claude-rpc 0.18.0 → 0.19.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-rpc",
-  "version": "0.18.0",
+  "version": "0.19.1",
   "description": "Discord Rich Presence for Claude Code — live model, project, tokens, and lifetime stats driven by Claude Code's hook system.",
   "type": "module",
   "license": "MIT",

package/src/badge.js

@@ -3,6 +3,7 @@
 
 import { dayKey } from './scanner.js';
 import { fmtCost } from './pricing.js';
+import { fmtNum, fmtHours as fmtHoursLabel } from './fmt.js';
 
 const COLORS = {
   hours:  { left: '#555', right: '#4c1' },     // green
@@ -58,22 +59,6 @@ function rangeLabel(range) {
 
 export { rangeToDays, rangeLabel, pickWindow };
 
-function fmtHoursLabel(ms) {
-  if (!ms) return '0h';
-  const h = ms / 3_600_000;
-  if (h < 1) return `${Math.round(h * 60)}m`;
-  if (h < 10) return `${h.toFixed(1)}h`;
-  return `${Math.round(h)}h`;
-}
-
-function fmtNum(n) {
-  if (!n) return '0';
-  if (n < 1000) return String(n);
-  if (n < 1_000_000) return `${(n / 1000).toFixed(1)}k`;
-  if (n < 1_000_000_000) return `${(n / 1_000_000).toFixed(2)}M`;
-  return `${(n / 1_000_000_000).toFixed(2)}B`;
-}
-
 // Compute label/value pair for the requested metric.
 function valueFor(aggregate, metric, range) {
   const a = aggregate || {};

package/src/card.js

@@ -15,6 +15,7 @@ import { dayKey } from './scanner.js';
 import { fmtCost } from './pricing.js';
 import { rangeToDays, rangeLabel, pickWindow } from './badge.js';
 import { VERSION } from './version.js';
+import { fmtNum, fmtHours } from './fmt.js';
 
 const W = 880;
 const H = 540;
@@ -45,22 +46,6 @@ function escapeXml(s) {
     .replace(/"/g, '"');
 }
 
-function fmtNum(n) {
-  if (!n) return '0';
-  if (n < 1000) return String(Math.round(n));
-  if (n < 1_000_000) return `${(n / 1000).toFixed(1)}k`;
-  if (n < 1_000_000_000) return `${(n / 1_000_000).toFixed(2)}M`;
-  return `${(n / 1_000_000_000).toFixed(2)}B`;
-}
-
-function fmtHours(ms) {
-  if (!ms || ms < 0) return '0h';
-  const h = ms / 3_600_000;
-  if (h < 1) return `${Math.round(h * 60)}m`;
-  if (h < 10) return `${h.toFixed(1)}h`;
-  return `${Math.round(h)}h`;
-}
-
 function rangeTitle(range) {
   const rl = rangeLabel(range);
   if (rl === 'all-time') return 'on claude';
@@ -103,7 +88,9 @@ function topWeekday(aggregate) {
   const wd = aggregate?.byWeekday || {};
   let best = null;
   for (const [k, v] of Object.entries(wd)) {
-    if (!best || (v.activeMs || 0) > (best.ms || 0)) best = { day: Number(k), ms: v.activeMs || 0 };
+    const day = Number(k);
+    if (!Number.isInteger(day) || day < 0 || day > 6) continue; // out-of-range key → skip, no blank name + stray "(3h)"
+    if (!best || (v.activeMs || 0) > (best.ms || 0)) best = { day, ms: v.activeMs || 0 };
   }
   return best;
 }
@@ -133,6 +120,7 @@ function peakHourLabel(aggregate) {
   const ph = aggregate?.peakHour;
   if (!ph || ph.hour == null) return null;
   const h = Number(ph.hour);
+  if (!Number.isInteger(h) || h < 0 || h > 23) return null; // corrupt aggregate → no label, not "99:00"/"NaN:00"
   return `${String(h).padStart(2, '0')}:00`;
 }
 

package/src/cli.js

@@ -11,9 +11,10 @@ if (process.platform === 'win32' && process.stdout.isTTY) {
   try { spawnSync('chcp.com', ['65001'], { stdio: 'ignore', windowsHide: true }); } catch { /* chcp absent (Wine, custom shell) — accept whatever code page is set */ }
 }
 import { DAEMON_SCRIPT, PID_PATH, STATE_PATH, LOG_PATH, AGGREGATE_PATH, CONFIG_PATH, IS_PACKAGED, IS_NPX, EXE_PATH, CANONICAL_EXE } from './paths.js';
-import { readState } from './state.js';
+import { readActiveState } from './state.js';
 import { buildVars, fillTemplate, humanProject, humanTool, applyIdle, framePasses, fmtNum } from './format.js';
 import { scan, readAggregate, findLiveSessions, dayKey, weekKey } from './scanner.js';
+import { weekGrid } from './week.js';
 import { runHookCli } from './hook.js';
 import { install as runInstall, uninstall as runUninstall, isInstalled, migrateConfig, installHooks, ensureCanonicalExe, installMcp, uninstallMcp, setupOutro } from './install.js';
 import { startTui } from './tui.js';
@@ -62,7 +63,7 @@ function readJson(path, fallback) {
 // (`profile set`, `community on`, `link`, …). mkdirSync first.
 function writeUserConfig(userCfg) {
   mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-  writeUserConfig(userCfg);
+  writeFileSync(CONFIG_PATH, JSON.stringify(userCfg, null, 2) + '\n');
 }
 
 // Validate a flag's value taken with `argv[++i]`. A value that's missing or
@@ -346,7 +347,7 @@ function todayBoxLines(vars, aggregate) {
 }
 
 function showStatus() {
-  const state = readState();
+  const state = readActiveState();
   const aggregate = readAggregate();
   const config = loadConfig();
   const live = findLiveSessions({ thresholdMs: 90_000 });
@@ -528,7 +529,7 @@ function showStatus() {
 }
 
 function showToday() {
-  const state = readState();
+  const state = readActiveState();
   const aggregate = readAggregate();
   const config = loadConfig();
   state.liveSessions = findLiveSessions({ thresholdMs: 90_000 });
@@ -561,7 +562,7 @@ function showToday() {
 }
 
 function showWeek() {
-  const state = readState();
+  const state = readActiveState();
   const aggregate = readAggregate();
   const config = loadConfig();
   state.liveSessions = findLiveSessions({ thresholdMs: 90_000 });
@@ -593,22 +594,7 @@ function showWeek() {
 
   // Current ISO week (Mon → Sun). Future days show "—".
   if (aggregate?.byDay) {
-    const now = new Date();
-    now.setHours(0, 0, 0, 0);
-    const monday = new Date(now);
-    monday.setDate(monday.getDate() - ((monday.getDay() + 6) % 7));
-    const days = [];
-    for (let i = 0; i < 7; i++) {
-      const d = new Date(monday);
-      d.setDate(d.getDate() + i);
-      const k = dayKey(d.getTime());
-      const dayName = ['Sun','Mon','Tue','Wed','Thu','Fri','Sat'][d.getDay()];
-      const ms = aggregate.byDay[k]?.activeMs || 0;
-      const isFuture = d > now;
-      const isToday = k === dayKey(now.getTime());
-      days.push({ label: `${dayName} ${k.slice(5)}`, ms, isFuture, isToday });
-    }
-    const maxMs = Math.max(...days.map((d) => d.ms)) || 1;
+    const { days, maxMs } = weekGrid(aggregate.byDay);
     const lines = days.map(({ label, ms, isFuture, isToday }) => {
       if (isFuture) return `${c.dim}${label.padEnd(12)} ${'·'.repeat(22)}     —${c.reset}`;
       const h = ms / 3_600_000;
@@ -681,7 +667,7 @@ function statusColor(status) {
 }
 
 function showPreview() {
-  let state = readState();
+  let state = readActiveState();
   const aggregate = readAggregate();
   const config = loadConfig();
   const live = findLiveSessions({ thresholdMs: 90_000 });
@@ -744,7 +730,7 @@ function showPreview() {
 // dashboard having to inline-eval ESM source. Output shape matches the
 // previous helper exactly: { vars: [sorted keys], live: <full vars object> }.
 function dumpVars() {
-  let state = readState();
+  let state = readActiveState();
   const config = loadConfig();
   state.liveSessions = findLiveSessions({ thresholdMs: 90_000 });
   state = applyIdle(state, config);
@@ -971,7 +957,7 @@ async function doGithubStat(argv) {
 // Build the live template-variable table the way the daemon does — current
 // state + idle/stale resolution + aggregate. Shared by statusline/session-card.
 function liveVars() {
-  const state = readState();
+  const state = readActiveState();
   state.liveSessions = findLiveSessions({ thresholdMs: 90_000 });
   const config = loadConfig();
   const resolved = applyIdle(state, config);
@@ -1837,7 +1823,7 @@ function overview() {
   }
 
   // Status line: daemon up/down + project + model + status verb.
-  const state = readState();
+  const state = readActiveState();
   const aggregate = readAggregate();
   state.liveSessions = findLiveSessions({ thresholdMs: 90_000 });
   state.usage = readUsageCache();

package/src/daemon.js

@@ -78,6 +78,7 @@ let aggregate = readAggregate() || null;
 let liveSessions = [];
 let client = null;
 let connected = false;
+let connecting = false; // login() in flight — see the watchdog note in connect()
 let lastPayloadHash = '';
 // Last status we acted on for outbound side-effects (webhook / desktop notify).
 // Tracked separately from the render hash so we fire once per transition.
@@ -405,6 +406,10 @@ function isConnectionError(e) {
 
 async function connect() {
   if (reconnectTimer) { clearTimeout(reconnectTimer); reconnectTimer = null; }
+  // While login() is in flight, connected===false and reconnectTimer===null
+  // both hold, so the watchdog's "down, nothing pending" branch would spawn a
+  // second connect() that overwrites `client` and orphans this socket. Block it.
+  connecting = true;
   client = new Client({ clientId: config.clientId, transport: { type: 'ipc' } });
 
   client.on('ready', () => {
@@ -422,6 +427,8 @@ async function connect() {
   try { await client.login(); }
   catch (e) {
     scheduleReconnect(`Discord login failed: ${e.message}`);
+  } finally {
+    connecting = false;
   }
 }
 
@@ -609,7 +616,7 @@ const HEALTH_CHECK_MS = 30_000;
 setInterval(() => {
   try {
     // Half-open: flag says connected but there's no usable user handle.
-    if (connected && !client?.user) {
+    if (connected && !client?.user && !connecting) {
       log('Watchdog: connected but no user handle — forcing reconnect');
       connected = false;
       try { client?.destroy(); } catch { /* already gone */ }
@@ -618,7 +625,7 @@ setInterval(() => {
     }
     // Down with nothing scheduled to bring us back. scheduleReconnect is a
     // no-op when a timer is already pending, so this can't stack retries.
-    if (!connected && !reconnectTimer) {
+    if (!connected && !reconnectTimer && !connecting) {
       log('Watchdog: disconnected with no reconnect pending — forcing reconnect');
       scheduleReconnect('watchdog: no retry pending');
     }

package/src/discord-ipc.js

@@ -32,6 +32,9 @@ export const OP_PING = 3;
 export const OP_PONG = 4;
 
 const CONNECT_TIMEOUT_MS = 10_000; // matches @xhayper's connect() timeout
+// Per-candidate connect timeout: a socket file whose peer accepts then stalls
+// must not wedge discovery of the real Discord socket behind it.
+const SOCKET_CONNECT_TIMEOUT_MS = 1500;
 
 // Same resolution order @xhayper used: XDG_RUNTIME_DIR → TMPDIR → TMP → TEMP → /tmp.
 function getTempDir() {
@@ -171,14 +174,18 @@ export class Client extends EventEmitter {
     for (const p of paths) {
       const socket = await new Promise((resolve) => {
         const s = net.createConnection(p);
-        const onErr = () => {
+        let timer = null;
+        const cleanup = () => {
+          clearTimeout(timer);
           s.removeListener('connect', onOk);
-          resolve(null);
-        };
-        const onOk = () => {
           s.removeListener('error', onErr);
-          resolve(s);
         };
+        const onErr = () => { cleanup(); resolve(null); };
+        const onOk = () => { cleanup(); resolve(s); };
+        // A peer that accepts then stalls would otherwise never settle this
+        // candidate and block the rest each discovery cycle (and leak the fd).
+        timer = setTimeout(() => { cleanup(); s.destroy(); resolve(null); }, SOCKET_CONNECT_TIMEOUT_MS);
+        if (typeof timer === 'object' && 'unref' in timer) timer.unref();
         s.once('connect', onOk);
         s.once('error', onErr);
       });

package/src/doctor.js

@@ -18,6 +18,7 @@ import { findLiveSessions } from './scanner.js';
 import { detectGithubUrl } from './git.js';
 import { resolveVisibility, listPrivateCwds, detectGithubPrivate } from './privacy.js';
 import { readClaudeCredentials, readUsageCache } from './usage.js';
+import { EVENTS as HOOK_EVENTS, isOurHook } from './install.js';
 import { c, check as uiCheck } from './ui.js';
 
 const counters = { pass: 0, fail: 0, warn: 0 };
@@ -82,6 +83,28 @@ function checkMode() {
   check('execution mode', mode, detail);
 }
 
+// Pure classifiers — extracted so doctor's decision logic is unit-testable
+// without spawning the full filesystem diagnostic. The check* wrappers below
+// pair these with the actual reads + check() output.
+const PLACEHOLDER_CLIENT_ID = '1234567890123456789';
+
+// '' / the seed placeholder → 'unset'; not a 17–21 digit snowflake → 'malformed'.
+export function classifyClientId(clientId) {
+  if (!clientId || clientId === PLACEHOLDER_CLIENT_ID) return 'unset';
+  if (!/^\d{17,21}$/.test(String(clientId))) return 'malformed';
+  return 'ok';
+}
+
+// Most-recent-wins IPC state inferred from the daemon log tail: 'up'/'down'/'unknown'.
+export function ipcStateFromLog(logText) {
+  let ipc = 'unknown';
+  for (const line of String(logText || '').split('\n').slice(-80)) {
+    if (/Discord RPC connected|Presence updated|Presence cleared/i.test(line)) ipc = 'up';
+    else if (/retry in \d+s|login failed|Discord disconnected/i.test(line)) ipc = 'down';
+  }
+  return ipc;
+}
+
 function checkConfig() {
   if (!existsSync(CONFIG_PATH)) {
     check('config.json present', 'fail', CONFIG_PATH,
@@ -98,10 +121,11 @@ function checkConfig() {
   }
   check('config.json present', 'pass', CONFIG_PATH);
 
-  if (!cfg.clientId || cfg.clientId === '1234567890123456789') {
+  const clientIdClass = classifyClientId(cfg.clientId);
+  if (clientIdClass === 'unset') {
     check('discord clientId set', 'fail', cfg.clientId || '(empty)',
       `paste your discord application ID into ${CONFIG_PATH}`);
-  } else if (!/^\d{17,21}$/.test(String(cfg.clientId))) {
+  } else if (clientIdClass === 'malformed') {
     check('discord clientId set', 'warn', `${cfg.clientId} doesn't look like a snowflake`,
       'discord application IDs are 17–21 digits');
   } else {
@@ -152,16 +176,6 @@ function checkClaudeProjects() {
   return count;
 }
 
-const HOOK_EVENTS = [
-  'SessionStart', 'UserPromptSubmit', 'PreToolUse', 'PostToolUse',
-  'Stop', 'SubagentStop', 'Notification', 'SessionEnd',
-];
-
-function isOurHookCommand(cmd) {
-  if (!cmd) return false;
-  return /claude-rpc/i.test(cmd) || /hook\.js/i.test(cmd);
-}
-
 function checkHooks() {
   if (!existsSync(CLAUDE_SETTINGS)) {
     check('hooks registered', 'fail', `${CLAUDE_SETTINGS} missing`,
@@ -181,7 +195,7 @@ function checkHooks() {
   for (const event of HOOK_EVENTS) {
     const bucket = settings.hooks?.[event];
     if (!Array.isArray(bucket) || bucket.length === 0) { missing.push(event); continue; }
-    const ours = bucket.flatMap((e) => e.hooks || []).find((h) => isOurHookCommand(h.command));
+    const ours = bucket.flatMap((e) => e.hooks || []).find((h) => isOurHook(h));
     if (!ours) { missing.push(event); continue; }
     if (IS_PACKAGED && !ours.command.includes(CANONICAL_EXE)) stale.push({ event, cmd: ours.command });
     if (IS_NPM_INSTALL && !/\bclaude-rpc\b\s+hook\b/.test(ours.command)) stale.push({ event, cmd: ours.command });
@@ -259,12 +273,8 @@ function checkDaemonLog() {
   // Ns" / "login failed" / "disconnected" line means it dropped. Whichever
   // happened most recently wins.
   let ipc = 'unknown';
-  try {
-    for (const line of readFileSync(LOG_PATH, 'utf8').split('\n').slice(-80)) {
-      if (/Discord RPC connected|Presence updated|Presence cleared/i.test(line)) ipc = 'up';
-      else if (/retry in \d+s|login failed|Discord disconnected/i.test(line)) ipc = 'down';
-    }
-  } catch { /* log unreadable — ipc stays 'unknown', warn renders */ }
+  try { ipc = ipcStateFromLog(readFileSync(LOG_PATH, 'utf8')); }
+  catch { /* log unreadable — ipc stays 'unknown', warn renders */ }
   if (ipc === 'up') {
     check('discord IPC connection', 'pass',
       `connected · ${sizeKB} KB log · last write ${ageMin.toFixed(1)} min ago`);

package/src/fmt.js

@@ -0,0 +1,33 @@
+// Canonical number/duration formatters shared across the card, badge, profile,
+// insights and the live presence engine (format.js re-exports these). Single
+// source of truth so tier-boundary rounding behaves identically everywhere —
+// the copies had drifted (sub-1000 rounding, a missing Billion tier).
+//
+// NOTE: worker/src/badge.js keeps a byte-for-byte copy of fmtNum — the worker
+// deploys dependency-free and can't import across the package boundary. Keep
+// the two in sync; test/format.test.js pins fmtNum's tier behavior.
+
+// Compact integer: 999 → "999", 1_500 → "1.5k", 1_500_000 → "1.50M", up to "B".
+// The unit is chosen from the ROUNDED value, so 999_999 → "1.00M" (not the old
+// "1000.0k") and 999_999_999 → "1.00B".
+export function fmtNum(n) {
+  if (!n) return '0';
+  const neg = n < 0 ? '-' : '';
+  const v = Math.abs(n);
+  if (v < 1000) return neg + Math.round(v);
+  for (const [suf, div, prec] of [['k', 1e3, 1], ['M', 1e6, 2], ['B', 1e9, 2]]) {
+    const s = (v / div).toFixed(prec);
+    if (Number(s) < 1000) return neg + s + suf;
+  }
+  return neg + (v / 1e9).toFixed(2) + 'B'; // ≥ ~1e12 stays in the B tier
+}
+
+// Duration from ms: <60m → "42m", <10h → "2.5h", else "12h". Rounds to whole
+// minutes first so 59.7m → "1.0h" (not the old "60m").
+export function fmtHours(ms) {
+  if (!ms || ms < 0) return '0h';
+  const mins = Math.round(ms / 60_000);
+  if (mins < 60) return `${mins}m`;
+  const hours = mins / 60;
+  return hours < 10 ? `${hours.toFixed(1)}h` : `${Math.round(hours)}h`;
+}

package/src/format.js

@@ -4,6 +4,7 @@ import { fmtCost } from './pricing.js';
 import { languageOf } from './languages.js';
 import { detectGitBranch, detectGitRepo } from './git.js';
 import { fmtResetTime, fmtResetDay } from './usage.js';
+import { fmtNum, fmtHours } from './fmt.js';
 
 const WEEKDAY_NAMES = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
 
@@ -33,14 +34,6 @@ function fmtHourLocal(ms) {
   return `${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}`;
 }
 
-function fmtNum(n) {
-  if (!n) return '0';
-  if (n < 1000) return `${n}`;
-  if (n < 1_000_000) return `${(n / 1000).toFixed(1)}k`;
-  if (n < 1_000_000_000) return `${(n / 1_000_000).toFixed(2)}M`;
-  return `${(n / 1_000_000_000).toFixed(2)}B`;
-}
-
 function fmtDuration(ms) {
   if (!ms || ms < 0) return '0s';
   const s = Math.floor(ms / 1000);
@@ -69,14 +62,6 @@ function fmtToolElapsed(ms) {
   return `${h}h ${m}m`;
 }
 
-function fmtHours(ms) {
-  if (!ms || ms < 0) return '0h';
-  const hours = ms / 3_600_000;
-  if (hours < 1) return `${Math.round(hours * 60)}m`;
-  if (hours < 10) return `${hours.toFixed(1)}h`;
-  return `${Math.round(hours)}h`;
-}
-
 function plural(n, sing, plur) {
   const word = n === 1 ? sing : (plur || `${sing}s`);
   return `${fmtNum(n)} ${word}`;
@@ -223,9 +208,11 @@ export function buildVars(state, config, aggregate) {
   // leak to anyone viewing the card. Fall back to the configured app name.
   const cwdIsLeaky = looksLikeUsernameLeak(state.cwd);
   const safeCwd = cwdIsLeaky ? '' : (state.cwd || '');
-  const projectPretty = cwdIsLeaky
-    ? (config?.appName || 'Claude Code')
-    : (humanProject(state.cwd) || 'Claude Code');
+  const appName = config?.appName || 'Claude Code';
+  // Project label with the home-dir/username-leak guard applied — shared by the
+  // single-session label and the concurrent list so neither renders "lucas".
+  const safeProject = (cwd) => looksLikeUsernameLeak(cwd) ? appName : (humanProject(cwd) || appName);
+  const projectPretty = safeProject(state.cwd);
   const currentToolPretty = humanTool(state.currentTool);
   const modelPretty = humanModel(state.model);
 
@@ -244,7 +231,7 @@ export function buildVars(state, config, aggregate) {
   const concurrentOther = Math.max(0, concurrent - 1);
   const concurrentListPretty = liveSessions
     .slice(0, 3)
-    .map((s) => (typeof s === 'string' ? humanProject(s) : humanProject(s.cwd || s.project || '')))
+    .map((s) => safeProject(typeof s === 'string' ? s : (s.cwd || s.project || '')))
     .filter(Boolean)
     .join(', ') || '—';
 
@@ -517,7 +504,7 @@ export function buildVars(state, config, aggregate) {
     gitRepo,
 
     // ── App identity (v0.3.6) ───────────────────────────────────
-    appName: config?.appName || 'Claude Code',
+    appName,
 
     // Literal single space — handy for blanking a line without `requires`.
     empty: ' ',

package/src/insights.js

@@ -4,24 +4,10 @@
 
 import { dayKey, weekKey } from './scanner.js';
 import { fmtCost } from './pricing.js';
+import { fmtNum, fmtHours } from './fmt.js';
 
 const WEEKDAYS = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
 
-function fmtHours(ms) {
-  if (!ms || ms < 0) return '0h';
-  const hours = ms / 3_600_000;
-  if (hours < 1) return `${Math.round(hours * 60)}m`;
-  if (hours < 10) return `${hours.toFixed(1)}h`;
-  return `${Math.round(hours)}h`;
-}
-
-function fmtNum(n) {
-  if (!n) return '0';
-  if (n < 1000) return `${n}`;
-  if (n < 1_000_000) return `${(n / 1000).toFixed(1)}k`;
-  return `${(n / 1_000_000).toFixed(2)}M`;
-}
-
 function pct(n) {
   const sign = n >= 0 ? '+' : '−';
   return `${sign}${Math.round(Math.abs(n) * 100)}%`;

package/src/install.js

@@ -52,7 +52,7 @@ function dirtyStep(sym, label, detail = '', log = console.log) {
 }
 function noop(fact) { noopFacts.push(fact); }
 
-const EVENTS = [
+export const EVENTS = [
   'SessionStart', 'UserPromptSubmit', 'PreToolUse', 'PostToolUse',
   'Stop', 'SubagentStop', 'Notification', 'SessionEnd', 'PreCompact',
 ];
@@ -69,7 +69,18 @@ function writeJson(p, d) {
 
 function isOurHookCommand(cmd) {
   if (!cmd) return false;
-  return /claude-rpc/i.test(cmd) || /hook\.js/i.test(cmd);
+  if (/claude-rpc/i.test(cmd)) return true;
+  // Dev-mode hooks point at THIS install's hook.js by absolute path. Match that
+  // exact path — NOT any `hook.js`, which could be a third-party tool's hook we
+  // must never rewrite or delete.
+  return cmd.includes(HOOK_SCRIPT.replace(/\\/g, '/'));
+}
+
+// A hook entry we own. Tagged entries are recognized regardless of command
+// shape or clone-dir name; command-matching is the legacy fallback for entries
+// written before tagging.
+export function isOurHook(h) {
+  return !!h && (h._claudeRpc === true || isOurHookCommand(h.command));
 }
 
 export function installHooks(exePath) {
@@ -81,24 +92,29 @@ export function installHooks(exePath) {
   //   npm     → `claude-rpc hook <event>`       (bin shim resolves through PATH;
   //              survives `npm update` and nvm version switches)
   //   dev     → `node "<src/hook.js>" <event>`  (cloned-source iteration)
+  // Hook commands must resolve under Claude Code's hook shell — `/bin/sh` with a
+  // minimal PATH that, under nvm, has neither `claude-rpc` nor `node` on it (no
+  // system node). So use the ABSOLUTE node (process.execPath) + absolute hook.js
+  // for both npm and dev installs; only the packaged exe is self-contained. This
+  // survives `npm update` (HOOK_SCRIPT is stable) and an nvm version switch (nvm
+  // keeps prior versions on disk); re-run setup only if that node is removed.
+  const node = process.execPath.replace(/\\/g, '/');
   const cmdFor = IS_PACKAGED
     ? (event) => `"${exePath}" hook ${event}`
-    : IS_NPM_INSTALL
-      ? (event) => `claude-rpc hook ${event}`
-      : (event) => `node "${HOOK_SCRIPT.replace(/\\/g, '/')}" ${event}`;
+    : (event) => `"${node}" "${HOOK_SCRIPT.replace(/\\/g, '/')}" ${event}`;
 
   for (const event of EVENTS) {
     const bucket = settings.hooks[event] = settings.hooks[event] || [];
     const wanted = cmdFor(event);
     const existingEntry = bucket.find((b) =>
-      Array.isArray(b.hooks) && b.hooks.some((h) => isOurHookCommand(h.command))
+      Array.isArray(b.hooks) && b.hooks.some((h) => isOurHook(h))
     );
     if (existingEntry) {
       existingEntry.hooks = existingEntry.hooks.map((h) =>
-        isOurHookCommand(h.command) ? { ...h, command: wanted } : h
+        isOurHook(h) ? { ...h, command: wanted, _claudeRpc: true } : h
       );
     } else {
-      bucket.push({ matcher: '', hooks: [{ type: 'command', command: wanted }] });
+      bucket.push({ matcher: '', hooks: [{ type: 'command', command: wanted, _claudeRpc: true }] });
     }
   }
   if (JSON.stringify(settings.hooks) === before) {
@@ -117,7 +133,7 @@ export function uninstallHooks() {
     const bucket = settings.hooks[event];
     if (!Array.isArray(bucket)) continue;
     settings.hooks[event] = bucket
-      .map((entry) => ({ ...entry, hooks: (entry.hooks || []).filter((h) => !isOurHookCommand(h.command)) }))
+      .map((entry) => ({ ...entry, hooks: (entry.hooks || []).filter((h) => !isOurHook(h)) }))
       .filter((entry) => (entry.hooks || []).length > 0);
     if (settings.hooks[event].length === 0) delete settings.hooks[event];
   }
@@ -421,7 +437,7 @@ export function migrateConfig({ silent = false } = {}) {
   // anyone who added a custom frame is left entirely alone.
   const frameId = (f) => (Array.isArray(f?.requires) && f.requires.length)
     ? 'r:' + [...f.requires].map(String).sort().join('|')
-    : 't:' + (f?.details ?? '') + '' + (f?.state ?? '');
+    : 't:' + (f?.details ?? '') + '\x00' + (f?.state ?? '');
   const dflBy = DEFAULT_CONFIG.presence?.byStatus || {};
   const usrBy = cfg.presence.byStatus || {};
   let framesAdded = 0;
@@ -453,18 +469,12 @@ export function migrateConfig({ silent = false } = {}) {
 // command and report success, leaving the user to discover the breakage
 // the next time they open Claude Code. Returns { ok, detail }.
 function verifyHookPipe(exePath) {
-  const cmd  = IS_PACKAGED ? exePath
-              : IS_NPM_INSTALL ? 'claude-rpc'
-              : process.execPath;
-  const args = IS_PACKAGED || IS_NPM_INSTALL
-              ? ['hook', 'SessionStart']
-              : [HOOK_SCRIPT, 'SessionStart'];
-  // Windows + npm-install: the global bin is `claude-rpc.cmd` (a batch shim),
-  // and Node's spawn doesn't apply PATHEXT — calling `claude-rpc` raw fails
-  // with ENOENT. shell:true makes cmd.exe do the resolution, mirroring how
-  // Claude Code actually invokes the hook string at runtime. Args are static
-  // and trusted; no injection surface.
-  const useShell = IS_NPM_INSTALL && process.platform === 'win32';
+  // Spawn exactly what installHooks wired: the packaged exe, or the absolute
+  // node + hook.js. Both are absolute, so there's no PATH/PATHEXT/shell
+  // resolution — it works under the same minimal hook shell Claude Code uses
+  // (the reason the old `claude-rpc` / bare-`node` forms failed under nvm).
+  const cmd  = IS_PACKAGED ? exePath : process.execPath;
+  const args = IS_PACKAGED ? ['hook', 'SessionStart'] : [HOOK_SCRIPT, 'SessionStart'];
   let result;
   try {
     result = spawnSync(cmd, args, {
@@ -472,7 +482,6 @@ function verifyHookPipe(exePath) {
       encoding: 'utf8',
       timeout: 3000,
       windowsHide: true,
-      shell: useShell,
     });
   } catch (e) {
     return { ok: false, detail: `spawn failed: ${e.message}` };
@@ -481,8 +490,14 @@ function verifyHookPipe(exePath) {
   if (result.status !== 0) {
     return { ok: false, detail: `hook exit ${result.status}: ${(result.stderr || '').trim().slice(0, 120)}` };
   }
-  if (!result.stdout.includes('"continue"')) {
-    return { ok: false, detail: `unexpected hook output: ${result.stdout.trim().slice(0, 120)}` };
+  // Parse the ack and assert the actual contract (a JSON object with
+  // continue:true) rather than substring-matching the bytes "continue" anywhere
+  // in stdout.
+  let ack;
+  try { ack = JSON.parse((result.stdout || '').trim()); }
+  catch { return { ok: false, detail: `non-JSON hook output: ${(result.stdout || '').trim().slice(0, 120)}` }; }
+  if (ack?.continue !== true) {
+    return { ok: false, detail: `hook ack missing continue:true: ${(result.stdout || '').trim().slice(0, 120)}` };
   }
   return { ok: true, detail: 'SessionStart round-trip succeeded' };
 }

package/src/leaderboard.js

@@ -29,7 +29,11 @@ export function isValidHandle(input) {
 // trim, bound the length. Returns null for empty input.
 export function cleanDisplayName(input, max = 40) {
   if (!input || typeof input !== 'string') return null;
-  const name = input.replace(/[\u0000-\u001f\u007f]/g, '').trim().slice(0, max);
+  // Strip control chars (C0/DEL/C1), zero-width, and bidi overrides so a name
+  // can't visually corrupt or spoof the shared board. Denylist by code point -
+  // CJK, emoji and accents still pass. Mirrored in the worker's cleanName.
+  const ok = (c) => !(c < 32 || (c >= 0x7f && c <= 0x9f) || (c >= 0x200b && c <= 0x200f) || (c >= 0x202a && c <= 0x202e) || (c >= 0x2066 && c <= 0x2069) || c === 0xfeff);
+  const name = [...input].filter((ch) => ok(ch.codePointAt(0))).join('').trim().slice(0, max);
   return name || null;
 }
 

package/src/mcp.js

@@ -114,6 +114,9 @@ export function callTool(name, getAgg = readAggregate) {
  */
 export function runMcpServer({ input = process.stdin, output = process.stdout } = {}) {
   let buf = '';
+  const MAX_BUF = 4 * 1024 * 1024; // hard cap on a single un-terminated line
+  const DEFAULT_PROTOCOL = '2024-11-05';
+  const SUPPORTED_PROTOCOLS = new Set([DEFAULT_PROTOCOL, '2025-03-26', '2025-06-18']);
   const send = (msg) => output.write(JSON.stringify(msg) + '\n');
   const reply = (id, result) => send({ jsonrpc: '2.0', id, result });
   const replyErr = (id, code, message) => send({ jsonrpc: '2.0', id, error: { code, message } });
@@ -121,8 +124,12 @@ export function runMcpServer({ input = process.stdin, output = process.stdout }
   function handle(msg) {
     const { id, method, params } = msg;
     if (method === 'initialize') {
+      // Echo the client's protocol version when we recognize it; otherwise fall
+      // back to our baseline (our surface — initialize/tools/*/ping — is stable
+      // across these revisions).
+      const requested = params?.protocolVersion;
       return reply(id, {
-        protocolVersion: '2024-11-05',
+        protocolVersion: SUPPORTED_PROTOCOLS.has(requested) ? requested : DEFAULT_PROTOCOL,
         capabilities: { tools: {} },
         serverInfo: { name: 'claude-rpc', version: VERSION },
       });
@@ -159,7 +166,14 @@ export function runMcpServer({ input = process.stdin, output = process.stdout }
       try { msg = JSON.parse(line); } catch { continue; }
       try { handle(msg); } catch (e) { process.stderr.write(`mcp handler error: ${e.message}\n`); }
     }
+    // A single line larger than the cap (no newline yet) would grow buf without
+    // bound — drop the partial and resync on the next newline.
+    if (buf.length > MAX_BUF) {
+      process.stderr.write(`mcp: dropping oversized line (>${MAX_BUF} bytes)\n`);
+      buf = '';
+    }
   });
   input.on('end', () => process.exit(0));
+  input.on('error', () => process.exit(0));
   process.stderr.write(`claude-rpc MCP server v${VERSION} ready (stdio)\n`);
 }

package/src/notify.js

@@ -29,7 +29,7 @@ export function sanitizeLabel(s) {
  * @param {string} [body] - Notification body text.
  * @returns {boolean} true if a notifier was spawned, false on failure.
  */
-export function desktopNotify(title, body = '') {
+export function desktopNotify(title, body = '', { spawn: spawnFn = spawn } = {}) {
   try {
     const p = platform();
     // A missing notifier binary (e.g. no `notify-send`) makes spawn emit an
@@ -43,15 +43,15 @@ export function desktopNotify(title, body = '') {
     };
     if (p === 'darwin') {
       const script = `display notification ${JSON.stringify(body)} with title ${JSON.stringify(title)}`;
-      swallow(spawn('osascript', ['-e', script], { stdio: 'ignore', detached: true }));
+      swallow(spawnFn('osascript', ['-e', script], { stdio: 'ignore', detached: true }));
     } else if (p === 'win32') {
       const script = `Add-Type -AssemblyName System.Windows.Forms;`
         + `$n=New-Object System.Windows.Forms.NotifyIcon;`
         + `$n.Icon=[System.Drawing.SystemIcons]::Information;$n.Visible=$true;`
         + `$n.ShowBalloonTip(5000, ${JSON.stringify(title)}, ${JSON.stringify(body)}, 'Info')`;
-      swallow(spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore', detached: true, windowsHide: true }));
+      swallow(spawnFn('powershell', ['-NoProfile', '-NonInteractive', '-Command', script], { stdio: 'ignore', detached: true, windowsHide: true }));
     } else {
-      swallow(spawn('notify-send', ['-a', 'Claude Code', title, body], { stdio: 'ignore', detached: true }));
+      swallow(spawnFn('notify-send', ['-a', 'Claude Code', title, body], { stdio: 'ignore', detached: true }));
     }
     return true;
   } catch {

package/src/privacy.js

@@ -21,7 +21,7 @@
 // by these flags. Privacy is a one-way valve from local state → Discord.
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
+import { execFile } from 'node:child_process';
 import { join, basename, dirname, resolve as resolvePath } from 'node:path';
 import { DATA_DIR } from './paths.js';
 
@@ -33,6 +33,7 @@ const TTL_MS = 5 * 60 * 1000;
 
 const projectFileCache = new Map();   // cwd → { ts, value | null }
 const ghPrivateCache  = new Map();    // cwd → { ts, value: bool | null }
+const ghProbeInFlight = new Set();    // cwds with an async `gh` probe running
 
 // ── Per-project .claude-rpc.json ────────────────────────────────────────
 
@@ -182,18 +183,33 @@ export function detectGithubPrivate(cwd) {
   if (!cwd) return null;
   const cached = ghPrivateCache.get(cwd);
   if (cached && Date.now() - cached.ts < TTL_MS) return cached.value;
-  let value = null;
-  try {
-    const out = execFileSync(
-      'gh',
-      ['repo', 'view', '--json', 'isPrivate', '-q', '.isPrivate'],
-      { cwd, stdio: ['ignore', 'pipe', 'ignore'], timeout: 1500 }
-    ).toString().trim();
-    if (out === 'true') value = true;
-    else if (out === 'false') value = false;
-  } catch { /* gh missing, not auth'd, not a repo, timeout — unknown */ }
-  ghPrivateCache.set(cwd, { ts: Date.now(), value });
-  return value;
+  // Cache miss: the single-threaded daemon render path must never block on a
+  // subprocess (a 1.5s gh call stalls ALL presence + file-watch updates). Fire
+  // a non-blocking probe and serve the last known value (null = unknown) this
+  // tick; the fresh verdict lands in the cache for the next one.
+  probeGithubPrivate(cwd);
+  return cached ? cached.value : null;
+}
+
+function probeGithubPrivate(cwd) {
+  if (ghProbeInFlight.has(cwd)) return; // one in-flight probe per cwd
+  ghProbeInFlight.add(cwd);
+  execFile(
+    'gh',
+    ['repo', 'view', '--json', 'isPrivate', '-q', '.isPrivate'],
+    { cwd, timeout: 1500 },
+    (err, stdout) => {
+      ghProbeInFlight.delete(cwd);
+      let value = null;
+      if (!err) {
+        const out = String(stdout).trim();
+        if (out === 'true') value = true;
+        else if (out === 'false') value = false;
+      }
+      // gh missing / not auth'd / not a repo / timeout → value stays null (unknown).
+      ghPrivateCache.set(cwd, { ts: Date.now(), value });
+    }
+  );
 }
 
 // ── Resolution + application ────────────────────────────────────────────

package/src/profile.js

@@ -7,6 +7,7 @@
 
 import { fmtCost } from './pricing.js';
 import { VERSION } from './version.js';
+import { fmtNum, fmtHours } from './fmt.js';
 
 const W = 520;
 const H = 240;
@@ -32,22 +33,6 @@ function escapeXml(s) {
     .replace(/"/g, '"');
 }
 
-function fmtNum(n) {
-  if (!n) return '0';
-  if (n < 1000) return String(Math.round(n));
-  if (n < 1_000_000) return `${(n / 1000).toFixed(1)}k`;
-  if (n < 1_000_000_000) return `${(n / 1_000_000).toFixed(2)}M`;
-  return `${(n / 1_000_000_000).toFixed(2)}B`;
-}
-
-function fmtHours(ms) {
-  if (!ms || ms < 0) return '0h';
-  const h = ms / 3_600_000;
-  if (h < 1) return `${Math.round(h * 60)}m`;
-  if (h < 10) return `${h.toFixed(1)}h`;
-  return `${Math.round(h)}h`;
-}
-
 function topLanguage(aggregate) {
   const langs = aggregate?.languages || {};
   let best = null;

package/src/scanner.js

@@ -632,25 +632,37 @@ export function readSessionTokens(path) {
 
 // Detect live sessions by transcript mtime. Returns array of { path, project, cwd, mtime, ageSec }.
 // A session is "live" if its .jsonl was modified within thresholdMs.
-export function findLiveSessions({ projectsDir = CLAUDE_PROJECTS, thresholdMs = 90_000 } = {}) {
-  if (!existsSync(projectsDir)) return [];
+// Roots default to the same set scan() uses — the canonical ~/.claude/projects
+// plus any discovered alt locations — so live presence, concurrent-session
+// detection, the web API, doctor and the TUI don't go silent on XDG-strict /
+// AppData / Library-relocated installs. Legacy single-root `projectsDir` and
+// explicit multi-root `projectsDirs` are both still accepted.
+export function findLiveSessions({ projectsDir, projectsDirs, thresholdMs = 90_000 } = {}) {
+  const dirs = projectsDirs && projectsDirs.length ? projectsDirs
+    : projectsDir ? [projectsDir]
+    : [CLAUDE_PROJECTS, ...discoverAltProjectDirs()];
   const now = Date.now();
   const live = [];
-  for (const proj of readdirSync(projectsDir)) {
-    const projPath = join(projectsDir, proj);
-    let entries;
-    try { entries = readdirSync(projPath, { withFileTypes: true }); } catch { continue; }
-    for (const e of entries) {
-      // Only top-level transcripts count as sessions, not subagent files.
-      if (!e.isFile() || !e.name.endsWith('.jsonl')) continue;
-      const full = join(projPath, e.name);
-      let st;
-      try { st = statSync(full); } catch { continue; }
-      const age = now - st.mtimeMs;
-      if (age <= thresholdMs) {
-        const cwd = readTranscriptCwd(full, st.mtimeMs);
-        const project = cleanProjectName(cwd ? basename(cwd) : proj);
-        live.push({ path: full, project, cwd: cwd || '', mtime: st.mtimeMs, ageSec: Math.round(age / 1000) });
+  for (const root of dirs) {
+    if (!existsSync(root)) continue;
+    let projects;
+    try { projects = readdirSync(root); } catch { continue; }
+    for (const proj of projects) {
+      const projPath = join(root, proj);
+      let entries;
+      try { entries = readdirSync(projPath, { withFileTypes: true }); } catch { continue; }
+      for (const e of entries) {
+        // Only top-level transcripts count as sessions, not subagent files.
+        if (!e.isFile() || !e.name.endsWith('.jsonl')) continue;
+        const full = join(projPath, e.name);
+        let st;
+        try { st = statSync(full); } catch { continue; }
+        const age = now - st.mtimeMs;
+        if (age <= thresholdMs) {
+          const cwd = readTranscriptCwd(full, st.mtimeMs);
+          const project = cleanProjectName(cwd ? basename(cwd) : proj);
+          live.push({ path: full, project, cwd: cwd || '', mtime: st.mtimeMs, ageSec: Math.round(age / 1000) });
+        }
       }
     }
   }

package/src/server/api.js

@@ -3,7 +3,7 @@
 // from the routing layer.
 
 import { basename } from 'node:path';
-import { readState } from '../state.js';
+import { readActiveState } from '../state.js';
 import { buildVars, fillTemplate, applyIdle, framePasses, humanModel } from '../format.js';
 import { readAggregate, findLiveSessions, dayKey } from '../scanner.js';
 import { loadConfig as loadSharedConfig } from '../config.js';
@@ -111,7 +111,7 @@ export function windowedAggregate(agg, range) {
 export function snapshot() {
   const config = loadConfig();
   const live = findLiveSessions({ thresholdMs: 90_000 });
-  let state = readState();
+  let state = readActiveState();
   state.liveSessions = live;
   state = applyIdle(state, config);
   const aggregate = readAggregate() || {};
@@ -196,7 +196,7 @@ export function wrappedData() {
     topLanguage: langs[0] ? { name: langs[0][0], edits: langs[0][1].edits || 0 } : null,
     languages: langs.slice(0, 5).map(([name, v]) => ({ name, edits: v.edits || 0 })),
     hotspot: top ? { name: basename(String(top.path || '')), count: top.count, daysSinceLastEdit: top.daysSinceLastEdit } : null,
-    peakHour: agg.peakHour && agg.peakHour.hour != null ? agg.peakHour.hour : null,
+    peakHour: (Number.isInteger(agg.peakHour?.hour) && agg.peakHour.hour >= 0 && agg.peakHour.hour <= 23) ? agg.peakHour.hour : null,
     peakWeekday: peakWd ? { name: WRAPPED_WEEKDAYS[peakWd.day], hours: peakWd.ms / 3_600_000 } : null,
     modelSplit: (agg.modelSplit || []).slice(0, 4).map((m) => ({ model: humanModel(m.model) || m.model, costPct: m.costPct || 0, tokenPct: m.tokenPct || 0 })),
     linesAdded: agg.linesAdded || 0,

package/src/server/assets/dashboard.client.js

@@ -23,6 +23,7 @@
   let range = '90d';
   let liveData = null;
   let aggData = null;
+  let heatmapByDay = null; // dedicated fixed-90d source, independent of the range pill
   let allFrames = [];
   let currentLiveIdx = 0;
   let rotationTimer = null;
@@ -162,25 +163,30 @@
   function renderHeatmap(byDay) {
     const grid = $('heatmap-grid');
     grid.innerHTML = '';
+    byDay = byDay || {};
     const today = new Date(); today.setHours(0, 0, 0, 0);
-    let start = new Date(today); start.setDate(start.getDate() - 90);
+    const start = new Date(today); start.setDate(start.getDate() - 90);
     while (start.getDay() !== 0) start.setDate(start.getDate() - 1);
-    let max = 0;
-    for (let k in byDay) max = Math.max(max, byDay[k].activeMs || 0);
+    // The day keys actually drawn — a fixed window ending today, independent of
+    // the range pill (so 7d/30d don't blank the grid).
+    const keys = [];
     const cur = new Date(start);
-    while (cur <= today) {
-      const k = dayKey(cur.getTime());
+    while (cur <= today) { keys.push(dayKey(cur.getTime())); cur.setDate(cur.getDate() + 1); }
+    // Normalize against the max of ONLY the drawn cells, so an off-window peak
+    // (from a wider range selection) can't dim the visible grid.
+    let max = 0;
+    for (const k of keys) max = Math.max(max, (byDay[k] || {}).activeMs || 0);
+    for (const k of keys) {
       const ms = (byDay[k] || {}).activeMs || 0;
       const cell = document.createElement('div');
       cell.className = 'cell';
-      if (ms > 0) {
+      if (ms > 0 && max > 0) {
         const lvl = Math.min(1, ms / max);
         cell.style.background = 'rgba(74, 222, 128, ' + (0.18 + lvl * 0.72).toFixed(2) + ')';
       }
       cell.title = k + ' · ' + fmtH(ms);
       cell.addEventListener('click', () => openDay(k));
       grid.appendChild(cell);
-      cur.setDate(cur.getDate() + 1);
     }
   }
 
@@ -434,6 +440,16 @@
     } catch (e) { console.error(e); }
   }
 
+  // The heatmap always shows the same fixed ~90-day window, so it has its own
+  // fetch decoupled from the range pill.
+  async function fetchHeatmap() {
+    try {
+      const r = await fetch('/api/aggregate?range=90d', { cache: 'no-store' });
+      heatmapByDay = (await r.json()).byDay || {};
+      renderHeatmap(heatmapByDay);
+    } catch (e) { console.error(e); }
+  }
+
   async function fetchInsights() {
     try {
       const r = await fetch('/api/insights');
@@ -454,7 +470,7 @@
     if (!aggData) return;
     const days = range === '7d' ? 7 : range === '30d' ? 30 : range === '1y' ? 365 : range === 'all' ? 365 : 90;
     renderChart(aggData.byDay || {}, days);
-    renderHeatmap(aggData.byDay || {});
+    renderHeatmap(heatmapByDay || aggData.byDay || {});
     renderChurn(aggData.byDay || {}, Math.min(days, 90));
     renderCost(aggData);
     renderLanguages(aggData.languages);
@@ -573,7 +589,9 @@
   // ── SSE ────────────────────────────────────────────────
   function startSse() {
     try {
+      $('conn-state').textContent = 'connecting';
       const ev = new EventSource('/events');
+      ev.onopen = () => { $('conn-state').textContent = 'live'; };
       ev.onmessage = async (e) => {
         try {
           const d = JSON.parse(e.data);
@@ -582,10 +600,14 @@
             await refreshState();
             await fetchAggregate();
             await fetchInsights();
+            await fetchHeatmap();
           }
         } catch { /* malformed SSE frame — wait for the next one */ }
       };
-      ev.onerror = () => { $('conn-state').textContent = 'reconnecting'; setTimeout(() => { $('conn-state').textContent = 'live'; }, 4000); };
+      // CLOSED = EventSource gave up (no auto-retry); otherwise a native
+      // reconnect is already in flight. No blind timer flipping back to "live"
+      // while the daemon is actually down.
+      ev.onerror = () => { $('conn-state').textContent = ev.readyState === EventSource.CLOSED ? 'offline' : 'reconnecting'; };
     } catch { /* EventSource constructor failed (very old browser) — dashboard falls back to one-shot fetches */ }
   }
 
@@ -650,6 +672,7 @@
     await refreshState();
     await fetchAggregate();
     await fetchInsights();
+    await fetchHeatmap();
     startSse();
     // Restore deep link.
     if (location.hash.startsWith('#projects/')) openProject(decodeURIComponent(location.hash.slice(10)));

package/src/server/index.js

@@ -15,7 +15,7 @@ import { createServer } from 'node:http';
 import { exec } from 'node:child_process';
 import { ROUTES, JSON_HEADERS } from './routes.js';
 import { projectDrilldown, dayDetail } from './api.js';
-import { sseClients, watchSources } from './sse.js';
+import { watchSources, addClient, removeClient } from './sse.js';
 import { buildHtml, buildWrappedHtml } from './page.js';
 
 // Pre-compose the HTML once at startup — the only dynamic bit is the port
@@ -60,8 +60,8 @@ function dispatch(req, res) {
       'connection': 'keep-alive',
     });
     res.write(': hello\n\n');
-    sseClients.add(res);
-    req.on('close', () => sseClients.delete(res));
+    addClient(res);
+    req.on('close', () => removeClient(res));
     return;
   }
 

package/src/server/sse.js

@@ -16,6 +16,33 @@ export function broadcast(payload) {
   }
 }
 
+// Heartbeat: bytes only flow on file-change broadcasts, so an idle connection
+// can sit half-open indefinitely and a dead socket isn't reaped until the next
+// real write throws. A periodic comment frame keeps connections warm and lets
+// the write/try-catch evict peers that have gone away. Started on the first
+// client, cleared when the last one leaves.
+const HEARTBEAT_MS = 20_000;
+let heartbeat = null;
+
+export function addClient(res) {
+  sseClients.add(res);
+  if (heartbeat) return;
+  heartbeat = setInterval(() => {
+    for (const r of sseClients) {
+      try { r.write(': ping\n\n'); } catch { sseClients.delete(r); }
+    }
+  }, HEARTBEAT_MS);
+  heartbeat.unref?.(); // a lone heartbeat shouldn't keep the process alive
+}
+
+export function removeClient(res) {
+  sseClients.delete(res);
+  if (sseClients.size === 0 && heartbeat) {
+    clearInterval(heartbeat);
+    heartbeat = null;
+  }
+}
+
 // Watch a file that is updated via atomic rename (write-tmp + renameSync).
 // Watching the file path directly binds to the inode at watch-time — on
 // Linux that inode is replaced by the first rename, so the watcher fires

package/src/state.js

@@ -13,6 +13,7 @@ import {
 } from 'node:fs';
 import { basename, join } from 'node:path';
 import { STATE_PATH, STATE_DIR } from './paths.js';
+import { pickActiveSession } from './presence.js';
 
 const DEFAULT_STATE = {
   sessionStart: null,
@@ -170,6 +171,17 @@ export function readState(sessionId) {
   }
 }
 
+// The session a one-shot reader (status / serve / tui) should display. The
+// daemon resolves per-session state with cross-tick stickiness; one-shot readers
+// have no cursor, so they pass displayedId=null and get the most-recently-active
+// session — exactly what the daemon settles on. Falls back to the legacy global
+// state.json when no per-session files exist (e.g. a hook payload without an id).
+export function readActiveState({ now = Date.now(), idleMs = 60_000 } = {}) {
+  const sessions = listSessionStates();
+  if (!sessions.length) return readState();
+  return pickActiveSession(sessions, null, now, idleMs).state || readState();
+}
+
 export function writeState(next, sessionId) {
   ensureDir();
   const path = statePathFor(sessionId);

package/src/tui.js

@@ -6,8 +6,9 @@
 
 import process from 'node:process';
 import { readFileSync, existsSync } from 'node:fs';
-import { readState } from './state.js';
-import { readAggregate, findLiveSessions, dayKey, weekKey } from './scanner.js';
+import { readActiveState } from './state.js';
+import { readAggregate, findLiveSessions, weekKey } from './scanner.js';
+import { weekGrid } from './week.js';
 import { buildVars, applyIdle, humanProject } from './format.js';
 import { loadConfig } from './config.js';
 import { PID_PATH } from './paths.js';
@@ -51,7 +52,7 @@ let exiting = false;
 
 // ── Data ────────────────────────────────────────────────────────────────────
 function loadSnapshot() {
-  let state = readState();
+  let state = readActiveState();
   state.liveSessions = findLiveSessions({ thresholdMs: 90_000 });
   const config = loadConfig();
   state = applyIdle(state, config);
@@ -186,22 +187,7 @@ function tabWeek(_, data) {
   if (agg.byDay) {
     out.push('');
     out.push(`${C.dim}daily breakdown${C.reset}`);
-    const now = new Date();
-    now.setHours(0, 0, 0, 0);
-    const monday = new Date(now);
-    monday.setDate(monday.getDate() - ((monday.getDay() + 6) % 7));
-    const days = [];
-    for (let i = 0; i < 7; i++) {
-      const d = new Date(monday);
-      d.setDate(d.getDate() + i);
-      const k = dayKey(d.getTime());
-      const dayName = ['Sun','Mon','Tue','Wed','Thu','Fri','Sat'][d.getDay()];
-      const ms = agg.byDay[k]?.activeMs || 0;
-      const isFuture = d > now;
-      const isToday = k === dayKey(now.getTime());
-      days.push({ label: `${dayName} ${k.slice(5)}`, ms, isFuture, isToday });
-    }
-    const maxMs = Math.max(...days.map((d) => d.ms)) || 1;
+    const { days, maxMs } = weekGrid(agg.byDay);
     for (const { label, ms, isFuture, isToday } of days) {
       if (isFuture) {
         out.push(`${C.dim}${label.padEnd(11)}${' '.repeat(18)}     —${C.reset}`);

package/src/usage.js

@@ -75,7 +75,7 @@ export function normalizeUsage(json) {
 
 export async function fetchUsage({ fetchImpl = globalThis.fetch, creds = readClaudeCredentials(), now = Date.now() } = {}) {
   if (!creds?.accessToken) return { ok: false, reason: 'no-credentials' };
-  if (creds.expiresAt && now > creds.expiresAt) return { ok: false, reason: 'token-expired' };
+  if (creds.expiresAt && now > creds.expiresAt - 30_000) return { ok: false, reason: 'token-expired' }; // 30s skew margin — skip a request we know will 401
   let res;
   try {
     res = await fetchImpl(USAGE_ENDPOINT, {
@@ -112,7 +112,11 @@ export function writeUsageCache(usage, path = USAGE_CACHE_PATH) {
 export function readUsageCache({ path = USAGE_CACHE_PATH, maxAgeMs = USAGE_STALE_MS, now = Date.now() } = {}) {
   try {
     const u = JSON.parse(readFileSync(path, 'utf8'));
-    if (!u?.fetchedAt || now - u.fetchedAt > maxAgeMs) return null;
+    if (!u?.fetchedAt) return null;
+    const age = now - u.fetchedAt;
+    // Stale, or future-dated (corrupt write / clock skew) — a future fetchedAt
+    // would otherwise read as fresh forever.
+    if (age > maxAgeMs || age < -60_000) return null;
     return u;
   } catch { return null; }
 }

package/src/version.js

@@ -11,7 +11,7 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ROOT } from './paths.js';
 
-const BAKED = '0.18.0';
+const BAKED = '0.19.1';
 
 function readPkgVersion() {
   try {

package/src/week.js

@@ -0,0 +1,33 @@
+// Shared Monday-anchored current-week grid. cli.js (showWeek) and tui.js
+// (tabWeek) render it with different ANSI widths but compute the same seven
+// days, future/today flags, and peak — extracted here so the date math can't
+// drift between the two and is unit-testable against a fixed clock.
+
+import { dayKey } from './scanner.js';
+
+const DAY_NAMES = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+
+// Returns { days: [{ label, ms, isFuture, isToday }], maxMs } for the ISO week
+// (Mon -> Sun) containing `now`. `label` is e.g. "Wed 06-17"; future days have
+// ms 0 and isFuture true. maxMs is floored at 1 so callers divide safely.
+export function weekGrid(byDay = {}, now = new Date()) {
+  const today = new Date(now);
+  today.setHours(0, 0, 0, 0);
+  const monday = new Date(today);
+  monday.setDate(monday.getDate() - ((monday.getDay() + 6) % 7));
+  const todayKey = dayKey(today.getTime());
+  const days = [];
+  for (let i = 0; i < 7; i++) {
+    const d = new Date(monday);
+    d.setDate(d.getDate() + i);
+    const k = dayKey(d.getTime());
+    days.push({
+      label: `${DAY_NAMES[d.getDay()]} ${k.slice(5)}`,
+      ms: byDay?.[k]?.activeMs || 0,
+      isFuture: d > today,
+      isToday: k === todayKey,
+    });
+  }
+  const maxMs = Math.max(...days.map((x) => x.ms)) || 1;
+  return { days, maxMs };
+}