ccdeck 3.22.15 → 3.23.1

package/README.md

@@ -7,7 +7,7 @@
 **ccdeck keeps them in one queue** — every session stopped on a human, longest wait first, and the count in the topbar is one click to the oldest. That queue is Claude Code's, because the deck reads Codex from its rollout log and a rollout carries no such signal; the canvas under it is both, with every Claude Code subagent on a node of its own.
 
 [![npm](https://img.shields.io/npm/v/ccdeck?color=cb3837&logo=npm&logoColor=white)](https://www.npmjs.com/package/ccdeck)
-[![agents-deck downloads](https://img.shields.io/npm/dm/agents-deck?color=blue&label=agents-deck%20downloads)](https://www.npmjs.com/package/agents-deck)
+[![npm downloads](https://img.shields.io/npm/dm/ccdeck?color=blue)](https://www.npmjs.com/package/ccdeck)
 [![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](LICENSE)
 [![Node.js >=18](https://img.shields.io/badge/node-%3E%3D18-brightgreen?logo=node.js&logoColor=white)](https://nodejs.org)
 [![macOS · Linux · Windows](https://img.shields.io/badge/macOS%20·%20Linux%20·%20Windows-supported-6aa9f7)](#requirements)
@@ -87,7 +87,7 @@ The deck opens on these eight pictures the first time it runs — they are the w
 | **Both providers, one canvas** | Claude Code through hooks, Codex through its rollout log. The model chip (`Opus 5`, `GPT-5.5`) tells them apart. |
 | **Cost and quota, live** | Spend per model and per session, plus Claude and Codex quota windows as they refill. |
 | **Click to inspect** | Any node opens its prompt, tool calls, token usage and timing. |
-| **Survives restarts** | Events are appended to `~/.claude/agent-dag/events.jsonl` and replayed on open. |
+| **Survives restarts** | Events are appended to this platform's log directory (see `--history` below) and replayed on open. |
 | **Accounts without a terminal** | Sign a new Claude account in, move one or your whole set to another machine, rename, reorder, remove — from the panel. |
 | **Logins that repair each other** | A Claude login that expires on one of your machines is copied back from another machine on the same network that still has it — see [Local network](#local-network). |
 | **Knows when it is stale** | Node caches modules at startup, so an upgraded-while-running deck keeps executing old code. This one says so, and can restart itself when nothing is running. |
@@ -188,6 +188,8 @@ Only visits **after this deck started** are ever considered. Your existing histo
 
 The Accounts panel reads the store [claude-swap](https://pypi.org/project/claude-swap/) keeps, and can drive it.
 
+The deck installs that package itself, so it installs it **bounded**: `claude-swap~=0.26`, which is `>= 0.26, == 0.*`, and when PyPI can be reached the exact version it resolved rather than the range. What `cswap --version` reports afterwards has to be that version, or the deck says so and leaves the panel dark rather than driving a copy it cannot account for — this is the tool that holds your Claude logins. The daily upgrade is bounded by the same specifier, and what it left behind is written to `~/.agents-deck/cswap-upgrade.json`.
+
 **`+` → Sign in** runs `claude auth login`, shows you the link, takes the code your browser gives back, and hands the result to `cswap add`. The account you were using **stays active** — signing in replaces the live credentials, so the previous one is switched back the moment the new one is recorded. The code goes straight into the CLI's stdin on this machine; it is never stored, logged, or sent anywhere else.
 
 **`share`** on an account produces a `ccdeck2:…` blob to paste into another deck's **`+` → Paste a share**.
@@ -249,19 +251,26 @@ ccdeck [options]
                            have shown it
       --workspace <path>   Only capture sessions whose cwd is inside <path>
       --scope              Restrict to the current working directory
-      --all                Capture every session on this machine  (default)
-                           (beside --stop: every deck, not every session)
+      --all                Capture every session on this machine  (default;
+                           accepted and ignored — it is what a bare run does)
       --history <path>     Override the events log file
                            (default: this platform's log directory —
                            ~/Library/Logs/ccdeck on macOS, %LOCALAPPDATA%\ccdeck\Log
                            on Windows, $XDG_STATE_HOME/ccdeck on Linux)
       --no-persist         RAM-only mode — don't write or replay the log
+      --install            Put the deck on your PATH and start it at login —
+                           what an `npx` run needs to survive a reboot
+      --install-service    Start the deck when you log in. Set up on first run;
+                           this is only for putting it back
+      --uninstall-service  Stop starting at login (`--uninstall` does this too)
       --codex              Force Codex capture even if ~/.codex/ is missing
       --no-codex           Skip Codex capture (Claude only)
       --claude             Force Claude capture even if Claude Code wasn't found
       --no-claude          Skip Claude entirely — no hooks, no claude-swap,
                            no Accounts panel (Codex only)
-      --uninstall          Remove ccdeck's hooks from settings files
+      --uninstall          Remove ccdeck's hooks from settings files, and name
+                           the files that still hold this deck's private key
+      --purge              With --uninstall: delete those files too
   -h, --help               Show this help
   -v, --version            Print the version and exit
 ```
@@ -354,6 +363,7 @@ Environment:
 | `AGENTS_DECK_CLAUDE` | Full path to the `claude` CLI |
 | `AGENTS_DECK_CCUSAGE` | Full path to your own `ccusage`, used ahead of everything else |
 | `CLAUDE_SWAP_BACKUP` | Override the claude-swap store root the Accounts panel reads |
+| `CCDECK_HOME` | Put everything the deck writes — its state and its log — under this directory instead of the platform default. Wins over every rule below it |
 | `CLAUDE_CONFIG_DIR` | Override `~/.claude` — the hook entry, the event log and everything else the deck writes move with it |
 | `AGENTS_DECK_LHM_PORT` | Port of a running LibreHardwareMonitor web server, when it is not 8085 (Windows temperatures) |
 
@@ -371,11 +381,44 @@ Removes every hook entry ccdeck injected from `~/.claude/settings.json`, and `~/
 
 It removes the hook entries and nothing else. The forwarder script
 (`~/.claude/agent-dag/hook.js`), the discovery directory around it, the events
-log, and the tools ccdeck installed for you — claude-swap, ccusage, and a `uv`
-binary if it had to fetch one — are all left in place, and each has its own
-uninstaller. Deleting `~/.claude/agent-dag/` and `~/.agents-deck/` clears
-ccdeck's own files; `uv tool uninstall claude-swap` (or `pipx uninstall
-claude-swap`) removes the account switcher.
+log, the deck's own state, and the tools ccdeck installed for you — claude-swap,
+ccusage, and a `uv` binary if it had to fetch one — are all left in place, and
+each has its own uninstaller.
+
+Three directories hold ccdeck's own files, and the second one matters most:
+`~/.claude/agent-dag/` (the forwarder and the discovery directory), the
+platform's **data** directory, and the platform's **log** directory.
+
+| | macOS | Windows | Linux |
+|---|---|---|---|
+| data — `prefs.json` | `~/Library/Application Support/ccdeck` | `%LOCALAPPDATA%\ccdeck\Data` | `$XDG_DATA_HOME/ccdeck` |
+| log — `events.jsonl` | `~/Library/Logs/ccdeck` | `%LOCALAPPDATA%\ccdeck\Log` | `$XDG_STATE_HOME/ccdeck` |
+
+`prefs.json` is the one to delete deliberately: it holds this deck's **Local
+network private key**, the one every deck you paired with has pinned. Leaving it
+behind leaves that identity on the machine. (`~/.agents-deck/` holds the managed
+tools rather than the deck's own state, and goes when you remove them.)
+
+`uv tool uninstall claude-swap` (or `pipx uninstall claude-swap`) removes the
+account switcher.
+
+### Deleting the key
+
+You do not have to work the table above out for yourself, and on an upgraded
+machine it is not the whole answer: `prefs.json` moved to the data directory by
+being **copied**, so a second copy is still in `~/.claude/agent-dag/` and
+deleting one of the two is not deleting the key.
+
+`--uninstall` prints every path that still holds one, resolved for your machine.
+Adding `--purge` deletes them:
+
+```bash
+npx ccdeck --uninstall --purge
+```
+
+That takes your ccdeck settings — pairings, aliases, which accounts this deck
+offered — with the key, which is the point: after an uninstall there is nothing
+left for them to configure.
 
 ## Updating
 

package/THIRD_PARTY_NOTICES.md

@@ -18,12 +18,22 @@ merely courteous.
 
 Two things are deliberately **not** listed:
 
-- **Build and test tooling** (`vite`, `vitest`, `typescript`, `@vitejs/plugin-react`)
-  and **type-only packages** (`@types/*`). These are devDependencies that never
-  reach the published bundle — `@types/*` erase at compile time.
+- **Test and type tooling** (`vitest`, `typescript`, `@vitejs/plugin-react`) and
+  **type-only packages** (`@types/*`). These are devDependencies that never reach
+  the published bundle — `@types/*` erase at compile time.
 - **The server, launcher and hook** (`src/server`, `bin`, `hook`). They import
   nothing but Node built-ins, so they carry no third-party code at all.
 
+`vite` used to be named in that first bullet and is not any more, because it is
+the exception the bullet cannot hold: it is a build tool that also **writes code
+of its own into the output**. `dist/web/assets/index-*.js` OPENS with Vite's
+`modulePreloadPolyfill` — the `link[rel="modulepreload"]` feature test and the
+`MutationObserver` that watches for late ones — and its bundled CommonJS interop
+helpers follow it. None of that comes from `src/web`; all of it is in the npm
+tarball, because `dist/web` is in `package.json` `files`. So `vite` is in the
+table below like any other bundled package (#962). The entry does not stop it
+being a devDependency; it records that some of its code ships.
+
 `package-lock.json` records the licences of the full dependency graph as npm
 resolved it. Apart from the root `packages[""]` entry — which describes ccdeck
 itself and now reads `AGPL-3.0-only` to match `package.json` — every licence
@@ -31,16 +41,27 @@ field in it belongs to a dependency and is left exactly as npm wrote it.
 
 ### Software ccdeck fetches but does not distribute
 
-Three third-party tools are downloaded onto the user's own machine at runtime,
-on demand, and are **not** in the npm tarball: `macmon`
-(github.com/vladkens/macmon), `uv` (github.com/astral-sh/uv) and `ccusage`
-(installed from npm). ccdeck runs them as separate processes and reads their
-output; it does not link them, bundle them or redistribute them, so their
-licences are not reproduced here — each arrives with its own licence beside
-it. They are named for completeness, so that "what ccdeck ships" and "what
-ccdeck can run" are not confused.
+Four third-party tools are downloaded onto the user's own machine at runtime, on
+demand, and are **not** in the npm tarball:
+
+- `macmon` — github.com/vladkens/macmon, fetched as a release binary.
+- `uv` — github.com/astral-sh/uv, fetched by `src/server/uv-bootstrap.mjs` when
+  the machine has no way to install a Python application.
+- `ccusage` — installed from npm, into a private prefix under `~/.agents-deck`.
+- `claude-swap` — installed from PyPI by `src/server/cswap-install.mjs`, with
+  `uv tool install` or a `pipx` fallback, and upgraded against
+  `https://pypi.org/pypi/claude-swap/json`. Unlike the three above it lands in
+  the user's **global** tool path and it handles Claude credentials, which is
+  why the deck prints what the install did rather than doing it quietly.
 
-## Bundled packages (27)
+This list said "three" and named the first three until #962. ccdeck runs all of
+them as separate processes and reads their output; it does not link them, bundle
+them or redistribute them, so their licences are not reproduced here — each
+arrives with its own licence beside it. They are named for completeness, so that
+"what ccdeck ships" and "what ccdeck can run" are not confused. Every one of them
+is off under `AGENTS_DECK_NO_INSTALL=1`.
+
+## Bundled packages (25)
 
 | Package | Version | Licence | Copyright |
 | --- | --- | --- | --- |
@@ -49,7 +70,6 @@ ccdeck can run" are not confused.
 | `@reactflow/core` | 11.11.4 | MIT | Copyright (c) 2019-2023 webkid GmbH |
 | `@reactflow/minimap` | 11.7.14 | MIT | Copyright (c) 2019-2023 webkid GmbH |
 | `@reactflow/node-resizer` | 2.2.14 | MIT | Copyright (c) 2019-2023 webkid GmbH |
-| `@reactflow/node-toolbar` | 1.3.14 | MIT | Copyright (c) 2019-2023 webkid GmbH |
 | `classcat` | 5.0.5 | MIT | Copyright © Jorge Bucaran <<https://jorgebucaran.com>> |
 | `d3-color` | 3.1.0 | ISC | Copyright 2010-2022 Mike Bostock |
 | `d3-dispatch` | 3.0.1 | ISC | Copyright 2010-2021 Mike Bostock |
@@ -62,14 +82,13 @@ ccdeck can run" are not confused.
 | `d3-zoom` | 3.0.0 | ISC | Copyright 2010-2021 Mike Bostock |
 | `dagre` | 0.8.5 | MIT | Copyright (c) 2012-2014 Chris Pettitt |
 | `graphlib` | 2.1.8 | MIT | Copyright (c) 2012-2014 Chris Pettitt |
-| `js-tokens` | 4.0.0 | MIT | Copyright (c) 2014, 2015, 2016, 2017, 2018 Simon Lydell |
 | `lodash` | 4.18.1 | MIT | Copyright OpenJS Foundation and other contributors <https://openjsf.org/> |
-| `loose-envify` | 1.4.0 | MIT | Copyright (c) 2015 Andres Suarez <zertosh@gmail.com> |
 | `react` | 18.3.1 | MIT | Copyright (c) Facebook, Inc. and its affiliates. |
 | `react-dom` | 18.3.1 | MIT | Copyright (c) Facebook, Inc. and its affiliates. |
 | `reactflow` | 11.11.4 | MIT | Copyright (c) 2019-2023 webkid GmbH |
 | `scheduler` | 0.23.2 | MIT | Copyright (c) Facebook, Inc. and its affiliates. |
 | `use-sync-external-store` | 1.6.0 | MIT | Copyright (c) Meta Platforms, Inc. and affiliates. |
+| `vite` | 6.4.3 | MIT | Copyright (c) 2019-present, VoidZero Inc. and Vite contributors |
 | `zustand` | 4.5.7 | MIT | Copyright (c) 2019 Paul Henschel |
 
 Every one is a permissive licence (MIT, ISC, BSD-3-Clause). All are
@@ -79,6 +98,33 @@ preserved, which is the purpose of this file. None of these licences is
 changed by ccdeck's relicensing, and no copyleft obligation flows back to
 their authors.
 
+### Declared but not emitted (3)
+
+Three packages resolve into `node_modules` and do **not** survive the build.
+They were in the table above until #962, which is over-attribution rather than
+under-attribution and so harmless legally — but the paragraph at the top of this
+file says everything in the table is *physically present in the published
+tarball*, and that is a factual claim a redistributor is entitled to rely on. So
+they are listed here instead, with what was looked for in the built chunks and
+not found.
+
+| Package | Version | Licence | Searched for in `dist/web/assets/*` | Why it is not there |
+| --- | --- | --- | --- | --- |
+| `js-tokens` | 4.0.0 | MIT | `[gmiyus]{1,6}` — a fragment of its one exported regex, which a minifier cannot rename | A browserify transform's dependency, reached only through `loose-envify`. Rollup never invokes it. |
+| `loose-envify` | 1.4.0 | MIT | `[_$a-zA-Z][$\w]+` — the body of its `process.env.` matcher, likewise a regex literal | Same: it is a browserify transform, declared by `react` and never part of a Rollup graph. |
+| `@reactflow/node-toolbar` | 1.3.14 | MIT | `react-flow__node-toolbar` | Tree-shaken. The deck renders no node toolbar, and unlike its siblings this one contributes no stylesheet either. |
+
+Their licence texts are still reproduced below — §3, §6 and §7 — because dropping
+a notice is the expensive mistake and keeping one is free.
+
+`@reactflow/node-resizer` is deliberately **not** in this list, and it is the one
+entry #962 got wrong. Its JavaScript is tree-shaken exactly as the toolbar's is —
+`react-flow__resize-control` appears nowhere in the JS chunks — but its
+stylesheet is inlined into `reactflow/dist/style.css`, which `src/web/main.tsx`
+imports, and those 27 rules are in `dist/web/assets/index-*.css` and therefore in
+the tarball. A search of the JS alone says it is absent; a search of what
+actually ships says it is not. It stays in the bundled table.
+
 ## Full licence texts
 
 ### 1. `react` 18.3.1, `react-dom` 18.3.1, `scheduler` 0.23.2
@@ -393,3 +439,65 @@ maintained libraries used by this software which have their own
 licenses; we recommend you read them, as their terms may differ from the
 terms above.
 ```
+
+### 13. `vite` 6.4.3
+
+The code Vite contributes to `dist/web` is its own — the `modulePreloadPolyfill`
+that opens the entry chunk, and the CommonJS interop helpers that follow it. Both
+are emitted from templates inside `vite/dist/node/chunks/`, so what ships is
+covered by Vite's core licence, reproduced verbatim below from
+`node_modules/vite/LICENSE.md`.
+
+```text
+MIT License
+
+Copyright (c) 2019-present, VoidZero Inc. and Vite contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+The interop helpers Vite emits originate in `@rollup/plugin-commonjs`, which Vite
+vendors into the chunks named above rather than resolving at build time — it is
+not a package in this tree. Its notice travels inside `vite/LICENSE.md`, under
+"Licenses of bundled dependencies", and is reproduced here too so that a reader
+of this file alone has it:
+
+```text
+The MIT License (MIT)
+
+Copyright (c) 2019 RollupJS Plugin Contributors (https://github.com/rollup/plugins/graphs/contributors)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```