claude-mission-control 1.22.0 → 1.23.0

package/README.md

@@ -311,7 +311,8 @@ Edit `ignore.json` — an array of absolute path prefixes. A project is hidden i
 | `CLAUDE_DASH_HOST` | `127.0.0.1` | Bind address — see below before changing |
 | `CLAUDE_DASH_DEMO` | unset | `1` = serve believable fake data (screenshots, trying it without Claude history) |
 | `CLAUDE_DASH_OPEN` | unset | `1` = open the browser on startup (what `npx` sets for you) |
-| `CLAUDE_DASH_CONFIG_DIR` | repo dir | Where config.json/names.json/ignore.json live (auto-falls back to `~/.config/claude-dashboard`) |
+| `CLAUDE_DASH_CONFIG_DIR` | repo dir (git checkout) | Where config.json/names.json/ignore.json/chats.json live. Non-git installs (npm, npx) use `~/.config/claude-dashboard`; files from older versions are copied there on first run |
+| `CLAUDE_DASH_ALLOWED_HOSTS` | — | Comma-separated extra hostnames accepted in the Host header, e.g. your MagicDNS name behind `tailscale serve`. Anything else gets 403 (DNS-rebinding protection) |
 
 The server binds to `127.0.0.1` only by default.
 

package/lib/chats.js

@@ -95,7 +95,15 @@ function readChats() {
 // Normalize the raw export and persist. Returns the imported count.
 function saveChats(raw) {
   const chats = normalizeChats(raw);
-  fs.writeFileSync(CHATS_FILE, JSON.stringify(chats));
+  // Atomic, like config: a failed write keeps the previous import intact.
+  const tmp = `${CHATS_FILE}.${process.pid}.tmp`;
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(chats));
+    fs.renameSync(tmp, CHATS_FILE);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* already gone */ }
+    throw e;
+  }
   cache = { mtimeMs: 0, chats: [] }; // next read picks up the new file
   return chats.length;
 }

package/lib/collector.js

@@ -7,7 +7,7 @@ const { readQuota } = require('./quota');
 const { fetchOauthUsage } = require('./usage');
 const { readRegistry } = require('./registry');
 const { refreshHistory, activityBuckets, weekHourHeat } = require('./history');
-const { scanAllTranscripts, scanFile, groupByProject, sessionTitle, sessionKind, combinedUsage, combinedDays, dailyCostSeries, subagentSummary, usageBreakdown, dayKey, reasonText, contextSummary, toolSummary } = require('./transcripts');
+const { scanAllTranscripts, scanFile, groupByProject, sessionTitle, sessionKind, combinedUsage, combinedDays, dailyCostSeries, subagentSummary, usageBreakdown, dayKey, reasonText, contextSummary, toolSummary, scannerHealth } = require('./transcripts');
 const { collectGitStatus } = require('./gitstatus');
 const { friendlyName } = require('./names');
 const { isIgnored } = require('./ignore');
@@ -165,6 +165,13 @@ class Collector {
     const sessions = await scanAllTranscripts();
     this.raw.transcriptGroups = groupByProject(sessions);
     this.raw.metaBySession = new Map(sessions.map((m) => [m.sessionId, m]));
+    // Say so once per distinct problem, not every 15s scan.
+    const warnings = scannerHealth(sessions);
+    const key = warnings.join('|');
+    if (key !== this.scanWarningKey) {
+      this.scanWarningKey = key;
+      for (const w of warnings) this.noteError('scan', w);
+    }
     this.raw.history = await refreshHistory();
     this.raw.teams = await readTeams();
     // Task summaries for recent sessions (readTasks caches by dir mtime).

package/lib/config.js

@@ -9,25 +9,48 @@ const { loadPricing } = require('./pricing');
 
 const ROOT = path.join(__dirname, '..');
 
-// Config lives beside the code when that's writable (git checkout — the
-// original layout). Under npx / a global npm install the package dir may be
-// read-only or ephemeral, so fall back to ~/.config/claude-dashboard.
-// CLAUDE_DASH_CONFIG_DIR overrides both.
+// Every user file the dashboard keeps. All live in one directory.
+const USER_FILES = ['config.json', 'names.json', 'ignore.json', 'chats.json'];
+
+// Pure: where user files live. CLAUDE_DASH_CONFIG_DIR wins. A writable git
+// checkout keeps them beside the code (the original layout; they're
+// gitignored). Anything else — a global npm install, the npx cache, brew, an
+// unpacked zip — is a tree a package manager or the self-updater may
+// replace wholesale, so user data goes to ~/.config/claude-dashboard.
+function chooseConfigDir({ env, rootIsGit, rootWritable, root, home }) {
+  if (env) return { dir: env, migrateFrom: null };
+  if (rootIsGit && rootWritable) return { dir: root, migrateFrom: null };
+  return { dir: path.join(home, '.config', 'claude-dashboard'), migrateFrom: root };
+}
+
 function resolveConfigDir() {
-  const os = require('os');
-  const env = process.env.CLAUDE_DASH_CONFIG_DIR;
-  if (env) {
-    fs.mkdirSync(env, { recursive: true });
-    return env;
-  }
+  let rootWritable = true;
   try {
     fs.accessSync(ROOT, fs.constants.W_OK);
-    return ROOT;
   } catch {
-    const dir = path.join(os.homedir(), '.config', 'claude-dashboard');
-    fs.mkdirSync(dir, { recursive: true });
-    return dir;
+    rootWritable = false;
   }
+  const { dir, migrateFrom } = chooseConfigDir({
+    env: process.env.CLAUDE_DASH_CONFIG_DIR,
+    rootIsGit: fs.existsSync(path.join(ROOT, '.git')),
+    rootWritable,
+    root: ROOT,
+    home: require('os').homedir(),
+  });
+  fs.mkdirSync(dir, { recursive: true });
+  // Older versions wrote user files into the package dir even for npm
+  // installs. Copy (never move) any that aren't in the new home yet, so the
+  // first run on this version keeps names, notes, pins and the phone key.
+  if (migrateFrom) {
+    for (const f of USER_FILES) {
+      const from = path.join(migrateFrom, f);
+      const to = path.join(dir, f);
+      try {
+        if (fs.existsSync(from) && !fs.existsSync(to)) fs.copyFileSync(from, to);
+      } catch { /* unreadable old file: start fresh rather than fail to boot */ }
+    }
+  }
+  return dir;
 }
 const CONFIG_DIR = resolveConfigDir();
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
@@ -55,14 +78,46 @@ function readJson(file, fallback) {
   }
 }
 
+// For read-modify-write paths. A missing file is a fresh start; a file that
+// exists but won't parse (hand-edit typo, partial write from an older
+// version) must NOT be treated as empty — writing back would wipe every
+// name, note, pin and the phone key. Refuse, and say which file.
+function readJsonForWrite(file, fallback) {
+  let text;
+  try {
+    text = fs.readFileSync(file, 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') return fallback;
+    throw e;
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new Error(`${path.basename(file)} is not valid JSON; fix or remove ${file} and try again`);
+  }
+}
+
+// Atomic: write a sibling temp file, then rename over the target. A crash
+// or full disk mid-write leaves the old file intact instead of truncated.
 function writeJson(file, value) {
-  fs.writeFileSync(file, JSON.stringify(value, null, 2) + '\n');
+  const tmp = `${file}.${process.pid}.tmp`;
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + '\n');
+    fs.renameSync(tmp, file);
+  } catch (e) {
+    try { fs.unlinkSync(tmp); } catch { /* already gone */ }
+    throw e;
+  }
 }
 
 function readConfig() {
   return { ...DEFAULTS, ...readJson(CONFIG_FILE, {}) };
 }
 
+function readConfigForWrite() {
+  return { ...DEFAULTS, ...readJsonForWrite(CONFIG_FILE, {}) };
+}
+
 // Rate table: Claude Code's managed `modelPricing` first (contracted rates
 // an admin deployed), then the same key in our config.json, then bundled
 // list prices. Both files are small; read fresh every call like readConfig.
@@ -72,7 +127,7 @@ function readPricing() {
 }
 
 function updateConfig(patch) {
-  const next = { ...readConfig() };
+  const next = readConfigForWrite();
   if (typeof patch.terminal === 'string') next.terminal = patch.terminal;
   if (typeof patch.notifications === 'boolean') next.notifications = patch.notifications;
   if (typeof patch.usageApi === 'boolean') next.usageApi = patch.usageApi;
@@ -96,7 +151,7 @@ function updateConfig(patch) {
 
 // Add or remove a project from the notification mute list.
 function setProjectMuted(projectPath, muted) {
-  const next = { ...readConfig() };
+  const next = readConfigForWrite();
   const key = canonicalize(projectPath);
   const list = (next.mutedProjects || []).filter((p) => canonicalize(p).toLowerCase() !== key.toLowerCase());
   if (muted) list.push(key);
@@ -107,7 +162,7 @@ function setProjectMuted(projectPath, muted) {
 
 // Pin or unpin a session for the pinned strip. Returns the new pinned state.
 function togglePin(sessionId) {
-  const next = { ...readConfig() };
+  const next = readConfigForWrite();
   const list = next.pinnedSessions || [];
   const has = list.includes(sessionId);
   next.pinnedSessions = has ? list.filter((id) => id !== sessionId) : [...list, sessionId];
@@ -126,7 +181,7 @@ function applySessionName(sessionNames, sessionId, name) {
 }
 
 function setSessionName(sessionId, name) {
-  const next = { ...readConfig() };
+  const next = readConfigForWrite();
   next.sessionNames = applySessionName(next.sessionNames, sessionId, name);
   writeJson(CONFIG_FILE, next);
   return next.sessionNames[sessionId] || '';
@@ -144,7 +199,7 @@ function applySessionNote(sessionNotes, sessionId, note) {
 }
 
 function setSessionNote(sessionId, note) {
-  const next = { ...readConfig() };
+  const next = readConfigForWrite();
   next.sessionNotes = applySessionNote(next.sessionNotes, sessionId, note);
   writeJson(CONFIG_FILE, next);
   return next.sessionNotes[sessionId] || '';
@@ -155,7 +210,7 @@ function readNames() {
 }
 
 function setName(projectPath, name) {
-  const names = readNames();
+  const names = readJsonForWrite(NAMES_FILE, {});
   const key = canonicalize(projectPath);
   // Stored keys may differ in case from the canonical path — replace any match.
   for (const k of Object.keys(names)) {
@@ -171,7 +226,8 @@ function readIgnores() {
 }
 
 function addIgnore(prefix) {
-  const list = readIgnores();
+  const raw = readJsonForWrite(IGNORE_FILE, []);
+  const list = Array.isArray(raw) ? raw : [];
   const key = canonicalize(prefix);
   if (!list.some((p) => canonicalize(p).toLowerCase() === key.toLowerCase())) {
     list.push(key);
@@ -181,7 +237,8 @@ function addIgnore(prefix) {
 
 function removeIgnore(prefix) {
   const key = canonicalize(prefix).toLowerCase();
-  writeJson(IGNORE_FILE, readIgnores().filter((p) => canonicalize(p).toLowerCase() !== key));
+  const raw = readJsonForWrite(IGNORE_FILE, []);
+  writeJson(IGNORE_FILE, (Array.isArray(raw) ? raw : []).filter((p) => canonicalize(p).toLowerCase() !== key));
 }
 
 // Walk PATH for a binary; `exists` injected so the walk is unit-testable.
@@ -257,6 +314,9 @@ module.exports = {
   readConfig,
   readPricing,
   configDir: () => CONFIG_DIR,
+  chooseConfigDir,
+  writeJson,
+  readJsonForWrite,
   findOnPath,
   detectClaudeApp,
   resolvedTerminal,

package/lib/guard.js

@@ -0,0 +1,58 @@
+'use strict';
+// Request guards for the main listener. Pure, so they're unit-testable.
+//
+// DNS rebinding: a page on evil.example can re-point its own name at
+// 127.0.0.1 and then read our GET routes as same-origin. The browser still
+// sends `Host: evil.example`, so an EXACT hostname match on the Host header
+// is the defence. A prefix match is not: `localhost.evil.example` is a name
+// an attacker controls.
+
+const LOOPBACK_NAMES = new Set(['127.0.0.1', 'localhost', '[::1]']);
+
+// Hostname part of a Host header value, lowercased: 'LocalHost:4517' ->
+// 'localhost', '[::1]:4517' -> '[::1]'. Empty string for garbage.
+function hostnameOf(hostHeader) {
+  const h = String(hostHeader || '').trim().toLowerCase();
+  if (!h) return '';
+  if (h.startsWith('[')) {
+    const end = h.indexOf(']');
+    return end === -1 ? '' : h.slice(0, end + 1);
+  }
+  const colon = h.indexOf(':');
+  return colon === -1 ? h : h.slice(0, colon);
+}
+
+// `bindHost` is what the server listens on. Accepted: loopback names, any
+// name the user listed in `extraHosts` (CLAUDE_DASH_ALLOWED_HOSTS — e.g. the
+// MagicDNS name `tailscale serve` forwards), and, when bound off-loopback,
+// the bind address itself. A wildcard bind (0.0.0.0) adds nothing: list names.
+function allowedHost(hostHeader, bindHost, extraHosts = []) {
+  const name = hostnameOf(hostHeader);
+  if (!name) return false;
+  if (LOOPBACK_NAMES.has(name)) return true;
+  if (extraHosts.some((h) => hostnameOf(h) === name)) return true;
+  return bindHost !== '127.0.0.1' && bindHost !== '0.0.0.0' && bindHost !== '::' && !!bindHost && name === bindHost.toLowerCase();
+}
+
+// For state-changing routes. Browsers always send Origin on cross-origin
+// POSTs; a missing Origin means a non-browser client (curl), which the Host
+// check has already vetted. A present Origin must name exactly the host the
+// request was sent to, so a page can never POST across origins, whatever
+// the bind address.
+function sameOrigin(originHeader, hostHeader) {
+  if (originHeader === undefined) return true;
+  let origin;
+  try {
+    origin = new URL(String(originHeader));
+  } catch {
+    return false; // includes the literal 'null' origin from sandboxed frames
+  }
+  if (origin.protocol !== 'http:' && origin.protocol !== 'https:') return false;
+  return origin.host.toLowerCase() === String(hostHeader || '').trim().toLowerCase();
+}
+
+function parseAllowedHosts(env) {
+  return String(env || '').split(',').map((s) => s.trim()).filter(Boolean);
+}
+
+module.exports = { hostnameOf, allowedHost, sameOrigin, parseAllowedHosts };

package/lib/ignore.js

@@ -6,7 +6,7 @@ const fs = require('fs');
 const path = require('path');
 const { canonicalize } = require('./paths');
 
-const IGNORE_FILE = path.join(__dirname, '..', 'ignore.json');
+const IGNORE_FILE = path.join(require('./config').configDir(), 'ignore.json');
 
 let cache = { mtimeMs: 0, prefixes: [] };
 

package/lib/names.js

@@ -4,7 +4,7 @@ const fs = require('fs');
 const path = require('path');
 const { canonicalize } = require('./paths');
 
-const NAMES_FILE = path.join(__dirname, '..', 'names.json');
+const NAMES_FILE = path.join(require('./config').configDir(), 'names.json');
 
 let cache = { mtimeMs: 0, map: {} };
 

package/lib/transcripts.js

@@ -193,6 +193,8 @@ async function scanFile(abs, sessionIdFromName) {
   meta.context = scan.lastContext || null;
   meta.tools = scan.tools || null;
   meta.lastTool = scan.lastTool || null;
+  meta.badLines = scan.badLines || 0;
+  meta.size = st.size;
 
   cache.set(abs, { mtimeMs: st.mtimeMs, size: st.size, meta, scan });
   return meta;
@@ -220,13 +222,20 @@ async function incrementalScan(abs, size, scan) {
   }
 }
 
+// A line we picked out by its "type" marker but couldn't parse. Lines are
+// only scanned once complete, so this is real damage or a format change —
+// counted so the collector can say so instead of silently reading $0.
+function badLine(scan) {
+  scan.badLines = (scan.badLines || 0) + 1;
+}
+
 function scanLine(line, scan) {
   if (line.includes('"type":"ai-title"')) {
     try {
       const rec = JSON.parse(line);
       if (rec.aiTitle) scan.aiTitle = rec.aiTitle;
     } catch {
-      /* ignore */
+      badLine(scan);
     }
   } else if (line.includes('"type":"assistant"') && line.includes('"usage"')) {
     try {
@@ -253,7 +262,7 @@ function scanLine(line, scan) {
         addUsage(day, model, m.usage);
       }
     } catch {
-      /* ignore */
+      badLine(scan);
     }
   } else if (line.includes('"type":"file-history-delta"')) {
     try {
@@ -261,7 +270,7 @@ function scanLine(line, scan) {
       const p = realPathOf(rec.trackingPath, rec.backup);
       if (p) recordChange(scan.changes || (scan.changes = {}), p, rec.backup);
     } catch {
-      /* ignore */
+      badLine(scan);
     }
   } else if (line.includes('"type":"file-history-snapshot"')) {
     try {
@@ -272,14 +281,14 @@ function scanLine(line, scan) {
         if (p) recordChange(scan.changes || (scan.changes = {}), p, backup);
       }
     } catch {
-      /* ignore */
+      badLine(scan);
     }
   } else if (line.includes('"is_error":true') && line.includes('"tool_use_id"')) {
     try {
       const rec = JSON.parse(line);
       if (rec.type === 'user' && rec.message) countToolErrors(scan, rec.message.content);
     } catch {
-      /* ignore */
+      badLine(scan);
     }
   } else if (scan.lastAssistantTs && line.includes('"type":"user"') && !line.includes('"tool_use_id"')) {
     // Your next real prompt after assistant output: bucket the gap.
@@ -296,7 +305,7 @@ function scanLine(line, scan) {
       const waits = scan.waits || (scan.waits = [0, 0, 0, 0]);
       waits[gap < 30000 ? 0 : gap < 120000 ? 1 : gap < 600000 ? 2 : 3]++;
     } catch {
-      /* ignore */
+      badLine(scan);
     }
   }
 }
@@ -700,6 +709,29 @@ function sessionTitle(meta, customNames) {
   return { title: meta.sessionId.slice(0, 8), source: 'session-id' };
 }
 
+// The scanner reads an undocumented format by substring match. When Claude
+// Code changes it, nothing throws: costs just read $0. Pure check over a
+// scan's metas; returns warning strings for the settings diagnostics.
+//  - drift: several recent, sizeable, interactive transcripts with no usage
+//    at all. Real sessions always have assistant turns; a format change is
+//    the likely cause.
+//  - damage: lines that carried a known "type" marker but didn't parse.
+const DRIFT_MIN_BYTES = 64 * 1024;
+const DRIFT_MIN_SESSIONS = 3;
+const BAD_LINE_WARN = 5;
+function scannerHealth(metas, now = Date.now()) {
+  const out = [];
+  const weekAgo = now - 7 * 86400000;
+  const recent = (metas || []).filter((m) => m.lastActivityAt >= weekAgo && (m.size || 0) >= DRIFT_MIN_BYTES && m.entrypoint !== 'sdk-cli');
+  const empty = recent.filter((m) => !Object.keys(m.usage || {}).length);
+  if (recent.length >= DRIFT_MIN_SESSIONS && empty.length === recent.length) {
+    out.push(`no token usage found in ${empty.length} recent transcripts — Claude Code's transcript format may have changed, so costs and limits will read low`);
+  }
+  const bad = (metas || []).reduce((n, m) => n + (m.badLines || 0), 0);
+  if (bad >= BAD_LINE_WARN) out.push(`${bad} transcript lines could not be parsed — some costs or titles may be missing`);
+  return out;
+}
+
 // Group scanned sessions by canonical project root (worktrees fold in).
 function groupByProject(sessions) {
   const byProject = new Map(); // lowercase root -> { path, sessions: [] }
@@ -723,5 +755,5 @@ function groupByProject(sessions) {
 module.exports = {
   scanAllTranscripts, scanFile, groupByProject, sessionTitle, tidyPromptTitle, sessionKind, combinedUsage, mergeUsage,
   scanLine, mergeDays, combinedDays, dailyCostSeries, subagentSummary, usageBreakdown, dayKey, contextSummary, toolSummary,
-  waitingReason, reasonText, shouldReadMeta, TOOL_RING,
+  waitingReason, reasonText, shouldReadMeta, TOOL_RING, scannerHealth,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-mission-control",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Local dashboard for Claude Code: live sessions, transcripts, costs, git status — all your projects in one place.",
   "main": "server.js",
   "bin": {

package/server.js

@@ -43,15 +43,17 @@ function indexHtml() {
   return indexCache;
 }
 
+const guard = require('./lib/guard');
+// Extra names to accept in the Host header when bound off-loopback (e.g. a
+// Tailscale MagicDNS name). Comma-separated.
+const ALLOWED_HOSTS = guard.parseAllowedHosts(process.env.CLAUDE_DASH_ALLOWED_HOSTS);
+
 function allowedHost(req) {
-  if (HOST !== '127.0.0.1') return true; // explicitly opted into remote access
-  const h = String(req.headers.host || '');
-  return h.startsWith('127.0.0.1') || h.startsWith('localhost');
+  return guard.allowedHost(req.headers.host, HOST, ALLOWED_HOSTS);
 }
 
 function sameOrigin(req) {
-  const origin = req.headers.origin;
-  return !origin || /^http:\/\/(127\.0\.0\.1|localhost)(:\d+)?$/.test(origin) || HOST !== '127.0.0.1';
+  return guard.sameOrigin(req.headers.origin, req.headers.host);
 }
 
 function readBody(req, res, cb) {
@@ -503,8 +505,7 @@ const server = http.createServer((req, res) => {
 
   if (url === '/api/open' && req.method === 'POST') {
     // Same-origin only: browsers always send Origin on cross-origin POSTs.
-    const origin = req.headers.origin;
-    if (origin && !/^http:\/\/(127\.0\.0\.1|localhost)(:\d+)?$/.test(origin)) {
+    if (!sameOrigin(req)) {
       res.writeHead(403, { 'Content-Type': 'application/json' });
       res.end('{"ok":false,"error":"forbidden"}');
       return;