ccdeck 3.22.14 → 3.23.0

package/src/server/lan-engine.mjs

@@ -27,8 +27,8 @@
 // something in it, which is when an account is actually broken. A deck whose
 // accounts all work talks to its peers every minute and never asks for
 // anything.
-import { accountKey, manifestFor, open, plan, seal, stillListed, transferChallenge } from "./lan-sync.mjs";
-import { connectToPeer, createBeacon, createSyncServer, sendFrame } from "./lan-socket.mjs";
+import { accountKey, currentFor, manifestFor, open, plan, seal, stillListed, transferChallenge } from "./lan-sync.mjs";
+import { connectToPeer, createBeacon, createSyncServer, MAX_FRAME_BYTES } from "./lan-socket.mjs";
 import { addTrusted, dropTrusted, identityFrom, mintInvite, pairable, readInvite, trustedPeer } from "./lan-sync.mjs";
 import { openAbout, sealAbout } from "./lan-about.mjs";
 import { randomBytes } from "node:crypto";
@@ -57,7 +57,25 @@ export const ASKING_MS = 8_000;
 /** How long one peer round may take before it is abandoned. A manifest is one
  *  round trip on a local network; anything past this is a peer that is not
  *  going to answer, and holding the attempt open would stall the next round. */
-export const ROUND_MS = 10_000;
+const ROUND_MS = 10_000;
+
+/**
+ * The most addresses `autoAsk` may put on the dial list on its own.
+ *
+ * Measured, because the shape of it is not the obvious one: the dial list is
+ * keyed `host:port`, not by fingerprint, so five hundred beacons from one
+ * address on one port make one row. Five hundred beacons from one address on
+ * five hundred PORTS make five hundred rows, and a round dials them one at a
+ * time with a ROUND_MS bell on each — so a list that size is eighty minutes of
+ * round, and the decks somebody actually paired with sit at the end of it
+ * waiting their turn. The ceiling on that without this number is 65,535 rows
+ * from a single host.
+ *
+ * It bounds only what the deck added BY ITSELF. Addresses a person typed are
+ * not capped: a list of those is somebody's own decision and the deck is in no
+ * position to tell them they have too many machines.
+ */
+export const MAX_AUTO_PEERS = 32;
 
 
 /** What this machine calls itself when the user has not said. The hostname,
@@ -103,11 +121,46 @@ export function localAddresses(faces = networkInterfaces()) {
  * where strings belong, a boolean for the verdict, and no more rows than a
  * manifest may carry. What is kept is only what the deck's dialog draws.
  */
+/** One peer-supplied string as the panel may draw it: no control or format
+ *  characters, whitespace collapsed, bounded. The rule cleanName applies to a
+ *  deck's name and lan-about's `field` to a card, applied to the two strings
+ *  that sit next to the fingerprint in the import dialog. */
+function flatten(v, max) {
+  if (typeof v !== "string") return "";
+  const flat = v.replace(/\p{Cc}/gu, " ").replace(/\p{Cf}/gu, "").replace(/\s+/g, " ").trim();
+  return [...flat].slice(0, max).join("");
+}
+
 export function offered(list) {
   return (Array.isArray(list) ? list : [])
     .filter(a => a && typeof a.key === "string" && typeof a.email === "string")
     .slice(0, 50)
-    .map(a => ({ key: a.key.slice(0, 320), email: a.email.slice(0, 254), alive: a.alive === true }));
+    // Character-filtered, not merely cut. These two are drawn beside the
+    // fingerprint at the moment the operator picks which of a peer's logins to
+    // import (LanPeerModal.tsx:497), and a bare slice let a format character
+    // through — the same class cleanName strips from the name one frame over.
+    .map(a => ({
+      key: flatten(a.key, 320),
+      email: flatten(a.email, 254),
+      alive: a.alive === true,
+    }))
+    .filter(a => a.key && a.email);
+}
+
+/**
+ * Which account a peer said it is on, as the panel may keep it: the key of one
+ * of the accounts it listed in the same frame, that its owner is hiding it, or
+ * that it is on one it does not share — and nothing for anything else. A key
+ * that is not in its own list is dropped rather than drawn: a deck only ever
+ * names an account it shares, and one that names another is saying something
+ * this deck will not show.
+ */
+export function heardCurrent(raw, list) {
+  if (!raw || typeof raw !== "object") return null;
+  if (raw.hidden === true) return { hidden: true };
+  if (raw.other === true) return { other: true };
+  if (typeof raw.key !== "string") return null;
+  return list.some(a => a.key === raw.key) ? { key: raw.key } : null;
 }
 
 /**
@@ -136,15 +189,37 @@ export function createEngine({
   /** This deck's own card — its version and its machine — handed to every
    *  paired deck and to nobody else. See lan-about.mjs. */
   about = null,
+  /** Whether this deck seals every frame after the handshake with a deck that
+   *  says it does too — see frameChannel in lan-sync.mjs. Nothing in the deck
+   *  turns it off; the suite does, to play a deck from before #810, which is
+   *  the only way to show that one still heals. */
+  sealFrames = true,
+  /** Whether this deck mixes a key pair made for each connection into that
+   *  connection's key, with a deck that says it does too — see sessionKey in
+   *  lan-sync.mjs. Nothing in the deck turns this off either; the suite does,
+   *  to play a deck of #810's version, which seals and does not mix. It rides
+   *  on `sealFrames`: with that off, this deck says neither. */
+  ephemeral = true,
+  /** Where the listener binds: every interface, which is what a peer dials,
+   *  unless the suite says loopback — a test deck has no business being
+   *  reachable from the office for the seconds it runs. */
+  host,
 } = {}) {
   let cfg = {
     enabled: false, name: defaultName(), secret: "", shared: [], trusted: [], port: 0,
     autoAsk: true, autoAccept: true, aliases: {},
+    // Tell paired decks which shared account this one is on — see currentFor.
+    shareActive: true,
   };
   let identity = null;
   let beacon = null;
   let server = null;
   let timer = null;
+  /** This engine, for the helpers below `apply` that need to press its own
+   *  accept — see askToAccept. Set on the first apply, which is the only thing
+   *  that can start a round or a listener, so nothing reads it before it is
+   *  there. */
+  let engine = null;
   /**
    * Decks that finished a handshake and that nobody here has accepted yet, and
    * decks merely heard shouting on the network. Two lists because they are two
@@ -237,6 +312,8 @@ export function createEngine({
       email: a.email,
       alive: a.alive === true,
       num: a.num,
+      // The one this deck is on — claude-swap's own answer, one at most.
+      active: a.active === true,
     }));
   };
 
@@ -252,7 +329,9 @@ export function createEngine({
   /** Frames from a deck that finished the handshake AND that somebody here has
    *  accepted. Nothing reaches this before both, which is the whole point of
    *  where the two checks sit. `ctx.key` is this connection's key and no other
-   *  connection's — see sessionKey. */
+   *  connection's — see sessionKey. `ctx.send` seals whatever it is handed when
+   *  both ends said they seal, so nothing below has to know which kind of deck
+   *  asked — see frameChannel. */
   const serve = async (msg, ctx) => {
     // Before the verbs, and for every one of them: something that proved it
     // holds a key this deck accepted is talking, now.
@@ -264,9 +343,19 @@ export function createEngine({
         // here ever asks. A seal that does not open is a deck that said nothing.
         const card = openAbout(ctx.key, msg.about, ctx.peerFp, identity.fp);
         if (card) aboutBy.set(ctx.peerFp, { ...card, at: now() });
+        // AND SO DOES ITS LIST, from a deck new enough to send one: what it
+        // offers, and which of those it is on. Kept only when it came — an
+        // older caller asks with its card alone, and a missing list is not an
+        // empty one. This is the only way a deck nothing here dials is ever
+        // known by what it offers.
+        if (Array.isArray(msg.accounts)) {
+          const list = offered(msg.accounts);
+          offersBy.set(ctx.peerFp, { at: now(), accounts: list, current: heardCurrent(msg.current, list) });
+        }
         const accounts = await localAccounts();
         return ctx.send({
           t: "manifest", accounts: manifestFor(accounts, cfg.shared),
+          ...currentFor(accounts, cfg.shared, cfg.shareActive),
           ...cardFor(ctx.key, ctx.peerFp),
         });
       }
@@ -299,6 +388,34 @@ export function createEngine({
     }
   };
 
+  /**
+   * A real deck nobody here has accepted: draw it as a row with an accept on it.
+   *
+   * ONE HELPER FOR BOTH DIRECTIONS, because the evidence is the same either
+   * way. A deck that DIALLED this one finishes a handshake at the listener and
+   * arrives through `onPending`; a deck this one dialled finishes the same
+   * handshake in roundWith. Both have proved they hold the key they announced,
+   * and neither has been agreed to. Before #969 only the first raised a
+   * request and the second silently pinned itself.
+   *
+   * SAY YES FOR SOMEBODY WHO SAID TO. `autoAccept` is the accept button and
+   * nothing else: the same pin, from the same key the handshake just proved.
+   * Nothing about the wire changes — an inbound connection is still refused,
+   * because trust is read fresh per connection, and the caller comes back a few
+   * seconds later.
+   *
+   * A deck already told no does not become a row again. On the inbound path
+   * lan-socket refuses it before this is ever called; on the outbound one there
+   * is nothing before this, so the check lives here.
+   */
+  const askToAccept = entry => {
+    if (declined.has(entry.fp)) return;
+    const had = pending.get(entry.fp);
+    pending.set(entry.fp, { ...entry, at: had?.at ?? now(), lastAt: now() });
+    if (cfg.autoAccept) { engine?.accept(entry.fp); return; }
+    if (!had) onChange?.();
+  };
+
   /**
    * Is anybody on the other end still deciding?
    *
@@ -322,33 +439,58 @@ export function createEngine({
         // The key pinned when this deck was accepted, so a second machine
         // answering at that address is refused rather than talked to.
         expectPub: trustedPeer(cfg.trusted, peer.fp)?.pub ?? null,
+        sealFrames, ephemeral,
       });
+      // A SECOND READER ON THE SAME SOCKET, AND IT HAS TO KEEP THE SAME CAP.
+      //
+      // lan-socket.mjs's header states the rule: "a peer that sends a megabyte
+      // with no newline in it is not sending a large frame, it is sending
+      // nothing at all, expensively... the buffer is ABANDONED rather than
+      // grown past it." frameReader enforces it; this reader did not.
+      //
+      // The frameReader connectToPeer installed IS still attached and does hit
+      // MAX_FRAME_BYTES — but it only sets its own flag and calls `fail`, which
+      // short-circuits on `settled`, so nothing destroys the socket. This
+      // buffer then grew unbounded for the full ROUND_MS at line rate. The
+      // reject path also never removed the listener; only roundWith's
+      // `finally { conn?.sock?.destroy(); }` stopped it.
       const ask = frame => new Promise((resolve, reject) => {
         const bell = setTimeout(() => reject(new Error("peer went quiet")), ROUND_MS);
         bell.unref?.();
         let buf = "";
+        const give = (fn, arg) => {
+          clearTimeout(bell);
+          conn.sock.off("data", onData);
+          fn(arg);
+        };
         const onData = chunk => {
           buf += chunk;
+          if (buf.length > MAX_FRAME_BYTES) {
+            conn.sock.destroy();
+            return give(reject, new Error("frame too large"));
+          }
           const i = buf.indexOf("\n");
           if (i === -1) return;
-          clearTimeout(bell);
-          conn.sock.off("data", onData);
-          try { resolve(JSON.parse(buf.slice(0, i))); } catch { reject(new Error("bad reply")); }
+          let parsed;
+          try { parsed = JSON.parse(buf.slice(0, i)); } catch { return give(reject, new Error("bad reply")); }
+          // THROUGH THE CONNECTION'S OWN READER, and on a sealed connection
+          // that is the only way in. A reply that does not open is not a reply
+          // with something wrong in it; it is a connection that stopped being
+          // the one the handshake proved — altered, replayed, or plain where
+          // both ends agreed to seal — so the round ends here instead of
+          // reading it as it stands. See frameChannel.
+          const got = conn.read(parsed);
+          if (conn.sealed && !got) {
+            conn.sock.destroy();
+            return give(reject, new Error("a reply from that deck did not open"));
+          }
+          give(resolve, got);
         };
         conn.sock.on("data", onData);
-        sendFrame(conn.sock, frame);
+        // And out through its own writer, which seals whenever the reader opens.
+        conn.send(frame);
       });
 
-      // TRUST ON FIRST USE, AND ONLY FOR AN ADDRESS SOMEBODY TYPED. Reaching a
-      // deck we have no pin for means the person at this keyboard put its
-      // address in the field, which is the same decision the accept button is
-      // on the other side. Pinning it here is what makes the two lists agree —
-      // without it this deck would dial a peer every minute and still show it
-      // as nobody, and its own listener would refuse the same deck calling
-      // back.
-      //
-      // A deck we DO have a pin for was checked before this line: connectToPeer
-      // was given expectPub and refuses a different key at that address.
       // WHO IS ACTUALLY THERE. A typed address is a row that says `192.168.1.5:54340`
       // and nothing else until somebody answers it — and once one has, the deck
       // on the other end has told us what it calls itself. The row says that
@@ -356,7 +498,46 @@ export function createEngine({
       // address was trying to reach.
       learned.set(`${peer.addr}:${peer.port}`, { fp: conn.peerFp, name: conn.peerName || "" });
 
+      // TRUST ON FIRST USE, AND ONLY FOR AN ADDRESS SOMEBODY NAMED. Reaching a
+      // deck we have no pin for used to mean the person at this keyboard put
+      // its address in the field, which is the same decision the accept button
+      // is on the other side. Pinning it here is what makes the two lists agree
+      // — without it this deck would dial a peer every minute and still show it
+      // as nobody, and its own listener would refuse the same deck calling back.
+      //
+      // THE PREMISE WAS NOT CHECKED, AND `autoAsk` BREAKS IT — which is #969,
+      // and it is a chain rather than one mistake. A beacon authenticates
+      // nothing, by construction: it carries a fingerprint and a port and
+      // nothing binds either to the address it came from. `autoAsk` ships on,
+      // and it answered every new fingerprint by putting that address on the
+      // dial list. The next round reached it, arrived here with no pin, and
+      // read "no pin" as "somebody typed this". Nobody typed anything. One
+      // unsolicited packet, zero presses, and the far end was in `cfg.trusted`
+      // — which index.mjs writes to prefs.json, and which is the whole inbound
+      // gate — so from then on it could authenticate to `serve` and ask for
+      // every account the owner had ticked. Reproduced end to end before this
+      // line changed.
+      //
+      // So the row has to say where it came from, and only a row a person
+      // named may be pinned unseen. A row the deck added itself raises the
+      // request instead — which is all `autoAsk` ever promised: it is the ASK
+      // switch, and the accept switch is the other one.
+      //
+      // A deck we DO have a pin for was checked before this line: connectToPeer
+      // was given expectPub and refuses a different key at that address.
       if (!trustedPeer(cfg.trusted, conn.peerFp)) {
+        if (!peer.typed) {
+          // The same row the listener's own `onPending` draws, from the other
+          // direction: this deck dialled rather than being dialled, and the
+          // handshake it just finished is the same evidence either way — a real
+          // deck holding the key it announced. What is missing is the press,
+          // and that is what this asks for.
+          askToAccept({
+            fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName,
+            addr: peer.addr, port: peer.port,
+          });
+          throw new Error("waiting for somebody here to accept that deck");
+        }
         const { list, added } = addTrusted(cfg.trusted, {
           fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName, at: now(),
         });
@@ -365,12 +546,21 @@ export function createEngine({
 
       // Our card goes with the question and theirs comes back with the answer
       // — see lan-about.mjs for why it is here and nowhere earlier.
-      const theirs = await ask({ t: "manifest", ...cardFor(conn.key, conn.peerFp) });
+      // THE QUESTION CARRIES THIS DECK'S LIST TOO, and which of it this deck is
+      // on — so the deck being asked knows both without dialling back, which a
+      // deck with no address for this one never could. An older deck reads the
+      // question's `t` and card and nothing else, so it answers as it always did.
+      const mine = await localAccounts();
+      const theirs = await ask({
+        t: "manifest", accounts: manifestFor(mine, cfg.shared),
+        ...currentFor(mine, cfg.shared, cfg.shareActive),
+        ...cardFor(conn.key, conn.peerFp),
+      });
       if (theirs?.t !== "manifest" || !Array.isArray(theirs.accounts)) throw new Error("no manifest");
       const card = openAbout(conn.key, theirs.about, conn.peerFp, identity.fp);
       if (card) aboutBy.set(conn.peerFp, { ...card, at: now() });
-      offersBy.set(conn.peerFp, { at: now(), accounts: offered(theirs.accounts) });
-      const mine = await localAccounts();
+      const list = offered(theirs.accounts);
+      offersBy.set(conn.peerFp, { at: now(), accounts: list, current: heardCurrent(theirs.current, list) });
       // Only accounts I have also ticked. Sharing is mutual by construction:
       // a peer cannot push an account at me that I never agreed to hold.
       // A HEAL NEEDS MY TICK; AN ADD DOES NOT, and the asymmetry is deliberate.
@@ -380,7 +570,16 @@ export function createEngine({
       // them, which is the whole of "I do not want to paste blobs any more".
       // What can reach this is what a deck somebody here pressed accept on
       // chose to offer.
-      const wanted = plan(mine, theirs.accounts)
+      // OVER `list`, NOT THE RAW ARRAY. `offered` above slices to 50 and type-
+      // filters `key` and `email`; this line read `theirs.accounts` and got
+      // neither. syncAction answers "add" for anything this deck lacks and an
+      // add needs no tick, so a peer answering `manifest` with thousands of
+      // rows produced thousands of steps — each a sequential `want`/`have`
+      // round trip with its own 10s bell plus a claude-swap subprocess holding
+      // the store lock, while the panel drew 50 and every other paired deck
+      // waited behind it. `step.key` also reached transferChallenge and
+      // importAccount untyped, which `offered`'s filter would have caught.
+      const wanted = plan(mine, list)
         .filter(step => step.action === "add" || cfg.shared.includes(step.key));
       const done = [];
       for (const step of wanted) {
@@ -427,14 +626,21 @@ export function createEngine({
    *
    *  Keyed by `host:port` rather than by fingerprint, because a fingerprint is
    *  what a deck says about itself after the handshake and this list has to
-   *  exist before there has been one. */
+   *  exist before there has been one.
+   *
+   *  EVERY ROW SAYS WHERE IT CAME FROM, in `typed`, and the difference decides
+   *  whether reaching it may pin a key sight unseen. A row somebody put in the
+   *  address field — or pressed accept on, or joined by invite — is a person
+   *  naming a machine. A row `autoAsk` added from a beacon is this deck
+   *  answering a shout, which is not the same claim and must not read as one.
+   *  See roundWith, where the difference is the whole of the trust rule. */
   const manual = new Map();
   /** What answered at a typed address, once something has. Keyed the same way
    *  `manual` is, because until a connection succeeds an address is all there
    *  is to key on. */
   const learned = new Map();
 
-  const round = async () => {
+  const oneRound = async () => {
     if (!beacon) return [];
     const all = [];
     // Heard first, typed second, and a typed one is skipped when the beacon
@@ -446,20 +652,75 @@ export function createEngine({
     const seen = new Set(heard.map(p => `${p.addr}:${p.port}`));
     for (const peer of [...heard, ...[...manual.values()].filter(p => !seen.has(`${p.addr}:${p.port}`))]) {
       // Sequential rather than parallel. The store takes one mutation at a
-      // time anyway (cswap-admin's lock), and two peers healing the same
-      // account at once would race for a slot number claude-swap assigns as
-      // max+1 without a lock of its own.
+      // time anyway (the mutex in store-lock.mjs), and two peers healing the
+      // same account at once would race for a slot number claude-swap assigns
+      // as max+1 without a lock of its own.
       all.push(...await roundWith(peer));
     }
     roundAt = now();
     return all;
   };
 
+  /**
+   * Where every round waits its turn — the whole list, or one deck from its own
+   * dialog — so that whichever is running is running alone. `round` and
+   * `roundOne` are the only two ways in, and both come through here.
+   *
+   * A LINE RATHER THAN A FLAG, because the two ways in want different things
+   * from what is already running and both have to end up behind it. A round
+   * asked for during a check cannot join it — a check asks one deck, and a
+   * round was asked to ask all of them — so it waits. A check asked for during
+   * a round can often join it, and sometimes cannot. Both need somewhere to
+   * stand that is after whatever is in flight, and this is it.
+   *
+   * The tail never rejects: `roundWith` reports a failure per peer instead of
+   * throwing, and anything else is swallowed here rather than left to stop
+   * every turn after it. The caller of the turn that threw still hears it.
+   */
+  let _turn = Promise.resolve();
+  const inTurn = job => {
+    const run = _turn.then(job);
+    _turn = run.then(() => {}, () => {});
+    return run;
+  };
+
+  /** The whole round in flight or waiting its turn, or null. See `round` below. */
+  let _round = null;
+
+  /**
+   * One round at a time, and the one already running is the answer (#1040).
+   *
+   * The sequential loop above reasons about peers being dialled one after
+   * another, which is a statement about the WHOLE round and was only ever true
+   * of a round running alone. Two ways in, and they meet: a self-scheduling
+   * timer (SYNC_MS, or ASKING_MS while somebody is waiting) and the "Sync now"
+   * press, which calls this straight from the route. A press landing on the
+   * timer's round gave two rounds walking the same peer list, each reading the
+   * same slot as empty and each force-importing a credential over the other —
+   * and the second one's blob wins for no reason anybody chose.
+   *
+   * JOINING rather than skipping, because the press has a reply to send: a
+   * caller that got `[]` for "a round is already running" would report "nothing
+   * to sync" about a round that was at that moment moving a credential. This is
+   * the shape `codexScanOnce` and ccusage's `_inflight` already use.
+   *
+   * THERE WAS A THIRD WAY IN, and it did not come through here (#1132). The
+   * `check now` in a deck's own dialog reaches `roundOne`, which called
+   * `roundWith` straight — so a press landing on the timer's round dialled the
+   * deck that round was already healing from, and the far side exported the
+   * same login twice for one account that needed repairing once. Both now take
+   * their turn in one line, above. A round joins only another whole round,
+   * never a check: joining a check would answer "ask every deck" with one
+   * deck's work and leave the rest waiting another minute.
+   */
+  const round = () => (_round ??= inTurn(oneRound).finally(() => { _round = null; }));
+
   return {
     async apply(next) {
       /** The engine itself, for the callbacks handed to the socket below: they
        *  outlive this call and `this` is not theirs to keep. */
       const self = this;
+      engine = this;
       const was = cfg;
       cfg = { ...cfg, ...next };
       // TURNING IT ON ANSWERS WHAT IS ALREADY WAITING. A person who switches
@@ -472,7 +733,7 @@ export function createEngine({
       // The same for the other direction: switching `ask` on with four machines
       // already listed asks those four.
       if (!was.autoAsk && cfg.autoAsk) {
-        for (const [fp, p] of [...strangers]) if (!declined.has(fp) && !p.pub) this.accept(fp);
+        for (const [fp, p] of [...strangers]) if (!declined.has(fp) && !p.pub) this.accept(fp, { byHand: false });
       }
       const restart = !was.enabled !== !cfg.enabled
         || was.secret !== cfg.secret
@@ -493,7 +754,7 @@ export function createEngine({
       // back — so the pin drifts to a free port rather than failing.
       server = createSyncServer({
         fp: identity.fp, pub: identity.pub, secret: identity.secret,
-        name: cfg.name, handlers: serve, onError, prefer: cfg.port,
+        name: cfg.name, handlers: serve, onError, prefer: cfg.port, host, sealFrames, ephemeral,
         trusted: () => cfg.trusted,
         invite: () => (invite && invite.expiresAt > now() ? invite : null),
         // Somebody used the token. They are pinned, and the token is retired —
@@ -524,21 +785,10 @@ export function createEngine({
         // told no again rather than becoming a row somebody has to answer
         // twice. The socket sends the reason; this only knows the name.
         declined: fp => declined.has(fp),
-        onPending: entry => {
-          const had = pending.get(entry.fp);
-          pending.set(entry.fp, { ...entry, at: had?.at ?? now(), lastAt: now() });
-          // SAY YES FOR SOMEBODY WHO SAID TO. It is the accept button and
-          // nothing else: the same pin, from the same key this handshake just
-          // proved, so the deck is trusted on its next attempt a few seconds
-          // later exactly as it would be if a person had pressed it. Nothing
-          // about the wire changes — this connection is still refused, because
-          // trust is read fresh per connection.
-          //
-          // A deck already told no does NOT come back this way: lan-socket
-          // refuses it before this is ever called.
-          if (cfg.autoAccept) { self.accept(entry.fp); return; }
-          if (!had) onChange?.();
-        },
+        // The same helper the outbound round uses, because a deck that called
+        // in and a deck this one called have proved exactly the same thing —
+        // see askToAccept.
+        onPending: askToAccept,
       });
       let port;
       try {
@@ -572,7 +822,9 @@ export function createEngine({
           // Only a deck that is NEW is asked, or a beacon every thirty seconds
           // would be thirty seconds of asking; and never one this deck's owner
           // already turned away.
-          if (cfg.autoAsk && !had && !declined.has(entry.fp)) { self.accept(entry.fp); return; }
+          // Never `byHand`: a beacon is a shout from an address nobody here
+          // named, and the row it leaves may ask rather than pin.
+          if (cfg.autoAsk && !had && !declined.has(entry.fp)) { self.accept(entry.fp, { byHand: false }); return; }
           // Only a deck that is new to us is news. A beacon every thirty
           // seconds from one already on the list is not a reason to redraw.
           if (!had) onChange?.();
@@ -660,6 +912,15 @@ export function createEngine({
             host: at.addr, port: at.port, timeoutMs: ROUND_MS,
             fp: identity.fp, pub: identity.pub, secret: identity.secret,
             name: cfg.name, myPort: server.port(), code: inv.code,
+            // MAKE IT PROVE IT HOLDS THE CODE. Without this the loop pinned
+            // whatever answered first, and the addresses in a token are only as
+            // trustworthy as the network they name: `localAddresses` keeps
+            // RFC1918, so a container bridge address or a lease that has since
+            // moved to somebody else's machine is an ordinary thing to find in
+            // one. Stopping at the first that ANSWERS is right; stopping at the
+            // first that answers CORRECTLY is what it was supposed to mean.
+            inviteProvesBack: inv.provesBack,
+            sealFrames, ephemeral,
           });
           const { list } = addTrusted(cfg.trusted, {
             fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName || inv.name, at: now(),
@@ -693,7 +954,7 @@ export function createEngine({
      * thing. A fingerprint nobody has actually met is refused rather than
      * trusted on a name somebody typed.
      */
-    accept(fp) {
+    accept(fp, { byHand = true } = {}) {
       const asked = pending.get(fp) ?? null;
       const heard = strangers.get(fp) ?? null;
       const seen = asked ?? heard;
@@ -712,7 +973,12 @@ export function createEngine({
       // is the same two presses, in the other order.
       if (!seen.pub) {
         if (!seen.addr || !seen.port) return null;
-        this.addPeer(seen.addr, seen.port);
+        // `byHand` IS WHAT THE ROW WILL BE ALLOWED TO DO LATER. A press here is
+        // a person naming a machine, so the row may be pinned on the round that
+        // reaches it. `autoAsk` reaches this same line with byHand false — the
+        // deck answering a shout — and the row it leaves may only ASK, which is
+        // what the switch's own name says it does. See roundWith.
+        this.addPeer(seen.addr, seen.port, { typed: byHand });
         strangers.delete(fp);
         onChange?.();
         return { fp, name: seen.name, addr: seen.addr, port: seen.port, dialled: true };
@@ -784,22 +1050,83 @@ export function createEngine({
      *
      * `roundAt` is left alone: it says when EVERY paired deck was last asked,
      * and asking one of them does not make that true.
+     *
+     * IN TURN, LIKE EVERY ROUND (#1132). This called `roundWith` straight, past
+     * the guard `round` keeps, and a press during the timer's round dialled the
+     * deck that round was mid-way through healing from: the far side exported
+     * `[5, 5]` and this side imported twice. fillEmptySlot's verdict inside the
+     * lock limited what the second write could do on the forced path; it did
+     * not stop the dial, the export, or a second write behind one verdict.
+     *
+     * WHAT IS ALREADY RUNNING IS THE ANSWER, WHEN IT HAS ONE. The press waits
+     * for everything ahead of it, and if an ask of this deck finished in that
+     * time — the round was dialling it when the press landed, or reached it
+     * after — that ask was the check, and its result is returned instead of
+     * asking again. A second ask would be a second dial for nothing, and it
+     * would also be WORSE for the person who pressed. The dialog does not read
+     * this list: it redraws from `lastRound`, where a login that moved says
+     * "arrived last round". An ask after a heal finds that login healthy —
+     * importAccount drops the accounts cache, so the next read is claude-swap's
+     * — moves nothing, and writes that over the record. The lane repaired from
+     * this very deck a moment ago would stop saying so, in answer to the press
+     * that asked about it.
+     *
+     * AND ONLY THEN. When nothing that ran asked this deck after the press — the
+     * round had been past it already, or never had it on its list, as with a
+     * deck first heard mid-round — joining would be a check that checked
+     * nothing. So it asks this deck itself, in its turn, behind whatever was
+     * ahead of it and never beside it. Told apart by the record, not the clock:
+     * every ask writes a new one, so the same object before and after means
+     * nothing here asked this deck since the press. Keyed by the ROW, because
+     * that is what roundWith writes under, and a typed row's `fp` is the
+     * placeholder built from its address rather than the fingerprint asked for.
      */
     async roundOne(fp) {
       if (!beacon || typeof fp !== "string" || !fp) return null;
       const heard = [...beacon.peers.values()].find(p => p.fp === fp && stillListed(p, now()));
       const typed = [...manual.values()].find(p => learned.get(`${p.addr}:${p.port}`)?.fp === fp);
       const peer = heard ?? typed;
-      return peer ? roundWith(peer) : null;
+      if (!peer) return null;
+      const had = lastRound.get(peer.fp);
+      await _turn;
+      const got = lastRound.get(peer.fp);
+      if (got && got !== had) return got.done ?? [];
+      // A deck switched off while the press waited is not dialled after all.
+      return inTurn(() => (beacon ? roundWith(peer) : []));
     },
     /** Dial this address on every round from now on. Returns false for an
      *  address that is not one, rather than storing a row that can never
      *  connect and reports an error every minute forever. */
-    addPeer(addr, port) {
+    addPeer(addr, port, { typed = true } = {}) {
       const p = Number(port);
       if (typeof addr !== "string" || !addr.trim() || !Number.isInteger(p) || p < 1 || p > 65_535) return false;
       const host = addr.trim();
-      manual.set(`${host}:${p}`, { fp: `manual:${host}:${p}`, name: host, addr: host, port: p, manual: true });
+      const at = `${host}:${p}`;
+      // MAKING ROOM RATHER THAN REFUSING, and only among rows the deck added
+      // itself. A hard refusal at the cap would let whoever got there first
+      // keep the whole budget, so a real deck starting later would never be
+      // asked — which turns a cap meant to protect the round into a way to
+      // silence it. Evicted first is the oldest auto row that has never
+      // answered: `learned` holds an entry only for an address that completed a
+      // handshake, so a row with no entry there has cost a round and returned
+      // nothing. When every auto row has answered, the new one waits.
+      if (!typed && !manual.has(at)) {
+        const auto = [...manual.entries()].filter(([, v]) => !v.typed);
+        if (auto.length >= MAX_AUTO_PEERS) {
+          const stale = auto.find(([k]) => !learned.has(k));
+          if (!stale) return false;
+          manual.delete(stale[0]);
+          learned.delete(stale[0]);
+        }
+      }
+      // A row somebody typed outranks one the deck added: the same address
+      // arriving by hand after a beacon put it there is a person vouching for
+      // it, and nothing about that should be undone by the next beacon.
+      const was = manual.get(at);
+      manual.set(at, {
+        fp: `manual:${at}`, name: host, addr: host, port: p, manual: true,
+        typed: typed || was?.typed === true,
+      });
       return true;
     },
     removePeer(addr, port) { return manual.delete(`${String(addr).trim()}:${Number(port)}`); },
@@ -835,6 +1162,8 @@ export function createEngine({
         // arrives is answered here or answered for you.
         autoAsk: !!cfg.autoAsk,
         autoAccept: !!cfg.autoAccept,
+        // Whether paired decks are told which shared account this one is on.
+        shareActive: cfg.shareActive !== false,
         fp: identity?.fp ?? null,
         // The address and port a person on another subnet types into the other
         // deck's field. Null when this machine has no ordinary one, which the
@@ -932,6 +1261,11 @@ export function createEngine({
               // and this is when. Undefined until it has, which is a row the
               // panel draws as unknown rather than as live.
               lastSeen: spokeAt.get(t.fp),
+              // AND WHAT IT SAID WHEN IT CALLED — its card, its list, and which
+              // of those it is on. The card was kept and never handed over, so
+              // the dialog said "it runs an older version" about a deck that
+              // had just told it exactly which version it runs.
+              ...card(t.fp),
             });
           }
           return rows;