castle-web-cli 0.4.105 → 0.4.107

package/dist/byo-login.d.ts

@@ -0,0 +1,14 @@
+export type LoginProvider = "claude" | "cursor";
+export type LoginPhase = "starting" | "awaiting-user" | "awaiting-code" | "verifying" | "error";
+export interface LoginState {
+    provider: LoginProvider;
+    phase: LoginPhase;
+    url?: string;
+    message?: string;
+}
+export declare function activeLogin(): LoginState | null;
+export declare function providerHasLogin(provider: LoginProvider): boolean;
+export declare function startLogin(provider: LoginProvider, onChange: () => void): void;
+export declare function submitLoginCode(code: string): void;
+export declare function logout(provider: LoginProvider, onChange: () => void): void;
+export declare function cancelLogin(): void;

package/dist/byo-login.js

@@ -0,0 +1,196 @@
+// Driving `claude auth login` / `cursor-agent login` from the editor, so a user
+// can put a run on their own subscription without knowing the terminal exists.
+//
+// Both CLIs are usable HEADLESS -- measured, not documented (probed 2026-07-30
+// against claude 2.1.220 and the current cursor-agent):
+//
+//   claude auth login   with no TTY and stdin from a pipe, prints
+//                       "Opening browser to sign in…" then the OAuth URL, then
+//                       blocks reading a pasted code from STDIN. The URL is
+//                       wrapped in an OSC-8 hyperlink, so it appears TWICE in
+//                       the raw bytes.
+//   cursor-agent login  with NO_OPEN_BROWSER=1, prints
+//                       "Open a browser and navigate to this link: <url>" and
+//                       then POLLS the challenge itself -- no code to paste.
+//
+// Neither uses a localhost callback, which is what makes this work at all in a
+// sandbox: the browser is on the user's machine and the CLI is in a container,
+// so a loopback redirect would have nowhere to land.
+//
+// `claude setup-token` is NOT usable here: with no TTY it prints nothing, and
+// under one it launches the full Claude Code TUI.
+import { spawn } from "child_process";
+import * as os from "os";
+import { ANTHROPIC_PROXY_ENV, claudeHasSavedLogin, cursorHasUserLogin, } from "./byo-auth.js";
+// A login is a singleton: two at once would race for the same credential file,
+// and the UI only ever offers one. A second start replaces the first.
+let active = null;
+export function activeLogin() {
+    return active ? active.state : null;
+}
+export function providerHasLogin(provider) {
+    return provider === "claude"
+        ? claudeHasSavedLogin()
+        : cursorHasUserLogin(os.homedir());
+}
+// Long enough for a real sign-in (find the browser, log in, maybe sign up),
+// short enough that an abandoned flow doesn't leave a child running forever.
+// The env override is a QA seam, like CASTLE_USER_KEYS_PATH: ten minutes is
+// unwaitable in a test.
+const LOGIN_TIMEOUT_MS = Number(process.env.CASTLE_LOGIN_TIMEOUT_MS ?? "") || 10 * 60 * 1000;
+// OSC-8 hyperlinks and colour codes come through on both CLIs; strip them
+// before matching so a URL isn't cut short at an escape byte.
+// eslint-disable-next-line no-control-regex
+const ANSI = /\x1b\[[0-9;]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)?/g;
+const URL_PATTERN = {
+    claude: /https:\/\/claude\.com\/\S*oauth\S*/,
+    cursor: /https:\/\/cursor\.com\/\S*/,
+};
+function commandFor(provider) {
+    const env = { ...process.env, NO_OPEN_BROWSER: "1" };
+    if (provider === "cursor") {
+        // Castle's key would let cursor-agent consider itself authenticated and
+        // skip the OAuth it was just asked for.
+        delete env.CURSOR_API_KEY;
+        return { file: "cursor-agent", args: ["login"], env };
+    }
+    // Castle's proxy pair outranks a claude.ai login (see byo-auth), and the
+    // sandbox always has it set -- leaving it in place would have claude decide
+    // it is already authenticated and skip the flow entirely.
+    for (const name of ANTHROPIC_PROXY_ENV)
+        delete env[name];
+    // Nothing here should open a browser on the SERVE's machine: in a sandbox
+    // that is the container, where it would silently fail; locally it would
+    // steal focus from the person who clicked.
+    env.BROWSER = "true";
+    return { file: "claude", args: ["auth", "login"], env };
+}
+function publish(next) {
+    if (!active)
+        return;
+    active.state = { ...active.state, ...next };
+    active.onChange();
+}
+function finish(message) {
+    if (!active)
+        return;
+    clearTimeout(active.timer);
+    const { onChange } = active;
+    if (message === null) {
+        active = null;
+    }
+    else {
+        // The flow is over, so nothing will read from the child again -- without
+        // this kill a timed-out `claude auth login` sits blocked on stdin forever,
+        // the very leak LOGIN_TIMEOUT_MS exists to prevent. A no-op on the paths
+        // where the child already exited.
+        active.child?.kill();
+        active.state = { ...active.state, phase: "error", message };
+        // Kept, not cleared: the phase IS the error surface, and a cleared state
+        // would read to the client as "no flow ran" -- indistinguishable from a
+        // button that did nothing. cancelLogin / the next start clears it.
+    }
+    onChange();
+}
+function handleOutput(text) {
+    if (!active)
+        return;
+    const clean = text.replace(ANSI, "");
+    // A mistyped code does NOT end the process -- claude prints this and prompts
+    // again (measured: "Invalid code. Please make sure the full code was
+    // copied."). Without catching it the flow sits in `verifying` until the
+    // timeout, looking like a hang, and the user has no way to retry short of
+    // cancelling. Put them back on the code step with the CLI's own wording.
+    const invalid = /Invalid code[^\n]*/.exec(clean);
+    if (invalid) {
+        publish({ phase: "awaiting-code", message: invalid[0].trim() });
+        return;
+    }
+    if (!active.state.url) {
+        const match = URL_PATTERN[active.provider].exec(clean);
+        if (match) {
+            publish({
+                url: match[0],
+                // claude will ask for a pasted code next; cursor polls on its own.
+                phase: active.provider === "claude" ? "awaiting-code" : "awaiting-user",
+            });
+        }
+    }
+}
+export function startLogin(provider, onChange) {
+    cancelLogin();
+    const { file, args, env } = commandFor(provider);
+    let child;
+    try {
+        child = spawn(file, args, { env, stdio: ["pipe", "pipe", "pipe"] });
+    }
+    catch {
+        active = {
+            provider,
+            child: null,
+            state: { provider, phase: "error", message: `could not run ${file}` },
+            timer: setTimeout(() => undefined, 0),
+            onChange,
+        };
+        onChange();
+        return;
+    }
+    active = {
+        provider,
+        child,
+        state: { provider, phase: "starting" },
+        timer: setTimeout(() => finish("Timed out waiting for sign-in."), LOGIN_TIMEOUT_MS),
+        onChange,
+    };
+    child.stdout?.on("data", (b) => handleOutput(b.toString()));
+    child.stderr?.on("data", (b) => handleOutput(b.toString()));
+    child.on("error", () => finish(`could not run ${file}`));
+    child.on("close", () => {
+        if (!active || active.child !== child)
+            return;
+        // Already settled as an error: this close is finish()'s own kill landing
+        // (the timeout path), and evaluating it as a fresh outcome would overwrite
+        // the message that explains what happened.
+        if (active.state.phase === "error")
+            return;
+        publish({ phase: "verifying" });
+        // The RESOLVER decides, never the exit code: what matters is whether the
+        // credential this process routes on is now there. A CLI that exits 0
+        // without leaving one behind must not read as success.
+        if (providerHasLogin(provider))
+            finish(null);
+        else
+            finish("Sign-in did not complete.");
+    });
+    onChange();
+}
+export function submitLoginCode(code) {
+    if (!active || active.state.phase !== "awaiting-code")
+        return;
+    const trimmed = code.trim();
+    if (!trimmed)
+        return;
+    active.child.stdin?.write(trimmed + "\n");
+    publish({ phase: "verifying" });
+}
+// Sign out, so the modal isn't a one-way door. Fire-and-forget by shape but
+// awaited for its close, because the snapshot is only right once the CLI has
+// actually dropped the credential -- the resolver, again, not the exit code.
+export function logout(provider, onChange) {
+    cancelLogin();
+    const { file, args, env } = provider === "cursor"
+        ? { file: "cursor-agent", args: ["logout"], env: process.env }
+        : { file: "claude", args: ["auth", "logout"], env: commandFor("claude").env };
+    const child = spawn(file, args, { env, stdio: "ignore" });
+    child.on("error", onChange);
+    child.on("close", onChange);
+}
+export function cancelLogin() {
+    if (!active)
+        return;
+    clearTimeout(active.timer);
+    active.child?.kill();
+    const { onChange } = active;
+    active = null;
+    onChange();
+}

package/dist/castleJson.d.ts

@@ -0,0 +1,15 @@
+export interface DeckImport {
+    deckId?: string;
+    source?: 'builtin';
+    kit?: string;
+    via?: string;
+    version: string;
+}
+export interface CastleJson {
+    deckId?: string;
+    cardId?: string;
+    imports?: Record<string, DeckImport>;
+    [key: string]: unknown;
+}
+export declare function readCastleJson(dir: string): CastleJson | null;
+export declare function readCastleJsonOrThrow(dir: string): CastleJson | null;

package/dist/castleJson.js

@@ -0,0 +1,24 @@
+import * as fs from 'fs';
+import * as path from 'path';
+// A missing castle.json is normal (a deck has none until its first save), so it
+// reads as `null` rather than an error. An unparseable one is not -- `onInvalid`
+// is how a caller says whether that should be fatal here or just another `null`.
+function readCastleJsonFile(dir, onInvalid) {
+    const file = path.join(dir, 'castle.json');
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf-8'));
+    }
+    catch (e) {
+        return onInvalid(file, e);
+    }
+}
+export function readCastleJson(dir) {
+    return readCastleJsonFile(dir, () => null);
+}
+export function readCastleJsonOrThrow(dir) {
+    return readCastleJsonFile(dir, (file, e) => {
+        throw new Error(`Could not read ${file}: ${e instanceof Error ? e.message : String(e)}`);
+    });
+}

package/dist/claude-shim-env.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/claude-shim-env.js

@@ -0,0 +1,6 @@
+// Printed for the editor terminal's `claude` shim to eval: the environment this
+// particular run should have, plus the real binary to exec (see
+// installClaudeShim in byo-auth.ts for why the decision can't live in the
+// shell's own environment).
+import { claudeShellEnvScript } from "./byo-auth.js";
+process.stdout.write(claudeShellEnvScript(process.env, process.argv[2] ?? ""));

package/dist/get-deck.js

@@ -5,6 +5,7 @@ import { nanoid } from 'nanoid';
 import * as api from './api.js';
 import { normalizeDeckPackageJson } from './normalize.js';
 import { archiveSource, runTar, SOURCE_ARCHIVE_EXCLUDES } from './save-deck.js';
+import { readCastleJson } from './castleJson.js';
 // Refreshing a deck already in the target replaces its source, so a file deleted
 // upstream actually disappears here -- untarring over the old tree would leave it
 // behind. What survives is exactly what the source archive doesn't carry, and it
@@ -12,17 +13,6 @@ import { archiveSource, runTar, SOURCE_ARCHIVE_EXCLUDES } from './save-deck.js';
 // below (which is that same archive), so deleting one destroys it outright. They're
 // all machine-local anyway -- deps, build output, .castle runtime state, .git.
 const KEEP = SOURCE_ARCHIVE_EXCLUDES;
-function readCastleJson(dir) {
-    const p = path.join(dir, 'castle.json');
-    if (!fs.existsSync(p))
-        return null;
-    try {
-        return JSON.parse(fs.readFileSync(p, 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
 // Whether the target already holds a deck, as opposed to being new, empty, or
 // holding only the dirs a refresh preserves.
 function hasSource(dir) {

package/dist/ide.js

@@ -15,7 +15,7 @@ import headlessPkg from "@xterm/headless";
 import { SerializeAddon } from "@xterm/addon-serialize";
 import { WebSocketServer } from "ws";
 import { IMPORTS_DIR, importStatuses, updateImport } from "./imports.js";
-import { envForUserShell } from "./byo-auth.js";
+import { envForUserShell, installClaudeShim } from "./byo-auth.js";
 const HeadlessTerminal = headlessPkg.Terminal;
 const DIST_DIR = path.dirname(fileURLToPath(import.meta.url));
 // The bundled shell app (vite build output). `/` serves its index.html and
@@ -315,7 +315,7 @@ function readRequestBody(req) {
         req.on("error", reject);
     });
 }
-function handleFilesWrite(deckDir, req, res) {
+function withJsonBody(req, res, handler) {
     void (async () => {
         let body;
         try {
@@ -324,24 +324,37 @@ function handleFilesWrite(deckDir, req, res) {
         catch {
             return sendJson(res, 400, { error: "Invalid JSON body." });
         }
+        handler(body);
+    })();
+}
+// The shape every single-path mutation handler starts with: parse the body,
+// resolve `path` against the deck, and reject anything outside it.
+function withMutationPath(deckDir, req, res, handler) {
+    withJsonBody(req, res, (body) => {
         const resolved = resolveDeckPath(deckDir, body.path, { mutation: true });
         if (!resolved.ok)
             return sendJson(res, 400, { error: resolved.error });
+        handler(resolved, body);
+    });
+}
+function sendFailure(res, action, rel, err) {
+    const message = err instanceof Error ? err.message : String(err);
+    sendJson(res, 500, { error: `Could not ${action} ${rel}: ${message}` });
+}
+function handleFilesWrite(deckDir, req, res) {
+    withMutationPath(deckDir, req, res, (target, body) => {
         if (typeof body.contents !== "string") {
             return sendJson(res, 400, { error: "File contents must be a string." });
         }
         try {
-            fs.mkdirSync(path.dirname(resolved.abs), { recursive: true });
-            fs.writeFileSync(resolved.abs, body.contents, "utf8");
-            sendJson(res, 200, { ok: true, path: resolved.rel });
+            fs.mkdirSync(path.dirname(target.abs), { recursive: true });
+            fs.writeFileSync(target.abs, body.contents, "utf8");
+            sendJson(res, 200, { ok: true, path: target.rel });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            sendJson(res, 500, {
-                error: `Could not write ${resolved.rel}: ${message}`,
-            });
+            sendFailure(res, "write", target.rel, err);
         }
-    })();
+    });
 }
 // Add `<rel>/**` to the deck's editor.visiblePaths so files created in a
 // newly-made folder show in the curated Files tree. Only touches a deck that is
@@ -378,29 +391,16 @@ function ensureVisiblePath(deckDir, rel) {
     }
 }
 function handleFilesMkdir(deckDir, req, res) {
-    void (async () => {
-        let body;
+    withMutationPath(deckDir, req, res, (target) => {
         try {
-            body = JSON.parse(await readRequestBody(req));
-        }
-        catch {
-            return sendJson(res, 400, { error: "Invalid JSON body." });
-        }
-        const resolved = resolveDeckPath(deckDir, body.path, { mutation: true });
-        if (!resolved.ok)
-            return sendJson(res, 400, { error: resolved.error });
-        try {
-            fs.mkdirSync(resolved.abs, { recursive: true });
+            fs.mkdirSync(target.abs, { recursive: true });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            return sendJson(res, 500, {
-                error: `Could not create folder ${resolved.rel}: ${message}`,
-            });
+            return sendFailure(res, "create folder", target.rel, err);
         }
-        const visiblePathAdded = ensureVisiblePath(deckDir, resolved.rel);
-        sendJson(res, 200, { ok: true, path: resolved.rel, visiblePathAdded });
-    })();
+        const visiblePathAdded = ensureVisiblePath(deckDir, target.rel);
+        sendJson(res, 200, { ok: true, path: target.rel, visiblePathAdded });
+    });
 }
 // True when two paths resolve to the same underlying file (same inode+device) --
 // e.g. the source and target of a case-only rename on a case-insensitive FS.
@@ -415,14 +415,7 @@ function isSameFile(a, b) {
     }
 }
 function handleFilesRename(deckDir, req, res) {
-    void (async () => {
-        let body;
-        try {
-            body = JSON.parse(await readRequestBody(req));
-        }
-        catch {
-            return sendJson(res, 400, { error: "Invalid JSON body." });
-        }
+    withJsonBody(req, res, (body) => {
         const from = resolveDeckPath(deckDir, body.from, { mutation: true });
         if (!from.ok)
             return sendJson(res, 400, { error: from.error });
@@ -447,37 +440,23 @@ function handleFilesRename(deckDir, req, res) {
             sendJson(res, 200, { ok: true, path: to.rel });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            sendJson(res, 500, { error: `Could not rename ${from.rel}: ${message}` });
+            sendFailure(res, "rename", from.rel, err);
         }
-    })();
+    });
 }
 function handleFilesDelete(deckDir, req, res) {
-    void (async () => {
-        let body;
-        try {
-            body = JSON.parse(await readRequestBody(req));
-        }
-        catch {
-            return sendJson(res, 400, { error: "Invalid JSON body." });
-        }
-        const resolved = resolveDeckPath(deckDir, body.path, { mutation: true });
-        if (!resolved.ok)
-            return sendJson(res, 400, { error: resolved.error });
-        if (!fs.existsSync(resolved.abs)) {
-            return sendJson(res, 404, { error: `Not found: ${resolved.rel}` });
+    withMutationPath(deckDir, req, res, (target) => {
+        if (!fs.existsSync(target.abs)) {
+            return sendJson(res, 404, { error: `Not found: ${target.rel}` });
         }
         try {
-            fs.rmSync(resolved.abs, { recursive: true, force: true });
-            sendJson(res, 200, { ok: true, path: resolved.rel });
+            fs.rmSync(target.abs, { recursive: true, force: true });
+            sendJson(res, 200, { ok: true, path: target.rel });
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            sendJson(res, 500, {
-                error: `Could not delete ${resolved.rel}: ${message}`,
-            });
+            sendFailure(res, "delete", target.rel, err);
         }
-    })();
+    });
 }
 // The builtin Files + code-editor backend: list / read / write deck files and
 // report kit-owned editor extensions. Paths are deck-relative; resolveDeckPath
@@ -611,7 +590,7 @@ function defaultShell() {
     }) ?? "/bin/sh";
     return { command, args: ["-l"] };
 }
-function ptyEnv() {
+function ptyEnv(shimDir) {
     const env = {
         ...envForUserShell(process.env),
         TERM: PTY_TERM,
@@ -623,6 +602,9 @@ function ptyEnv() {
     };
     delete env.NO_COLOR;
     delete env.NODE_DISABLE_COLORS;
+    if (shimDir) {
+        env.PATH = env.PATH ? `${shimDir}${path.delimiter}${env.PATH}` : shimDir;
+    }
     return env;
 }
 function clampSize(value, fallback) {
@@ -669,6 +651,7 @@ export function createIdeServer(opts) {
     let session = null;
     function spawnSession() {
         const { command, args } = defaultShell();
+        const shimDir = installClaudeShim(deckDir);
         const screen = new HeadlessTerminal({
             allowProposedApi: true,
             cols: INITIAL_COLS,
@@ -683,7 +666,7 @@ export function createIdeServer(opts) {
             cols: INITIAL_COLS,
             rows: INITIAL_ROWS,
             cwd: deckDir,
-            env: ptyEnv(),
+            env: ptyEnv(shimDir),
         });
         const s = {
             pty,

package/dist/imports.js

@@ -5,6 +5,7 @@ import * as api from './api.js';
 import { runTar } from './save-deck.js';
 import { normalizeDeckPackageJson } from './normalize.js';
 import { getKitsDir } from './localPaths.js';
+import { readCastleJsonOrThrow as readCastleJson, } from './castleJson.js';
 // Adding another deck as a dependency (`castle-web add-import`; removing one is a
 // later command). Deliberately NOT `get-deck`: that one
 // replaces THIS deck's own source from the server (and carries guards for the
@@ -24,17 +25,6 @@ import { getKitsDir } from './localPaths.js';
 // node_modules gets. That also means `get-deck` leaves an existing `imports/`
 // alone when it refreshes a deck.
 export const IMPORTS_DIR = 'imports';
-function readCastleJson(dir) {
-    const p = path.join(dir, 'castle.json');
-    if (!fs.existsSync(p))
-        return null;
-    try {
-        return JSON.parse(fs.readFileSync(p, 'utf-8'));
-    }
-    catch (e) {
-        throw new Error(`Could not read ${p}: ${e instanceof Error ? e.message : String(e)}`);
-    }
-}
 // Only the `imports` key is ours; everything else in castle.json (deck identity,
 // editor config) is preserved as-is.
 function writeImportPin(dir, alias, pin) {
@@ -88,47 +78,24 @@ function qualifiedAlias(meta, deckId) {
 //
 // The cost is that `imports/<alias>` can't be deleted until it's unlocked, which
 // is why every path in this file that replaces a dependency unlocks it first.
-function chmodTree(dir, fileMode, dirMode) {
-    let entries;
-    try {
-        entries = fs.readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return;
-    }
-    for (const entry of entries) {
-        const child = path.join(dir, entry.name);
-        if (entry.isDirectory())
-            chmodTree(child, fileMode, dirMode);
-        else {
-            try {
-                fs.chmodSync(child, fileMode);
-            }
-            catch {
-                /* a file we can't chmod is not worth failing the import over */
-            }
-        }
-    }
-    // The directory goes last: its contents have to be reachable while we walk it.
+// A file we can't chmod is not worth failing the import over, so every chmod
+// here is best-effort.
+function chmod(target, mode) {
     try {
-        fs.chmodSync(dir, dirMode);
+        fs.chmodSync(target, mode);
+        return true;
     }
     catch {
-        /* as above */
+        return false;
     }
 }
-export function lockImportTree(dir) {
-    chmodTree(dir, 0o444, 0o555);
-}
-// Restore write permission so the tree can be replaced or removed. Directories
-// first, or their contents are unreachable.
-function unlockImportTree(dir) {
-    try {
-        fs.chmodSync(dir, 0o755);
-    }
-    catch {
+// `dirFirst` is the one thing that differs between locking and unlocking, and it
+// has to: locking chmods a directory AFTER its contents (they must stay
+// reachable while we walk it), unlocking chmods it BEFORE (or the walk can't get
+// in at all -- so a failure there aborts this subtree).
+function chmodTree(dir, modes) {
+    if (modes.dirFirst && !chmod(dir, modes.dir))
         return;
-    }
     let entries;
     try {
         entries = fs.readdirSync(dir, { withFileTypes: true });
@@ -139,16 +106,19 @@ function unlockImportTree(dir) {
     for (const entry of entries) {
         const child = path.join(dir, entry.name);
         if (entry.isDirectory())
-            unlockImportTree(child);
-        else {
-            try {
-                fs.chmodSync(child, 0o644);
-            }
-            catch {
-                /* best effort */
-            }
-        }
+            chmodTree(child, modes);
+        else
+            chmod(child, modes.file);
     }
+    if (!modes.dirFirst)
+        chmod(dir, modes.dir);
+}
+export function lockImportTree(dir) {
+    chmodTree(dir, { file: 0o444, dir: 0o555, dirFirst: false });
+}
+// Restore write permission so the tree can be replaced or removed.
+function unlockImportTree(dir) {
+    chmodTree(dir, { file: 0o644, dir: 0o755, dirFirst: true });
 }
 // An import's code runs from the IMPORTING deck's node_modules -- there is one
 // install at the deck root, and a dependency's own node_modules is neither
@@ -209,7 +179,7 @@ export function syncImportDependencies(deckDir) {
 // won't run until they are back. Rebuilding them from the pins is `install`'s
 // job, alongside node_modules.
 export async function restoreMissingImports(deckDir) {
-    const pins = (readCastleJson(deckDir)?.imports ?? {});
+    const pins = readCastleJson(deckDir)?.imports ?? {};
     const restored = [];
     for (const [alias, pin] of Object.entries(pins)) {
         const destDir = path.join(deckDir, IMPORTS_DIR, alias);
@@ -298,7 +268,7 @@ export async function importStatuses(deckDir) {
     const cached = statusCache.get(deckDir);
     if (cached && Date.now() - cached.at < STATUS_TTL_MS)
         return cached.value;
-    const pins = (readCastleJson(deckDir)?.imports ?? {});
+    const pins = readCastleJson(deckDir)?.imports ?? {};
     const value = await Promise.all(Object.entries(pins).map(async ([alias, pin]) => {
         const base = {
             alias,
@@ -386,12 +356,12 @@ async function placeImport(deckDir, alias, deckId, source, via) {
 // silently renamed, since renaming would break the refs of whoever named it.
 async function addTransitiveImports(deckDir, viaAlias, seen) {
     const viaDir = path.join(deckDir, IMPORTS_DIR, viaAlias);
-    const pins = (readCastleJson(viaDir)?.imports ?? {});
+    const pins = readCastleJson(viaDir)?.imports ?? {};
     const added = [];
     for (const [alias, pin] of Object.entries(pins)) {
         if (!pin?.deckId || seen.has(pin.deckId))
             continue;
-        const existing = (readCastleJson(deckDir)?.imports ?? {});
+        const existing = readCastleJson(deckDir)?.imports ?? {};
         const holder = existing[alias];
         if (holder && holder.deckId !== pin.deckId) {
             console.warn(`"${viaAlias}" wants ${pin.deckId} as "${alias}", which is already ${holder.deckId} here -- skipping; ` +
@@ -417,7 +387,7 @@ async function addTransitiveImports(deckDir, viaAlias, seen) {
 // Every deckId this deck already has, so a transitive walk doesn't refetch or
 // loop on a cycle.
 function importedDeckIds(deckDir) {
-    const pins = (readCastleJson(deckDir)?.imports ?? {});
+    const pins = readCastleJson(deckDir)?.imports ?? {};
     return new Set(Object.values(pins).map((p) => p?.deckId).filter((id) => !!id));
 }
 export async function addImport(dir, options = {}) {
@@ -468,7 +438,7 @@ export async function addImport(dir, options = {}) {
 // wasn't.
 export async function updateImport(dir, options = {}) {
     const deckDir = path.resolve(dir);
-    const pins = (readCastleJson(deckDir)?.imports ?? {});
+    const pins = readCastleJson(deckDir)?.imports ?? {};
     const aliases = options.alias ? [options.alias] : Object.keys(pins);
     if (aliases.length === 0) {
         console.log('This deck has no imports.');