crewforth 3.1.1 → 3.2.0-rc.2

package/kit/studio/server/lib/code-stamp.js

@@ -0,0 +1,35 @@
+// code-stamp.js — is the code this server runs still the code on disk?
+//
+// A server keeps the code it started with. An update replaces the files on disk, the page is served fresh from
+// them, and the two disagree: measured in a real project, a server started before 3.2.0 answered the new Map
+// view's /api/map with 404, which the view showed as "Not read — HTTP 404". The stamp is the size and mtime of
+// every file of the server, taken at start and again when asked; when they differ, the page says to restart.
+import fs from 'node:fs';
+import path from 'node:path';
+
+/** Size and mtime of every .js/.mjs/.sh file under `dir` (the server's own code), as one string. */
+export function codeStamp(dir) {
+  const parts = [];
+  const walk = (d) => {
+    let entries;
+    try { entries = fs.readdirSync(d, { withFileTypes: true }); } catch { return; }
+    for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))) {
+      const p = path.join(d, e.name);
+      if (e.isDirectory()) { if (e.name !== 'node_modules') walk(p); continue; }
+      if (!/\.(m?js|sh)$/.test(e.name)) continue;
+      try { const st = fs.statSync(p); parts.push(`${path.relative(dir, p)}:${st.size}:${Math.round(st.mtimeMs)}`); } catch { /* gone */ }
+    }
+  };
+  walk(dir);
+  return parts.join('|');
+}
+
+/** Stamp the code now, and answer later whether it has changed on disk (re-read at most every `everyMs`). */
+export function stampAtStart(dir, { everyMs = 5000, now = () => Date.now() } = {}) {
+  const boot = codeStamp(dir);
+  let last = boot; let at = now();
+  return () => {
+    if (now() - at >= everyMs) { last = codeStamp(dir); at = now(); }
+    return { changed: last !== boot };
+  };
+}

package/kit/studio/server/lib/crew-map.js

@@ -0,0 +1,113 @@
+// What Crewforth's crew map says about a project, for the Map view.
+//
+// The map is `.crewforth/crew-map.json`, written by Crewforth's scanner (kit/eval/lib/crew-map/scan.mjs): the
+// project's modules, the external resources it touches, the endpoints it provides and calls, and the findings
+// between them, every one citing file:line. This file reads it and runs nothing that writes: no scan is started
+// from here, and a map that is not on disk is said to be missing. The one process it starts is `git rev-list
+// --count`, to say how far the project has moved since the commit the map was scanned at.
+//
+// Compare with: another project's map is read the same way. The scanner already says which of a project's calls
+// no endpoint in that project provides (they go somewhere else); those are the calls compared here. One the other
+// project provides is a match, one it does not is missing.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFile } from 'node:child_process';
+
+export const MAP_FILE = path.join('.crewforth', 'crew-map.json');
+// How a project writes its map, said wherever a map is missing. The one place it is written: the view and the
+// page show what the server sends.
+// /crew-map in Claude Code: the scan, then the descriptions, in either edition (the plugin has no .claude/eval).
+export const WRITER = '/crew-map in Claude Code';
+export const SCHEMA = /^crewforth\.crew-map\/1$/;
+const MAX_BYTES = 8 * 1024 * 1024;
+const GIT_TIMEOUT_MS = 5000;
+
+const maps = new Map();               // cwd -> { sig, value }
+export const _stats = { parsed: 0 };  // how many times a map was really read: the claims count it
+
+/**
+ * The map of one project, read once and kept until the file changes (its time or its size).
+ * @returns { measured: true, file, bytes, doc } or { measured: false, reason }
+ */
+export function readMap(cwd) {
+  const file = path.join(cwd, MAP_FILE);
+  let st;
+  try { st = fs.statSync(file); } catch {
+    return { measured: false, missing: true, reason: `no ${MAP_FILE.replaceAll('\\', '/')} in this project. Write one there with: ${WRITER}` };
+  }
+  const sig = `${st.mtimeMs}:${st.size}`;
+  const hit = maps.get(cwd);
+  if (hit && hit.sig === sig) return hit.value;
+  const value = parseMap(file, st.size);
+  _stats.parsed += 1;
+  if (maps.size > 50) maps.clear();
+  maps.set(cwd, { sig, value });
+  return value;
+}
+
+function parseMap(file, size) {
+  const shown = MAP_FILE.replaceAll('\\', '/');
+  // Read whole or not at all: half a map would draw modules without the edges that belong to them.
+  if (size > MAX_BYTES) return { measured: false, reason: `${shown} is ${size} bytes, over the ${MAX_BYTES} Studio reads` };
+  let doc;
+  try { doc = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) { return { measured: false, reason: `${shown} is not JSON (${e.message.slice(0, 80)})` }; }
+  if (!SCHEMA.test(String(doc?.schema))) return { measured: false, reason: `${shown} says schema ${JSON.stringify(doc?.schema ?? null)}, and Studio reads crewforth.crew-map/1` };
+  for (const k of ['nodes', 'edges', 'findings', 'notMeasured']) {
+    if (!Array.isArray(doc[k])) return { measured: false, reason: `${shown} has no ${k} list` };
+  }
+  return { measured: true, file: shown, bytes: size, doc };
+}
+
+/** What the navigator says of a project's map: null with none, else how many findings it shows unasked. */
+export function mapSummary(cwd) {
+  const m = readMap(cwd);
+  if (!m.measured) return m.missing ? null : { findings: null, reason: m.reason };
+  return { findings: m.doc.findings.filter((f) => !f?.data?.defaultHidden).length };
+}
+
+/**
+ * How many commits HEAD is past the commit the map was scanned at: { count } or { count: null, reason }.
+ * Only a commit id is handed to git, so nothing in the file can become an option.
+ */
+export function behindOf(cwd, commit) {
+  if (typeof commit !== 'string' || !/^[0-9a-f]{7,64}$/.test(commit)) return Promise.resolve({ count: null, reason: 'the map names no commit' });
+  return new Promise((resolve) => {
+    execFile('git', ['rev-list', '--count', `${commit}..HEAD`], { cwd, timeout: GIT_TIMEOUT_MS, windowsHide: true }, (err, stdout) => {
+      const n = Number.parseInt(String(stdout).trim(), 10);
+      if (err || !Number.isFinite(n)) resolve({ count: null, reason: 'git could not say (the commit may not be in this clone)' });
+      else resolve({ count: n });
+    });
+  });
+}
+
+/** One endpoint as it is matched: the method, and the path with each parameter written as one `*`. */
+export function endpointKey(e) {
+  const p = String(e?.path ?? '').split('?')[0].replace(/\/+$/, '') || '/';
+  const segs = p.split('/').map((s) => (/^(:\w+|\{[^}]*\}|<[^>]*>|\*)$/.test(s) ? '*' : s));
+  return `${String(e?.method ?? '').toUpperCase()} ${segs.join('/')}`;
+}
+
+/**
+ * Another project's calls into this one. `doc` is this project's map, `other` the other project's. A call of the
+ * other project is compared when no endpoint of its own provides it (the scanner's own endpoint-missing). Each
+ * calling module of the other project is one client: what it calls here that this project provides (`calls`,
+ * each with `to`, the module of this project that provides it),
+ * and what else it calls that its own project does not provide either (`missing`). A module none of whose calls
+ * this project provides is not a client of it, and is not listed: its calls go to a third place, and naming them
+ * missing here would say something the two maps do not.
+ */
+export function compareMaps(doc, other) {
+  const own = new Set((other?.provides?.endpoints ?? []).map(endpointKey));
+  const here = new Map((doc?.provides?.endpoints ?? []).map((e) => [endpointKey(e), e.module]));
+  const names = new Map((other?.nodes ?? []).filter((n) => n.kind === 'module').map((n) => [n.id, n]));
+  const by = new Map();
+  for (const e of other?.consumes?.endpoints ?? []) {
+    const k = endpointKey(e);
+    if (own.has(k)) continue;
+    const c = by.get(e.module) ?? by.set(e.module, { id: e.module, name: names.get(e.module)?.name ?? e.module, tech: names.get(e.module)?.tech ?? [], calls: [], missing: [] }).get(e.module);
+    const call = { method: e.method, path: e.path, evidence: (e.evidence ?? []).slice(0, 1) };
+    if (here.has(k)) c.calls.push({ ...call, to: here.get(k) }); else c.missing.push(call);
+  }
+  return [...by.values()].filter((c) => c.calls.length).sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}

package/kit/studio/server/lib/model-outcomes.js

@@ -2,7 +2,7 @@
 //
 // Crewforth writes one line per finished crew agent to `.claude/state/model-outcomes.tsv` (hooks/agent-outcome.sh):
 //
-//   ts  agent_id  agent  change  risk  card  model  verify  fixes  escalated_from  ran_on  confidence
+//   ts  agent_id  agent  change  risk  card  model  verify  fixes  escalated_from  ran_on  confidence  [risk_why]
 //
 // Twelve columns, tab-separated, a header on the first line, "-" for an empty value, and any column added later
 // is added at the end. This file reads that and adds nothing to it: a class's first-try success is counted from
@@ -19,11 +19,18 @@
 // failed too often. Lowering such a hold is the user's to approve, with a Crewforth command in their own session:
 // Studio shows which holds could be lowered (`suggestionsOf`) and writes nothing. A panel's button is a request
 // any process of the same user can send, so it cannot stand for the user.
+//
+// The gate holds a floor and no ceiling: normal work may run on a model above the one the table in CLAUDE.md asks
+// for it. Studio shows that work (`aboveTableOf`) and blocks nothing. That the table's model would have done is
+// said only where this record shows it: the class's latest LOOSEN_AFTER verified calls on that model all passed the
+// first time, the same test a hold is offered for lowering by.
 
 import fs from 'node:fs';
 import path from 'node:path';
 
 export const COLUMNS = ['ts', 'agent_id', 'agent', 'change', 'risk', 'card', 'model', 'verify', 'fixes', 'escalated_from', 'ran_on', 'confidence'];
+// Added at the end later, so a line written before them is still whole without them.
+export const LATER_COLUMNS = ['risk_why'];
 const VERIFIED = new Set(['pass', 'fail']);
 // What the hooks write, and nothing else is a row. The words are hooks/guard-agent-model.sh's and
 // hooks/agent-outcome.sh's; a word they do not use is a line this file cannot read, not a new kind of work.
@@ -36,6 +43,14 @@ const MAX_BYTES = 4 * 1024 * 1024;      // the record is read whole; past this o
 // A starting point; it has not been measured.
 export const LOOSEN_AFTER = 10;
 const TRAIL_MAX = 6;
+// What the table in CLAUDE.md asks of normal work, at most. Above it is a choice the gate lets the caller make.
+export const NORMAL_TIER = 'sonnet';
+// The floor hooks/guard-agent-model.sh puts under an agent whatever its card says (its `case "$st"`).
+export const AGENT_FLOORS = {
+  'crew-security-expert': 'opus',
+  'crew-privacy-agent': 'sonnet', 'crew-review-agent': 'sonnet', 'crew-planner': 'sonnet', 'crew-database-expert': 'sonnet',
+};
+const rankOf = (t) => TIERS.indexOf(t) + 1;   // 1..4, 0 for no tier: the gate's _am_rank
 
 const stateDir = (cwd) => path.join(cwd, '.claude', 'state');
 const dash = (v) => (v === '-' || v === '' || v == null ? null : v);
@@ -72,6 +87,8 @@ export function parseOutcomes(text) {
       line: i, ts: f[0], at, agentId: f[1], agent: f[2], change: f[3], risk: f[4], card: dash(f[5]),
       model: dash(f[6]), verify: f[7], fixes: Number.parseInt(f[8], 10), escalatedFrom: dash(f[9]), ranOn: dash(f[10]),
       confidence: dash(f[11]),
+      // Written by the gate when it called the work critical; a line from before it kept the reason has no column.
+      riskWhy: dash(f[12]),
     });
   }
   return out;
@@ -102,9 +119,53 @@ export function parseLoosened(text) {
   return out;
 }
 
+/**
+ * The `floor <agent> <change> <risk> <model>` lines of the project's .claude/crew-model-rules; `*` matches any.
+ * Read as hooks/guard-agent-model.sh reads them (`_am_rules`): a comment is cut at #, the model is found in the word.
+ */
+export function parseRuleFloors(text) {
+  const out = [];
+  for (const line of String(text ?? '').split('\n')) {
+    const l = line.replace(/\r$/, '').replace(/#.*/, '').trim();
+    const m = l.match(/^floor\s+(\S+)\s+(\S+)\s+(\S+)\s+(\S+)/);
+    if (!m) continue;
+    const model = TIERS.find((t) => m[4].toLowerCase().includes(t));
+    if (model) out.push({ agent: m[1], change: m[2], risk: m[3], model });
+  }
+  return out;
+}
+
 const keyOf = (r) => `${r.agent}\t${r.change}\t${r.risk}`;
 const firstTry = (r) => r.verify === 'pass' && r.fixes === 0;
 
+/**
+ * The lowest model the gate would have let this call run on, as a rank (see `rankOf`): the highest of what
+ * applies, the order of hooks/guard-agent-model.sh. The project's rules are read as they are now; a raise from the
+ * record counts for the calls made after it, lowered or not, so a call it held is never said to have run above.
+ */
+export function floorOfRow(r, ruleFloors = [], floors = []) {
+  let f = rankOf(AGENT_FLOORS[r.agent]);
+  if (r.verify === 'none') f = Math.max(f, 2);
+  if (r.change === 'test-write' || r.change === 'audit') f = Math.max(f, 2);
+  if (r.risk === 'critical' && r.change !== 'test-run') f = Math.max(f, 3);
+  const any = (want, v) => want === '*' || want === v;
+  for (const x of ruleFloors) if (any(x.agent, r.agent) && any(x.change, r.change) && any(x.risk, r.risk)) f = Math.max(f, rankOf(x.model));
+  for (const x of floors) if (keyOf(x) === keyOf(r) && !(String(r.ts) < String(x.when ?? ''))) f = Math.max(f, rankOf(x.model));
+  if (r.escalatedFrom) f = Math.max(f, rankOf(r.escalatedFrom) + 1);
+  return f;
+}
+
+/**
+ * How many of a class's latest `need` verified calls on `model`, since `since`, there are when every one of them
+ * passed the first time; 0 when there are fewer, or one did not. The test for lowering a hold and for saying the
+ * table's model would have done.
+ */
+function passedLatest(rows, k, model, since, need) {
+  const recent = rows.filter((r) => keyOf(r) === k && r.model === model && VERIFIED.has(r.verify) && (r.at ?? 0) >= since)
+    .sort((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, need);
+  return recent.length >= need && recent.every(firstTry) ? recent.length : 0;
+}
+
 /**
  * The lowering that stands for a raised floor, or null. The rule is hooks/guard-agent-model.sh's (`_am_floor_now`),
  * word for word: a lowering counts when it is not older than the raise it answers (the times are UTC text and are
@@ -161,13 +222,16 @@ export function classesOf(rows, floors = [], loosened = []) {
  * `costed` of `runs` were priced; the rest are not in the sum, so the sum is a floor and not the total.
  * @param costOf  (agentId) => USD or null
  */
-export function classCosts(rows, costOf) {
+export function classCosts(rows, costOf, advisorOf = () => null) {
   const out = {};
   for (const r of rows) {
-    const c = (out[keyOf(r)] ??= { cost: 0, costed: 0, runs: 0 });
+    const c = (out[keyOf(r)] ??= { cost: 0, costed: 0, runs: 0, advisorCalls: 0, advisorCost: 0 });
     c.runs += 1;
     const usd = costOf(r.agentId);
     if (typeof usd === 'number') { c.cost += usd; c.costed += 1; }
+    // The advisor's share is part of `cost` already; it is counted apart only to be said.
+    const a = advisorOf(r.agentId);
+    if (a?.calls > 0) { c.advisorCalls += a.calls; if (typeof a.cost === 'number') c.advisorCost += a.cost; }
   }
   return out;
 }
@@ -186,11 +250,52 @@ export function suggestionsOf(rows, floors = [], loosened = [], need = LOOSEN_AF
     const k = keyOf(f);
     // Once for each raise: a floor whose lowering stands is not offered again (the same rule the gate reads it by).
     if (loweringOf(f, loosened)) continue;
-    const since = Date.parse(f.when ?? '') || 0;
-    const recent = rows.filter((r) => keyOf(r) === k && r.model === f.model && VERIFIED.has(r.verify) && (r.at ?? 0) >= since)
-      .sort((a, b) => (b.at ?? 0) - (a.at ?? 0)).slice(0, need);
-    if (recent.length < need || !recent.every(firstTry)) continue;
-    out.push({ key: k, agent: f.agent, change: f.change, risk: f.risk, from: f.model, to: TIERS[tier - 1], passed: recent.length, heldSince: f.when ?? null });
+    const passed = passedLatest(rows, k, f.model, Date.parse(f.when ?? '') || 0, need);
+    if (!passed) continue;
+    out.push({ key: k, agent: f.agent, change: f.change, risk: f.risk, from: f.model, to: TIERS[tier - 1], passed, heldSince: f.when ?? null });
+  }
+  return out;
+}
+
+/**
+ * Normal work that ran above the table's model, by class, the busiest first: the calls on a model above both
+ * NORMAL_TIER and the floor the gate held them to (`floorOfRow`). `passed` is how many of the class's latest
+ * verified calls on NORMAL_TIER passed the first time (counted from the class's raise, where it has one), when it
+ * is `need` of `need`; otherwise 0, and nothing is said about whether NORMAL_TIER would have done.
+ * `ids` are the agents' ids, for pricing; they are not sent to a page (`readModels`).
+ */
+export function aboveTableOf(rows, ruleFloors = [], floors = [], need = LOOSEN_AFTER) {
+  const by = new Map();
+  const top = rankOf(NORMAL_TIER);
+  for (const r of rows) {
+    if (r.risk !== 'normal' || rankOf(r.model) <= Math.max(top, floorOfRow(r, ruleFloors, floors))) continue;
+    const k = keyOf(r);
+    const c = by.get(k) ?? by.set(k, { key: k, agent: r.agent, change: r.change, risk: r.risk, to: NORMAL_TIER, runs: 0, models: {}, ids: [] }).get(k);
+    c.runs += 1;
+    c.models[r.model] = (c.models[r.model] ?? 0) + 1;
+    c.ids.push(r.agentId);
+  }
+  return [...by.values()].map((c) => {
+    const held = floors.find((f) => keyOf(f) === c.key);
+    return { ...c, need, passed: passedLatest(rows, c.key, NORMAL_TIER, Date.parse(held?.when ?? '') || 0, need) };
+  }).sort((a, b) => b.runs - a.runs || a.key.localeCompare(b.key));
+}
+
+/**
+ * What the work above the table cost, by class: { classKey: { cost, atNormal, costed, runs } }. `atNormal` is the
+ * same tokens at NORMAL_TIER's list price: what that model would have cost had it used as many, which no record
+ * can say it would have. As with `classCosts`, only priced calls are in the sums.
+ * @param priceOf  (agentId) => { cost, atNormal } in USD, or null
+ */
+export function aboveCosts(above, priceOf) {
+  const out = {};
+  for (const c of above) {
+    const o = (out[c.key] = { cost: 0, atNormal: 0, costed: 0, runs: c.ids.length });
+    for (const id of c.ids) {
+      const p = priceOf(id);
+      if (typeof p?.cost !== 'number' || typeof p?.atNormal !== 'number') continue;
+      o.cost += p.cost; o.atNormal += p.atNormal; o.costed += 1;
+    }
   }
   return out;
 }
@@ -210,16 +315,18 @@ function readBounded(file) {
 
 const sigOf = (file) => { try { const st = fs.statSync(file); return `${st.mtimeMs}:${st.size}`; } catch { return '-'; } };
 const FILES = ['model-outcomes.tsv', 'crew-model-floors.auto', 'crew-model-loosened.tsv'];
+const RULES = (cwd) => path.join(cwd, '.claude', 'crew-model-rules');   // the project's own, beside the state
 const records = new Map();           // cwd -> { sig, value }
 export const _stats = { parsed: 0 };  // how many times a record was really read: the claims count it
 
 /**
- * The record of one project, read once and kept until one of its three files changes (its time or its size).
+ * The record of one project, read once and kept until one of its files, or the project's rules, changes (its
+ * time or its size).
  * A view that asks every few seconds costs three stats, not a parse.
  */
 export function readRecord(cwd) {
   const dir = stateDir(cwd);
-  const sig = FILES.map((f) => sigOf(path.join(dir, f))).join('|');
+  const sig = [...FILES.map((f) => sigOf(path.join(dir, f))), sigOf(RULES(cwd))].join('|');
   const hit = records.get(cwd);
   if (hit && hit.sig === sig) return hit.value;
   const value = parseRecord(dir, cwd);
@@ -231,10 +338,11 @@ export function readRecord(cwd) {
 
 function parseRecord(dir, cwd) {
   const record = readBounded(path.join(dir, FILES[0]));
-  if (!record) return { measured: false, reason: 'no .claude/state/model-outcomes.tsv in this project: no crew agent has finished here since model routing was installed', classes: [], suggestions: [], byAgent: {} };
+  if (!record) return { measured: false, reason: 'no .claude/state/model-outcomes.tsv in this project: no crew agent has finished here since model routing was installed', classes: [], suggestions: [], above: [], byAgent: {} };
   const parsed = parseOutcomes(record.text);
   const floors = parseFloors(readBounded(path.join(dir, FILES[1]))?.text ?? '');
   const loosened = parseLoosened(readBounded(path.join(dir, FILES[2]))?.text ?? '');
+  const ruleFloors = parseRuleFloors(readBounded(RULES(cwd))?.text ?? '');
   const byAgent = {};
   for (const r of parsed.rows) byAgent[r.agentId] = r;           // a resumed agent's latest line is the one that stands
   // A card that failed is given again one model up, to another agent: the calls of one card, oldest first, are
@@ -258,6 +366,7 @@ function parseRecord(dir, cwd) {
     classes: classesOf(parsed.rows, floors, loosened),
     floors,
     suggestions: suggestionsOf(parsed.rows, floors, loosened),
+    above: aboveTableOf(parsed.rows, ruleFloors, floors),
     loosened,
     byAgent,
     all: parsed.rows,
@@ -276,12 +385,18 @@ export function readModels(cwd, { agents = null } = {}) {
   if (!rec.measured) return rec;
   const byAgent = {};
   for (const id of agents ?? []) if (Object.hasOwn(rec.byAgent, id)) byAgent[id] = rec.byAgent[id];
-  const { all, byAgent: _every, ...rest } = rec;
-  return { ...rest, byAgent };
+  const { all, byAgent: _every, above, ...rest } = rec;
+  return { ...rest, above: above.map(({ ids, ...c }) => c), byAgent };
 }
 
 /** What the classes of one project cost, from the kept record: see `classCosts`. Null when there is no record. */
-export function readCosts(cwd, costOf) {
+export function readCosts(cwd, costOf, advisorOf) {
+  const rec = readRecord(cwd);
+  return rec.measured ? classCosts(rec.all, costOf, advisorOf) : null;
+}
+
+/** What the work above the table cost, from the kept record: see `aboveCosts`. Null when there is no record. */
+export function readAboveCosts(cwd, priceOf) {
   const rec = readRecord(cwd);
-  return rec.measured ? classCosts(rec.all, costOf) : null;
+  return rec.measured ? aboveCosts(rec.above, priceOf) : null;
 }

package/kit/studio/server/lib/owned-stream.js

@@ -0,0 +1,56 @@
+// owned-stream.js — the conversations of several owned sessions, replayed then followed, on ONE connection.
+//
+// A browser holds six connections to one host over HTTP/1.1, and a pane per stream reached them at five panes
+// beside the page's own: the panel kept painting, but a message sent and every request the page made itself waited
+// until a pane was closed (measured on Windows, Claude Code 2.1.301: a send did not arrive in 35 s, then in 8 s once
+// two panes closed). Each event and state carries the session id it belongs to.
+//   ids=a,b,c          the sessions (at most MAX_STREAM_IDS; an unknown id is answered with `gone`)
+//   after=a:12,b:3     resume each where the client last was, so a reconnect neither replays nor drops
+
+export const MAX_STREAM_IDS = 32;
+
+/** Read `ids` and `after` from a URL: the ids, de-duplicated and capped, and each one's resume point. */
+export function parseOwnedQuery(url) {
+  const ids = [...new Set((url.searchParams.get('ids') ?? '').split(',').filter(Boolean))].slice(0, MAX_STREAM_IDS);
+  const after = new Map();
+  for (const part of (url.searchParams.get('after') ?? '').split(',')) {
+    const at = part.lastIndexOf(':');
+    if (at > 0) after.set(part.slice(0, at), Number(part.slice(at + 1)) || 0);
+  }
+  return { ids, after };
+}
+
+/**
+ * @param getSession  id -> an owned session ({ summary(), subscribe(fn, after) }) or null
+ * @param stateAfter  the record types after which a session's summary is sent again
+ * @param beatMs      how often every summary is sent regardless
+ */
+export function streamOwned(req, res, url, { getSession, stateAfter = new Set(), beatMs = 15000 }) {
+  const { ids, after } = parseOwnedQuery(url);
+  res.writeHead(200, {
+    'content-type': 'text/event-stream; charset=utf-8',
+    'cache-control': 'no-store',
+    connection: 'keep-alive',
+    'x-accel-buffering': 'no',
+  });
+  const write = (event, data) => {
+    try { res.write(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`); } catch { /* client gone */ }
+  };
+  const unsubscribes = [];
+  for (const id of ids) {
+    const s = getSession(id);
+    if (!s) { write('gone', { id }); continue; }
+    write('state', { id, session: s.summary() });
+    unsubscribes.push(s.subscribe((ev) => {
+      write('event', { id, ev });
+      if (stateAfter.has(ev.rec?.type)) write('state', { id, session: s.summary() });
+    }, after.get(id) ?? 0));
+  }
+  const beat = setInterval(() => {
+    for (const id of ids) { const s = getSession(id); if (s) write('state', { id, session: s.summary() }); }
+  }, beatMs);
+  const stop = () => { clearInterval(beat); for (const u of unsubscribes) u(); try { res.end(); } catch { /* gone */ } };
+  req.on('close', stop);
+  req.on('error', stop);
+  return stop;
+}

package/kit/studio/server/lib/pricing.js

@@ -36,6 +36,9 @@ export const PRICES = {
   'claude-haiku-4-5': { input: 1, output: 5 },
 };
 
+// The model the table's normal tier is priced at, for the Models view's "the same tokens on the table's model".
+export const NORMAL_TIER_MODEL = 'claude-sonnet-5-5';
+
 /** The row for a model id, or null. A dated snapshot (`<id>-20260101`) is the same model; nothing else matches. */
 export function priceOf(model) {
   if (typeof model !== 'string') return null;

package/kit/studio/server/lib/projects.js

@@ -24,10 +24,17 @@ import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 
-// Overridable so a second instance can be pointed at a different transcript
-// store — which is also the only way to exercise the peer relay on one machine.
-export const PROJECTS_ROOT = process.env.CREW_STUDIO_PROJECTS_ROOT
-  || path.join(os.homedir(), '.claude', 'projects');
+// Where Claude Code writes its transcripts: <config dir>/projects, the config dir being CLAUDE_CONFIG_DIR when it is
+// set and ~/.claude otherwise. Reading ~/.claude alone, sessions started under a moved config dir (Studio's own
+// included) were not listed and read a cost of 0 (measured on Windows). The studio gate hook reads it the same way.
+// CREW_STUDIO_PROJECTS_ROOT still wins: a second instance pointed at a different store, which is also the only way to
+// exercise the peer relay on one machine.
+export function projectsRoot(env = process.env, home = os.homedir()) {
+  if (env.CREW_STUDIO_PROJECTS_ROOT) return env.CREW_STUDIO_PROJECTS_ROOT;
+  const config = env.CLAUDE_CONFIG_DIR ? path.resolve(env.CLAUDE_CONFIG_DIR) : path.join(home, '.claude');
+  return path.join(config, 'projects');
+}
+export const PROJECTS_ROOT = projectsRoot();
 
 /** Fold a working directory into the directory name Claude Code uses. */
 export function encodeCwd(cwd) {

package/kit/studio/server/lib/remote.js

@@ -0,0 +1,99 @@
+// remote.js — read-only viewers.
+//
+// The panel's own token can start a session and answer a tool call. Handing that token to a phone, over
+// whatever tunnel reaches this machine, hands the phone all of it. A viewer token is the smaller thing: it
+// reads what the panel reads and can change nothing. The server decides that, not the page — a viewer's
+// request is refused here before any handler sees it.
+//
+// THE SERVER STILL LISTENS ON LOOPBACK ONLY. A viewer does not widen that. The way in from another device is a
+// tunnel the user runs (an ssh forward, a tailnet), and this module knows nothing about it.
+//
+// Kept in memory, like the owner's token: a viewer lasts as long as the server that made it. A link that
+// survived a restart would be a credential nobody remembers handing out.
+import { randomUUID } from 'node:crypto';
+
+export const MAX_VIEWERS = 8;
+const LABEL_MAX = 40;
+
+const viewers = new Map();          // id -> viewer
+const byToken = new Map();          // token -> viewer
+
+const publicOf = (v) => ({
+  id: v.id,
+  label: v.label,
+  createdAt: v.createdAt,
+  lastSeenAt: v.lastSeenAt,
+  requests: v.requests,
+  agent: v.agent,
+  open: v.conns.size,
+});
+
+/** Make a viewer. The token is in this answer and in no later one. */
+export function addViewer(label) {
+  if (viewers.size >= MAX_VIEWERS) {
+    return { ok: false, reason: `${MAX_VIEWERS} viewers already; revoke one first` };
+  }
+  const named = typeof label === 'string' ? label.replace(/\s+/g, ' ').trim().slice(0, LABEL_MAX) : '';
+  const v = {
+    id: randomUUID().slice(0, 8),
+    label: named || `Viewer ${viewers.size + 1}`,
+    token: randomUUID(),
+    createdAt: Date.now(),
+    lastSeenAt: null,
+    requests: 0,
+    agent: null,
+    conns: new Set(),
+  };
+  viewers.set(v.id, v);
+  byToken.set(v.token, v);
+  return { ok: true, viewer: { ...publicOf(v), token: v.token } };
+}
+
+export function listViewers() {
+  return [...viewers.values()].map(publicOf);
+}
+
+export function viewerByToken(token) {
+  return (typeof token === 'string' && byToken.get(token)) || null;
+}
+
+/**
+ * Take a viewer's access back. Its token stops working with this call, and a stream it holds open is closed:
+ * a revoke that left the live graph running on the phone would be a revoke in name only.
+ */
+export function revokeViewer(id) {
+  const v = viewers.get(id);
+  if (!v) return { ok: true, revoked: false };
+  viewers.delete(id);
+  byToken.delete(v.token);
+  for (const res of v.conns) { try { res.destroy(); } catch { /* already gone */ } }
+  v.conns.clear();
+  return { ok: true, revoked: true };
+}
+
+/** Count a viewer's request and remember its response for as long as it is open. */
+export function noteRequest(v, req, res) {
+  v.requests += 1;
+  v.lastSeenAt = Date.now();
+  const ua = req.headers['user-agent'];
+  v.agent = typeof ua === 'string' ? ua.slice(0, 160) : null;
+  v.conns.add(res);
+  res.on('close', () => v.conns.delete(res));
+}
+
+/**
+ * What a viewer may ask for: a GET of anything the panel reads, and nothing about viewers themselves.
+ * The list of viewers is the owner's; a viewer that could read it could count who else is watching.
+ */
+export function viewerMay(method, pathname) {
+  if (method !== 'GET') return { ok: false, reason: 'read-only token: GET only' };
+  if (pathname === '/api/remote' || pathname.startsWith('/api/remote/')) {
+    return { ok: false, reason: 'read-only token: viewers are managed from the machine itself' };
+  }
+  return { ok: true };
+}
+
+/** For the self-check: start from nothing. */
+export function _reset() {
+  for (const id of [...viewers.keys()]) revokeViewer(id);
+}