feat(cockpit): status hysteresis + per-session model/time + tray alert

Four cockpit improvements:
- Fix the Working↔your-turn flicker while the agent is working: status is
  now hysteretic — once 'working', a brief output gap (<10s, no input
  prompt) stays 'working' instead of flipping to "your turn" during the
  agent's thinking/tool pauses. (computeActivity takes prev.)
- Show each session's model (read from its log) + active working time as
  header pills, and the model in each list row.
- Tray attention alert (Discord-style red tray icon) when sessions need
  you — configurable in Settings (Off / Questions only [default] /
  Questions + your turn). "Questions only" is rare, so the tray isn't
  constantly red even though "your turn" is common. The renderer draws a
  red-dotted tray icon on a canvas (no new asset/dep) and hands it to main.

New: shared sessionMeta (friendlyModel + parseSessionMeta), main
readClaudeSessionMeta (session-id-guarded — no path traversal), store
trayAlert, tray.ts controller. v1.9.0. 277 tests (+10). QA 0 errors.
Final review APPROVED after fixing a sessionId path-traversal it caught.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: writingdeveloper

README.md

@@ -11,7 +11,7 @@ See every repo's state at a glance — git status, how long it's been neglected,
 ![License](https://img.shields.io/badge/license-MIT-blue)
 ![Platform](https://img.shields.io/badge/platform-Windows%20%7C%20macOS%20%7C%20Linux-0078D6)
 ![Built with Electron](https://img.shields.io/badge/Electron-31-47848F)
-![Tests](https://img.shields.io/badge/tests-267%20passing-3fb950)
+![Tests](https://img.shields.io/badge/tests-277%20passing-3fb950)
 ![CI](https://github.com/writingdeveloper/devdeck/actions/workflows/ci.yml/badge.svg)
 
 <img src="docs/demo/demo.gif" width="820" alt="DevDeck demo" />
@@ -30,7 +30,7 @@ If you run Claude Code across a dozen side projects, you lose the thread: *Which
 - **📂 Multiple scan locations** — point DevDeck at several folders to scan for repos, or add individual repos that live anywhere; each is auto-detected.
 - **🚦 Staleness traffic-light** — fresh / warning / neglected, so dirty or abandoned repos surface themselves.
 - **▶ One-click resume** — opens a terminal in the repo and continues your last session with the active agent (`claude -c` / `codex resume`) — or pick a specific past session.
-- **🖥 Cockpit (embedded terminals · Windows)** — on Windows, **Open** drops you straight into an in-app terminal instead of a pile of external windows. A searchable session list shows each session's **live status** — working (spinner) / awaiting-you / idle — and floats the ones needing you to the top, with a count badge on the 🖥 icon so you can see "who's waiting on me" from any view. The live agent terminal + branch · agent status bar fill the right, with selection **copy (Ctrl+C) / paste (Ctrl+V)** that doesn't clash with the agent's own Ctrl+C interrupt. Running 10+ projects no longer means a wall of shrinking tabs you have to click through to see which finished. Your open sessions are **remembered across restarts** — after a quit or crash the cockpit lists them as one-click **restorable** entries (re-attaching via `claude -c` / `codex resume`). You can run **several sessions in the same repo at once** — a **+ New session** button forks another conversation; each is tracked separately and you can **name it** (double-click the name) so you remember what each one is doing. (macOS/Linux keep opening your external terminal.)
+- **🖥 Cockpit (embedded terminals · Windows)** — on Windows, **Open** drops you straight into an in-app terminal instead of a pile of external windows. A searchable session list shows each session's **live status** — working (spinner) / awaiting-you / idle — and floats the ones needing you to the top, with a count badge on the 🖥 icon (and an optional **tray icon alert**, off-by-default-able) so you can see "who's waiting on me" from any view. Each session shows its **model and active working time**, and you can **name** sessions and run **several per repo**. The live agent terminal + branch · agent status bar fill the right, with selection **copy (Ctrl+C) / paste (Ctrl+V)** that doesn't clash with the agent's own Ctrl+C interrupt. Running 10+ projects no longer means a wall of shrinking tabs you have to click through to see which finished. Your open sessions are **remembered across restarts** — after a quit or crash the cockpit lists them as one-click **restorable** entries (re-attaching via `claude -c` / `codex resume`). You can run **several sessions in the same repo at once** — a **+ New session** button forks another conversation; each is tracked separately and you can **name it** (double-click the name) so you remember what each one is doing. (macOS/Linux keep opening your external terminal.)
 - **↩ Resume cue** — auto-reads the *last thing you asked* in each project's newest session (Claude or Codex) and shows it in the note slot, so "where was I?" needs no typing. Click to adopt it as your note.
 - **📋 "Next" view** — every project's note (or resume cue) gathered into one cross-project "what's next" list.
 - **↑ Unpushed signal** — commits ahead of your remote, flagged on the card so unprotected work stands out.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "devdeck",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Project command deck — at-a-glance state + claude -c resume",
   "main": "dist/main/main.js",
   "type": "commonjs",

src/main/ipc.ts

@@ -20,6 +20,8 @@ import type { WtTab } from '../shared/wtArgs';
 import { scanUsage } from './usageScan';
 import { getUsageWindows, readClaudeCredentials, fetchUsageApi, type CacheEntry } from './claudeUsage';
 import type { PersistedSession } from '../shared/cockpitPersist';
+import { readClaudeSessionMeta } from './sessionMeta';
+import type { TrayController } from './tray';
 import { DEFAULT_THRESHOLDS } from '../shared/staleness';
 
 const CLAUDE_PROJECTS = join(homedir(), '.claude', 'projects');
@@ -32,9 +34,11 @@ export interface IpcConfig {
   sendError: (msg: string) => void;
   defaultLanguage: string;
   ptyHost: PtyHost;
+  tray: TrayController;
 }
 
 export function registerIpc(cfg: IpcConfig): void {
+  let lastTrayCounts = { attention: 0, turn: 0 }; // remember the latest needs-you counts so a tray-alert setting change re-applies at once
   // Legacy single-base value, retained only for the settings:get response (back-compat); not used for scanning or the security guard.
   const effBaseDir = () => cfg.store.getBaseDir() ?? cfg.defaultBaseDir;
   const effThresholds = () => cfg.store.getThresholds() ?? DEFAULT_THRESHOLDS;
@@ -87,8 +91,12 @@ export function registerIpc(cfg: IpcConfig): void {
   ipcMain.handle('settings:get', () => ({
     baseDir: effBaseDir(), thresholds: effThresholds(), language: cfg.store.getLanguage() ?? cfg.defaultLanguage,
     openAtLogin: effectiveOpenAtLogin(cfg.store.getOpenAtLogin()), platform: process.platform,
-    viewMode: cfg.store.getViewMode(),
+    viewMode: cfg.store.getViewMode(), trayAlert: cfg.store.getTrayAlert(),
   }));
+  ipcMain.handle('settings:setTrayAlert', (_e, mode: string) => {
+    cfg.store.setTrayAlert(mode === 'off' || mode === 'all' ? mode : 'attention');
+    cfg.tray.applyCounts(lastTrayCounts, cfg.store.getTrayAlert()); // re-apply immediately with the latest counts
+  });
   ipcMain.handle('settings:setOpenAtLogin', (_e, enabled: boolean) => {
     const on = !!enabled;
     cfg.store.setOpenAtLogin(on);
@@ -241,6 +249,19 @@ export function registerIpc(cfg: IpcConfig): void {
   ipcMain.handle('cockpit:loadSessions', () => cfg.store.getCockpitSessions());
   ipcMain.on('cockpit:saveSessions', (_e, list: PersistedSession[]) => cfg.store.setCockpitSessions(Array.isArray(list) ? list : []));
 
+  // Per-session model + active working time (read from the Claude session log) for the cockpit header/list.
+  ipcMain.handle('cockpit:sessionMeta', (_e, projectPath: string, sessionId: string) => {
+    if (agent().id !== 'claude' || typeof sessionId !== 'string' || !sessionId) return { model: null, activeMs: 0 };
+    return readClaudeSessionMeta(String(projectPath), sessionId, CLAUDE_PROJECTS);
+  });
+
+  // Tray attention indicator (Discord-style): the renderer supplies the red-dotted icon once + live needs-you counts.
+  ipcMain.on('tray:alertImage', (_e, dataUrl: string) => cfg.tray.setAlertImage(String(dataUrl)));
+  ipcMain.on('tray:counts', (_e, counts: { attention?: number; turn?: number }) => {
+    lastTrayCounts = { attention: Math.max(0, Number(counts?.attention) | 0), turn: Math.max(0, Number(counts?.turn) | 0) };
+    cfg.tray.applyCounts(lastTrayCounts, cfg.store.getTrayAlert());
+  });
+
   // Opt-in usage monitor. Token is read + used ONLY in the main process (claudeUsage);
   // only computed percentages/plan/reset cross IPC.
   const usageCachePath = () => join(app.getPath('userData'), 'usage-cache.json');

src/main/main.ts

@@ -69,15 +69,16 @@ if (!gotLock) {
     applyOpenAtLogin(store.getOpenAtLogin());
     const w = createWindow();
     win = w;
+    const tray = setupTray(w);
     registerIpc({
       win: w,
       defaultBaseDir: path.join(app.getPath('home'), 'Documents', 'GitHub'),
       store,
       sendError: (msg) => w.webContents.send('devdeck:error', msg),
       defaultLanguage: app.getLocale().split('-')[0] || 'en',
       ptyHost,
+      tray,
     });
-    setupTray(w);
     registerUpdater(w);
     globalShortcut.register('Control+Alt+D', showWindow);
     app.on('activate', () => { if (!win) win = createWindow(); });

src/main/sessionMeta.test.ts

@@ -0,0 +1,12 @@
+import { describe, it, expect } from 'vitest';
+import { readClaudeSessionMeta } from './sessionMeta';
+
+describe('readClaudeSessionMeta', () => {
+  it('rejects a traversal sessionId — no path escape (returns {null,0})', () => {
+    expect(readClaudeSessionMeta('C:/a/b', '../../../../etc/passwd', '/tmp/claude')).toEqual({ model: null, activeMs: 0 });
+    expect(readClaudeSessionMeta('C:/a/b', 'a/../../b', '/tmp/claude')).toEqual({ model: null, activeMs: 0 });
+  });
+  it('returns {null,0} for a valid id whose file is missing', () => {
+    expect(readClaudeSessionMeta('C:/a/b', 'a0b1c2d3-e4f5-6789-abcd-ef0123456789', '/no/such/dir')).toEqual({ model: null, activeMs: 0 });
+  });
+});

src/main/sessionMeta.ts

@@ -0,0 +1,15 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { encodeProjectPath } from '../shared/paths';
+import { parseSessionMeta } from '../shared/sessionMeta';
+import { isValidSessionId } from './sessions';
+
+/** Read a Claude session's { model, activeMs } from its on-disk .jsonl (best-effort; {null,0} if missing). */
+export function readClaudeSessionMeta(projectPath: string, sessionId: string, claudeProjectsDir: string): { model: string | null; activeMs: number } {
+  // Guard the id before it touches a path — a crafted sessionId must not escape ~/.claude/projects (path traversal).
+  if (!isValidSessionId(sessionId)) return { model: null, activeMs: 0 };
+  const file = join(claudeProjectsDir, encodeProjectPath(projectPath), sessionId + '.jsonl');
+  let raw: string;
+  try { raw = readFileSync(file, 'utf8'); } catch { return { model: null, activeMs: 0 }; }
+  return parseSessionMeta(raw);
+}

src/main/store.test.ts

@@ -125,6 +125,15 @@ describe('Store', () => {
     expect(new Store(file).getCockpitSessions()).toEqual([{ projectPath: 'C:/a/dev', name: 'dev', sessionId: 's1', agentId: 'codex', label: 'auth' }]);
   });
 
+  it('round-trips trayAlert (default attention; bad value coerced)', () => {
+    const s = new Store(file);
+    expect(s.getTrayAlert()).toBe('attention');
+    s.setTrayAlert('all');
+    expect(new Store(file).getTrayAlert()).toBe('all');
+    s.setTrayAlert('garbage' as 'off');
+    expect(s.getTrayAlert()).toBe('attention');
+  });
+
   it('sanitizes corrupted cockpitSessions on read', () => {
     const s = new Store(file);
     // bypass the typed setter to simulate a hand-corrupted state.json

src/main/store.ts

@@ -5,7 +5,7 @@ import { sanitizePersistedList, type PersistedSession } from '../shared/cockpitP
 
 interface StateFile {
   projects: Record<string, StoreEntry>;
-  settings?: { language?: string; baseDir?: string; folders?: Folder[]; thresholds?: { freshDays: number; warnDays: number; neglectedDays: number }; agent?: string; openAtLogin?: boolean; viewMode?: 'cards' | 'list'; cockpitSessions?: PersistedSession[] };
+  settings?: { language?: string; baseDir?: string; folders?: Folder[]; thresholds?: { freshDays: number; warnDays: number; neglectedDays: number }; agent?: string; openAtLogin?: boolean; viewMode?: 'cards' | 'list'; cockpitSessions?: PersistedSession[]; trayAlert?: 'off' | 'attention' | 'all' };
 }
 
 const EMPTY: StoreEntry = {
@@ -94,6 +94,9 @@ export class Store {
   getCockpitSessions(): PersistedSession[] { return sanitizePersistedList(this.state.settings?.cockpitSessions); }
   setCockpitSessions(list: PersistedSession[]): void { this.state.settings = { ...(this.state.settings ?? {}), cockpitSessions: sanitizePersistedList(list) }; this.save(); }
 
+  getTrayAlert(): 'off' | 'attention' | 'all' { const t = this.state.settings?.trayAlert; return t === 'off' || t === 'all' ? t : 'attention'; }
+  setTrayAlert(t: 'off' | 'attention' | 'all'): void { this.state.settings = { ...(this.state.settings ?? {}), trayAlert: t === 'off' || t === 'all' ? t : 'attention' }; this.save(); }
+
 
   setNote(path: string, note: string): void { this.mutate(path, { note }); }
   setPinned(path: string, pinned: boolean): void { this.mutate(path, { pinned }); }

src/main/tray.ts

@@ -1,10 +1,18 @@
-import { app, Tray, Menu, nativeImage, type BrowserWindow } from 'electron';
+import { app, Tray, Menu, nativeImage, type BrowserWindow, type NativeImage } from 'electron';
 import { join } from 'node:path';
 
-/** Build a tray icon with Open/Quit, and make window-close hide to tray instead of quitting. */
-export function setupTray(win: BrowserWindow): Tray {
-  const icon = nativeImage.createFromPath(join(__dirname, '..', 'renderer', 'assets', 'tray.png'));
-  const tray = new Tray(icon);
+export type TrayAlertMode = 'off' | 'attention' | 'all';
+export interface TrayController {
+  /** Receive the renderer-rendered red-dotted alert icon (a PNG data URL). */
+  setAlertImage(dataUrl: string): void;
+  /** Apply needs-you counts: redden the tray icon when the mode says there's something for you. */
+  applyCounts(counts: { attention: number; turn: number }, mode: TrayAlertMode): void;
+}
+
+/** Build a tray icon with Open/Quit, make close hide to tray, and return a controller for the alert state. */
+export function setupTray(win: BrowserWindow): TrayController {
+  const normalIcon = nativeImage.createFromPath(join(__dirname, '..', 'renderer', 'assets', 'tray.png'));
+  const tray = new Tray(normalIcon);
   tray.setToolTip('DevDeck');
   const menu = Menu.buildFromTemplate([
     { label: 'Open DevDeck', click: () => { win.show(); win.focus(); } },
@@ -20,5 +28,16 @@ export function setupTray(win: BrowserWindow): Tray {
       win.hide();
     }
   });
-  return tray;
+
+  let alertIcon: NativeImage | null = null;
+  return {
+    setAlertImage(dataUrl: string): void {
+      try { const img = nativeImage.createFromDataURL(dataUrl); if (!img.isEmpty()) alertIcon = img; } catch { /* ignore */ }
+    },
+    applyCounts(counts, mode): void {
+      const red = mode === 'off' ? 0 : mode === 'all' ? counts.attention + counts.turn : counts.attention;
+      tray.setImage(red > 0 && alertIcon ? alertIcon : normalIcon);
+      tray.setToolTip(red > 0 ? `DevDeck — ${red}` : 'DevDeck');
+    },
+  };
 }

src/preload/preload.ts

@@ -59,5 +59,9 @@ contextBridge.exposeInMainWorld('devdeck', {
       ipcRenderer.on('cockpit:exit', (_e, p) => cb(p)),
     loadSessions: () => ipcRenderer.invoke('cockpit:loadSessions'),
     saveSessions: (list: unknown) => ipcRenderer.send('cockpit:saveSessions', list),
+    sessionMeta: (projectPath: string, sessionId: string) => ipcRenderer.invoke('cockpit:sessionMeta', projectPath, sessionId),
   },
+  setTrayAlert: (mode: string) => ipcRenderer.invoke('settings:setTrayAlert', mode),
+  setTrayCounts: (counts: { attention: number; turn: number }) => ipcRenderer.send('tray:counts', counts),
+  setTrayAlertImage: (dataUrl: string) => ipcRenderer.send('tray:alertImage', dataUrl),
 });