agent-dag 3.20.0 → 3.21.1

package/src/server/index.mjs

@@ -26,8 +26,12 @@ import { claudeConfigDir } from "./claude-dir.mjs";
 import { CODEX_HOME, CODEX_SESSIONS_DIR, STOP, walkRolloutDays } from "./codex-dir.mjs";
 import { PRODUCT } from "./brand.mjs";
 import { createBlockNotifier } from "./block-notify.mjs";
-import { DEFAULTS as PREF_DEFAULTS, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, writePrefs } from "./deck-prefs.mjs";
+import { createActivity } from "./activity.mjs";
+import { AWAY_BOOT_GRACE_MS, AWAY_RECHECK_MS, AWAY_TICK_MS, awayGate, awayUpdateStep } from "./auto-update.mjs";
+import { createPresence } from "./presence.mjs";
+import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
+import { aboutThisDeck } from "./lan-about.mjs";
 import { PROBE_PS, localAliases, reachability, readProbe } from "./lan-reach.mjs";
 import { run } from "./exec.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
@@ -48,6 +52,13 @@ const RUNNING_VERSION = (() => {
   catch { return null; }
 })();
 
+// The two facts the away-update waits on (awayUpdateTick): whether a turn is
+// running, fed from pushEvent, and whether a tab is being looked at, fed from
+// POST /api/presence. Up here rather than beside the tick because pushEvent
+// can run before the module below it has finished evaluating.
+const activity = createActivity();
+const presence = createPresence();
+
 const MIME = {
   ".html": "text/html; charset=utf-8",
   ".js":   "application/javascript; charset=utf-8",
@@ -3127,10 +3138,14 @@ function redactDeckToken(raw) {
  * same freshness every other cross-deck setting has.
  */
 let _prefs = { ...PREF_DEFAULTS };
-// And LAN sync starts from the same read, so a deck that had it on comes back
-// with it on. `applyLanPrefs` is defined below — this runs after module
-// evaluation, which is what makes the forward reference fine.
-readPrefs().then(async p => { _prefs = p; await applyLanPrefs(); }).catch(() => {});
+// Read at import, so `consider` has its answer from the first event. LAN sync
+// used to start from this same read, and it must not: bin/deck.js imports this
+// module to ASK whether a deck is already up, and a launcher that then attaches
+// and exits had already bound the beacon and the sync port on the way in —
+// which is the `lan sync (listen): EADDRINUSE` line a second `ccdeck` printed
+// above `deck already running`. The engine starts from the listen that
+// succeeds, in startServer, which is the only process that may hold a port.
+const _prefsRead = readPrefs().then(p => { _prefs = p; }).catch(() => {});
 
 const blockNotifier = createBlockNotifier({
   notify: osNotify,
@@ -3186,12 +3201,87 @@ async function handlePrefsWrite(req, res) {
   return send(res, 200, prefsPayload());
 }
 
+// ── updating while nobody is looking ────────────────────────────────────────
+//
+// auto-update.mjs has the why and the rules; this is the timer and the three
+// effects — install, restart, npx relaunch — each through the code a press
+// uses.
+let _awayTry = null;
+let _awayTimer = null;
+let _bootedAt = Date.now();
+// Until when a report that found nothing newer stands — see AWAY_RECHECK_MS.
+let _awayNothingUntil = 0;
+
+/**
+ * One tick of the away-update. Returns what it did, or null.
+ *
+ * Exported so a test can drive it without waiting out the boot grace — the one
+ * input that is a policy rather than a fact, and so the only one it may pass.
+ * Every clock is the real one: presence and activity are stamped with it.
+ */
+export async function awayUpdateTick({ graceMs = AWAY_BOOT_GRACE_MS } = {}) {
+  const now = Date.now();
+  if (!awayGate({
+    enabled: _prefs?.autoUpdate !== false,
+    supervised: _onRestart != null && _canRestart,
+    restarting: _restarting,
+    sinceBootMs: now - _bootedAt,
+    looking: presence.looking(now),
+    busy: activity.busy(now),
+    quietMs: activity.quietMs(now),
+    graceMs,
+  })) return null;
+  // A standing "nothing newer", unless the clock has moved back past it.
+  if (now < _awayNothingUntil && _awayNothingUntil - now <= AWAY_RECHECK_MS) return null;
+  const su = await import(pathToFileURL(join(PKG_ROOT, "src/server/self-update.mjs")).href);
+  const report = await su.versionReport({ running: RUNNING_VERSION, pkgRoot: PKG_ROOT });
+  if (!report.notice) {
+    _awayNothingUntil = now + AWAY_RECHECK_MS;
+    return null;
+  }
+  const step = awayUpdateStep({
+    notice: report.notice, mode: report.upgradeMode,
+    installing: report.upgrade?.state === "running", lastTry: _awayTry, now,
+  });
+  if (!step.act) return null;
+  // Asked again, because the lookup above can take seconds on a slow line and
+  // somebody may have sat down, or started a turn, in them.
+  const again = Date.now();
+  if (presence.looking(again) || activity.busy(again) || _restarting) return null;
+  _awayTry = { target: step.target, at: again };
+  if (step.act === "install") {
+    su.startUpgrade({ pkgRoot: PKG_ROOT });
+    return step.act;
+  }
+  // handleRestart's own check for the npx path, for the same reason: the mode
+  // comes from the install on disk, and a spec it cannot name is no relaunch.
+  if (step.act === "npx" && !su.npxRestartSpec(PKG_ROOT)) return null;
+  _restarting = true;
+  handOffRestart(step.act === "npx" ? "npx" : null);
+  return step.act;
+}
+
+/** POST {tab, looking} — a tab saying whether it is being looked at. See
+ *  presence.mjs, and src/web/presence.ts for the sender. */
+async function handlePresence(req, res) {
+  const raw = await readBody(req).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
+  if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
+  const ok = presence.report(body.tab, body.looking === true, Date.now());
+  return send(res, ok ? 200 : 400, { ok });
+}
+
 // ── LAN sync ────────────────────────────────────────────────────────────────
 //
 // The engine is built once and told the settings; it opens and closes its own
 // sockets as those change. Nothing here touches a credential — see
 // lan-engine.mjs, which passes an opaque blob between two claude-swap commands.
 const lanEngine = createEngine({
+  // This deck's version and machine, for the decks it is paired with and
+  // nobody else. RUNNING_VERSION rather than a fresh read, for the reason it
+  // is read at import: it is what this process actually runs.
+  about: aboutThisDeck({ version: RUNNING_VERSION }),
   readAccounts: async () => {
     const { fetchClaudeAccounts } = await import("./claude-accounts.mjs");
     return fetchClaudeAccounts();
@@ -3324,6 +3414,9 @@ async function applyLanPrefs() {
       port: lan.port || 0,
       autoAsk: lan.autoAsk !== false,
       autoAccept: lan.autoAccept !== false,
+      // Names somebody here gave other decks. The engine only hands them to
+      // the page, so a change never restarts anything.
+      aliases: lan.aliases && typeof lan.aliases === "object" ? lan.aliases : {},
     });
     // Wholesale, so removing an address in the panel really stops it being
     // dialled rather than only taking the row away.
@@ -3461,6 +3554,21 @@ async function handleLanPeer(req, res) {
       return send(res, 200, { ok: lanEngine.allow(fp), ...lanEngine.status() });
     case "unpair":
       return send(res, 200, { ok: lanEngine.unpair(fp), ...lanEngine.status() });
+    // WHAT THIS DECK CALLS THAT ONE, and nobody else sees it. Keyed by the
+    // fingerprint, so it follows the machine across a new address or a new
+    // name of its own choosing. An empty name takes the alias away.
+    //
+    // The whole map is rebuilt from the one on disk rather than sent by the
+    // page, so two tabs renaming two decks cannot undo each other.
+    case "alias": {
+      if (!isAliasKey(fp)) return send(res, 400, { ok: false, reason: "bad_request" });
+      const name = cleanAlias(body.name);
+      const next = { ...(_prefs?.lan?.aliases ?? {}) };
+      if (name) next[fp] = name; else delete next[fp];
+      _prefs = await writePrefs({ lan: { aliases: next } });
+      await lanEngine.apply({ aliases: _prefs.lan.aliases });
+      return send(res, 200, { ok: true, ...lanEngine.status() });
+    }
     default:
       return send(res, 400, { ok: false, reason: "unknown_action" });
   }
@@ -3468,8 +3576,21 @@ async function handleLanPeer(req, res) {
 
 /** Ask every peer now rather than at the next tick — the button beside the
  *  list, for somebody who has just fixed a login on the other machine and does
- *  not want to wait a minute to see it arrive. */
+ *  not want to wait a minute to see it arrive.
+ *
+ *  Or ONE peer, when the body names it: the `check now` in a deck's own
+ *  dialog. A deck that only calls in has no address here, and says so rather
+ *  than reporting a round that asked nobody. */
 async function handleLanSync(req, res) {
+  const raw = await readBody(req).catch(() => null);
+  let body = null;
+  try { body = JSON.parse(raw ?? ""); } catch { /* the whole-list press sends nothing to read */ }
+  const fp = body && typeof body.fp === "string" ? body.fp : null;
+  if (fp) {
+    const done = await lanEngine.roundOne(fp);
+    if (done == null) return send(res, 409, { ok: false, reason: "no_address" });
+    return send(res, 200, { ok: true, done, ...lanEngine.status() });
+  }
   const done = await lanEngine.round();
   return send(res, 200, { ok: true, done, ...lanEngine.status() });
 }
@@ -3624,6 +3745,10 @@ function pushEvent(raw, source, opts = {}) {
   // know the other exists. block-notify.mjs holds the gates and the cooldown.
   blockNotifier.consider(raw, { clients: sseClients.size, replay: !!opts.replay });
 
+  // Whether a turn is running, for the away-update. Not from a replay: the log
+  // is history, and a turn it shows open is one that ended in another process.
+  if (!opts.replay) activity.note(raw, evt.receivedAt);
+
   if (persisting) {
     // Fire-and-forget append. JSONL = newline-delimited JSON, so the whole line
     // has to reach the file as one write — this used to be `appendFile`, which
@@ -4395,6 +4520,16 @@ async function handleRestart(req, res) {
   if (_deckReady) send(res, 200, { ok: true, mode });
   else send(res, 202, { ok: true, mode, booting: true, detail: "the deck is still starting up; the restart runs as soon as it has finished booting" });
   // Let the response flush before the listener goes away.
+  handOffRestart(mode);
+}
+
+/**
+ * Hand a restart the latch has already admitted to the launcher — from a press
+ * (handleRestart, once its answer is on its way) or from the away-update
+ * (awayUpdateTick). The delay is the press's: its response has to leave before
+ * the listener does.
+ */
+function handOffRestart(mode) {
   setTimeout(() => {
     try { _onRestart(mode); }
     catch (err) {
@@ -5648,6 +5783,22 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
   // `!== false` rather than a cast: a caller that omits the field means "yes",
   // which is how every embedder that predates this option keeps working.
   _providers = { claude: claude !== false, codex: codex !== false };
+  // The away-update's clock. The boot grace counts from here, and the timer is
+  // unref'd so it never keeps a process alive on its own. It does nothing until
+  // the launcher has handed down a restart — see awayGate's `supervised`.
+  _bootedAt = Date.now();
+  clearInterval(_awayTimer);
+  _awayTimer = setInterval(() => { awayUpdateTick().catch(() => {}); }, AWAY_TICK_MS);
+  _awayTimer.unref?.();
+  // The repair a paused Claude account used to wait on a `resume` press for:
+  // handed to the roster read here, by the server that is actually running,
+  // rather than wired at import — see repairStaleCopyWith.
+  if (_providers.claude) {
+    void Promise.all([
+      import(pathToFileURL(join(PKG_ROOT, "src/server/claude-accounts.mjs")).href),
+      cswapAdminModule(),
+    ]).then(([accounts, admin]) => accounts.repairStaleCopyWith(admin.autoRecapture), () => {});
+  }
   const removed = await sweepStaleDiscovery();
   if (removed > 0) console.log(`  swept ${removed} stale discovery file(s)`);
   if (persist) {
@@ -5725,6 +5876,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
     if (req.method === "GET"  && url.pathname === "/api/version")     return guard(handleVersion(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/upgrade")     return guard(handleUpgrade(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/restart")     return guard(handleRestart(req, res), res);
+    if (req.method === "POST" && url.pathname === "/api/presence")    return guard(handlePresence(req, res), res);
     if (req.method === "POST" && url.pathname === "/api/shutdown")    return guard(handleStop(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/quota")       return guard(handleQuota(req, res), res);
     if (req.method === "GET"  && url.pathname === "/api/codex-usage")  return guard(handleCodexUsage(req, res), res);
@@ -5845,6 +5997,10 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       if (codex) startCodexWatcher(workspace);
       // Both timers are unref'd, so this never holds the process open.
       startSystemMetrics();
+      // LAN sync, from the prefs the import read — and only from here, so a
+      // deck that had it on comes back with it on, and a launcher that only
+      // asked the registry never binds a port it is about to walk away from.
+      _prefsRead.then(() => applyLanPrefs()).catch(() => {});
       // Auto-switch resumes only if the user previously turned it on; the
       // module reads its own persisted flag and does nothing otherwise.
       cswapAutoModule().then(m => m.initCswapAuto()).catch(() => {});

package/src/server/lan-about.mjs

@@ -0,0 +1,119 @@
+// What a paired deck says about itself: the version it runs and the machine it
+// runs on.
+//
+// ONLY TO A DECK THAT IS PAIRED, AND SEALED. The beacon is shouted at the whole
+// network and the hello is sent before anybody has proved anything, so neither
+// carries this: which build of which operating system a machine runs is the
+// first thing somebody hunting for a known-broken version would want, and
+// nobody on the network is owed it. It rides the manifest exchange, which only
+// happens between two decks that have each accepted the other — and it is
+// sealed with that connection's key, because the frames around it are JSON in
+// the clear on the wire.
+//
+// BOTH WAYS. The deck that dials sends its own card with the question, and the
+// deck that answers sends its own with the answer. A deck that only calls in —
+// paired, with no address this one can reach — is never asked anything, so the
+// card it sends when it calls is the only way this deck ever learns what it is.
+//
+// OLDER DECKS SAY NOTHING, AND NOTHING BREAKS. The field is extra on a frame
+// both versions already send: a deck from before this reads the accounts and
+// never looks at the rest, and a card that is absent is drawn as absent.
+import { readFileSync } from "node:fs";
+import { release as osRelease } from "node:os";
+import { open, seal } from "./lan-sync.mjs";
+
+/**
+ * The operating system, in the words its owner would use.
+ *
+ * Node reports the KERNEL — `darwin 25.5.0`, `win32 10.0.26100` — and nobody
+ * calls their laptop Darwin 25. So the numbers are translated on the machine
+ * they describe, where the translation is certain, rather than on the one
+ * reading them. Every input is a parameter, so all three platforms are tested
+ * on any one of them.
+ */
+export function osLabel({ platform, release = "", prettyName = "" } = {}) {
+  const [major, minor, build] = String(release).split(".").map(n => Number.parseInt(n, 10));
+  const dot = Number.isInteger(minor) ? `.${minor}` : "";
+  if (platform === "darwin") {
+    if (!Number.isInteger(major)) return "macOS";
+    // Darwin 20 was macOS 11 and every major after it was one more — until 25,
+    // which Apple shipped as macOS 26 to match the year.
+    if (major >= 25) return `macOS ${major + 1}${dot}`;
+    if (major >= 20) return `macOS ${major - 9}${dot}`;
+    // The 10.x years, where the kernel's major minus four is the second number.
+    return major >= 5 ? `macOS 10.${major - 4}` : "macOS";
+  }
+  if (platform === "win32") {
+    // Windows 11 kept the version 10.0 and moved only the build, and 22000 is
+    // the first one. From here it is the only way to tell the two apart.
+    if (major === 10 && Number.isInteger(build)) return build >= 22_000 ? "Windows 11" : "Windows 10";
+    return "Windows";
+  }
+  if (platform === "linux") return prettyName || "Linux";
+  return typeof platform === "string" && platform ? platform : "unknown";
+}
+
+/** The distribution's own name for itself, from the file every systemd-era
+ *  distribution ships, with the fallback path the same spec names. Only ever
+ *  read on Linux: the paths are Linux's and mean nothing anywhere else. */
+export function linuxPrettyName(read = readFileSync) {
+  for (const file of ["/etc/os-release", "/usr/lib/os-release"]) {
+    try {
+      const line = /^PRETTY_NAME=(.*)$/m.exec(String(read(file, "utf8")))?.[1];
+      const name = line?.trim().replace(/^(["'])(.*)\1$/, "$2").trim();
+      if (name) return name;
+    } catch { /* not this one */ }
+  }
+  return "";
+}
+
+/** This deck's own card. Built once, at start: nothing in it changes while the
+ *  process lives, and an upgrade is a restart. */
+export function aboutThisDeck({
+  version = null, platform = process.platform, release = osRelease(), arch = process.arch, read = readFileSync,
+} = {}) {
+  return readAbout({
+    version,
+    os: osLabel({ platform, release, prettyName: platform === "linux" ? linuxPrettyName(read) : "" }),
+    arch,
+  });
+}
+
+/** One field of a card, or null. It came off the network, so it is a string of
+ *  bounded length with no control characters — the rule cleanName applies to a
+ *  deck's name, for the same reason: it reaches a terminal as well as a page.
+ *  `\p{Cc}` is the Unicode class for exactly those, C0 and C1 both. */
+function field(v, max, shape = null) {
+  if (typeof v !== "string") return null;
+  const flat = v.replace(/\p{Cc}/gu, " ").replace(/\s+/g, " ").trim();
+  const s = [...flat].slice(0, max).join("").trim();
+  return s && (!shape || shape.test(s)) ? s : null;
+}
+
+/** A card, or null when there is nothing in it worth drawing. */
+export function readAbout(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const version = field(raw.version, 32, /^[0-9A-Za-z][0-9A-Za-z.+-]*$/);
+  const os = field(raw.os, 48);
+  const arch = field(raw.arch, 16, /^[0-9A-Za-z_]+$/);
+  return version || os || arch ? { version, os, arch } : null;
+}
+
+/** Bound to one connection AND one direction, so a card cannot be replayed
+ *  back at the deck that sent it as if it were the other deck's. */
+const aboutAad = (fromFp, toFp) => `${fromFp}->${toFp}|about`;
+
+/** This deck's card, sealed for the deck on the other end of `key`. */
+export function sealAbout(key, about, fromFp, toFp) {
+  if (!key || !about) return null;
+  return seal(key, JSON.stringify(about), aboutAad(fromFp, toFp));
+}
+
+/** The other deck's card, or null — for a deck that sent none, and for one
+ *  whose seal does not open, which mean the same thing to the panel. */
+export function openAbout(key, sealed, fromFp, toFp) {
+  if (!key || !sealed || typeof sealed !== "object") return null;
+  const text = open(key, sealed, aboutAad(fromFp, toFp));
+  if (text == null) return null;
+  try { return readAbout(JSON.parse(text)); } catch { return null; }
+}

package/src/server/lan-engine.mjs

@@ -30,6 +30,7 @@
 import { accountKey, manifestFor, open, plan, seal, stillListed, transferChallenge } from "./lan-sync.mjs";
 import { connectToPeer, createBeacon, createSyncServer, sendFrame } from "./lan-socket.mjs";
 import { addTrusted, dropTrusted, identityFrom, mintInvite, pairable, readInvite, trustedPeer } from "./lan-sync.mjs";
+import { openAbout, sealAbout } from "./lan-about.mjs";
 import { randomBytes } from "node:crypto";
 import { hostname, networkInterfaces } from "node:os";
 
@@ -95,6 +96,20 @@ export function localAddresses(faces = networkInterfaces()) {
   return out;
 }
 
+/**
+ * The accounts a peer's manifest listed, as the panel may keep them.
+ *
+ * It arrived from another machine, so it is read rather than trusted: strings
+ * where strings belong, a boolean for the verdict, and no more rows than a
+ * manifest may carry. What is kept is only what the deck's dialog draws.
+ */
+export function offered(list) {
+  return (Array.isArray(list) ? list : [])
+    .filter(a => a && typeof a.key === "string" && typeof a.email === "string")
+    .slice(0, 50)
+    .map(a => ({ key: a.key.slice(0, 320), email: a.email.slice(0, 254), alive: a.alive === true }));
+}
+
 /**
  * One deck's LAN sync, from settings to a healed account.
  *
@@ -118,10 +133,13 @@ export function createEngine({
    * with. Nothing secret leaves, and it is still a test shouting at an office.
    */
   createSocket,
+  /** This deck's own card — its version and its machine — handed to every
+   *  paired deck and to nobody else. See lan-about.mjs. */
+  about = null,
 } = {}) {
   let cfg = {
     enabled: false, name: defaultName(), secret: "", shared: [], trusted: [], port: 0,
-    autoAsk: true, autoAccept: true,
+    autoAsk: true, autoAccept: true, aliases: {},
   };
   let identity = null;
   let beacon = null;
@@ -166,6 +184,16 @@ export function createEngine({
   /** What the last round did, for the panel. Not a log: one line per peer, most
    *  recent only, because "what happened" is a question about now. */
   const lastRound = new Map();
+  /** What each paired deck said about itself — version, operating system,
+   *  architecture — keyed by fingerprint, most recent only. Filled from both
+   *  directions: the manifest a deck answers with, and the question a deck that
+   *  calls in asks. See lan-about.mjs. */
+  const aboutBy = new Map();
+  /** The accounts each paired deck offered in its last manifest, keyed by
+   *  fingerprint. Kept APART from lastRound on purpose: a round that fails
+   *  replaces that line, and the list a deck offered a minute ago is still the
+   *  best answer to "what does it share" while it is unreachable. */
+  const offersBy = new Map();
   /** When the last round FINISHED, whatever it did or failed to do. The panel's
    *  `↻` fires one on demand and the loop fires one on its own; a reader who
    *  pressed it wants to know it happened, and a reader who did not wants to
@@ -212,6 +240,15 @@ export function createEngine({
     }));
   };
 
+  /** This deck's card for one connection, as a frame field — or nothing, for a
+   *  deck built without one. Spread into the frame, so a deck from before this
+   *  existed receives exactly the frame it always did plus one key it never
+   *  reads. */
+  const cardFor = (key, toFp) => {
+    const sealed = sealAbout(key, about, identity.fp, toFp);
+    return sealed ? { about: sealed } : {};
+  };
+
   /** Frames from a deck that finished the handshake AND that somebody here has
    *  accepted. Nothing reaches this before both, which is the whole point of
    *  where the two checks sit. `ctx.key` is this connection's key and no other
@@ -222,8 +259,16 @@ export function createEngine({
     if (ctx?.peerFp) spokeAt.set(ctx.peerFp, now());
     try {
       if (msg.t === "manifest") {
+        // THE CALLER'S CARD RIDES THE QUESTION, which is the only way a deck
+        // that calls in ever says what it is: nothing here dials it, so nothing
+        // here ever asks. A seal that does not open is a deck that said nothing.
+        const card = openAbout(ctx.key, msg.about, ctx.peerFp, identity.fp);
+        if (card) aboutBy.set(ctx.peerFp, { ...card, at: now() });
         const accounts = await localAccounts();
-        return ctx.send({ t: "manifest", accounts: manifestFor(accounts, cfg.shared) });
+        return ctx.send({
+          t: "manifest", accounts: manifestFor(accounts, cfg.shared),
+          ...cardFor(ctx.key, ctx.peerFp),
+        });
       }
       if (msg.t === "want") {
         // A SECOND PROOF, for the one operation that moves a credential. The
@@ -313,13 +358,18 @@ export function createEngine({
 
       if (!trustedPeer(cfg.trusted, conn.peerFp)) {
         const { list, added } = addTrusted(cfg.trusted, {
-          fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName,
+          fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName, at: now(),
         });
         if (added) { cfg = { ...cfg, trusted: list }; onTrust?.(list); }
       }
 
-      const theirs = await ask({ t: "manifest" });
+      // Our card goes with the question and theirs comes back with the answer
+      // — see lan-about.mjs for why it is here and nowhere earlier.
+      const theirs = await ask({ t: "manifest", ...cardFor(conn.key, conn.peerFp) });
       if (theirs?.t !== "manifest" || !Array.isArray(theirs.accounts)) throw new Error("no manifest");
+      const card = openAbout(conn.key, theirs.about, conn.peerFp, identity.fp);
+      if (card) aboutBy.set(conn.peerFp, { ...card, at: now() });
+      offersBy.set(conn.peerFp, { at: now(), accounts: offered(theirs.accounts) });
       const mine = await localAccounts();
       // Only accounts I have also ticked. Sharing is mutual by construction:
       // a peer cannot push an account at me that I never agreed to hold.
@@ -449,7 +499,7 @@ export function createEngine({
         // Somebody used the token. They are pinned, and the token is retired —
         // one that pairs twice is one worth stealing twice.
         onInviteUsed: entry => {
-          const { list } = addTrusted(cfg.trusted, { fp: entry.fp, pub: entry.pub, name: entry.name });
+          const { list } = addTrusted(cfg.trusted, { fp: entry.fp, pub: entry.pub, name: entry.name, at: now() });
           cfg = { ...cfg, trusted: list };
           invite = null;
           // AND DIAL IT BACK, KEPT. Accepting made it welcome and left this
@@ -612,7 +662,7 @@ export function createEngine({
             name: cfg.name, myPort: server.port(), code: inv.code,
           });
           const { list } = addTrusted(cfg.trusted, {
-            fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName || inv.name,
+            fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName || inv.name, at: now(),
           });
           cfg = { ...cfg, trusted: list };
           this.addPeer(at.addr, at.port);
@@ -667,7 +717,7 @@ export function createEngine({
         onChange?.();
         return { fp, name: seen.name, addr: seen.addr, port: seen.port, dialled: true };
       }
-      const { list, added } = addTrusted(cfg.trusted, { fp, pub: seen.pub, name: seen.name });
+      const { list, added } = addTrusted(cfg.trusted, { fp, pub: seen.pub, name: seen.name, at: now() });
       cfg = { ...cfg, trusted: list };
       pending.delete(fp);
       strangers.delete(fp);
@@ -724,6 +774,24 @@ export function createEngine({
       return true;
     },
     round,
+    /**
+     * One deck, now — the `check now` in that deck's own dialog.
+     *
+     * Found the way the list found it: heard on the network under its own
+     * fingerprint, or dialled at an address whose answer was that fingerprint.
+     * Null when it is neither, which is a deck that only calls in — nothing
+     * here holds an address for it, so there is nobody to dial.
+     *
+     * `roundAt` is left alone: it says when EVERY paired deck was last asked,
+     * and asking one of them does not make that true.
+     */
+    async roundOne(fp) {
+      if (!beacon || typeof fp !== "string" || !fp) return null;
+      const heard = [...beacon.peers.values()].find(p => p.fp === fp && stillListed(p, now()));
+      const typed = [...manual.values()].find(p => learned.get(`${p.addr}:${p.port}`)?.fp === fp);
+      const peer = heard ?? typed;
+      return peer ? roundWith(peer) : null;
+    },
     /** Dial this address on every round from now on. Returns false for an
      *  address that is not one, rather than storing a row that can never
      *  connect and reports an error every minute forever. */
@@ -758,6 +826,11 @@ export function createEngine({
         // which on a deck that has just started is the honest answer.
         checkedAt: roundAt,
         name: cfg.name,
+        // This deck's own card, so the panel can read a peer's version against
+        // it; and the names somebody here gave other decks, which the panel
+        // and the request dialog draw in place of the ones those decks chose.
+        about: about ?? null,
+        aliases: { ...(cfg.aliases ?? {}) },
         // Whether this deck asks on its own, and whether a request that
         // arrives is answered here or answered for you.
         autoAsk: !!cfg.autoAsk,
@@ -820,6 +893,15 @@ export function createEngine({
             had.met = had.met || row.met;
             if (row.name && !had.name) had.name = row.name;
           };
+          // WHAT THE DECK'S OWN DIALOG DRAWS, by identity: the card it sent,
+          // the logins it offered last, and when somebody here said yes. All
+          // three are keyed by the fingerprint that proved itself, so both
+          // halves of a merged row read the same answer.
+          const card = id => ({
+            about: aboutBy.get(id) ?? null,
+            offers: offersBy.get(id) ?? null,
+            pairedAt: trustedPeer(cfg.trusted, id)?.at ?? null,
+          });
           for (const p of [...beacon.peers.values(), ...manual.values()]) {
             if (!stillListed(p, now())) continue;
             const met = p.manual ? learned.get(`${p.addr}:${p.port}`) : null;
@@ -834,6 +916,7 @@ export function createEngine({
               met: !!met,
               paired: !!trustedPeer(cfg.trusted, id),
               last: lastRound.get(p.fp) ?? null,
+              ...card(id),
             });
           }
           // A DECK WE ARE PAIRED WITH AND DO NOT DIAL. It called us, we accepted

package/src/server/lan-sync.mjs

@@ -592,7 +592,11 @@ export function addTrusted(trusted, entry) {
       added: false,
     };
   }
-  return { list: [...list, { fp: entry.fp, pub: entry.pub, name: entry.name ?? "" }], added: true };
+  // WHEN, for the panel's "paired since". Only a new pin gets one: a deck that
+  // was already trusted keeps whatever date it had, and one pinned before this
+  // field existed keeps having none rather than being given today's.
+  const at = Number.isFinite(entry.at) && entry.at > 0 ? { at: entry.at } : {};
+  return { list: [...list, { fp: entry.fp, pub: entry.pub, name: entry.name ?? "", ...at }], added: true };
 }
 
 /** Take one back out. Unpairing stops what has not happened yet and takes back

package/src/server/presence.mjs

@@ -0,0 +1,40 @@
+// Whether somebody is looking at the deck right now, as its tabs say.
+//
+// The server can tell whether a page is CONNECTED — `sseClients.size` — but not
+// whether anybody is looking at one: a tab behind other windows keeps its
+// stream open all day. The away-update (auto-update.mjs) needs the second fact,
+// so each tab reports it (src/web/presence.ts), and a claim expires here unless
+// it is renewed, because a tab that crashed or lost its network never gets to
+// take it back.
+export const PRESENCE_TTL_MS = 45_000;
+/** More tabs than anybody opens on one deck. A bound because the ids arrive
+ *  from pages; past it the oldest claim goes. */
+const MAX_TABS = 32;
+const TAB_ID = /^[\w-]{1,64}$/;
+
+export function createPresence({ ttlMs = PRESENCE_TTL_MS } = {}) {
+  /** tab id → when it last said it was looking */
+  const seen = new Map();
+  return {
+    /** A tab saying whether it is being looked at. False for an id no page
+     *  could have made, which the route answers with a 400. */
+    report(tab, looking, now) {
+      if (typeof tab !== "string" || !TAB_ID.test(tab)) return false;
+      seen.delete(tab);
+      if (looking) {
+        seen.set(tab, now);
+        while (seen.size > MAX_TABS) seen.delete(seen.keys().next().value);
+      }
+      return true;
+    },
+    /** Whether any tab's claim is still live. A claim stamped by a clock that
+     *  has since moved either way is as expired as an old one. */
+    looking(now) {
+      for (const [tab, at] of seen) {
+        if (Math.abs(now - at) > ttlMs) seen.delete(tab);
+        else return true;
+      }
+      return false;
+    },
+  };
+}