ccdeck 3.43.3 → 3.44.0

package/src/server/claude-accounts.mjs

@@ -39,10 +39,11 @@ import { currentIdentity } from "./claude-identity.mjs";
 // cycle is a lock that may not be there yet when a mutation wants it.
 import { withStoreLock } from "./store-lock.mjs";
 // claude-swap's own per-slot verdicts, which have to be ASKED for rather than
-// read off the store. The roster puts them on each row; verdictNow and
-// verdictsNow are re-exported because cswap-admin.mjs and lan-deck.mjs reach
-// them through this module.
-import { verdictFor, verdictsAskedAt } from "./claude-verdicts.mjs";
+// read off the store. The roster puts them on each row, and a switch asks for a
+// collection through the same queue before it reads its target (#2184);
+// verdictNow and verdictsNow are re-exported because cswap-admin.mjs and
+// lan-deck.mjs reach them through this module.
+import { verdictFor, verdictsAskedAt, verdictsNow } from "./claude-verdicts.mjs";
 export { verdictNow, verdictsNow } from "./claude-verdicts.mjs";
 // Asking claude-swap to collect, which every roster read does when something is
 // due, and when each account will next be read.
@@ -51,6 +52,9 @@ import { nextReadAt, nudgeCollector } from "./claude-collector.mjs";
 // (#1893). Pure, and keyed the way LAN sync keys accounts.
 import { hasRecovered, reauthFor } from "./account-origins.mjs";
 import { accountKey } from "./lan-copies.mjs";
+// Whether a switch target's stored login is known dead, and whether a
+// collection would read it first (#2184). Pure, and imports nothing.
+import { collectionWouldRead, deadLoginOf } from "./login-guard.mjs";
 import { dirname, join } from "node:path";
 import { existsSync } from "node:fs";
 import { homedir, platform } from "node:os";
@@ -628,8 +632,8 @@ function rosterRow({ seq, num, acct, row, identity, now, key, origin = null }) {
  * It says nothing about whether the user is signed in. Measured on the machine
  * that reported this, at the same instant:
  *
- *   claude auth status --json  ->  loggedIn: true, claude3@sapec.md
- *   cswap list --json          ->  claude3@sapec.md: relogin_required
+ *   claude auth status --json  ->  loggedIn: true, carol@example.net
+ *   cswap list --json          ->  carol@example.net: relogin_required
  *   GET /api/quota             ->  source: cli, 5h 33%, 7d 37%
  *
  * The user had signed in again in a terminal, which refreshes the LIVE
@@ -796,6 +800,82 @@ export function slotNumber(accountNum) {
   return Number.isInteger(num) && num >= 1 && num <= 999 ? num : null;
 }
 
+// ── before a switch: is the target's login known dead? (#2184) ──────────────
+
+/** How long a switch waits for claude-swap to read its target first. A cold
+ *  collection can take a minute; a switch that waited that long would read as
+ *  a hang, and what it could not learn in time it does not hold against the
+ *  target. */
+const SWITCH_READ_WAIT_MS = 15_000;
+
+/** Slot `num` as the store holds it — the account, its usage row and whether
+ *  that row is the account's own — or null when there is no such slot. */
+async function switchTarget(num) {
+  const root = backupRoot();
+  const seq = await readSequence(root);
+  const key = String(num);
+  const acct = seq?.accounts?.[key];
+  if (!acct) return null;
+  const row = (await readUsageRows(root))[key];
+  return { acct, row, matches: rowIsFor(row, acct), active: activeSlot(seq) === key };
+}
+
+/**
+ * Ask claude-swap to read slot `num` before a switch onto it, when a
+ * collection would read it at all — see login-guard.mjs for why that is the
+ * only check 0.26.0 offers, and the incident it would have caught.
+ *
+ * Shares the verdict queue's `cswap list --json`, so it never starts a second
+ * collection beside one already running, and waits for it no longer than
+ * SWITCH_READ_WAIT_MS. Outside the store lock: a collection takes none of the
+ * deck's, and a mutation queued behind this one must not wait out somebody
+ * else's network. Never throws — a check that cannot be made is no answer.
+ */
+export async function readBeforeSwitch(num, { now = Date.now(), collect = () => verdictsNow(), waitMs = SWITCH_READ_WAIT_MS } = {}) {
+  let timer = null;
+  try {
+    const t = await switchTarget(num);
+    if (!t || t.active || deadLoginOf(t.row, { matches: t.matches })) return false;
+    if (!collectionWouldRead(t.row, { matches: t.matches, now })) return false;
+    const waited = new Promise(resolve => { timer = setTimeout(resolve, waitMs); timer.unref?.(); });
+    await Promise.race([Promise.resolve().then(collect).catch(() => null), waited]);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/**
+ * The refusal for a switch onto slot `num`, when claude-swap's store says its
+ * stored login is dead — or null, which is every case it cannot say so,
+ * including a store it could not read.
+ *
+ * `{ ok: false, reason: "login_expired", account: { num, email, alias }, error,
+ * since }`, so the panel can name the account and offer the sign-in that fixes
+ * it. A switch to the slot that is already active is not this question: it
+ * writes nothing live.
+ */
+export async function expiredSwitchTarget(num) {
+  try {
+    const t = await switchTarget(num);
+    if (!t || t.active) return null;
+    const signedIn = originsNow()[accountKey(t.acct.email, t.acct.organizationUuid)]?.signedInAt;
+    const dead = deadLoginOf(t.row, { matches: t.matches, signedInAt: signedIn > 0 ? signedIn : null });
+    if (!dead) return null;
+    return {
+      ok: false,
+      reason: "login_expired",
+      account: { num, email: t.acct.email ?? null, alias: t.acct.alias ?? null },
+      error: dead.error,
+      since: dead.since,
+    };
+  } catch {
+    return null;
+  }
+}
+
 /**
  * Switch the active Claude account by delegating to `cswap`.
  *
@@ -817,8 +897,25 @@ export function slotNumber(accountNum) {
  * The validation stays OUTSIDE the lock. A slot number that is not one is not a
  * mutation and must not wait behind somebody else's sixty-second `cswap add`
  * to be told so.
+ *
+ * AND IT DOES NOT SWITCH ONTO A LOGIN KNOWN TO BE DEAD (#2184). Every session
+ * on the machine runs on the login this puts live, so a dead one stops all of
+ * them at once. The target is read first when a collection would read it
+ * (readBeforeSwitch), and judged inside the lock, on the store as it stands
+ * when `cswap switch` would run (expiredSwitchTarget). Anything that cannot be
+ * judged lets the switch go ahead.
+ *
+ * `before`, when given, is asked first thing inside the lock: a switch nobody
+ * pressed — the auto-switch failover — may have been turned off while it
+ * queued, and answers `{ skipped: <why> }` instead of moving the account.
+ *
+ * `force` is `cswap switch --force`: activate the target without backing up
+ * the current login first. Only for a current login already known to be dead.
+ * Claude Code clears a login whose refresh was refused, and a plain switch then
+ * refuses in turn ("Current account credential is empty …; refusing to
+ * overwrite its backup"), which would leave the user exactly where they were.
  */
-export function switchClaudeAccount(accountNum) {
+export function switchClaudeAccount(accountNum, { before, force = false } = {}) {
   // Straight into an exec argument, so nothing but a slot number gets through.
   const num = slotNumber(accountNum);
   if (num == null) {
@@ -827,13 +924,17 @@ export function switchClaudeAccount(accountNum) {
 
   // Argument vector, never a shell — and resolved through exec.mjs so the
   // Windows `.exe`/`.cmd` shim is found too.
-  return withStoreLock(() => cswapBin()
-    .then(bin => run(bin, ["switch", String(num)], { timeout: 30_000 }))
-    .then(r => {
-      if (r.ok) return { ok: true, output: r.stdout.trim() };
-      const reason = r.code === "ENOENT" ? "no_cswap" : r.killed ? "timeout" : "switch_failed";
-      return { ok: false, reason, output: failureDetail(r, 500) };
-    }));
+  return readBeforeSwitch(num).then(() => withStoreLock(async () => {
+    const skipped = before ? await before() : null;
+    if (skipped) return { ok: false, skipped };
+    const expired = await expiredSwitchTarget(num);
+    if (expired) return expired;
+    const argv = force ? ["switch", String(num), "--force"] : ["switch", String(num)];
+    const r = await run(await cswapBin(), argv, { timeout: 30_000 });
+    if (r.ok) return { ok: true, output: r.stdout.trim() };
+    const reason = r.code === "ENOENT" ? "no_cswap" : r.killed ? "timeout" : "switch_failed";
+    return { ok: false, reason, output: failureDetail(r, 500) };
+  }));
 }
 
 /**

package/src/server/claude-dir.mjs

@@ -19,7 +19,7 @@
 // to "where does the `claude` command live", and the deck now asks that question
 // at boot, before any quota exists, to decide whether this is a Claude machine
 // at all. One list, one caller-visible name, no second spelling to drift.
-import { existsSync } from "node:fs";
+import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve, posix as posixPath, win32 as winPath } from "node:path";
 
@@ -131,15 +131,26 @@ function claudeCliOnDisk({
   home = homedir(),
   exists = existsSync,
 } = {}) {
+  for (const _ of claudeCliFound({ platform, env, home, exists })) return true;
+  return false;
+}
+
+/**
+ * Every `claude` the walk above finds, in the order it finds them — the known
+ * install paths first, then each PATH entry. claudeCliOnDisk stops at the first;
+ * claudeCodeVersions below reads them all, because an old CLI anywhere on the
+ * machine still reads the settings file a new one does.
+ */
+function* claudeCliFound({ platform, env, home, exists }) {
   const path = platform === "win32" ? winPath : posixPath;
   const bare = [];
   for (const candidate of claudeCliCandidates(platform, env, home)) {
     // A full path is worth a single stat; a bare name means "ask PATH", which
     // is the walk below. Same split quotaClaudeBin makes, for the same reason.
-    if (candidate.includes(path.sep)) { if (exists(candidate)) return true; }
+    if (candidate.includes(path.sep)) { if (exists(candidate)) yield candidate; }
     else bare.push(candidate);
   }
-  if (bare.length === 0) return false;
+  if (bare.length === 0) return;
 
   // process.env is case-insensitive on Windows, but an injected plain object in
   // a test is not, and %Path% is how the variable is actually spelled there.
@@ -156,10 +167,136 @@ function claudeCliOnDisk({
     const dir = entry.trim().replace(/^"+|"+$/g, "");
     if (dir === "") continue;
     for (const name of bare) {
-      for (const ext of exts) if (exists(path.join(dir, name + ext))) return true;
+      for (const ext of exts) {
+        const found = path.join(dir, name + ext);
+        if (exists(found)) yield found;
+      }
     }
   }
-  return false;
+}
+
+/** A Claude Code version as its installers spell it: three numbers, and a
+ *  pre-release or build suffix that does not change which release it is. */
+const CC_VERSION_RE = /^(\d+)\.(\d+)\.(\d+)(?:[-+][0-9A-Za-z.+-]*)?$/;
+
+/** Whether `version` is `min` or newer, by the three numbers. */
+export function claudeVersionAtLeast(version, min) {
+  const a = CC_VERSION_RE.exec(String(version ?? ""));
+  const b = CC_VERSION_RE.exec(String(min ?? ""));
+  if (!a || !b) return false;
+  for (let i = 1; i <= 3; i++) {
+    const d = Number(a[i]) - Number(b[i]);
+    if (d !== 0) return d > 0;
+  }
+  return true;
+}
+
+/** The npm package every npm install of Claude Code is. */
+const CC_PACKAGE = "@anthropic-ai/claude-code";
+
+/**
+ * The version of the one install `bin` belongs to, read off disk, or
+ * undefined when its layout does not say.
+ *
+ *   npm      the package's own package.json, found by walking up from the
+ *            file the bin resolves to — or, for the `claude.cmd` shim npm
+ *            writes on Windows, in the node_modules beside the shim
+ *   native   `~/.local/bin/claude` links to `…/claude/versions/<version>`;
+ *            on Windows it is a copy, and the newest of those versions is the
+ *            one the installer put there
+ *   Homebrew the cask's binary lives at `…/Caskroom/claude-code/<version>/claude`
+ *
+ * The package.json comes first, and a version-shaped directory is believed only
+ * where those two layouts put one: a node manager keeps the NODE version in its
+ * paths (`…/installs/node/22.14.0/…`), and reading that as Claude Code's would
+ * let a machine with an old CLI through the gate.
+ */
+function installVersion(bin, { platform, home, exists, realpath, readText, list }) {
+  const path = platform === "win32" ? winPath : posixPath;
+  let real = bin;
+  try { real = realpath(bin); } catch { /* a dangling link reads as itself */ }
+  const fromPackage = file => {
+    try {
+      const pkg = JSON.parse(readText(file));
+      return pkg?.name === CC_PACKAGE && CC_VERSION_RE.test(pkg.version) ? pkg.version : undefined;
+    } catch { return undefined; }
+  };
+  const beside = path.join(path.dirname(bin), "node_modules", ...CC_PACKAGE.split("/"), "package.json");
+  if (exists(beside)) {
+    const v = fromPackage(beside);
+    if (v) return v;
+  }
+  let dir = path.dirname(real);
+  for (let i = 0; i < 5; i++) {
+    const file = path.join(dir, "package.json");
+    if (exists(file)) {
+      const v = fromPackage(file);
+      if (v) return v;
+    }
+    const up = path.dirname(dir);
+    if (up === dir) break;
+    dir = up;
+  }
+  const name = path.basename(real);
+  const parent = path.basename(path.dirname(real));
+  if (CC_VERSION_RE.test(name) && parent === "versions") return name;
+  if (CC_VERSION_RE.test(parent) && path.basename(path.dirname(path.dirname(real))) === "claude-code") return parent;
+  const nativeBin = path.join(home, ".local", "bin");
+  if (path.dirname(real) === nativeBin) {
+    try {
+      const versions = list(path.join(home, ".local", "share", "claude", "versions"))
+        .filter(v => CC_VERSION_RE.test(v));
+      let newest;
+      for (const v of versions) if (!newest || claudeVersionAtLeast(v, newest)) newest = v;
+      if (newest) return newest;
+    } catch { /* no native install beside it */ }
+  }
+  return undefined;
+}
+
+/**
+ * The versions of every Claude Code the deck can find on this machine, read
+ * off disk without running any of them — the same places hasClaudeInstalled
+ * looks, each resolved to the install it belongs to. Distinct, and only the
+ * ones whose layout names a version: an install that does not say is left out
+ * rather than guessed at.
+ *
+ * WITHOUT A CHILD PROCESS, for the reason claudeCliOnDisk gives: the installer
+ * asks this at boot, and a `claude --version` is about three seconds there.
+ * Every dependency is injected so the suite can lay out an npm, a native and a
+ * Homebrew install for any platform without one on the machine.
+ */
+export function claudeCodeVersions(deps = {}) {
+  const out = new Set();
+  for (const { version } of claudeCodeInstalls(deps)) if (version) out.add(version);
+  return [...out];
+}
+
+/**
+ * Every `claude` the deck can find, each with the version its install layout
+ * names, or `version: undefined` where the layout does not say. The same walk
+ * and the same reading as claudeCodeVersions, which keeps only the versions;
+ * this keeps the installs that did not answer too, for a gate that has to
+ * treat "a Claude Code whose version is unknown" as a reason to refuse rather
+ * than as one fewer Claude Code (skill-hook.mjs).
+ */
+export function claudeCodeInstalls({
+  platform = process.platform,
+  env = process.env,
+  home = homedir(),
+  exists = existsSync,
+  realpath = p => realpathSync.native(p),
+  readText = p => readFileSync(p, "utf8"),
+  list = p => readdirSync(p),
+} = {}) {
+  const out = [];
+  const seen = new Set();
+  for (const bin of claudeCliFound({ platform, env, home, exists })) {
+    if (seen.has(bin)) continue;
+    seen.add(bin);
+    out.push({ bin, version: installVersion(bin, { platform, home, exists, realpath, readText, list }) });
+  }
+  return out;
 }
 
 /**

package/src/server/claude-identity.mjs

@@ -120,3 +120,26 @@ export async function currentIdentity() {
     return null;
   }
 }
+
+/**
+ * Whether the CLI says anybody is signed in — the answer currentIdentity folds
+ * away: `{ loggedIn: true, email }`, `{ loggedIn: false }`, or null when there
+ * is no answer to read.
+ *
+ * `claude auth status --json` exits 1 when nobody is signed in and still prints
+ * `{"loggedIn": false, …}` (Claude Code 2.1.302), so `r.ok` cannot tell
+ * "signed out" from "could not ask". currentIdentity returns null for both,
+ * which is right for its callers. The auto-switch failover may only act on a
+ * CLI that has said the login is gone, so it reads the printed answer whatever
+ * the exit code, and a run that timed out or printed nothing is no answer.
+ */
+export async function cliSignIn() {
+  const r = await run(adminClaudeBin(), ["auth", "status", "--json"], { timeout: 20_000 });
+  if (r.timedOut) return null;
+  try {
+    const j = JSON.parse(r.stdout);
+    if (j?.loggedIn === true) return { loggedIn: true, email: j.email ?? "" };
+    if (j?.loggedIn === false) return { loggedIn: false };
+  } catch { /* nothing printed that could be read */ }
+  return null;
+}

package/src/server/cli-lines.mjs

@@ -0,0 +1,224 @@
+// What `ccdeck accounts`, `ccdeck usage` and `ccdeck sessions` print (#2183).
+//
+// Pure — rows, a palette, glyphs and a width in; lines out — so the layout can
+// be pinned at 40 columns and at 120 without a terminal, and so the same rows a
+// running deck serves and the rows read in this process draw identically. The
+// palette and glyphs are the boot's own (term.mjs), which is what makes these
+// lines look like the product rather than like a script beside it: the same
+// colour tier, the same ASCII fallback on a console that cannot draw a block.
+import { sinceLabel, stripAnsi } from "./term.mjs";
+
+/**
+ * Text that came from somewhere else — a session's title and folder, the
+ * question Claude Code passed on, an alias somebody typed — on one line and
+ * without the bytes a terminal acts on. A newline would break the row it is
+ * in, and an ESC would reach the terminal as a command rather than as text.
+ */
+export function oneLine(s) {
+  return String(s ?? "").replace(/[\u0000-\u001f\u007f-\u009f]+/g, " ").replace(/\s+/g, " ").trim();
+}
+
+// The columns a character takes: two for the wide ones (CJK, Hangul, the
+// fullwidth forms, the pictographic emoji), none for combining marks, joiners
+// and variation selectors, one otherwise. Enough of wcwidth that a title in
+// Japanese, or with an emoji in it, does not wrap the row it was clipped to.
+const WIDE = /[ᄀ-ᅟ⺀-〾ぁ-㏿㐀-䶿一-鿿ꀀ-꓏가-힣豈-﫿︰-﹏＀-｠￠-￦\u{1f300}-\u{1f64f}\u{1f680}-\u{1f6ff}\u{1f900}-\u{1f9ff}\u{20000}-\u{3fffd}]/u;
+const ZERO = /[\p{Mn}\p{Me}​-‏︀-️]/u;
+const cellsOf = (ch) => (ZERO.test(ch) ? 0 : WIDE.test(ch) ? 2 : 1);
+
+/** How many columns `s` takes on a terminal, its colour codes not counted. */
+export function textWidth(s) {
+  let w = 0;
+  for (const ch of stripAnsi(String(s))) w += cellsOf(ch);
+  return w;
+}
+
+/** The longest start of `s` that fits in `n` columns. */
+function takeCells(s, n) {
+  let out = "";
+  let w = 0;
+  for (const ch of s) {
+    const c = cellsOf(ch);
+    if (w + c > n) break;
+    out += ch;
+    w += c;
+  }
+  return out;
+}
+
+/** A ten-cell meter, or `cells` of them. Blocks where the terminal can draw
+ *  them, `#` and `.` where it cannot. */
+export function meter(pct, { cells = 10, unicode = true } = {}) {
+  const p = Math.min(100, Math.max(0, Number(pct) || 0));
+  const full = Math.round((p / 100) * cells);
+  const [on, off] = unicode ? ["█", "░"] : ["#", "."];
+  return on.repeat(full) + off.repeat(cells - full);
+}
+
+/** The tone a percentage is drawn in: the panel's thresholds, near the limit
+ *  in warn and at it in err. */
+export function pctTone(pct, tone) {
+  return pct >= 90 ? tone.err : pct >= 75 ? tone.warn : tone.ok;
+}
+
+/** "1h 12m" until a reset given in epoch SECONDS, or "" when there is none or
+ *  it has passed — a reset in the past is a reading that is out of date, and
+ *  "resets in 0s" would claim otherwise. */
+export function untilReset(resetAt, now = Date.now()) {
+  if (typeof resetAt !== "number" || !Number.isFinite(resetAt)) return "";
+  const ms = resetAt * 1000 - now;
+  return ms > 0 ? sinceLabel(ms) : "";
+}
+
+const padEnd = (s, n) => s + " ".repeat(Math.max(0, n - textWidth(s)));
+const padStart = (s, n) => " ".repeat(Math.max(0, n - textWidth(s))) + s;
+// Cut to `n` columns with the glyph tier's own ellipsis, which is three
+// characters on a console that cannot draw the one-character one.
+export const clip = (s, n, ellipsis = "…") => (textWidth(s) <= n ? s
+  : n <= textWidth(ellipsis) ? takeCells(s, n) : `${takeCells(s, n - textWidth(ellipsis))}${ellipsis}`);
+
+/** What is wrong with an account, in words, or null when nothing is. */
+export function accountTrouble(a) {
+  if (a.disabled) return { word: "disabled", tone: "muted" };
+  if (a.error && !a.staleCopy) return { word: "sign-in needed", tone: "err" };
+  if (a.stopped) return { word: "not collecting usage", tone: "warn" };
+  return null;
+}
+
+function lanesText(a, { tone, g, unicode, now, wide }) {
+  const lanes = (a.lanes ?? []).filter(l => l.id === "five_hour" || l.id === "seven_day");
+  if (!lanes.length) {
+    return a.fetchedAt == null ? `${tone.muted}not read yet${tone.reset}` : `${tone.muted}no usage reading${tone.reset}`;
+  }
+  return lanes.map(l => {
+    const pct = `${Math.round(l.pct)}%`;
+    const until = untilReset(l.resetAt, now);
+    const bar = wide ? ` ${pctTone(l.pct, tone)}${meter(l.pct, { unicode })}${tone.reset}` : "";
+    const reset = wide && until ? ` ${tone.muted}${g.restart} ${padEnd(until, 7)}${tone.reset}` : wide ? "          " : "";
+    return `${tone.muted}${l.label}${tone.reset}${bar} ${pctTone(l.pct, tone)}${padStart(pct, 4)}${tone.reset}${reset}`;
+  }).join("  ");
+}
+
+/**
+ * The roster, one account per line, the active one marked.
+ *
+ * Three widths. From 104 columns each lane has its meter and its reset; from 64
+ * the percentages stand alone; below that the alias goes and the email is
+ * clipped. Nothing wraps: a row that wrapped would put one account's usage
+ * under another's name.
+ */
+export function accountLines(accounts, { tone, g, unicode = true, columns = 80, now = Date.now() } = {}) {
+  const rows = Array.isArray(accounts) ? accounts : [];
+  if (!rows.length) return [`  ${tone.muted}${g.dash}  no Claude accounts yet${tone.reset}`];
+  const wide = columns >= 104;
+  const aliasOf = (a) => oneLine(a.alias);
+  const emailOf = (a) => oneLine(a.email) || "(no email)";
+  const showAlias = columns >= 64 && rows.some(a => aliasOf(a));
+  const numW = Math.max(...rows.map(a => String(a.num).length));
+  const aliasW = showAlias ? Math.min(14, Math.max(...rows.map(a => textWidth(aliasOf(a))))) : 0;
+  // What is left for the email once the mark, the slot, the alias and the
+  // lanes have their room; never less than 12, which still shows whose it is.
+  const lanesW = wide ? 66 : 20;
+  const emailRoom = Math.max(12, columns - 2 - 2 - numW - 2 - (showAlias ? aliasW + 2 : 0) - 2 - lanesW);
+  const emailW = Math.min(emailRoom, Math.max(...rows.map(a => textWidth(emailOf(a)))));
+  return rows.map(a => {
+    const mark = a.active ? `${tone.ok}${g.pulse}${tone.reset}` : " ";
+    const num = `${a.active ? tone.bold : ""}${padStart(String(a.num), numW)}${tone.reset}`;
+    const alias = showAlias ? `${tone.accent}${padEnd(clip(aliasOf(a), aliasW, g.ellipsis), aliasW)}${tone.reset}  ` : "";
+    const email = padEnd(clip(emailOf(a), emailW, g.ellipsis), emailW);
+    const trouble = accountTrouble(a);
+    const status = trouble
+      ? `${tone[trouble.tone]}${trouble.word}${tone.reset}`
+      : lanesText(a, { tone, g, unicode, now, wide });
+    // The last lane's reset is padded for the column after it, which the last
+    // lane does not have: the padding goes, and the colour reset behind it stays.
+    const line = `  ${mark} ${num}  ${alias}${email}  ${status}`.replace(/ +((?:\x1b\[[0-9;]*m)*)$/, "$1");
+    // How old the reading is, where it fits: the one part of a row that can be
+    // left off without the row saying something else.
+    const age = !trouble && a.stale && a.fetchedAt != null
+      ? `  ${tone.muted}read ${sinceLabel(now - a.fetchedAt)} ago${tone.reset}`
+      : "";
+    return textWidth(line) + textWidth(age) <= columns ? line + age : line;
+  });
+}
+
+/** One account's lanes, at length, for `ccdeck usage`: every lane the roster
+ *  holds, the model-scoped ones included, each with a twenty-cell meter. */
+export function usageLines(a, { tone, g, unicode = true, columns = 80, now = Date.now() } = {}) {
+  const alias = oneLine(a.alias);
+  const head = `  ${tone.ok}${g.pulse}${tone.reset} ${tone.bold}#${a.num} ${oneLine(a.email) || "(no email)"}${tone.reset}`
+    + `${alias ? ` ${tone.accent}(${alias})${tone.reset}` : ""}`;
+  const out = [head, ""];
+  const trouble = accountTrouble(a);
+  if (trouble) out.push(`    ${tone[trouble.tone]}${trouble.word}${tone.reset}`);
+  const lanes = a.lanes ?? [];
+  const labelW = Math.max(2, ...lanes.map(l => String(l.label).length));
+  const cells = columns >= 70 ? 20 : 10;
+  for (const l of lanes) {
+    const until = untilReset(l.resetAt, now);
+    out.push(`    ${tone.muted}${padEnd(String(l.label), labelW)}${tone.reset}  ${pctTone(l.pct, tone)}${meter(l.pct, { cells, unicode })}`
+      + `${padStart(`${Math.round(l.pct)}%`, 5)}${tone.reset}${until ? `   ${tone.muted}resets in ${until}${tone.reset}` : ""}`);
+  }
+  if (!lanes.length) out.push(`    ${tone.muted}${a.fetchedAt == null ? "not read yet" : "no usage reading"}${tone.reset}`);
+  if (a.fetchedAt != null) out.push("", `    ${tone.muted}read ${sinceLabel(now - a.fetchedAt)} ago${tone.reset}`);
+  return out;
+}
+
+/** "opus-4-1" for "claude-opus-4-1-20250805": the part a person says. */
+export function shortModel(model) {
+  if (typeof model !== "string" || !model) return "";
+  return oneLine(model).replace(/^claude-/, "").replace(/-\d{8}$/, "").replace(/\[.*\]$/, "");
+}
+
+const STATE_WORDS = { waiting: "waiting", working: "working", idle: "your turn", ended: "ended" };
+
+/**
+ * The sessions, one per line, the ones waiting on a human first and their
+ * question underneath in their own words.
+ */
+export function sessionLines(sessions, { tone, g, columns = 80, now = Date.now() } = {}) {
+  const rows = Array.isArray(sessions) ? sessions : [];
+  if (!rows.length) return [`  ${tone.muted}${g.dash}  no sessions right now${tone.reset}`];
+  const label = (s) => oneLine(s.name) || oneLine(s.project) || oneLine(s.id).slice(0, 8);
+  const agentOf = (s) => (s.provider === "codex" ? "Codex" : "Claude");
+  // The mark, the state word and the age take 23 columns; the label gets what
+  // the agent column leaves, and on a narrow terminal the agent column gives
+  // way first — the model, then the agent — so the label, which is how a person
+  // tells two sessions apart, keeps at least eight.
+  const LEAD = 23;
+  const tails = [
+    (s) => `${agentOf(s)}${shortModel(s.model) ? ` ${g.bullet} ${shortModel(s.model)}` : ""}`,
+    (s) => agentOf(s),
+    () => "",
+  ];
+  const longestLabel = Math.max(...rows.map(s => textWidth(label(s))));
+  const tailOf = tails.find(t => columns - LEAD - 2 - Math.max(...rows.map(s => textWidth(t(s)))) >= 8) ?? tails[2];
+  const tailW = Math.max(...rows.map(s => textWidth(tailOf(s))));
+  const labelW = Math.max(1, Math.min(longestLabel, columns - LEAD - (tailW ? tailW + 2 : 0)));
+  const out = [];
+  for (const s of rows) {
+    const icon = s.state === "waiting" ? `${tone.warn}${g.warn}${tone.reset}`
+      : s.state === "working" ? `${tone.ok}${g.pulse}${tone.reset}`
+      : s.state === "idle" ? `${tone.accent}${g.bullet}${tone.reset}`
+      : `${tone.muted}${g.dash}${tone.reset}`;
+    const word = STATE_WORDS[s.state] ?? s.state;
+    const wordTone = s.state === "waiting" ? tone.warn : s.state === "ended" ? tone.muted : "";
+    const age = sinceLabel(now - (s.since ?? s.lastEventAt ?? now));
+    const tail = tailOf(s);
+    const named = padEnd(clip(label(s), labelW, g.ellipsis), labelW);
+    out.push((`  ${icon} ${wordTone}${padEnd(word, 9)}${tone.reset} ${tone.muted}${padStart(age, 7)}${tone.reset}  `
+      + `${tail ? `${named}  ${tone.muted}${tail}${tone.reset}` : named}`).replace(/ +((?:\x1b\[[0-9;]*m)*)$/, "$1"));
+    if (s.state === "waiting" && s.waiting) {
+      const what = oneLine(s.waiting.message) || (s.waiting.kind === "asked" ? "asked a question" : "needs your permission");
+      // The tool the prompt is most likely about, unless Claude Code's own
+      // sentence already names it — "permission to use Bash (Bash)" says
+      // nothing twice over.
+      const tool0 = oneLine(s.waiting.tool);
+      const toolText = tool0 && !what.includes(tool0) ? ` (${tool0})` : "";
+      const room = Math.max(8, columns - 6 - textWidth(toolText));
+      const tool = toolText ? `${tone.muted}${toolText}${tone.reset}` : "";
+      out.push(`      ${tone.warn}${clip(what, room, g.ellipsis)}${tone.reset}${tool}`);
+    }
+  }
+  return out;
+}

package/src/server/codex-cost-usage.mjs

@@ -0,0 +1,67 @@
+import { FREE_AUTO_REVIEW_TIER, isFreeAutoReview } from "./codex-review-policy.mjs";
+// Price only observed increases under recorded settings, never a whole session
+// at its latest tier. These are API-equivalent estimates, not billing evidence.
+const FIELDS = ["input_tokens", "output_tokens", "cached_input_tokens", "cache_write_input_tokens"];
+const TIERS = new Map([["default", "standard"], ["standard", "standard"], ["priority", "fast"], ["fast", "fast"], ["flex", "flex"]]);
+const count = n => typeof n === "number" && Number.isFinite(n) && n >= 0 ? n : 0;
+const empty = () => Object.fromEntries(FIELDS.map(k => [k, 0]));
+export function codexCostState() {
+  return { model: null, tier: null, previous: null, models: new Map() };
+}
+export function codexCostGap(state) {
+  state.gapPrevious = state.previous;
+  state.previous = null;
+  state.tier = null;
+  state.model = null;
+  state.lastUsageAt = undefined;
+}
+export function foldCodexCost(state, obj) {
+  const pl = obj?.payload;
+  if (obj?.type === "session_meta") {
+    state.creator = pl?.creator_account_id;
+    state.startedAt = obj.timestamp;
+    if (state.previous === null) state.previous = empty();
+  }
+  if (obj?.type === "session_meta" && typeof pl?.model === "string") state.model = pl.model;
+  if ((obj?.type === "turn_context" || obj?.type === "response_item") && typeof pl?.model === "string") state.model = pl.model;
+  if (obj?.type !== "event_msg") return;
+  if (pl?.type === "thread_settings_applied" && Object.hasOwn(pl.thread_settings ?? {}, "service_tier")) {
+    const tier = pl.thread_settings.service_tier;
+    state.tier = TIERS.get(tier) ?? "unknown";
+  }
+  const raw = pl?.type === "token_count" ? pl.info?.total_token_usage : null;
+  if (!raw || typeof raw !== "object") return;
+  const next = Object.fromEntries(FIELDS.map(k => [k, count(raw[k])]));
+  const priorUsageAt = state.lastUsageAt;
+  state.lastUsageAt = obj.timestamp;
+  const prior = state.previous;
+  const baseline = prior ?? state.gapPrevious;
+  state.gapPrevious = null;
+  state.previous = next;
+  // The first total could precede the tier setting; the first read after a gap
+  // certainly does. Leave that part at base rates instead of guessing its tier.
+  if (baseline && FIELDS.some(k => next[k] < baseline[k])) {
+    state.models.clear();
+    return;
+  }
+  if (!prior || !state.model) return;
+  const delta = Object.fromEntries(FIELDS.map(k => [k, next[k] - prior[k]]));
+  const bucket = state.models.get(state.model) ?? { ...empty(), speeds: new Map() };
+  for (const k of FIELDS) bucket[k] += delta[k];
+  const free = isFreeAutoReview(state.model, state.creator, obj.timestamp)
+    && (isFreeAutoReview(state.model, state.creator, priorUsageAt)
+      || isFreeAutoReview(state.model, state.creator, state.startedAt));
+  const billedTier = free ? FREE_AUTO_REVIEW_TIER : state.tier;
+  if (billedTier && billedTier !== "standard") {
+    const share = bucket.speeds.get(billedTier) ?? empty();
+    for (const k of FIELDS) share[k] += delta[k];
+    bucket.speeds.set(billedTier, share);
+  }
+  state.models.set(state.model, bucket);
+}
+export function codexCostBuckets(state) {
+  if (state.models.size === 0) return undefined;
+  return Object.fromEntries([...state.models].map(([model, { speeds, ...usage }]) => [model, {
+    ...usage, ...(speeds.size ? { speeds: Object.fromEntries(speeds) } : {}),
+  }]));
+}