (query.history && query.operation) {
+    const first = Date.parse(dayKey(since)), last = Date.parse(dayKey(until));
+    if (!Number.isFinite(first) || !Number.isFinite(last) || last - first > 91 * DAY) throw new Error('Daily history exceeds report capacity');
+    const retainedDay = dayKey(retainedSince);
+    const atBoundary = (time, end = false) => {
+      const parts = Object.fromEntries(dayFormatter.formatToParts(new Date(time)).map(part => [part.type, part.value]));
+      return parts.hour === (end ? '23' : '00') && parts.minute === (end ? '59' : '00') && parts.second === (end ? '59' : '00') && ((time % 1000) + 1000) % 1000 === (end ? 999 : 0);
+    };
+    const firstDay = dayKey(since), lastDay = dayKey(until);
+    const firstPartial = !atBoundary(since), lastPartial = !atBoundary(until, true), retainedPartial = !atBoundary(retainedSince);
+    for (let date = first; date <= last; date += DAY) {
+      const key = new Date(date).toISOString().slice(0, 10);
+      daily.set(key, { date: key, calls: 0, measured: 0, shared: 0, providers: { claude: 0, codex: 0 }, durations: [],
+        status: key < retainedDay ? 'outside-history' : 'no-calls', partial: key === retainedDay && retainedPartial || key === firstDay && firstPartial || key === lastDay && lastPartial });
+    }
+  }
+  const groups = new Map(); let total = 0, measured = 0, failed = 0, pending = 0, orphaned = 0;
+  const details = [];
+  let totalMs = null, observedSince = null, observedUntil = null;
+  const providers = { claude: { calls: 0, measured: 0, failed: 0 }, codex: { calls: 0, measured: 0, failed: 0 } };
+  for (const [id, call] of calls) {
+    const start = call.start, end = call.end;
+    if (!start) { orphaned++; continue; }
+    if (start.t < since || start.t > until || query.provider !== 'all' && start.provider !== query.provider) continue;
+    total++; providers[start.provider].calls++;
+    observedSince = observedSince === null ? start.t : Math.min(observedSince, start.t);
+    observedUntil = observedUntil === null ? start.t : Math.max(observedUntil, start.t);
+    const duration = end && start.clock === end.clock && finite(start.at) && finite(end.at)
+      && end.at >= start.at && end.at - start.at <= 7 * DAY ? end.at - start.at : null;
+    if (duration !== null) { measured++; providers[start.provider].measured++; totalMs = (totalMs ?? 0) + duration; }
+    if (end?.failed) { failed++; providers[start.provider].failed++; }
+    if (!end) pending++;
+    const shared = start.operations.length > 1;
+    for (const operation of start.operations) {
+      let group = groups.get(operation);
+      if (!group) { group = { operation, calls: 0, completed: 0, failed: 0, missingTiming: 0, pending: 0, shared: 0, durations: [], providers: { claude: 0, codex: 0 }, tools: new Set() }; groups.set(operation, group); }
+      group.calls++; group.providers[start.provider]++; group.tools.add(start.tool);
+      if (end) group.completed++; else group.pending++;
+      if (end?.failed) group.failed++;
+      if (shared) group.shared++;
+      if (duration !== null) group.durations.push(duration); else group.missingTiming++;
+      if (operation === query.operation && daily.size) {
+        const bucket = daily.get(dayKey(start.t));
+        if (bucket) { bucket.calls++; bucket.providers[start.provider]++; if (shared) bucket.shared++; if (duration !== null) { bucket.measured++; bucket.durations.push(duration); } }
+      }
+      if (operation === query.operation) details.push({ id, operation, provider: start.provider, tool: start.tool,
+        capturedAt: start.t, durationMs: duration, state: !end ? 'unmatched' : end.failed ? 'failed' : 'success', clock: start.clock, shared });
+    }
+  }
+  const rows = [...groups.values()].map(g => {
+    const durations = g.durations.sort((a, b) => a - b);
+    const n = durations.length;
+    return { operation: g.operation, calls: g.calls, completed: g.completed, failed: g.failed,
+      errorRate: g.completed ? g.failed / g.completed : null, measured: n, missingTiming: g.missingTiming,
+      unmatched: g.pending, shared: g.shared, providers: g.providers, tools: [...g.tools],
+      totalMs: n ? durations.reduce((a, b) => a + b, 0) : null,
+      averageMs: n ? durations.reduce((a, b) => a + b, 0) / n : null,
+      medianMs: n ? n % 2 ? durations[Math.floor(n / 2)] : (durations[n / 2 - 1] + durations[n / 2]) / 2 : null,
+      p95Ms: n >= 20 ? percentile(durations, .95) : null, maxMs: n ? durations.at(-1) : null };
+  }).sort((a, b) => b.calls - a.calls || a.operation.localeCompare(b.operation));
+  return { ok: true, capturedAt: now, since, until, provider: query.provider, total, measured, failed, unmatched: pending,
+    corrupt, duplicates, orphaned, rows, totalMs, completed: total - pending, providers, observedSince, observedUntil,
+    retainedSince,
+    details: query.operation ? { operation: query.operation, total: details.length,
+      ...(query.history ? { capturedAt: now, measurements: rows.find(row => row.operation === query.operation) ?? null, history: { timeZone: query.timeZone ?? 'UTC', days: [...daily.values()].map(bucket => {
+        const sorted = bucket.durations.sort((a, b) => a - b), n = sorted.length;
+        return { date: bucket.date, calls: bucket.calls, measured: n, shared: bucket.shared, providers: bucket.providers, partial: bucket.partial,
+          status: n ? 'measured' : bucket.calls ? 'missing-timing' : bucket.status,
+          averageMs: n ? sorted.reduce((sum, duration) => sum + duration, 0) / n : null,
+          medianMs: n ? n % 2 ? sorted[Math.floor(n / 2)] : (sorted[n / 2 - 1] + sorted[n / 2]) / 2 : null,
+          maxMs: n ? sorted.at(-1) : null, p95Ms: n >= 20 ? percentile(sorted, .95) : null };
+      }) } } : {}),
+      slowest: details.filter(d => d.durationMs !== null).sort((a, b) => b.durationMs - a.durationMs).slice(0, 20),
+      recent: details.sort((a, b) => b.capturedAt - a.capturedAt).slice(0, 30) } : null };
+}

package/src/server/tool-audit-routes.mjs

@@ -0,0 +1,38 @@
+import { toolAudit } from './tool-audit.mjs';
+import { readBody, send } from './http-io.mjs';
+const calendarDate = value => /^\d{4}-\d{2}-\d{2}$/.test(value ?? '') && Number.isFinite(Date.parse(value)) && new Date(value).toISOString().slice(0, 10) === value;
+export function auditQuery(params) {
+  const provider = params.get('provider') ?? 'all';
+  const days = Number(params.get('days') ?? 7);
+  const operation = params.get('operation') ?? undefined;
+  const since = params.get('since'), until = params.get('until');
+  const history = params.get('history');
+  let timeZone = params.get('timeZone') ?? 'UTC';
+  if (history !== null && history !== '1' || history && !operation || timeZone.length > 80) return null;
+  try { timeZone = new Intl.DateTimeFormat('en', { timeZone }).resolvedOptions().timeZone; } catch { return null; }
+  if (!['all', 'claude', 'codex'].includes(provider) || ![1, 7, 30, 60, 90].includes(days)
+      || operation && operation.length > 150 || !!since !== !!until) return null;
+  if (since && (!calendarDate(since) || !calendarDate(until) || since > until || Date.parse(until) - Date.parse(since) >= 90 * 86400000)) return null;
+  return { provider, days, operation, ...(history ? { history: true, timeZone } : {}), ...(since ? { since: Date.parse(since), until: Date.parse(until) + 86400000 - 1 } : {}) };
+}
+export async function handleToolAudit(req, res) {
+  const audit = toolAudit();
+  if (!audit) return send(res, 503, { ok: false, reason: 'unavailable' });
+  if (req.method === 'GET') {
+    if (new URL(req.url, 'http://localhost').pathname.endsWith('/storage')) return send(res, 200, await audit.status());
+    const query = auditQuery(new URL(req.url, 'http://localhost').searchParams);
+    if (!query) return send(res, 400, { ok: false, reason: 'bad_range' });
+    const controller = new AbortController();
+    const cancel = () => { if (!res.writableEnded) controller.abort(); };
+    res.once('close', cancel);
+    let report;
+    try { report = await audit.report(query, controller.signal); }
+    catch (e) { if (controller.signal.aborted) return; throw e; }
+    finally { res.off('close', cancel); }
+    return send(res, report.ok ? 200 : 409, report);
+  }
+  let body; try { body = JSON.parse(await readBody(req, res, 2048)); } catch { return send(res, 400, { ok: false, reason: 'bad_body' }); }
+  if (body?.action === 'clear' && body.confirm === true) return send(res, 200, await audit.clear());
+  if (body?.action === 'retention' && [30, 60, 90].includes(body.days)) return send(res, 200, await audit.configure(body.days));
+  return send(res, 400, { ok: false, reason: 'bad_action' });
+}