claude-rpc 0.17.2 → 0.19.1

package/src/install.js

@@ -52,7 +52,7 @@ function dirtyStep(sym, label, detail = '', log = console.log) {
 }
 function noop(fact) { noopFacts.push(fact); }
 
-const EVENTS = [
+export const EVENTS = [
   'SessionStart', 'UserPromptSubmit', 'PreToolUse', 'PostToolUse',
   'Stop', 'SubagentStop', 'Notification', 'SessionEnd', 'PreCompact',
 ];
@@ -69,7 +69,18 @@ function writeJson(p, d) {
 
 function isOurHookCommand(cmd) {
   if (!cmd) return false;
-  return /claude-rpc/i.test(cmd) || /hook\.js/i.test(cmd);
+  if (/claude-rpc/i.test(cmd)) return true;
+  // Dev-mode hooks point at THIS install's hook.js by absolute path. Match that
+  // exact path — NOT any `hook.js`, which could be a third-party tool's hook we
+  // must never rewrite or delete.
+  return cmd.includes(HOOK_SCRIPT.replace(/\\/g, '/'));
+}
+
+// A hook entry we own. Tagged entries are recognized regardless of command
+// shape or clone-dir name; command-matching is the legacy fallback for entries
+// written before tagging.
+export function isOurHook(h) {
+  return !!h && (h._claudeRpc === true || isOurHookCommand(h.command));
 }
 
 export function installHooks(exePath) {
@@ -81,24 +92,29 @@ export function installHooks(exePath) {
   //   npm     → `claude-rpc hook <event>`       (bin shim resolves through PATH;
   //              survives `npm update` and nvm version switches)
   //   dev     → `node "<src/hook.js>" <event>`  (cloned-source iteration)
+  // Hook commands must resolve under Claude Code's hook shell — `/bin/sh` with a
+  // minimal PATH that, under nvm, has neither `claude-rpc` nor `node` on it (no
+  // system node). So use the ABSOLUTE node (process.execPath) + absolute hook.js
+  // for both npm and dev installs; only the packaged exe is self-contained. This
+  // survives `npm update` (HOOK_SCRIPT is stable) and an nvm version switch (nvm
+  // keeps prior versions on disk); re-run setup only if that node is removed.
+  const node = process.execPath.replace(/\\/g, '/');
   const cmdFor = IS_PACKAGED
     ? (event) => `"${exePath}" hook ${event}`
-    : IS_NPM_INSTALL
-      ? (event) => `claude-rpc hook ${event}`
-      : (event) => `node "${HOOK_SCRIPT.replace(/\\/g, '/')}" ${event}`;
+    : (event) => `"${node}" "${HOOK_SCRIPT.replace(/\\/g, '/')}" ${event}`;
 
   for (const event of EVENTS) {
     const bucket = settings.hooks[event] = settings.hooks[event] || [];
     const wanted = cmdFor(event);
     const existingEntry = bucket.find((b) =>
-      Array.isArray(b.hooks) && b.hooks.some((h) => isOurHookCommand(h.command))
+      Array.isArray(b.hooks) && b.hooks.some((h) => isOurHook(h))
     );
     if (existingEntry) {
       existingEntry.hooks = existingEntry.hooks.map((h) =>
-        isOurHookCommand(h.command) ? { ...h, command: wanted } : h
+        isOurHook(h) ? { ...h, command: wanted, _claudeRpc: true } : h
       );
     } else {
-      bucket.push({ matcher: '', hooks: [{ type: 'command', command: wanted }] });
+      bucket.push({ matcher: '', hooks: [{ type: 'command', command: wanted, _claudeRpc: true }] });
     }
   }
   if (JSON.stringify(settings.hooks) === before) {
@@ -117,7 +133,7 @@ export function uninstallHooks() {
     const bucket = settings.hooks[event];
     if (!Array.isArray(bucket)) continue;
     settings.hooks[event] = bucket
-      .map((entry) => ({ ...entry, hooks: (entry.hooks || []).filter((h) => !isOurHookCommand(h.command)) }))
+      .map((entry) => ({ ...entry, hooks: (entry.hooks || []).filter((h) => !isOurHook(h)) }))
       .filter((entry) => (entry.hooks || []).length > 0);
     if (settings.hooks[event].length === 0) delete settings.hooks[event];
   }
@@ -421,7 +437,7 @@ export function migrateConfig({ silent = false } = {}) {
   // anyone who added a custom frame is left entirely alone.
   const frameId = (f) => (Array.isArray(f?.requires) && f.requires.length)
     ? 'r:' + [...f.requires].map(String).sort().join('|')
-    : 't:' + (f?.details ?? '') + '' + (f?.state ?? '');
+    : 't:' + (f?.details ?? '') + '\x00' + (f?.state ?? '');
   const dflBy = DEFAULT_CONFIG.presence?.byStatus || {};
   const usrBy = cfg.presence.byStatus || {};
   let framesAdded = 0;
@@ -453,18 +469,12 @@ export function migrateConfig({ silent = false } = {}) {
 // command and report success, leaving the user to discover the breakage
 // the next time they open Claude Code. Returns { ok, detail }.
 function verifyHookPipe(exePath) {
-  const cmd  = IS_PACKAGED ? exePath
-              : IS_NPM_INSTALL ? 'claude-rpc'
-              : process.execPath;
-  const args = IS_PACKAGED || IS_NPM_INSTALL
-              ? ['hook', 'SessionStart']
-              : [HOOK_SCRIPT, 'SessionStart'];
-  // Windows + npm-install: the global bin is `claude-rpc.cmd` (a batch shim),
-  // and Node's spawn doesn't apply PATHEXT — calling `claude-rpc` raw fails
-  // with ENOENT. shell:true makes cmd.exe do the resolution, mirroring how
-  // Claude Code actually invokes the hook string at runtime. Args are static
-  // and trusted; no injection surface.
-  const useShell = IS_NPM_INSTALL && process.platform === 'win32';
+  // Spawn exactly what installHooks wired: the packaged exe, or the absolute
+  // node + hook.js. Both are absolute, so there's no PATH/PATHEXT/shell
+  // resolution — it works under the same minimal hook shell Claude Code uses
+  // (the reason the old `claude-rpc` / bare-`node` forms failed under nvm).
+  const cmd  = IS_PACKAGED ? exePath : process.execPath;
+  const args = IS_PACKAGED ? ['hook', 'SessionStart'] : [HOOK_SCRIPT, 'SessionStart'];
   let result;
   try {
     result = spawnSync(cmd, args, {
@@ -472,7 +482,6 @@ function verifyHookPipe(exePath) {
       encoding: 'utf8',
       timeout: 3000,
       windowsHide: true,
-      shell: useShell,
     });
   } catch (e) {
     return { ok: false, detail: `spawn failed: ${e.message}` };
@@ -481,8 +490,14 @@ function verifyHookPipe(exePath) {
   if (result.status !== 0) {
     return { ok: false, detail: `hook exit ${result.status}: ${(result.stderr || '').trim().slice(0, 120)}` };
   }
-  if (!result.stdout.includes('"continue"')) {
-    return { ok: false, detail: `unexpected hook output: ${result.stdout.trim().slice(0, 120)}` };
+  // Parse the ack and assert the actual contract (a JSON object with
+  // continue:true) rather than substring-matching the bytes "continue" anywhere
+  // in stdout.
+  let ack;
+  try { ack = JSON.parse((result.stdout || '').trim()); }
+  catch { return { ok: false, detail: `non-JSON hook output: ${(result.stdout || '').trim().slice(0, 120)}` }; }
+  if (ack?.continue !== true) {
+    return { ok: false, detail: `hook ack missing continue:true: ${(result.stdout || '').trim().slice(0, 120)}` };
   }
   return { ok: true, detail: 'SessionStart round-trip succeeded' };
 }

package/src/leaderboard.js

@@ -29,7 +29,11 @@ export function isValidHandle(input) {
 // trim, bound the length. Returns null for empty input.
 export function cleanDisplayName(input, max = 40) {
   if (!input || typeof input !== 'string') return null;
-  const name = input.replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, max);
+  // Strip control chars (C0/DEL/C1), zero-width, and bidi overrides so a name
+  // can't visually corrupt or spoof the shared board. Denylist by code point -
+  // CJK, emoji and accents still pass. Mirrored in the worker's cleanName.
+  const ok = (c) => !(c < 32 || (c >= 0x7f && c <= 0x9f) || (c >= 0x200b && c <= 0x200f) || (c >= 0x202a && c <= 0x202e) || (c >= 0x2066 && c <= 0x2069) || c === 0xfeff);
+  const name = [...input].filter((ch) => ok(ch.codePointAt(0))).join('').trim().slice(0, max);
   return name || null;
 }
 

package/src/mcp.js

@@ -114,6 +114,9 @@ export function callTool(name, getAgg = readAggregate) {
  */
 export function runMcpServer({ input = process.stdin, output = process.stdout } = {}) {
   let buf = '';
+  const MAX_BUF = 4 * 1024 * 1024; // hard cap on a single un-terminated line
+  const DEFAULT_PROTOCOL = '2024-11-05';
+  const SUPPORTED_PROTOCOLS = new Set([DEFAULT_PROTOCOL, '2025-03-26', '2025-06-18']);
   const send = (msg) => output.write(JSON.stringify(msg) + '\n');
   const reply = (id, result) => send({ jsonrpc: '2.0', id, result });
   const replyErr = (id, code, message) => send({ jsonrpc: '2.0', id, error: { code, message } });
@@ -121,8 +124,12 @@ export function runMcpServer({ input = process.stdin, output = process.stdout }
   function handle(msg) {
     const { id, method, params } = msg;
     if (method === 'initialize') {
+      // Echo the client's protocol version when we recognize it; otherwise fall
+      // back to our baseline (our surface — initialize/tools/*/ping — is stable
+      // across these revisions).
+      const requested = params?.protocolVersion;
       return reply(id, {
-        protocolVersion: '2024-11-05',
+        protocolVersion: SUPPORTED_PROTOCOLS.has(requested) ? requested : DEFAULT_PROTOCOL,
         capabilities: { tools: {} },
         serverInfo: { name: 'claude-rpc', version: VERSION },
       });
@@ -159,7 +166,14 @@ export function runMcpServer({ input = process.stdin, output = process.stdout }
       try { msg = JSON.parse(line); } catch { continue; }
       try { handle(msg); } catch (e) { process.stderr.write(`mcp handler error: ${e.message}\n`); }
     }
+    // A single line larger than the cap (no newline yet) would grow buf without
+    // bound — drop the partial and resync on the next newline.
+    if (buf.length > MAX_BUF) {
+      process.stderr.write(`mcp: dropping oversized line (>${MAX_BUF} bytes)\n`);
+      buf = '';
+    }
   });
   input.on('end', () => process.exit(0));
+  input.on('error', () => process.exit(0));
   process.stderr.write(`claude-rpc MCP server v${VERSION} ready (stdio)\n`);
 }

package/src/notify.js

@@ -29,7 +29,7 @@ export function sanitizeLabel(s) {
  * @param {string} [body] - Notification body text.
  * @returns {boolean} true if a notifier was spawned, false on failure.
  */
-export function desktopNotify(title, body = '') {
+export function desktopNotify(title, body = '', { spawn: spawnFn = spawn } = {}) {
   try {
     const p = platform();
     // A missing notifier binary (e.g. no `notify-send`) makes spawn emit an
@@ -43,15 +43,15 @@ export function desktopNotify(title, body = '') {
     };
     if (p === 'darwin') {
       const script = `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)}`;
-      swallow(spawn('osascript', ['-e', script], { stdio: 'ignore', detached: true }));
+      swallow(spawnFn('osascript', ['-e', script], { stdio: 'ignore', detached: true }));
     } else if (p === 'win32') {
       const script = `Add-Type -AssemblyName System.Windows.Forms;`
         + `$n=New-Object System.Windows.Forms.NotifyIcon;`
         + `$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;`
         + `$n.ShowBalloonTip(5000, ${JSON.stringify(title)}, ${JSON.stringify(body)}, 'Info')`;
-      swallow(spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore', detached: true, windowsHide: true }));
+      swallow(spawnFn('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore', detached: true, windowsHide: true }));
     } else {
-      swallow(spawn('notify-send', ['-a', 'Claude Code', title, body], { stdio: 'ignore', detached: true }));
+      swallow(spawnFn('notify-send', ['-a', 'Claude Code', title, body], { stdio: 'ignore', detached: true }));
     }
     return true;
   } catch {

package/src/presence.js

@@ -55,6 +55,34 @@ export function selectFrame(rawFrames, vars, status, cursor, intervalMs, framePa
   return frames[cursor.index % frames.length] || {};
 }
 
+// Pick which session's card to show when several Claude sessions run at once.
+// Each session writes its own state-<id>.json (lastActivity stamped on every
+// hook), so `states` is one entry per session. Behavior: STICK to the currently
+// shown session while it's still active (lastActivity within idleMs), so the
+// card doesn't thrash between sessions while you're working in one; only once
+// the shown session goes idle do we switch to the most-recently-active session.
+// Returns { state, sessionId, liveCount } — liveCount feeds the "N sessions"
+// party field so it stays consistent with what's displayed.
+export function pickActiveSession(states, displayedId, now, idleMs) {
+  const list = (states || []).filter((s) => s && s.sessionId);
+  if (!list.length) return { state: null, sessionId: null, liveCount: 0 };
+  // A just-ended session (SessionEnd → claudeClosed) stamps a recent
+  // lastActivity but is gone — never count it live or stick to it.
+  const isLive = (s) => !s.claudeClosed && now - (s.lastActivity || 0) <= idleMs;
+  const liveCount = list.filter(isLive).length;
+  const byRecent = [...list].sort((a, b) => (b.lastActivity || 0) - (a.lastActivity || 0));
+  // Stickiness: keep the shown session while it's still active.
+  const current = list.find((s) => s.sessionId === displayedId);
+  if (current && isLive(current)) {
+    return { state: current, sessionId: current.sessionId, liveCount };
+  }
+  // Otherwise show the most-recently-active live session — or, if none are live,
+  // the most-recent overall so the card follows the last session into idle/stale
+  // rather than blanking.
+  const chosen = byRecent.find(isLive) || byRecent[0];
+  return { state: chosen, sessionId: chosen.sessionId, liveCount };
+}
+
 // Should the daemon auto-add a "View on GitHub →" button for this cwd? The
 // button URL is read from .git/config (no `gh` needed), but private-repo
 // detection DOES need the gh CLI — so on a machine without gh a private repo

package/src/privacy.js

@@ -21,7 +21,7 @@
 // by these flags. Privacy is a one-way valve from local state → Discord.
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { join, basename, dirname, resolve as resolvePath } from 'node:path';
 import { DATA_DIR } from './paths.js';
 
@@ -33,6 +33,7 @@ const TTL_MS = 5 * 60 * 1000;
 
 const projectFileCache = new Map();   // cwd → { ts, value | null }
 const ghPrivateCache  = new Map();    // cwd → { ts, value: bool | null }
+const ghProbeInFlight = new Set();    // cwds with an async `gh` probe running
 
 // ── Per-project .claude-rpc.json ────────────────────────────────────────
 
@@ -182,18 +183,33 @@ export function detectGithubPrivate(cwd) {
   if (!cwd) return null;
   const cached = ghPrivateCache.get(cwd);
   if (cached && Date.now() - cached.ts < TTL_MS) return cached.value;
-  let value = null;
-  try {
-    const out = execFileSync(
-      'gh',
-      ['repo', 'view', '--json', 'isPrivate', '-q', '.isPrivate'],
-      { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500 }
-    ).toString().trim();
-    if (out === 'true') value = true;
-    else if (out === 'false') value = false;
-  } catch { /* gh missing, not auth'd, not a repo, timeout — unknown */ }
-  ghPrivateCache.set(cwd, { ts: Date.now(), value });
-  return value;
+  // Cache miss: the single-threaded daemon render path must never block on a
+  // subprocess (a 1.5s gh call stalls ALL presence + file-watch updates). Fire
+  // a non-blocking probe and serve the last known value (null = unknown) this
+  // tick; the fresh verdict lands in the cache for the next one.
+  probeGithubPrivate(cwd);
+  return cached ? cached.value : null;
+}
+
+function probeGithubPrivate(cwd) {
+  if (ghProbeInFlight.has(cwd)) return; // one in-flight probe per cwd
+  ghProbeInFlight.add(cwd);
+  execFile(
+    'gh',
+    ['repo', 'view', '--json', 'isPrivate', '-q', '.isPrivate'],
+    { cwd, timeout: 1500 },
+    (err, stdout) => {
+      ghProbeInFlight.delete(cwd);
+      let value = null;
+      if (!err) {
+        const out = String(stdout).trim();
+        if (out === 'true') value = true;
+        else if (out === 'false') value = false;
+      }
+      // gh missing / not auth'd / not a repo / timeout → value stays null (unknown).
+      ghPrivateCache.set(cwd, { ts: Date.now(), value });
+    }
+  );
 }
 
 // ── Resolution + application ────────────────────────────────────────────

package/src/profile.js

@@ -7,6 +7,7 @@
 
 import { fmtCost } from './pricing.js';
 import { VERSION } from './version.js';
+import { fmtNum, fmtHours } from './fmt.js';
 
 const W = 520;
 const H = 240;
@@ -32,22 +33,6 @@ function escapeXml(s) {
     .replace(/"/g, '"');
 }
 
-function fmtNum(n) {
-  if (!n) return '0';
-  if (n < 1000) return String(Math.round(n));
-  if (n < 1_000_000) return `${(n / 1000).toFixed(1)}k`;
-  if (n < 1_000_000_000) return `${(n / 1_000_000).toFixed(2)}M`;
-  return `${(n / 1_000_000_000).toFixed(2)}B`;
-}
-
-function fmtHours(ms) {
-  if (!ms || ms < 0) return '0h';
-  const h = ms / 3_600_000;
-  if (h < 1) return `${Math.round(h * 60)}m`;
-  if (h < 10) return `${h.toFixed(1)}h`;
-  return `${Math.round(h)}h`;
-}
-
 function topLanguage(aggregate) {
   const langs = aggregate?.languages || {};
   let best = null;

package/src/scanner.js

@@ -632,25 +632,37 @@ export function readSessionTokens(path) {
 
 // Detect live sessions by transcript mtime. Returns array of { path, project, cwd, mtime, ageSec }.
 // A session is "live" if its .jsonl was modified within thresholdMs.
-export function findLiveSessions({ projectsDir = CLAUDE_PROJECTS, thresholdMs = 90_000 } = {}) {
-  if (!existsSync(projectsDir)) return [];
+// Roots default to the same set scan() uses — the canonical ~/.claude/projects
+// plus any discovered alt locations — so live presence, concurrent-session
+// detection, the web API, doctor and the TUI don't go silent on XDG-strict /
+// AppData / Library-relocated installs. Legacy single-root `projectsDir` and
+// explicit multi-root `projectsDirs` are both still accepted.
+export function findLiveSessions({ projectsDir, projectsDirs, thresholdMs = 90_000 } = {}) {
+  const dirs = projectsDirs && projectsDirs.length ? projectsDirs
+    : projectsDir ? [projectsDir]
+    : [CLAUDE_PROJECTS, ...discoverAltProjectDirs()];
   const now = Date.now();
   const live = [];
-  for (const proj of readdirSync(projectsDir)) {
-    const projPath = join(projectsDir, proj);
-    let entries;
-    try { entries = readdirSync(projPath, { withFileTypes: true }); } catch { continue; }
-    for (const e of entries) {
-      // Only top-level transcripts count as sessions, not subagent files.
-      if (!e.isFile() || !e.name.endsWith('.jsonl')) continue;
-      const full = join(projPath, e.name);
-      let st;
-      try { st = statSync(full); } catch { continue; }
-      const age = now - st.mtimeMs;
-      if (age <= thresholdMs) {
-        const cwd = readTranscriptCwd(full, st.mtimeMs);
-        const project = cleanProjectName(cwd ? basename(cwd) : proj);
-        live.push({ path: full, project, cwd: cwd || '', mtime: st.mtimeMs, ageSec: Math.round(age / 1000) });
+  for (const root of dirs) {
+    if (!existsSync(root)) continue;
+    let projects;
+    try { projects = readdirSync(root); } catch { continue; }
+    for (const proj of projects) {
+      const projPath = join(root, proj);
+      let entries;
+      try { entries = readdirSync(projPath, { withFileTypes: true }); } catch { continue; }
+      for (const e of entries) {
+        // Only top-level transcripts count as sessions, not subagent files.
+        if (!e.isFile() || !e.name.endsWith('.jsonl')) continue;
+        const full = join(projPath, e.name);
+        let st;
+        try { st = statSync(full); } catch { continue; }
+        const age = now - st.mtimeMs;
+        if (age <= thresholdMs) {
+          const cwd = readTranscriptCwd(full, st.mtimeMs);
+          const project = cleanProjectName(cwd ? basename(cwd) : proj);
+          live.push({ path: full, project, cwd: cwd || '', mtime: st.mtimeMs, ageSec: Math.round(age / 1000) });
+        }
       }
     }
   }

package/src/server/api.js

@@ -3,7 +3,7 @@
 // from the routing layer.
 
 import { basename } from 'node:path';
-import { readState } from '../state.js';
+import { readActiveState } from '../state.js';
 import { buildVars, fillTemplate, applyIdle, framePasses, humanModel } from '../format.js';
 import { readAggregate, findLiveSessions, dayKey } from '../scanner.js';
 import { loadConfig as loadSharedConfig } from '../config.js';
@@ -111,7 +111,7 @@ export function windowedAggregate(agg, range) {
 export function snapshot() {
   const config = loadConfig();
   const live = findLiveSessions({ thresholdMs: 90_000 });
-  let state = readState();
+  let state = readActiveState();
   state.liveSessions = live;
   state = applyIdle(state, config);
   const aggregate = readAggregate() || {};
@@ -196,7 +196,7 @@ export function wrappedData() {
     topLanguage: langs[0] ? { name: langs[0][0], edits: langs[0][1].edits || 0 } : null,
     languages: langs.slice(0, 5).map(([name, v]) => ({ name, edits: v.edits || 0 })),
     hotspot: top ? { name: basename(String(top.path || '')), count: top.count, daysSinceLastEdit: top.daysSinceLastEdit } : null,
-    peakHour: agg.peakHour && agg.peakHour.hour != null ? agg.peakHour.hour : null,
+    peakHour: (Number.isInteger(agg.peakHour?.hour) && agg.peakHour.hour >= 0 && agg.peakHour.hour <= 23) ? agg.peakHour.hour : null,
     peakWeekday: peakWd ? { name: WRAPPED_WEEKDAYS[peakWd.day], hours: peakWd.ms / 3_600_000 } : null,
     modelSplit: (agg.modelSplit || []).slice(0, 4).map((m) => ({ model: humanModel(m.model) || m.model, costPct: m.costPct || 0, tokenPct: m.tokenPct || 0 })),
     linesAdded: agg.linesAdded || 0,

package/src/server/assets/dashboard.client.js

@@ -23,6 +23,7 @@
   let range = '90d';
   let liveData = null;
   let aggData = null;
+  let heatmapByDay = null; // dedicated fixed-90d source, independent of the range pill
   let allFrames = [];
   let currentLiveIdx = 0;
   let rotationTimer = null;
@@ -162,25 +163,30 @@
   function renderHeatmap(byDay) {
     const grid = $('heatmap-grid');
     grid.innerHTML = '';
+    byDay = byDay || {};
     const today = new Date(); today.setHours(0, 0, 0, 0);
-    let start = new Date(today); start.setDate(start.getDate() - 90);
+    const start = new Date(today); start.setDate(start.getDate() - 90);
     while (start.getDay() !== 0) start.setDate(start.getDate() - 1);
-    let max = 0;
-    for (let k in byDay) max = Math.max(max, byDay[k].activeMs || 0);
+    // The day keys actually drawn — a fixed window ending today, independent of
+    // the range pill (so 7d/30d don't blank the grid).
+    const keys = [];
     const cur = new Date(start);
-    while (cur <= today) {
-      const k = dayKey(cur.getTime());
+    while (cur <= today) { keys.push(dayKey(cur.getTime())); cur.setDate(cur.getDate() + 1); }
+    // Normalize against the max of ONLY the drawn cells, so an off-window peak
+    // (from a wider range selection) can't dim the visible grid.
+    let max = 0;
+    for (const k of keys) max = Math.max(max, (byDay[k] || {}).activeMs || 0);
+    for (const k of keys) {
       const ms = (byDay[k] || {}).activeMs || 0;
       const cell = document.createElement('div');
       cell.className = 'cell';
-      if (ms > 0) {
+      if (ms > 0 && max > 0) {
         const lvl = Math.min(1, ms / max);
         cell.style.background = 'rgba(74, 222, 128, ' + (0.18 + lvl * 0.72).toFixed(2) + ')';
       }
       cell.title = k + ' · ' + fmtH(ms);
       cell.addEventListener('click', () => openDay(k));
       grid.appendChild(cell);
-      cur.setDate(cur.getDate() + 1);
     }
   }
 
@@ -434,6 +440,16 @@
     } catch (e) { console.error(e); }
   }
 
+  // The heatmap always shows the same fixed ~90-day window, so it has its own
+  // fetch decoupled from the range pill.
+  async function fetchHeatmap() {
+    try {
+      const r = await fetch('/api/aggregate?range=90d', { cache: 'no-store' });
+      heatmapByDay = (await r.json()).byDay || {};
+      renderHeatmap(heatmapByDay);
+    } catch (e) { console.error(e); }
+  }
+
   async function fetchInsights() {
     try {
       const r = await fetch('/api/insights');
@@ -454,7 +470,7 @@
     if (!aggData) return;
     const days = range === '7d' ? 7 : range === '30d' ? 30 : range === '1y' ? 365 : range === 'all' ? 365 : 90;
     renderChart(aggData.byDay || {}, days);
-    renderHeatmap(aggData.byDay || {});
+    renderHeatmap(heatmapByDay || aggData.byDay || {});
     renderChurn(aggData.byDay || {}, Math.min(days, 90));
     renderCost(aggData);
     renderLanguages(aggData.languages);
@@ -573,7 +589,9 @@
   // ── SSE ────────────────────────────────────────────────
   function startSse() {
     try {
+      $('conn-state').textContent = 'connecting';
       const ev = new EventSource('/events');
+      ev.onopen = () => { $('conn-state').textContent = 'live'; };
       ev.onmessage = async (e) => {
         try {
           const d = JSON.parse(e.data);
@@ -582,10 +600,14 @@
             await refreshState();
             await fetchAggregate();
             await fetchInsights();
+            await fetchHeatmap();
           }
         } catch { /* malformed SSE frame — wait for the next one */ }
       };
-      ev.onerror = () => { $('conn-state').textContent = 'reconnecting'; setTimeout(() => { $('conn-state').textContent = 'live'; }, 4000); };
+      // CLOSED = EventSource gave up (no auto-retry); otherwise a native
+      // reconnect is already in flight. No blind timer flipping back to "live"
+      // while the daemon is actually down.
+      ev.onerror = () => { $('conn-state').textContent = ev.readyState === EventSource.CLOSED ? 'offline' : 'reconnecting'; };
     } catch { /* EventSource constructor failed (very old browser) — dashboard falls back to one-shot fetches */ }
   }
 
@@ -650,6 +672,7 @@
     await refreshState();
     await fetchAggregate();
     await fetchInsights();
+    await fetchHeatmap();
     startSse();
     // Restore deep link.
     if (location.hash.startsWith('#projects/')) openProject(decodeURIComponent(location.hash.slice(10)));

package/src/server/index.js

@@ -15,7 +15,7 @@ import { createServer } from 'node:http';
 import { exec } from 'node:child_process';
 import { ROUTES, JSON_HEADERS } from './routes.js';
 import { projectDrilldown, dayDetail } from './api.js';
-import { sseClients, watchSources } from './sse.js';
+import { watchSources, addClient, removeClient } from './sse.js';
 import { buildHtml, buildWrappedHtml } from './page.js';
 
 // Pre-compose the HTML once at startup — the only dynamic bit is the port
@@ -60,8 +60,8 @@ function dispatch(req, res) {
       'connection': 'keep-alive',
     });
     res.write(': hello\n\n');
-    sseClients.add(res);
-    req.on('close', () => sseClients.delete(res));
+    addClient(res);
+    req.on('close', () => removeClient(res));
     return;
   }
 

package/src/server/sse.js

@@ -16,6 +16,33 @@ export function broadcast(payload) {
   }
 }
 
+// Heartbeat: bytes only flow on file-change broadcasts, so an idle connection
+// can sit half-open indefinitely and a dead socket isn't reaped until the next
+// real write throws. A periodic comment frame keeps connections warm and lets
+// the write/try-catch evict peers that have gone away. Started on the first
+// client, cleared when the last one leaves.
+const HEARTBEAT_MS = 20_000;
+let heartbeat = null;
+
+export function addClient(res) {
+  sseClients.add(res);
+  if (heartbeat) return;
+  heartbeat = setInterval(() => {
+    for (const r of sseClients) {
+      try { r.write(': ping\n\n'); } catch { sseClients.delete(r); }
+    }
+  }, HEARTBEAT_MS);
+  heartbeat.unref?.(); // a lone heartbeat shouldn't keep the process alive
+}
+
+export function removeClient(res) {
+  sseClients.delete(res);
+  if (sseClients.size === 0 && heartbeat) {
+    clearInterval(heartbeat);
+    heartbeat = null;
+  }
+}
+
 // Watch a file that is updated via atomic rename (write-tmp + renameSync).
 // Watching the file path directly binds to the inode at watch-time — on
 // Linux that inode is replaced by the first rename, so the watcher fires