ccdeck 3.43.4 → 3.45.0

package/src/server/cswap-auto-choice.mjs

@@ -181,6 +181,23 @@ async function accountsInCswapRun(accounts) {
   return live;
 }
 
+/**
+ * The slots no move may land on, whatever the rule: the ones claude-swap's
+ * engine quarantined and the ones a local `cswap run` session is using — the
+ * two `landable` skips by key. For the failover away from an expired login
+ * (autoswitch-failover.mjs), which moves without asking the rules, so it
+ * never lands on another dead login or on a login a session already holds.
+ * Roster rows in, slot numbers out.
+ */
+export async function slotsHeldBack(roster) {
+  const accounts = (Array.isArray(roster) ? roster : [])
+    .filter(a => a && a.num != null)
+    .map(a => ({ ...a, key: accountKey(a.email, a.orgUuid) }));
+  const engine = await engineState(accounts);
+  const busy = await accountsInCswapRun(accounts);
+  return new Set(accounts.filter(a => engine.quarantined.has(a.key) || busy.has(a.key)).map(a => a.num));
+}
+
 const numberOr = (v, fallback) => {
   const n = Number(v);
   return v != null && v !== "" && Number.isFinite(n) ? n : fallback;
@@ -294,3 +311,39 @@ export async function noteEngineTick(result, accounts) {
   const to = accounts.find(a => String(a.num) === String(result.to?.number));
   await updateChoice(c => ({ ...c, manual: false, lastActive: to?.key ?? null, lastMoveAt: Date.now() }));
 }
+
+/**
+ * The two rules as `ccdeck switch --best` asks them (#2183): what
+ * account-pick.mjs bestAccount hands chooseAccount, read the way
+ * chooseBeforeEngine reads it — the threshold, the counted models and the
+ * engine's strategy from claude-swap's config, the accounts its engine
+ * quarantined and the ones a local `cswap run` session holds. Null when
+ * neither rule is set, before anything else is read: `--best` is then the
+ * engine's own choice, as every tick is.
+ *
+ * `choice` and `settings` are the deck's (GET /api/cswap-auto) when a deck
+ * answered, so the rules are the ones its panel shows; with no deck they are
+ * read here. Only reads: nothing in auto-choice.json or claude-swap's store
+ * changes, so it needs no lock and takes none.
+ */
+export async function bestRules(rows, { choice = null, settings = null, now = Date.now() } = {}) {
+  const c = choice ?? await choiceStatus();
+  const next = c?.next === "weekly" ? "weekly" : "room";
+  const home = text(c?.home?.email) ? accountKey(c.home.email, c.home.orgUuid) : null;
+  if (next === "room" && !home) return null;
+  const cfg = (settings ?? await readCswapConfig()) ?? {};
+  const accounts = (Array.isArray(rows) ? rows : [])
+    .filter(a => a && a.num != null)
+    .map(a => ({ ...a, key: accountKey(a.email, a.orgUuid) }));
+  const engine = await engineState(accounts);
+  return {
+    next,
+    home,
+    threshold: numberOr(cfg["autoswitch.threshold"]?.value, 90),
+    models: countedModels(cfg["autoswitch.model"]?.value),
+    busy: await accountsInCswapRun(accounts),
+    quarantined: engine.quarantined,
+    optional: (cfg["autoswitch.strategy"]?.value ?? "best") === "best",
+    now,
+  };
+}

package/src/server/cswap-auto-loop.mjs

@@ -18,11 +18,18 @@ import { invalidateQuotaCache } from "./quota.mjs";
 import { withStoreLock } from "./store-lock.mjs";
 // Told about every finished tick and about the switch itself, so a tick that
 // moved the account is said once on the desktop (account-notify.mjs). Both
-// doors return at once and never throw.
-import { noteAutoSwitch, noteAutoTick } from "./account-watch.mjs";
+// doors return at once and never throw. The third is the other way round: how a
+// session that stopped on a dead login asks for a tick now (tickSoon).
+import { connectEarlyTick, noteAutoSwitch, noteAutoTick } from "./account-watch.mjs";
 // The owner's two rules — a home account, and the soonest weekly reset — asked
 // before the engine, inside the same lock. With neither set, nothing.
-import { chooseBeforeEngine, forgetPicksByHand, noteEngineTick } from "./cswap-auto-choice.mjs";
+import { chooseBeforeEngine, forgetPicksByHand, noteEngineTick, slotsHeldBack } from "./cswap-auto-choice.mjs";
+// The one decision the engine cannot reach under `--once`: leaving an active
+// account whose login has died. See its header.
+import { engineLostActive, failOver } from "./autoswitch-failover.mjs";
+// And the automatic continue of stopped background sessions (#2193), which a
+// tick that moved the account is the likeliest moment for. Returns at once.
+import { noteContinueTick } from "./stop-continue.mjs";
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -55,7 +62,8 @@ function summarise(stdout) {
     // here throws away readings that cost a subprocess each.
     switched:  events.some(e => e.event === "switch" && e.dryRun !== true),
     // Why the engine moved — "proactive", "at-limit", "failover" — beside the
-    // deck's own "home" and "weekly-reset" (cswap-auto-choice.mjs).
+    // deck's own "home" and "weekly-reset" (cswap-auto-choice.mjs), and
+    // "login-expired", which the deck's failover writes here.
     trigger:   action?.trigger ?? null,
     reason:    action?.reason ?? null,
     detail:    action?.detail ?? null,
@@ -121,9 +129,13 @@ async function runAutoTick() {
       // A deck-managed `cswap switch` does not advance the engine's own
       // lastSwitchAt. Its fallback must keep our cooldown too, or a manual
       // return to the full account can immediately escape the weekly rule
-      // through the engine's most-room choice. Still allow emergency exits.
+      // through the engine's most-room choice. Still allow emergency exits:
+      // the engine's own at-limit and failover, and an active account it could
+      // not read, which may be a login that has died — the deck's failover
+      // judges that one after the tick (autoswitch-failover.mjs).
       const decision = summarise(preview.stdout);
-      if (Date.now() < chose.cooldownUntil && decision.trigger !== "at-limit" && decision.trigger !== "failover") {
+      if (Date.now() < chose.cooldownUntil && decision.trigger !== "at-limit" && decision.trigger !== "failover"
+        && !engineLostActive({ ok: true, ...decision })) {
         return { chose: {
           ok: true, ...decision, event: "no-switch", switched: false,
           trigger: null, reason: "cooldown", from: null, to: null,
@@ -134,6 +146,7 @@ async function runAutoTick() {
     const out = await run(await cswapBin(), ["auto", "--once", "--json"], { timeout: TICK_TIMEOUT_MS });
     return { ...out, accounts: chose.accounts };
   });
+  _ruleAccounts = r.accounts ?? null;
   if (r.skipped) return { event: "skipped", reason: r.skipped };
   if (r.chose) return r.chose;
   // A KILLED RUN IS NOT A QUIET ONE. `run`'s timeout path deliberately keeps an
@@ -159,6 +172,11 @@ async function runAutoTick() {
 let _timer   = null;
 let _lastTick = null;
 let _enabled  = false;
+// When the deck last switched away from a dead login, for failOver's cooldown.
+let _lastFailoverAt = null;
+// The roster the home/weekly rules decided on in this tick, or null when none
+// is set: the failover's move is a tick's, and noteEngineTick records it so.
+let _ruleAccounts = null;
 // Set the instant startLoop is entered and cleared when it settles, because
 // `_timer` cannot do that job: it is assigned AFTER an await, and the window in
 // between is what #537 was. See startLoop.
@@ -169,6 +187,9 @@ let _starting = false;
 let _restartWanted = false;
 // The tick in flight, so the interval can skip rather than stack. See tick.
 let _ticking = null;
+// When the tick in flight began, so an early tick can tell whether the one
+// running already started after it was asked for. See tickSoon.
+let _tickStartedAt = 0;
 // What every tick waits for before it runs anything: the launcher's word that
 // the claude-swap it drives is not being installed or upgraded underneath it.
 // Settled by default, so a caller with nothing to wait for — a respawn, a test,
@@ -244,7 +265,25 @@ async function runTick() {
     _lastTick = { at: Date.now(), event: "skipped", reason: "disabled" };
     return;
   }
-  const result = await runAutoTick();
+  let result = await runAutoTick();
+  // A tick that could not read the active account may be a login that has
+  // died, which the engine cannot leave under --once (autoswitch-failover.mjs).
+  // The switch asks both of this function's questions again inside the lock,
+  // for the same reason runAutoTick does (#1797).
+  const failover = await failOver(result, {
+    lastAt: _lastFailoverAt,
+    before: async () => (!_enabled ? "disabled" : (await externalAutoRunning()) ? "external-engine" : null),
+    heldBack: slotsHeldBack,
+  }).catch(() => null);
+  if (failover) {
+    result = { ...result, ...failover };
+    if (failover.switched) {
+      _lastFailoverAt = Date.now();
+      // Where the failover left the user is a tick's pick, not one made by
+      // hand, so the home/weekly rules and their cooldown go on from it.
+      await noteEngineTick(result, _ruleAccounts).catch(() => {});
+    }
+  }
   // Before `_lastTick`, not after. This is the only path in the deck that moves
   // the live account without a click behind it, so nothing else is in a position
   // to make the call — and `_lastTick` is what /api/cswap-auto reports, so
@@ -286,12 +325,63 @@ async function runTick() {
 function tick() {
   if (_ticking) return _ticking;
   // The notifier hears what every tick did, the ones that switched nothing
-  // included: a threshold notice it is holding waits for exactly that answer.
+  // included: a threshold notice it is holding waits for exactly that answer,
+  // and a stopped notice for one that began after the stop.
   // Not awaited, and caught inside: a notification never delays a tick.
-  _ticking = runTick().then(() => { noteAutoTick(_lastTick); }).finally(() => { _ticking = null; });
+  const startedAt = Date.now();
+  _tickStartedAt = startedAt;
+  _ticking = runTick().then(() => { noteAutoTick(_lastTick, { startedAt }); noteContinueTick(_lastTick); }).finally(() => { _ticking = null; });
   return _ticking;
 }
 
+/** How long an early tick waits for the rest of a burst: sessions sharing a
+ *  login stop within a second or two of each other. */
+export const SOON_MS = 1_500;
+
+/** The least time between two early ticks. The stops arrive on `/api/event`,
+ *  which takes a post without the deck's token, so this is what keeps a loop
+ *  of fake ones from running `cswap auto --once` back to back — the interval's
+ *  own floor is fifteen seconds, and this is twice that. */
+export const SOON_GAP_MS = 30_000;
+
+let _soon = null;
+let _soonAskedAt = -Infinity;
+
+/**
+ * Run one tick now rather than at the next interval, because a session has
+ * just stopped on an expired login or a usage limit (account-watch.mjs
+ * `noteHookStop`). The same tick the interval runs, through the same guards,
+ * so nothing about what the engine decides changes — only when it is asked.
+ *
+ * COALESCED: the first ask arms one tick SOON_MS later and every ask until it
+ * runs joins it, so ten sessions stopping in the same second cause one tick;
+ * after it, asks inside SOON_GAP_MS are dropped, and the interval carries on.
+ * NEVER BESIDE A RUNNING TICK: one in flight is waited for, and is enough by
+ * itself when it began after the ask. Off, this does nothing.
+ *
+ * Returns whether a tick was armed, for the suite.
+ */
+export function tickSoon() {
+  if (!_enabled || _soon) return false;
+  const askedAt = Date.now();
+  if (askedAt - _soonAskedAt < SOON_GAP_MS) return false;
+  _soonAskedAt = askedAt;
+  _soon = setTimeout(async () => {
+    _soon = null;
+    try {
+      if (_ticking) {
+        const covered = _tickStartedAt >= askedAt;
+        await _ticking;
+        if (covered) return;
+      }
+      if (_enabled) await tick();
+    } catch { /* a tick reports its own failures in _lastTick */ }
+  }, SOON_MS);
+  _soon.unref?.();
+  return true;
+}
+connectEarlyTick(tickSoon);
+
 /**
  * Start the deck-managed loop, at most once.
  *
@@ -354,6 +444,7 @@ async function startLoop() {
 
 function stopLoop() {
   if (_timer) { clearInterval(_timer); _timer = null; }
+  if (_soon) { clearTimeout(_soon); _soon = null; }
 }
 
 /** Put a new interval into effect: the timer goes, and a fresh read of the

package/src/server/deck-client.mjs

@@ -0,0 +1,112 @@
+// How a command typed in a terminal talks to the deck already running (#2183).
+//
+// `ccdeck accounts` and `ccdeck switch` are asked over SSH as often as at the
+// desk, by somebody who has no tab open and no wish to forward one. The deck
+// already answers everything they need — the roster, the switch, the sessions
+// it is watching — so the command is a client of it rather than a second
+// implementation beside it.
+//
+// AND IT HAS TO BE. The account store's mutex is in the deck's own process
+// (store-lock.mjs, "not defence against another process"), so a terminal that
+// ran `cswap switch` itself while a deck was up would race the Accounts panel,
+// the auto-switch tick and a sign-in in flight — the race #1039 closed inside
+// the deck. Through the deck, the switch takes that lock, invalidates the
+// roster and the quota the panel is showing, and lands in the swap log, exactly
+// as a click does.
+//
+// THE SAME DOOR `--stop` USES. The registry record (0600, this user's) holds
+// the deck's port and token; a request on 127.0.0.1 with `x-ccdeck-token` and
+// no browser headers is what request-gates.mjs admits for a guarded read and a
+// mutation alike. The token is read again on every call, because a deck that
+// restarted has a new one.
+//
+// A leaf, like stop-deck.mjs: node:http and running-deck.mjs, and nothing that
+// starts a server or arms a timer.
+import { request as httpRequest } from "node:http";
+import { liveDecks } from "./running-deck.mjs";
+
+/** Long enough for a roster read, which can wait on claude-swap's store; short
+ *  enough that a wedged deck does not hold the terminal. A switch passes its
+ *  own, since `cswap switch` is given thirty seconds inside the deck. */
+export const ASK_MS = 10_000;
+
+/**
+ * The deck a command talks to, or null when none is running.
+ *
+ * `--port` names one. Otherwise there is meant to be exactly one — a start
+ * keeps at most one per Claude config directory (running-deck.mjs) — and when a
+ * leftover from before that rule is still up, the newest version wins, then the
+ * lowest port, so the answer is the same every time it is asked.
+ */
+export async function findDeck({ port = null, live = liveDecks } = {}) {
+  const decks = await live().catch(() => []);
+  if (port != null) return decks.find(d => d.port === Number(port)) ?? null;
+  if (!decks.length) return null;
+  return [...decks].sort((a, b) => newer(b.version, a.version) || a.port - b.port)[0];
+}
+
+/** Positive when `a` is a newer x.y.z than `b`. A missing version is oldest. */
+function newer(a, b) {
+  const parts = (v) => String(v ?? "").split(".").map(n => Number.parseInt(n, 10) || 0);
+  const [x, y] = [parts(a), parts(b)];
+  for (let i = 0; i < 3; i++) if ((x[i] ?? 0) !== (y[i] ?? 0)) return (x[i] ?? 0) - (y[i] ?? 0);
+  return 0;
+}
+
+/**
+ * One request to a deck, answered as `{ ok, status, body }`.
+ *
+ * Never rejects, for the reason askDeckToStop gives: every failure is a verdict
+ * the caller has something to say about. `ok` is the HTTP status, and `body` the
+ * parsed JSON or null — the deck's own `{ ok: false, reason }` arrives with a
+ * 400 and is worth more to the reader than the status alone, so it is kept.
+ */
+export function askDeck(rec, { method = "GET", path, body = undefined, timeoutMs = ASK_MS, request = httpRequest } = {}) {
+  return new Promise(resolve => {
+    let settled = false;
+    const finish = (v) => { if (!settled) { settled = true; resolve(v); } };
+    const payload = body === undefined ? null : JSON.stringify(body);
+    let req;
+    try {
+      req = request({
+        hostname: "127.0.0.1",
+        port: rec.port,
+        path,
+        method,
+        timeout: timeoutMs,
+        headers: {
+          // The token, and nothing a browser would send: a request that carried
+          // an Origin or Sec-Fetch-Site would be judged as a page's, and a page
+          // is not who this is.
+          "x-ccdeck-token": String(rec.token ?? ""),
+          ...(payload === null
+            ? { "content-length": "0" }
+            : { "content-type": "application/json", "content-length": String(Buffer.byteLength(payload)) }),
+        },
+      }, res => {
+        let text = "";
+        res.setEncoding("utf8");
+        res.on("data", d => { text += d; });
+        res.on("end", () => {
+          let parsed = null;
+          try { parsed = JSON.parse(text); } catch { /* not JSON: the status speaks */ }
+          const status = res.statusCode ?? 0;
+          finish({ ok: status >= 200 && status < 300, status, body: parsed });
+        });
+        // A reply cut off half way — the deck stopped, or its socket did —
+        // ends with neither `end` nor a request error, and a promise left
+        // waiting for one is a command that never returns.
+        res.on("error", () => {});
+        res.on("close", () => {
+          if (!res.complete) finish({ ok: false, status: res.statusCode ?? 0, body: null, reason: "cut_off" });
+        });
+      });
+    } catch (err) {
+      return finish({ ok: false, status: 0, body: null, reason: err?.code ?? "request_failed" });
+    }
+    req.on("error", err => finish({ ok: false, status: 0, body: null, reason: err?.code ?? "unreachable" }));
+    req.on("timeout", () => { req.destroy(); finish({ ok: false, status: 0, body: null, reason: "timeout" }); });
+    if (payload !== null) req.write(payload);
+    req.end();
+  });
+}

package/src/server/deck-prefs.mjs

@@ -84,6 +84,19 @@ export const DEFAULTS = Object.freeze({
   notifySwap: true,
   notifyQuota: false,
   notifyReset: false,
+  // Sessions that stopped on an expired login or a usage limit, said once per
+  // incident (account-notify.mjs). ON for the swap's reason: it is rare, every
+  // running session is stopped when it happens, and nothing else says so.
+  notifyStopped: true,
+  // A login this deck is on, live on another deck too (#2192). ON, like the
+  // swap: it is rare, it is said once per incident, and nothing else on the
+  // desktop says it before one of the two machines is signed out.
+  notifyElsewhere: true,
+  // Continue a BACKGROUND session whose turn stopped on an expired login or a
+  // usage limit, once a working login with room is active again — once per
+  // stop (stop-continue.mjs, #2193). OFF: it stops and restarts a session's
+  // process on the user's behalf, and that is something a person turns on.
+  continueStopped: false,
   // The Electron window can open on a new localhost port after an update.
   // Its tour marker must outlive that origin; browser tabs still use their
   // own localStorage marker and never read this preference.
@@ -334,6 +347,9 @@ export function normalise(raw) {
     notifySwap: flagOr(src.notifySwap, DEFAULTS.notifySwap),
     notifyQuota: flagOr(src.notifyQuota, DEFAULTS.notifyQuota),
     notifyReset: flagOr(src.notifyReset, DEFAULTS.notifyReset),
+    notifyStopped: flagOr(src.notifyStopped, DEFAULTS.notifyStopped),
+    notifyElsewhere: flagOr(src.notifyElsewhere, DEFAULTS.notifyElsewhere),
+    continueStopped: flagOr(src.continueStopped, DEFAULTS.continueStopped),
     tourSeen: flagOr(src.tourSeen, DEFAULTS.tourSeen),
     autoUpdate: flagOr(src.autoUpdate, DEFAULTS.autoUpdate),
     reports: flagOr(src.reports, DEFAULTS.reports),
@@ -718,7 +734,10 @@ export function publicPrefs(prefs) {
  * here — prefs-route-fields.test.ts lists them.
  */
 export const PAGE_FIELDS = Object.freeze({
-  top: Object.freeze(["notifications", "notifySwap", "notifyQuota", "notifyReset", "tourSeen", "autoUpdate", "recoverCodexSessions", "recoverClaudeSessions"]),
+  top: Object.freeze([
+    "notifications", "notifySwap", "notifyQuota", "notifyReset", "notifyStopped", "notifyElsewhere", "continueStopped",
+    "tourSeen", "autoUpdate", "recoverCodexSessions", "recoverClaudeSessions",
+  ]),
   lan: Object.freeze([
     "enabled", "name", "shared", "manual", "shareActive", "sendInUse", "pairingMode",
     "autoAsk", "autoAccept", "tailscale", "tailscaleAsk", "tailscaleAccept",
@@ -752,15 +771,17 @@ export function notificationsOn(prefs, env = process.env) {
 }
 
 /**
- * Which account notifications may go out right now: the three switches, each
- * on its own, and all three off when the machine vetoed notifications at
+ * Which account notifications may go out right now: the five switches, each
+ * on its own, and all five off when the machine vetoed notifications at
  * launch — AGENTS_DECK_NO_NOTIFY=1 keeps the deck off the desktop whatever
  * else it was told, and these are desktop notifications too.
  */
 export function accountNotifySettings(prefs, env = process.env) {
-  if (notificationsVetoed(env)) return { swap: false, quota: false, reset: false };
+  if (notificationsVetoed(env)) return { swap: false, quota: false, reset: false, stopped: false, elsewhere: false };
   const p = normalise(prefs);
-  return { swap: p.notifySwap, quota: p.notifyQuota, reset: p.notifyReset };
+  return {
+    swap: p.notifySwap, quota: p.notifyQuota, reset: p.notifyReset, stopped: p.notifyStopped, elsewhere: p.notifyElsewhere,
+  };
 }
 
 /**

package/src/server/event-pipeline.mjs

@@ -14,9 +14,13 @@ import { PRODUCT } from "./brand.mjs";
 import { createBlockNotifier } from "./block-notify.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
 import { accountNotifySettings, notificationsOn } from "./deck-prefs.mjs";
-// The account notifier — a switch, a quota threshold, a reset — connected below
-// to the same OS call the block notifier uses.
-import { connectAccountNotify } from "./account-watch.mjs";
+// The account notifier — a switch, a quota threshold, a reset, sessions stopped
+// on a dead login — connected below to the same OS call the block notifier
+// uses, and the door a stopped turn is reported through.
+import { connectAccountNotify, noteHookStop } from "./account-watch.mjs";
+// The same stops, and what shows each session working again, for the Continue
+// action and the automatic continue of background sessions (#2193).
+import { noteStopContinue } from "./stop-continue.mjs";
 // The settings as this process holds them — see prefs-state.mjs.
 import { heldPrefs } from "./prefs-state.mjs";
 // The deck's own token, taken back out of every event before the ring, the
@@ -205,6 +209,15 @@ export function pushEvent(raw, source, opts = {}) {
   // know the other exists. block-notify.mjs holds the gates and the cooldown.
   blockNotifier.consider(raw, { clients: pageCount(), replay: !!opts.replay });
 
+  // A turn this machine's Claude Code ended on an expired login or a usage
+  // limit: one notification for the incident, and an auto-switch tick now
+  // rather than at the next interval (account-watch.mjs). A hook's own post
+  // only — a replay is history, and the scanners never send one.
+  if (source === "hook" && !opts.replay) {
+    noteHookStop(raw, evt.receivedAt);
+    noteStopContinue(raw, evt.receivedAt);
+  }
+
   // Persisted history is not current activity. Fresh recovery snapshots are
   // current evidence even though they bypass replayed-tool accounting.
   if (shouldTrackActivity(raw, opts)) activity.note(raw, evt.receivedAt);
@@ -241,6 +254,9 @@ export function pushEvent(raw, source, opts = {}) {
   // Provider gates the path: Claude reads transcript_path; Codex reads its
   // rollout JSONL under ~/.codex/sessions/. The Claude scanners short-circuit
   // when transcript_path is absent (always the case for Codex hooks).
+  if (source === "codex" && !opts.replay && raw?.hook_event_name === "UsageObserved") {
+    maybeResolveCodex(raw, { persist: opts.persist });
+  }
   if (source === "hook" && !opts.replay) {
     // A hook is somebody running the CLI, which is what the day's usage counts.
     usageDay.noteUse(raw);

package/src/server/event-routes.mjs

@@ -17,6 +17,7 @@ import { presentsDeckToken } from "./request-gates.mjs";
 import { SEQ_EPOCH, ringHoldsNewerThan, ringSnapshot } from "./event-ring.mjs";
 // The one door every event comes through — see event-pipeline.mjs.
 import { pushEvent } from "./event-pipeline.mjs";
+import { noteToolAudit } from "./tool-audit.mjs";
 import { noteLogWriter } from "./event-log.mjs";
 // Which CLIs this deck watches — see deck-scope.mjs.
 import { deckProviders } from "./deck-scope.mjs";
@@ -201,6 +202,20 @@ export function handleEventIngest(req, res, persist = true) {
     if (!deckProviders().claude && parsed?.provider === "claude") {
       return send(res, 409, { error: "this deck is not watching Claude" });
     }
+    // A slash command expanding into a prompt (UserPromptExpansion) is counted
+    // for Skill activity and goes no further. The prompt it becomes arrives on
+    // its own UserPromptSubmit, the canvas has nothing to draw for it, and the
+    // reducer would otherwise treat an event it does not know as session
+    // traffic. So it never reaches the ring, the pages or the log.
+    if (parsed?.hook_event_name === "UserPromptExpansion") {
+      try {
+        noteToolAudit(parsed, "hook", {});
+        send(res, 200, { ok: true });
+      } catch (err) {
+        sendInternalError(res, err);
+      }
+      return;
+    }
     // Everything past the parse is inside one net, because this listener is the
     // one place in the route table `guard` cannot reach. The route does wrap the
     // call — `guard(handleEventIngest(req, res, …), res)` — but this function

package/src/server/exec.mjs

@@ -96,8 +96,12 @@ const TIMEOUT_TAIL = 8 << 10;
  * `{...process.env, X: "1"}` to add to it. It exists because the quota probe
  * runs a whole Claude Code and has to mark the run as the deck's own, and that
  * marker is what stops every poll drawing itself onto the canvas.
+ *
+ * `cwd` is the child's working directory, and the deck's own when absent. It
+ * exists for `claude --resume <id> --bg` (stop-continue.mjs): Claude Code
+ * finds a conversation by the project it was started in, and resumes it there.
  */
-export function run(cmd, args, { timeout = 20_000, maxBuffer = 4 << 20, env } = {}) {
+export function run(cmd, args, { timeout = 20_000, maxBuffer = 4 << 20, env, cwd } = {}) {
   const tries = candidates(cmd);
   return new Promise((resolve) => {
     const attempt = (i) => {
@@ -166,7 +170,7 @@ export function run(cmd, args, { timeout = 20_000, maxBuffer = 4 << 20, env } =
         // process, so a shutdown that does not reap it leaves the child with
         // no deadline at all. See `live` in exec-children.mjs, and #1012.
         const cp = watchChild(execFile(file, argv,
-          { timeout: 0, shell: false, windowsHide: true, maxBuffer, ...(env ? { env } : {}), ...opts }, done));
+          { timeout: 0, shell: false, windowsHide: true, maxBuffer, ...(env ? { env } : {}), ...(cwd ? { cwd } : {}), ...opts }, done));
         // Give the child EOF on stdin straight away, which is what this
         // function's contract has always claimed ("run closes stdin", says
         // runInteractive's header) and what execFile does not do: it leaves the

package/src/server/feature-use.mjs

@@ -23,10 +23,20 @@ const ROUTE_FEATURES = new Map([
   ["POST /api/clear", "clear-board"],
 ]);
 
+/** Features a whole namespace of routes is: a connected tracker's reads carry
+ *  the connection's id in the path (#2178), so they are matched by prefix. The
+ *  name is the provider's, never the connection, board or issue read. */
+const ROUTE_PREFIX_FEATURES = [
+  ["GET /api/integrations/jira/", "jira"],
+  ["GET /api/integrations/github/", "github"],
+  ["GET /api/integrations/gitlab/", "gitlab"],
+];
+
 /** Note the feature a request is, if it is one. Called for requests that got
  *  past the deck's own gates. */
 export function noteRouteFeature(method, pathname) {
-  const name = ROUTE_FEATURES.get(`${method} ${pathname}`);
+  const route = `${method} ${pathname}`;
+  const name = ROUTE_FEATURES.get(route) ?? ROUTE_PREFIX_FEATURES.find(([prefix]) => route.startsWith(prefix))?.[1];
   if (name) usageDay.noteFeature(name);
 }