ccdeck 3.43.4 → 3.45.0

package/dist/web/assets/{index-Ch4ks76J.js → index-r8Ymr47Q.js}

@@ -1 +1 @@
-import"./app-DBsNB-2y.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const e of document.querySelectorAll('link[rel="modulepreload"]'))i(e);new MutationObserver(e=>{for(const r of e)if(r.type==="childList")for(const o of r.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&i(o)}).observe(document,{childList:!0,subtree:!0});function s(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),e.crossOrigin==="use-credentials"?r.credentials="include":e.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function i(e){if(e.ep)return;e.ep=!0;const r=s(e);fetch(e.href,r)}})();
+import"./app-BW3NYUYB.js";(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const e of document.querySelectorAll('link[rel="modulepreload"]'))i(e);new MutationObserver(e=>{for(const r of e)if(r.type==="childList")for(const o of r.addedNodes)o.tagName==="LINK"&&o.rel==="modulepreload"&&i(o)}).observe(document,{childList:!0,subtree:!0});function s(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),e.crossOrigin==="use-credentials"?r.credentials="include":e.crossOrigin==="anonymous"?r.credentials="omit":r.credentials="same-origin",r}function i(e){if(e.ep)return;e.ep=!0;const r=s(e);fetch(e.href,r)}})();

package/dist/web/index.html

@@ -77,9 +77,9 @@
         document.documentElement.setAttribute("data-density", density === "tightest" || density === "tighter" || density === "compact" || density === "comfortable" ? density : "default");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-Ch4ks76J.js"></script>
-    <link rel="modulepreload" crossorigin href="/assets/app-DBsNB-2y.js">
-    <link rel="stylesheet" crossorigin href="/assets/app-BiJ8TfUl.css">
+    <script type="module" crossorigin src="/assets/index-r8Ymr47Q.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/app-BW3NYUYB.js">
+    <link rel="stylesheet" crossorigin href="/assets/app-C5RY_wZ4.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.43.4",
+  "version": "3.45.0",
   "description": "Local dashboard for Claude Code and Codex CLI sessions: which Claude Code session needs input, every tool call and Claude Code subagent live, token cost and quota, several Claude accounts. Run npx ccdeck.",
   "type": "module",
   "bin": {
@@ -82,6 +82,7 @@
     "esbuild": "0.25.12",
     "hls.js": "^1.7.3",
     "hpack.js": "2.1.6",
+    "json-edit-react": "2.0.4",
     "long": "5.3.2",
     "protobufjs": "8.8.0",
     "react": "^18.3.1",

package/release-notes.json

@@ -80,6 +80,58 @@
     "3.43.1",
     "3.43.3"
   ],
+  "3.45.0": [
+    {
+      "title": "🔗 Read-only Jira, GitHub and GitLab panels beside your agents",
+      "body": "Settings › Integrations connects Jira (Cloud, Server or Data Center), GitHub, and GitLab.com or your own GitLab, each with a token, and a control on the left stripe opens its panel: a Jira board's backlog in Jira's own order, or a project's branches, pull or merge requests, pipelines and issues, with the item beside the list. The panels only read: they never comment, merge, re-run a job or change an issue. The token stays on this machine, in a file only you can read, and goes only to that connection's own API. Nothing is read until you connect a tracker, and then only while its panel is open."
+    },
+    {
+      "title": "📤 Each account says what its organization's telemetry sends",
+      "body": "A Team or Enterprise organization can turn on Claude Code's telemetry for every member, and Claude Code applies it without asking. Each account of such an organization now carries a line under its name: “Telemetry · usage data”, or “Telemetry · prompts, tool details” in the warning colour when your prompts and tool details are sent too. Its tooltip names the organization and where the data goes. After a switch, Auto-switch's notification and the row's “Now active” note say it too. The deck changes nothing; it learns what the organization turns on from a Claude Code session run on one of its accounts, and until then that account shows no line."
+    },
+    {
+      "title": "⚠️ A warning when a paired deck is on the same Claude login",
+      "body": "A Claude login renews once, so when two machines use one copied login, the one that renews second is signed out. When a paired deck on Local network says it is on the login this deck is using, the live account's row now says “Also active on” and names that deck, with what to do: use a different account on one of the machines, or sign in on each one separately. A switch onto such a login says so too, and so does one desktop notification per incident, “Login active on another deck” in Settings › Notifications, which is on by default."
+    },
+    {
+      "title": "📱 A phone opens one panel at most when the deck loads",
+      "body": "On a window 640 px wide or less, a reload used to open Accounts, Usage and the machine panel on top of each other, with none of the board in sight. It now opens at most one of them, preferring Usage over the machine panel, and Accounts and the session list open from the dock. A wider window loads exactly as before, and nothing you chose is forgotten."
+    }
+  ],
+  "3.44.0": [
+    {
+      "title": "⛔ A turn that stops on an error now shows as stopped",
+      "body": "When Claude Code ends a turn on an API error, such as an expired login or a usage limit, it sends StopFailure instead of Stop. The deck now adds StopFailure to the hooks it writes in Claude Code's settings.json, but only when every Claude Code it finds is 2.1.78 or newer; with an older one, or one whose version it cannot read, nothing changes. The card then says “Stopped · login expired”, “Stopped · usage limit” or “Stopped · API error”, and the sessions one expired login stops together arrive as one notification that names them. Each needs a “continue” once a working login is active."
+    },
+    {
+      "title": "🔑 Auto-switch leaves an expired login, and nothing switches onto one",
+      "body": "When Claude Code has signed a login out and claude-swap's saved copy is dead too, Auto-switch now moves to another account under your home and weekly-reset rules, and its notification says why. Neither Auto-switch nor Switch moves onto a login that is already known to be expired: that account's row says its login expired, with Sign in again, and nothing moves."
+    },
+    {
+      "title": "💲 Usage totals say how complete they are",
+      "body": "The usage headline is always shown now, by the rule History and the model table already used: an exact total when every cost is known, a known $0 included; the known part with “+” when some tokens could not be priced; and “not priced”, never a bare $0, when no cost is known. Sessions whose cost is a known zero show it too."
+    },
+    {
+      "title": "📡 Radar: a resizable inspector, prompt previews and a JSON view",
+      "body": "Radar's inspector can be resized and shows prompt previews, highlights and each record as a JSON tree, beside the File view. Settings › Radar has a new Monitor automatically switch. It is off, so Radar still watches only after you press Start, as before; turn it on to have the deck start monitoring by itself."
+    },
+    {
+      "title": "🧰 Tool activity opens over the deck, with the first tool's details open",
+      "body": "Tool activity now opens as a dialog over the deck instead of a page of its own, with the first tool selected and its details beside the list. Escape closes the details first, then the dialog. On a phone the details open as a sheet."
+    },
+    {
+      "title": "🧩 Tool activity counts skills, and the slash commands you type if you opt in",
+      "body": "Tool activity's Skills tab ranks the skills your Claude Code and Codex agents used. Counting the slash commands you type needs Claude Code's UserPromptExpansion hook, which the deck adds to settings.json only when you start it with AGENTS_DECK_SKILL_HOOK=1 and every Claude Code it finds is 2.1.116 or newer. Without that variable nothing in settings.json changes."
+    },
+    {
+      "title": "▶️ Continue a background session that stopped",
+      "body": "A background session that stopped on an error has a Continue button on its card and panel: the deck stops it if Claude Code still lists it, then resumes it in its own folder with “Continue from where you left off.” Continue stopped background sessions, in Settings › General, presses it for you once per stop. It is off until you turn it on."
+    },
+    {
+      "title": "⌨️ ccdeck commands for your terminal",
+      "body": "ccdeck accounts, ccdeck switch, ccdeck usage, ccdeck sessions and ccdeck open work from any terminal. ccdeck switch --best goes where Auto-switch would, and every switch follows the deck's own rules. Over SSH, ccdeck open prints the line that opens the deck on your own computer. Each command takes --json for scripts."
+    }
+  ],
   "3.43.4": [
     {
       "title": "🔐 Local network no longer sends the login a deck is signed in to",

package/src/server/account-notify.mjs

@@ -1,4 +1,4 @@
-// Three notifications about the accounts the deck is on, and the rules for when
+// Five notifications about the accounts the deck is on, and the rules for when
 // each is said.
 //
 //   SWAP       the deck's own auto-switch tick moved the live Claude account.
@@ -8,6 +8,16 @@
 //   THRESHOLD  a quota window of the account a provider is LIVE on reached 90%,
 //              and once more at 100%.
 //   RESET      a window of the live account that had reached 90% is new again.
+//   STOPPED    Claude Code sessions ended a turn on an expired login or a usage
+//              limit (StopFailure, stop-failure.mjs). Said once per incident —
+//              every session on the machine shares the login, so they stop
+//              together — with how many stopped and that each needs a
+//              "continue" once a working login is active.
+//   ELSEWHERE  the Claude account this deck is on is the one a paired deck says
+//              it is on too (#2192). Said once per incident — from the moment
+//              both are on it until one of them is not — because the next
+//              renewal signs one of the two machines out, and nothing on the
+//              desktop says so before it does. See lan-elsewhere.mjs.
 //
 // SPARSE BY CONSTRUCTION. Each window is a record keyed by provider, account
 // and window, holding the reset instant it is about and the levels already said
@@ -26,9 +36,18 @@
 // never saw because the tick saw it first is written down from the tick, so the
 // account does not announce it later when it is live again.
 //
+// ONE INCIDENT, ONE NOTIFICATION, by the same rule. A login that dies makes the
+// deck run a tick at once (cswap-auto-loop.mjs `tickSoon`), so while the loop
+// and the swap switch are on the stopped notice waits for the first tick that
+// began after the incident did: a switch says both in one notification —
+// "Switched to … · 3 sessions stopped, type “continue” in each" — and anything
+// else lets the stopped notice go on its own.
+//
 // Pure apart from the factory at the bottom, whose clock, disk and OS call are
 // injected — the shape block-notify.mjs uses, for the reason it gives: what the
 // suite cannot run is what drifts.
+import { switchCanCure } from "./stop-failure.mjs";
+import { deckList } from "./lan-elsewhere.mjs";
 
 /** The levels a window is announced at, lowest first. */
 export const LEVELS = Object.freeze([90, 100]);
@@ -296,6 +315,11 @@ export function swapNotice({ toName, fromName, used, threshold, trigger = null,
   const verb = trigger === "home" ? "Back on" : "Switched to";
   if (!fromName) return { who: SWAP_WHO, body: `${verb} ${to}` };
   const from = cut(fromName, NAME_MAX);
+  // The deck's own failover (autoswitch-failover.mjs) moved for one reason
+  // only, and it is the one the user has to act on: sign in again.
+  if (trigger === "login-expired") {
+    return { who: SWAP_WHO, body: `Switched to ${to} · ${from}'s login expired, sign in again to use it` };
+  }
   if (used != null && used >= 100) return { who: SWAP_WHO, body: `${verb} ${to} · ${from} reached 100%` };
   if (used != null && typeof threshold === "number" && used >= threshold) {
     return { who: SWAP_WHO, body: `${verb} ${to} · ${from} reached ${pctLabel(threshold)}%` };
@@ -307,6 +331,101 @@ export function swapNotice({ toName, fromName, used, threshold, trigger = null,
   return { who: SWAP_WHO, body: `Switched to ${to} from ${from}` };
 }
 
+/** How long a stop gathers the rest of its incident before it is said, when no
+ *  tick is coming to say it with: sessions sharing a login stop within seconds
+ *  of each other, each at its own next request. */
+export const STOP_GATHER_MS = 5_000;
+
+/** The longest a stopped notice waits for a tick to say whether it switched.
+ *  The tick is run at once, and one is allowed two minutes. */
+export const STOP_HOLD_MS = 150_000;
+
+/** A stop this long after the incident's newest is a new incident. Long enough
+ *  for the stragglers — a session four minutes into a test run stops when the
+ *  run finishes — and short against a login that dies again tomorrow. */
+export const STOP_INCIDENT_MS = 10 * 60_000;
+
+/** How many sessions an incident remembers. `POST /api/event` takes a post
+ *  without the deck's token, so the count of ids is bounded like every other
+ *  set fed from it. */
+export const STOP_SESSIONS_MAX = 256;
+
+/** How many sessions a notice names before it counts the rest. */
+export const STOP_NAMES_SHOWN = 3;
+
+/** "vcrm-core", "vcrm-core and api", "vcrm-core, api, web and 2 more". */
+function nameList(names, count) {
+  const shown = names.slice(0, STOP_NAMES_SHOWN).map(n => cut(n, NAME_MAX));
+  const more = count - shown.length;
+  if (more > 0) return `${shown.join(", ")} and ${more} more`;
+  if (shown.length <= 1) return shown[0] ?? "";
+  return `${shown.slice(0, -1).join(", ")} and ${shown[shown.length - 1]}`;
+}
+
+/** "3 sessions stopped" / "1 session stopped". */
+function stoppedCount(count) {
+  return `${count} ${count === 1 ? "session" : "sessions"} stopped`;
+}
+
+/**
+ * "3 Claude sessions stopped", "Login expired · vcrm-core, api and web. Type
+ * “continue” in each once a working login is active."
+ *
+ * `kinds` is the set the incident's stops were: "login", "usage-limit" or
+ * both. What to do comes last because it is the part a person acts on, and it
+ * is the one Claude Code cannot do itself: a running session picks up a
+ * working login on its own, but the turn that failed is not run again.
+ */
+export function stoppedNotice({ names = [], count, kinds }) {
+  const login = kinds.has("login"), limit = kinds.has("usage-limit");
+  const what = login && limit ? "Login expired or usage limit reached" : limit ? "Usage limit reached" : "Login expired";
+  const when = login && limit
+    ? "once a working account is active"
+    : limit ? "once the limit resets or another account is active" : "once a working login is active";
+  const where = nameList(names, count);
+  const each = count === 1 ? "it" : "each";
+  return {
+    who: `${count} Claude ${count === 1 ? "session" : "sessions"} stopped`,
+    body: `${what}${where ? ` · ${where}` : ""}. Type “continue” in ${each} ${when}.`,
+  };
+}
+
+/** A swap notice that also carries the incident it cured: one notification for
+ *  one incident, and the switch is what made "continue" worth typing. */
+export function withStopped(notice, count) {
+  return { ...notice, body: `${notice.body} · ${stoppedCount(count)}, type “continue” in ${count === 1 ? "it" : "each"}` };
+}
+
+/** How long one stuck login is left unsaid after it has been said once. */
+export const STUCK_REPEAT_MS = 6 * 60 * 60 * 1000;
+
+/**
+ * "Claude auto-switch", "work@x.com's login expired · no other account is ready
+ * to switch to". The tick the failover could not finish: the user is on a dead
+ * login, and only a sign-in or another account will get them off it.
+ */
+export function stuckNotice({ fromName }) {
+  const from = fromName ? cut(fromName, NAME_MAX) : "The active account";
+  return { who: SWAP_WHO, body: `${from}'s login expired · no other account is ready to switch to` };
+}
+
+/**
+ * "Claude · work@x.com", "Also active on iMac. When one machine renews this
+ * login, the other is signed out — use a different account on one of them."
+ *
+ * The decks by the names Local network's list gives them. The reason is the
+ * sentence, because it is the whole of why this is worth a notification: the
+ * same account on two machines is ordinary, one copied login live on two is
+ * what breaks, and the remedy is one press on either machine.
+ */
+export function elsewhereNotice({ accountName, decks }) {
+  return {
+    who: whoFor("claude", accountName),
+    body: `Also active on ${cut(deckList(decks), NAME_MAX)}. When one machine renews this login, the other is `
+      + "signed out — use a different account on one of them.",
+  };
+}
+
 /** The records, as read back from disk: anything that is not one is dropped,
  *  and so is one nobody has read for RECORD_KEEP_MS. */
 export function normaliseRecords(raw, now) {
@@ -339,8 +458,9 @@ function laterUnref(fn, ms) {
  *
  *   notify(title, body, meta)  the OS call — injected, never awaited by a poll
  *                              or a tick, and its failure goes to `onError`
- *   settings()                 `{ swap, quota, reset }`, asked per decision, so
- *                              a switch pressed mid-run takes effect at once
+ *   settings()                 `{ swap, quota, reset, stopped, elsewhere }`,
+ *                              asked per decision, so a switch pressed mid-run
+ *                              takes effect at once
  *   load() / save(records)     the disk, both best effort
  *   now, later                 the clock and the hold timer, for the suite
  *
@@ -362,8 +482,18 @@ export function createAccountNotifier({
   let policy = null;
   /** Threshold notices held for a tick, by record key. */
   const held = new Map();
+  /** The account whose ELSEWHERE incident is open — this deck and another on
+   *  it — and therefore already said, or null. One at a time, because this
+   *  deck is on one account at a time. Kept in memory: a restart in the middle
+   *  of an incident says it once more, which is a restart's news as well. */
+  let elsewhereOpen = null;
   let holdTimer = null;
   let saving = Promise.resolve();
+  /** The stop incident being gathered or held, or the one already said while
+   *  it is still running: `{ firstAt, lastAt, ids, names, kinds, said, held,
+   *  armed, timer }`. In memory — an incident is minutes long, and a deck restarted
+   *  inside one has lost the sessions it would have counted. */
+  let incident = null;
 
   const persist = () => {
     const snapshot = JSON.parse(JSON.stringify(records));
@@ -381,6 +511,10 @@ export function createAccountNotifier({
 
   const keyOf = (provider, accountKey, windowId) => `${provider}|${accountKey}|${windowId}`;
 
+  /** When each stuck login was last said, by account. In memory: a restart may
+   *  say one once more, and every tick after it says nothing for a while. */
+  const stuckSaid = new Map();
+
   /** Write `levels` down as said for the window a held notice was about, if the
    *  record is still about that window. */
   const markSaid = (entry, levels) => {
@@ -416,6 +550,55 @@ export function createAccountNotifier({
     }, Math.max(0, due - now()));
   };
 
+  /** Say the incident, once, unless its switch is off by now. */
+  const sayIncident = () => {
+    const inc = incident;
+    if (!inc || inc.said) return;
+    inc.said = true;
+    if (inc.timer) { clearTimeout(inc.timer); inc.timer = null; }
+    if (settings().stopped) say(stoppedNotice({ names: inc.names, count: inc.ids.size, kinds: inc.kinds }));
+  };
+
+  /**
+   * A session's turn ended on an error (StopFailure). Only the two a working
+   * login cures are an incident; they gather into one, and the first is what
+   * arms its notice — held for the tick when a tick will say what it did, and
+   * said after STOP_GATHER_MS otherwise. Every later stop of the incident is
+   * counted and says nothing: the cards show each one.
+   */
+  function stopped({ sessionId, who, kind, at = now() } = {}) {
+    try {
+      if (!switchCanCure(kind) || typeof sessionId !== "string" || !sessionId) return;
+      if (incident && at - incident.lastAt > STOP_INCIDENT_MS) {
+        if (incident.timer) clearTimeout(incident.timer);
+        incident = null;
+      }
+      if (!incident) {
+        incident = { firstAt: at, lastAt: at, ids: new Set(), names: [], kinds: new Set(), said: false, held: false, armed: false, timer: null };
+      }
+      const inc = incident;
+      inc.lastAt = Math.max(inc.lastAt, at);
+      inc.kinds.add(kind);
+      if (!inc.ids.has(sessionId) && inc.ids.size < STOP_SESSIONS_MAX) {
+        inc.ids.add(sessionId);
+        const name = typeof who === "string" && who ? who : sessionId.slice(0, 8);
+        if (!inc.names.includes(name)) inc.names.push(name);
+      }
+      if (inc.said || inc.armed) return;
+      inc.armed = true;
+      inc.held = autoOn && settings().swap;
+      inc.timer = later(() => { inc.timer = null; if (incident === inc) sayIncident(); }, inc.held ? STOP_HOLD_MS : STOP_GATHER_MS);
+    } catch (err) {
+      onError?.(err);
+    }
+  }
+
+  /** The incident a finished tick answers for: one still held, and begun no
+   *  later than the tick — a tick that started before the login died says
+   *  nothing about it. */
+  const incidentFor = startedAt =>
+    incident && !incident.said && incident.held && (startedAt == null || startedAt >= incident.firstAt) ? incident : null;
+
   /** Should a threshold notice for this window wait for the next tick? */
   const holdFor = (provider, level) =>
     provider === "claude" && autoOn && settings().swap && (policy == null || level >= policy);
@@ -460,19 +643,52 @@ export function createAccountNotifier({
    *
    * `accounts` is claude-swap's roster as sequence.json has it — number to
    * `{ email, organizationUuid, alias }` — read after the tick, for the names
-   * and the keys of the two accounts a switch moved between.
+   * and the keys of the two accounts a switch moved between. `startedAt` is
+   * when the tick began, which decides whether it can answer for a stop.
+   *
+   * `telemetryOf`, when given, answers what an organization's telemetry
+   * settings turn on, as one sentence or null (org-telemetry.mjs's
+   * telemetryClause): the swap notice carries it for the account it moved to,
+   * because an unattended switch is exactly when nobody saw it coming.
    */
-  async function tick(result, accounts) {
+  async function tick(result, accounts, { startedAt = null, telemetryOf = null } = {}) {
     try {
       await ready;
       if (!result || typeof result !== "object") return;
       if (typeof result.threshold === "number" && Number.isFinite(result.threshold)) policy = result.threshold;
+      // A tick that did not switch lets a held stop go now, a cooldown
+      // included: the sessions are stopped already, and minutes is too long to
+      // wait to say so for a switch that may come.
+      const inc = incidentFor(startedAt);
+      // On a dead login with nowhere to go, said once and then left alone:
+      // the failover asks again every tick, and the answer will not change
+      // until somebody signs in.
+      const stuck = !result.switched && result.event === "no-switch" && result.reason === "login-expired" && result.stuck === true;
+      const stuckFrom = stuck ? accountOfRef(result.from, accounts) : null;
+      const stuckKey = stuck ? stuckFrom?.key ?? String(result.from?.number ?? "") : null;
+      const sayStuck = stuck && settings().swap && !(now() - (stuckSaid.get(stuckKey) ?? -Infinity) < STUCK_REPEAT_MS);
+      // The stuck notice carries the incident it explains, as a switch does:
+      // one notification for one dead login.
+      if (inc && !(result.switched && settings().swap) && !sayStuck) sayIncident();
       if (!result.switched) {
         // A cooldown is the one answer that says a switch is still coming.
         if (result.event === "no-switch" && result.reason === "cooldown") return;
         release([...held.values()]);
+        if (sayStuck) {
+          stuckSaid.set(stuckKey, now());
+          const notice = stuckNotice({ fromName: stuckFrom?.name ?? null });
+          const told = inc && incident === inc && !inc.said ? inc : null;
+          if (told) {
+            told.said = true;
+            if (told.timer) { clearTimeout(told.timer); told.timer = null; }
+          }
+          say(told && settings().stopped ? { ...notice, body: `${notice.body} · ${stoppedCount(told.ids.size)}` } : notice);
+        }
         return;
       }
+      if (result.trigger === "login-expired") {
+        stuckSaid.delete(accountOfRef(result.from, accounts)?.key ?? String(result.from?.number ?? ""));
+      }
       const at = now();
       const s = settings();
       const from = accountOfRef(result.from, accounts);
@@ -491,11 +707,24 @@ export function createAccountNotifier({
       if (from?.key) carryFromPoll(result, from, at, !s.swap);
       release([...held.values()]);
       if (s.swap) {
-        say(swapNotice({
+        const notice = swapNotice({
           toName: to?.name ?? null, fromName: from?.name ?? null,
           used: usedBefore(result, result.from?.number), threshold: result.threshold,
           trigger: result.trigger ?? null, resetAt: result.resetAt ?? null, now: at,
-        }));
+        });
+        // The incident this switch cured, said with it — and said, so its own
+        // notice does not follow.
+        const cured = inc && incident === inc && !inc.said ? inc : null;
+        if (cured) {
+          cured.said = true;
+          if (cured.timer) { clearTimeout(cured.timer); cured.timer = null; }
+        }
+        const told = cured && s.stopped ? withStopped(notice, cured.ids.size) : notice;
+        // Only for an account the store and the tick agree on: an organization
+        // read off the wrong slot would put another company's policy on it.
+        const toOrg = to?.key ? accounts?.[String(result.to?.number)]?.organizationUuid : null;
+        const telemetry = toOrg && telemetryOf ? telemetryOf(toOrg) : null;
+        say(telemetry ? { ...told, body: `${told.body}\n${telemetry}` } : told);
       }
       await persist();
     } catch (err) {
@@ -530,18 +759,48 @@ export function createAccountNotifier({
     }
   }
 
+  /**
+   * What Local network says about the account this deck is on: `account` is
+   * `{ key, name }`, or null when this deck is on none, and `decks` the paired
+   * decks that say they are on it too, by name.
+   *
+   * ONCE PER INCIDENT. The incident opens when both are on it, is said then —
+   * if the switch is on at that moment — and closes when either moves off it
+   * or the other deck stops saying so (lan-elsewhere.mjs holds a deck's word
+   * for five minutes, which is what keeps a dropped round from closing it). A
+   * new one is news again; the same one, every minute, is not.
+   */
+  async function elsewhere(account, decks) {
+    try {
+      await ready;
+      const key = account?.key && Array.isArray(decks) && decks.length > 0 ? account.key : null;
+      if (key === elsewhereOpen) return;
+      elsewhereOpen = key;
+      if (key && settings().elsewhere) say(elsewhereNotice({ accountName: account.name, decks }));
+    } catch (err) {
+      onError?.(err);
+    }
+  }
+
   return {
     ready,
     observe,
     tick,
+    stopped,
+    elsewhere,
     /** The loop was switched on or off. Off, nothing will carry what is held. */
     autoSwitch(on) {
       autoOn = on === true;
-      if (!autoOn) release([...held.values()]);
+      if (!autoOn) {
+        release([...held.values()]);
+        if (incident?.held && !incident.said) sayIncident();
+      }
     },
-    /** For the suite: the records as they stand, and what is held. */
+    /** For the suite: the records as they stand, what is held, and the stop
+     *  incident. */
     records: () => records,
     held: () => [...held.values()],
+    incident: () => incident,
     settled: () => saving,
   };
 }

package/src/server/account-pick.mjs

@@ -0,0 +1,160 @@
+// Which account a command line means (#2183): `ccdeck switch 2`, `ccdeck switch
+// work`, `ccdeck switch alice@`, `ccdeck switch --best`.
+//
+// Pure — roster rows in, a verdict out — because both halves are rules a person
+// leans on without looking, and a rule nobody can run in a test is the one that
+// drifts. The rows are the roster's own (claude-accounts.mjs rosterRow), read
+// either from a running deck or from claude-swap's store in this process.
+import { oneLine } from "./cli-lines.mjs";
+// Auto-switch's own chooser (#2200) and the key it names accounts by. Both are
+// pure and import nothing that starts anything.
+import { chooseAccount, readingCurrent, usedOf } from "./account-choice.mjs";
+import { accountKey } from "./lan-copies.mjs";
+
+/**
+ * The account `query` names, as `{ account }`, or why there is none: `{ none }`
+ * for a name nothing matches, `{ ambiguous: [rows] }` for one several do.
+ *
+ * In the order a person means them. A whole number is a slot, and only a slot —
+ * `2` is never the second account in the list, because the list's order is the
+ * rotation's and the slot is what `cswap` and the panel both print. Then an
+ * exact email or alias, case-insensitive. Then a fragment of either, which is
+ * what `alice` or `@corp` is, accepted only when it narrows to one account: a
+ * switch that guessed between two would move the live login of every running
+ * session on a coin toss.
+ */
+export function resolveAccount(accounts, query) {
+  const rows = Array.isArray(accounts) ? accounts : [];
+  const q = String(query ?? "").trim();
+  if (!q) return { none: true };
+  if (/^\d+$/.test(q)) {
+    const hit = rows.find(a => a.num === Number(q));
+    return hit ? { account: hit } : { none: true };
+  }
+  const lower = q.toLowerCase();
+  const exact = rows.filter(a => lc(a.email) === lower || lc(a.alias) === lower);
+  if (exact.length === 1) return { account: exact[0] };
+  if (exact.length > 1) return { ambiguous: exact };
+  const partial = rows.filter(a => lc(a.email).includes(lower) || lc(a.alias).includes(lower));
+  if (partial.length === 1) return { account: partial[0] };
+  if (partial.length > 1) return { ambiguous: partial };
+  return { none: true };
+}
+
+const lc = (s) => (typeof s === "string" ? s.toLowerCase() : "");
+
+/** The errors that mean the stored login itself was refused — the ones the
+ *  panel offers "Sign in again" for (account-issue.ts errorText `fixable`). */
+const SIGN_IN_ERRORS = new Set(["invalid_grant", "no_refresh_token", "http-401"]);
+
+/**
+ * Whether the accounts panel withholds its Switch button from this row — the
+ * server-side copy of account-issue.ts's `blocksSwitch`, which
+ * cli-switch-rules-2183.test.ts holds to it row by row.
+ *
+ * A login that is dead or was never stored: claude-swap refused its token, or
+ * stopped collecting it on a verdict that only a sign-in clears. Never a stale
+ * copy (#721): the login works, only claude-swap's copy is behind. And not a
+ * rate limit, a timeout or a network error — those clear by themselves, and the
+ * panel switches to such an account when asked.
+ */
+export function blocksSwitch(a) {
+  if (!a || a.staleCopy === true) return false;
+  if (a.stopped === true) return a.collector === "no_credentials" || a.collector === "relogin_required";
+  return typeof a.error === "string" && SIGN_IN_ERRORS.has(a.error);
+}
+
+/**
+ * Could the live login be moved here at all, when somebody names it?
+ *
+ * Exactly when the panel would offer the switch: not a disabled slot —
+ * claude-swap's own "keep out of rotation", which a person set on purpose —
+ * and not one whose stored login is known to be dead (blocksSwitch): switching
+ * to it signs every running session out.
+ */
+export function switchable(a) {
+  return Boolean(a) && a.disabled !== true && !blocksSwitch(a);
+}
+
+/** Whether `--best` may land on this row by room alone: switchable, and with no
+ *  collector error at all. A reading that failed — a rate limit, a timeout — is
+ *  no evidence of room, which is what `--best` promises; Auto-switch's own
+ *  chooser skips any row with an error too (account-choice.mjs `landable`). A
+ *  stale copy is fine, since its login works (see authTrouble). */
+function roomCandidate(a) {
+  return switchable(a) && !(a.error && a.staleCopy !== true);
+}
+
+/**
+ * Where `--best` goes: `{ account, rule }`, `{ already: row, rule }` when the
+ * active account is it, or `{ none: true }` when nothing can take the login.
+ *
+ * WHAT AUTO-SWITCH WOULD PICK (#2200). `rules` is Auto-switch's own state as
+ * the deck holds it — `{ next, home, threshold, models, busy, quarantined,
+ * optional, now }`, see cswap-auto-choice.mjs bestRules — or null. With a home
+ * account or "soonest weekly reset" set, the answer is account-choice.mjs's
+ * chooseAccount's, asked the way a tick right after a person's request would
+ * be: nothing picked by hand to protect, the home asked for, no cooldown. Its
+ * `rule` is that pick's trigger, "home" or "weekly-reset". When it names no
+ * account and the account in use is under the threshold on a current reading,
+ * Auto-switch would keep it, and so does this (`rule: "rules"`, or "home" on
+ * the home account). Otherwise — no rule set, or the active account full or
+ * unread and no rule's account free — it is the engine's own choice, below.
+ *
+ * MOST ROOM, the engine's `best`. Room is the roster's own `headroom` — against
+ * the tightest lane, so an account at 10% of five hours and 97% of the week is
+ * not chosen over one at 50% of both. A reading nobody has taken counts as no
+ * room rather than as full: the point of `--best` is to land somewhere known to
+ * have space. A tie with the active account stays where it is — a switch that
+ * gains no room still moves every running session — and other ties go to a
+ * fresh reading over a stale one, then to the lower slot, so the answer is the
+ * same every time it is asked.
+ */
+export function bestAccount(accounts, rules = null) {
+  const all = Array.isArray(accounts) ? accounts : [];
+  const rows = all.filter(roomCandidate);
+  const ruled = rules ? byRules(all, rules) : null;
+  if (ruled) return ruled;
+  if (!rows.length) return { none: true };
+  const room = (a) => (typeof a.headroom === "number" ? a.headroom : -1);
+  const best = [...rows].sort((x, y) =>
+    room(y) - room(x)
+    || Number(y.active === true) - Number(x.active === true)
+    || Number(x.stale === true) - Number(y.stale === true)
+    || x.num - y.num)[0];
+  return best.active ? { already: best, rule: "most-room" } : { account: best, rule: "most-room" };
+}
+
+/** chooseAccount's answer for `--best`, as bestAccount describes it, or null
+ *  for "the engine's own choice". */
+function byRules(rows, { next = "room", home = null, threshold, models = [], busy, quarantined, optional = true, now = Date.now() } = {}) {
+  if (next !== "weekly" && !home) return null;
+  if (!Number.isFinite(threshold)) return null;
+  const keyed = rows.map(a => ({ ...a, key: accountKey(a.email, a.orgUuid) }));
+  const original = (k) => rows[keyed.indexOf(k)];
+  const pick = chooseAccount({
+    accounts: keyed,
+    choice: { next, home, manual: false, goHome: true },
+    threshold,
+    models,
+    busy: busy instanceof Set ? busy : new Set(),
+    quarantined: quarantined instanceof Set ? quarantined : new Set(),
+    sinceMove: Infinity,
+    optional: optional !== false,
+    now,
+  });
+  if (pick) return { account: original(pick.to), rule: pick.trigger };
+  const active = keyed.find(a => a.active);
+  if (!active || !readingCurrent(active, models, now)) return null;
+  const used = usedOf(active, models);
+  if (used == null || used >= threshold) return null;
+  return { already: original(active), rule: home && active.key === home ? "home" : "rules" };
+}
+
+/** How a row is named back to its reader: `#2 alice@corp.com (work)`. On one
+ *  line and without control bytes, since an alias is whatever was typed. */
+export function accountName(a) {
+  if (!a) return "";
+  const who = a.email ?? "(no email)";
+  return oneLine(`#${a.num} ${who}${a.alias ? ` (${a.alias})` : ""}`);
+}