ccdeck 3.43.4 → 3.45.0

package/src/server/org-telemetry.mjs

@@ -0,0 +1,173 @@
+// What each Claude organization's settings send, remembered per organization.
+//
+// A Team or Enterprise organization can turn Claude Code's OpenTelemetry export
+// on for every member: the admin sets it in claude.ai, and Claude Code fetches
+// it at startup and hourly into <config dir>/remote-settings.json. There is ONE
+// such file per machine, and it describes whichever organization's login last
+// fetched it. claude-swap does not touch it on a switch, so for a while after a
+// switch it still describes the account the user just left, until a Claude
+// session on the new account fetches its own.
+//
+// So the deck cannot read an account's telemetry off the file whenever it
+// likes. It reads it when the file can be attributed, and remembers the answer
+// under the organization's uuid, for the accounts panel to show on every row of
+// that organization — the inactive ones included, which is the point: the
+// panel can say before a switch what the switch will turn on.
+//
+// WHEN THE FILE IS AN ORGANIZATION'S. Both of these, or nothing is recorded:
+//   - it was written after claude-swap last changed its store (sequence.json's
+//     `lastUpdated`), so it was fetched by the account active now;
+//   - the live login (`oauthAccount` in Claude Code's own .claude.json) belongs
+//     to the same organization as claude-swap's active account, so a /login
+//     made outside claude-swap is not mistaken for the store's account.
+// Anything else is left unknown rather than guessed: telling a user an account
+// is unmonitored because the file was another organization's is the one
+// mistake this must not make. `lastUpdated` also moves on an alias or an add,
+// which can only make an answer wait for the next hourly fetch.
+//
+// Read only when the file has changed since it was last looked at. The roster
+// is polled every fifteen seconds, the file changes at most hourly, and
+// .claude.json can be large; one stat per poll is the whole steady-state cost.
+import { mkdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { claudeConfigDir } from "./claude-dir.mjs";
+import { deckDataDir } from "./deck-home.mjs";
+import { writeFileAtomic } from "./atomic-write.mjs";
+import { radarVariables } from "./traffic-radar-config.mjs";
+
+/** The flags that put content, not only counts, into the export. */
+export const CONTENT_KEYS = Object.freeze([
+  "OTEL_LOG_USER_PROMPTS", "OTEL_LOG_ASSISTANT_RESPONSES", "OTEL_LOG_TOOL_DETAILS",
+  "OTEL_LOG_TOOL_CONTENT", "OTEL_LOG_RAW_API_BODIES",
+]);
+
+const RECORDS_FILE = "org-telemetry.json";
+
+/**
+ * What one settings file turns on, from Radar's own reading of it (so endpoint
+ * paths and credentials are already stripped): `level` is "content" when a
+ * content flag is on beside telemetry, "metrics" for telemetry alone, and "off"
+ * when the file does not enable it. Content flags without telemetry send
+ * nothing, so they do not count.
+ */
+export function telemetrySummary(variables) {
+  const on = key => variables.some(v => v.key === key && String(v.value).startsWith("Enabled"));
+  const telemetry = on("CLAUDE_CODE_ENABLE_TELEMETRY");
+  const content = telemetry ? CONTENT_KEYS.filter(on) : [];
+  const destinations = [...new Set(variables
+    .filter(v => v.key.endsWith("ENDPOINT") && /^https?:\/\//.test(v.value))
+    .map(v => v.value))];
+  return { level: !telemetry ? "off" : content.length ? "content" : "metrics", content, destinations };
+}
+
+/** Claude Code's own state file: beside the home directory, or inside a
+ *  moved config directory. */
+function claudeStatePath(env, home, platform) {
+  const { join } = platform === "win32" ? win32 : posix;
+  return env.CLAUDE_CONFIG_DIR?.trim() ? join(claudeConfigDir(env, home, platform), ".claude.json") : join(home, ".claude.json");
+}
+
+async function readJson(path, read) {
+  try { return JSON.parse(String(await read(path, "utf8")).replace(/^/, "")); } catch { return null; }
+}
+
+let _records = null;
+let _examined = null;   // mtime of the remote-settings.json last looked at
+
+/** The content flags by the words a person would use for them. The page has
+ *  its own copy in org-telemetry.ts, for the row. */
+export const CONTENT_WORDS = Object.freeze({
+  OTEL_LOG_USER_PROMPTS: "prompts",
+  OTEL_LOG_ASSISTANT_RESPONSES: "responses",
+  OTEL_LOG_TOOL_DETAILS: "tool details",
+  OTEL_LOG_TOOL_CONTENT: "tool output",
+  OTEL_LOG_RAW_API_BODIES: "full API bodies",
+});
+
+/** "a, b and c". */
+function listed(words) {
+  return words.length <= 1 ? words.join("") : `${words.slice(0, -1).join(", ")} and ${words[words.length - 1]}`;
+}
+
+/**
+ * "Acme's telemetry is on for new sessions: it sends your prompts and tool
+ * details to 192.0.2.16:4317" — what a switch to an account of this
+ * organization turns on, for the swap notice to carry. Null when nothing is
+ * known to be on: settings seen off, or never seen.
+ */
+export function telemetryClause(record) {
+  if (!record || (record.level !== "metrics" && record.level !== "content")) return null;
+  const words = record.level === "content" ? (record.content ?? []).map(k => CONTENT_WORDS[k] ?? k) : [];
+  const what = words.length ? `your ${listed(words)}` : "usage data";
+  const hosts = (record.destinations ?? []).map(d => String(d).replace(/^https?:\/\//, ""));
+  const who = record.orgName ? `${record.orgName}'s telemetry` : "Its organization's telemetry";
+  return `${who} is on for new sessions: it sends ${what}${hosts.length ? ` to ${listed(hosts)}` : ""}`;
+}
+
+/** Every organization's record as last saved, without looking at the settings
+ *  file: for a reader that has no store to pin a new reading on. */
+export async function knownOrgTelemetry({
+  env = process.env, home = homedir(), platform = process.platform,
+  dataDir = deckDataDir(platform, env, home), read = readFile,
+} = {}) {
+  if (_records == null) {
+    const { join } = platform === "win32" ? win32 : posix;
+    const saved = await readJson(join(dataDir, RECORDS_FILE), read);
+    _records = saved && typeof saved === "object" && !Array.isArray(saved) ? saved : {};
+  }
+  return _records;
+}
+
+/** Forget everything held in memory. For the suite. */
+export function resetOrgTelemetry() { _records = null; _examined = null; }
+
+/**
+ * Look at remote-settings.json if it changed, record it under its organization
+ * when it can be attributed (see the header), and answer every organization's
+ * record: uuid → `{ orgName, level, content, destinations, seenAt, writtenAt }`.
+ *
+ * `seq` is claude-swap's sequence.json as the roster already read it. Never
+ * throws: a record that could not be made is a record not made.
+ */
+export async function observeOrgTelemetry({
+  seq,
+  env = process.env, home = homedir(), platform = process.platform, now = Date.now(),
+  dataDir = deckDataDir(platform, env, home),
+  statFile = stat, read = readFile, write = writeFileAtomic, makeDir = mkdir,
+} = {}) {
+  const { join } = platform === "win32" ? win32 : posix;
+  const recordsPath = join(dataDir, RECORDS_FILE);
+  if (_records == null) {
+    const saved = await readJson(recordsPath, read);
+    _records = saved && typeof saved === "object" && !Array.isArray(saved) ? saved : {};
+  }
+  try {
+    const remote = join(claudeConfigDir(env, home, platform), "remote-settings.json");
+    const mtime = (await statFile(remote)).mtimeMs;
+    if (mtime === _examined) return _records;
+    _examined = mtime;
+
+    const active = seq?.accounts?.[String(seq?.activeAccountNumber)];
+    const switchedAt = Date.parse(seq?.lastUpdated ?? "");
+    if (!active?.organizationUuid || !Number.isFinite(switchedAt) || mtime <= switchedAt) return _records;
+    const live = (await readJson(claudeStatePath(env, home, platform), read))?.oauthAccount;
+    if (!live || live.organizationUuid !== active.organizationUuid) return _records;
+
+    const settings = await readJson(remote, read);
+    if (!settings) return _records;
+    _records = {
+      ..._records,
+      [active.organizationUuid]: {
+        orgName: live.organizationName ?? active.organizationName ?? null,
+        ...telemetrySummary(radarVariables(settings, "Cached organization settings")),
+        seenAt: now,
+        writtenAt: Math.round(mtime),
+      },
+    };
+    await makeDir(dataDir, { recursive: true })
+      .then(() => write(recordsPath, `${JSON.stringify(_records, null, 2)}\n`))
+      .catch(() => {});
+  } catch { /* no file, or one that could not be read: nothing new to say */ }
+  return _records;
+}

package/src/server/pinned-build.mjs

@@ -83,6 +83,9 @@ const PINNED_MODULES = [
   // import() from the report's route.
   "account-projects.mjs",
   "swap-log.mjs",
+  // account-watch.mjs reads what each organization's telemetry was last seen
+  // to turn on, for the swap notice, only once a tick has switched.
+  "org-telemetry.mjs",
   "lan-sync.mjs",
   // The providers' status pages (#1311), reached only from their route.
   "provider-status.mjs",
@@ -98,6 +101,11 @@ const PINNED_MODULES = [
   // (cswap-auto-choice.mjs). Already in memory through prefs-routes.mjs; named
   // here because the tick reaches it through import().
   "lan-deck.mjs",
+  // The accounts Auto-switch's own moves never land on (slotsHeldBack), which
+  // the move after removing an expired active login skips too. Already in
+  // memory through cswap-auto.mjs; named here because account-routes.mjs
+  // reaches it through import().
+  "cswap-auto-choice.mjs",
 ];
 
 let _pinned = null;

package/src/server/prefs-routes.mjs

@@ -13,6 +13,7 @@ import { heldPrefs } from "./prefs-state.mjs";
 import { applyLanPrefs, forgetReach, resetLanLoaded } from "./lan-deck.mjs";
 import { giveBackDeckFolders } from "./prefs-give-back.mjs";
 import { readBody, send } from "./http-io.mjs";
+import { noteContinueSwitchedOn } from "./stop-continue.mjs";
 
 /**
  * GET the deck's settings, and what the machine is allowing.
@@ -78,6 +79,9 @@ export async function handlePrefsWrite(req, res) {
   // to one question: is anything going to turn up. Whatever the probe said
   // before is about a deck whose sockets were down — see forgetReach.
   if (body.lan?.enabled === true) forgetReach();
+  // A stopped background session already waiting for a working login is
+  // looked at now, not at the next pass (stop-continue.mjs).
+  if (patch.continueStopped === true) noteContinueSwitchedOn();
   return send(res, 200, prefsPayload());
 }
 

package/src/server/request-gates.mjs

@@ -433,10 +433,14 @@ export const GUARDED_READS = new Set([
   "/api/tool-audit",
   "/api/tool-audit/storage",
   "/api/system/traffic-radar",
+  "/api/system/traffic-radar/settings",
   "/api/system/traffic-radar/capture",
   "/api/system/traffic-radar/capture/event",
   "/events",
   "/api/events",
+  // The ring folded to one row per session (#2183): each project's path and a
+  // standing question's own words, which is the ring's secret in fewer bytes.
+  "/api/sessions",
   "/api/claude-accounts",
   "/api/claude-accounts/login",
   "/api/browser-watch",
@@ -461,6 +465,9 @@ export const GUARDED_READS = new Set([
   "/api/ccusage/session",
   "/api/codex-usage",
   "/api/cswap-auto",
+  // Which sessions stopped, and the active account's quota reading the
+  // Continue button is gated on (stop-continue.mjs) — the quota route's class.
+  "/api/stop-continue",
   // Not a secret, and here for the other reason a read can be dangerous: it is
   // the one route where the caller names what the deck goes and fetches
   // (#1208). fm-station.mjs holds that to YouTube, but a page on another site
@@ -470,8 +477,27 @@ export const GUARDED_READS = new Set([
   "/api/fm-station",
   "/api/radio-stations",
   "/api/radio-click",
+  // The trackers this deck is connected to (#2178): the list of connections
+  // with their accounts, and below it every read a provider adds.
+  "/api/integrations",
 ]);
 
+/** Whole namespaces of guarded reads, for routes whose path carries an id —
+ *  /api/integrations/<kind>/<connId>/… (#2178). A connected tracker's boards,
+ *  issues, comments and the images the asset route signs for are the user's
+ *  work, read with the user's own token; every one of them is fetched by the
+ *  deck's own page and nothing else. A prefix rather than a list because a
+ *  provider adds its routes without touching this file, and a read it adds
+ *  must be covered from the moment it exists. */
+export const GUARDED_READ_PREFIXES = Object.freeze(["/api/integrations/"]);
+
+/** Whether a GET to `pathname` must come from the deck's page or carry the
+ *  token: listed in GUARDED_READS, or under one of GUARDED_READ_PREFIXES. */
+export function isGuardedRead(pathname) {
+  const path = String(pathname ?? "");
+  return GUARDED_READS.has(path) || GUARDED_READ_PREFIXES.some(prefix => path.startsWith(prefix));
+}
+
 export function isAuthorizedMutation(req) {
   const headers = req?.headers ?? {};
   if (presentsDeckToken(headers)) return true;

package/src/server/session-read-gate.mjs

@@ -13,7 +13,8 @@
  * A per-session read gate with a window of `ms`.
  *
  * `run(sid, read)` calls `read()` unless a read for `sid` is still in flight or
- * the last one began less than `ms` ago. The stamp is taken as the read starts,
+ * the last one began less than `ms` ago. Returns whether a read started, so
+ * a caller that needs a final snapshot can keep refused work pending. The stamp is taken as the read starts,
  * so a read that fails or finds nothing still holds the next one back for the
  * window — that is the throttle. `read` is called before `run` returns, as
  * every copy called it, and returns a promise. Whatever that rejects with is
@@ -29,15 +30,16 @@ export function sessionReadGate(ms) {
   const pending = new Set();      // sid currently being read
   return {
     run(sid, read) {
-      if (pending.has(sid)) return;
+      if (pending.has(sid)) return false;
       const now = Date.now();
       const last = lastReadAt.get(sid) ?? 0;
-      if (now - last < ms) return;
+      if (now - last < ms) return false;
       lastReadAt.set(sid, now);
       pending.add(sid);
       read()
         .catch(() => {})
         .finally(() => pending.delete(sid));
+      return true;
     },
     forget(sid) {
       lastReadAt.delete(sid);

package/src/server/session-summary.mjs

@@ -0,0 +1,281 @@
+// The sessions a deck is watching, as one row each, for `ccdeck sessions`
+// (#2183) — the question somebody on SSH asks first: which of my agents is
+// waiting on me?
+//
+// The canvas answers it from src/web/reducer.ts, which folds every event into a
+// graph of agents, tool calls and subagents. None of that is needed to say
+// which sessions exist and which one is blocked, and none of it can be imported
+// here: it is TypeScript bundled for the browser. So this is a small fold over
+// the same ring, and THE WAITING RULE IS A MIRROR of src/web/waiting-block.ts —
+// the same three `notification_type` kinds, the same events that leave a block
+// standing, the same rule for whose traffic clears one — written twice because
+// it has to be, the way block-notify.mjs mirrors sound.ts.
+// session-summary-mirror.test.ts runs both over the same events and fails the
+// day they disagree.
+//
+// Pure: envelopes in, rows out. The route that serves it is in index.mjs.
+
+/** How long a session may be silent before it is taken to be gone — the
+ *  canvas's own STALE_SESSION_MS (src/web/board-sweeps.ts), for its reasons:
+ *  long enough for a permission prompt left standing through a meeting, short
+ *  enough that this morning's closed terminals stop being listed as running. */
+export const STALE_SESSION_MS = 90 * 60_000;
+
+/** The `notification_type` values that raise a block, as the chore each one is
+ *  — waitingKind in waiting-block.ts. */
+export function waitingKind(notificationType) {
+  if (notificationType === "permission_prompt") return "permission";
+  if (notificationType === "agent_needs_input") return "asked";
+  if (notificationType === "idle_prompt") return "idle";
+  return null;
+}
+
+/** Events that are not evidence the session moved, and leave a block standing
+ *  — WAITING_KEEPERS in waiting-block.ts, which says why each one is here. */
+export const WAITING_KEEPERS = new Set([
+  "Notification", "ModelObserved", "ContextObserved", "UsageObserved",
+  "SessionNamed", "SessionRecapped", "OutputObserved", "ActivityObserved", "JobObserved",
+]);
+
+/** The transcript scans: enrichment the server reads off a session's files,
+ *  never the session's own traffic — the reducer's early returns, which stamp
+ *  no provider and prove nothing about whether the session is alive. */
+const SCANS = new Set([...WAITING_KEEPERS].filter(n => n !== "Notification"));
+
+/** Two copies of one event inside this are the wire talking twice —
+ *  HOOK_REDELIVERY_WINDOW_MS and PROMPT_REDELIVERY_WINDOW_MS in
+ *  src/web/redelivery.ts, which are the same number on purpose. */
+const REDELIVERY_MS = 2_000;
+
+/** Whose traffic an event is: the subagent it names, or null for the root's —
+ *  explicitSubagentKey in agent-attribution.ts. */
+function subagentKeyOf(p) {
+  if (p.agent_id) return p.agent_id;
+  if (p.parent_tool_use_id) return p.parent_tool_use_id;
+  return null;
+}
+
+/** Is this event evidence the human dealt with `w`? clearsWaiting in
+ *  waiting-block.ts: any traffic falsifies an idle block; a permission prompt
+ *  or a question is answered only by the root's own traffic or by the very
+ *  subagent that asked. */
+function clearsWaiting(w, p) {
+  if (w.kind === "idle") return true;
+  const key = subagentKeyOf(p);
+  if (key == null) return true;
+  return w.subagent != null && w.subagent === key;
+}
+
+/** The newest call still in flight on a session, whose payload names who is
+ *  asking — blockedCall in waiting-block.ts, minus the canvas's owner lookup:
+ *  the payload's own key is what that function reads in the end. */
+function newestInFlight(s) {
+  let newest = null;
+  for (const c of s.inFlight.values()) if (!newest || c.at > newest.at) newest = c;
+  return newest;
+}
+
+function blankSession(id, at) {
+  return {
+    id, provider: null, cwd: null, name: null, model: null,
+    startedAt: at, lastEventAt: at, recoveryLiveAt: null,
+    turn: "idle", turnSince: at, closed: false, waiting: null,
+    prompts: [], lastTurnEndAt: null,
+    inFlight: new Map(),
+  };
+}
+
+/** A prompt, filed in time order unless it is a copy of one already filed —
+ *  recordPrompt in redelivery.ts. Only the newest is ever read, as evidence. */
+function recordPrompt(s, at, text) {
+  for (let i = s.prompts.length - 1; i >= 0; i--) {
+    const prev = s.prompts[i];
+    if (prev.at < at - REDELIVERY_MS) break;
+    if (prev.text === text && prev.at <= at + REDELIVERY_MS) return;
+  }
+  let i = s.prompts.length;
+  while (i > 0 && s.prompts[i - 1].at > at) i--;
+  s.prompts.splice(i, 0, { at, text });
+}
+
+/**
+ * `Stop` or `SessionEnd`: the root's turn is over — applyTurnEnd in
+ * session-lifecycle.ts, the parts of it a row can show.
+ *
+ * Refused whole when it is out of order (a boundary older than the prompt that
+ * opened the turn now running) or a copy of the ending already recorded, for
+ * the reducer's reason (#1022): a replayed `Stop` landing in the next turn
+ * would call a working session "your turn". And the calls it settles are the
+ * ROOT's only, and none on Codex: a background subagent outlives the turn that
+ * dispatched it, and its call — and a permission prompt that call raises — is
+ * still running after the root's `Stop`.
+ */
+function endTurn(s, name, at) {
+  const newest = s.prompts[s.prompts.length - 1];
+  const evidenceAt = newest && newest.at > s.startedAt ? newest.at : s.startedAt;
+  if (at < evidenceAt) return;
+  if (s.lastTurnEndAt != null && evidenceAt > s.lastTurnEndAt && at <= s.lastTurnEndAt + REDELIVERY_MS) return;
+  s.turn = "idle"; s.turnSince = at;
+  s.lastTurnEndAt = at;
+  if (s.provider !== "codex") {
+    for (const [id, call] of s.inFlight) if (call.key == null) s.inFlight.delete(id);
+  }
+  if (name === "SessionEnd") s.closed = true;
+}
+
+/**
+ * The deck's recovery scan, which finds a session already running when it
+ * starts — recoverSession in session-recovery.ts. Not the session's traffic:
+ * it leaves a standing block standing (after a restart the replay has put the
+ * session's prompt back up, and the scan arrives every second and a half),
+ * and a snapshot older than the session's own newest event says nothing.
+ */
+function recover(sessions, p, at) {
+  const id = p.session_id;
+  if ((p.provider !== "codex" && p.provider !== "claude") || typeof id !== "string" || !id) return;
+  const s = sessions.get(id);
+  if (s?.provider && s.provider !== p.provider) return;
+  if (s && Number.isFinite(p.snapshot_observed_at) && (s.recoveryLiveAt ?? s.lastEventAt ?? 0) >= p.snapshot_observed_at) return;
+  if (p.recovery_active === false) {
+    if (s) endTurn(s, p.recovery_session_closed === true ? "SessionEnd" : "Stop", at);
+    return;
+  }
+  const r = s ?? blankSession(id, at);
+  sessions.set(id, r);
+  r.recoveryLiveAt ??= s?.lastEventAt ?? 0;
+  r.provider = p.provider;
+  r.closed = false;
+  if (r.turn !== "working") { r.turn = "working"; r.turnSince = at; }
+  r.lastEventAt = at;
+  if (!r.cwd && typeof p.cwd === "string" && p.cwd) r.cwd = p.cwd;
+  if (typeof p.model === "string" && p.model) r.model = p.model;
+  if (!s && Number.isFinite(p.turn_started_at) && p.turn_started_at <= at) r.startedAt = p.turn_started_at;
+  if (typeof p.prompt === "string" && p.prompt && r.prompts.at(-1)?.text !== p.prompt) r.prompts.push({ at, text: p.prompt });
+}
+
+/**
+ * Every session in the ring, folded.
+ *
+ * `envelopes` are the ring's own `{ seq, receivedAt, payload }`, oldest first.
+ * Each row says what the session is doing in one word:
+ *
+ *   waiting   a permission prompt or a question is standing — the alarm the
+ *             topbar chip counts (isAlarming in ambient-counts.ts)
+ *   working   a turn is running
+ *   idle      the turn ended and the input box is waiting, which is not an
+ *             alarm (#348) but is "your turn"
+ *   ended     SessionEnd, or nothing heard for STALE_SESSION_MS
+ */
+export function summarizeSessions(envelopes, { now = Date.now(), staleMs = STALE_SESSION_MS } = {}) {
+  let sessions = new Map();
+  for (const env of Array.isArray(envelopes) ? envelopes : []) {
+    const p = env?.payload;
+    if (!p || typeof p !== "object") continue;
+    const name = p.hook_event_name ?? "Unknown";
+    // POST /api/clear wipes the canvas with this; it wipes the list too.
+    if (name === "__clear") { sessions = new Map(); continue; }
+    const at = Number(env.receivedAt) || now;
+    if (name === "ClaudeSessionRecovered" || name === "CodexSessionRecovered") { recover(sessions, p, at); continue; }
+    const id = typeof p.session_id === "string" && p.session_id ? p.session_id : null;
+    if (!id) continue;
+    let s = sessions.get(id);
+    if (!s) { s = blankSession(id, at); sessions.set(id, s); }
+    // A Codex child thread named by its parent: a session of its own, and
+    // nothing the human did — linkCodexThread, which returns before any block
+    // is read.
+    if (name === "CodexThreadLinked") { if (p.provider === "codex") s.provider ??= "codex"; continue; }
+
+    if (!WAITING_KEEPERS.has(name) && s.waiting && clearsWaiting(s.waiting, p)) s.waiting = null;
+    // A background job's file is not always the session talking — see the
+    // reducer's note at noteSessionHeard.
+    if (name !== "JobObserved" && at > s.lastEventAt) s.lastEventAt = at;
+    if (!SCANS.has(name)) {
+      // The provider, from the session's first own event; a scan stamps none.
+      s.provider ??= p.provider === "codex" ? "codex" : "claude";
+      if (at >= (s.recoveryLiveAt ?? 0)) s.recoveryLiveAt = at;
+    }
+    if (!s.cwd && typeof p.cwd === "string" && p.cwd) s.cwd = p.cwd;
+    if (typeof p.model === "string" && p.model && !subagentKeyOf(p)) s.model = p.model;
+    if (name === "SessionNamed") s.name = p.sessionTitle ?? p.sessionName ?? s.name;
+
+    switch (name) {
+      case "SessionStart":
+        s.closed = false;
+        // The earliest beginning heard of, as applySessionStart keeps it.
+        s.startedAt = Math.min(s.startedAt, at);
+        if (s.turn !== "working") { s.turn = "idle"; s.turnSince = at; }
+        break;
+      case "UserPromptSubmit": {
+        s.closed = false;
+        s.turn = "working"; s.turnSince = at;
+        const text = typeof p.prompt === "string" ? p.prompt : typeof p.message === "string" ? p.message : "";
+        if (text) recordPrompt(s, at, text);
+        break;
+      }
+      case "Stop":
+      case "SessionEnd":
+        endTurn(s, name, at);
+        break;
+      case "PreToolUse":
+        if (p.tool_use_id) s.inFlight.set(p.tool_use_id, { at, key: subagentKeyOf(p), tool: p.tool_name ?? null });
+        if (s.turn !== "working") { s.turn = "working"; s.turnSince = at; }
+        break;
+      case "PostToolUse":
+      case "PostToolUseFailure":
+        if (p.tool_use_id) s.inFlight.delete(p.tool_use_id);
+        break;
+      case "Notification": {
+        const kind = waitingKind(p.notification_type);
+        if (!kind) break;
+        const message = typeof p.message === "string" ? p.message : "";
+        const prev = s.waiting;
+        if (prev && prev.kind === kind && prev.message === message) {
+          prev.since = Math.min(prev.since, at);
+          break;
+        }
+        const block = { kind, message, since: at, subagent: null, tool: null };
+        if (kind === "permission") {
+          const call = newestInFlight(s);
+          if (call?.key) block.subagent = call.key;
+          // BLOCK_GUESS_WINDOW_MS: only a call that started moments before the
+          // prompt is printed as the thing being asked about.
+          if (call?.tool && at - call.at <= 30_000 && call.at <= at) block.tool = call.tool;
+        }
+        s.waiting = block;
+        break;
+      }
+      default:
+        break;
+    }
+  }
+
+  const rows = [];
+  for (const s of sessions.values()) {
+    const gone = s.closed || now - s.lastEventAt > staleMs;
+    const alarm = !gone && s.waiting && s.waiting.kind !== "idle";
+    const state = gone ? "ended" : alarm ? "waiting" : s.turn === "working" && !s.waiting ? "working" : "idle";
+    const since = state === "waiting" ? s.waiting.since
+      : state === "idle" && s.waiting ? Math.min(s.waiting.since, s.turnSince)
+      : state === "ended" ? s.lastEventAt
+      : s.turnSince;
+    rows.push({
+      id: s.id,
+      provider: s.provider ?? "claude",
+      cwd: s.cwd,
+      project: s.cwd ? s.cwd.split(/[\\/]/).filter(Boolean).pop() ?? s.cwd : null,
+      name: s.name,
+      model: s.model,
+      state,
+      since,
+      startedAt: s.startedAt,
+      lastEventAt: s.lastEventAt,
+      waiting: gone || !s.waiting ? null : { kind: s.waiting.kind, message: s.waiting.message, since: s.waiting.since, tool: s.waiting.tool },
+    });
+  }
+  // The ones waiting on a human first, longest-blocked first — the order the
+  // topbar's own click visits them (blockedSessions) — then running, then the
+  // idle and the ended, most recently heard first.
+  const rank = { waiting: 0, working: 1, idle: 2, ended: 3 };
+  return rows.sort((a, b) => rank[a.state] - rank[b.state]
+    || (a.state === "waiting" ? a.since - b.since : b.lastEventAt - a.lastEventAt));
+}