ccdeck 3.43.3 → 3.44.0

package/src/server/lan-deck.mjs

@@ -352,6 +352,9 @@ export function lanApplyFields(prefs, { load = false, env = process.env } = {})
     pairingMode: lan.pairingMode === "invite" ? "invite" : "automatic",
     // Whether paired decks are told which shared account this one is on.
     shareActive: lan.shareActive !== false,
+    // Whether the account this deck is using right now may be sent to a paired
+    // deck. Off unless somebody turned it on (#2192).
+    sendInUse: lan.sendInUse === true,
     // Discovery over Tailscale, off unless somebody turned it on, and the two
     // permissions that answer for the owner's own machines there.
     tailscale: lan.tailscale === true,

package/src/server/lan-engine.mjs

@@ -107,7 +107,7 @@ export function defaultName() {
  *
  * It returned the first one, and that was wrong the first time somebody
  * checked: on this machine the first is 192.168.1.82 and the deck it needs to
- * reach is on Tailscale at 100.67.32.58, so the panel would have offered an
+ * reach is on Tailscale at 100.64.0.100, so the panel would have offered an
  * address that peer cannot route to and left them to work out why.
  *
  * WHICH ONE IS RIGHT DEPENDS ON WHERE THE PEER IS, which this side cannot
@@ -307,6 +307,9 @@ export function createEngine({
     autoAsk: true, autoAccept: true, pairingMode: "automatic", aliases: {},
     // Tell paired decks which shared account this one is on — see currentFor.
     shareActive: true,
+    // Send the account this deck is on to a paired deck that asks — off, so
+    // one login is live in one place (#2192). See manifestFor and lan-serve.mjs.
+    sendInUse: false,
     // DISCOVERY OVER TAILSCALE, off until somebody turns it on, and its own
     // pair of permissions. They are separate from the two above because the
     // tailnet is a different audience: the local switches answer for whoever
@@ -651,7 +654,7 @@ export function createEngine({
       // WHO IS ACTUALLY THERE. A typed address is a row that says `192.168.1.5:54340`
       // and nothing else until somebody answers it — and once one has, the deck
       // on the other end has told us what it calls itself. The row says that
-      // from then on, because "Constantin-PC" is what the person who typed the
+      // from then on, because "Consultant-PC" is what the person who typed the
       // address was trying to reach.
       //
       // A DIAL-BACK THAT ANSWERED IS AN ORDINARY PEER NOW. It was on trial only
@@ -1474,6 +1477,8 @@ export function createEngine({
         pairingMode: cfg.pairingMode === "invite" ? "invite" : "automatic",
         // Whether paired decks are told which shared account this one is on.
         shareActive: cfg.shareActive !== false,
+        // Whether the account this deck is on may be sent to one (#2192).
+        sendInUse: cfg.sendInUse === true,
         // Discovery over Tailscale: whether this machine has it at all, which
         // decides whether the dialog shows the switch, and what it can see.
         tailscale: tailnet ? tailnetStatus() : null,

package/src/server/lan-manifest.mjs

@@ -12,7 +12,7 @@ import { openAbout, sealAbout } from "./lan-about.mjs";
  * is the engine's clock. `myFp` answers this deck's fingerprint as it is at
  * the moment of asking — a restart for a new key changes it — and `settings`
  * the settings in force, of which a manifest reads `shared`, `onward`,
- * `trusted` and `shareActive`.
+ * `trusted`, `shareActive` and `sendInUse`.
  */
 export function createManifests({ about, now, myFp, settings }) {
   /** What each paired deck said about itself — version, operating system,
@@ -43,7 +43,7 @@ export function createManifests({ about, now, myFp, settings }) {
     const cfg = settings();
     const shared = sharedWith(cfg, toFp);
     return {
-      t: "manifest", accounts: manifestFor(accounts, shared),
+      t: "manifest", accounts: manifestFor(accounts, shared, { sendInUse: cfg.sendInUse === true, shareActive: cfg.shareActive }),
       ...currentFor(accounts, shared, cfg.shareActive),
       ...cardFor(key, toFp),
     };

package/src/server/lan-serve.mjs

@@ -5,7 +5,7 @@
 // answered at all. It keeps nothing of its own: every check reads the
 // engine's settings, listener and key at the moment it is made, because any
 // of them can change while the store is read.
-import { credentialAad, seal, sharedWith, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
+import { credentialAad, IN_USE, mayGiveInUse, seal, sharedWith, slotFor, transferChallenge, trustedPeer } from "./lan-sync.mjs";
 import { liveLoginIs } from "./account-health.mjs";
 
 /**
@@ -62,7 +62,12 @@ export function createServe({
         // paired is less than everything ticked — see sharedWith.
         const maySend = () => settings().enabled && !!serverNow() && !!trustedPeer(settings().trusted, ctx.peerFp)
           && sharedWith(settings(), ctx.peerFp).includes(msg.key);
-        if (!maySend()) return ctx.send({ t: "no", why: "not shared" });
+        // ONE ORDER, WHATEVER IS ASKED FOR: the proof, then the store, then
+        // whether that deck may have it (#2192). While its owner hides which
+        // account this deck is on, the login it is on is refused "not shared",
+        // as one not ticked is; refused before the proof and before the store,
+        // an unticked one answered a bad proof differently and sooner, which
+        // told the two apart.
         // A SECOND PROOF, for the one operation that moves a credential. The
         // session says who connected; this says they are asking for this
         // account, now. A long-lived connection authenticated an hour ago is
@@ -83,6 +88,16 @@ export function createServe({
         // live one behind it.
         const mine = slotFor(accounts, msg.key);
         if (!mine) return ctx.send({ t: "no", why: "not mine to give" });
+        // NOT THE LOGIN THIS DECK IS ON, unless its owner said so (#2192). The
+        // manifest already marked it not to be asked for, and a peer older than
+        // that mark asks anyway; this is the answer that does not depend on the
+        // asker's version, read off the same store read as everything below.
+        // While its owner hides which account this deck is on, the manifest
+        // leaves that login out, and the refusal is the one an unticked login
+        // gets: "in use" would name it.
+        if (!mayGiveInUse(accounts, msg.key, settings().sendInUse)) {
+          return ctx.send({ t: "no", why: settings().shareActive === false ? "not shared" : IN_USE });
+        }
         // A LOGIN THIS DECK CANNOT READ IS SAID SO, from state rather than from
         // a failed export: no subprocess, and nothing the CLI printed. The
         // asking deck prints it under the account, so the person learns which

package/src/server/lan-sync.mjs

@@ -123,8 +123,8 @@ export {
 // wire — see lan-copies.mjs. Re-exported, so what imports them from here still
 // does.
 export {
-  accountKey, currentFor, heardCurrent, manifestFor, offered, onePerKey, peerWhy, plan, slotFor, syncAction,
-  HERE, SENDER_UNREADABLE,
+  accountKey, currentFor, heardCurrent, manifestFor, mayGiveInUse, offered, onePerKey, peerWhy, plan, slotFor,
+  syncAction, HERE, IN_USE, SENDER_UNREADABLE,
 } from "./lan-copies.mjs";
 
 /** Marks a packet as ours before anything reads a field of it. Four bytes of
@@ -288,8 +288,8 @@ function machineKey() {
  * The part of a hostname that names the machine, rather than the network it is
  * on at the moment.
  *
- * macOS answers `os.hostname()` with `Petrus-MacBook-Pro.local` at one moment
- * and `Petrus-MacBook-Pro` at another, and a DHCP server can hang its own
+ * macOS answers `os.hostname()` with `Oswald-MacBook-Pro.local` at one moment
+ * and `Oswald-MacBook-Pro` at another, and a DHCP server can hang its own
  * domain on the end — `.lan`, `.home`, `.fritz.box`. hostId hashed whatever it
  * was handed, so two decks on one computer started either side of such a change
  * disagreed about which machine they were on. Sharing a key, each read the other
@@ -418,7 +418,7 @@ export function beaconVerdict(beacon, { selfFp, selfInstance, selfHost, formerHo
     // taking a new key is the engine's to do.
     //
     // AND ONE MACHINE'S OWN TWIN IS NOT A CLASH, which is the whole of a defect
-    // reported as "Fiodor pressed yes ten times and it keeps asking". Several
+    // reported as "Elliot pressed yes ten times and it keeps asking". Several
     // decks on one computer share a config directory, so they start with one
     // key; each read the others' beacons as somebody wearing its name, each
     // took a fresh key, each wrote that key to the file the others read — and

package/src/server/lan-wire.mjs

@@ -397,9 +397,9 @@ export function credentialAad(fromFp, toFp, key) {
 // two engines of the version before this, the round that healed one account
 // and added another read, after `ok`:
 //
-//   {"t":"manifest","accounts":[{"key":"claude1@sapec.md@@org-1","email":"claude1@sapec.md","alive":true},…],"current":{"key":"claude1@sapec.md@@org-1"}}
-//   {"t":"want","key":"claude2@sapec.md@@org-2","nonce":"…","proof":"…"}
-//   {"t":"have","key":"claude2@sapec.md@@org-2","sealed":{…}}
+//   {"t":"manifest","accounts":[{"key":"alice@example.net@@org-1","email":"alice@example.net","alive":true},…],"current":{"key":"alice@example.net@@org-1"}}
+//   {"t":"want","key":"bob@example.net@@org-2","nonce":"…","proof":"…"}
+//   {"t":"have","key":"bob@example.net@@org-2","sealed":{…}}
 //
 // So anybody on the same network segment could read every address a deck
 // shares, which of its copies are broken, which one the machine is on, and

package/src/server/login-guard.mjs

@@ -0,0 +1,162 @@
+// Never put a dead login under every session on the machine (#2184).
+//
+// Every Claude Code session on a machine shares one login. `cswap switch N`
+// writes slot N's stored copy over it, and when that copy's refresh token is
+// already dead every running session fails within seconds with "Login expired ·
+// Please run /login". On the owner's machine that was three of the seven login
+// interruptions in the month before this was written.
+//
+// claude-swap's own `auto` engine refreshes a target before it activates it and
+// quarantines one whose refresh is refused. A plain `cswap switch` does neither,
+// and that is the command the deck runs. So the deck asks claude-swap's store
+// first, and refuses only on evidence: a dead-login error on the slot's own
+// usage row, newer than the last good read and the last sign-in. Anything it
+// cannot tell — no row, a row for somebody else, a store it cannot read — lets
+// the switch go ahead exactly as it did before.
+//
+// WHY NOT ASK CLAUDE-SWAP ABOUT ONE SLOT. 0.26.0 has no command that checks a
+// single account. `cswap list --json` is the nearest: a collection over every
+// account that is due, under claude-swap's own locks, which refreshes an
+// expired stored token through its one-time-grant gate and strikes the slot
+// when the refresh is refused. It never re-reads a slot it has already struck,
+// and it skips one its plan says is not due. So the deck asks for one only when
+// it would actually read the target (collectionWouldRead) — the 2026-10-12
+// incident was exactly that case: slot 5 last read ten minutes earlier, its
+// poll overdue, and the refusal that proved its login dead recorded one second
+// AFTER the switch had put it live.
+//
+// Pure: no file, no clock, no subprocess. claude-accounts.mjs reads the store
+// and asks these, and account-routes.mjs hands removeLeavingLiveLogin its three
+// steps.
+
+/** claude-swap's two words for a stored refresh token only a sign-in can
+ *  replace — its PERMANENT_AUTH_ERRORS. The panel says "login expired". */
+export const DEAD_LOGIN_ERRORS = new Set(["invalid_grant", "no_refresh_token"]);
+
+/** claude-swap's SERVE_TTL_S: younger than this, an on-demand collection
+ *  serves the row from the store and fetches nothing. */
+const SERVE_TTL_MS = 180_000;
+
+/** A claude-swap timestamp (epoch seconds) in ms, or null. */
+function ms(seconds) {
+  const v = typeof seconds === "number" ? seconds * 1000 : NaN;
+  return Number.isFinite(v) && v > 0 ? v : null;
+}
+
+/**
+ * Whether a slot's stored login is KNOWN dead, from its usage row.
+ *
+ * `matches` is rowIsFor's answer — a row left by the slot's previous occupant
+ * says nothing about this one. `signedInAt` is when the deck last signed this
+ * account in, in ms, or null.
+ *
+ * Dead is claude-swap's strike (`authDeadStrikes`, set by an `invalid_grant` or
+ * `no_refresh_token` and lifted by a good read or by any write of a new
+ * credential — add, import, a sign-in) or that error on a failing row, from a
+ * store that predates the strike count. And only when the refusal is the newest
+ * thing known about the login: a good read or a sign-in after it is about a
+ * login that has since worked. Transient errors — a 429, a timeout, a network
+ * that is not there — are never evidence either way.
+ *
+ * Answers `{ error, since }`, `since` being when the refusal was recorded (ms,
+ * or null when the row does not say), or null.
+ */
+export function deadLoginOf(row, { matches = false, signedInAt = null } = {}) {
+  if (!matches || !row || typeof row !== "object") return null;
+  const struck = Number(row.authDeadStrikes) >= 1;
+  const refused = Number(row.consecutiveFailures) > 0 && DEAD_LOGIN_ERRORS.has(row.lastError);
+  if (!struck && !refused) return null;
+  const failedAt = ms(row.lastAttemptAt);
+  const goodAt = ms(row.fetchedAt);
+  if (failedAt != null && goodAt != null && goodAt > failedAt) return null;
+  if (failedAt != null && Number.isFinite(signedInAt) && signedInAt > failedAt) return null;
+  return { error: DEAD_LOGIN_ERRORS.has(row.lastError) ? row.lastError : "invalid_grant", since: failedAt };
+}
+
+/**
+ * Whether a `cswap list` asked for right now would read this row — claude-swap's
+ * own on-demand rule (usage_store._row_eligible with respect_plans), so the deck
+ * spends a collection on a switch only when it can change the answer.
+ *
+ * No row, or one for somebody else, is read on the first pass. A struck row is
+ * never read again, a row in backoff or claimed by another collector waits, and
+ * otherwise it must be both older than the serve TTL and past its planned poll.
+ */
+export function collectionWouldRead(row, { matches = false, now }) {
+  if (!matches || !row || typeof row !== "object") return true;
+  if (Number(row.authDeadStrikes) >= 1) return false;
+  const backoff = ms(row.backoffUntil);
+  if (backoff != null && backoff > now) return false;
+  const claim = ms(row.claimUntil);
+  if (claim != null && claim > now) return false;
+  const fetched = ms(row.fetchedAt);
+  const next = ms(row.nextPollAt);
+  return (fetched == null || now - fetched > SERVE_TTL_MS) && (next == null || now >= next);
+}
+
+// ── removing the active account ─────────────────────────────────────────────
+//
+// `cswap remove` deletes the slot's stored copy and its entry, and nothing else:
+// it does not activate another slot, and Claude Code stays signed in as the
+// account that was removed. When that login works, that is the right thing to
+// leave alone — every session goes on running. When it is the expired one, the
+// sessions are already failing and nothing would ever move them: auto-switch
+// will not touch a login claude-swap no longer manages. So then, and only then,
+// the deck moves Claude Code to a working account once the removal has landed.
+// After it, the dead login belongs to no slot, so `cswap switch` activates the
+// target directly instead of refusing to back up the empty login first.
+
+/** The roster's active row when its login is one only a sign-in brings back —
+ *  the panel's "Login expired" on the live account. Never a stale copy (#721):
+ *  there the user IS signed in, and only claude-swap's copy is dead. */
+export function activeLoginExpired(row) {
+  if (!row?.active || row.staleCopy) return false;
+  if (row.stopped) return row.collector === "relogin_required";
+  return DEAD_LOGIN_ERRORS.has(row.error);
+}
+
+/** The accounts Claude Code may be moved to, best first: working, not held
+ *  out, and with nothing wrong on the row — the freshest reading first, then the
+ *  most room. `held` is the slots no move the deck makes may land on: set aside
+ *  by claude-swap's engine, or in use by a local `cswap run` session
+ *  (cswap-auto-choice.mjs slotsHeldBack). */
+export function liveTargets(accounts, leaving, held = new Set()) {
+  return (Array.isArray(accounts) ? accounts : [])
+    .filter(a => a && a.num !== leaving && !a.active && !a.disabled && a.alive === true
+      && !a.staleCopy && !a.stopped && !a.error && !held.has(a.num))
+    .sort((a, b) => Number(a.stale === true) - Number(b.stale === true) || (b.headroom ?? -1) - (a.headroom ?? -1));
+}
+
+/** How many accounts a removal tries before it says none would take over. Each
+ *  try can wait on a collection, and a store full of dead logins is a sign-in's
+ *  job, not a walk through every slot. */
+const MOVE_TRIES = 3;
+
+/**
+ * Remove an account, and when it was the active one with its login expired,
+ * move Claude Code to a working account afterwards.
+ *
+ * `roster()` is the roster as it stood before the removal, `remove(num)` is
+ * cswap-admin's removeAccount and `switchTo(num)` the switch route's own path,
+ * guard included. `heldBack(accounts)` names the slots the move may not land
+ * on (liveTargets); one it cannot read holds nothing back. Answers the
+ * removal's own answer, plus `movedTo` (the account now active) or
+ * `stillExpired` (nothing could take over).
+ */
+export async function removeLeavingLiveLogin(num, { roster, remove, switchTo, heldBack = async () => new Set() }) {
+  const before = await Promise.resolve().then(roster).catch(() => null);
+  const removed = await remove(num);
+  if (!removed?.ok) return removed;
+  const accounts = before?.ok && Array.isArray(before.accounts) ? before.accounts : [];
+  const row = accounts.find(a => a?.num === Number(num));
+  if (!activeLoginExpired(row)) return removed;
+  const held = await Promise.resolve().then(() => heldBack(accounts)).catch(() => null);
+  for (const target of liveTargets(accounts, row.num, held instanceof Set ? held : new Set()).slice(0, MOVE_TRIES)) {
+    const moved = await Promise.resolve().then(() => switchTo(target.num)).catch(() => null);
+    if (moved?.ok) return { ...removed, movedTo: { num: target.num, email: target.email ?? null, alias: target.alias ?? null } };
+    // Only a target refused for its own login is a reason to try the next one.
+    // Anything else — no claude-swap, a timeout — would refuse the next as well.
+    if (moved?.reason !== "login_expired") break;
+  }
+  return { ...removed, stillExpired: true };
+}

package/src/server/login-service.mjs

@@ -403,6 +403,9 @@ export const SETTING_VARS = Object.freeze([
   "AGENTS_DECK_NO_INSTALL", "AGENTS_DECK_NO_DOWNLOAD", "AGENTS_DECK_NO_UPDATE_CHECK", "AGENTS_DECK_NO_STATUS",
   "AGENTS_DECK_NO_FRESHEN", "AGENTS_DECK_NO_NOTIFY", "AGENTS_DECK_NO_LAN", "AGENTS_DECK_NO_REPORTS",
   "AGENTS_DECK_CSWAP", "AGENTS_DECK_CLAUDE", "AGENTS_DECK_CCUSAGE", "CLAUDE_SWAP_BACKUP", "AGENTS_DECK_LHM_PORT",
+  // The opt-in for Skill activity's typed-command hook (skill-hook.mjs). A deck
+  // started at login without it would take the entry back out.
+  "AGENTS_DECK_SKILL_HOOK",
 ]);
 
 export function settingsEnv(env = process.env) {

package/src/server/pinned-build.mjs

@@ -98,6 +98,11 @@ const PINNED_MODULES = [
   // (cswap-auto-choice.mjs). Already in memory through prefs-routes.mjs; named
   // here because the tick reaches it through import().
   "lan-deck.mjs",
+  // The accounts Auto-switch's own moves never land on (slotsHeldBack), which
+  // the move after removing an expired active login skips too. Already in
+  // memory through cswap-auto.mjs; named here because account-routes.mjs
+  // reaches it through import().
+  "cswap-auto-choice.mjs",
 ];
 
 let _pinned = null;

package/src/server/prefs-routes.mjs

@@ -13,6 +13,7 @@ import { heldPrefs } from "./prefs-state.mjs";
 import { applyLanPrefs, forgetReach, resetLanLoaded } from "./lan-deck.mjs";
 import { giveBackDeckFolders } from "./prefs-give-back.mjs";
 import { readBody, send } from "./http-io.mjs";
+import { noteContinueSwitchedOn } from "./stop-continue.mjs";
 
 /**
  * GET the deck's settings, and what the machine is allowing.
@@ -78,6 +79,9 @@ export async function handlePrefsWrite(req, res) {
   // to one question: is anything going to turn up. Whatever the probe said
   // before is about a deck whose sockets were down — see forgetReach.
   if (body.lan?.enabled === true) forgetReach();
+  // A stopped background session already waiting for a working login is
+  // looked at now, not at the next pass (stop-continue.mjs).
+  if (patch.continueStopped === true) noteContinueSwitchedOn();
   return send(res, 200, prefsPayload());
 }
 

package/src/server/process-command.mjs

@@ -31,8 +31,11 @@ export const CMD_MAX = 180;
 const SECRET_FLAG =
   /(-{1,2}[\w.-]*(?:token|password|passwd|secret|api[-_]?key|apikey|auth|credential|bearer|cookie|session[-_]?id|private[-_]?key)[\w.-]*)(=|\s+)(\S+)/gi;
 // The shapes that are a secret on their own, with no flag in front of them.
+// GitHub's fine-grained tokens and GitLab's prefixed ones (personal, deploy,
+// runner, trigger…) too: `gh`, `glab`, git credential helpers and scripts put
+// them on a command line as readily as the classic `ghp_` ones.
 const BARE_SECRET =
-  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,})/g;
+  /\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,}|gl(?:pat|dt|rt|cbt|ptt|ft|imt|agent|oas|soat)-[A-Za-z0-9_.-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{12,}|eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,})/g;
 // user:password@host, in any URL. The password goes; the rest is a location.
 const URL_CREDENTIALS = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:@/]+):[^\s@/]+@/gi;
 

package/src/server/reports.mjs

@@ -477,8 +477,14 @@ export function scrub(text, home = homedir(), root = PKG_ROOT) {
     .replace(new RegExp(ADDRESS_PATTERN, "g"), "<host>")
     .replace(new RegExp(HOST_PATTERN, "g"), "<host>")
     .replace(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, "<email>")
+    // An Authorization header's value, whatever its scheme carries — a token
+    // of 44 characters of base64, say, is short of the generic pattern below
+    // (found with #2178) — and an Atlassian API token, which always starts
+    // ATATT, at any length.
+    .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9+/._~-]{12,}=*/g, "$1 <secret>")
+    .replace(/\bATATT[A-Za-z0-9+/_=-]{8,}/g, "<secret>")
     .replace(
-      /\b(?:sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[A-Fa-f0-9]{40,}|[A-Za-z0-9+_=-]{48,})/g,
+      /\b(?:sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9_-]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|gl(?:pat|dt|rt|cbt|ptt|ft|imt|agent|oas|soat)-[A-Za-z0-9_.-]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}|[A-Fa-f0-9]{40,}|[A-Za-z0-9+_=-]{48,})/g,
       "<secret>",
     );
 }

package/src/server/request-gates.mjs

@@ -433,10 +433,14 @@ export const GUARDED_READS = new Set([
   "/api/tool-audit",
   "/api/tool-audit/storage",
   "/api/system/traffic-radar",
+  "/api/system/traffic-radar/settings",
   "/api/system/traffic-radar/capture",
   "/api/system/traffic-radar/capture/event",
   "/events",
   "/api/events",
+  // The ring folded to one row per session (#2183): each project's path and a
+  // standing question's own words, which is the ring's secret in fewer bytes.
+  "/api/sessions",
   "/api/claude-accounts",
   "/api/claude-accounts/login",
   "/api/browser-watch",
@@ -461,6 +465,9 @@ export const GUARDED_READS = new Set([
   "/api/ccusage/session",
   "/api/codex-usage",
   "/api/cswap-auto",
+  // Which sessions stopped, and the active account's quota reading the
+  // Continue button is gated on (stop-continue.mjs) — the quota route's class.
+  "/api/stop-continue",
   // Not a secret, and here for the other reason a read can be dangerous: it is
   // the one route where the caller names what the deck goes and fetches
   // (#1208). fm-station.mjs holds that to YouTube, but a page on another site

package/src/server/session-read-gate.mjs

@@ -13,7 +13,8 @@
  * A per-session read gate with a window of `ms`.
  *
  * `run(sid, read)` calls `read()` unless a read for `sid` is still in flight or
- * the last one began less than `ms` ago. The stamp is taken as the read starts,
+ * the last one began less than `ms` ago. Returns whether a read started, so
+ * a caller that needs a final snapshot can keep refused work pending. The stamp is taken as the read starts,
  * so a read that fails or finds nothing still holds the next one back for the
  * window — that is the throttle. `read` is called before `run` returns, as
  * every copy called it, and returns a promise. Whatever that rejects with is
@@ -29,15 +30,16 @@ export function sessionReadGate(ms) {
   const pending = new Set();      // sid currently being read
   return {
     run(sid, read) {
-      if (pending.has(sid)) return;
+      if (pending.has(sid)) return false;
       const now = Date.now();
       const last = lastReadAt.get(sid) ?? 0;
-      if (now - last < ms) return;
+      if (now - last < ms) return false;
       lastReadAt.set(sid, now);
       pending.add(sid);
       read()
         .catch(() => {})
         .finally(() => pending.delete(sid));
+      return true;
     },
     forget(sid) {
       lastReadAt.delete(sid);