claude-code-runrate 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -0,0 +1,154 @@
+# Changelog
+
+Every release also has a [GitHub release](https://github.com/bingh0/ccr/releases)
+and a release commit, and those carry the full notes — what was measured, what
+was rejected, and why. This file is the index: enough to decide whether a
+version is worth upgrading to, and where to read the rest.
+
+Dates are npm publish dates, because that is when a version reached anyone.
+
+## 0.6.0 — 2026-09-01
+
+The remote-session release. Over mosh, two things had been degrading in
+silence — every clipboard copy was dropped in transit, and 24-bit colour was
+quietly flattened to 256 — and the tmux version floor the sidecar had grown
+was written down nowhere. All three were measured at the terminal, reading
+the raw bytes that reach a mosh client, not inferred.
+
+- **The clipboard survives mosh.** tmux's built-in OSC 52 emits an empty
+  selection field and mosh's parser accepts only an explicit `c`, so every
+  copy vanished between the two. The shipped tmux config now spells the
+  selection out — and names `c` explicitly, which is *more* compatible than
+  tmux's default everywhere, not a mosh-only workaround.
+- **True colour survives mosh.** mosh forces `TERM=xterm-256color` and drops
+  `COLORTERM`, which tmux reads as "no RGB" and silently downgrades every
+  24-bit colour to the nearest 256. The config now declares RGB for that
+  TERM, restoring what mosh was carrying fine all along.
+- **The tmux floor is declared: 3.2.** Percentage splits and
+  `terminal-features` need 3.1; the pane-scoped hooks that keep the sidebar
+  out of copy-mode need 3.2. Below the floor each failure is silent and looks
+  like something else, so `ccr doctor` now reports the tmux version and names
+  one that is too old — and an unreadable version is reported as unreadable,
+  never manufactured into a failure.
+- **The sidebar split speaks tmux 3.4's dialect.** `-p 34` was deprecated in
+  3.1 and rejected outright in 3.4; the launcher sizes with `-l 34%`, which
+  every supported tmux accepts.
+- **The Node floor rises to 22.17.** Node 18 and 20 are past their end of
+  life, and the vendored test runner's own floor is 22.17 — testing below it
+  produced a lane that hung rather than failed. `engines`, the CI matrix,
+  `ccr doctor`'s check, and the spec all state the same floor now, and the
+  matrix pins 22.17 exactly so the floor is tested, not just declared.
+- **The acceptance suite hardened underneath.** The vendored Gherkin runner
+  moved to gherkin-node-test 0.11.0, whose step linter enforces a rule the
+  suite now lives by: a negative assertion over a literal needle passes
+  forever once the needle rots, so *absence must be earned* — by a control
+  proving the needle can still find, or a sanction naming what proves it.
+  Every structural refusal in the step layer (the renderer spawns nothing,
+  the launcher reads no blob, the sidecar has no input channel) now carries
+  one or the other, and both of 0.11's linters gate the suite.
+
+## 0.5.0 — 2026-08-22
+
+The Windows release. The things that could not be reasoned about were measured
+on a real Windows 11 machine, because none of them are reachable from CI: every
+Windows test injects the launcher, so the suite proves the argv `ccr` builds and
+nothing about what Windows Terminal does when handed it.
+
+- **The panes open where `ccr` was run.** `wt.exe` does not inherit the working
+  directory the way `tmux new-session` does, so every pane opened in
+  `%USERPROFILE%` while the launch record claimed otherwise — and the sidecar
+  prefers that record, so the git pane described the project in full confidence
+  for a terminal that was not in it. One source now feeds both.
+- **Measured limits, and they are real.** Past 256 characters `wt` opens *no
+  tab at all*; a UNC path opens a tab and silently lands in `%SystemRoot%`; a
+  semicolon costs the whole tab; a backtick does not, so refusing it was wrong
+  and no longer happens. Each unusable path degrades — the panes open in the
+  default directory and stderr names which of the four reasons applied.
+- **The sidecar pane has a cycle key** on Windows Terminal. F3 or Space. F3 has
+  three encodings and on Windows which one arrives depends on the *Node*
+  version, so `ccr` answers all three rather than pinning a Node floor for a
+  keystroke.
+- **A pane config that says what is wrong.** A UTF-8 BOM is stripped; UTF-16 —
+  what PowerShell 5.1 writes for `>` and `Out-File` — is named as an encoding
+  problem instead of reported as bad JSON; `~\` expands as well as `~/`; and a
+  broken config says so on the panel and in `ccr doctor`, which reports pane
+  paths as *resolved*.
+- **`ccr sidecar` resolves the instance from the working directory**, which the
+  feature files and the README had both described for a while.
+- **The economy screen earns a decimal** where the next tenth is a decision: at
+  or past 95% used, one truncated digit, so `floor(shown)` still matches
+  `/usage`. A snapshot that stopped refreshing dims rather than blanks.
+
+## 0.4.0 — 2026-08-07
+
+[The instance layer and the git pane.](https://github.com/bingh0/ccr/releases/tag/v0.4.0)
+
+- **Instances.** Every launch is a named, slotted instance under one container
+  home; the name is derived from the project or given with `-i`, and travels
+  into the window title, status line and sidebar.
+- **A git pane** on F3: which repository the tab is in, the working tree, and
+  recent history in lanes. Read-only — it never writes to the repository.
+- The three launchers (tmux, Windows Terminal, VS Code) take naming, titles and
+  retention from one shared path rather than the tmux path owning them.
+
+## 0.3.0 — 2026-08-04
+
+[External tool panes in the sidebar.](https://github.com/bingh0/ccr/releases/tag/v0.3.0)
+
+- **Panes from other tools.** The sidebar hosts full-height read-only panes
+  rendered from small JSON blobs another tool writes beside its own artifacts.
+  You list the path in `~/.config/ccr/config.json`; F3 cycles.
+- A rate-limit correctness fix, and `strict` type checking across the codebase.
+
+## 0.2.4 — 2026-07-12
+
+[VS Code sidecars stop piling up; profile state-dir fix.](https://github.com/bingh0/ccr/releases/tag/v0.2.4)
+
+- One live sidecar per session: relaunching inside VS Code no longer
+  accumulates identical panes.
+- Profile sessions write their snapshots to the right state dir.
+
+## 0.2.3 — 2026-07-03
+
+[Sidecars agree on 5h/weekly across profiles.](https://github.com/bingh0/ccr/releases/tag/v0.2.3)
+
+- The 5h and weekly walls are one account-wide resource, but each profile only
+  captures its own; two sidecars on the same account could disagree. They
+  reconcile now.
+
+## 0.2.2 — 2026-07-02
+
+[Aligned meter bars + a staleness marker.](https://github.com/bingh0/ccr/releases/tag/v0.2.2)
+
+- A barely-used window projects an enormous time-to-exhaust, which overflowed
+  the fixed time column and shoved that row's bar out of line. Long horizons
+  are capped, so the bars stay aligned and the figure reads more honestly.
+- A stale snapshot is annotated (`· updated Nm ago`) rather than silently
+  frozen. Never a wipe — Claude Code legitimately stops ticking during a long
+  operation.
+
+## 0.2.1 — 2026-06-26
+
+[Windows Terminal teardown and sidecar width fixes.](https://github.com/bingh0/ccr/releases/tag/v0.2.1)
+
+- ConPTY makes a split pane's reported width unreliable, so the panel
+  soft-wrapped. The launcher injects the computed width and the sidecar clamps
+  to the smaller of the two.
+- On exit the sidecar pane collapses first and the border sweeps left to right,
+  fixing an ordering bug where Claude's pane could close first.
+
+## 0.2.0 — 2026-06-26
+
+[Native Windows and VS Code live sidecars.](https://github.com/bingh0/ccr/releases/tag/v0.2.0)
+
+- **Native Windows** — the live sidecar hosted in Windows Terminal split panes,
+  no tmux, bash or WSL, with a graceful fallback when `wt.exe` is absent.
+- **VS Code integrated terminal on any OS** — split-pane sidecar via a
+  clipboard one-liner.
+- `statusLine` injected per launch through a temp settings file, so `~/.claude`
+  is never mutated.
+
+## 0.1.0 — 2026-06-24
+
+First publish: the CLI and status line — `economy`, `resume`, `statusline` —
+with the live sidebar on tmux. Native Windows arrived in 0.2.0.

package/README.md

@@ -69,8 +69,8 @@ On Linux/macOS the default host is `tmux`. No WSL required.
 
 ## Requirements
 
-- **Node ≥ 18.3** — that's it for the core. **Zero runtime dependencies.**
-- For the optional live `ccr sidecar`: `tmux` on Linux/macOS, or **Windows
+- **Node ≥ 22.17** — that's it for the core. **Zero runtime dependencies.**
+- For the optional live `ccr sidecar`: **`tmux` ≥ 3.2** on Linux/macOS, or **Windows
   Terminal** / **VS Code's integrated terminal** on Windows (no WSL).
 
 ## VS Code (split terminal)
@@ -173,11 +173,11 @@ small JSON blob beside its own artifacts; you list that file's path in ccr's
 config; the sidebar cycles between the economy panel, the built-in git pane, and
 each configured pane.
 
-**Cycling views.** Under tmux the launcher binds **F3**. VS Code and its forks
-(Cursor, Positron, Antigravity) bind no key and leave both split panes running a
-foreground process, so the pasted sidecar one-liner carries `--keys`: click that
-pane and press **Space** (or **F3**). The renderer still reads no input — the key
-lives in a separate parent process that runs the panel as a child, the same
+**Cycling views.** Under tmux the launcher binds **F3** at the host. **Windows
+Terminal** binds no key of its own, and neither do VS Code and its forks (Cursor,
+Positron, Antigravity) — so on those the sidecar pane carries its own key: click
+the pane and press **Space** or **F3**. The renderer still reads no input — the
+key lives in a separate parent process that runs the panel as a child, the same
 separation tmux enforces. Anywhere else, `ccr cycle-view -i <name>` (or
 `--state-dir <dir>`); a bare `ccr cycle-view` resolves the instance from your
 working directory, like `ccr economy` does.
@@ -191,6 +191,19 @@ read from a repository:
 { "panes": [ { "path": "/home/you/project/.your-tool/sidecar.json" } ] }
 ```
 
+A leading `~` expands, with either separator (`~/tools/blob.json`,
+`~\tools\blob.json`), and a relative path resolves against the config file's own
+directory. **On Windows, save the file as UTF-8** — `>` and `Out-File` in Windows
+PowerShell 5.1 write UTF-16, which is not JSON as far as any parser is concerned:
+
+```powershell
+Set-Content -Encoding utf8 $env:USERPROFILE\.config\ccr\config.json $json
+```
+
+`ccr doctor` reports what it read out of the config — the paths as **resolved**,
+not as written — and names the problem when there is one, so a pane that never
+appears is a question you can answer rather than a silence.
+
 A pane is a full-height view carrying the producing tool's own rows — here
 `gherkin-trace`, whose blob ships as the golden example:
 
@@ -253,10 +266,16 @@ method has followed since, and is honest about which point on that line this
 repository represents.
 
 ```bash
-npm test            # node --test — harness self-tests + feature scenarios
-npm run typecheck   # tsc --noEmit over @ts-check'd JS (needs: npm i first)
+npm test              # node --test — harness self-tests + feature scenarios
+npm run typecheck     # tsc --noEmit over @ts-check'd JS (needs: npm i first)
+npm run install-hooks # copy .githooks/ into this clone (run once)
 ```
 
+`install-hooks` installs a fail-closed `pre-push` guard for the public remote:
+only `main`, fast-forward only, and a scan of the commits the push would make
+public. It is worth running in any clone you push from — a push is the moment
+history stops being private, and it is the last moment the check can help.
+
 - **No runtime dependencies**, ever — it's what lets `npx claude-code-runrate` install
   instantly on every OS, including native Windows.
 - **Dev-only** tooling (`typescript`, `@types/node`) exists solely for

package/bin/ccr.js

@@ -323,8 +323,18 @@ function cmdResume(arg) {
  * @returns {number | undefined}
  */
 function cmdSidecar(stateDir, showHint, exitOnEnd, useKeys, view, target = null) {
-  if (!stateDir && target != null) {
-    // -i: attach to a live instance by name, through the resolution chain.
+  // Resolve whether or not -i was typed, which is what `ccr cycle-view` has
+  // always done. Consulting the chain ONLY for -i meant a bare `ccr sidecar`
+  // skipped every other link in it — including the one that matters most here,
+  // "the live instance whose launch directory contains the cwd" — and landed on
+  // the CONTAINER (~/.ccr) instead. The container holds no session, so the pane
+  // sat empty next to a running instance, and the fix looked like naming the
+  // instance exactly right when the whole point of the chain is not having to.
+  //
+  // --hint is left out: it prints the VS Code split instructions, which are
+  // worth printing before any instance exists, so requiring a live one to
+  // explain how to start one would be backwards.
+  if (!stateDir && !showHint) {
     const res = require('../src/instance-resolve').resolveInstance({ target, command: 'sidecar' });
     if (!res.ok) { process.stderr.write(res.error + '\n'); return 1; }
     stateDir = res.stateDir;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-runrate",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Claude Code run-rate — subscription burn-rate & economy for your Claude Code sessions.",
   "license": "MIT",
   "author": "Bing Ho <reps-attic-riot@duck.com>",
@@ -17,7 +17,7 @@
     "ccr": "bin/ccr.js"
   },
   "engines": {
-    "node": ">=18.3"
+    "node": ">=22.17"
   },
   "files": [
     "bin",
@@ -25,6 +25,7 @@
     "scripts/launch.sh",
     "sidecar",
     "README.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
@@ -32,7 +33,10 @@
     "typecheck": "tsc --noEmit -p jsconfig.json",
     "lint": "oxlint",
     "release-gate": "node scripts/release-gate.js",
-    "prepublishOnly": "npm run release-gate && npm run lint && npm run typecheck && npm test"
+    "install-hooks": "node scripts/install-hooks.js",
+    "probe:wt": "node scripts/probe-wt.js",
+    "scan-package": "node scripts/scan-package.js",
+    "prepublishOnly": "npm run release-gate && npm run scan-package && npm run lint && npm run typecheck && npm test"
   },
   "keywords": [
     "claude-code",

package/scripts/launch.sh

@@ -135,7 +135,14 @@ if [ -n "${CCR_TITLE:-}" ]; then
 fi
 
 # Pane 1: the live economy sidebar. Capture its pane id so we can scope a hook to it.
-SIDEBAR_PANE="$(tmux -L "$SOCKET" split-window -t "$SESSION:0" -h -p "${CCR_SIDEBAR_PCT:-34}" -P -F '#{pane_id}' \
+# The width is `-l <pct>%`, NOT `-p <pct>`. Both spell the same split, but `-p` is the
+# deprecated form and tmux 3.4 — what Ubuntu 24.04 LTS ships, i.e. every stock Ubuntu
+# Server — rejects it with `size missing`. That killed the launcher AFTER new-session
+# had already succeeded, so the failure mode was silent and confusing: a live Claude
+# pane, no sidebar, no error on screen (launch.sh's stderr goes to the terminal it was
+# spawned from, which is gone by then). `-l N%` is accepted by 3.1 through 3.6+ alike
+# and produces an identical split, so there is no version guard to maintain.
+SIDEBAR_PANE="$(tmux -L "$SOCKET" split-window -t "$SESSION:0" -h -l "${CCR_SIDEBAR_PCT:-34}%" -P -F '#{pane_id}' \
   "$ENV_PREAMBLE; \"$NODE\" \"$REPO/bin/ccr.js\" sidecar; read -r -p 'sidebar exited — Enter to close '")"
 
 # The sidebar is a live dashboard — there is nothing to scroll. A stray mouse-wheel

package/sidecar/ccr.tmux.conf

@@ -22,3 +22,41 @@ set -g set-clipboard on
 
 # prefix + P — dump the whole pane scrollback to a file, regardless of length.
 bind-key P command-prompt -p 'save pane to:' 'capture-pane -S - ; save-buffer %1'
+
+# --- Remote sessions: true colour and a clipboard that survives mosh ---------
+#
+# Both lines matter only over a remote transport, and mosh is the case that
+# breaks without them. Measured over mosh -> tmux, reading the raw bytes that
+# reach the client; neither is guesswork.
+#
+# 1. TRUE COLOUR. mosh forces TERM=xterm-256color and DROPS COLORTERM. tmux
+#    infers RGB support from COLORTERM, so with it gone tmux silently
+#    downgrades 24-bit colour to the nearest 256 (38;2;R;G;B -> 38;5;N). mosh
+#    itself carries 24-bit fine; tmux is the one degrading it. Declaring the
+#    feature restores it.
+#
+# 2. CLIPBOARD. tmux's built-in OSC 52 emits an EMPTY selection field
+#    (`\033]52;;<base64>`), and mosh's OSC 52 parser accepts ONLY an explicit
+#    `c`. So every copy is silently dropped in transit. This override spells
+#    the selection out. Three details are load-bearing:
+#      * `%p1%.0s` CONSUMES the selection parameter while printing nothing.
+#        Omitting it leaves p1 unconsumed and the expansion is invalid.
+#      * `\007`, never `\7`. tmux 3.x SILENTLY REJECTS a terminal-overrides
+#        value containing `\7` — the option is discarded whole with no error,
+#        and `tmux show -s terminal-overrides` simply will not list it. Older
+#        guides on the web all use `\7`; that spelling was fine on tmux 2.x.
+#      * terminal-overrides keys on the client's TERM, so this matches when
+#        TERM is xterm-256color — which is exactly what mosh sets.
+#    Emitting an explicit `c` is also strictly more compatible than tmux's
+#    default empty field, so this is not a mosh-only workaround.
+#
+# Both require tmux 3.1+; ccr asks for 3.2+ overall (see `ccr doctor`).
+#
+# RGB is declared unconditionally. 24-bit has been table stakes for years —
+# iTerm2, Ghostty, WezTerm, kitty, Alacritty, Konsole, every libvte terminal
+# (GNOME Terminal et al), Windows Terminal and PuTTY all handle it. The lone
+# holdout that reports TERM=xterm-256color without it is macOS Terminal.app
+# before macOS 26, which degrades rather than breaking. Optimising the default
+# for that shrinking case would cost every other user their colours.
+set -as terminal-features ',xterm-256color:RGB'
+set -as terminal-overrides ",xterm-256color:Ms=\E]52;c%p1%.0s;%p2%s\007"

package/src/doctor.js

@@ -9,6 +9,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { spawnSync } = require('node:child_process');
 const { stripControl } = require('./sanitize');
+const { loadPaneConfig } = require('./pane-config');
 
 const ok = (/** @type {string} */ s) => `\x1b[32m✓\x1b[0m ${s}`;
 const bad = (/** @type {string} */ s) => `\x1b[31m✗\x1b[0m ${s}`;
@@ -34,15 +35,36 @@ function isExec(/** @type {string} */ f) {
   try { return (fs.statSync(f).mode & 0o111) !== 0; } catch { return false; }
 }
 
+// ccr's tmux dialect has a floor. 3.1 is HARD: percentage splits
+// (`split-window -l 34%`, since `-p` was deprecated there and 3.4+ rejects it)
+// and `terminal-features`, which sidecar/ccr.tmux.conf needs for true colour
+// over mosh. 3.2 adds pane-scoped hooks, which the launcher uses to keep the
+// sidebar out of copy-mode; below that it degrades quietly rather than
+// breaking, so 3.2 is what we ask for and 3.1 is what we tolerate.
+const TMUX_MIN = { major: 3, minor: 2 };
+/** @param {string} bin @returns {{major:number,minor:number}|null} */
+function tmuxVersion(bin) {
+  try {
+    const r = spawnSync(bin, ['-V'], { encoding: 'utf8' });
+    if (r.status !== 0) return null;
+    // "tmux 3.7c", "tmux 3.2a", "tmux next-3.6" — only the numbers matter.
+    const m = /(\d+)\.(\d+)/.exec(r.stdout || '');
+    return m ? { major: Number(m[1]), minor: Number(m[2]) } : null;
+  } catch { return null; }
+}
+
 /**
  * @param {{ platform?: string, has?: (cmd: string) => (string|null),
- *   homedir?: string, repo?: string, write?: (s: string) => void }} [opts]
+ *   tmuxVersion?: (bin: string) => ({major:number,minor:number}|null),
+ *   homedir?: string, repo?: string, write?: (s: string) => void,
+ *   env?: Record<string, string|undefined> }} [opts]
  *   side effects are injectable for testing; defaults hit the real environment
  * @returns {number} exit code (0 = healthy)
  */
 function run(opts = {}) {
   const platform = opts.platform || process.platform;
   const hasFn = opts.has || has;
+  const tmuxVerFn = opts.tmuxVersion || tmuxVersion;
   const homedir = opts.homedir || os.homedir();
   const REPO = opts.repo || path.join(__dirname, '..');
   const write = opts.write || ((s) => { process.stdout.write(s); });
@@ -51,8 +73,8 @@ function run(opts = {}) {
   let problems = 0;
 
   const [maj, min] = process.versions.node.split('.').map(Number);
-  const nodeOk = maj > 18 || (maj === 18 && min >= 3);
-  out.push(nodeOk ? ok(`node ${process.version}`) : bad(`node ${process.version} — need >= 18.3`));
+  const nodeOk = maj > 22 || (maj === 22 && min >= 17);
+  out.push(nodeOk ? ok(`node ${process.version}`) : bad(`node ${process.version} — need >= 22.17`));
   if (!nodeOk) problems++;
 
   const ccr = hasFn('ccr');
@@ -72,8 +94,24 @@ function run(opts = {}) {
     // temp settings file, so there's no shipped shim asset to check on Windows.
   } else {
     const tmux = hasFn('tmux');
-    out.push(tmux ? ok(`tmux (${stripControl(tmux)})`) : warn('tmux missing — needed for the `ccr [profile]` sidebar'));
-    if (!tmux) problems++;
+    if (!tmux) {
+      out.push(warn('tmux missing — needed for the `ccr [profile]` sidebar'));
+      problems++;
+    } else {
+      const v = tmuxVerFn(tmux);
+      // An unreadable version is not evidence of a problem — say so and move on
+      // rather than manufacturing a failure out of a parse miss.
+      if (!v) {
+        out.push(ok(`tmux (${stripControl(tmux)})`) + dim(' — version unreadable'));
+      } else if (v.major < TMUX_MIN.major
+          || (v.major === TMUX_MIN.major && v.minor < TMUX_MIN.minor)) {
+        out.push(warn(`tmux ${v.major}.${v.minor} (${stripControl(tmux)}) — ccr wants `
+          + `${TMUX_MIN.major}.${TMUX_MIN.minor}+; below 3.1 the sidebar split fails outright`));
+        problems++;
+      } else {
+        out.push(ok(`tmux ${v.major}.${v.minor} (${stripControl(tmux)})`));
+      }
+    }
     out.push(hasFn('bash') ? ok('bash') : warn('bash missing — needed for the launcher'));
 
     const sl = path.join(REPO, 'sidecar', 'ccr-statusline');
@@ -91,6 +129,24 @@ function run(opts = {}) {
     out.push(dim('· ccs not installed (optional — only for `ccr <profile>`)'));
   }
 
+  // Pane wiring. This command exists to diagnose "nothing happens", and a pane
+  // config the user wrote and got wrong is exactly that — the sidecar has room
+  // for a one-line marker and no more. Here there is room for the path, the
+  // reason, and what ccr actually read out of the file, which is the question
+  // someone whose pane never appeared is really asking.
+  const cfg = loadPaneConfig({ env: opts.env, home: homedir });
+  if (cfg.error) {
+    out.push(bad(`pane config: ${cfg.error} — ${stripControl(cfg.configPath)}`));
+    problems++;
+  } else if (cfg.panes.length) {
+    out.push(ok(`pane config: ${cfg.panes.length} pane(s) (${stripControl(cfg.configPath)})`));
+    // The path as ccr resolved it, not as written: a tilde that did not expand
+    // is invisible in the source string and obvious in the resolved one.
+    for (const pane of cfg.panes) out.push(dim(`  · ${stripControl(pane.path)}`));
+  } else {
+    out.push(dim(`· no panes configured (optional — ${stripControl(cfg.configPath)})`));
+  }
+
   // newest captured snapshot across the container. Instances live TWO levels
   // down under the 0.4.0 layout (~/.ccr/instances/<n>/last-status.json) — the
   // one-level scan alone would report "no status captured" while instances run

package/src/launch-win.js

@@ -39,6 +39,109 @@ function isWtArgSafe(value) {
   return !WT_UNSAFE_RE.test(String(value));
 }
 
+// The starting directory is a DIFFERENT problem from the values above, and
+// reusing WT_UNSAFE_RE for it would be a bug in both directions.
+//
+//   `%` is LEGAL in a Windows path (C:\100%done) and harmless here: -d's value
+//   is its own argv token handed to wt, never interpolated into a cmd /c
+//   payload, so cmd's variable expansion never sees it. WT_UNSAFE_RE rejects
+//   `%`, so reusing it would refuse a perfectly valid directory.
+//
+//   `;` is legal in a Windows path AND is wt's own command separator — wt
+//   re-parses its command line, and Node only quotes an argv token that
+//   contains whitespace, so `C:\my;dir` would arrive unquoted and split the
+//   command. WT_UNSAFE_RE does NOT reject `;`, so it misses the one character
+//   that actually matters here.
+//
+// A directory that fails this does not fail the launch: run() drops -d and
+// says where the panes landed (features/windows-launcher.feature, "A launch
+// directory Windows Terminal cannot be given still launches"). Refusing to
+// start over a legal directory name would trade one broken launch for another.
+//
+// MEASURED on Windows 11 (10.0.26200) with scripts/probe-wt.js, because none of
+// this was knowable from the documentation and none of it is covered by CI —
+// every test injects spawnWt, so the suite proves the argv and nothing about
+// what Windows Terminal does with it.
+const WT_PATH_UNSAFE_RE = /[";\r\n]/;
+
+// The backtick used to be in that class and is NOT: a path containing one was
+// passed through and the tab landed exactly where it was asked to. wt is not
+// PowerShell. Refusing it cost a launch that would have worked.
+//
+// The semicolon earns its place — wt splits its own command line on it, and a
+// path containing one opens NO TAB AT ALL.
+
+// Longest path wt will accept as `-d`. Measured: 256 characters opens a tab,
+// 259 opens none — so the true limit is 257 or 258, and 256 is the longest
+// length known to work. Two characters of headroom is not worth another round
+// trip on someone else's machine.
+//
+// This is NOT the filesystem's limit. The machine that measured it has long
+// paths enabled: a 299-character directory was created successfully and then
+// refused a tab. The refusal is Windows Terminal's.
+const WT_PATH_MAX = 256;
+
+// Naming the character rather than echoing it. Two reasons: a raw CR or LF
+// interpolated into a diagnostic would break the diagnostic, and "a semicolon"
+// is what the reader needs anyway — they are looking at the path already.
+/** @type {Record<string, string>} */
+const WT_PATH_CHAR_NAMES = {
+  '"': 'a double quote',
+  ';': 'a semicolon',
+  '\r': 'a carriage return',
+  '\n': 'a newline',
+};
+
+/**
+ * Why `dir` cannot be given to wt as `-d`, or null when it can.
+ *
+ * Every branch here degrades rather than refuses to launch: the panes open in
+ * Windows Terminal's default directory and stderr says so. The point of the
+ * REASON is that "we would not pass this one" is a different sentence for each
+ * cause, and the previous single message named characters the path did not
+ * contain.
+ *
+ * @param {string|null|undefined} dir
+ * @returns {string|null} a clause completing "the path …", or null if usable
+ */
+function wtPathProblem(dir) {
+  if (typeof dir !== 'string' || dir.length === 0) return 'is not a directory ccr could read';
+  // UNC is the dangerous one, and the only case here that is SILENT. The tab
+  // OPENS — cmd.exe simply refuses a UNC working directory and starts in
+  // %SystemRoot% without a word. Measured: \\localhost\c$\Users reported
+  // C:\Windows. Left unhandled, the git pane would describe the project in
+  // full confidence for a terminal sitting in C:\Windows.
+  if (/^[\\/]{2}/.test(dir)) return 'is a UNC path — cmd.exe refuses those and starts in %SystemRoot% without saying so';
+  if (dir.length > WT_PATH_MAX) return `is ${dir.length} characters — Windows Terminal opens no tab at all past ${WT_PATH_MAX}`;
+  const m = WT_PATH_UNSAFE_RE.exec(dir);
+  if (m) return `contains ${WT_PATH_CHAR_NAMES[m[0]] || 'a character'} — Windows Terminal parses it and opens no tab at all`;
+  return null;
+}
+
+/**
+ * What the user could DO about it, when there is anything.
+ *
+ * Only the UNC case has an answer: cmd.exe will take a mapped drive letter
+ * where it refuses the UNC form, so the directory is reachable — just not by
+ * that name. The other causes are the path they have, and telling someone to
+ * rename their project or shorten it below 256 characters is not advice.
+ *
+ * @param {string|null|undefined} dir
+ * @returns {string|null}
+ */
+function wtPathHint(dir) {
+  if (typeof dir !== 'string' || !/^[\\/]{2}/.test(dir)) return null;
+  return 'map the share to a drive letter (net use Z: \\\\server\\share) and run ccr from there';
+}
+
+/**
+ * @param {string|null|undefined} dir
+ * @returns {boolean} true if `dir` can be passed to wt.exe as `-d <dir>`
+ */
+function isWtPathSafe(dir) {
+  return wtPathProblem(dir) === null;
+}
+
 // Upstream default split: the sidecar gets ~34% of the width.
 const DEFAULT_SIDEBAR_PCT = 34;
 
@@ -181,9 +284,16 @@ function sidecarCols(termCols, fracNum, splitFlag) {
  * the case of %, hijack) the cmd /c payload — see isWtArgSafe. run() catches
  * this and reports a clean error instead of spawning a broken command.
  *
+ * `cwd` is the directory BOTH panes start in. Windows Terminal does not
+ * inherit it the way `tmux new-session` does: without `-d` a pane opens in the
+ * WT profile's own `startingDirectory`, which defaults to %USERPROFILE% — so
+ * omitting it silently moved Claude Code out of the user's project. Absent or
+ * unpassable (see isWtPathSafe), `-d` is left off entirely and the panes fall
+ * back to that profile default; run() is what tells the user.
+ *
  * @param {{ ccCmd: string, settingsFile: string, stateDir: string,
  *   node: string, ccrJs: string, sidebarPct?: number, sidebarSide?: string,
- *   termCols?: number, title?: string }} o
+ *   termCols?: number, title?: string, cwd?: string|null }} o
  * @returns {string[]}
  */
 function buildWtArgs(o) {
@@ -227,13 +337,17 @@ function buildWtArgs(o) {
   const cols = sidecarCols(o.termCols, Number(frac), splitFlag);
   const sidecarBody =
     (cols != null ? `set "CCR_SIDECAR_COLS=${cols}"&& ` : '') +
-    `"${node}" "${ccrJs}" sidecar --exit-on-end`;
+    `"${node}" "${ccrJs}" sidecar --exit-on-end --keys`;
   const pane1 = paneCommand(stateDir, sidecarBody);
 
+  // Both panes get the same starting directory, or neither does. `-d` sits
+  // with the other options, before each pane's `cmd` payload.
+  const startIn = isWtPathSafe(o.cwd) ? ['-d', String(o.cwd)] : [];
+
   return [
-    '-w', '0', 'new-tab', '--title', title, 'cmd', '/c', pane0,
+    '-w', '0', 'new-tab', '--title', title, ...startIn, 'cmd', '/c', pane0,
     ';',
-    'split-pane', splitFlag, '-s', frac, 'cmd', '/c', pane1,
+    'split-pane', splitFlag, '-s', frac, ...startIn, 'cmd', '/c', pane1,
   ];
 }
 
@@ -263,7 +377,7 @@ function defaultWhere(name) {
 
 const inject = require('./settings-inject');
 const slots = require('./instance-slot');
-const { ensureSecureDir, recordLaunchDir } = require('./state-dir');
+const { ensureSecureDir, recordLaunchDir, clearLaunchDir } = require('./state-dir');
 
 /**
  * Fill in real-environment implementations for anything the caller didn't
@@ -282,6 +396,15 @@ function withDefaults(deps) {
     // The launcher's own stdout reports the live terminal width — the sidecar's
     // does not, inside its cmd /c pane (see sidecarCols). undefined on non-TTY.
     cols: deps.cols != null ? deps.cols : process.stdout.columns,
+    // The launch directory, injected like every other external effect. It is
+    // the INPUT to that decision, not the answer: run() narrows it to paneCwd —
+    // the directory wt will actually be given — and both the record and `-d`
+    // read that, so the pane and the record cannot disagree about where this
+    // session is. This comment claimed the invariant before the code held it.
+    // process.cwd() throws only if the cwd has been deleted.
+    cwd: deps.cwd != null ? deps.cwd : (() => {
+      try { return process.cwd(); } catch { return null; }
+    })(),
     node: deps.node || process.execPath,
     ccrJs: deps.ccrJs || path.join(__dirname, '..', 'bin', 'ccr.js'),
     out: deps.out || ((s) => { process.stdout.write(s); }),
@@ -292,6 +415,7 @@ function withDefaults(deps) {
     listDir: deps.listDir || defaultListDir,
     ensureDir: deps.ensureDir || ensureSecureDir,
     recordLaunchDir: deps.recordLaunchDir || recordLaunchDir,
+    clearLaunchDir: deps.clearLaunchDir || clearLaunchDir,
     allocateSlot: deps.allocateSlot || ((o) => slots.allocateSlot(o)),
     prepareInstance: deps.prepareInstance
       || ((/** @type {{slot:number,stateDir:string}} */ s, /** @type {any} */ o) =>
@@ -409,11 +533,39 @@ function run(profile, deps = {}, opts = {}) {
 
   // 4. Prepare the per-profile state dir; clear a stale sentinel.
   try { d.ensureDir(st.stateDir); } catch { /* best effort */ }
-  // The tab's stable identity for the git pane. Recorded here because only the
-  // launcher knows where ccr was started (src/state-dir.js).
-  try { d.recordLaunchDir(st.stateDir, process.cwd()); } catch { /* best effort */ }
+  // ONE source for both consumers: the directory the panes will ACTUALLY start
+  // in. Everything below reads paneCwd — the record that gives the git pane its
+  // identity, and wt's `-d` — so the two cannot describe different directories.
+  //
+  // Recording d.cwd unconditionally is what CREATED the divergence rather than
+  // merely failing to prevent it: src/sidecar.js launchDir() PREFERS the record
+  // over the pane's own cwd. readGitRepo self-heals after Claude's first status
+  // tick, but before that tick — the state every tab starts in — the pane draws
+  // the project's repo, branch, tree and history in full confidence for a
+  // session sitting somewhere else entirely.
+  const paneCwd = isWtPathSafe(d.cwd) ? d.cwd : null;
+  if (paneCwd) {
+    try { d.recordLaunchDir(st.stateDir, paneCwd); } catch { /* best effort */ }
+  } else {
+    // Clearing, not skipping. Slots are reused, so the record from whatever ran
+    // in this slot before would otherwise win (src/state-dir.js clearLaunchDir).
+    try { d.clearLaunchDir(st.stateDir); } catch { /* best effort */ }
+  }
   d.removeExited(st.stateDir);
 
+  // The panes must open where `ccr` was run. wt does not inherit that, so it
+  // is passed explicitly below; when the directory cannot be passed the launch
+  // still goes ahead, and saying so is the whole difference between a surprise
+  // and a known limitation.
+  const pathProblem = d.cwd ? wtPathProblem(d.cwd) : null;
+  if (pathProblem) {
+    d.err(`ccr: cannot open the panes in ${d.cwd}\n`);
+    d.err(`     the path ${pathProblem}\n`);
+    d.err("     — they will open in Windows Terminal's default directory instead.\n");
+    const hint = wtPathHint(d.cwd);
+    if (hint) d.err(`     ${hint}.\n`);
+  }
+
   // 5. Inject statusLine via a temp settings FILE (avoids CLI JSON quoting).
   const command = inject.buildStatusLineCommandInline({ node: d.node, ccrJs: d.ccrJs });
   const settingsFile = d.writeSettings(inject.buildSettings(command));
@@ -432,6 +584,7 @@ function run(profile, deps = {}, opts = {}) {
       sidebarSide: d.env.CCR_SIDEBAR_SIDE || DEFAULT_SIDEBAR_SIDE,
       termCols: d.cols,
       title: inst ? inst.title : undefined,
+      cwd: paneCwd,
     });
   } catch (e) {
     d.err(`ccr: ${e instanceof Error ? e.message : String(e)}\n`);
@@ -453,6 +606,8 @@ function run(profile, deps = {}, opts = {}) {
  * @property {NodeJS.ProcessEnv} env
  * @property {string} home
  * @property {number|undefined} cols
+ * @property {string|null} cwd the directory `ccr` was run in — recorded as the
+ *   tab's launch dir AND passed to wt as the panes' starting directory
  * @property {string} node
  * @property {string} ccrJs
  * @property {(s: string) => void} out
@@ -463,6 +618,7 @@ function run(profile, deps = {}, opts = {}) {
  * @property {(dir: string) => string[]} listDir
  * @property {(dir: string) => void} ensureDir
  * @property {(dir: string, cwd: string) => void} recordLaunchDir
+ * @property {(dir: string) => void} clearLaunchDir
  * @property {(o: {profile?: string, env: NodeJS.ProcessEnv, home: string}) => ({slot: number, session: string, stateDir: string, attached: boolean}|{exhausted: true}|null)} allocateSlot
  * @property {(slot: {slot: number, stateDir: string}, o: {profile?: string, name?: string|null}) => {name: string, title: string}} prepareInstance
  * @property {(dir: string) => void} removeExited
@@ -477,6 +633,10 @@ module.exports = {
   DEFAULT_SIDEBAR_SIDE,
   validateProfile,
   isWtArgSafe,
+  isWtPathSafe,
+  wtPathProblem,
+  wtPathHint,
+  WT_PATH_MAX,
   resolveProfileState,
   sidebarFraction,
   sidebarSplitFlag,

package/src/pane-config.js

@@ -64,8 +64,14 @@ function configPath(env) {
  */
 function resolvePanePath(p, baseDir, home) {
   let out = p;
+  // `~\` as well as `~/`: a Windows user writes the separator their shell shows
+  // them, and accepting only the forward slash left `~\tools\blob.json` to
+  // resolve against the config directory — a path that cannot exist, whose only
+  // symptom is a pane that never appears. The tilde means home on the machine
+  // the config was written for; the separator it is followed by does not
+  // change that.
   if (out === '~') out = home;
-  else if (out.startsWith('~/')) out = path.join(home, out.slice(2));
+  else if (out.startsWith('~/') || out.startsWith('~\\')) out = path.join(home, out.slice(2));
   return path.resolve(baseDir, out);
 }
 
@@ -75,22 +81,50 @@ function resolvePanePath(p, baseDir, home) {
  * economy sidebar exactly as before this feature existed.
  *
  * @param {{ env?: Record<string, string|undefined>, home?: string }} [opts]
- * @returns {{ panes: Array<{ path: string, source: string }>, configPath: string }}
+ * @returns {{ panes: Array<{ path: string, source: string }>, configPath: string,
+ *   error: string|null }}
  *   `path` is absolute and ready to read; `source` is the string the user wrote
  *   (what error states name, so the message matches their config, not ours).
+ *   `error` names why a config that EXISTS produced no panes. A config that is
+ *   simply absent is not an error — that is most users — but one the user wrote
+ *   and got wrong must say so somewhere, or the only symptom of a typo is panes
+ *   that never appear.
  */
 function loadPaneConfig(opts = {}) {
   const env = opts.env || process.env;
   const home = opts.home || os.homedir();
   const file = configPath(env);
-  const empty = { panes: [], configPath: file };
+  const empty = { panes: [], configPath: file, error: null };
 
   const raw = readTextCapped(file, MAX_CONFIG_BYTES);
   if (raw == null || !raw.trim()) return empty;
 
+  // A UTF-8 byte-order mark makes JSON.parse throw. PowerShell writes one by
+  // default — `Set-Content`, `Out-File`, and `>` under Windows PowerShell all
+  // do — so a config written the obvious way on Windows is malformed on
+  // arrival, and the only symptom is panes that never appear. Strip it rather
+  // than diagnose it later: there is no config for which a leading BOM is
+  // content. (`.trim()` above already treats a BOM-only file as empty; U+FEFF
+  // is whitespace to the trimmer but not to the parser.)
+  const text = raw.replace(/^\uFEFF/, '');
+
+  // UTF-16 is the likelier Windows mistake, and it is NOT what the strip above
+  // catches. Windows PowerShell 5.1 writes UTF-16LE for `>` and `Out-File` by
+  // default (Set-Content writes ANSI; only `-Encoding utf8` gives the UTF-8 BOM;
+  // PowerShell 7+ writes UTF-8 without one). Read as UTF-8 those bytes survive
+  // trim() and reach the parser as a leading U+FFFD pair and NUL-interleaved
+  // text, so the parse fails and the honest-looking report is "not valid JSON"
+  // — sending someone to hunt for a syntax error in a file whose syntax is
+  // fine. A NUL is never content in a JSON config, so it names the real cause.
+  if (text.includes('\u0000')) {
+    return { ...empty, error: 'looks like UTF-16 — save it as UTF-8' };
+  }
+
   let parsed;
-  try { parsed = JSON.parse(raw); } catch { return empty; }
-  if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.panes)) return empty;
+  try { parsed = JSON.parse(text); } catch { return { ...empty, error: 'not valid JSON' }; }
+  if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed.panes)) {
+    return { ...empty, error: 'no panes array' };
+  }
 
   const baseDir = path.dirname(file);
   /** @type {Array<{ path: string, source: string }>} */
@@ -103,7 +137,7 @@ function loadPaneConfig(opts = {}) {
     if (!source.trim()) continue;
     panes.push({ path: resolvePanePath(source, baseDir, home), source });
   }
-  return { panes, configPath: file };
+  return { panes, configPath: file, error: null };
 }
 
 module.exports = { loadPaneConfig, configPath, resolvePanePath, MAX_CONFIG_BYTES };

package/src/render/economy.js

@@ -10,16 +10,23 @@
 const { clearROI } = require('../burn');
 const { classifyWindows, band } = require('../economy-model');
 const { resolveTheme, lexicon } = require('../theme');
-const { dim, bold, green, red, yellow, cyan, flash, pctColor, bar, tok, fmtMins, fmtReset } = require('./shared');
+const { dim, bold, green, red, yellow, cyan, flash, pctColor, CRIT_PCT, usedLabel, bar, tok, fmtMins, fmtReset } = require('./shared');
+const { liveness } = require('../liveness');
 
 const bandColor = { imminent: red, warn: yellow, ok: cyan };
 
-function wallRow(/** @type {any} */ row, /** @type {any} */ L, /** @type {boolean} */ tick, /** @type {number} */ labelW) {
+function wallRow(/** @type {any} */ row, /** @type {any} */ L, /** @type {boolean} */ tick, /** @type {number} */ labelW, /** @type {boolean} */ stale, /** @type {number} */ numW) {
   // Truncate, don't round: Claude's own surfaces (`/usage`, claude.ai usage)
   // floor the fractional `used_percentage` (e.g. 41.6 → "41%"). Math.round here
   // read ~1pt high on values past the half-point. Display only — the burn/ROI
   // math below still uses the raw fractional `row.est.usedPct`.
+  //
+  // `used` (whole %) drives the bar fill and the colour band; `usedTxt` is the
+  // number actually shown, which gains one truncated decimal in the critical
+  // zone. Both floor, so they can never disagree about which side of a whole
+  // number the reading falls on.
   const used = Math.floor(row.est.usedPct);
+  const usedTxt = usedLabel(row.est.usedPct);
   const ml = row.est.minutesLeft;
   const b = band(ml);
   // Per-row colour dot: green when the window resets before you'd hit it,
@@ -37,7 +44,11 @@ function wallRow(/** @type {any} */ row, /** @type {any} */ L, /** @type {boolea
   const leftTxt = (ml != null ? '~' + fmtMins(ml) : '—').padEnd(7);
   const left = row.binding ? bold(leftTxt) : dim(leftTxt);
   const resets = row.reset != null ? dim('resets ' + fmtReset(row.reset)) : '';
-  const meter = pctColor(used)(bar(used)) + ' ' + String(used).padStart(2) + '% used';
+  // A stale snapshot dims the figure so a number frozen between chat rounds
+  // never reads as live. The bar colour stays, so the band still pops, and the
+  // sidecar appends the "updated …" note that says why (see src/liveness.js).
+  const numTxt = usedTxt.padStart(numW) + '% used';
+  const meter = pctColor(used)(bar(used)) + ' ' + (stale ? dim(numTxt) : numTxt);
   const main = '  ' + dot + ' ' + label + ' ' + left + ' ' + meter + '  ' + resets;
 
   // The binding window's "wall" call-out drops to its own indented line below —
@@ -51,16 +62,30 @@ function wallRow(/** @type {any} */ row, /** @type {any} */ L, /** @type {boolea
 
 /**
  * @param {any} view normalized economy data
- * @param {{ theme?: 'plain'|'mary', now?: Date, tick?: boolean, env?: any }} [opts]
+ * @param {{ theme?: 'plain'|'mary', now?: Date, tick?: boolean, env?: any,
+ *   ageMs?: number, staleMs?: number }} [opts]
+ *   ageMs/staleMs: how old the captured snapshot is, and the threshold past
+ *   which it counts as stale. The snapshot only refreshes per chat round, so
+ *   between rounds it ages — past the threshold the used figures dim, so they
+ *   read as last-known rather than live. The threshold decision itself stays
+ *   in src/liveness.js, which also owns the "updated …" note the sidecar
+ *   appends; this renderer only asks whether the data is stale.
  * @returns {string}
  */
 function renderEconomy(view, opts = {}) {
   const themeName = opts.theme || resolveTheme(opts.now, opts.env);
   const L = lexicon(themeName);
   const tick = !!opts.tick;
+  const stale = !!liveness({ ageMs: opts.ageMs ?? 0, staleMs: opts.staleMs }).marker;
   const out = [bold('economy') + dim('   ' + (view.model || '')), ''];
 
   const { rows, next } = classifyWindows(view);
+  // The used% column widens to fit a decimal only when some row actually has
+  // one. Widening it unconditionally would shift every meter two columns right
+  // for the whole time you are nowhere near the wall — which both costs a
+  // narrow sidebar two columns it needs and blunts the point of the decimal,
+  // whose appearing is itself the "you are in the zone" cue.
+  const numW = rows.some((/** @type {any} */ r) => r.est.usedPct >= CRIT_PCT && r.est.usedPct < 100) ? 4 : 2;
   // Cap the label column. `labelW` multiplies: every row pads to it, so cost is
   // rows × longest-label, and BOTH come from the snapshot's rate_limits keys. A
   // planted file with many buckets and one very long key built a string large
@@ -86,7 +111,7 @@ function renderEconomy(view, opts = {}) {
   }
   out.push('');
 
-  for (const r of rows) out.push(wallRow(r, L, tick, labelW));
+  for (const r of rows) out.push(wallRow(r, L, tick, labelW, stale, numW));
   if (rows.length) out.push('');
 
   // CLEAR — plain language, framed against the binding wall, only when it looms.

package/src/render/shared.js

@@ -16,6 +16,26 @@ const flash = (/** @type {boolean} */ tick, /** @type {string} */ s) => (tick ?
 
 const pctColor = (/** @type {number} */ p) => (p >= 75 ? red : p >= 60 ? yellow : green);
 
+// At/above this used%, surface one extra digit of Claude's own (fractional)
+// `used_percentage`. Near the wall the next tenth is a decision input; below it
+// it is noise. A decimal appearing IS the "you are in the zone" salience signal.
+const CRIT_PCT = 95;
+
+/**
+ * Used% display string. Below the critical zone: the whole number. In the zone
+ * (and under 100): one TRUNCATED decimal — the same downward direction as the
+ * integer floor, so `floor(shown)` still equals what `/usage` reports. We never
+ * tick above Claude's own number, only out-resolve it. The +1e-9 guards float
+ * representation: 98.7 * 10 is 986.9999… and would otherwise truncate to 98.6.
+ * @param {number} pct raw fractional used_percentage
+ * @returns {string}
+ */
+function usedLabel(pct) {
+  if (pct < CRIT_PCT || pct >= 100) return String(Math.floor(pct));
+  const tenths = Math.floor(pct * 10 + 1e-9);
+  return `${Math.floor(tenths / 10)}.${tenths % 10}`;
+}
+
 function bar(/** @type {number} */ p, w = 10) {
   const f = Math.max(0, Math.min(w, Math.round((p / 100) * w)));
   return '▓'.repeat(f) + '░'.repeat(w - f);
@@ -186,6 +206,6 @@ function ellipsize(s, cols) {
 }
 
 module.exports = {
-  e, dim, bold, green, red, yellow, cyan, flash, pctColor, bar, clampVisible, tok, fmtMins, fmtReset,
+  e, dim, bold, green, red, yellow, cyan, flash, pctColor, CRIT_PCT, usedLabel, bar, clampVisible, tok, fmtMins, fmtReset,
   charWidth, visibleWidth, ellipsize,
 };

package/src/render/statusline.js

@@ -4,7 +4,7 @@
 // Plain text (no ANSI) so it renders cleanly wherever the status line appears.
 
 const { windowEstimate, binding } = require('../burn');
-const { fmtMins } = require('./shared');
+const { fmtMins, usedLabel, CRIT_PCT } = require('./shared');
 
 /**
  * Deterministic middle ellipsis: the same input shortens the same way at
@@ -66,12 +66,19 @@ function renderStatusline(view, identity = {}) {
     const b = binding(live);
     if (b && b.minutesLeft != null) {
       const row = rows.find((r) => r.key === b.window);
+      const label = row ? row.label : b.window;
+      // Progressive disclosure: the one-line summary earns the precise used%
+      // ONLY in the critical zone, and truncated, so floor() still matches
+      // /usage. Below the zone the line stays a single glanceable beat — the
+      // time-to-limit already answers "am I near the wall?", and a percentage
+      // that is always present stops being a signal when it starts to matter.
+      const pct = row && row.est.usedPct >= CRIT_PCT ? ` ${usedLabel(row.est.usedPct)}%` : '';
       if (b.minutesLeft <= 30) {
         // "About to hit the wall" outranks orientation for the next thing the
         // user types: the warning jumps ahead of everything, identity included.
-        parts.unshift(`⚠ ${row ? row.label : b.window} ~${fmtMins(b.minutesLeft)}`);
+        parts.unshift(`⚠ ${label}${pct} ~${fmtMins(b.minutesLeft)}`);
       } else {
-        parts.push(`${row ? row.label : b.window} ~${fmtMins(b.minutesLeft)}`);
+        parts.push(`${label}${pct} ~${fmtMins(b.minutesLeft)}`);
       }
     } else {
       parts.push('within limits');

package/src/sidecar-keys.js

@@ -41,15 +41,28 @@ const path = require('node:path');
 const { spawn } = require('node:child_process');
 const { cycleView } = require('./cycle-view');
 
-// F3 in the two encodings terminals actually send — SS3 on xterm and VS Code's
-// xterm.js, CSI on the Linux console — plus SPACE.
+// F3 in every encoding a terminal actually sends it, plus SPACE.
+//
+//   \x1bOR    SS3. What xterm, screen, tmux and vt220 all send (infocmp: kf3).
+//   \x1b[[C   The Linux console — infocmp gives `linux: kf3=\E[[C`, and it is
+//             the ONLY entry that differs. It is also what arrives on Windows
+//             from Node before v22.17.0 / v24.2.0: until "tty: use terminal VT
+//             mode on Windows" (db2aae802) setRawMode passed UV_TTY_MODE_RAW,
+//             where libuv translates the keypress itself rather than letting
+//             the terminal's own sequence through. From UV_TTY_MODE_RAW_VT on
+//             it sets ENABLE_VIRTUAL_TERMINAL_INPUT and Windows Terminal sends
+//             SS3 like everyone else. Which of the two arrives on Windows is
+//             therefore a property of the NODE VERSION, not the terminal.
+//   \x1b[13~  The CSI-tilde form VS Code's xterm.js sends. An earlier version
+//             of this comment called it the Linux console encoding; it is not,
+//             and the console form above was missing entirely.
 //
 // Space is not a fallback for tidiness: an editor that keeps F3 for its own
 // "find next" while the terminal is focused would otherwise leave this pane with
 // no key at all, and that behavior differs across VS Code, Cursor, Positron and
 // Antigravity. The pane is dedicated to the sidecar, so nothing else there is
 // waiting for a space.
-const CYCLE_KEYS = ['\x1bOR', '\x1b[13~', ' '];
+const CYCLE_KEYS = ['\x1bOR', '\x1b[[C', '\x1b[13~', ' '];
 
 // In raw mode Ctrl-C arrives as a BYTE, not a signal. Without handling it the
 // pane could not be closed from the keyboard at all.

package/src/sidecar.js

@@ -167,6 +167,7 @@ function updateFeed(tpath) {
 
 const dim = (/** @type {string} */ s) => `\x1b[2m${s}\x1b[0m`;
 const bold = (/** @type {string} */ s) => `\x1b[1m${s}\x1b[0m`;
+const yellow = (/** @type {string} */ s) => `\x1b[33m${s}\x1b[0m`;
 
 let prev = '';
 function draw(/** @type {string} */ s) {
@@ -204,7 +205,15 @@ function sessionDir(stateDir) {
 /**
  * The directory ccr was LAUNCHED in — the tab's stable identity. Written by the
  * launcher (src/state-dir.js: recordLaunchDir); the sidecar's own cwd is the
- * fallback, which is right under tmux and wt.exe where the pane inherits it.
+ * fallback.
+ *
+ * That fallback is right under tmux, where `new-session` inherits the caller's
+ * cwd. It is NOT free under wt.exe: a pane opens in the Windows Terminal
+ * profile's own startingDirectory unless the launcher passes `-d`, which it
+ * now does (src/launch-win.js: buildWtArgs). This comment previously claimed
+ * wt.exe inherited it, and that claim was the only place the assumption
+ * surfaced anywhere in the codebase — see features/windows-launcher.feature,
+ * "Claude Code opens in the directory ccr was launched from".
  *
  * `process.cwd()` throws when the directory it names has been deleted, which is
  * not hypothetical here: it is the "repository is deleted while the pane is
@@ -263,7 +272,8 @@ function composeFrame(stateDir, opts = {}) {
   // External panes. Config is re-read per tick so adding a pane needs no
   // relaunch, and it is best-effort: a broken config costs the panes, never the
   // panel (loadPaneConfig is total — see src/pane-config.js).
-  const panes = opts.panes || loadPaneConfig().panes;
+  const cfg = opts.panes ? { panes: opts.panes, error: null } : loadPaneConfig();
+  const panes = cfg.panes;
   // View order: 0 economy, 1 the git pane, 2… external panes. The git pane is
   // BUILT IN and therefore always in the cycle — including in a directory that
   // is not a repository at all, where it says so. A view that appeared and
@@ -341,6 +351,12 @@ function composeFrame(stateDir, opts = {}) {
   if (!raw.trim()) return clamp(dim('ccr · waiting for the first status tick…') + '\n');
   let state;
   try { state = JSON.parse(raw); } catch { return clamp(dim('ccr · status unreadable') + '\n'); }
+  // Snapshot age drives BOTH the dimming of the used figures inside the panel
+  // and the freshness marker appended below — read ONCE so the two can never
+  // disagree about whether what you are looking at is live. An unreadable mtime
+  // reads as fresh: a missing timestamp is not evidence of staleness.
+  let ageMs = 0;
+  try { ageMs = Math.max(0, now - fs.statSync(snapshot).mtimeMs); } catch { /* unknown → fresh */ }
   let out;
   try {
     // 5h/weekly are ACCOUNT-WIDE but captured per-profile, so an idle sibling's
@@ -348,7 +364,7 @@ function composeFrame(stateDir, opts = {}) {
     // SAME account (see src/account-limits.js) before rendering — best-effort, and
     // strictly guarded so a different account is never mixed in.
     const reconciled = { ...state, rate_limits: freshenAccountLimits(state.rate_limits, stateDir, opts.home ? { home: opts.home } : {}) };
-    out = renderEconomy(normalizeStatus(reconciled), { tick: Math.floor(now / 1000) % 2 === 0 });
+    out = renderEconomy(normalizeStatus(reconciled), { tick: Math.floor(now / 1000) % 2 === 0, ageMs });
     // ccr's own view is position 1 of the cycle, named only when the cycle is
     // long enough for the position to tell you something (see showPosition).
     if (showPosition) out = out.replace(/\n/, dim(`   ${positionAt(0)}`) + '\n');
@@ -375,11 +391,17 @@ function composeFrame(stateDir, opts = {}) {
   // quiet "updated Nm ago" so a stale panel reads as stale rather than broken —
   // otherwise a long agent run (or a CC statusLine that stopped firing) looks like
   // the sidecar just froze. See src/liveness.js + features/liveness.feature.
-  try {
-    const ageMs = now - fs.statSync(snapshot).mtimeMs;
-    const mark = liveness({ exited: false, ageMs }).marker;
-    if (mark) out += (out.endsWith('\n') ? '' : '\n') + '  ' + dim('· ' + mark);
-  } catch { /* snapshot mtime unknown → no marker */ }
+  const mark = liveness({ exited: false, ageMs }).marker;
+  if (mark) out += (out.endsWith('\n') ? '' : '\n') + '  ' + dim('· ' + mark);
+  // A config the user wrote and got wrong used to cost the panes in silence —
+  // the panel rendered exactly as it does for someone who configured nothing,
+  // so a typo was indistinguishable from never having tried. Name it here and
+  // send them to `ccr doctor`, which has room for the path and the reason.
+  // Still never fatal: the panel is whole, only the panes are missing.
+  if (cfg.error) {
+    out += (out.endsWith('\n') ? '' : '\n')
+      + '  ' + yellow('· config: ' + cfg.error) + dim(' — see `ccr doctor`');
+  }
   return clamp(out.endsWith('\n') ? out : out + '\n');
 }
 

package/src/state-dir.js

@@ -61,4 +61,21 @@ function recordLaunchDir(dir, cwd) {
   } catch { /* best effort */ }
 }
 
-module.exports = { ensureSecureDir, recordLaunchDir };
+/**
+ * Forget the recorded launch directory.
+ *
+ * NOT the same as declining to write one. Slots are REUSED, so a record left by
+ * whatever ran in this slot before would still be sitting there — and
+ * src/sidecar.js launchDir() PREFERS the record over the pane's own cwd, so a
+ * stale one wins outright. The launcher calls this whenever it could not
+ * deliver the directory to the panes, which is the only moment it knows the
+ * record would be a lie.
+ *
+ * @param {string} dir  The state directory.
+ */
+function clearLaunchDir(dir) {
+  const path = require('node:path');
+  try { fs.rmSync(path.join(dir, 'launch-cwd'), { force: true }); } catch { /* best effort */ }
+}
+
+module.exports = { ensureSecureDir, recordLaunchDir, clearLaunchDir };