ccdeck 3.23.3 → 3.23.4

package/dist/web/index.html

@@ -44,8 +44,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-gPPlJnr8.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-cRw55wBV.css">
+    <script type="module" crossorigin src="/assets/index-D3oqs0dv.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BzFGrdm1.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.23.3",
+  "version": "3.23.4",
   "description": "Live deck of Claude Code and Codex agents — watch tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -39,7 +39,7 @@
     "the release whose version is in neither place. Any key opening with // is a",
     "note to the author and never a release."
   ],
-  "//nothing-to-say": ["3.23.1", "3.23.2", "3.23.3"],
+  "//nothing-to-say": ["3.23.1", "3.23.2", "3.23.3", "3.23.4"],
   "3.23.0": [
     {
       "title": "🧭 The accounts column leads with accounts",

package/src/server/index.mjs

@@ -37,7 +37,7 @@ import { createPresence } from "./presence.mjs";
 import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
 import { aboutThisDeck } from "./lan-about.mjs";
-import { PROBE_PS, UFW_CONF, UFW_DEFAULTS, isActive, localAliases, reachability, readProbe, readUfw } from "./lan-reach.mjs";
+import { MAC_FW, PROBE_PS, UFW_CONF, UFW_DEFAULTS, isActive, localAliases, reachability, readMacProbe, readProbe, readUfw, silentInbound } from "./lan-reach.mjs";
 import { run } from "./exec.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
 import { invokedName, renameNotice } from "./invoked-as.mjs";
@@ -3727,6 +3727,10 @@ async function handlePrefsWrite(req, res) {
   // so turning the switch off in the panel really does stop the sockets rather
   // than only changing what the panel says.
   await applyLanPrefs();
+  // Somebody has just switched this on and is watching the panel for the answer
+  // to one question: is anything going to turn up. Whatever the probe said
+  // before is about a deck whose sockets were down — see forgetReach.
+  if (body.lan?.enabled === true) forgetReach();
   return send(res, 200, prefsPayload());
 }
 
@@ -3914,6 +3918,9 @@ const lanEngine = createEngine({
   onPort: async port => {
     try { _prefs = await writePrefs({ lan: { port } }); }
     catch { /* the address field still works this session; next start re-pins */ }
+    // The Linux fix lines name this number, so a verdict taken before the
+    // listener had one is missing half of them — see forgetReach.
+    forgetReach();
   },
   // A deck was accepted or unpaired. Written straight through, because the
   // trusted list is the whole of who this deck will talk to and a list that
@@ -4100,21 +4107,118 @@ async function probeLinux() {
   };
 }
 
+/**
+ * Forget what the last probe said, so the next poll measures rather than
+ * answering out of the five-minute cache.
+ *
+ * TWO MOMENTS EARN IT, and both are moments where the held answer is about a
+ * machine in a different state from the one being asked about.
+ *
+ * A SWITCH-ON is the one somebody is watching. The panel starts polling every
+ * five seconds the instant it goes on, and without this the first several
+ * minutes of that are a verdict taken while the sockets were down — which is
+ * the exact question they turned it on to have answered. Five minutes is the
+ * right staleness for a firewall nobody is touching and the wrong one for the
+ * press that starts the feature.
+ *
+ * THE SYNC PORT LANDING changes what the answer CONTAINS on Linux: the fix
+ * lines name a TCP port (see linuxFixSteps), and a verdict taken before the
+ * listener had one offers the discovery line alone — half an answer, pinned for
+ * five minutes, on the machine that most needs the other half.
+ */
+function forgetReach() { reachAt = 0; }
+
+/**
+ * What the macOS application firewall says about this deck.
+ *
+ * Three reads, none of them privileged — measured on macOS 26.6, where all of
+ * them answer an ordinary user with exit 0 and no password. See the macos block
+ * in lan-reach.mjs for why this platform can be asked the exact question about
+ * its own binary while Linux has to reason from a default policy.
+ *
+ * A call that fails comes back as an empty string rather than as a throw, which
+ * readMacProbe turns into a null field and macReach turns into silence: a Mac
+ * that will not answer is a Mac this says nothing about.
+ */
+async function probeMac() {
+  const ask = args => run(MAC_FW, args, { timeout: 5_000 }).then(r => (r?.ok ? r.stdout : "")).catch(() => "");
+  const [globalState, blockAll, app] = await Promise.all([
+    ask(["--getglobalstate"]),
+    ask(["--getblockall"]),
+    // The binary the LISTENER runs as, which is this process's own executable —
+    // the application firewall's rules are about a program, never about a port.
+    ask(["--getappblocked", process.execPath]),
+  ]);
+  return readMacProbe({ global: globalState, blockAll, app });
+}
+
+/** How recently a beacon has to have arrived to count as a machine this deck
+ *  can hear. Three announce intervals, which is the same window the panel calls
+ *  `now` — one dropped broadcast must not retract the claim. */
+const HEARD_MS = 90_000;
+
+/**
+ * The verdict for a machine no probe could speak about — see silentInbound.
+ *
+ * BOTH LISTS ARE COUNTED. `strangers` is already one row per machine, and a
+ * deck LEAVES it for `peers` the moment somebody pairs with it — so counting
+ * strangers alone would make a deck that has paired with everything it can hear
+ * look like a deck that hears nobody, which is the one state this must not
+ * confuse with being blocked.
+ */
+function measuredReach() {
+  const st = lanEngine.status();
+  const at = Date.now();
+  const fresh = p => typeof p?.lastSeen === "number" && at - p.lastSeen < HEARD_MS;
+  const heard = (st.strangers?.length ?? 0) + (st.peers ?? []).filter(fresh).length;
+  return silentInbound({ heard, listeningSince: st.listeningSince, inbound: st.inboundAt, now: at });
+}
+
 function refreshReach() {
-  if (reachBusy || (process.platform !== "win32" && process.platform !== "linux")) return;
+  if (reachBusy) return;
   if (reachAt && Date.now() - reachAt < REACH_MS) return;
   reachBusy = true;
   if (process.platform === "linux") {
     probeLinux().then(linux => {
-      reachSaid = reachability({ platform: "linux", linux, inbound: lanEngine.status().inboundAt });
+      // A read of the real configuration beats an inference from silence, so
+      // the measurement only speaks where the probe had no opinion at all.
+      reachSaid = reachability({ platform: "linux", linux, inbound: lanEngine.status().inboundAt })
+        ?? measuredReach();
+    }).catch(() => {
+      reachSaid = measuredReach();
+    }).finally(() => {
+      reachAt = Date.now();
+      reachBusy = false;
+    });
+    return;
+  }
+  if (process.platform === "darwin") {
+    probeMac().then(mac => {
+      reachSaid = reachability({
+        platform: "darwin",
+        mac,
+        // The same path the probe asked about, so the lines somebody pastes name
+        // the binary the verdict was taken on.
+        exePath: process.execPath,
+        inbound: lanEngine.status().inboundAt,
+      }) ?? measuredReach();
     }).catch(() => {
-      reachSaid = null;
+      reachSaid = measuredReach();
     }).finally(() => {
       reachAt = Date.now();
       reachBusy = false;
     });
     return;
   }
+  // EVERY OTHER PLATFORM, which used to return before reaching any of this and
+  // therefore said nothing forever. FreeBSD, an unrecognised Linux, anything
+  // node runs on: no probe to run, and the measurement needs none.
+  if (process.platform !== "win32") {
+    reachSaid = measuredReach();
+    reachAt = Date.now();
+    reachBusy = false;
+    return;
+  }
   run("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", PROBE_PS], {
     // The program path goes through the environment rather than into the
     // script, so a path with a quote in it cannot close the string it sits in.
@@ -4127,12 +4231,12 @@ function refreshReach() {
       aliases: localAliases(networkInterfaces()),
       exePath: process.execPath,
       inbound: lanEngine.status().inboundAt,
-    });
+    }) ?? measuredReach();
   }).catch(() => {
-    // A probe that did not run says nothing, which is the same answer as a
-    // machine this cannot speak about. It is never an error the panel shows:
-    // nobody asked for it.
-    reachSaid = null;
+    // A probe that did not run is exactly the machine silentInbound was written
+    // for: nothing can be asked, so what is left is what was measured. It is
+    // never an error the panel shows — nobody asked for it.
+    reachSaid = measuredReach();
   }).finally(() => {
     reachAt = Date.now();
     reachBusy = false;

package/src/server/lan-engine.mjs

@@ -337,6 +337,17 @@ export function createEngine({
    */
   let inboundAt = null;
 
+  /** When this deck's listener came up, or null while it is down.
+   *
+   *  THE OTHER HALF OF `inboundAt`. On its own, "nothing has ever connected in"
+   *  says nothing: a deck that started four seconds ago has the same null as one
+   *  that has been listening all afternoon while the network talked around it.
+   *  What makes the silence evidence is how long it has gone on for, and that is
+   *  a number only the engine holds. See silentInbound in lan-reach.mjs, which
+   *  is the one verdict in this feature that works on a platform nothing can be
+   *  asked about. */
+  let listeningSince = null;
+
   /** This deck's accounts in the shape the rules want. Read through the same
    *  function the panel uses, so a row can never be alive here and dead there. */
   const localAccounts = async () => {
@@ -838,6 +849,9 @@ export function createEngine({
         throw err;
       }
       stalled = null;
+      // From here the socket is accepting, so this is the moment the silence
+      // starts being about the network rather than about a deck still starting.
+      listeningSince = now();
       if (port !== cfg.port) onPort?.(port);
       beacon = createBeacon({
         port, name: cfg.name, fp: identity.fp,
@@ -1211,6 +1225,8 @@ export function createEngine({
         // on a deck nobody has dialled yet, which is not the same as blocked
         // and is drawn as neither — see inboundAt and lan-reach.mjs.
         inboundAt,
+        // How long that null has been true for — see listeningSince.
+        listeningSince,
         addrs: beacon ? localAddresses() : [],
         shared: [...cfg.shared],
         // The token this deck is offering, if any. Drawn as the one thing to do
@@ -1323,6 +1339,9 @@ export function createEngine({
       server?.stop();
       beacon = null;
       server = null;
+      // Nothing is listening, so nothing is being silent AT anybody. Leaving
+      // this set would have the next start measure its quiet from the last one.
+      listeningSince = null;
     },
   };
 }

package/src/server/lan-reach.mjs

@@ -296,30 +296,152 @@ export function linuxReach({ ufw = null, firewalld = false, inbound = null, sync
   };
 }
 
+// ── macos ───────────────────────────────────────────────────────────────────
+//
+// THE REVERSAL. This module used to say macOS was deliberately silent: the
+// firewall ships off, and when it is on it asks the person at the keyboard the
+// first time a program listens — so the answer was either "nothing is in the
+// way" or "somebody was shown a dialog and pressed a button".
+//
+// The second half of that is what gave way. A deck started from a terminal, or
+// by npx, or by a launch agent, is not always a program somebody is sitting in
+// front of when the question is asked, and a dialog nobody answers is a denial
+// that looks exactly like an empty list. And the answer IS readable. Measured
+// on macOS 26.6, as an ordinary user, no password and exit 0 on all four:
+// `--getglobalstate`, `--getblockall`, `--getstealthmode`, and
+// `--getappblocked <path>`.
+//
+// WHICH MAKES THIS THE BEST-INFORMED OF THE THREE PLATFORMS, not the worst.
+// ufw will not show its rules to anybody but root, so the Linux verdict reasons
+// from a default policy and says out loud that it could not check. This one can
+// ask the exact question — is an incoming connection to THIS binary permitted —
+// about the binary the listener actually runs as. So there is no `unsure` here,
+// because there is nothing it could not look at.
+//
+// WHAT IS NOT EVIDENCE, and the trap this nearly walked into: with the firewall
+// OFF, `--getappblocked` answers "is permitted" for every path handed to it,
+// including one that does not exist. Measured, and it is the reason the order
+// in macReach is load-bearing rather than tidy — the per-app answer means
+// nothing at all until the global state says the firewall is on.
+//
+// STEALTH MODE IS READ AND NOT ACTED ON. It drops unsolicited probes to ports
+// nothing is listening on, which is not this: a deck that is listening and
+// allowed still answers. Blaming it would send somebody to change a setting
+// that was never in the way.
+
+/** The application firewall's own tool. Not on PATH, and the full path is what
+ *  goes in the lines somebody pastes, so it is written once. */
+export const MAC_FW = "/usr/libexec/ApplicationFirewall/socketfilterfw";
+
+/**
+ * What the three reads said, as a verdict-shaped thing.
+ *
+ * Every field can come back null, which is this file's word for "the machine
+ * did not answer that" — a locked-down build, a future macOS that renamed the
+ * flag, a tool that is not there at all. Null travels to macReach and comes out
+ * as silence rather than as a guess.
+ */
+export function readMacProbe({ global: globalState, blockAll, app } = {}) {
+  // "Firewall is disabled. (State = 0)" / "Firewall is enabled. (State = 1)".
+  // The number is read rather than the adjective: it is the stable half of the
+  // sentence, and 2 is a third state that says enabled in words.
+  const state = /State\s*=\s*(\d+)/i.exec(String(globalState ?? ""))?.[1];
+  return {
+    on: state == null ? null : Number(state) > 0,
+    // "Firewall has block all state set to enabled." — the setting that turns
+    // every allowance off at once, including one this deck already has.
+    blockAll: /block all state set to enabled/i.test(String(blockAll ?? "")),
+    // "Incoming connection to <path> is permitted." / "... is blocked."
+    appBlocked: /is blocked/i.test(String(app ?? "")) ? true
+      : /is permitted/i.test(String(app ?? "")) ? false
+      : null,
+  };
+}
+
+/**
+ * The lines that open the path, as text.
+ *
+ * SCOPED TO THE PROGRAM, like the Windows rule and unlike the Linux ones: the
+ * application firewall has no notion of a port, which is what makes it the
+ * right shape here — the sync listener's port is a different number after some
+ * restarts, and a rule about the binary survives that.
+ *
+ * `--add` before `--unblockapp` because a binary the firewall has never heard
+ * of cannot be unblocked; adding one that is already listed changes nothing,
+ * so the pair is safe to paste twice.
+ */
+export function macFixSteps({ exePath, blockAll = false } = {}) {
+  const steps = [];
+  // First, because while it is on nothing else in this list has any effect.
+  if (blockAll) steps.push(`sudo ${MAC_FW} --setblockall off`);
+  steps.push(`sudo ${MAC_FW} --add "${exePath}"`);
+  steps.push(`sudo ${MAC_FW} --unblockapp "${exePath}"`);
+  return steps;
+}
+
+/**
+ * Whether other decks can reach this Mac, from what the application firewall
+ * says about this deck's own binary.
+ *
+ * Null for anything it could not read, and for the ordinary machine whose
+ * firewall is simply off — see the block above for why `appBlocked` is not
+ * consulted until `on` is true.
+ */
+export function macReach({ probe = null, exePath = "", inbound = null } = {}) {
+  // MEASURED BEATS READ, here as on the other two: a connection from another
+  // machine has arrived, so the path is open whatever the settings say.
+  if (inbound) return { blocked: false, why: "inbound seen", category: "", alias: "" };
+  if (!probe || probe.on == null) return null;
+  if (!probe.on) return { blocked: false, why: "firewall off", category: "", alias: "" };
+  // Both halves of the sentence, because the asymmetry is the confusing part:
+  // the other deck may already show this machine's name, which reads as a
+  // working connection and is not one.
+  const heard = " They can still hear it — that is why one of them may already show this machine.";
+  if (probe.blockAll) {
+    return {
+      blocked: true,
+      why: "block all incoming",
+      category: "",
+      alias: "",
+      shell: "sh",
+      text: "macOS is set to block all incoming connections, so other decks cannot reach this one." + heard,
+      steps: macFixSteps({ exePath, blockAll: true }),
+    };
+  }
+  if (probe.appBlocked === true) {
+    return {
+      blocked: true,
+      why: "app blocked",
+      category: "",
+      alias: "",
+      shell: "sh",
+      text: "The macOS firewall is refusing incoming connections to this deck, so other decks cannot reach it." + heard,
+      steps: macFixSteps({ exePath }),
+    };
+  }
+  if (probe.appBlocked === false) return { blocked: false, why: "app permitted", category: "", alias: "" };
+  return null;
+}
+
 /**
  * Whether other decks can reach this one, and what to do when they cannot.
  *
  * `null` means "no opinion", and it is the answer for every machine this cannot
- * speak about: anything that is neither Windows nor Linux, and any probe that
- * did not come back. Silence rather than a hedge — a panel line that says
- * "possibly" about a thing it did not measure is worse than no line.
- *
- * macOS is deliberately among the silent ones. Its firewall is off by default
- * and, when on, asks the person at the keyboard the first time a program
- * listens — so the answer is either "nothing is in the way" or "somebody was
- * shown a dialog and pressed a button", and neither is a thing to instruct
- * anybody about.
+ * speak about: anything that is none of the three platforms below, and any
+ * probe that did not come back. Silence rather than a hedge — a panel line that
+ * says "possibly" about a thing it did not measure is worse than no line.
  *
  * `blocked: false` is a real finding and is worth returning: it lets the panel
  * stop blaming the firewall for an empty list and say the other thing instead,
  * which is that nobody else is running.
  */
-export function reachability({ platform, probe, aliases = [], exePath = "", inbound = null, linux = null } = {}) {
-  // Two platforms, two entirely different reads — see the linux block above for
-  // why that one cannot be written in this one's shape. `inbound` is the one
-  // input both of them share: it is a measurement rather than a read, so it
-  // outranks whatever either platform's configuration says.
+export function reachability({ platform, probe, aliases = [], exePath = "", inbound = null, linux = null, mac = null } = {}) {
+  // Three platforms, three entirely different reads — see each block above for
+  // why none of them can be written in another's shape. `inbound` is the one
+  // input all of them share: it is a measurement rather than a read, so it
+  // outranks whatever any platform's configuration says.
   if (platform === "linux") return linux ? linuxReach({ ...linux, inbound }) : null;
+  if (platform === "darwin") return mac ? macReach({ probe: mac, exePath, inbound }) : null;
   if (platform !== "win32") return null;
   if (!probe) return null;
   // The broadcast route first, then the interfaces the deck holds an address
@@ -378,6 +500,63 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
  * the first try if the invite is minted at the other end and pasted here. Same
  * two controls, opposite order, and only one of the orders works.
  */
+// ── the machine nothing can be asked about ──────────────────────────────────
+//
+// Every block above depends on the operating system answering a question.
+// FreeBSD has nobody to ask; a Linux box running plain nftables has no ufw.conf
+// to read; a Windows probe comes back empty for a dozen policy reasons; a
+// hardened Mac can refuse the tool. All of them arrive at `reachability` as
+// null — which is honest, and no use at all to somebody watching an empty list.
+//
+// WHAT IS MEASURABLE ON ANY OF THEM. A beacon ARRIVING proves this machine
+// hears the network. `inboundAt` still null proves nothing has ever connected
+// in. Those two facts together are the exact shape of a blocked inbound path,
+// and neither of them asks the OS anything.
+//
+// SO IT IS A LAST RESORT, NOT A SECOND OPINION. It speaks only where a platform
+// verdict said nothing: a read of the actual configuration beats an inference
+// from silence every time, including when the read says the firewall is off and
+// the silence has some other cause this cannot name.
+
+/** How long this deck has to have been listening — hearing other machines and
+ *  receiving nothing — before the silence is worth reporting.
+ *
+ *  Deliberately many times over the interval anything would have dialled on: a
+ *  paired deck runs a round every SYNC_MS (60s) and a stranger that hears this
+ *  one asks within ASKING_MS (8s), autoAsk being on by default. Five minutes is
+ *  therefore dozens of missed chances rather than one — and the cost of getting
+ *  this wrong is telling somebody their network is broken when it is quiet. */
+export const QUIET_MS = 5 * 60_000;
+
+/**
+ * The verdict for a machine this file cannot read: measured, never read.
+ *
+ * WHAT IT REFUSES TO SAY. It names no firewall and offers no command, because
+ * it looked at no configuration and would be guessing at both. Everything it
+ * has is in the one sentence it returns, and the ways out the panel draws under
+ * it need no rule on this machine at all.
+ */
+export function silentInbound({ heard = 0, listeningSince = null, inbound = null, now = Date.now() } = {}) {
+  // Something got in, so the path is open — the same measurement that outranks
+  // a configuration read everywhere else in this file.
+  if (inbound) return null;
+  // Nobody is out there. "Nothing has arrived" and "nothing can arrive" are the
+  // two facts this whole module exists to tell apart, and with no beacon in
+  // hand this one is the first.
+  if (!heard) return null;
+  if (!listeningSince) return null;
+  const listening = now - listeningSince;
+  if (listening < QUIET_MS) return null;
+  const mins = Math.round(listening / 60_000);
+  return {
+    blocked: true,
+    why: "heard them, nothing got in",
+    category: "",
+    alias: "",
+    text: `This deck hears ${heard === 1 ? "another deck" : `${heard} other decks`} on the network and, in the ${mins} minutes it has been listening, nothing has ever connected to it — which is what a blocked inbound path looks like from this side. This machine cannot be asked which firewall it runs, so there is no line to paste.`,
+  };
+}
+
 export function workaround(blocked) {
   if (!blocked) return null;
   return {