ccdeck 3.41.3 → 3.43.0

package/src/server/cswap-auto-choice.mjs

@@ -0,0 +1,296 @@
+// The deck's own step in an auto-switch tick, taken before claude-swap's
+// engine: the home account and "soonest weekly reset" rules
+// (account-choice.mjs), carried out, and what they need remembered between
+// ticks.
+//
+// NOTHING SET, NOTHING DONE. With the next account left on "most room" and no
+// home, a tick never reads anything here beyond this file and goes straight to
+// the engine — the behaviour every deck had before these rules existed.
+//
+// WHAT IS REMEMBERED, per machine, in auto-choice.json beside prefs.json:
+//
+//   next        "room" | "weekly"
+//   home        { key, email, orgUuid } or null — an identity, never a slot:
+//               slots are reused and differ between machines (lan-copies.mjs)
+//   manual      the account in use was picked by hand: the panel's Switch, the
+//               terminal, anything that was not a tick. The moves nobody needs
+//               leave it alone until it fills.
+//   goHome      a home was just set, so the next tick may take the user there
+//   lastActive  the account the last tick left the user on, which is how a
+//               switch made by hand is told from one a tick made
+//   lastMoveAt  when a tick last moved the account, for the cooldowns
+//
+// The ticks run one at a time under the store mutex; the panel's two writes
+// do not, so every write here goes through one chain.
+import { readFile, readdir, mkdir } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { deckDataDir } from "./deck-home.mjs";
+import { writeFileAtomic } from "./atomic-write.mjs";
+import { backupRoot, fetchClaudeAccounts, slotNumber, switchClaudeAccount } from "./claude-accounts.mjs";
+import { readCswapConfig } from "./cswap-auto-readers.mjs";
+import { accountKey } from "./lan-copies.mjs";
+import { isProcessAlive } from "./deck-probe.mjs";
+import { chooseAccount, countedModels, NEXT_CHOICES } from "./account-choice.mjs";
+
+/** Where the choice is kept: beside prefs.json, in the deck's own data. */
+export function choicePath(home = deckDataDir()) {
+  return join(home, "auto-choice.json");
+}
+
+const text = v => (typeof v === "string" && v ? v : null);
+
+/** Whatever is on disk, as a whole and known-shaped choice. */
+export function normaliseChoice(raw) {
+  const src = raw && typeof raw === "object" ? raw : {};
+  const home = src.home && typeof src.home === "object" && text(src.home.email)
+    ? { key: accountKey(src.home.email, src.home.orgUuid), email: src.home.email, orgUuid: text(src.home.orgUuid) }
+    : null;
+  return {
+    next: NEXT_CHOICES.includes(src.next) ? src.next : "room",
+    home,
+    manual: src.manual === true,
+    goHome: home != null && src.goHome === true,
+    lastActive: text(src.lastActive),
+    lastMoveAt: Number.isFinite(src.lastMoveAt) ? src.lastMoveAt : 0,
+  };
+}
+
+// The choice as last read or written. This process is the file's only writer,
+// so after the first read a tick asks memory, not the disk — which is what
+// keeps a deck with nothing set paying nothing per tick.
+let _held = null;
+
+async function readChoice() {
+  if (_held) return _held;
+  try { _held = normaliseChoice(JSON.parse(await readFile(choicePath(), "utf8"))); } catch { _held = normaliseChoice(null); }
+  return _held;
+}
+
+let _writes = Promise.resolve();
+/** Read, change and write the choice, one change at a time. A change that
+ *  changes nothing writes nothing: most ticks only confirm where they are. */
+function updateChoice(change) {
+  const done = _writes.then(async () => {
+    const before = await readChoice();
+    const next = normaliseChoice(change(before));
+    if (JSON.stringify(next) === JSON.stringify(before)) return before;
+    const path = choicePath();
+    await mkdir(dirname(path), { recursive: true });
+    await writeFileAtomic(path, `${JSON.stringify(next)}\n`);
+    _held = next;
+    return next;
+  });
+  _writes = done.catch(() => {});
+  return done;
+}
+
+/** What the panel draws: the strategy, and whose row carries the home mark. */
+export async function choiceStatus() {
+  const c = await readChoice();
+  return { next: c.next, home: c.home ? { email: c.home.email, orgUuid: c.home.orgUuid } : null };
+}
+
+/** "room" or "weekly". Choosing is a decision about the account in use too,
+ *  so a pick made by hand no longer holds the new rule back. */
+export async function setNextChoice(value) {
+  if (!NEXT_CHOICES.includes(value)) return { ok: false, reason: "bad_value" };
+  await updateChoice(c => ({ ...c, next: value, manual: false, lastActive: null }));
+  return { ok: true };
+}
+
+/**
+ * Make the account in slot `accountNum` the home, or clear it with null.
+ * Setting one is asking to be taken there: the next tick does, once the
+ * account is usable, even from an account picked by hand.
+ */
+export async function setHomeAccount(accountNum) {
+  if (accountNum === null) {
+    await updateChoice(c => ({ ...c, home: null, goHome: false }));
+    return { ok: true };
+  }
+  const num = slotNumber(accountNum);
+  if (num == null) return { ok: false, reason: "bad_account" };
+  const roster = await fetchClaudeAccounts();
+  const row = roster?.ok ? roster.accounts?.find(a => a.num === num) : null;
+  if (!row?.email) return { ok: false, reason: "bad_account" };
+  await updateChoice(c => ({ ...c, home: { email: row.email, orgUuid: row.orgUuid ?? null }, goHome: true, manual: false }));
+  return { ok: true };
+}
+
+/** Auto-switch was just turned on: whatever happened while it was off is not
+ *  a pick to protect, so the next tick starts from the account in use. */
+export function forgetPicksByHand() {
+  return updateChoice(c => ({ ...c, manual: false, lastActive: null })).catch(() => {});
+}
+
+/**
+ * What claude-swap's engine keeps in autoswitch_state.json that a move here
+ * has to respect: when it last switched, in ms or 0 — a move the deck makes
+ * does not start the engine's cooldown, so this one keeps both — and the
+ * accounts it has quarantined, by key.
+ *
+ * A quarantine is the slot's, with the email it held: the engine drops one
+ * whose slot now holds somebody else, so it is only this account's while the
+ * emails agree. One the engine would drop for a fresh login it drops on its
+ * next run, which every tick that does not move here is.
+ */
+async function engineState(accounts) {
+  let state = null;
+  try { state = JSON.parse(await readFile(join(backupRoot(), "autoswitch_state.json"), "utf8")); } catch {}
+  const at = Number(state?.lastSwitchAt);
+  const held = state?.quarantine && typeof state.quarantine === "object" ? state.quarantine : {};
+  const sameEmail = (x, y) => typeof x === "string" && typeof y === "string" && x.trim().toLowerCase() === y.trim().toLowerCase();
+  return {
+    lastSwitchAt: Number.isFinite(at) && at > 0 ? at * 1000 : 0,
+    quarantined: new Set(accounts.filter(a => sameEmail(held[String(a.num)]?.email, a.email)).map(a => a.key)),
+  };
+}
+
+/** The accounts the decks this one is paired with say they are working on.
+ *  One login live on two machines races for every renewal (README, "One login
+ *  live in one place"), so a tick never moves onto one of them. */
+async function accountsOnOtherDecks() {
+  try {
+    const { lanEngine } = await import("./lan-deck.mjs");
+    const peers = lanEngine.status()?.peers ?? [];
+    return new Set(peers.map(p => p?.offers?.current?.key).filter(k => typeof k === "string"));
+  } catch {
+    return new Set();
+  }
+}
+
+/** The name claude-swap gives an account's `cswap run` profile after its
+ *  slot number: the email, NFC, with anything but ASCII letters, digits and
+ *  `._-` turned into `_` (claude_swap/session.py, slugify_email). */
+export function sessionSlug(email) {
+  return [...String(email ?? "").normalize("NFC")].map(ch => (/^[A-Za-z0-9._-]$/.test(ch) ? ch : "_")).join("");
+}
+
+/**
+ * The accounts a `cswap run` session is working on, by key. Such a session
+ * runs Claude Code on the account's own copy of the login; the engine never
+ * activates one of them, because two copies of one login race for every
+ * renewal. `cswap switch`, which is what a move here runs, only warns — so
+ * the deck asks the same question first.
+ *
+ * Claude Code leaves one record per running instance in the profile's
+ * `sessions/<pid>.json`; one counts while its process is running. A pid used
+ * again by something else reads as live too, which only leaves that move to
+ * the engine.
+ */
+async function accountsInCswapRun(accounts) {
+  const live = new Set();
+  for (const a of accounts) {
+    if (a.num == null || !a.email) continue;
+    const dir = join(backupRoot(), "sessions", `${a.num}-${sessionSlug(a.email)}`, "sessions");
+    let names = [];
+    try { names = (await readdir(dir)).filter(n => /^\d+\.json$/.test(n)); } catch { continue; }
+    for (const name of names) {
+      let pid = null;
+      try { pid = Number(JSON.parse(await readFile(join(dir, name), "utf8"))?.pid); } catch {}
+      if (Number.isSafeInteger(pid) && pid > 0 && isProcessAlive(pid)) { live.add(a.key); break; }
+    }
+  }
+  return live;
+}
+
+const numberOr = (v, fallback) => {
+  const n = Number(v);
+  return v != null && v !== "" && Number.isFinite(n) ? n : fallback;
+};
+
+/** One side of a move, in the shape claude-swap's own `switch` event has. */
+const refOf = a => (a ? { number: a.num, email: a.email ?? null } : null);
+
+/**
+ * Ask the two rules, and move when they say so. Under the store mutex, from
+ * the tick (cswap-auto-loop.mjs).
+ *
+ * Returns `{ result, accounts }`: `result` is a tick in the shape summarise
+ * gives the engine's — so the caches, the swap log and the notification treat
+ * the move as any other — or null for "run the engine"; `accounts` is the
+ * roster it decided on, which noteEngineTick needs to name where the engine
+ * went, and null when nothing is set.
+ */
+export async function chooseBeforeEngine({ now = Date.now() } = {}) {
+  const choice = await readChoice();
+  if (choice.next === "room" && !choice.home) return { result: null, accounts: null };
+  const roster = await fetchClaudeAccounts();
+  if (!roster?.ok || !Array.isArray(roster.accounts)) return { result: null, accounts: null };
+  const accounts = roster.accounts.map(a => ({ ...a, key: accountKey(a.email, a.orgUuid) }));
+  const active = accounts.find(a => a.active) ?? null;
+
+  const byHand = active != null && choice.lastActive != null && choice.lastActive !== active.key;
+  const manual = choice.manual || byHand;
+  const goHome = choice.goHome && active?.key !== choice.home?.key;
+  // WHAT THIS TICK LEARNED, WRITTEN OVER WHAT IS THERE NOW. The panel's writes
+  // do not wait for the store lock, so "Set as home" or a new rule can land
+  // while the awaits below run. `manual` and `goHome` were worked out from the
+  // choice as it was read, so they are only written back over that same
+  // choice — over a newer one they would undo what the person just set.
+  // Every write replaces the held object, which is what tells the two apart.
+  const keep = c => (c === choice
+    ? { ...c, manual, goHome, lastActive: active?.key ?? c.lastActive }
+    : { ...c, lastActive: active?.key ?? c.lastActive });
+
+  const cfg = (await readCswapConfig()) ?? {};
+  const threshold = numberOr(cfg["autoswitch.threshold"]?.value, 90);
+  const models = countedModels(cfg["autoswitch.model"]?.value);
+  const engine = await engineState(accounts);
+  const pick = chooseAccount({
+    accounts,
+    choice: { next: choice.next, home: choice.home?.key ?? null, manual, goHome },
+    threshold,
+    models,
+    busy: new Set([...await accountsOnOtherDecks(), ...await accountsInCswapRun(accounts)]),
+    quarantined: engine.quarantined,
+    sinceMove: now - Math.max(choice.lastMoveAt, engine.lastSwitchAt),
+    cooldownMs: numberOr(cfg["autoswitch.cooldownSeconds"]?.value, 300) * 1000,
+    optional: (cfg["autoswitch.strategy"]?.value ?? "best") === "best",
+    now,
+  });
+  if (!pick) {
+    await updateChoice(keep);
+    return { result: null, accounts };
+  }
+  const moved = await switchClaudeAccount(pick.to.num);
+  if (!moved.ok) {
+    await updateChoice(keep);
+    return { result: null, accounts };
+  }
+  // The move happened, so where it left the user and when are true whatever
+  // was set meanwhile; a home still to be gone to is the current choice's.
+  await updateChoice(c => ({
+    ...c, manual: false, goHome: (c === choice ? goHome : c.goHome) && pick.to.key !== c.home?.key,
+    lastActive: pick.to.key, lastMoveAt: now,
+  }));
+  return {
+    result: {
+      ok: true,
+      event: "switch",
+      switched: true,
+      trigger: pick.trigger,
+      reason: null,
+      detail: null,
+      from: refOf(active),
+      to: refOf(pick.to),
+      active: refOf(active),
+      threshold,
+      // What the notification reads, in the shape claude-swap's poll gives:
+      // room per account, and the windows of each by label.
+      headroom: Object.fromEntries(accounts.map(a => [String(a.num), a.headroom ?? null])),
+      windows: Object.fromEntries(accounts.map(a => [String(a.num),
+        Object.fromEntries((a.lanes ?? []).map(l => [l.label, l.pct]))])),
+      resetAt: pick.resetAt ?? null,
+    },
+    accounts,
+  };
+}
+
+/** The engine switched in a tick this step had looked at: the account it left
+ *  the user on is the tick's pick, not one made by hand. */
+export async function noteEngineTick(result, accounts) {
+  if (!accounts || !result?.switched) return;
+  const to = accounts.find(a => String(a.num) === String(result.to?.number));
+  await updateChoice(c => ({ ...c, manual: false, lastActive: to?.key ?? null, lastMoveAt: Date.now() }));
+}

package/src/server/cswap-auto-loop.mjs

@@ -20,6 +20,9 @@ import { withStoreLock } from "./store-lock.mjs";
 // moved the account is said once on the desktop (account-notify.mjs). Both
 // doors return at once and never throw.
 import { noteAutoSwitch, noteAutoTick } from "./account-watch.mjs";
+// The owner's two rules — a home account, and the soonest weekly reset — asked
+// before the engine, inside the same lock. With neither set, nothing.
+import { chooseBeforeEngine, forgetPicksByHand, noteEngineTick } from "./cswap-auto-choice.mjs";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -51,6 +54,9 @@ function summarise(stdout) {
     // `switch` event for a decision it did not carry out, and a false positive
     // here throws away readings that cost a subprocess each.
     switched:  events.some(e => e.event === "switch" && e.dryRun !== true),
+    // Why the engine moved — "proactive", "at-limit", "failover" — beside the
+    // deck's own "home" and "weekly-reset" (cswap-auto-choice.mjs).
+    trigger:   action?.trigger ?? null,
     reason:    action?.reason ?? null,
     detail:    action?.detail ?? null,
     from:      action?.from ?? null,
@@ -94,9 +100,15 @@ async function runAutoTick() {
   const r = await withStoreLock(async () => {
     if (!_enabled) return { skipped: "disabled" };
     if (await externalAutoRunning()) return { skipped: "external-engine" };
-    return run(await cswapBin(), ["auto", "--once", "--json"], { timeout: TICK_TIMEOUT_MS });
+    // The deck's own rules first. A move they make is the tick; when they have
+    // nothing to say — or cannot say it — the engine decides, as it always did.
+    const chose = await chooseBeforeEngine().catch(() => ({ result: null, accounts: null }));
+    if (chose.result) return { chose: chose.result };
+    const out = await run(await cswapBin(), ["auto", "--once", "--json"], { timeout: TICK_TIMEOUT_MS });
+    return { ...out, accounts: chose.accounts };
   });
   if (r.skipped) return { event: "skipped", reason: r.skipped };
+  if (r.chose) return r.chose;
   // A KILLED RUN IS NOT A QUIET ONE. `run`'s timeout path deliberately keeps an
   // 8 KB tail of whatever the child managed to print, so `!r.ok && !r.stdout`
   // is false for a tick that emitted its `{"event":"poll"}` line and then
@@ -109,7 +121,10 @@ async function runAutoTick() {
   if (!r.ok && !r.stdout) {
     return { ok: false, reason: "tick_failed", detail: failureDetail(r, 300) };
   }
-  return { ok: true, ...summarise(r.stdout) };
+  const result = { ok: true, ...summarise(r.stdout) };
+  // Where the engine left the user is a tick's pick, not one made by hand.
+  if (result.switched) await noteEngineTick(result, r.accounts).catch(() => {});
+  return result;
 }
 
 // ── deck-managed loop ──────────────────────────────────────────────────────
@@ -340,6 +355,7 @@ export function lastTick() {
 export async function setAutoEnabled(enabled) {
   _enabled = Boolean(enabled);
   noteAutoSwitch(_enabled);
+  if (_enabled) await forgetPicksByHand();
   await saveState({ ...(await loadState()), enabled: _enabled });
   if (_enabled) await startLoop(); else stopLoop();
   return { ok: true, enabled: _enabled };

package/src/server/cswap-auto-readers.mjs

@@ -9,6 +9,7 @@
 // it re-exports all five names, which is where the suite reaches them.
 import { run } from "./exec.mjs";
 import { cswapBin, cswapRefused } from "./cswap-install.mjs";
+import { stripAnsi } from "./term.mjs";
 
 // ── one reading at a time ──────────────────────────────────────────────────
 
@@ -157,7 +158,9 @@ export function invalidateCswapAutoCache() {
  * whatever shape it is given, and the interval collapses four fields to one
  * number that is clamped anyway. The parse itself is a regex over
  * human-formatted output from a separate Python tool, on both line-ending
- * conventions. See cswap-auto-readers.test.ts.
+ * conventions, and with or without colour: the tool dims its `(default)` marker
+ * whenever the environment asks for colour, and a deck launched from a terminal
+ * inherits that terminal's FORCE_COLOR. See cswap-auto-readers.test.ts.
  *
  * One reading at a time and one every CONFIG_MIN_GAP_MS at most; the parse below
  * is what a reading is, and admission control is the wrapper. See throttled.
@@ -174,7 +177,7 @@ async function readCswapConfigNow() {
   const r = await run(bin, ["config"]);
   if (!r.ok) return null;
   const out = {};
-  for (const line of r.stdout.split("\n")) {
+  for (const line of stripAnsi(r.stdout).split("\n")) {
     const m = line.match(/^(\S+)\s+(.*?)\s*(\(default\))?\s*$/);
     if (!m || !m[1].includes(".")) continue;
     const raw = m[2].trim();

package/src/server/cswap-auto.mjs

@@ -20,6 +20,7 @@ import {
   commandTokens, externalAutoRunning, invalidateCswapAutoCache, looksLikeAutoLoop, readCswapConfig,
 } from "./cswap-auto-readers.mjs";
 import { initCswapAuto, lastTick, loopEnabled, restartLoop, setAutoEnabled } from "./cswap-auto-loop.mjs";
+import { choiceStatus, setHomeAccount, setNextChoice } from "./cswap-auto-choice.mjs";
 import { invalidateClaudeAccountsCache, slotNumber } from "./claude-accounts.mjs";
 // The one store mutex, which the rotation flag below holds like every other
 // writer of claude-swap's store.
@@ -135,14 +136,19 @@ export { commandTokens, externalAutoRunning, looksLikeAutoLoop };
 // cswap-auto-loop.mjs.
 export { initCswapAuto, setAutoEnabled };
 
+// Which account a tick moves to — the home it comes back to and the strategy
+// for the next one — kept by the deck, not by claude-swap: cswap-auto-choice.mjs.
+export { setHomeAccount, setNextChoice };
+
 export async function autoStatus() {
-  const [config, external] = await Promise.all([readCswapConfig(), externalAutoRunning()]);
+  const [config, external, choice] = await Promise.all([readCswapConfig(), externalAutoRunning(), choiceStatus()]);
   return {
     ok:        config != null,
     enabled:   loopEnabled(),
     external,                       // user is running their own `cswap auto`
     lastTick:  lastTick(),
     settings:  config ?? {},
+    choice,                         // { next: "room"|"weekly", home: {email, orgUuid}|null }
   };
 }
 

package/src/server/deck-prefs.mjs

@@ -72,6 +72,8 @@ export { prefsPath };
  */
 export const DEFAULTS = Object.freeze({
   notifications: false,
+  recoverCodexSessions: true,
+  recoverClaudeSessions: true,
   // ACCOUNT NOTIFICATIONS, one switch each (account-notify.mjs). Not part of
   // `notifications` above, which is about a deck nobody is looking at: these
   // are said whether a page is open or not, because no page says them. The
@@ -314,6 +316,8 @@ export function normalise(raw) {
   const src = raw && typeof raw === "object" ? raw : {};
   return {
     notifications: flagOr(src.notifications, DEFAULTS.notifications),
+    recoverClaudeSessions: flagOr(src.recoverClaudeSessions, DEFAULTS.recoverClaudeSessions),
+    recoverCodexSessions: flagOr(src.recoverCodexSessions, DEFAULTS.recoverCodexSessions),
     notifySwap: flagOr(src.notifySwap, DEFAULTS.notifySwap),
     notifyQuota: flagOr(src.notifyQuota, DEFAULTS.notifyQuota),
     notifyReset: flagOr(src.notifyReset, DEFAULTS.notifyReset),
@@ -701,7 +705,7 @@ export function publicPrefs(prefs) {
  * here — prefs-route-fields.test.ts lists them.
  */
 export const PAGE_FIELDS = Object.freeze({
-  top: Object.freeze(["notifications", "notifySwap", "notifyQuota", "notifyReset", "tourSeen", "autoUpdate"]),
+  top: Object.freeze(["notifications", "notifySwap", "notifyQuota", "notifyReset", "tourSeen", "autoUpdate", "recoverCodexSessions", "recoverClaudeSessions"]),
   lan: Object.freeze([
     "enabled", "name", "shared", "manual", "shareActive", "pairingMode",
     "autoAsk", "autoAccept", "tailscale", "tailscaleAsk", "tailscaleAccept",

package/src/server/event-pipeline.mjs

@@ -9,6 +9,7 @@
 // imports reach pushEvent through event-sink.mjs, connected below as this
 // module loads; index.mjs's routes import it from here. The bodies are
 // unchanged.
+import { noteToolAudit } from "./tool-audit.mjs";
 import { PRODUCT } from "./brand.mjs";
 import { createBlockNotifier } from "./block-notify.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
@@ -30,6 +31,7 @@ import { notifyTrays, pageCount, sseClients, trayClients, writeSse } from "./sse
 import { eventLogPath, maybeRotatePersistFile, writesLogFor } from "./event-log.mjs";
 import { appendLogLine } from "./log-writer.mjs";
 // The away-update's word on whether a turn is running — see lifecycle.mjs.
+import { shouldTrackActivity } from "./activity.mjs";
 import { activity } from "./lifecycle.mjs";
 // The session LRU and the transcript watch — see session-tracking.mjs.
 import { outputWatch, touchSession } from "./session-tracking.mjs";
@@ -122,6 +124,7 @@ export function pushEvent(raw, source, opts = {}) {
   // Numbered, charged, held, and the ring evicted behind it — see admitEvent.
   const evt = admitEvent(raw, source, opts.receivedAt ?? Date.now());
   const seq = evt.seq;
+  noteToolAudit(raw, source, opts);
 
   // Does this event reach the log at all? Not on a replay (it came from
   // there), not when the hook told us another deck owns this session's log,
@@ -202,9 +205,9 @@ export function pushEvent(raw, source, opts = {}) {
   // know the other exists. block-notify.mjs holds the gates and the cooldown.
   blockNotifier.consider(raw, { clients: pageCount(), replay: !!opts.replay });
 
-  // Whether a turn is running, for the away-update. Not from a replay: the log
-  // is history, and a turn it shows open is one that ended in another process.
-  if (!opts.replay) activity.note(raw, evt.receivedAt);
+  // Persisted history is not current activity. Fresh recovery snapshots are
+  // current evidence even though they bypass replayed-tool accounting.
+  if (shouldTrackActivity(raw, opts)) activity.note(raw, evt.receivedAt);
 
   if (persisting) {
     // Fire-and-forget append. JSONL = newline-delimited JSON, so the whole line

package/src/server/evicted-enrichment.mjs

@@ -64,6 +64,8 @@ const nonEmpty = v => typeof v === "string" && v.trim() !== "";
 const STAMPED = [
   ["model_context_window", v => typeof v === "number" && v > 0],
   ["approval_policy", v => typeof v === "string" && v !== ""],
+  // Null is a value here: a turn that names no effort clears the chip (#2155).
+  ["reasoning_effort", v => (typeof v === "string" && v !== "") || v === null],
   ["context_tokens", v => typeof v === "number" && v >= 0],
 ];
 

package/src/server/feedback-form.mjs

@@ -139,6 +139,7 @@ export function upstreamForm({ fields, images }, facts) {
   if (contact) text("contact", contact);
   text("appVersion", facts.appVersion);
   text("platform", facts.platform);
+  if (facts.deviceId) text("deviceId", facts.deviceId);
   for (const [index, { data, format }] of images.entries()) {
     const { type, extension } = FORMAT[format];
     parts.push(`${head(IMAGES_FIELD, `; filename="image-${index + 1}.${extension}"`)}Content-Type: ${type}\r\n\r\n`, data, "\r\n");

package/src/server/index.mjs

@@ -83,6 +83,7 @@ import { ccProjectSlug } from "./claude-dir.mjs";
 export { ccProjectSlug };
 // The Codex half of capture: the rollouts directory tailed for its events —
 // see codex-watch.mjs.
+import { createClaudeRecovery } from "./claude-recovery.mjs";
 import { startCodexWatcher } from "./codex-watch.mjs";
 // Exported from this file before they moved, and still. scanCodexNow is new,
 // and is here for the suites that import this file to drive the watcher.
@@ -164,6 +165,8 @@ import { handleBrowserWatch, handleBrowserWatchDismiss, handleBrowserWatchSettin
 // The music routes, every one behind AGENTS_DECK_NO_MUSIC — see music-routes.mjs.
 import { handleBestOfNostalgia, handleCafeMusicBgm, handleClaudeFm, handleFmStation, handleGoodLifeRadio, handleLiveRadioMix, handleLofiGirl, handleRadioStations, handleRadioClick, handleMusicConfig } from "./music-routes.mjs";
 // The usage panel's quota and history reads — see usage-routes.mjs.
+import { startToolAudit } from "./tool-audit.mjs";
+import { handleToolAudit } from "./tool-audit-routes.mjs";
 import { startQuotaHistory } from "./quota-history.mjs";
 import { handleCcusage, handleCcusageSession, handleCodexQuota, handleCodexUsage, handleProviderStatus, handleQuota, handleQuotaHistory } from "./usage-routes.mjs";
 // The port fallback, one listen attempt, and the words for a failed one — see
@@ -192,6 +195,7 @@ export function requestUrl(rawUrl) {
 
 export async function startServer({ port = 4317, host = "127.0.0.1", persist = null, portRange = [4318, 4400], workspace = "", codex = true, claude = true, onRestart = null, onStop = null, cswapQuiet = null } = {}) {
   startQuotaHistory();
+  await startToolAudit();
   armLifecycle({ onRestart, onStop, persist, onSelfUpdate: () => reporter.noteSelfUpdate() });
   // Which tree and which CLIs, normalised once — see setDeckScope.
   setDeckScope({ workspace, claude, codex });
@@ -318,6 +322,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "POST" && url.pathname === "/api/restart")     return guard(handleRestart(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/presence")    return guard(handlePresence(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/shutdown")    return guard(handleStop(req, res), res);
+    if (["GET", "POST"].includes(req.method) && ["/api/tool-audit", "/api/tool-audit/storage"].includes(url.pathname)) return guard(handleToolAudit(req, res), res);
     if (req.method === "GET" && url.pathname === "/api/quota/history") return guard(handleQuotaHistory(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/quota")       return guard(handleQuota(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-usage")  return guard(handleCodexUsage(req, res), res);
@@ -510,6 +515,14 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       server.once("close", () => trafficCapture.dispose());
       // Codex has no working hooks on Windows — tail its rollout files instead.
       if (codex) startCodexWatcher(workspace);
+      if (claude) {
+        const recovery = createClaudeRecovery({ workspace });
+        const recover = () => { void recovery.scan().catch(() => {}); };
+        recover();
+        const timer = setInterval(recover, 1500);
+        timer.unref?.();
+        server.once("close", () => { clearInterval(timer); recovery.stop(); });
+      }
       // What a session is producing between its tool calls. Claude only — it
       // reads `transcript_path`, which Codex hooks never send — and unref'd
       // like its neighbours.

package/src/server/pinned-build.mjs

@@ -53,6 +53,7 @@ const PKG_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..");
  */
 const PINNED_MODULES = [
   "self-update.mjs",
+  "tool-audit.mjs",
   "claude-accounts.mjs",
   "account-health.mjs",
   "cswap-admin.mjs",
@@ -93,6 +94,10 @@ const PINNED_MODULES = [
   // The plans the daily report says, read through import() by depth-facts.mjs.
   "quota-oauth.mjs",
   "codex-auth.mjs",
+  // The paired decks' current accounts, which Auto-switch's own rules skip
+  // (cswap-auto-choice.mjs). Already in memory through prefs-routes.mjs; named
+  // here because the tick reaches it through import().
+  "lan-deck.mjs",
 ];
 
 let _pinned = null;

package/src/server/reports-routes.mjs

@@ -7,7 +7,7 @@ import { reportsVetoed } from "./deck-prefs.mjs";
 import { MAX_REQUEST_BYTES, isMultipart, readFeedbackForm, upstreamForm } from "./feedback-form.mjs";
 import { readBody, readBytes, send } from "./http-io.mjs";
 import { heldPrefs } from "./prefs-state.mjs";
-import { REPORTS_API, installFacts, reporter } from "./reports.mjs";
+import { REPORTS_API, deviceIdToken, installFacts, reporter, reportsOn } from "./reports.mjs";
 
 async function readJson(req, res, limit) {
   const raw = await readBody(req, res, limit).catch(() => null);
@@ -72,35 +72,54 @@ export async function handleClientError(req, res, { report = reporter } = {}) {
  * one message. AGENTS_DECK_NO_INSTALL=1 still wins, because the README promises
  * that it "turns off everything but the quota reads", and a launch script's
  * word about the machine outranks a button on the page.
+ *
+ * `device` is the fingerprint feedbackDeviceId picks; a test passes its own,
+ * or null for none.
  */
-export async function handleFeedback(req, res, { fetchImpl = globalThis.fetch, env = process.env } = {}) {
+export async function handleFeedback(req, res, { fetchImpl = globalThis.fetch, env = process.env, device = feedbackDeviceId({ env }) } = {}) {
   if (env.AGENTS_DECK_NO_INSTALL === "1") return send(res, 403, { ok: false, reason: "vetoed" });
+  // Left out of the post entirely when there is none: JSON drops an undefined.
+  const deviceId = device || undefined;
   const contentType = req.headers?.["content-type"];
-  if (isMultipart(contentType)) return forwardFeedbackForm(req, res, contentType, { fetchImpl, env });
+  if (isMultipart(contentType)) return forwardFeedbackForm(req, res, contentType, { fetchImpl, env, deviceId });
   const body = await readJson(req, res, 32_000);
   if (!body) return send(res, 400, { ok: false, reason: "bad_request" });
   const facts = feedbackFacts({ env });
   const contact = typeof body.contact === "string" && body.contact.trim() ? body.contact.trim() : undefined;
   return forwardFeedback(res, fetchImpl, {
     headers: { "content-type": "application/json", "user-agent": `ccdeck/${facts.appVersion}` },
-    body: JSON.stringify({ kind: body.kind, title: body.title, body: body.body, contact, ...facts }),
+    body: JSON.stringify({ kind: body.kind, title: body.title, body: body.body, contact, ...facts, deviceId }),
     timeoutMs: JSON_TIMEOUT_MS,
   });
 }
 
 /**
- * What this deck adds to a piece of feedback, and all it adds: the ccdeck
- * version, and the system as `os-arch` — `darwin-arm64`. installFacts knows
- * more than that (the channel, the runtime, a locale, a device fingerprint)
- * and none of it goes with feedback. One function for both posts and for the
- * line the dialog draws before Send, so what the page says is sent and what
- * the API is sent are one answer and cannot drift apart.
+ * What the dialog says, before Send, that this deck adds to a piece of
+ * feedback: the ccdeck version, and the system as `os-arch` — `darwin-arm64`.
+ * Both posts carry these two, from this one function, so what the line shows
+ * and what the API gets for them cannot drift apart.
+ *
+ * The posts also carry the device fingerprint (feedbackDeviceId), and the line
+ * does not show it: the owner's decision of 2026-10-14, so a report can be
+ * tied to the install that sent it. installFacts' other fields (the channel,
+ * the runtime, a locale) never go with feedback.
  */
 export function feedbackFacts({ env = process.env } = {}) {
   const facts = installFacts({ env });
   return { appVersion: facts.version, platform: `${facts.os}-${facts.arch}` };
 }
 
+/**
+ * The device fingerprint a piece of feedback carries: the same one-way hash
+ * every usage report sends (deviceIdToken), and under the same rule — only
+ * while reports are on. Switched off, or vetoed with AGENTS_DECK_NO_REPORTS=1,
+ * the fingerprint stays home here as it does everywhere else, and the feedback
+ * still goes. It is read here, never taken from the page.
+ */
+export function feedbackDeviceId({ env = process.env, prefs = heldPrefs.current() } = {}) {
+  return reportsOn(prefs, env) ? deviceIdToken() : undefined;
+}
+
 /** `GET /api/feedback`: what a report sent from here would carry besides its
  *  words, for the dialog to say before Send. Nothing leaves the machine. */
 export function handleFeedbackFacts(_req, res, { env = process.env } = {}) {
@@ -113,7 +132,7 @@ const JSON_TIMEOUT_MS = 20_000;
  *  seconds of upload before the API has read a byte of it. */
 const FORM_TIMEOUT_MS = 120_000;
 
-async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env }) {
+async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env, deviceId }) {
   // Over the cap, readBytes has already answered 413 too_large and the 400
   // below is a no-op; this is the answer to a read that failed some other way.
   const bytes = await readBytes(req, res, MAX_REQUEST_BYTES, { ok: false, reason: "too_large" }).catch(() => null);
@@ -125,7 +144,7 @@ async function forwardFeedbackForm(req, res, contentType, { fetchImpl, env }) {
   return forwardFeedback(res, fetchImpl, {
     // No content type: fetch writes the form's own, boundary and all.
     headers: { "user-agent": `ccdeck/${facts.appVersion}` },
-    body: upstreamForm(form, facts),
+    body: upstreamForm(form, { ...facts, deviceId }),
     timeoutMs: FORM_TIMEOUT_MS,
   });
 }