ccdeck 3.43.4 → 3.44.0

package/src/server/login-guard.mjs

@@ -0,0 +1,162 @@
+// Never put a dead login under every session on the machine (#2184).
+//
+// Every Claude Code session on a machine shares one login. `cswap switch N`
+// writes slot N's stored copy over it, and when that copy's refresh token is
+// already dead every running session fails within seconds with "Login expired ·
+// Please run /login". On the owner's machine that was three of the seven login
+// interruptions in the month before this was written.
+//
+// claude-swap's own `auto` engine refreshes a target before it activates it and
+// quarantines one whose refresh is refused. A plain `cswap switch` does neither,
+// and that is the command the deck runs. So the deck asks claude-swap's store
+// first, and refuses only on evidence: a dead-login error on the slot's own
+// usage row, newer than the last good read and the last sign-in. Anything it
+// cannot tell — no row, a row for somebody else, a store it cannot read — lets
+// the switch go ahead exactly as it did before.
+//
+// WHY NOT ASK CLAUDE-SWAP ABOUT ONE SLOT. 0.26.0 has no command that checks a
+// single account. `cswap list --json` is the nearest: a collection over every
+// account that is due, under claude-swap's own locks, which refreshes an
+// expired stored token through its one-time-grant gate and strikes the slot
+// when the refresh is refused. It never re-reads a slot it has already struck,
+// and it skips one its plan says is not due. So the deck asks for one only when
+// it would actually read the target (collectionWouldRead) — the 2026-10-12
+// incident was exactly that case: slot 5 last read ten minutes earlier, its
+// poll overdue, and the refusal that proved its login dead recorded one second
+// AFTER the switch had put it live.
+//
+// Pure: no file, no clock, no subprocess. claude-accounts.mjs reads the store
+// and asks these, and account-routes.mjs hands removeLeavingLiveLogin its three
+// steps.
+
+/** claude-swap's two words for a stored refresh token only a sign-in can
+ *  replace — its PERMANENT_AUTH_ERRORS. The panel says "login expired". */
+export const DEAD_LOGIN_ERRORS = new Set(["invalid_grant", "no_refresh_token"]);
+
+/** claude-swap's SERVE_TTL_S: younger than this, an on-demand collection
+ *  serves the row from the store and fetches nothing. */
+const SERVE_TTL_MS = 180_000;
+
+/** A claude-swap timestamp (epoch seconds) in ms, or null. */
+function ms(seconds) {
+  const v = typeof seconds === "number" ? seconds * 1000 : NaN;
+  return Number.isFinite(v) && v > 0 ? v : null;
+}
+
+/**
+ * Whether a slot's stored login is KNOWN dead, from its usage row.
+ *
+ * `matches` is rowIsFor's answer — a row left by the slot's previous occupant
+ * says nothing about this one. `signedInAt` is when the deck last signed this
+ * account in, in ms, or null.
+ *
+ * Dead is claude-swap's strike (`authDeadStrikes`, set by an `invalid_grant` or
+ * `no_refresh_token` and lifted by a good read or by any write of a new
+ * credential — add, import, a sign-in) or that error on a failing row, from a
+ * store that predates the strike count. And only when the refusal is the newest
+ * thing known about the login: a good read or a sign-in after it is about a
+ * login that has since worked. Transient errors — a 429, a timeout, a network
+ * that is not there — are never evidence either way.
+ *
+ * Answers `{ error, since }`, `since` being when the refusal was recorded (ms,
+ * or null when the row does not say), or null.
+ */
+export function deadLoginOf(row, { matches = false, signedInAt = null } = {}) {
+  if (!matches || !row || typeof row !== "object") return null;
+  const struck = Number(row.authDeadStrikes) >= 1;
+  const refused = Number(row.consecutiveFailures) > 0 && DEAD_LOGIN_ERRORS.has(row.lastError);
+  if (!struck && !refused) return null;
+  const failedAt = ms(row.lastAttemptAt);
+  const goodAt = ms(row.fetchedAt);
+  if (failedAt != null && goodAt != null && goodAt > failedAt) return null;
+  if (failedAt != null && Number.isFinite(signedInAt) && signedInAt > failedAt) return null;
+  return { error: DEAD_LOGIN_ERRORS.has(row.lastError) ? row.lastError : "invalid_grant", since: failedAt };
+}
+
+/**
+ * Whether a `cswap list` asked for right now would read this row — claude-swap's
+ * own on-demand rule (usage_store._row_eligible with respect_plans), so the deck
+ * spends a collection on a switch only when it can change the answer.
+ *
+ * No row, or one for somebody else, is read on the first pass. A struck row is
+ * never read again, a row in backoff or claimed by another collector waits, and
+ * otherwise it must be both older than the serve TTL and past its planned poll.
+ */
+export function collectionWouldRead(row, { matches = false, now }) {
+  if (!matches || !row || typeof row !== "object") return true;
+  if (Number(row.authDeadStrikes) >= 1) return false;
+  const backoff = ms(row.backoffUntil);
+  if (backoff != null && backoff > now) return false;
+  const claim = ms(row.claimUntil);
+  if (claim != null && claim > now) return false;
+  const fetched = ms(row.fetchedAt);
+  const next = ms(row.nextPollAt);
+  return (fetched == null || now - fetched > SERVE_TTL_MS) && (next == null || now >= next);
+}
+
+// ── removing the active account ─────────────────────────────────────────────
+//
+// `cswap remove` deletes the slot's stored copy and its entry, and nothing else:
+// it does not activate another slot, and Claude Code stays signed in as the
+// account that was removed. When that login works, that is the right thing to
+// leave alone — every session goes on running. When it is the expired one, the
+// sessions are already failing and nothing would ever move them: auto-switch
+// will not touch a login claude-swap no longer manages. So then, and only then,
+// the deck moves Claude Code to a working account once the removal has landed.
+// After it, the dead login belongs to no slot, so `cswap switch` activates the
+// target directly instead of refusing to back up the empty login first.
+
+/** The roster's active row when its login is one only a sign-in brings back —
+ *  the panel's "Login expired" on the live account. Never a stale copy (#721):
+ *  there the user IS signed in, and only claude-swap's copy is dead. */
+export function activeLoginExpired(row) {
+  if (!row?.active || row.staleCopy) return false;
+  if (row.stopped) return row.collector === "relogin_required";
+  return DEAD_LOGIN_ERRORS.has(row.error);
+}
+
+/** The accounts Claude Code may be moved to, best first: working, not held
+ *  out, and with nothing wrong on the row — the freshest reading first, then the
+ *  most room. `held` is the slots no move the deck makes may land on: set aside
+ *  by claude-swap's engine, or in use by a local `cswap run` session
+ *  (cswap-auto-choice.mjs slotsHeldBack). */
+export function liveTargets(accounts, leaving, held = new Set()) {
+  return (Array.isArray(accounts) ? accounts : [])
+    .filter(a => a && a.num !== leaving && !a.active && !a.disabled && a.alive === true
+      && !a.staleCopy && !a.stopped && !a.error && !held.has(a.num))
+    .sort((a, b) => Number(a.stale === true) - Number(b.stale === true) || (b.headroom ?? -1) - (a.headroom ?? -1));
+}
+
+/** How many accounts a removal tries before it says none would take over. Each
+ *  try can wait on a collection, and a store full of dead logins is a sign-in's
+ *  job, not a walk through every slot. */
+const MOVE_TRIES = 3;
+
+/**
+ * Remove an account, and when it was the active one with its login expired,
+ * move Claude Code to a working account afterwards.
+ *
+ * `roster()` is the roster as it stood before the removal, `remove(num)` is
+ * cswap-admin's removeAccount and `switchTo(num)` the switch route's own path,
+ * guard included. `heldBack(accounts)` names the slots the move may not land
+ * on (liveTargets); one it cannot read holds nothing back. Answers the
+ * removal's own answer, plus `movedTo` (the account now active) or
+ * `stillExpired` (nothing could take over).
+ */
+export async function removeLeavingLiveLogin(num, { roster, remove, switchTo, heldBack = async () => new Set() }) {
+  const before = await Promise.resolve().then(roster).catch(() => null);
+  const removed = await remove(num);
+  if (!removed?.ok) return removed;
+  const accounts = before?.ok && Array.isArray(before.accounts) ? before.accounts : [];
+  const row = accounts.find(a => a?.num === Number(num));
+  if (!activeLoginExpired(row)) return removed;
+  const held = await Promise.resolve().then(() => heldBack(accounts)).catch(() => null);
+  for (const target of liveTargets(accounts, row.num, held instanceof Set ? held : new Set()).slice(0, MOVE_TRIES)) {
+    const moved = await Promise.resolve().then(() => switchTo(target.num)).catch(() => null);
+    if (moved?.ok) return { ...removed, movedTo: { num: target.num, email: target.email ?? null, alias: target.alias ?? null } };
+    // Only a target refused for its own login is a reason to try the next one.
+    // Anything else — no claude-swap, a timeout — would refuse the next as well.
+    if (moved?.reason !== "login_expired") break;
+  }
+  return { ...removed, stillExpired: true };
+}

package/src/server/login-service.mjs

@@ -403,6 +403,9 @@ export const SETTING_VARS = Object.freeze([
   "AGENTS_DECK_NO_INSTALL", "AGENTS_DECK_NO_DOWNLOAD", "AGENTS_DECK_NO_UPDATE_CHECK", "AGENTS_DECK_NO_STATUS",
   "AGENTS_DECK_NO_FRESHEN", "AGENTS_DECK_NO_NOTIFY", "AGENTS_DECK_NO_LAN", "AGENTS_DECK_NO_REPORTS",
   "AGENTS_DECK_CSWAP", "AGENTS_DECK_CLAUDE", "AGENTS_DECK_CCUSAGE", "CLAUDE_SWAP_BACKUP", "AGENTS_DECK_LHM_PORT",
+  // The opt-in for Skill activity's typed-command hook (skill-hook.mjs). A deck
+  // started at login without it would take the entry back out.
+  "AGENTS_DECK_SKILL_HOOK",
 ]);
 
 export function settingsEnv(env = process.env) {

package/src/server/pinned-build.mjs

@@ -98,6 +98,11 @@ const PINNED_MODULES = [
   // (cswap-auto-choice.mjs). Already in memory through prefs-routes.mjs; named
   // here because the tick reaches it through import().
   "lan-deck.mjs",
+  // The accounts Auto-switch's own moves never land on (slotsHeldBack), which
+  // the move after removing an expired active login skips too. Already in
+  // memory through cswap-auto.mjs; named here because account-routes.mjs
+  // reaches it through import().
+  "cswap-auto-choice.mjs",
 ];
 
 let _pinned = null;

package/src/server/prefs-routes.mjs

@@ -13,6 +13,7 @@ import { heldPrefs } from "./prefs-state.mjs";
 import { applyLanPrefs, forgetReach, resetLanLoaded } from "./lan-deck.mjs";
 import { giveBackDeckFolders } from "./prefs-give-back.mjs";
 import { readBody, send } from "./http-io.mjs";
+import { noteContinueSwitchedOn } from "./stop-continue.mjs";
 
 /**
  * GET the deck's settings, and what the machine is allowing.
@@ -78,6 +79,9 @@ export async function handlePrefsWrite(req, res) {
   // to one question: is anything going to turn up. Whatever the probe said
   // before is about a deck whose sockets were down — see forgetReach.
   if (body.lan?.enabled === true) forgetReach();
+  // A stopped background session already waiting for a working login is
+  // looked at now, not at the next pass (stop-continue.mjs).
+  if (patch.continueStopped === true) noteContinueSwitchedOn();
   return send(res, 200, prefsPayload());
 }
 

package/src/server/request-gates.mjs

@@ -433,10 +433,14 @@ export const GUARDED_READS = new Set([
   "/api/tool-audit",
   "/api/tool-audit/storage",
   "/api/system/traffic-radar",
+  "/api/system/traffic-radar/settings",
   "/api/system/traffic-radar/capture",
   "/api/system/traffic-radar/capture/event",
   "/events",
   "/api/events",
+  // The ring folded to one row per session (#2183): each project's path and a
+  // standing question's own words, which is the ring's secret in fewer bytes.
+  "/api/sessions",
   "/api/claude-accounts",
   "/api/claude-accounts/login",
   "/api/browser-watch",
@@ -461,6 +465,9 @@ export const GUARDED_READS = new Set([
   "/api/ccusage/session",
   "/api/codex-usage",
   "/api/cswap-auto",
+  // Which sessions stopped, and the active account's quota reading the
+  // Continue button is gated on (stop-continue.mjs) — the quota route's class.
+  "/api/stop-continue",
   // Not a secret, and here for the other reason a read can be dangerous: it is
   // the one route where the caller names what the deck goes and fetches
   // (#1208). fm-station.mjs holds that to YouTube, but a page on another site

package/src/server/session-read-gate.mjs

@@ -13,7 +13,8 @@
  * A per-session read gate with a window of `ms`.
  *
  * `run(sid, read)` calls `read()` unless a read for `sid` is still in flight or
- * the last one began less than `ms` ago. The stamp is taken as the read starts,
+ * the last one began less than `ms` ago. Returns whether a read started, so
+ * a caller that needs a final snapshot can keep refused work pending. The stamp is taken as the read starts,
  * so a read that fails or finds nothing still holds the next one back for the
  * window — that is the throttle. `read` is called before `run` returns, as
  * every copy called it, and returns a promise. Whatever that rejects with is
@@ -29,15 +30,16 @@ export function sessionReadGate(ms) {
   const pending = new Set();      // sid currently being read
   return {
     run(sid, read) {
-      if (pending.has(sid)) return;
+      if (pending.has(sid)) return false;
       const now = Date.now();
       const last = lastReadAt.get(sid) ?? 0;
-      if (now - last < ms) return;
+      if (now - last < ms) return false;
       lastReadAt.set(sid, now);
       pending.add(sid);
       read()
         .catch(() => {})
         .finally(() => pending.delete(sid));
+      return true;
     },
     forget(sid) {
       lastReadAt.delete(sid);

package/src/server/session-summary.mjs

@@ -0,0 +1,281 @@
+// The sessions a deck is watching, as one row each, for `ccdeck sessions`
+// (#2183) — the question somebody on SSH asks first: which of my agents is
+// waiting on me?
+//
+// The canvas answers it from src/web/reducer.ts, which folds every event into a
+// graph of agents, tool calls and subagents. None of that is needed to say
+// which sessions exist and which one is blocked, and none of it can be imported
+// here: it is TypeScript bundled for the browser. So this is a small fold over
+// the same ring, and THE WAITING RULE IS A MIRROR of src/web/waiting-block.ts —
+// the same three `notification_type` kinds, the same events that leave a block
+// standing, the same rule for whose traffic clears one — written twice because
+// it has to be, the way block-notify.mjs mirrors sound.ts.
+// session-summary-mirror.test.ts runs both over the same events and fails the
+// day they disagree.
+//
+// Pure: envelopes in, rows out. The route that serves it is in index.mjs.
+
+/** How long a session may be silent before it is taken to be gone — the
+ *  canvas's own STALE_SESSION_MS (src/web/board-sweeps.ts), for its reasons:
+ *  long enough for a permission prompt left standing through a meeting, short
+ *  enough that this morning's closed terminals stop being listed as running. */
+export const STALE_SESSION_MS = 90 * 60_000;
+
+/** The `notification_type` values that raise a block, as the chore each one is
+ *  — waitingKind in waiting-block.ts. */
+export function waitingKind(notificationType) {
+  if (notificationType === "permission_prompt") return "permission";
+  if (notificationType === "agent_needs_input") return "asked";
+  if (notificationType === "idle_prompt") return "idle";
+  return null;
+}
+
+/** Events that are not evidence the session moved, and leave a block standing
+ *  — WAITING_KEEPERS in waiting-block.ts, which says why each one is here. */
+export const WAITING_KEEPERS = new Set([
+  "Notification", "ModelObserved", "ContextObserved", "UsageObserved",
+  "SessionNamed", "SessionRecapped", "OutputObserved", "ActivityObserved", "JobObserved",
+]);
+
+/** The transcript scans: enrichment the server reads off a session's files,
+ *  never the session's own traffic — the reducer's early returns, which stamp
+ *  no provider and prove nothing about whether the session is alive. */
+const SCANS = new Set([...WAITING_KEEPERS].filter(n => n !== "Notification"));
+
+/** Two copies of one event inside this are the wire talking twice —
+ *  HOOK_REDELIVERY_WINDOW_MS and PROMPT_REDELIVERY_WINDOW_MS in
+ *  src/web/redelivery.ts, which are the same number on purpose. */
+const REDELIVERY_MS = 2_000;
+
+/** Whose traffic an event is: the subagent it names, or null for the root's —
+ *  explicitSubagentKey in agent-attribution.ts. */
+function subagentKeyOf(p) {
+  if (p.agent_id) return p.agent_id;
+  if (p.parent_tool_use_id) return p.parent_tool_use_id;
+  return null;
+}
+
+/** Is this event evidence the human dealt with `w`? clearsWaiting in
+ *  waiting-block.ts: any traffic falsifies an idle block; a permission prompt
+ *  or a question is answered only by the root's own traffic or by the very
+ *  subagent that asked. */
+function clearsWaiting(w, p) {
+  if (w.kind === "idle") return true;
+  const key = subagentKeyOf(p);
+  if (key == null) return true;
+  return w.subagent != null && w.subagent === key;
+}
+
+/** The newest call still in flight on a session, whose payload names who is
+ *  asking — blockedCall in waiting-block.ts, minus the canvas's owner lookup:
+ *  the payload's own key is what that function reads in the end. */
+function newestInFlight(s) {
+  let newest = null;
+  for (const c of s.inFlight.values()) if (!newest || c.at > newest.at) newest = c;
+  return newest;
+}
+
+function blankSession(id, at) {
+  return {
+    id, provider: null, cwd: null, name: null, model: null,
+    startedAt: at, lastEventAt: at, recoveryLiveAt: null,
+    turn: "idle", turnSince: at, closed: false, waiting: null,
+    prompts: [], lastTurnEndAt: null,
+    inFlight: new Map(),
+  };
+}
+
+/** A prompt, filed in time order unless it is a copy of one already filed —
+ *  recordPrompt in redelivery.ts. Only the newest is ever read, as evidence. */
+function recordPrompt(s, at, text) {
+  for (let i = s.prompts.length - 1; i >= 0; i--) {
+    const prev = s.prompts[i];
+    if (prev.at < at - REDELIVERY_MS) break;
+    if (prev.text === text && prev.at <= at + REDELIVERY_MS) return;
+  }
+  let i = s.prompts.length;
+  while (i > 0 && s.prompts[i - 1].at > at) i--;
+  s.prompts.splice(i, 0, { at, text });
+}
+
+/**
+ * `Stop` or `SessionEnd`: the root's turn is over — applyTurnEnd in
+ * session-lifecycle.ts, the parts of it a row can show.
+ *
+ * Refused whole when it is out of order (a boundary older than the prompt that
+ * opened the turn now running) or a copy of the ending already recorded, for
+ * the reducer's reason (#1022): a replayed `Stop` landing in the next turn
+ * would call a working session "your turn". And the calls it settles are the
+ * ROOT's only, and none on Codex: a background subagent outlives the turn that
+ * dispatched it, and its call — and a permission prompt that call raises — is
+ * still running after the root's `Stop`.
+ */
+function endTurn(s, name, at) {
+  const newest = s.prompts[s.prompts.length - 1];
+  const evidenceAt = newest && newest.at > s.startedAt ? newest.at : s.startedAt;
+  if (at < evidenceAt) return;
+  if (s.lastTurnEndAt != null && evidenceAt > s.lastTurnEndAt && at <= s.lastTurnEndAt + REDELIVERY_MS) return;
+  s.turn = "idle"; s.turnSince = at;
+  s.lastTurnEndAt = at;
+  if (s.provider !== "codex") {
+    for (const [id, call] of s.inFlight) if (call.key == null) s.inFlight.delete(id);
+  }
+  if (name === "SessionEnd") s.closed = true;
+}
+
+/**
+ * The deck's recovery scan, which finds a session already running when it
+ * starts — recoverSession in session-recovery.ts. Not the session's traffic:
+ * it leaves a standing block standing (after a restart the replay has put the
+ * session's prompt back up, and the scan arrives every second and a half),
+ * and a snapshot older than the session's own newest event says nothing.
+ */
+function recover(sessions, p, at) {
+  const id = p.session_id;
+  if ((p.provider !== "codex" && p.provider !== "claude") || typeof id !== "string" || !id) return;
+  const s = sessions.get(id);
+  if (s?.provider && s.provider !== p.provider) return;
+  if (s && Number.isFinite(p.snapshot_observed_at) && (s.recoveryLiveAt ?? s.lastEventAt ?? 0) >= p.snapshot_observed_at) return;
+  if (p.recovery_active === false) {
+    if (s) endTurn(s, p.recovery_session_closed === true ? "SessionEnd" : "Stop", at);
+    return;
+  }
+  const r = s ?? blankSession(id, at);
+  sessions.set(id, r);
+  r.recoveryLiveAt ??= s?.lastEventAt ?? 0;
+  r.provider = p.provider;
+  r.closed = false;
+  if (r.turn !== "working") { r.turn = "working"; r.turnSince = at; }
+  r.lastEventAt = at;
+  if (!r.cwd && typeof p.cwd === "string" && p.cwd) r.cwd = p.cwd;
+  if (typeof p.model === "string" && p.model) r.model = p.model;
+  if (!s && Number.isFinite(p.turn_started_at) && p.turn_started_at <= at) r.startedAt = p.turn_started_at;
+  if (typeof p.prompt === "string" && p.prompt && r.prompts.at(-1)?.text !== p.prompt) r.prompts.push({ at, text: p.prompt });
+}
+
+/**
+ * Every session in the ring, folded.
+ *
+ * `envelopes` are the ring's own `{ seq, receivedAt, payload }`, oldest first.
+ * Each row says what the session is doing in one word:
+ *
+ *   waiting   a permission prompt or a question is standing — the alarm the
+ *             topbar chip counts (isAlarming in ambient-counts.ts)
+ *   working   a turn is running
+ *   idle      the turn ended and the input box is waiting, which is not an
+ *             alarm (#348) but is "your turn"
+ *   ended     SessionEnd, or nothing heard for STALE_SESSION_MS
+ */
+export function summarizeSessions(envelopes, { now = Date.now(), staleMs = STALE_SESSION_MS } = {}) {
+  let sessions = new Map();
+  for (const env of Array.isArray(envelopes) ? envelopes : []) {
+    const p = env?.payload;
+    if (!p || typeof p !== "object") continue;
+    const name = p.hook_event_name ?? "Unknown";
+    // POST /api/clear wipes the canvas with this; it wipes the list too.
+    if (name === "__clear") { sessions = new Map(); continue; }
+    const at = Number(env.receivedAt) || now;
+    if (name === "ClaudeSessionRecovered" || name === "CodexSessionRecovered") { recover(sessions, p, at); continue; }
+    const id = typeof p.session_id === "string" && p.session_id ? p.session_id : null;
+    if (!id) continue;
+    let s = sessions.get(id);
+    if (!s) { s = blankSession(id, at); sessions.set(id, s); }
+    // A Codex child thread named by its parent: a session of its own, and
+    // nothing the human did — linkCodexThread, which returns before any block
+    // is read.
+    if (name === "CodexThreadLinked") { if (p.provider === "codex") s.provider ??= "codex"; continue; }
+
+    if (!WAITING_KEEPERS.has(name) && s.waiting && clearsWaiting(s.waiting, p)) s.waiting = null;
+    // A background job's file is not always the session talking — see the
+    // reducer's note at noteSessionHeard.
+    if (name !== "JobObserved" && at > s.lastEventAt) s.lastEventAt = at;
+    if (!SCANS.has(name)) {
+      // The provider, from the session's first own event; a scan stamps none.
+      s.provider ??= p.provider === "codex" ? "codex" : "claude";
+      if (at >= (s.recoveryLiveAt ?? 0)) s.recoveryLiveAt = at;
+    }
+    if (!s.cwd && typeof p.cwd === "string" && p.cwd) s.cwd = p.cwd;
+    if (typeof p.model === "string" && p.model && !subagentKeyOf(p)) s.model = p.model;
+    if (name === "SessionNamed") s.name = p.sessionTitle ?? p.sessionName ?? s.name;
+
+    switch (name) {
+      case "SessionStart":
+        s.closed = false;
+        // The earliest beginning heard of, as applySessionStart keeps it.
+        s.startedAt = Math.min(s.startedAt, at);
+        if (s.turn !== "working") { s.turn = "idle"; s.turnSince = at; }
+        break;
+      case "UserPromptSubmit": {
+        s.closed = false;
+        s.turn = "working"; s.turnSince = at;
+        const text = typeof p.prompt === "string" ? p.prompt : typeof p.message === "string" ? p.message : "";
+        if (text) recordPrompt(s, at, text);
+        break;
+      }
+      case "Stop":
+      case "SessionEnd":
+        endTurn(s, name, at);
+        break;
+      case "PreToolUse":
+        if (p.tool_use_id) s.inFlight.set(p.tool_use_id, { at, key: subagentKeyOf(p), tool: p.tool_name ?? null });
+        if (s.turn !== "working") { s.turn = "working"; s.turnSince = at; }
+        break;
+      case "PostToolUse":
+      case "PostToolUseFailure":
+        if (p.tool_use_id) s.inFlight.delete(p.tool_use_id);
+        break;
+      case "Notification": {
+        const kind = waitingKind(p.notification_type);
+        if (!kind) break;
+        const message = typeof p.message === "string" ? p.message : "";
+        const prev = s.waiting;
+        if (prev && prev.kind === kind && prev.message === message) {
+          prev.since = Math.min(prev.since, at);
+          break;
+        }
+        const block = { kind, message, since: at, subagent: null, tool: null };
+        if (kind === "permission") {
+          const call = newestInFlight(s);
+          if (call?.key) block.subagent = call.key;
+          // BLOCK_GUESS_WINDOW_MS: only a call that started moments before the
+          // prompt is printed as the thing being asked about.
+          if (call?.tool && at - call.at <= 30_000 && call.at <= at) block.tool = call.tool;
+        }
+        s.waiting = block;
+        break;
+      }
+      default:
+        break;
+    }
+  }
+
+  const rows = [];
+  for (const s of sessions.values()) {
+    const gone = s.closed || now - s.lastEventAt > staleMs;
+    const alarm = !gone && s.waiting && s.waiting.kind !== "idle";
+    const state = gone ? "ended" : alarm ? "waiting" : s.turn === "working" && !s.waiting ? "working" : "idle";
+    const since = state === "waiting" ? s.waiting.since
+      : state === "idle" && s.waiting ? Math.min(s.waiting.since, s.turnSince)
+      : state === "ended" ? s.lastEventAt
+      : s.turnSince;
+    rows.push({
+      id: s.id,
+      provider: s.provider ?? "claude",
+      cwd: s.cwd,
+      project: s.cwd ? s.cwd.split(/[\\/]/).filter(Boolean).pop() ?? s.cwd : null,
+      name: s.name,
+      model: s.model,
+      state,
+      since,
+      startedAt: s.startedAt,
+      lastEventAt: s.lastEventAt,
+      waiting: gone || !s.waiting ? null : { kind: s.waiting.kind, message: s.waiting.message, since: s.waiting.since, tool: s.waiting.tool },
+    });
+  }
+  // The ones waiting on a human first, longest-blocked first — the order the
+  // topbar's own click visits them (blockedSessions) — then running, then the
+  // idle and the ended, most recently heard first.
+  const rank = { waiting: 0, working: 1, idle: 2, ended: 3 };
+  return rows.sort((a, b) => rank[a.state] - rank[b.state]
+    || (a.state === "waiting" ? a.since - b.since : b.lastEventAt - a.lastEventAt));
+}