agent-dag 3.16.0 → 3.17.0

package/dist/web/index.html

@@ -40,8 +40,8 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-C7_uf54q.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DPOZaaRr.css">
+    <script type="module" crossorigin src="/assets/index-CSpWSOAU.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BwFExw1D.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -31,6 +31,12 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.17.0": [
+    {
+      "title": "🔔 Pairing is two presses",
+      "body": "When another deck asks to pair, the question now arrives **over the deck** rather than in a row three sections down a panel: its name, its address, the fingerprint to compare, **Accept** or **Decline**. Escape means later — the request stays in the panel until you answer it.\n\nThe rest is one list. Every deck you are paired with, every deck on the network, and every one you turned away, each a row with its state under the name and one verb at the end — and a deck that cannot be reached now reads differently from one that is fine. Saying no also reaches the other machine now, instead of leaving it waiting forever; you can take it back.\n\nThe dialog behind **setup** is down to the two things it is really about: what this deck is called, and which logins it offers."
+    }
+  ],
   "3.15.0": [
     {
       "title": "🔗 Decks on one network heal each other's dead logins",

package/src/server/index.mjs

@@ -7,7 +7,7 @@ import { createServer, request as httpRequest } from "node:http";
 import { readFile, stat, mkdir, open, truncate, readdir, unlink } from "node:fs/promises";
 import { existsSync, readFileSync, realpath as realpathCb, realpathSync } from "node:fs";
 import { extname, join, resolve, sep, dirname as pdirname } from "node:path";
-import { homedir } from "node:os";
+import { homedir, networkInterfaces } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { dirname } from "node:path";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
@@ -18,6 +18,8 @@ import { PRODUCT } from "./brand.mjs";
 import { createBlockNotifier } from "./block-notify.mjs";
 import { DEFAULTS as PREF_DEFAULTS, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
+import { PROBE_PS, localAliases, reachability, readProbe } from "./lan-reach.mjs";
+import { run } from "./exec.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
 import { invokedName, renameNotice } from "./invoked-as.mjs";
 import { appendLogLine, codexCwdInWorkspace, electWriters, foldsCase, writesCodexLog } from "./log-writer.mjs";
@@ -3322,10 +3324,57 @@ async function applyLanPrefs() {
   }
 }
 
+// ── can other decks reach this one ──────────────────────────────────────────
+//
+// NEVER IN THE REQUEST. The panel polls this route, and the probe is a
+// PowerShell start-up — the better part of a second on a warm machine and
+// worse on a cold one. So the route answers with whatever the last probe said
+// and starts the next one behind it. The first poll after a deck starts
+// carries no verdict, which is correct rather than merely tolerable: at that
+// point the deck has not been listening long enough for an empty list to mean
+// anything either.
+//
+// STALE IS THE RIGHT DEFAULT HERE. What this measures — a network's category, a
+// firewall rule — changes when somebody changes it, which is a thing they do
+// while looking at the instructions this produced. Five minutes is far tighter
+// than that, and the panel's own reload picks up the change on the next poll.
+let reachSaid = null;
+let reachAt = 0;
+let reachBusy = false;
+const REACH_MS = 5 * 60_000;
+
+function refreshReach() {
+  if (reachBusy || process.platform !== "win32") return;
+  if (reachAt && Date.now() - reachAt < REACH_MS) return;
+  reachBusy = true;
+  run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PROBE_PS], {
+    // The program path goes through the environment rather than into the
+    // script, so a path with a quote in it cannot close the string it sits in.
+    env: { ...process.env, CCDECK_EXE: process.execPath },
+    timeout: 25_000,
+  }).then(r => {
+    reachSaid = reachability({
+      platform: process.platform,
+      probe: r?.ok ? readProbe(r.stdout) : null,
+      aliases: localAliases(networkInterfaces()),
+      exePath: process.execPath,
+    });
+  }).catch(() => {
+    // A probe that did not run says nothing, which is the same answer as a
+    // machine this cannot speak about. It is never an error the panel shows:
+    // nobody asked for it.
+    reachSaid = null;
+  }).finally(() => {
+    reachAt = Date.now();
+    reachBusy = false;
+  });
+}
+
 /** What the panel draws: the switch, this deck's own name and address, and who
  *  else is in the group. No passphrase, for the reason prefsPayload gives. */
 function handleLanStatus(req, res) {
-  return send(res, 200, { ok: true, ...lanEngine.status() });
+  refreshReach();
+  return send(res, 200, { ok: true, ...lanEngine.status(), reach: reachSaid });
 }
 
 /**
@@ -3397,6 +3446,10 @@ async function handleLanPeer(req, res) {
     }
     case "dismiss":
       return send(res, 200, { ok: lanEngine.dismiss(fp), ...lanEngine.status() });
+    // The undo for the one above. A deck that was told no stops asking; this is
+    // how somebody who changed their mind lets it ask again.
+    case "allow":
+      return send(res, 200, { ok: lanEngine.allow(fp), ...lanEngine.status() });
     case "unpair":
       return send(res, 200, { ok: lanEngine.unpair(fp), ...lanEngine.status() });
     default:

package/src/server/lan-engine.mjs

@@ -121,12 +121,46 @@ export function createEngine({
    */
   const pending = new Map();
   const strangers = new Map();
+  /**
+   * Decks somebody here said no to.
+   *
+   * WITHOUT THIS, DECLINING DID NOTHING THAT LASTED. A deck that asks is a deck
+   * that keeps asking — it dials on its own timer, and every dial that finds no
+   * pin here becomes a fresh request. So `dismiss` took a row off a list that
+   * the next minute put back, and on the other machine the refusal was
+   * indistinguishable from a deck that had not been answered yet: both are the
+   * same `pending` refusal on the wire, and both drew "waiting for the other
+   * deck to accept this one" forever.
+   *
+   * A name kept here is therefore two answers at once. This deck stops asking
+   * its owner, and the deck that asked is TOLD — see refuse("declined") in
+   * lan-socket.mjs, which is the only way the far end can ever learn that the
+   * answer was no rather than not yet.
+   *
+   * In memory, like the two lists above, and reversible: `allow` takes a name
+   * out and the requests come back. Nothing about it is written down, because a
+   * refusal that outlives the process is a decision nobody can find to undo.
+   */
+  const declined = new Map();
   /** The invite this deck is offering, or null. One at a time: a deck showing
    *  two tokens is a deck whose owner cannot say which one they sent. */
   let invite = null;
   /** What the last round did, for the panel. Not a log: one line per peer, most
    *  recent only, because "what happened" is a question about now. */
   const lastRound = new Map();
+  /**
+   * Why this deck is not listening, when it is switched on and is not.
+   *
+   * A second deck on one machine takes the first one's port and the bind fails;
+   * the switch stays on, the beacon never starts, and the panel drew
+   * `starting…` for as long as the process lived. A state that cannot resolve
+   * and does not say why is the worst thing an instrument can show — the reader
+   * waits, and waiting is the one thing that never fixes it.
+   *
+   * Only the failures that stop the service reach this. A round that could not
+   * reach one peer is that peer's row, not the deck's.
+   */
+  let stalled = null;
 
   /** This deck's accounts in the shape the rules want. Read through the same
    *  function the panel uses, so a row can never be alive here and dead there. */
@@ -361,13 +395,26 @@ export function createEngine({
           onTrust?.(list);
           onChange?.();
         },
+        // Asked before the request is drawn, so a deck that was told no is
+        // told no again rather than becoming a row somebody has to answer
+        // twice. The socket sends the reason; this only knows the name.
+        declined: fp => declined.has(fp),
         onPending: entry => {
           const had = pending.get(entry.fp);
           pending.set(entry.fp, { ...entry, at: had?.at ?? now(), lastAt: now() });
           if (!had) onChange?.();
         },
       });
-      const port = await server.start();
+      let port;
+      try {
+        port = await server.start();
+      } catch (err) {
+        // Kept, so the panel can say it. Rethrown, because the caller's own
+        // catch is what leaves the engine stopped rather than half-started.
+        stalled = err?.message ?? String(err);
+        throw err;
+      }
+      stalled = null;
       if (port !== cfg.port) onPort?.(port);
       beacon = createBeacon({
         port, name: cfg.name, fp: identity.fp,
@@ -533,7 +580,28 @@ export function createEngine({
     /** Say no, and stop being asked. The deck is dropped from both lists; if it
      *  connects again it is a new request, because refusing is not a block. */
     dismiss(fp) {
+      // Whatever the row said, kept — the panel draws a declined deck by name
+      // and address, and after the delete below there is nowhere else to read
+      // them from.
+      const was = pending.get(fp) ?? strangers.get(fp) ?? null;
       const had = pending.delete(fp) || strangers.delete(fp);
+      if (had) {
+        declined.set(fp, {
+          fp,
+          name: was?.name ?? fp,
+          addr: was?.addr ?? "",
+          port: was?.port ?? 0,
+          at: now(),
+        });
+        onChange?.();
+      }
+      return had;
+    },
+    /** Change your mind. The name comes off the declined list and the next time
+     *  that deck dials, it is a request again — which it will, on its own, so
+     *  there is nothing else to press. */
+    allow(fp) {
+      const had = declined.delete(fp);
       if (had) onChange?.();
       return had;
     },
@@ -575,6 +643,9 @@ export function createEngine({
       return {
         enabled: !!cfg.enabled,
         running: !!beacon,
+        // Said only while it is true, and it is only ever true of a deck that
+        // is switched on and has no listener.
+        stalled: cfg.enabled && !beacon ? stalled : null,
         name: cfg.name,
         fp: identity?.fp ?? null,
         // The address and port a person on another subnet types into the other
@@ -597,9 +668,16 @@ export function createEngine({
         // per machine, newest first — see pairable, which is where the rule
         // that keeps this from becoming a wall of ghosts lives.
         strangers: (() => {
-          const { shown, more } = pairable([...strangers.values()], now());
+          // A deck that was told no is not somebody to offer pairing with. It
+          // has its own row, with the one control that undoes the decision.
+          const heard = [...strangers.values()].filter(p => !declined.has(p.fp));
+          const { shown, more } = pairable(heard, now(), { mine: localAddresses() });
           return shown.map(p => ({ fp: p.fp, name: p.name, addr: p.addr, port: p.port, at: p.at, more }));
         })(),
+        // Said no to, by somebody at this keyboard. Listed rather than merely
+        // silenced, because a refusal nobody can see is a refusal nobody can
+        // take back.
+        declined: [...declined.values()].map(p => ({ fp: p.fp, name: p.name, addr: p.addr, at: p.at })),
         peers: beacon ? (() => {
           // ONE DECK, ONE ROW, and it takes work because a deck can arrive here
           // twice by two different routes: heard on the network, and dialled at
@@ -657,6 +735,8 @@ export function createEngine({
     },
     stop() {
       if (timer) clearInterval(timer);
+      // A deliberate stop is not a fault, and the next start says its own.
+      if (!cfg.enabled) stalled = null;
       timer = null;
       beacon?.stop();
       server?.stop();

package/src/server/lan-reach.mjs

@@ -0,0 +1,256 @@
+// Why another deck cannot reach this one — read off the machine, not guessed.
+//
+// THE FAILURE THIS EXISTS FOR. Two decks on one router, LAN sync on at both
+// ends, and one of them shows an empty list forever. Reported as "he sees me
+// and I see nobody", which is the shape that gives it away: Windows lets a
+// process send without asking anybody, and drops unsolicited inbound unless a
+// rule says otherwise. So the beacon leaves, the far deck hears it and draws a
+// row — and the answer coming back is dropped at this machine's edge. Both
+// halves of the feature look broken from here and neither is.
+//
+// WHY IT CANNOT BE FIXED FROM HERE, and this is settled rather than open.
+// Creating a firewall rule needs elevation, and `relay-guard.mjs` already wrote
+// down why no route in this server may raise a password dialog: `index.mjs`
+// deliberately trusts a request carrying no Origin header so hook.js and curl
+// keep working, on the reasoning that a process able to POST to loopback can
+// already run anything as the user. That holds only while no route can do
+// something the caller could not do for itself. One route that elevates hands
+// every local process a way to make an authentication prompt appear wearing
+// ccdeck's name, at a moment ccdeck chose. So this module reads, decides, and
+// hands back a command as TEXT. It is the same shape and the same refusal.
+//
+// WHY IT IS WORTH SAYING ANYTHING AT ALL, given a manual address already makes
+// the feature work without any of this: because "nothing here yet" and "this
+// machine cannot be reached" are different facts, and an empty list says the
+// first while meaning the second. A person reading it concludes the feature is
+// broken, or that the other machine is off. Neither is true and neither is
+// actionable.
+//
+// EVERYTHING BELOW IS A PURE FUNCTION. The probe is one PowerShell call that
+// knows nothing and reports three lists; every judgement is here, where the
+// suite can run it on any platform. That is the same division lan-sync.mjs and
+// lan-socket.mjs already keep, for the same reason.
+
+/** What the probe asks Windows for. Three reads, none of them privileged —
+ *  measured: `Get-NetConnectionProfile`, `Get-NetFirewallProfile` and
+ *  `Get-NetFirewallApplicationFilter` all answer for an ordinary user, while
+ *  `Get-NetFirewallPortFilter` returns "Access is denied". So the rule this
+ *  looks for is scoped to a PROGRAM rather than to a port, which is also the
+ *  only kind that keeps working: the sync listener's port is ephemeral and is
+ *  a different number after every restart. */
+export const PROBE_PS = [
+  "$ErrorActionPreference='SilentlyContinue'",
+  "$nets = @(Get-NetConnectionProfile | ForEach-Object { [pscustomobject]@{ alias=$_.InterfaceAlias; category=[string]$_.NetworkCategory; v4=[string]$_.IPv4Connectivity } })",
+  "$profiles = @(Get-NetFirewallProfile | ForEach-Object { [pscustomobject]@{ name=[string]$_.Name; enabled=[bool]$_.Enabled } })",
+  "$rules = @(Get-NetFirewallApplicationFilter | Where-Object { $_.Program -eq $env:CCDECK_EXE } | ForEach-Object { $_ | Get-NetFirewallRule } | ForEach-Object { [pscustomobject]@{ direction=[string]$_.Direction; action=[string]$_.Action; enabled=[bool]$_.Enabled; profile=[string]$_.Profile } })",
+  // WHICH INTERFACE IS THE LAN, asked of the routing table rather than guessed
+  // from a name. The beacon goes to 255.255.255.255, so the interface that
+  // carries the broadcast IS the one this feature lives or dies on — and on a
+  // machine with Tailscale beside wifi the two have different categories, so
+  // picking the wrong one reports Private and clears a machine that is blocked.
+  "$bcast = [string](Find-NetRoute -RemoteIPAddress 255.255.255.255 | Select-Object -First 1 -ExpandProperty InterfaceAlias)",
+  "[pscustomobject]@{ nets=$nets; profiles=$profiles; rules=$rules; bcast=$bcast } | ConvertTo-Json -Depth 4 -Compress",
+].join("; ");
+
+/**
+ * Read what the probe printed, or null.
+ *
+ * REFUSES RATHER THAN GUESSES. Every field here comes back from a shell on
+ * somebody else's machine, where a policy, a missing cmdlet or a locale can
+ * turn any of it into something this did not expect. A null answer means the
+ * panel says nothing, which is what it did before this module existed — the
+ * one outcome that cannot make anything worse.
+ *
+ * `ConvertTo-Json` collapses a one-element array to a bare object, which is
+ * the classic way a Windows probe passes its own tests and fails on the one
+ * machine that has exactly one network. Normalised here rather than worked
+ * around at each use.
+ */
+export function readProbe(stdout) {
+  let raw = null;
+  try { raw = JSON.parse(String(stdout ?? "").trim()); }
+  catch { return null; }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const list = v => (Array.isArray(v) ? v : v == null ? [] : [v]).filter(x => x && typeof x === "object");
+  return {
+    nets: list(raw.nets).map(n => ({
+      alias: typeof n.alias === "string" ? n.alias : "",
+      category: typeof n.category === "string" ? n.category : "",
+      v4: typeof n.v4 === "string" ? n.v4 : "",
+    })).filter(n => n.alias),
+    profiles: list(raw.profiles).map(p => ({
+      name: typeof p.name === "string" ? p.name : "",
+      enabled: p.enabled === true,
+    })).filter(p => p.name),
+    rules: list(raw.rules).map(r => ({
+      direction: typeof r.direction === "string" ? r.direction : "",
+      action: typeof r.action === "string" ? r.action : "",
+      enabled: r.enabled === true,
+      profile: typeof r.profile === "string" ? r.profile : "",
+    })),
+    bcast: typeof raw.bcast === "string" ? raw.bcast.trim() : "",
+  };
+}
+
+/** The interfaces this machine holds a routable v4 address on, as the names
+ *  Windows knows them by. `faces` is passed in rather than read, for the reason
+ *  everything else here is pure. Measured on Windows 11 26200: node's key and
+ *  `Get-NetConnectionProfile`'s `InterfaceAlias` are the same string, which is
+ *  what makes matching them worth doing at all. */
+export function localAliases(faces) {
+  const out = [];
+  for (const [name, list] of Object.entries(faces ?? {})) {
+    for (const n of list ?? []) {
+      if (n?.internal) continue;
+      if (n?.family !== "IPv4" && n?.family !== 4) continue;
+      if (typeof n.address !== "string" || n.address.startsWith("169.254.")) continue;
+      if (!out.includes(name)) out.push(name);
+    }
+  }
+  return out;
+}
+
+/** A connection profile's category is spelled `DomainAuthenticated`; the
+ *  firewall profile it answers to is spelled `Domain`. One mapping, in one
+ *  place, because getting it wrong reads the wrong profile's `Enabled` and
+ *  produces a confident wrong answer rather than a visible failure. */
+export function profileFor(category) {
+  const c = String(category ?? "").trim().toLowerCase();
+  if (c === "public") return "Public";
+  if (c === "private") return "Private";
+  if (c === "domainauthenticated" || c === "domain") return "Domain";
+  return null;
+}
+
+/**
+ * The network this deck is actually on.
+ *
+ * A machine with Tailscale, a container bridge and wifi has several profiles
+ * and only one of them is the LAN somebody means.
+ *
+ * `aliases` IS IN PREFERENCE ORDER and is walked in that order rather than
+ * matched as a set. The caller puts the broadcast route's interface first,
+ * because that is the one the beacon actually leaves by; matching whichever
+ * happened to come first in the probe's own output is how the machine this was
+ * written on reports Tailscale's Private and clears a wifi that is Public.
+ */
+export function lanNet(nets, aliases = []) {
+  const rows = Array.isArray(nets) ? nets : [];
+  for (const a of (Array.isArray(aliases) ? aliases : [])) {
+    const want = String(a ?? "").trim().toLowerCase();
+    if (!want) continue;
+    const hit = rows.find(n => n.alias.toLowerCase() === want);
+    if (hit) return hit;
+  }
+  return rows.find(n => n.v4 && n.v4 !== "Disconnected") ?? rows[0] ?? null;
+}
+
+/** Does an inbound allow rule for this program already cover that profile?
+ *  A rule's `Profile` is a comma-joined list, and `Any` means all of them. */
+export function ruleCovers(rules, profileName) {
+  const want = String(profileName ?? "").toLowerCase();
+  return (Array.isArray(rules) ? rules : []).some(r => {
+    if (!r.enabled) return false;
+    if (r.direction.toLowerCase() !== "inbound") return false;
+    if (r.action.toLowerCase() !== "allow") return false;
+    const on = r.profile.split(",").map(s => s.trim().toLowerCase());
+    return on.includes("any") || on.includes(want);
+  });
+}
+
+/**
+ * The command that would change it — as text, for a person to paste into an
+ * elevated shell. Never run from here; see the header.
+ *
+ * ONE RULE, SCOPED TO THE PROGRAM. It covers the discovery socket and the sync
+ * listener at once, and it goes on covering the sync listener after a restart
+ * moves it — a rule written against today's port is a rule that works today.
+ *
+ * The category line is only offered when the network is Public, and it is
+ * offered rather than assumed: Public is the right setting for a café and the
+ * wrong one for the router at home, and this module cannot tell which one
+ * somebody is sitting in. The panel says so beside it.
+ */
+export function fixSteps({ category, alias, exePath }) {
+  const steps = [];
+  if (profileFor(category) === "Public" && alias) {
+    steps.push(`Set-NetConnectionProfile -InterfaceAlias "${alias}" -NetworkCategory Private`);
+  }
+  steps.push(
+    "New-NetFirewallRule -DisplayName \"ccdeck (local network)\" -Direction Inbound"
+    + ` -Program "${exePath}" -Action Allow -Profile Private`,
+  );
+  return steps;
+}
+
+/**
+ * Whether other decks can reach this one, and what to do when they cannot.
+ *
+ * `null` means "no opinion", and it is the answer for every machine this cannot
+ * speak about: anything that is not Windows, and any probe that did not come
+ * back. Silence rather than a hedge — a panel line that says "possibly" about a
+ * thing it did not measure is worse than no line.
+ *
+ * `blocked: false` is a real finding and is worth returning: it lets the panel
+ * stop blaming the firewall for an empty list and say the other thing instead,
+ * which is that nobody else is running.
+ */
+export function reachability({ platform, probe, aliases = [], exePath = "" } = {}) {
+  if (platform !== "win32") return null;
+  if (!probe) return null;
+  // The broadcast route first, then the interfaces the deck holds an address
+  // on. The routing table is the authority on where a beacon goes; the deck's
+  // own addresses are the fallback for a machine where that read came back
+  // empty, and the probe's first connected network is the fallback for that.
+  const net = lanNet(probe.nets, [probe.bcast, ...aliases]);
+  const category = net?.category ?? "";
+  const name = profileFor(category);
+  if (!name) return null;
+  const prof = probe.profiles.find(p => p.name.toLowerCase() === name.toLowerCase());
+  // A firewall that is off blocks nothing, and saying otherwise would send
+  // somebody to add a rule that changes nothing.
+  if (prof && !prof.enabled) return { blocked: false, why: "firewall off", category, alias: net?.alias ?? "" };
+  if (ruleCovers(probe.rules, name)) {
+    return { blocked: false, why: "rule present", category, alias: net?.alias ?? "" };
+  }
+  return {
+    blocked: true,
+    why: "no inbound rule",
+    category,
+    alias: net?.alias ?? "",
+    // The reason in the reader's terms, not the registry's. What they need to
+    // know is which half is broken, because the other half is what makes the
+    // workaround below obvious rather than magic.
+    text: name === "Public"
+      ? "This network is set to Public, and Windows drops what other decks send. They can still hear this deck — that is why one of them may already show it."
+      : "Windows has no inbound rule for this deck, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine.",
+    steps: fixSteps({ category, alias: net?.alias ?? "", exePath }),
+  };
+}
+
+/**
+ * The way out that needs no rule at all, and the reason this module is not the
+ * whole answer.
+ *
+ * A round is one OUTBOUND connection — `roundWith` dials, both sides prove
+ * themselves over that socket, and the manifest and any transfer ride it home.
+ * Nothing in a round needs this machine to accept a connection. So a deck that
+ * cannot be reached can still do every part of this by dialling first, and the
+ * two controls that make it dial are an address somebody typed and an invite
+ * somebody else minted.
+ *
+ * WHICH WAY THE INVITE GOES IS THE WHOLE OF IT, and nothing said so before.
+ * An invite carries the addresses of the deck that MINTED it, and the deck that
+ * PASTES it dials them. So a blocked machine that mints an invite is asking to
+ * be called, which is the one thing it cannot receive; the same pair works on
+ * the first try if the invite is minted at the other end and pasted here. Same
+ * two controls, opposite order, and only one of the orders works.
+ */
+export function workaround(blocked) {
+  if (!blocked) return null;
+  return {
+    dial: "This deck can still reach out, and one connection is all a round needs.",
+    invite: "Ask them to make the invite and paste it here — an invite is dialled by whoever pastes it, so it has to be pasted on this machine rather than made on it.",
+    address: "Or type their address below, and this deck will call them.",
+  };
+}

package/src/server/lan-socket.mjs

@@ -253,6 +253,11 @@ export function createSyncServer({
    *  is therefore a real deck rather than a port scan. The panel turns this
    *  into a row with an accept on it. */
   onPending,
+  /** Was this deck already told no? A refusal has to be sent rather than
+   *  merely held, or the far end reads "declined" and "not answered yet" as one
+   *  silent wait — they are the same frame otherwise, and only one of them ever
+   *  comes right by waiting. */
+  declined = () => false,
   /** The invite this deck is currently offering, or null. A caller that proves
    *  it holds the code is somebody the owner handed a token to, so it is paired
    *  on arrival rather than queued behind a press. */
@@ -394,6 +399,12 @@ export function createSyncServer({
               return;
             }
           }
+          // A DECK THIS ONE'S OWNER ALREADY ANSWERED, and the answer was no.
+          // It is not asked again here, and — the half a held refusal cannot
+          // do — the deck that asked is told, so its own panel can stop saying
+          // "waiting" about a question that has been answered.
+          if (declined(peerFp)) return refuse("declined");
+
           // A REAL DECK WE HAVE NOT MET. It finished a handshake, so it is not
           // a port scan, and it told us a name and an address a person can
           // recognise. That is a row with an accept on it, and nothing else
@@ -525,6 +536,7 @@ export function connectToPeer({
       if (msg.t === "no") {
         return fail(new Error({
           pending: "waiting for the other deck to accept this one",
+          declined: "that deck said no",
           impostor: "that deck has this one pinned under a different key",
           "bad proof": "the other deck refused this one's proof",
         }[msg.why] ?? "the other deck refused this handshake"));

package/src/server/lan-sync.mjs

@@ -564,9 +564,22 @@ export function dropTrusted(trusted, fp) {
  * NEWEST FIRST, AND CAPPED. The deck somebody just started is the one they are
  * looking for; a list longer than a screen is a list nobody reads.
  */
-export function pairable(strangers, now, { presentMs = PRESENT_MS, limit = 8 } = {}) {
+export function pairable(strangers, now, { presentMs = PRESENT_MS, limit = 8, mine = [] } = {}) {
+  // NOT THIS MACHINE. A deck's own beacon is filtered by fingerprint, which is
+  // right and is not enough: a second deck on the same computer is a different
+  // process with a different key, so it passes that check honestly and then
+  // shows up in the list under this machine's own hostname, at this machine's
+  // own address, offering to pair with itself.
+  //
+  // It was reported from a screenshot — "why myself appear here in list" — and
+  // the answer is that the address is the one thing that cannot lie: a beacon
+  // arriving FROM an address this machine holds came from this machine. Pairing
+  // with it would also buy nothing, because both decks read one claude-swap
+  // store and there is nothing for either to heal.
+  const own = new Set(Array.isArray(mine) ? mine : []);
   const live = [...(strangers ?? [])]
     .filter(p => p && typeof p.at === "number" && now - p.at <= presentMs)
+    .filter(p => !own.has(p.addr))
     .sort((a, b) => b.at - a.at);
   const seen = new Set();
   const out = [];