ccdeck 3.22.4 → 3.22.5

package/dist/web/index.html

@@ -40,7 +40,7 @@
         document.documentElement.setAttribute("data-theme", stored === "light" ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-BogvoO2t.js"></script>
+    <script type="module" crossorigin src="/assets/index-Dr2467D6.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-D0ZefIva.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.22.4",
+  "version": "3.22.5",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/src/server/macmon.mjs

@@ -186,7 +186,15 @@ export function resetMacmonFetch() { _fetched = false; }
  */
 export function macmonAsset(release) {
   const tag = release?.tag_name;
-  const a = (release?.assets ?? []).find(x => typeof x?.name === "string" && x.name.endsWith(".tar.gz"));
+  // Named, not merely suffixed. Every macmon release back to v0.5.1 has
+  // published exactly ONE asset, so `.tar.gz` alone has always picked the right
+  // one — but it picks the FIRST match, and the day a release adds a second
+  // tarball beside the binary (a `source.tar.gz`, or per-arch builds) the wrong
+  // one is chosen silently: it downloads, it hashes against a digest that
+  // matches, and what lands is not an executable. The published name has been
+  // `macmon-v<X.Y.Z>.tar.gz` throughout, so requiring that shape costs nothing
+  // today and refuses to guess on the day it would otherwise guess wrong.
+  const a = (release?.assets ?? []).find(x => typeof x?.name === "string" && /^macmon-v[\d.]+\.tar\.gz$/.test(x.name));
   if (!a?.browser_download_url) return null;
   const m = /^sha256:([0-9a-f]{64})$/.exec(String(a.digest ?? ""));
   if (!m) return null;

package/src/server/uv-bootstrap.mjs

@@ -36,7 +36,12 @@ const DOWNLOAD_BASE = "https://github.com/astral-sh/uv/releases/download";
 // Used when the releases API cannot be reached — rate limiting is per-IP and
 // unauthenticated, so this is a normal outcome rather than an error. Any
 // reasonably recent uv can install claude-swap; it self-updates later.
-const FALLBACK_VERSION = "0.12.3";
+//
+// Dated, because this constant rots silently: nothing fails when it falls
+// behind, it simply installs an older uv on the machines that reach it, so no
+// test and no user will ever report it. Checked against the releases API on the
+// date below; worth re-reading whenever this file is opened for another reason.
+const FALLBACK_VERSION = "0.12.13"; // latest as of 2026-09-13
 
 const DOWNLOAD_TIMEOUT_MS = 120_000;