agent-dag 3.9.0 → 3.10.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-dag",
-  "version": "3.9.0",
+  "version": "3.10.0",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -31,6 +31,12 @@
     "about a defect in the type, and the suite refuses both it and no space at",
     "all."
   ],
+  "3.10.0": [
+    {
+      "title": "\ud83d\udd0c Who else can drive your browser, and where to see it",
+      "body": "**Browser Watch has a Remote control section.** The Claude in Chrome extension holds a connection open to Anthropic's relay, and that connection is registered against your **account**, not against this machine \u2014 so any Claude Code session signed in to the same account, running anywhere, can enumerate and drive this browser, and nothing prompts you on the machine being driven.\n\nThe panel now says whether that is the case here, and what the extension is actually allowed to do in each profile \u2014 enabled or switched off, every site or only the ones it was granted, and which of the powerful APIs it holds. That last part is not what `chrome://extensions` shows you: the per-site list there is enforced by the extension, on itself, while the grant underneath stays exactly as wide as it was.\n\nIf you want it closed, the section hands you the one command that closes it \u2014 as text, to paste in your own terminal. **ccdeck never runs it and never asks for your password**, and it never will: no part of this deck elevates, and a dashboard that could raise a password box on request would be a gift to anything else running on the machine. If the block is already in place, the section offers the command that takes it back out. And if something else in your hosts file already points that name somewhere, it says so and leaves the line alone \u2014 ccdeck only removes the line ccdeck wrote.\n\nAll of this is two file reads and no network call. It was written some releases ago and, until now, was not connected to any screen.\n\n**Also:** the README said `share` produces a `ccdeck1:` blob. It produces `ccdeck2:` \u2014 `ccdeck1:` has been read-only legacy for a while."
+    }
+  ],
   "3.9.0": [
     {
       "title": "\ud83c\udf9b\ufe0f Five switches that were not where the thing they control is",

package/src/server/browser-profiles.mjs

@@ -33,6 +33,15 @@
 import { existsSync as fsExistsSync, readdirSync as fsReaddirSync, statSync as fsStatSync } from "node:fs";
 import { homedir } from "node:os";
 import { posix as posixPath, win32 as winPath } from "node:path";
+// ONE DECLARATION OF THE EXTENSION ID (#798). It was written out here and again
+// in relay-guard.mjs, with the same literal, in two modules that never imported
+// each other — so republishing the extension under a new id and updating one
+// would leave the other detector answering "not installed" forever, with
+// nothing going red anywhere. It comes from relay-guard because that direction
+// is the safe one: relay-guard imports node:path and nothing else, a property
+// its own header states and relay-guard.test.ts pins by reading the source, and
+// importing this module (node:fs) into it would break that.
+import { CLAUDE_EXT_ID } from "./relay-guard.mjs";
 
 /**
  * Claude in Chrome's extension id, which is the same 32 characters in every
@@ -42,8 +51,11 @@ import { posix as posixPath, win32 as winPath } from "node:path";
  * the browser, so Brave, Edge and Vivaldi all hold it under this exact name.
  * That is what makes a directory test sufficient here and what lets one
  * constant serve every row this module returns.
+ *
+ * Re-exported rather than moved, so the callers that read it from here keep
+ * working and the name still documents itself where it is used.
  */
-export const CLAUDE_EXT_ID = "fcoeoabgfenejglbffodgkkbkcdhcgfn";
+export { CLAUDE_EXT_ID };
 
 /**
  * The directories inside a user-data root that are browsing profiles.

package/src/server/browser-watch.mjs

@@ -37,7 +37,7 @@ import { classify, toEpisodes, defaultExclusions, isProgramNavigation } from "./
 import { appendLog, logPath, mergeEpisodes, readStore, undismissed, updateStore, writeStore } from "./browser-watch-store.mjs";
 import { browserSurvey } from "./browser-presence.mjs";
 import { available, performable, react } from "./browser-react.mjs";
-import { RELAY_HOST } from "./relay-guard.mjs";
+import { RELAY_HOST, hostsPath, readKillswitch, extensionReport, killswitchCommand, verdict } from "./relay-guard.mjs";
 
 /**
  * The moment this deck started, and the only floor any read uses.
@@ -77,6 +77,106 @@ function mtimeMs(file, deps) {
   try { return (deps.statSync ?? statSync)(file).mtimeMs; } catch { return null; }
 }
 
+/** Secure Preferences reports, keyed on the file and its mtime — see
+ *  `relayGuard` for why this one needs a cache more than the History read
+ *  does. */
+const extCache = new Map();
+
+/**
+ * What relay-guard can say about this machine, from two reads it does not do
+ * itself.
+ *
+ * THE MODULE WAS BUILT AND NEVER PLUGGED IN (#799). Every export but
+ * `RELAY_HOST` greped to its own declaration and its test, so the header's
+ * promise — "the one command that closes it … hands back the command that would
+ * change it, as text, for the user to paste" — reached no surface. A reader
+ * auditing this repo's security posture would have believed the killswitch and
+ * the grant report ship. This is that promise kept: the panel now renders both.
+ *
+ * relay-guard imports node:path and nothing else, on purpose, so the reading is
+ * here. Two sources:
+ *
+ *   THE HOSTS FILE, once. Small, and the same file for every profile.
+ *
+ *   EACH PROFILE'S "Secure Preferences", only where `hasExtension` already said
+ *   the directory is there. This one is why there is a cache: it is a single
+ *   JSON document holding every extension's settings and it runs to megabytes
+ *   on a profile with a few installed, while the panel polls every ten seconds.
+ *   Keyed on mtime like the History cache above, and for the same reason — a
+ *   browser that is closed cannot invalidate it.
+ *
+ * A read that fails is not a report of "nothing installed": `null` for that
+ * profile, and the aggregate says so. The difference matters here more than
+ * anywhere else in this file, because the reassuring answer and the unreadable
+ * answer are the same shape.
+ */
+async function relayGuard(profiles, { platform, env, deps }) {
+  const readOne = async (file) => {
+    const stamp = mtimeMs(file, deps);
+    if (stamp === null) return null;
+    const hit = extCache.get(file);
+    if (hit && hit.stamp === stamp) return hit.report;
+    let report = null;
+    try {
+      report = extensionReport(JSON.parse(await (deps.readFile ?? readFile)(file, "utf8")));
+    } catch {
+      // Unreadable or not JSON — a profile being written as we looked, a
+      // hardened profile we cannot open. Not cached, so the next poll retries.
+      return null;
+    }
+    extCache.set(file, { stamp, report });
+    return report;
+  };
+
+  const seen = [];
+  for (const profile of profiles) {
+    // `hasClaudeExt` is an existsSync on `Extensions/<id>` and is already
+    // computed; it cannot see `enabled`, `allUrls` or `sensitiveApis`, which is
+    // the whole reason this reads the preferences at all. But it is a free way
+    // to skip every profile that has no extension to report on.
+    if (!profile.hasClaudeExt) continue;
+    const report = await readOne(profile.securePrefsPath);
+    seen.push({
+      browser: profile.browser,
+      name: profile.name,
+      profile: profile.profile,
+      // Null when the file could not be read, which the panel says out loud
+      // rather than rendering as an absence of permissions.
+      report,
+    });
+  }
+
+  let hostsText = null;
+  const hosts = (deps.hostsPath ?? hostsPath)(platform, env);
+  try { hostsText = await (deps.readFile ?? readFile)(hosts, "utf8"); } catch { /* no file, or no permission to read it */ }
+  const killswitch = readKillswitch(hostsText);
+
+  // ONE ENABLED COPY ANYWHERE IS ENOUGH, which is `verdict`'s own rule: the
+  // relay is registered per ANTHROPIC ACCOUNT, not per profile, so a second
+  // profile with the extension switched off protects nothing.
+  const anyExtension = seen.some(p => p.report?.present === true && p.report.enabled === true);
+
+  return {
+    relayHost: RELAY_HOST,
+    hostsPath: hosts,
+    // Whether the hosts file could be read at all. `blocked: false` from an
+    // unreadable file and `blocked: false` from a file with no entry are the
+    // same value and not the same fact.
+    hostsRead: typeof hostsText === "string",
+    profiles: seen,
+    anyExtension,
+    killswitch,
+    verdict: verdict({ anyExtension, blocked: killswitch.blocked }),
+    // Both, always, so the panel can offer the one that matches the state
+    // without having to know how either is spelled. Text only — nothing here
+    // runs it, and relay-guard could not if it tried.
+    command: {
+      block: killswitchCommand(platform, { on: true }),
+      unblock: killswitchCommand(platform, { on: false }),
+    },
+  };
+}
+
 /**
  * Visits for one profile, re-reading only when the browser has written since
  * the last look.
@@ -503,6 +603,10 @@ export async function browserWatchSnapshot({
       log: watchLog(),
       profiles: [],
       browsers: [],
+      // Null rather than an empty report: this poll read no browser at all, and
+      // "the extension is not installed" is not something it is in a position
+      // to say. The panel renders the difference.
+      relay: null,
       episodes: archived,
       coverage: {
         startedMs: STARTED_MS,
@@ -753,10 +857,14 @@ export async function browserWatchSnapshot({
   _checkedMs = now;
 
   const browsers = await surveyBrowsers(platform, env, now, deps);
+  // Two small reads, and the answer to the one question this panel exists
+  // beside: whether somebody else's Claude Code can drive this browser (#799).
+  const relay = await relayGuard(profiles, { platform, env, deps }).catch(() => null);
 
   return {
     ok: true,
     settings: store.settings,
+    relay,
     // What this platform can actually do, so the panel never offers a mode
     // that would silently do nothing. See browser-react.mjs.
     reactions: available(platform),

package/src/server/index.mjs

@@ -788,7 +788,7 @@ const AGENT_NAME_MARK = '"agent-name"';
 /** Fold one line's naming records into `out`. Last value wins. Pure: `out` is
  *  the only thing written, and a line that is not one of the two records — or
  *  is a truncated fragment of one — leaves it untouched. */
-function foldSessionNamingLine(out, line) {
+export function foldSessionNamingLine(out, line) {
   if (!line) return;
   const hasTitle = line.includes(AI_TITLE_MARK);
   const hasName = line.includes(AGENT_NAME_MARK);
@@ -803,22 +803,6 @@ function foldSessionNamingLine(out, line) {
   }
 }
 
-/**
- * The session naming carried by a chunk of transcript text, newest wins.
- *
- * Pure and text-in, so the suite can pin the parsing against a handful of lines
- * instead of a 46 MB fixture. Returns `{aiTitle: null, agentName: null}` for a
- * chunk holding neither — a young session, or a stretch of the file that is all
- * tool output — and the caller keeps whatever it already knew rather than
- * clearing a name it has already shown.
- */
-export function readSessionNaming(text) {
-  const out = { aiTitle: null, agentName: null };
-  if (!text || typeof text !== "string") return out;
-  for (const line of text.split("\n")) foldSessionNamingLine(out, line);
-  return out;
-}
-
 /** Fold one transcript line into the running state. Every fact the three
  *  scanners need lives on a single line, so line-at-a-time folding sees
  *  exactly what a whole-file pass would. */
@@ -1459,8 +1443,13 @@ const lastNameReadAt = new Map();       // sid -> ms timestamp
 const pendingNameReads = new Set();     // sid currently being read
 
 /** The naming the cursor has folded so far, or null when the scan has nothing.
- *  Exported beside readContextFromTranscript for the same reason: the rule is
- *  worth pinning directly rather than through a live server. */
+ *
+ *  NOT exported, and the comment here used to say it was — "beside
+ *  readContextFromTranscript … the rule is worth pinning directly rather than
+ *  through a live server" — which stated a test contract no test had (#798).
+ *  What is worth pinning is the parsing, and that is `foldSessionNamingLine`,
+ *  which IS exported and which session-name.test.ts drives line at a time the
+ *  way `foldTranscriptLine` does. This wrapper is a scan and two null checks. */
 async function readSessionNamingFromTranscript(path) {
   const state = await scanTranscript(path);
   if (!state) return null;

package/src/server/open-url.mjs

@@ -158,19 +158,14 @@ export function startCommand(url, env = process.env, comspec) {
 }
 
 /**
- * Refuse anything that is not an http(s) URL.
+ * The address to actually hand the desktop, or null when it is not one — and
+ * the ONLY guard, since #798 removed the `isOpenable` boolean that sat in front
+ * of it with no caller but the suite.
  *
- * The one caller passes a localhost address it built itself, so this is not
- * guarding against a hostile input today — it is guarding against the day a
- * second caller passes a path, because every launcher above would happily open
- * it and `start` would run it.
- */
-export function isOpenable(url) {
-  return normalizeOpenable(url) !== null;
-}
-
-/**
- * The address to actually hand the desktop, or null when it is not one.
+ * Refuse anything that is not an http(s) URL: today's one caller passes a
+ * loopback address this deck built itself, so this is not guarding against a
+ * hostile input — it is guarding against the day a second caller passes a path,
+ * because every launcher above would happily open it and `start` would run it.
  *
  * The guard used to parse into a local `u`, check its protocol and throw the
  * parse away — so what reached `launchers` was the RAW string. `new URL()`

package/src/server/relay-guard.mjs

@@ -12,6 +12,11 @@
 // the one holding the user's logged-in sessions, so the question is worth a
 // panel rather than a footnote.
 //
+// WHERE IT SURFACES. The Browser Watch panel, under "Can this browser be
+// driven": the verdict, the grants each profile actually holds, and the
+// killswitch command as text to copy. `browser-watch.mjs`'s `relayGuard` does
+// the two reads this module refuses to do and calls everything below.
+//
 // WHAT THIS MODULE DOES. Two reads and a string. It says whether the extension
 // is installed and what it was granted (from a profile's "Secure Preferences",
 // which the caller parses), and whether the hosts file already black-holes the

package/src/server/system-metrics.mjs

@@ -1463,6 +1463,23 @@ export function startSystemMetrics() {
   thermalTimer.unref?.();
 }
 
+/**
+ * Stop the three timers and reset every reading this module holds.
+ *
+ * THE SUITE'S, AND SAID PLAINLY (#798). Production starts the loop once at boot
+ * and never stops it — the process ending is what stops it — so an audit
+ * grepping for callers finds none, and the honest answer is not to delete this
+ * but to name what it is for. It is a RESET as much as a stop: `history`,
+ * `thermal`, the CPU baselines and the miss counters all go back to their
+ * initial values, which is exactly what a case needs between two runs of
+ * `startSystemMetrics` in one process, and what nothing else in this module
+ * offers. Deleting it would leave the suite leaking intervals into the values
+ * the next case reads.
+ *
+ * That is also why it is safe as a test-only export where the four removed in
+ * #798 were not: there is no shipped counterpart for it to drift away from. The
+ * state it clears IS the state every other assertion here reads.
+ */
 export function stopSystemMetrics() {
   if (cpuTimer) clearInterval(cpuTimer);
   if (memTimer) clearInterval(memTimer);