ccdeck 3.44.0 → 3.46.0

package/src/server/integrations/store.mjs

@@ -0,0 +1,226 @@
+// The trackers this deck is connected to (#2178): what each connection is, kept
+// in one file, and the credential it uses, kept in another.
+//
+// TWO FILES, AND WHY. `integrations.json` holds what the page may see — the
+// name, the address, which account answered, what the provider learned about
+// the server — and is read for every list. `integrations-secrets.json` holds
+// the tokens and nothing else, is read only when a request to the tracker is
+// about to be signed, and is never serialised into an answer. Splitting them
+// means no code path that returns connections can carry a token by accident:
+// the token is not in the object it returns.
+//
+// There is no keychain anywhere in this deck, so both are plain files in a
+// folder of their own, `integrations/` in the deck's home (deck-home.mjs, which
+// honours CCDECK_HOME), kept at 0700 whatever the home itself is — written the way
+// prefs.json and Codex's auth.json are: a fresh temp file created 0600 with
+// O_EXCL, fsynced, chmod'ed, then renamed over the old one with the retrying
+// rename Windows needs. writeFileAtomic is deliberately not used: it creates a
+// new file at 0666 minus the umask, which is world-readable on most machines.
+//
+// THE SECRET IS OPAQUE. A string today (a Jira token), an object tomorrow (an
+// OAuth access/refresh pair). Nothing in this file looks inside it; a provider
+// decides what it is and the proxy hands it back to the provider to sign with.
+//
+// Nothing here is shared with paired decks: the LAN exchange is an explicit
+// allowlist (lan-manifest.mjs, lan-copies.mjs) and prefs never sync, so a
+// connection made on this machine stays on this machine.
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, readFile, rename, unlink } from "node:fs/promises";
+import { join } from "node:path";
+import { createTemp, renameWithRetry } from "../atomic-write.mjs";
+import { deckDataDir } from "../deck-home.mjs";
+import { PRODUCT } from "../brand.mjs";
+
+export const META_FILE = "integrations.json";
+export const SECRETS_FILE = "integrations-secrets.json";
+const FILE_MODE = 0o600;
+const DIR_MODE = 0o700;
+/** More than anybody connects by hand; a bound on what a list answer costs. */
+export const MAX_CONNECTIONS = 50;
+/** The folder both files live in, inside the deck's home. */
+export const STORE_DIR = "integrations";
+
+const text = (v, max = 500) => (typeof v === "string" ? v.slice(0, max) : "");
+
+/** A connection as it is kept: every field a known type, nothing else. */
+function normaliseConnection(raw) {
+  if (!raw || typeof raw !== "object" || typeof raw.id !== "string" || typeof raw.kind !== "string") return null;
+  const account = raw.account && typeof raw.account === "object" ? raw.account : {};
+  const origins = Array.isArray(raw.allowedOrigins) ? raw.allowedOrigins.filter(o => typeof o === "string").slice(0, 8) : [];
+  return {
+    id: text(raw.id, 64),
+    kind: text(raw.kind, 32),
+    name: text(raw.name, 120),
+    baseUrl: text(raw.baseUrl, 500),
+    account: {
+      id: text(account.id, 200),
+      login: text(account.login, 200),
+      name: text(account.name, 200),
+      avatarUrl: text(account.avatarUrl, 1000),
+    },
+    meta: raw.meta && typeof raw.meta === "object" && !Array.isArray(raw.meta) ? raw.meta : {},
+    allowedOrigins: origins,
+    createdAt: text(raw.createdAt, 40),
+    updatedAt: text(raw.updatedAt, 40),
+  };
+}
+
+/**
+ * @param {object} [opts]
+ * @param {() => string} [opts.dir] the directory both files live in; the deck's home by default
+ * @param {(msg: string) => void} [opts.warn]
+ */
+export function createIntegrationsStore({ dir = () => join(deckDataDir(), STORE_DIR), warn = msg => console.warn(msg) } = {}) {
+  /** Every write, one at a time, so two pages saving at once cannot lose one. */
+  let chain = Promise.resolve();
+  const queued = job => {
+    const run = chain.then(job, job);
+    chain = run.catch(() => {});
+    return run;
+  };
+
+  async function readJson(path, label) {
+    let raw;
+    try { raw = await readFile(path, "utf8"); }
+    catch (err) {
+      if (err?.code === "ENOENT") return null;
+      throw err;
+    }
+    try { return JSON.parse(raw.replace(/^/, "")); }
+    catch {
+      // Kept aside rather than overwritten: a damaged secrets file is still
+      // the user's tokens, and the next save would otherwise replace it with
+      // an empty one. Its contents are never logged.
+      const aside = `${path}.corrupt-${Date.now()}`;
+      await rename(path, aside).catch(() => {});
+      warn(`${PRODUCT}: ${label} could not be read as JSON and was moved aside to ${aside}.`);
+      return null;
+    }
+  }
+
+  async function load() {
+    const home = dir();
+    const meta = await readJson(join(home, META_FILE), META_FILE);
+    const secrets = await readJson(join(home, SECRETS_FILE), SECRETS_FILE);
+    const connections = (Array.isArray(meta?.connections) ? meta.connections : [])
+      .map(normaliseConnection).filter(Boolean).slice(0, MAX_CONNECTIONS);
+    const ids = new Set(connections.map(c => c.id));
+    const kept = secrets?.secrets && typeof secrets.secrets === "object" ? secrets.secrets : {};
+    // A secret whose connection is gone is dropped at the next write: a
+    // disconnect that half-failed must not leave a token behind for ever.
+    const secretMap = new Map(Object.entries(kept).filter(([id, value]) => ids.has(id) && value != null));
+    return { connections, secrets: secretMap };
+  }
+
+  /** The safe write: temp at 0600 with O_EXCL, fsync, chmod, rename. */
+  async function writeFile(name, value) {
+    const home = dir();
+    await mkdir(home, { recursive: true, mode: DIR_MODE });
+    // Made 0700 by mkdir only when it did not exist yet; held there on every
+    // write, so a folder someone loosened does not stay loose.
+    if (process.platform !== "win32") await chmod(home, DIR_MODE).catch(() => {});
+    const target = join(home, name);
+    const { tmp, handle } = await createTemp(target, { mode: FILE_MODE });
+    let landed = false;
+    try {
+      try {
+        await handle.writeFile(JSON.stringify(value, null, 2) + "\n", "utf8");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await chmod(tmp, FILE_MODE);
+      await renameWithRetry(tmp, target);
+      landed = true;
+    } finally {
+      // A temp left behind may hold tokens in cleartext.
+      if (!landed) await unlink(tmp).catch(() => {});
+    }
+  }
+
+  const writeMeta = connections => writeFile(META_FILE, { version: 1, connections });
+  const writeSecrets = map => writeFile(SECRETS_FILE, { version: 1, secrets: Object.fromEntries(map) });
+
+  /** What a page may see of a connection: everything but the secret, and
+   *  whether one is saved. */
+  const publicOf = (conn, secrets) => ({ ...conn, tokenSaved: secrets.has(conn.id) });
+
+  return {
+    /** Every connection, as a page may see it. `own(conn, secret)`, when
+     *  given, is handed each connection that has a secret, with it, and
+     *  answers the connection to list: the routes take that secret out of what
+     *  an earlier build kept (routes.mjs). */
+    async list({ own } = {}) {
+      const { connections, secrets } = await load();
+      return connections.map(c => publicOf(own && secrets.has(c.id) ? own(c, secrets.get(c.id)) : c, secrets));
+    },
+
+    /** One connection, as a page may see it, or null. */
+    async get(id) {
+      const { connections, secrets } = await load();
+      const conn = connections.find(c => c.id === id);
+      return conn ? publicOf(conn, secrets) : null;
+    },
+
+    /** The opaque secret for one connection, or null. The ONE read of the
+     *  secrets file, and its only caller is the proxy that signs requests. */
+    async secret(id) {
+      const { secrets } = await load();
+      return secrets.get(id) ?? null;
+    },
+
+    /** Add a connection with its secret. Answers it as a page may see it. */
+    create(fields, secret) {
+      return queued(async () => {
+        const { connections, secrets } = await load();
+        if (connections.length >= MAX_CONNECTIONS) throw new Error("too many connections");
+        const now = new Date().toISOString();
+        const conn = normaliseConnection({ ...fields, id: randomUUID(), createdAt: now, updatedAt: now });
+        // The secret first: if the second write fails the connection does not
+        // exist, and the orphaned secret is dropped by the next write.
+        if (secret != null) {
+          secrets.set(conn.id, secret);
+          await writeSecrets(secrets);
+        }
+        await writeMeta([...connections, conn]);
+        return publicOf(conn, secrets);
+      });
+    },
+
+    /** Change a connection. `secret` undefined keeps the saved one. */
+    update(id, patch, secret) {
+      return queued(async () => {
+        const { connections, secrets } = await load();
+        const at = connections.findIndex(c => c.id === id);
+        if (at < 0) return null;
+        const prev = connections[at];
+        const next = normaliseConnection({ ...prev, ...patch, id: prev.id, kind: prev.kind, createdAt: prev.createdAt, updatedAt: new Date().toISOString() });
+        if (secret !== undefined) {
+          if (secret === null) secrets.delete(id); else secrets.set(id, secret);
+          await writeSecrets(secrets);
+        }
+        const list = connections.slice();
+        list[at] = next;
+        await writeMeta(list);
+        return publicOf(next, secrets);
+      });
+    },
+
+    /** Forget a connection and its secret. True when there was one. */
+    remove(id) {
+      return queued(async () => {
+        const { connections, secrets } = await load();
+        const had = connections.some(c => c.id === id);
+        // The secret goes first: a disconnect that fails halfway leaves a
+        // connection with no token (visible, and Disconnect can be pressed
+        // again), never a token with no connection.
+        if (secrets.delete(id) || had) await writeSecrets(secrets);
+        if (had) await writeMeta(connections.filter(c => c.id !== id));
+        return had;
+      });
+    },
+  };
+}
+
+/** The deck's own store, in its home. */
+export const integrationsStore = createIntegrationsStore();

package/src/server/lan-deck.mjs

@@ -31,6 +31,9 @@ import { run } from "./exec.mjs";
 // A LAN round checks the imports it lands the way the paste box does.
 import { CHECKS_IMPORTS } from "./account-routes.mjs";
 import { RUNNING_VERSION } from "./running-version.mjs";
+// Which of this deck's accounts a paired deck is working on, for the account
+// notifier, which reaches the engine's status through it (#2192).
+import { connectLanStatus } from "./lan-elsewhere.mjs";
 
 // ── LAN sync ────────────────────────────────────────────────────────────────
 //
@@ -301,6 +304,10 @@ export const lanEngine = createEngine({
   },
 });
 
+// The status the account notifier reads "which deck is on what" from — see
+// lan-elsewhere.mjs, which says why it does not import this file for it.
+connectLanStatus(() => lanEngine.status());
+
 /**
  * What prefs is entitled to tell the LAN engine, and what it is not.
  *

package/src/server/lan-elsewhere.d.mts

@@ -0,0 +1,30 @@
+// The page's view of lan-elsewhere.mjs: the rule the accounts' rows read, the
+// same one the notifier reads on the server.
+
+/** The parts of a status row the rule reads — the engine's and the page's
+ *  status rows are both this and more. */
+export interface ElsewherePeer {
+  fp: string;
+  peerFp?: string | null;
+  name?: string;
+  addr?: string;
+  paired?: boolean;
+  offers?: { at: number; current?: { key?: string } | { hidden: true } | { other: true } | null } | null;
+}
+
+export interface ElsewhereStatus<P extends ElsewherePeer = ElsewherePeer> {
+  enabled?: boolean;
+  peers?: P[];
+  addrs?: string[];
+  aliases?: Record<string, string>;
+}
+
+export const ELSEWHERE_FRESH_MS: number;
+export function decksByAccount<P extends ElsewherePeer>(
+  status: ElsewhereStatus<P> | null | undefined, now: number, freshMs?: number,
+): Map<string, P[]>;
+export function deckName(p: ElsewherePeer, aliases?: Record<string, string>): string;
+export function namesByAccount(status: ElsewhereStatus | null | undefined, now: number, freshMs?: number): Map<string, string[]>;
+export function deckList(names: readonly string[]): string;
+export function connectLanStatus(status: (() => unknown) | null): void;
+export function elsewhereNow(now?: number): Map<string, string[]>;

package/src/server/lan-elsewhere.mjs

@@ -0,0 +1,137 @@
+// Which of this deck's accounts another deck is working on right now (#2192).
+//
+// ONE LOGIN, LIVE IN ONE PLACE. A Claude refresh token is good for one renewal:
+// the copy that renews it first gets a new one, and every other copy of that
+// login is refused with invalid_grant from then on. Claude Code answers that by
+// wiping the stored login, and every session on that machine stops with "Login
+// expired · Please run /login". Two machines that hold one copied login hold one
+// expiry too, so both reach for the renewal within minutes of each other and
+// the slower one loses. Measured on one pair of decks: three of seven
+// interruptions in a month landed on the 8-hour renewal with nothing on that
+// machine renewing in between.
+//
+// Local network already says which account each paired deck is on (`current`
+// in its manifest — see currentFor in lan-copies.mjs), so this needs nothing new
+// on the wire: it reads what the status already holds. It is the one rule the
+// row's warning and the notification both ask, so the two cannot disagree
+// about which deck is on what. The page reads it through lan-elsewhere.d.mts;
+// the server through the door at the bottom, which lan-deck.mjs connects to its
+// engine.
+//
+// IT WARNS AND DOES NOTHING ELSE. The login a deck is on already stays on that
+// deck (manifestFor marks it `inUse` and `serve` refuses it), and Auto-switch
+// may still move to a login a paired deck is on (3.43.3). What is left is a
+// copy a paired deck held before this deck went live on it — which only the
+// two decks saying where they are can show, and only a person can settle. A
+// deck that hides which account it is on, or is on one it does not share with
+// this one, says nothing here, and nothing is guessed in its place.
+//
+// Pure apart from that door. No sockets, no timers, no filesystem.
+
+/**
+ * How recent a deck's word has to be for "it is on this account right now".
+ *
+ * A paired deck says which account it is on in every manifest, and a manifest
+ * crosses at least once a minute each way — this deck's round asks it, and its
+ * round carries one in. Five minutes is five rounds: a dropped round or two does
+ * not take the warning down and put it back, which would read as two incidents,
+ * and a deck that was switched off stops counting soon after. Past it, what the
+ * deck said is its last word rather than its current one.
+ */
+export const ELSEWHERE_FRESH_MS = 5 * 60_000;
+
+/** An address that is this machine: loopback, or one of its own. A second deck
+ *  on this machine shares its Claude login rather than copying it, so it is not
+ *  another place the login is live. */
+function onThisMachine(addr, mine) {
+  if (typeof addr !== "string" || !addr) return false;
+  if (addr === "::1" || addr === "localhost" || addr.startsWith("127.")) return true;
+  return Array.isArray(mine) && mine.includes(addr);
+}
+
+/**
+ * The paired decks that said, within `freshMs`, that they are working on one of
+ * the accounts they share — keyed by account, one row per deck.
+ *
+ * ONLY WHAT A DECK SAID, AND ONLY RECENTLY. A deck names the account it is on
+ * only when it shares that account and its owner left "Show paired decks which
+ * of these this deck is using" on; `hidden`, `other`, nothing at all (a deck
+ * older than 3.22.15 never says) and a word older than `freshMs` all prove
+ * nothing, and none of them is drawn as a deck on an account. A deck that is
+ * not paired any more is not counted either: what it said was said to a deck
+ * that no longer listens.
+ *
+ * `status` is the engine's status() — or the page's copy of it, the same shape.
+ */
+export function decksByAccount(status, now, freshMs = ELSEWHERE_FRESH_MS) {
+  const out = new Map();
+  if (!status?.enabled) return out;
+  const seen = new Set();
+  for (const p of Array.isArray(status.peers) ? status.peers : []) {
+    if (!p || p.paired !== true) continue;
+    const said = p.offers;
+    const key = said?.current && typeof said.current.key === "string" ? said.current.key : "";
+    if (!key || typeof said.at !== "number" || !Number.isFinite(said.at)) continue;
+    // Within the window, and not from the future: a clock that ran ahead is not
+    // a promise about the next five minutes.
+    if (now - said.at > freshMs || said.at - now > freshMs) continue;
+    if (onThisMachine(p.addr, status.addrs)) continue;
+    // One deck reached two ways is merged into one row by the engine already;
+    // the same deck under the same key twice would still be one deck.
+    const id = `${key}|${p.peerFp ?? p.fp}`;
+    if (seen.has(id)) continue;
+    seen.add(id);
+    out.set(key, [...(out.get(key) ?? []), p]);
+  }
+  return out;
+}
+
+/** A deck as a sentence names it: the name somebody here gave it, else its own. */
+export function deckName(p, aliases) {
+  const id = p?.peerFp ?? p?.fp;
+  const given = aliases && typeof aliases === "object" && typeof aliases[id] === "string" ? aliases[id].trim() : "";
+  const own = typeof p?.name === "string" ? p.name.trim() : "";
+  return given || own || "another deck";
+}
+
+/** The same answer as names: account key to the decks on it, each named once
+ *  and in order, so one machine reached under two keys is one name. */
+export function namesByAccount(status, now, freshMs = ELSEWHERE_FRESH_MS) {
+  const out = new Map();
+  for (const [key, rows] of decksByAccount(status, now, freshMs)) {
+    const names = [...new Set(rows.map(p => deckName(p, status?.aliases)))].sort((a, b) => a.localeCompare(b));
+    out.set(key, names);
+  }
+  return out;
+}
+
+/** "iMac", "iMac and PC", "iMac, Mac and PC". */
+export function deckList(names) {
+  if (names.length <= 1) return names[0] ?? "another deck";
+  return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}
+
+// ── the door ────────────────────────────────────────────────────────────────
+//
+// The notifier needs the engine's status, and the engine lives in lan-deck.mjs,
+// which imports far more than the notifier should. So lan-deck.mjs hands its
+// status() in here as it loads, and the notifier asks here. Until it does — a
+// test that runs the notifier on its own — the answer is that no deck is on
+// anything, which is what a deck with Local network off would say too.
+
+let _status = null;
+
+/** lan-deck.mjs's, once, as it loads. */
+export function connectLanStatus(status) {
+  _status = typeof status === "function" ? status : null;
+}
+
+/** namesByAccount over the engine's status as it is now. Never throws: a
+ *  status that could not be read is a deck that knows of nobody. */
+export function elsewhereNow(now = Date.now()) {
+  try {
+    return _status ? namesByAccount(_status(), now) : new Map();
+  } catch {
+    return new Map();
+  }
+}

package/src/server/login-service.mjs

@@ -403,8 +403,8 @@ export const SETTING_VARS = Object.freeze([
   "AGENTS_DECK_NO_INSTALL", "AGENTS_DECK_NO_DOWNLOAD", "AGENTS_DECK_NO_UPDATE_CHECK", "AGENTS_DECK_NO_STATUS",
   "AGENTS_DECK_NO_FRESHEN", "AGENTS_DECK_NO_NOTIFY", "AGENTS_DECK_NO_LAN", "AGENTS_DECK_NO_REPORTS",
   "AGENTS_DECK_CSWAP", "AGENTS_DECK_CLAUDE", "AGENTS_DECK_CCUSAGE", "CLAUDE_SWAP_BACKUP", "AGENTS_DECK_LHM_PORT",
-  // The opt-in for Skill activity's typed-command hook (skill-hook.mjs). A deck
-  // started at login without it would take the entry back out.
+  // The off switch for Skill activity's typed-command hook (skill-hook.mjs). A
+  // deck started at login without it would put the entry back in.
   "AGENTS_DECK_SKILL_HOOK",
 ]);
 

package/src/server/org-telemetry.mjs

@@ -0,0 +1,173 @@
+// What each Claude organization's settings send, remembered per organization.
+//
+// A Team or Enterprise organization can turn Claude Code's OpenTelemetry export
+// on for every member: the admin sets it in claude.ai, and Claude Code fetches
+// it at startup and hourly into <config dir>/remote-settings.json. There is ONE
+// such file per machine, and it describes whichever organization's login last
+// fetched it. claude-swap does not touch it on a switch, so for a while after a
+// switch it still describes the account the user just left, until a Claude
+// session on the new account fetches its own.
+//
+// So the deck cannot read an account's telemetry off the file whenever it
+// likes. It reads it when the file can be attributed, and remembers the answer
+// under the organization's uuid, for the accounts panel to show on every row of
+// that organization — the inactive ones included, which is the point: the
+// panel can say before a switch what the switch will turn on.
+//
+// WHEN THE FILE IS AN ORGANIZATION'S. Both of these, or nothing is recorded:
+//   - it was written after claude-swap last changed its store (sequence.json's
+//     `lastUpdated`), so it was fetched by the account active now;
+//   - the live login (`oauthAccount` in Claude Code's own .claude.json) belongs
+//     to the same organization as claude-swap's active account, so a /login
+//     made outside claude-swap is not mistaken for the store's account.
+// Anything else is left unknown rather than guessed: telling a user an account
+// is unmonitored because the file was another organization's is the one
+// mistake this must not make. `lastUpdated` also moves on an alias or an add,
+// which can only make an answer wait for the next hourly fetch.
+//
+// Read only when the file has changed since it was last looked at. The roster
+// is polled every fifteen seconds, the file changes at most hourly, and
+// .claude.json can be large; one stat per poll is the whole steady-state cost.
+import { mkdir, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+import { claudeConfigDir } from "./claude-dir.mjs";
+import { deckDataDir } from "./deck-home.mjs";
+import { writeFileAtomic } from "./atomic-write.mjs";
+import { radarVariables } from "./traffic-radar-config.mjs";
+
+/** The flags that put content, not only counts, into the export. */
+export const CONTENT_KEYS = Object.freeze([
+  "OTEL_LOG_USER_PROMPTS", "OTEL_LOG_ASSISTANT_RESPONSES", "OTEL_LOG_TOOL_DETAILS",
+  "OTEL_LOG_TOOL_CONTENT", "OTEL_LOG_RAW_API_BODIES",
+]);
+
+const RECORDS_FILE = "org-telemetry.json";
+
+/**
+ * What one settings file turns on, from Radar's own reading of it (so endpoint
+ * paths and credentials are already stripped): `level` is "content" when a
+ * content flag is on beside telemetry, "metrics" for telemetry alone, and "off"
+ * when the file does not enable it. Content flags without telemetry send
+ * nothing, so they do not count.
+ */
+export function telemetrySummary(variables) {
+  const on = key => variables.some(v => v.key === key && String(v.value).startsWith("Enabled"));
+  const telemetry = on("CLAUDE_CODE_ENABLE_TELEMETRY");
+  const content = telemetry ? CONTENT_KEYS.filter(on) : [];
+  const destinations = [...new Set(variables
+    .filter(v => v.key.endsWith("ENDPOINT") && /^https?:\/\//.test(v.value))
+    .map(v => v.value))];
+  return { level: !telemetry ? "off" : content.length ? "content" : "metrics", content, destinations };
+}
+
+/** Claude Code's own state file: beside the home directory, or inside a
+ *  moved config directory. */
+function claudeStatePath(env, home, platform) {
+  const { join } = platform === "win32" ? win32 : posix;
+  return env.CLAUDE_CONFIG_DIR?.trim() ? join(claudeConfigDir(env, home, platform), ".claude.json") : join(home, ".claude.json");
+}
+
+async function readJson(path, read) {
+  try { return JSON.parse(String(await read(path, "utf8")).replace(/^/, "")); } catch { return null; }
+}
+
+let _records = null;
+let _examined = null;   // mtime of the remote-settings.json last looked at
+
+/** The content flags by the words a person would use for them. The page has
+ *  its own copy in org-telemetry.ts, for the row. */
+export const CONTENT_WORDS = Object.freeze({
+  OTEL_LOG_USER_PROMPTS: "prompts",
+  OTEL_LOG_ASSISTANT_RESPONSES: "responses",
+  OTEL_LOG_TOOL_DETAILS: "tool details",
+  OTEL_LOG_TOOL_CONTENT: "tool output",
+  OTEL_LOG_RAW_API_BODIES: "full API bodies",
+});
+
+/** "a, b and c". */
+function listed(words) {
+  return words.length <= 1 ? words.join("") : `${words.slice(0, -1).join(", ")} and ${words[words.length - 1]}`;
+}
+
+/**
+ * "Acme's telemetry is on for new sessions: it sends your prompts and tool
+ * details to 192.0.2.16:4317" — what a switch to an account of this
+ * organization turns on, for the swap notice to carry. Null when nothing is
+ * known to be on: settings seen off, or never seen.
+ */
+export function telemetryClause(record) {
+  if (!record || (record.level !== "metrics" && record.level !== "content")) return null;
+  const words = record.level === "content" ? (record.content ?? []).map(k => CONTENT_WORDS[k] ?? k) : [];
+  const what = words.length ? `your ${listed(words)}` : "usage data";
+  const hosts = (record.destinations ?? []).map(d => String(d).replace(/^https?:\/\//, ""));
+  const who = record.orgName ? `${record.orgName}'s telemetry` : "Its organization's telemetry";
+  return `${who} is on for new sessions: it sends ${what}${hosts.length ? ` to ${listed(hosts)}` : ""}`;
+}
+
+/** Every organization's record as last saved, without looking at the settings
+ *  file: for a reader that has no store to pin a new reading on. */
+export async function knownOrgTelemetry({
+  env = process.env, home = homedir(), platform = process.platform,
+  dataDir = deckDataDir(platform, env, home), read = readFile,
+} = {}) {
+  if (_records == null) {
+    const { join } = platform === "win32" ? win32 : posix;
+    const saved = await readJson(join(dataDir, RECORDS_FILE), read);
+    _records = saved && typeof saved === "object" && !Array.isArray(saved) ? saved : {};
+  }
+  return _records;
+}
+
+/** Forget everything held in memory. For the suite. */
+export function resetOrgTelemetry() { _records = null; _examined = null; }
+
+/**
+ * Look at remote-settings.json if it changed, record it under its organization
+ * when it can be attributed (see the header), and answer every organization's
+ * record: uuid → `{ orgName, level, content, destinations, seenAt, writtenAt }`.
+ *
+ * `seq` is claude-swap's sequence.json as the roster already read it. Never
+ * throws: a record that could not be made is a record not made.
+ */
+export async function observeOrgTelemetry({
+  seq,
+  env = process.env, home = homedir(), platform = process.platform, now = Date.now(),
+  dataDir = deckDataDir(platform, env, home),
+  statFile = stat, read = readFile, write = writeFileAtomic, makeDir = mkdir,
+} = {}) {
+  const { join } = platform === "win32" ? win32 : posix;
+  const recordsPath = join(dataDir, RECORDS_FILE);
+  if (_records == null) {
+    const saved = await readJson(recordsPath, read);
+    _records = saved && typeof saved === "object" && !Array.isArray(saved) ? saved : {};
+  }
+  try {
+    const remote = join(claudeConfigDir(env, home, platform), "remote-settings.json");
+    const mtime = (await statFile(remote)).mtimeMs;
+    if (mtime === _examined) return _records;
+    _examined = mtime;
+
+    const active = seq?.accounts?.[String(seq?.activeAccountNumber)];
+    const switchedAt = Date.parse(seq?.lastUpdated ?? "");
+    if (!active?.organizationUuid || !Number.isFinite(switchedAt) || mtime <= switchedAt) return _records;
+    const live = (await readJson(claudeStatePath(env, home, platform), read))?.oauthAccount;
+    if (!live || live.organizationUuid !== active.organizationUuid) return _records;
+
+    const settings = await readJson(remote, read);
+    if (!settings) return _records;
+    _records = {
+      ..._records,
+      [active.organizationUuid]: {
+        orgName: live.organizationName ?? active.organizationName ?? null,
+        ...telemetrySummary(radarVariables(settings, "Cached organization settings")),
+        seenAt: now,
+        writtenAt: Math.round(mtime),
+      },
+    };
+    await makeDir(dataDir, { recursive: true })
+      .then(() => write(recordsPath, `${JSON.stringify(_records, null, 2)}\n`))
+      .catch(() => {});
+  } catch { /* no file, or one that could not be read: nothing new to say */ }
+  return _records;
+}

package/src/server/pinned-build.mjs

@@ -83,6 +83,9 @@ const PINNED_MODULES = [
   // import() from the report's route.
   "account-projects.mjs",
   "swap-log.mjs",
+  // account-watch.mjs reads what each organization's telemetry was last seen
+  // to turn on, for the swap notice, only once a tick has switched.
+  "org-telemetry.mjs",
   "lan-sync.mjs",
   // The providers' status pages (#1311), reached only from their route.
   "provider-status.mjs",

package/src/server/request-gates.mjs

@@ -477,8 +477,27 @@ export const GUARDED_READS = new Set([
   "/api/fm-station",
   "/api/radio-stations",
   "/api/radio-click",
+  // The trackers this deck is connected to (#2178): the list of connections
+  // with their accounts, and below it every read a provider adds.
+  "/api/integrations",
 ]);
 
+/** Whole namespaces of guarded reads, for routes whose path carries an id —
+ *  /api/integrations/<kind>/<connId>/… (#2178). A connected tracker's boards,
+ *  issues, comments and the images the asset route signs for are the user's
+ *  work, read with the user's own token; every one of them is fetched by the
+ *  deck's own page and nothing else. A prefix rather than a list because a
+ *  provider adds its routes without touching this file, and a read it adds
+ *  must be covered from the moment it exists. */
+export const GUARDED_READ_PREFIXES = Object.freeze(["/api/integrations/"]);
+
+/** Whether a GET to `pathname` must come from the deck's page or carry the
+ *  token: listed in GUARDED_READS, or under one of GUARDED_READ_PREFIXES. */
+export function isGuardedRead(pathname) {
+  const path = String(pathname ?? "");
+  return GUARDED_READS.has(path) || GUARDED_READ_PREFIXES.some(prefix => path.startsWith(prefix));
+}
+
 export function isAuthorizedMutation(req) {
   const headers = req?.headers ?? {};
   if (presentsDeckToken(headers)) return true;