agent-dag 3.18.0 → 3.18.3

package/dist/web/index.html

@@ -40,8 +40,8 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DYh8wtpn.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-Dp5_CD7C.css">
+    <script type="module" crossorigin src="/assets/index-gg-y6G2I.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BeMPJP5g.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.18.0",
+  "version": "3.18.3",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -31,6 +31,18 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.18.3": [
+    {
+      "title": "🟢 The list shows what is on, and folds the rest",
+      "body": "A machine that is off, or nearby and unpaired, or one you said no to, is context rather than an answer to \"who can I use right now\" — so the decks that are **on** lead the list and everything else is one line: `2 more`. Nothing worrying is hidden by it: a deck that cannot be reached is counted in that line, in the warning colour, so the fold says whether it is worth opening.\n\nThe round moved to a **↻ beside the switch**, where the accounts header has kept the same act since it was written, and the line under the state now says when it last ran — `checked 2m ago`, or `not checked yet`. A list that refreshes itself and a list that has stopped used to look identical, and pressing the button to find out was the only way to tell."
+    }
+  ],
+  "3.18.1": [
+    {
+      "title": "🔁 A deck stops asking to pair over and over",
+      "body": "Several decks on one computer share a config directory, so they start with one key. Each read the others' beacons as somebody wearing its name, took a fresh key, and wrote it to the file the others read — a loop that never settles. Every new key is a **new deck** to everyone else on the network, so one machine sent a fresh pairing request every few seconds and accepting one accomplished nothing: the deck that asked no longer existed by the time the answer arrived.\n\nDecks on one computer now recognise each other as the same machine and leave the key alone. The clash still worth healing — a `~/.claude` copied to a second machine — is unchanged.\n\nThis also collapses the rows: a computer that has run the deck a few times appeared several times on everybody else's panel and is one row now. **Both machines need this version** for that to take effect on the other one's screen.\n\nA deck that answered is no longer counted as unreachable, the list refreshes itself in seconds while somebody is deciding rather than at the next minute, and a failed round says what happened — `not listening`, `no route to it` — with the address and the raw error on the hover."
+    }
+  ],
   "3.18.0": [
     {
       "title": "🟢 A deck that is switched off no longer reads as on",

package/src/server/lan-engine.mjs

@@ -38,6 +38,21 @@ import { hostname, networkInterfaces } from "node:os";
  *  than something that updates when you press a button. */
 export const SYNC_MS = 60_000;
 
+/**
+ * How long to wait before dialling again while somebody is deciding.
+ *
+ * A minute is right for the steady state — two decks whose logins all work have
+ * nothing to say to each other — and it is far too long for the one moment
+ * anybody is watching: the seconds after somebody presses accept on the other
+ * machine. Reported as "it should work by itself", from a panel that had been
+ * correct for up to fifty-nine more seconds than the person in front of it.
+ *
+ * So the loop tightens while a request is outstanding and relaxes the moment it
+ * is answered — either way. A refusal is an answer, and a deck that said no is
+ * not asked every eight seconds.
+ */
+export const ASKING_MS = 8_000;
+
 /** How long one peer round may take before it is abandoned. A manifest is one
  *  round trip on a local network; anything past this is a peer that is not
  *  going to answer, and holding the attempt open would stall the next round. */
@@ -148,6 +163,11 @@ export function createEngine({
   /** What the last round did, for the panel. Not a log: one line per peer, most
    *  recent only, because "what happened" is a question about now. */
   const lastRound = new Map();
+  /** When the last round FINISHED, whatever it did or failed to do. The panel's
+   *  `↻` fires one on demand and the loop fires one on its own; a reader who
+   *  pressed it wants to know it happened, and a reader who did not wants to
+   *  know the list is not a photograph of an hour ago. */
+  let roundAt = null;
   /**
    * Why this deck is not listening, when it is switched on and is not.
    *
@@ -231,6 +251,16 @@ export function createEngine({
     }
   };
 
+  /**
+   * Is anybody on the other end still deciding?
+   *
+   * The exact sentence lan-socket.mjs sends for "a real deck, not yet
+   * accepted", which is the one state where dialling again in a few seconds
+   * does something a minute later would not.
+   */
+  const waitingOnSomebody = () =>
+    [...lastRound.values()].some(r => r?.error === "waiting for the other deck to accept this one");
+
   /** Ask one peer what it has, and heal whatever it can heal. */
   const roundWith = async peer => {
     let conn = null;
@@ -360,6 +390,7 @@ export function createEngine({
       // max+1 without a lock of its own.
       all.push(...await roundWith(peer));
     }
+    roundAt = now();
     return all;
   };
 
@@ -440,6 +471,11 @@ export function createEngine({
         onPeer: () => onChange?.(),
         onStranger: entry => {
           const had = strangers.get(entry.fp);
+          // KEYED BY MACHINE WHEN IT SAYS WHICH ONE IT IS. A computer that took
+          // a fresh key — a second deck sharing one config directory does, by
+          // design — used to leave its old key in this map for a day, and every
+          // one of them drew a row offering to pair with the same machine.
+          if (entry.host) for (const [fp, p] of strangers) if (p.host === entry.host && fp !== entry.fp) strangers.delete(fp);
           strangers.set(entry.fp, entry);
           // Only a deck that is new to us is news. A beacon every thirty
           // seconds from one already on the list is not a reason to redraw.
@@ -457,7 +493,15 @@ export function createEngine({
         ...(createSocket ? { createSocket } : {}),
       });
       await beacon.start();
-      timer = setInterval(() => { void round(); }, SYNC_MS);
+      // A self-scheduling loop rather than one interval, because the gap
+      // between rounds is not one number: see ASKING_MS.
+      const tick = async () => {
+        try { await round(); } catch { /* a round reports itself, per peer */ }
+        if (!beacon) return;
+        timer = setTimeout(() => { void tick(); }, waitingOnSomebody() ? ASKING_MS : SYNC_MS);
+        timer.unref?.();
+      };
+      timer = setTimeout(() => { void tick(); }, SYNC_MS);
       timer.unref?.();
     },
     /**
@@ -664,6 +708,9 @@ export function createEngine({
         // Said only while it is true, and it is only ever true of a deck that
         // is switched on and has no listener.
         stalled: cfg.enabled && !beacon ? stalled : null,
+        // When every paired deck was last asked. Null until the first round,
+        // which on a deck that has just started is the honest answer.
+        checkedAt: roundAt,
         name: cfg.name,
         fp: identity?.fp ?? null,
         // The address and port a person on another subnet types into the other
@@ -689,6 +736,9 @@ export function createEngine({
           // A deck that was told no is not somebody to offer pairing with. It
           // has its own row, with the one control that undoes the decision.
           const heard = [...strangers.values()].filter(p => !declined.has(p.fp));
+          // pairable() collapses the rest by machine — see hostId. A computer
+          // that has run the deck a few times holds a key per run, and every
+          // one of them was a row of its own on everybody else's panel.
           const { shown, more } = pairable(heard, now(), { mine: localAddresses() });
           return shown.map(p => ({ fp: p.fp, name: p.name, addr: p.addr, port: p.port, at: p.at, more }));
         })(),
@@ -756,7 +806,7 @@ export function createEngine({
       };
     },
     stop() {
-      if (timer) clearInterval(timer);
+      if (timer) clearTimeout(timer);
       // A deliberate stop is not a fault, and the next start says its own.
       if (!cfg.enabled) stalled = null;
       timer = null;

package/src/server/lan-socket.mjs

@@ -25,7 +25,7 @@ import dgram from "node:dgram";
 import net from "node:net";
 import { randomBytes } from "node:crypto";
 import {
-  beaconPayload, beaconVerdict, handshakeTranscript, notePeer, proof, proofOk,
+  beaconPayload, beaconVerdict, handshakeTranscript, hostId, notePeer, proof, proofOk,
   inviteProof, readBeacon, readPub, sessionKey, trustedPeer,
   ANNOUNCE_MS, MAX_BEACON_BYTES, MAX_MANIFEST_BYTES,
 } from "./lan-sync.mjs";
@@ -89,6 +89,11 @@ export function createBeacon({
   // instance ids mean the deck restarted between them, which is the signal to
   // drop any session held for it rather than resume into a process that is gone.
   const instance = randomBytes(8).toString("hex");
+  /** Which computer this is, as opposed to which process or which key. Derived
+   *  once per beacon rather than per packet: it cannot change while a process
+   *  is running, and hashing a hostname thirty seconds apart forever is work
+   *  nobody asked for. See hostId. */
+  const host = hostId();
   const peers = new Map();
   let sock = null;
   let timer = null;
@@ -99,7 +104,7 @@ export function createBeacon({
   let repliedAt = 0;
   const answered = new Set();
 
-  const payload = () => Buffer.from(JSON.stringify(beaconPayload({ name, fp, port, instance })));
+  const payload = () => Buffer.from(JSON.stringify(beaconPayload({ name, fp, port, instance, host })));
 
   const announce = () => {
     if (!sock) return;
@@ -123,7 +128,7 @@ export function createBeacon({
       // the bytes and the address and does what it is told.
       if (msg.length > MAX_BEACON_BYTES) return;
       const beacon = readBeacon(msg);
-      const verdict = beaconVerdict(beacon, { selfFp: fp, selfInstance: instance, trusted: trusted() });
+      const verdict = beaconVerdict(beacon, { selfFp: fp, selfInstance: instance, selfHost: host, trusted: trusted() });
       // ANSWER A DECK WE HAVE NEVER HEARD, once, WHOEVER IT IS — and that last
       // part is the change. It used to answer only a deck already in the group,
       // which was fine when a group existed. Now the first thing a new deck has
@@ -155,7 +160,12 @@ export function createBeacon({
         // row somebody can accept. Nothing is asked of it and nothing is
         // offered to it until they do.
         if (verdict === "stranger") {
-          onStranger?.({ fp: beacon.fp, name: beacon.name, addr: rinfo.address, port: beacon.port, at: now() });
+          onStranger?.({
+            fp: beacon.fp, name: beacon.name, addr: rinfo.address, port: beacon.port,
+            // Carried through so the list can show one row per machine rather
+            // than one per key that machine has ever held.
+            host: beacon.host, at: now(),
+          });
         }
         return;
       }

package/src/server/lan-sync.mjs

@@ -98,6 +98,7 @@ import {
   createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes,
   timingSafeEqual,
 } from "node:crypto";
+import os from "node:os";
 
 /** Marks a packet as ours before anything reads a field of it. Four bytes of
  *  ASCII rather than a number, so a stray packet on the port is recognisable
@@ -419,7 +420,31 @@ export function inviteProof(code, transcript) {
  * from a deck this one does not trust becomes a row somebody can accept, and
  * nothing at all happens until they do.
  */
-export function beaconPayload({ name, fp, port, instance }) {
+/**
+ * WHICH MACHINE THIS IS, as opposed to which PROCESS or which KEY.
+ *
+ * Reported by somebody looking at a colleague's screen: "I appear three or four
+ * times". Every one of those rows was honest — a deck's identity is its key, a
+ * second deck sharing a config directory is told to take a fresh one
+ * (`id-clash`), and a deck heard yesterday stays listed for a day — so a
+ * machine that has run the deck a few times becomes a column of itself on
+ * everybody else's panel, under one hostname, offering to pair with each.
+ *
+ * A key cannot answer "same machine?" and was never meant to. This can: it is
+ * derived rather than stored, so two processes on one computer agree without
+ * coordinating and a first run needs nothing written; and it is HASHED, because
+ * a hostname and a home directory carry a person's name and this goes out in
+ * the clear to everyone on the network, thirty seconds apart, forever.
+ *
+ * The home directory is in it so that a copied `~/.claude` — which is how two
+ * real machines end up holding one key, and the reason `id-clash` exists —
+ * still reads as two machines when the hostnames differ, which they do.
+ */
+export function hostId({ hostname = os.hostname(), home = os.homedir() } = {}) {
+  return createHash("sha256").update(`${hostname}\u0000${home}`).digest("hex").slice(0, 12);
+}
+
+export function beaconPayload({ name, fp, port, instance, host }) {
   return {
     m: MAGIC,
     v: PROTOCOL,
@@ -431,6 +456,11 @@ export function beaconPayload({ name, fp, port, instance }) {
     // drop whatever session state was held for it rather than trying to resume
     // into a process that no longer exists. Syncthing's field, same job.
     i: instance,
+    // Which MACHINE, so several processes on one computer are one row rather
+    // than one row each. Optional on the wire: a deck older than this sends no
+    // `h`, and a reader that requires one would stop seeing every deck already
+    // installed.
+    ...(host ? { h: host } : {}),
   };
 }
 
@@ -464,7 +494,11 @@ export function readBeacon(buf, { maxBytes = MAX_BEACON_BYTES } = {}) {
   const port = raw.p;
   if (typeof raw.f !== "string" || !/^[0-9a-f]{3}(-[0-9a-f]{3}){3}$/.test(raw.f)) return null;
   if (typeof raw.i !== "string" || !/^[0-9a-f]{8,32}$/.test(raw.i)) return null;
-  return { name: cleanName(raw.n, raw.f), fp: raw.f, port, instance: raw.i };
+  // Optional, and refused rather than tolerated when it is malformed: a field
+  // that decides which rows collapse into one is a field worth being strict
+  // about. Absent is fine and means "a deck older than this".
+  if (raw.h !== undefined && (typeof raw.h !== "string" || !/^[0-9a-f]{6,32}$/.test(raw.h))) return null;
+  return { name: cleanName(raw.n, raw.f), fp: raw.f, port, instance: raw.i, host: raw.h };
 }
 
 /**
@@ -480,8 +514,15 @@ export function readBeacon(buf, { maxBytes = MAX_BEACON_BYTES } = {}) {
  * broadcast on every interface it owns, and filtering by address would need a
  * list of them that changes when a VPN comes up.
  */
-export function beaconVerdict(beacon, { selfFp, selfInstance, trusted } = {}) {
+export function beaconVerdict(beacon, { selfFp, selfInstance, selfHost, trusted } = {}) {
   if (!beacon) return "unreadable";
+  // ANOTHER DECK ON THIS COMPUTER. Not this process — a different key, honestly
+  // its own — and still nothing to pair with: both read one claude-swap store,
+  // so neither holds a login the other could heal. It used to be filtered by
+  // the address the packet came from, which is true and needs the list of this
+  // machine's addresses to be current; the machine's own id needs nothing and
+  // is the same answer.
+  if (selfHost && beacon.host && beacon.host === selfHost && beacon.fp !== selfFp) return "self";
   if (beacon.fp === selfFp) {
     // OUR OWN NAME, FROM SOMEBODY ELSE'S PROCESS. Two decks sharing a config
     // directory hold the same key — and so does the second machine when
@@ -493,7 +534,27 @@ export function beaconVerdict(beacon, { selfFp, selfInstance, trusted } = {}) {
     // own packet carries the instance we are running and another deck's cannot.
     // Told apart here rather than healed here — this function decides, and
     // taking a new key is the engine's to do.
-    return selfInstance && beacon.instance !== selfInstance ? "id-clash" : "self";
+    //
+    // AND ONE MACHINE'S OWN TWIN IS NOT A CLASH, which is the whole of a defect
+    // reported as "Fiodor pressed yes ten times and it keeps asking". Several
+    // decks on one computer share a config directory, so they start with one
+    // key; each read the others' beacons as somebody wearing its name, each
+    // took a fresh key, each wrote that key to the file the others read — and
+    // the loop never settles. Every new key is a new deck to everybody else on
+    // the network, so one machine produced a fresh pairing request every few
+    // seconds, forever, and accepting one accomplished nothing because the deck
+    // that asked no longer existed by the time the answer arrived.
+    //
+    // Two processes on one computer sharing one key is not a problem to heal.
+    // They read one claude-swap store; there is nothing for either to send the
+    // other, they never dial each other, and to the rest of the network they
+    // are one deck — which is exactly what they are. The clash worth healing is
+    // the OTHER one: a `~/.claude` copied to a second machine, where two real
+    // decks would otherwise be permanently invisible to each other.
+    if (selfInstance && beacon.instance !== selfInstance) {
+      return selfHost && beacon.host === selfHost ? "self" : "id-clash";
+    }
+    return "self";
   }
   // A DECK WE HAVE BEEN TOLD TO TRUST, or one somebody may choose to. There is
   // no third answer any more: the group tag used to sort strangers from peers
@@ -581,10 +642,17 @@ export function pairable(strangers, now, { presentMs = PRESENT_MS, limit = 8, mi
     .filter(p => p && typeof p.at === "number" && now - p.at <= presentMs)
     .filter(p => !own.has(p.addr))
     .sort((a, b) => b.at - a.at);
+  // ONE ROW PER MACHINE. `live` is newest first, so the row that survives is the
+  // one that spoke most recently — which is the process somebody is actually
+  // running, rather than a key its computer took and abandoned an hour ago.
+  //
+  // The machine's own id when the far deck sends one, and the old name@address
+  // pair when it does not: a deck older than the `h` field is still collapsed
+  // as well as it can be rather than not at all.
   const seen = new Set();
   const out = [];
   for (const p of live) {
-    const key = `${p.name}@${p.addr}`;
+    const key = p.host ? `host:${p.host}` : `${p.name}@${p.addr}`;
     if (seen.has(key)) continue;
     seen.add(key);
     out.push(p);
@@ -614,6 +682,7 @@ export function notePeer(peers, beacon, addr, now) {
     addr,
     port: beacon.port,
     instance: beacon.instance,
+    host: beacon.host,
     firstSeen: prev?.firstSeen ?? now,
     lastSeen: now,
     // Kept across a name change so the panel can say "was Laptop-birou", which