ccdeck 3.41.3 → 3.43.0

package/dist/web/assets/index-Bkx27-wy.js

@@ -0,0 +1 @@
+import"./app-9p127oSR.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const e of document.querySelectorAll('link[rel="modulepreload"]'))i(e);new MutationObserver(e=>{for(const r of e)if(r.type==="childList")for(const o of r.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&i(o)}).observe(document,{childList:!0,subtree:!0});function s(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),e.crossOrigin==="use-credentials"?r.credentials="include":e.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function i(e){if(e.ep)return;e.ep=!0;const r=s(e);fetch(e.href,r)}})();

package/dist/web/index.html

@@ -53,8 +53,8 @@
     <script>
       (function () {
         // Generated from JSON alongside the CSS and Settings catalog.
-        var themes = /* theme-ids:start */ ["light","dark","rider-black","vscode-black","omarchy","matrix","black-contrast","white-contrast","catppuccin-mocha"] /* theme-ids:end */;
-        var lightThemes = /* theme-light-ids:start */ ["light","white-contrast"] /* theme-light-ids:end */;
+        var themes = /* theme-ids:start */ ["light","dark","rider-black","vscode-black","omarchy","matrix","black-contrast","white-contrast","catppuccin-mocha","gruvbox-dark","gruvbox-light","gruvbox-material"] /* theme-ids:end */;
+        var lightThemes = /* theme-light-ids:start */ ["light","white-contrast","gruvbox-light"] /* theme-light-ids:end */;
         var stored = null;
         // `window.localStorage` is a GETTER that throws where site data is
         // blocked, so the property read is inside the try, not just getItem.
@@ -66,10 +66,24 @@
         document.documentElement.setAttribute("data-color-scheme", lightThemes.indexOf(theme) >= 0 ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-C80Hp_2s.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-BgSnAnP6.css">
+    <script>
+      (function () {
+        var size = null, density = null;
+        try {
+          size = window.localStorage.getItem("agent-dag.text-size");
+          density = window.localStorage.getItem("agent-dag.density");
+        } catch (e) {}
+        document.documentElement.setAttribute("data-text-size", size === "smallest" || size === "smaller" || size === "larger" || size === "largest" ? size : "default");
+        document.documentElement.setAttribute("data-density", density === "tightest" || density === "tighter" || density === "compact" || density === "comfortable" ? density : "default");
+      })();
+    </script>
+    <script type="module" crossorigin src="/assets/index-Bkx27-wy.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/app-9p127oSR.js">
+    <link rel="stylesheet" crossorigin href="/assets/app-DsHSufBt.css">
   </head>
   <body>
     <div id="root"></div>
+    <!-- entry.ts, not main.tsx: the entry holds no app code, so the app runs
+         once whatever URL the entry is loaded under. See entry.ts (#2162). -->
   </body>
 </html>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.41.3",
+  "version": "3.43.0",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -78,6 +78,46 @@
     "3.40.1",
     "3.41.3"
   ],
+  "3.43.0": [
+    {
+      "title": "🏠 Auto-switch can come back to a home account",
+      "body": "Choose Set as home in an account’s ⋯ menu. With Auto-switch on, Next account › Soonest weekly reset uses up quota that resets within 4 days first."
+    },
+    {
+      "title": "🔄 Sessions already running appear when ccdeck starts",
+      "body": "Busy Codex sessions, and Claude ones on macOS and Linux, show up again after a restart. Restore unfinished sessions, in Settings › General, turns it off."
+    },
+    {
+      "title": "⚙️ Settings, reorganized and searchable",
+      "body": "Search every setting from the top of the list. Keyboard, Data and About have sections of their own."
+    },
+    {
+      "title": "📋 Plan progress and reasoning effort on agent cards",
+      "body": "Cards show how far an agent is through its plan, and the effort beside the model. Finished sessions can hide themselves after a delay you choose."
+    },
+    {
+      "title": "✨ Calmer desktop updates, marked shared accounts, Codex sub-agents kept together",
+      "body": "The desktop app installs an update only when no agent is working or waiting. Accounts shared on Local network are marked."
+    }
+  ],
+  "3.42.0": [
+    {
+      "title": "🔠 Text size and density, in Settings",
+      "body": "Five text sizes and five spacing levels, under Settings › Text & density."
+    },
+    {
+      "title": "🛠️ Tool activity: which tools your agents use, how long they take and what fails",
+      "body": "A new page on the stripe on the right. Its history is kept on this device only."
+    },
+    {
+      "title": "🎨 Gruvbox Dark, Light and Material themes",
+      "body": "Pick one in Settings › General. Switching themes now fades instead of snapping."
+    },
+    {
+      "title": "✨ A session-list drawer on phones, whole dates in usage history, the waiting session in the minimap",
+      "body": "Smaller fixes for the phone layout, the usage history chart and the canvas minimap."
+    }
+  ],
   "3.41.1": [
     {
       "title": "🪟 More reliable Windows updates",

package/src/server/account-choice.mjs

@@ -0,0 +1,198 @@
+// Which account Auto-switch should be on, by the owner's two rules — a home
+// account it comes back to, and "soonest weekly reset" as the way it picks the
+// next one — asked before claude-swap's own engine runs.
+//
+// THE ENGINE STAYS THE SAFETY NET. claude-swap decides with `best` exactly as it
+// did before; this only answers when one of the two rules has something better
+// to say, and answers nothing otherwise. Nothing here is consulted at all while
+// neither rule is set, so a deck that never touched them switches as it always
+// did.
+//
+// WHY NOT claude-swap's OWN `consume-first`. It ranks by the weekly reset too,
+// but it has no horizon, skips the hysteresis gate below the threshold, and
+// pulls away from any account it is on — and upstream measured endless
+// 1→2→1→3 cycles when it was combined with a preferred account (PR #260). So
+// the engine is left on `best`, and while it is not, the moves below the
+// threshold are not made here either: two strategies would take turns.
+//
+// WHAT A MOVE MADE HERE DOES NOT DO. A `cswap switch` run by the deck does not
+// start the engine's cooldown and switches off its guard against undoing its
+// own last move (autoswitch.py `_no_return_account`). An account landed on
+// above the threshold would be left again on the very next tick. So a target
+// is only ever an account comfortably under it, read recently, with no window
+// that has reset since it was read — and the deck keeps a cooldown of its own.
+//
+// Pure: the roster, the rules and the clock in, a target or null out. The loop
+// (cswap-auto-loop.mjs) reads the store, carries out the move and remembers
+// what happened.
+
+/** Accounts further than this from their weekly reset are not chased. */
+export const WEEKLY_HORIZON_H = 95;
+/** How far under the threshold a target must sit, so the engine — which
+ *  leaves an account at the threshold — does not leave it again at once. */
+export const ROOM_MARGIN_PCT = 5;
+/** A reading older than this is not acted on: claude-swap re-reads an idle
+ *  account every five to ten minutes while the loop runs. */
+export const FRESH_FOR_MS = 15 * 60_000;
+/** Below the threshold, a sooner weekly reset is worth a move only when it is
+ *  at least this much sooner — so two accounts that reset within the same hour
+ *  do not trade places. */
+export const WEEKLY_LEAD_S = 3600;
+/** How long after any move the optional ones wait. The engine leaves an
+ *  account at the threshold even when its 5-hour window resets minutes later;
+ *  measured in the simulated week, a move straight back followed five minutes
+ *  on. Nothing optional is worth a move that soon after another. */
+export const SETTLE_MS = 30 * 60_000;
+
+/** The two ways to pick the next account. "room" is the engine's own. */
+export const NEXT_CHOICES = Object.freeze(["room", "weekly"]);
+
+/**
+ * The scoped (per-model) lanes the engine counts, from its `autoswitch.model`
+ * setting: none, "all", or a comma list matched case-insensitively against
+ * the model's name — the rule autoswitch.py applies to the same windows.
+ */
+export function countedModels(setting) {
+  const raw = typeof setting === "string" ? setting.trim() : "";
+  if (!raw) return [];
+  if (raw.toLowerCase() === "all") return "all";
+  return raw.split(",").map(s => s.trim().toLowerCase()).filter(Boolean);
+}
+
+/** The lanes that decide whether an account is over the threshold: 5h, 7d and
+ *  whichever model lanes the engine counts. */
+export function bindingLanes(account, models) {
+  return (account?.lanes ?? []).filter(l => {
+    if (l.id === "five_hour" || l.id === "seven_day") return true;
+    if (!String(l.id).startsWith("scoped-")) return false;
+    return models === "all" || (Array.isArray(models) && models.includes(String(l.label).toLowerCase()));
+  });
+}
+
+/** The tightest of those lanes, as a percentage used, or null when none. */
+export function usedOf(account, models) {
+  const lanes = bindingLanes(account, models);
+  return lanes.length ? Math.max(...lanes.map(l => l.pct)) : null;
+}
+
+/** When the weekly window resets, in unix seconds, or null when unknown. */
+export function weeklyResetOf(account) {
+  const lane = (account?.lanes ?? []).find(l => l.id === "seven_day");
+  return typeof lane?.resetAt === "number" ? lane.resetAt : null;
+}
+
+/**
+ * Whether this account's numbers may be acted on now: read in the last
+ * FRESH_FOR_MS, and no counted window has reset since. A window past its reset
+ * still carries the percentage from before it — wrong in the direction that
+ * matters least for leaving and most for landing, so it is simply not used
+ * until claude-swap has read the account again.
+ */
+export function readingCurrent(account, models, now) {
+  if (typeof account?.fetchedAt !== "number" || now - account.fetchedAt > FRESH_FOR_MS) return false;
+  return bindingLanes(account, models).every(l => l.resetAt == null || l.resetAt * 1000 > now);
+}
+
+/**
+ * Whether Auto-switch may land on this account: signed in, in rotation, not
+ * the one another paired deck is working on, not one claude-swap has
+ * quarantined, read recently, and comfortably under the threshold on every
+ * window that counts. An account with no 5-hour or weekly window (an API key)
+ * is never a target here; the engine still decides about those.
+ *
+ * QUARANTINED IS NOT THE SAME AS SIGNED OUT. The engine quarantines an account
+ * when the refresh it tries before activating one says the token is dead. Its
+ * usage reads go on working until the access token expires, hours later, so
+ * the roster still calls it healthy — and `cswap switch`, which is what a move
+ * here runs, does not ask the engine.
+ */
+export function landable(account, { threshold, models, busy, quarantined, now }) {
+  if (!account || account.active || account.disabled || account.alive === false) return false;
+  if (account.error || account.reauth) return false;
+  if (busy?.has?.(account.key) || quarantined?.has?.(account.key)) return false;
+  const ids = new Set((account.lanes ?? []).map(l => l.id));
+  if (!ids.has("five_hour") || !ids.has("seven_day")) return false;
+  if (!readingCurrent(account, models, now)) return false;
+  return usedOf(account, models) < threshold - ROOM_MARGIN_PCT;
+}
+
+/** The landable account whose weekly window resets soonest within the horizon
+ *  (and before `before`, when given), the one with more room first on a tie,
+ *  then the lower slot — or null. */
+function soonestWeekly(accounts, ctx, before = null) {
+  const limit = ctx.now / 1000 + WEEKLY_HORIZON_H * 3600;
+  const fits = accounts
+    .filter(a => landable(a, ctx))
+    .map(a => ({ a, reset: weeklyResetOf(a), used: usedOf(a, ctx.models) }))
+    .filter(x => x.reset != null && x.reset * 1000 > ctx.now && x.reset <= limit)
+    .filter(x => before == null || x.reset <= before - WEEKLY_LEAD_S)
+    .sort((x, y) => x.reset - y.reset || x.used - y.used || x.a.num - y.a.num);
+  return fits.length ? fits[0] : null;
+}
+
+/**
+ * Where Auto-switch should move now, or null for "leave it to the engine".
+ *
+ *   accounts  roster rows (claude-accounts.mjs), each with its `key`
+ *   choice    { next: "room"|"weekly", home: key|null, manual, goHome }
+ *             `manual` — the account in use was picked by hand, so the moves
+ *             nobody needs (below the threshold) leave it alone. `goHome` —
+ *             somebody just set a home and expects to be taken there.
+ *   threshold the engine's, in percent
+ *   models    countedModels(...) of the engine's model setting
+ *   busy      keys of the accounts whose login is live somewhere else: on a
+ *             paired deck, or in a `cswap run` session
+ *   quarantined keys of the accounts claude-swap's engine has quarantined
+ *   sinceMove ms since the last move, the engine's or this one's
+ *   cooldownMs the engine's cooldown, which every move here keeps too
+ *   optional  whether moves below the threshold may be made at all: only
+ *             while the engine itself is on `best`
+ *
+ * Returns { to, trigger: "home"|"weekly-reset", leaving, resetAt? }.
+ */
+export function chooseAccount({ accounts, choice, threshold, models = [], busy = new Set(), quarantined = new Set(), sinceMove = Infinity, cooldownMs = 300_000, optional = true, now }) {
+  const next = choice?.next === "weekly" ? "weekly" : "room";
+  const homeKey = choice?.home ?? null;
+  if (next === "room" && !homeKey) return null;
+  if (sinceMove < cooldownMs || !Number.isFinite(threshold)) return null;
+
+  const active = accounts.find(a => a.active);
+  // The engine reads the account it is on every minute or so; if the store
+  // has nothing current for it, the engine is the one to sort that out.
+  if (!active || !readingCurrent(active, models, now)) return null;
+  const used = usedOf(active, models);
+  if (used == null) return null;
+
+  const ctx = { threshold, models, busy, quarantined, now };
+  const home = homeKey ? accounts.find(a => a.key === homeKey) ?? null : null;
+  const onHome = home != null && home === active;
+
+  // HAS TO LEAVE: the engine would move now. Home first, then the soonest
+  // weekly reset within the horizon; when neither fits, the engine picks the
+  // account with the most room, as it always has — so nobody is ever stuck.
+  if (used >= threshold) {
+    if (home && !onHome && landable(home, ctx)) return { to: home, trigger: "home", leaving: true };
+    if (next === "weekly") {
+      const pick = soonestWeekly(accounts, ctx);
+      if (pick) return { to: pick.a, trigger: "weekly-reset", leaving: true, resetAt: pick.reset };
+    }
+    return null;
+  }
+
+  // BELOW THE THRESHOLD every move is optional, and four things stop one: a
+  // second strategy in the engine, being home (never left from under the
+  // threshold — that is what keeps the two rules from taking turns), a
+  // hand-picked account, which stays picked until it fills or a home is set,
+  // and a move less than SETTLE_MS ago. A home somebody has just set is the
+  // one exception to the last: they asked to be taken there.
+  if (!optional || onHome) return null;
+  const settled = sinceMove >= Math.max(cooldownMs, SETTLE_MS);
+  if (home && (choice.goHome || (!choice.manual && settled)) && landable(home, ctx)) {
+    return { to: home, trigger: "home", leaving: false };
+  }
+  if (choice.manual || next !== "weekly" || !settled) return null;
+  const mine = weeklyResetOf(active);
+  if (mine == null || mine * 1000 <= now) return null;
+  const pick = soonestWeekly(accounts, ctx, mine);
+  return pick ? { to: pick.a, trigger: "weekly-reset", leaving: false, resetAt: pick.reset } : null;
+}

package/src/server/account-notify.mjs

@@ -285,18 +285,24 @@ export function usedBefore(result, fromNumber) {
  * "Switched to work@x.com · personal@x.com reached 90%".
  *
  * The reason is stated only when the tick carries it: the account it left had
- * used at least the threshold the policy ran with. A switch for any other
- * reason — the account's usage could not be read, or a strategy that moves
- * below the threshold — says where it went and from where, and nothing about
- * why.
+ * used at least the threshold the policy ran with. Below it, the deck's own two
+ * rules say theirs (cswap-auto-choice.mjs) — "home" is a return to the home
+ * account, "weekly-reset" a move to the account whose weekly limit resets
+ * sooner. A switch for any other reason — the account's usage could not be
+ * read — says where it went and from where, and nothing about why.
  */
-export function swapNotice({ toName, fromName, used, threshold }) {
+export function swapNotice({ toName, fromName, used, threshold, trigger = null, resetAt = null, now = Date.now() }) {
   const to = toName ? cut(toName, NAME_MAX) : "another account";
-  if (!fromName) return { who: SWAP_WHO, body: `Switched to ${to}` };
+  const verb = trigger === "home" ? "Back on" : "Switched to";
+  if (!fromName) return { who: SWAP_WHO, body: `${verb} ${to}` };
   const from = cut(fromName, NAME_MAX);
-  if (used != null && used >= 100) return { who: SWAP_WHO, body: `Switched to ${to} · ${from} reached 100%` };
+  if (used != null && used >= 100) return { who: SWAP_WHO, body: `${verb} ${to} · ${from} reached 100%` };
   if (used != null && typeof threshold === "number" && used >= threshold) {
-    return { who: SWAP_WHO, body: `Switched to ${to} · ${from} reached ${pctLabel(threshold)}%` };
+    return { who: SWAP_WHO, body: `${verb} ${to} · ${from} reached ${pctLabel(threshold)}%` };
+  }
+  if (trigger === "home") return { who: SWAP_WHO, body: `Back on ${to} · your home account` };
+  if (trigger === "weekly-reset" && typeof resetAt === "number" && resetAt * 1000 > now) {
+    return { who: SWAP_WHO, body: `Switched to ${to} · weekly limit resets in ${inDuration(resetAt, now)}` };
   }
   return { who: SWAP_WHO, body: `Switched to ${to} from ${from}` };
 }
@@ -488,6 +494,7 @@ export function createAccountNotifier({
         say(swapNotice({
           toName: to?.name ?? null, fromName: from?.name ?? null,
           used: usedBefore(result, result.from?.number), threshold: result.threshold,
+          trigger: result.trigger ?? null, resetAt: result.resetAt ?? null, now: at,
         }));
       }
       await persist();

package/src/server/account-routes.mjs

@@ -348,6 +348,12 @@ export async function handleCswapAutoAction(req, res) {
     case "account":
       result = await mod.setAccountEnabled(parsed.account, parsed.enabled === true);
       break;
+    case "next":
+      result = await mod.setNextChoice(parsed.value);
+      break;
+    case "home":
+      result = await mod.setHomeAccount(parsed.account ?? null);
+      break;
     default:
       return send(res, 400, { ok: false, reason: "unknown_action" });
   }

package/src/server/activity.mjs

@@ -1,4 +1,4 @@
-// Whether any agent is mid-turn, from the hook stream alone.
+// Whether any agent is mid-turn, from live events and startup snapshots.
 //
 // For the one decision the server takes on its own that must not land in the
 // middle of a turn: restarting into a new version while nobody is looking
@@ -16,8 +16,15 @@
 // its Stop, and waiting on one forever would mean never updating.
 export const OPEN_CAP_MS = 30 * 60_000;
 
+const RECOVERIES = new Set(["CodexSessionRecovered", "ClaudeSessionRecovered"]);
+
+/** Persisted history is not live activity; a fresh startup snapshot is. */
+export function shouldTrackActivity(raw, opts = {}) {
+  return !opts.replay || RECOVERIES.has(raw?.hook_event_name);
+}
+
 const OPENS = new Set([
-  "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "SubagentStart", "SubagentStop",
+  ...RECOVERIES, "UserPromptSubmit", "PreToolUse", "PostToolUse", "PostToolUseFailure", "SubagentStart", "SubagentStop",
 ]);
 const CLOSES = new Set(["Stop", "SessionEnd"]);
 
@@ -40,7 +47,8 @@ export function createActivity({ openCapMs = OPEN_CAP_MS } = {}) {
   return {
     /** One hook payload, as pushEvent receives it. Anything else is ignored. */
     note(raw, at) {
-      const name = raw?.hook_event_name;
+      const name = raw?.recovery_active === false && RECOVERIES.has(raw?.hook_event_name)
+        ? "Stop" : raw?.hook_event_name;
       if (!OPENS.has(name) && !CLOSES.has(name)) return;
       if (at > lastAt) lastAt = at;
       const id = raw?.session_id;

package/src/server/agent-activity.mjs

@@ -33,10 +33,16 @@
 //     the same GitLab project — settings, jobs, branches. Fourteen rows
 //     describe that worse than one card does. That is what toEpisodes is for.
 //   * Without exclusions the deck reports ITSELF: 41 visits to 127.0.0.1:4317
-//     and 34 to 127.0.0.1:4399 carry FROM_API, because ccdeck opens its own tab
-//     through `open` on every start (bin/deck.js) and the listen fallback range
+//     and 34 to 127.0.0.1:4399 carry FROM_API, and the listen fallback range
 //     means it is not always the same port. defaultExclusions() is that, and
-//     only that.
+//     only that. This note used to say `open` was the reason — ccdeck opens its
+//     own tab with it on every start (bin/deck.js). Retested on 2026-10-14, a
+//     URL that `open` (macOS, Chrome 155) or `xdg-open` (Linux, Brave 1.95)
+//     hands to a running Chromium is recorded as AUTO_TOPLEVEL WITHOUT the bit,
+//     so those 75 visits most likely came from something else that loaded the
+//     deck's page (they were FROM_API over LINK, the shape an extension's
+//     tabs.update leaves). The exclusion stands either way: the deck's own
+//     origin does collect FROM_API visits.
 //
 // WHAT "NOBODY WAS AT THE BROWSER" MEANS HERE. It is derived from the visit
 // list itself: a human visit is any visit WITHOUT the bit. There is no OS idle
@@ -65,8 +71,25 @@
 // reports program navigation; the person reading the card decides what it was.
 
 /** Chrome's PAGE_TRANSITION_FROM_API qualifier — bit 27 of `visits.transition`.
- *  Set when the navigation was started through an API rather than by a person
- *  in the UI, which covers `open`, the debugger protocol, and an extension. */
+ *  Chromium defines it only as "originated from an external application", so
+ *  what sets it is Chrome's own code, and it is narrower than "any API":
+ *
+ *    SET by a page loaded with the DevTools protocol's `Page.navigate`, whatever
+ *    transition type was asked for (content/browser/devtools/protocol/
+ *    page_handler.cc), which is how Playwright and Puppeteer go to an address,
+ *    and by an extension's `chrome.tabs.update` with a URL
+ *    (chrome/browser/extensions/api/tabs/tabs_api.cc).
+ *
+ *    NOT SET by `Target.createTarget` with a URL (AUTO_TOPLEVEL,
+ *    chrome/browser/devtools/chrome_devtools_manager_delegate.cc), an
+ *    extension's `chrome.tabs.create` (LINK, extensions/open_tab_helper.cc), a
+ *    link a program clicks, or a URL handed over by `open` or `xdg-open`
+ *    (AUTO_TOPLEVEL, chrome/browser/ui/startup/startup_browser_creator_impl.cc).
+ *
+ *  Tested on 2026-10-14 on Brave 1.95 (Chromium 153, Linux) and Chrome 155
+ *  (macOS 26.6) with throwaway profiles. The NOT SET ones are invisible to this
+ *  module, and since a visit without the bit counts as a person (classify),
+ *  they can also cancel a program's flagged page within the quiet window. */
 export const FROM_API = 0x08000000;
 
 /** The same bit for the arbitrary-precision path below. */
@@ -227,11 +250,11 @@ function hostParts(text) {
  * Exclusion matchers for the deck's own pages, from the origins it is listening
  * on — `["http://127.0.0.1:4317"]`, or whatever the fallback range settled on.
  *
- * This is not politeness. ccdeck opens its own tab through `open`, so every
- * start writes a FROM_API visit to the deck's own origin, and those visits land
- * exactly where the rule is most sensitive: nobody is browsing at the moment a
- * background process opens a tab. Unfiltered, the feature's loudest and most
- * frequent finding is the feature itself.
+ * This is not politeness. The measured profile held FROM_API visits to the
+ * deck's own origin (the header's note says why `open` is not their cause),
+ * and those visits land exactly where the rule is most sensitive: nobody is
+ * browsing while a program loads the deck's page. Unfiltered, the feature's
+ * loudest and most frequent finding is the feature itself.
  *
  * Each origin expands to its port on all three loopback spellings, because the
  * deck opens 127.0.0.1 and a returning user may have typed localhost, and one

package/src/server/browser-watch-decks.mjs

@@ -34,8 +34,9 @@ import { isProcessAlive } from "./deck-probe.mjs";
  * `portRange`), so a machine that has been running decks for a month has tabs
  * on several. The real profile this feature was tuned against carried 41 visits
  * to 127.0.0.1:4317 and 34 to 127.0.0.1:4399 — two ports, both this deck, both
- * FROM_API because `open` is an API call, and every one of them a card the
- * panel would have shown its owner about itself.
+ * FROM_API (not from `open`, which left no FROM_API when tested: see FROM_API in
+ * agent-activity.mjs), and every one of them a card the panel would have shown
+ * its owner about itself.
  *
  * The whole range rather than the ports seen: the alternative is to remember
  * which ports past decks used, which is a file to keep, a file to migrate, and

package/src/server/browser-watch.mjs

@@ -664,10 +664,9 @@ async function readProfile(profile, { sinceChromeTime, copyDir, deps, quietMs, o
  * Everything the panel draws, in one object.
  *
  * `deckOrigins` are the addresses this deck is listening on. They are excluded
- * by default and it is not an optimisation: ccdeck opens its own tab through
- * `open` on every start, which Chrome records with the same FROM_API bit as any
- * other program, so a watch without them reports the deck as the intruder every
- * time it launches.
+ * by default and it is not an optimisation: the deck's own origin collects
+ * FROM_API visits like any other program's page (see defaultExclusions), so a
+ * watch without them reports the deck as the intruder.
  */
 export async function browserWatchSnapshot({
   deckOrigins = [],

package/src/server/claude-recovery.mjs

@@ -0,0 +1,150 @@
+import { open, readdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { claudeConfigDir, ccProjectSlug } from "./claude-dir.mjs";
+import { canonicalCwd } from "./canonical-path.mjs";
+import { codexCwdInWorkspace } from "./log-election.mjs";
+import { readByteRange } from "./jsonl-chunks.mjs";
+import { run } from "./exec.mjs";
+import { heldPrefs, prefsRead } from "./prefs-state.mjs";
+import { pushEvent } from "./event-sink.mjs";
+import { outputWatch, touchSession } from "./session-tracking.mjs";
+import { maybeResolveContext, maybeResolveModel, maybeResolveUsage } from "./session-enrichment.mjs";
+
+const FILE_LIMIT = 128;
+const REGISTRY_BYTES = 64 * 1024;
+const TRANSCRIPT_BYTES = 256 * 1024;
+const normalizeStart = value => typeof value === "string" ? value.trim().replace(/\s+/g, " ") : "";
+
+/** PID existence alone cannot distinguish a reused PID from the old process. */
+export async function claudeProcessStarts(pids) {
+  const starts = new Map();
+  // The registry's POSIX lstart fingerprint has no verified Windows equivalent.
+  // Unsupported identity formats are deliberately left to normal live hooks.
+  if (!["darwin", "linux"].includes(process.platform) || !pids.length) return starts;
+  const result = await run("ps", ["-p", pids.join(","), "-o", "pid=,lstart="], {
+    timeout: 1500, maxBuffer: 64 * 1024, env: { ...process.env, LC_ALL: "C" },
+  });
+  starts.complete = result.ok || (result.code === 1 && !result.stderr.trim());
+  // ps exits 1 when all candidates are gone; partial output is still useful.
+  for (const line of result.stdout.split("\n")) {
+    const match = /^\s*(\d+)\s+(.+)$/.exec(line);
+    if (match) starts.set(Number(match[1]), normalizeStart(match[2]));
+  }
+  return starts;
+}
+
+async function registry(path) {
+  let file;
+  try {
+    file = await open(path, "r");
+    const info = await file.stat();
+    if (!info.isFile() || info.size > REGISTRY_BYTES) return null;
+    const bytes = Buffer.alloc(info.size);
+    const { bytesRead } = await file.read(bytes, 0, bytes.length, 0);
+    return JSON.parse(bytes.subarray(0, bytesRead).toString("utf8"));
+  } catch { return null; }
+  finally { await file?.close(); }
+}
+
+export async function claudeRecoveryPrompt(path) {
+  try {
+    const info = await stat(path);
+    const from = Math.max(0, info.size - TRANSCRIPT_BYTES);
+    let text = await readByteRange(path, from, info.size);
+    if (from) text = text.slice(text.indexOf("\n") + 1);
+    const end = text.lastIndexOf("\n");
+    if (end < 0) return {};
+    let prompt, model;
+    for (const line of text.slice(0, end).split("\n")) {
+      let row;
+      try { row = JSON.parse(line); } catch { continue; }
+      if (row?.isSidechain) continue;
+      if (row?.type === "assistant" && typeof row.message?.model === "string") model = row.message.model;
+      if (row?.type !== "user") continue;
+      const content = row.message?.content;
+      const value = typeof content === "string" ? content : Array.isArray(content)
+        ? content.filter(part => part?.type === "text" && typeof part.text === "string").map(part => part.text).join("\n") : "";
+      if (value) prompt = value;
+    }
+    return { prompt, model };
+  } catch { return {}; }
+}
+
+/** Bounded discovery plus status reconciliation for the sessions it recovered. */
+export function createClaudeRecovery({ workspace = "", home = claudeConfigDir(),
+  platform = process.platform, starts = claudeProcessStarts, emit = pushEvent,
+  enrich = raw => {
+    outputWatch.note(raw.session_id, raw.transcript_path);
+    touchSession(raw.session_id);
+    maybeResolveModel(raw); maybeResolveUsage(raw); maybeResolveContext(raw);
+  }, enabled = () => heldPrefs.current().recoverClaudeSessions !== false } = {}) {
+  let stopped = false, pending = null, startupEnabled, startupFiles;
+  const startupIdentities = new Map();
+  const tracked = new Map();
+  async function scanOnce() {
+    await prefsRead;
+    startupEnabled ??= enabled();
+    if (stopped || !startupEnabled) return;
+    const observedAt = Date.now();
+    let files;
+    try {
+      startupFiles ??= (await readdir(join(home, "sessions"))).filter(name => /^\d+\.json$/.test(name)).sort().slice(0, FILE_LIMIT);
+      files = startupFiles;
+    }
+    catch { return; }
+    const candidates = [];
+    for (const name of files) {
+      const path = join(home, "sessions", name);
+      const row = await registry(path);
+      if (!row || row.pid !== Number(name.slice(0, -5)) || !Number.isSafeInteger(row.pid) || row.pid <= 0 ||
+        row.pidDomain !== platform || !normalizeStart(row.procStart) ||
+        typeof row.sessionId !== "string" || !/^[a-z0-9][a-z0-9_-]{0,127}$/i.test(row.sessionId) ||
+        typeof row.cwd !== "string" || !row.cwd) continue;
+      const identity = `${row.pid}:${row.procStart}:${row.sessionId}`;
+      if (startupIdentities.has(path) && startupIdentities.get(path) !== identity) continue;
+      startupIdentities.set(path, identity);
+      const cwd = await canonicalCwd(row.cwd);
+      if (!codexCwdInWorkspace(cwd, workspace)) continue;
+      candidates.push({ path, row, cwd });
+    }
+    const identities = await starts([...new Set([...candidates.map(c => c.row.pid), ...[...tracked.values()].filter(t => t.active).map(t => t.pid)])]);
+    for (const [sid, prior] of tracked) {
+      if (!prior.active || stopped) continue;
+      const actual = identities.get(prior.pid);
+      if ((actual && actual !== normalizeStart(prior.procStart)) || (!actual && identities.complete === true)) {
+        emit({ hook_event_name: "ClaudeSessionRecovered", provider: "claude", session_id: sid,
+          cwd: prior.cwd, snapshot_observed_at: observedAt, recovery_active: false, recovery_session_closed: true,
+        }, "hook", { replay: true, persist: false });
+        prior.active = false;
+      }
+    }
+    candidates.sort((a, b) => (Number(b.row.updatedAt) || 0) - (Number(a.row.updatedAt) || 0));
+    const selected = new Set();
+    for (const { path, row, cwd } of candidates) {
+      if (stopped) return;
+      if (identities.get(row.pid) !== normalizeStart(row.procStart)) continue;
+      if (selected.has(row.sessionId)) continue;
+      selected.add(row.sessionId);
+      const previous = tracked.get(row.sessionId);
+      if (row.status !== "busy" && row.status !== "idle") continue;
+      const active = row.status === "busy";
+      if (previous?.active === active) continue;
+      const transcript = join(home, "projects", ccProjectSlug(row.cwd), `${row.sessionId}.jsonl`);
+      const facts = active ? await claudeRecoveryPrompt(transcript) : {};
+      // A hook/status update can overtake the transcript read.
+      const latest = await registry(path);
+      if (!latest || latest.sessionId !== row.sessionId || latest.pid !== row.pid ||
+        latest.procStart !== row.procStart || latest.status !== row.status || latest.updatedAt !== row.updatedAt) continue;
+      if (stopped) return;
+      emit({ hook_event_name: "ClaudeSessionRecovered", provider: "claude", session_id: row.sessionId,
+        cwd, snapshot_observed_at: observedAt, recovery_active: active, ...facts,
+      }, "hook", { replay: true, persist: false });
+      tracked.set(row.sessionId, { active, pid: row.pid, procStart: row.procStart, cwd });
+      if (active) enrich({ session_id: row.sessionId, cwd, transcript_path: transcript });
+    }
+  }
+  return {
+    scan() { return pending ??= scanOnce().finally(() => { pending = null; }); },
+    stop() { stopped = true; },
+  };
+}