ccdeck 3.25.0 → 3.26.1

package/dist/web/index.html

@@ -44,8 +44,8 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-BoR2dMqR.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-7a7ISatq.css">
+    <script type="module" crossorigin src="/assets/index-CO8B_qBe.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DlaHgzye.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.25.0",
+  "version": "3.26.1",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -43,7 +43,9 @@
     "3.23.1",
     "3.23.2",
     "3.23.3",
-    "3.23.4"
+    "3.23.4",
+    "3.26.0",
+    "3.26.1"
   ],
   "3.25.0": [
     {

package/src/server/app-host.mjs

@@ -0,0 +1,37 @@
+// When the deck runs inside the ccdeck desktop app (#1160).
+//
+// The app starts this deck with its own binary acting as Node
+// (ELECTRON_RUN_AS_NODE=1) and tells it so, because three things the deck does
+// for itself are the app's to do there, and doing them anyway goes wrong:
+//
+//   UPDATES. The deck would ask npm for a newer ccdeck and `npm i -g` it — a
+//   second, global copy the app never runs, reinstalled every thirty minutes by
+//   the away-update because the app's own version never changes. The app
+//   updates itself from GitHub Releases instead.
+//
+//   START AT LOGIN. The deck offers a login item that runs `process.execPath
+//   bin/agent-dag.js` — here the app's binary, started at login with no window
+//   and no tray, beside the app's own login item. The app owns that switch.
+//
+//   THE CLAUDE CODE HOOK. Its command is `<node> hook.js`, and `process.execPath`
+//   is the app's binary, which without ELECTRON_RUN_AS_NODE opens the app. The
+//   app hands the deck a launcher that finds a Node to run the hook with.
+//
+// Environment, not flags: the supervisor re-spawns the worker with its own
+// argv, and the environment is what both of them inherit unchanged.
+
+/** "1" when the desktop app started this deck. */
+export const APP_ENV = "CCDECK_APP";
+
+/** The program the Claude Code hook command runs hook.js with, when it must
+ *  not be `process.execPath`. */
+export const HOOK_RUNTIME_ENV = "CCDECK_HOOK_RUNTIME";
+
+export function inApp(env = process.env) {
+  return env[APP_ENV] === "1";
+}
+
+export function hookRuntime(env = process.env, execPath = process.execPath) {
+  const given = env[HOOK_RUNTIME_ENV];
+  return typeof given === "string" && given.trim() ? given : execPath;
+}

package/src/server/block-notify.mjs

@@ -6,6 +6,12 @@
 // because raising a notification from a page requires a page, and the case this
 // whole feature exists for is the one where you walked away.
 //
+// WHAT IT SAYS IS WHAT AN OPEN DECK WOULD HAVE PLAYED. With a tab open you hear
+// a turn finish and hear Claude ask; with none open nothing plays, and those are
+// exactly the moments somebody who walked away wanted. So a closed deck stands
+// in for its own sounds rather than keeping a narrower rule of its own. See
+// `isChimeEvent`.
+//
 // The server can, and it already knows the one fact that makes it safe to:
 // `sseClients.size`. Nobody is listening means nobody is being told by any
 // other surface — the chip, the title, the favicon and the live region are all
@@ -55,30 +61,85 @@ export const OFF_ENV = "AGENTS_DECK_NO_NOTIFY";
 export const QUIET_MS = 2 * 60 * 1000;
 
 /**
- * The events that mean a session has stopped and cannot start again without a
- * human. Two of the three kinds CC emits.
+ * Would an open deck have played a tone for this?
  *
- * `permission_prompt` — it wants to run something and is waiting to be allowed.
+ * The page's rule, not a new one: `Stop` is the "turn finished" tone and every
+ * `Notification` is "Claude is asking" (src/web/sound.ts `chimeFor`).
  *
- * `agent_needs_input` — it asked a question and is waiting for the answer, with
- * the question itself in `message`. This was missing, and its absence was not a
- * small gap: on a machine running `bypassPermissions` Claude Code never asks to
- * run anything, so `permission_prompt` essentially never fires and the desktop
- * notification could not happen at all. Measured on one real log — 1683 events,
- * every one of them bypassPermissions — a single permission prompt in the whole
- * history against five of these.
+ * WIDER THAN IT USED TO BE, ON PURPOSE. This was permission prompts and
+ * questions only — `idle_prompt` and every finished turn left out, because
+ * #348 measured idle at three quarters of what CC emits. What that cost is
+ * the setup the deck's owner runs: under `bypassPermissions` Claude Code almost
+ * never raises a permission prompt (one log: 14 idle, 1 permission), so the
+ * notification this switch promised could not happen. The noise is held back
+ * by the memo instead — see `memoKeys` — and the channel is still off until
+ * somebody turns it on (deck-prefs.mjs).
  *
- * `idle_prompt` is deliberately still out: #348 measured 16 idle to 5
- * permission, and an idle prompt is a turn that ended, not a session that is
- * stuck. Three quarters noise is how a notification channel gets muted, and a
- * muted channel is worse than none because the deck goes on believing it told
- * somebody.
+ * WRITTEN TWICE BECAUSE IT HAS TO BE. sound.ts is TypeScript bundled for the
+ * browser and this runs in bare node, so neither can import the other.
+ * notify-mirror.test.ts runs both over the same events and fails the day they
+ * disagree, which is the only thing that keeps a mirrored rule a mirror.
  */
-export function isBlockingPrompt(raw) {
-  return !!raw
-    && raw.hook_event_name === "Notification"
-    && (raw.notification_type === "permission_prompt"
-      || raw.notification_type === "agent_needs_input");
+export function isChimeEvent(raw) {
+  return !!raw && (raw.hook_event_name === "Stop" || raw.hook_event_name === "Notification");
+}
+
+/** Which of the two tones it would have been — sound.ts's names, so the
+ *  desktop app can play the same one with the notification. */
+export function chimeOf(raw) {
+  return raw?.hook_event_name === "Stop" ? "done" : "needs-input";
+}
+
+/**
+ * How long one session stays quiet about a FINISHED TURN after saying so.
+ *
+ * Far shorter than `QUIET_MS`, because every `Stop` is a different turn and
+ * somebody answering from the terminal can finish two inside a minute — each is
+ * the tone an open deck would have played. What this still stops is one `Stop`
+ * delivered twice: a retried hook, or a second deck feeding the same log.
+ */
+export const TURN_QUIET_MS = 10 * 1000;
+
+/**
+ * Which memo entries speak for this event: its own, and any whose having been
+ * said makes this one old news.
+ *
+ * The case with an `also` is the idle prompt. CC sends one a minute after a
+ * turn ends with the input box still empty — so after a `Stop` that was already
+ * on the desktop it says nothing new, and a second notification for the same
+ * turn a minute later is exactly the drumming that gets a channel muted. The
+ * tab plays both tones because a tone is gone in a second; a notification sits
+ * in the tray. An idle prompt whose `Stop` was NOT said — the tab was open when
+ * the turn ended and closed since — still is.
+ */
+export function memoKeys(raw) {
+  const sid = raw?.session_id ?? "";
+  if (raw?.hook_event_name === "Stop") return { own: `${sid}#turn`, also: [] };
+  if (raw?.notification_type === "idle_prompt") return { own: `${sid}#idle`, also: [`${sid}#turn`] };
+  return { own: sid, also: [] };
+}
+
+/** The quiet window this event is measured against. */
+export function quietFor(raw) {
+  return raw?.hook_event_name === "Stop" ? TURN_QUIET_MS : QUIET_MS;
+}
+
+/** Longest quoted body. macOS shows about two lines of this; the rest is
+ *  still worth having in Notification Center, but not a transcript. */
+export const TURN_BODY_MAX = 160;
+
+/**
+ * The body for a finished turn: what the agent last said, cut to what a tray
+ * shows, or a plain sentence when there is nothing to quote — Codex's `Stop`
+ * carries no message, and neither does an older Claude Code's.
+ */
+export function turnBody(raw) {
+  const said = typeof raw?.last_assistant_message === "string"
+    ? raw.last_assistant_message.replace(/\s+/g, " ").trim()
+    : "";
+  if (!said) return "Finished its turn";
+  const chars = [...said];
+  return chars.length > TURN_BODY_MAX ? `${chars.slice(0, TURN_BODY_MAX - 1).join("").trimEnd()}…` : said;
 }
 
 /**
@@ -97,10 +158,18 @@ export function isBlockingPrompt(raw) {
  * dimmer copy of a rule that already exists — the failure ambient-counts.ts and
  * block-announce.ts were both written to end.
  */
+/** Which session a notification is about, in the words the user has for it:
+ *  the working directory's last segment, else a short session id. */
+export function whoOf(raw) {
+  const cwd = typeof raw?.cwd === "string" && raw.cwd ? basename(raw.cwd) : "";
+  return cwd || (typeof raw?.session_id === "string" ? raw.session_id.slice(0, 8) : "a session");
+}
+
 export function blockNotice(raw, product) {
-  const cwd = typeof raw.cwd === "string" && raw.cwd ? basename(raw.cwd) : "";
-  const who = cwd || (typeof raw.session_id === "string" ? raw.session_id.slice(0, 8) : "a session");
-  const said = typeof raw.message === "string" && raw.message ? raw.message : "Needs your permission";
+  const who = whoOf(raw);
+  if (raw.hook_event_name === "Stop") return { title: `${who} — ${product}`, body: turnBody(raw) };
+  const fallback = raw.notification_type === "idle_prompt" ? "Waiting for your input" : "Needs your permission";
+  const said = typeof raw.message === "string" && raw.message ? raw.message : fallback;
   return { title: `${who} — ${product}`, body: said };
 }
 
@@ -111,20 +180,20 @@ export function blockNotice(raw, product) {
  * notification — a channel that fires twelve times in a second is one the user
  * turns off within the minute:
  *
- *   - a blocking prompt, per `isBlockingPrompt`
+ *   - something an open deck would have played a tone for, per `isChimeEvent`
  *   - NOTHING LISTENING. A page is a better surface than this in every way, so
  *     wherever there is one, this stays out of the way.
  *   - NOT A REPLAY. The server replays events.jsonl into itself at boot to
  *     rebuild the ring, and that log holds every permission prompt of the last
  *     50MB. Without this gate, starting the deck would announce the entire
  *     history of the machine at once.
- *   - the session has not just been announced, per `QUIET_MS`.
+ *   - the session has not just been announced, per `quietFor`.
  */
 export function shouldNotify(raw, { clients, replay, lastAt, now }) {
-  if (!isBlockingPrompt(raw)) return false;
+  if (!isChimeEvent(raw)) return false;
   if (clients > 0) return false;
   if (replay) return false;
-  if (lastAt != null && now - lastAt < QUIET_MS) return false;
+  if (lastAt != null && now - lastAt < quietFor(raw)) return false;
   return true;
 }
 
@@ -146,7 +215,7 @@ export function shouldNotify(raw, { clients, replay, lastAt, now }) {
  */
 export function createBlockNotifier({ notify, product, now = Date.now, enabled = true, onError }) {
   const isEnabled = typeof enabled === "function" ? enabled : () => enabled;
-  /** session_id → when it was last announced. Bounded by pruning on read: a
+  /** memo key (see `memoKeys`) → when it was last announced. Bounded by pruning on read: a
    *  long-lived server sees many sessions and this must not become a second
    *  ring nobody empties. */
   const seen = new Map();
@@ -156,9 +225,11 @@ export function createBlockNotifier({ notify, product, now = Date.now, enabled =
     consider(raw, { clients, replay = false }) {
       if (!isEnabled()) return "off";
       const at = now();
-      const id = raw?.session_id ?? "";
-      if (!shouldNotify(raw, { clients, replay, lastAt: seen.get(id), now: at })) return "skipped";
-      seen.set(id, at);
+      const { own, also } = memoKeys(raw);
+      const said = [own, ...also].map(k => seen.get(k)).filter(t => t != null);
+      const lastAt = said.length ? Math.max(...said) : undefined;
+      if (!shouldNotify(raw, { clients, replay, lastAt, now: at })) return "skipped";
+      seen.set(own, at);
       for (const [key, when] of seen) if (at - when > QUIET_MS) seen.delete(key);
       const { title, body } = blockNotice(raw, product);
       // Fire-and-forget, and the catch is not decoration. `notify` shells out —
@@ -166,7 +237,10 @@ export function createBlockNotifier({ notify, product, now = Date.now, enabled =
       // notification daemon the last of those simply is not there. A rejected
       // promise from a notification must never take down the ingest path that
       // every hook event in the process goes through.
-      Promise.resolve(notify(title, body)).catch(err => onError?.(err));
+      // `who` alone as well: the desktop app shows its own name above every
+      // notification, so the "— ccdeck" the title carries for osascript's sake
+      // would be said twice there.
+      Promise.resolve(notify(title, body, { chime: chimeOf(raw), who: whoOf(raw) })).catch(err => onError?.(err));
       return "notified";
     },
   };

package/src/server/browser-react.mjs

@@ -184,10 +184,25 @@ export async function notify(title, body, platform = process.platform, deps = {}
   // is a broken notification rather than an execution — fixed anyway, because
   // the rule is "never let a user string be read as an option" and a rule with
   // an exception is a rule somebody will apply to the wrong call next time.
-  const r = await exec("notify-send", ["--", title, body]).catch(() => null);
+  //
+  // AND THE BODY IS ESCAPED, BECAUSE NOTIFY-SEND'S BODY IS MARKUP. The
+  // freedesktop spec lets a server read `<b>`, `<i>`, `<a>` and entities in the
+  // body, and GNOME, KDE, dunst and mako all do — so a bare `&` or `<` is a
+  // parse error there, and the usual result is an empty or missing body. That
+  // was theoretical while the body was CC's own sentence or a host name. It is
+  // not now that a finished turn quotes the agent's last reply, which is code
+  // and arrows as often as not. The summary is plain text in the spec, so the
+  // title is left as it is: escaping it would print `&amp;` on every daemon.
+  const r = await exec("notify-send", ["--", title, markupEscape(body)]).catch(() => null);
   return r?.ok === true;
 }
 
+/** Text as notify-send's body markup reads it: the three characters that can
+ *  start a tag or an entity, and nothing else. */
+export function markupEscape(text) {
+  return String(text).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
 /** Close one tab by its exact URL. macOS only; see `available`. */
 export async function closeTab(browserKey, url, platform = process.platform, deps = {}) {
   if (platform !== "darwin") return { ok: false, reason: "unsupported" };

package/src/server/ccusage.mjs

@@ -11,6 +11,7 @@
 // the current call always serves from the already-installed copy. If the
 // managed install is missing/broken we fall back to the old npx path so the
 // feature still works on a fresh machine.
+import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
@@ -738,12 +739,43 @@ function discardDamagedInstall(runner, err) {
 export const userSpec = (file, args = [], platform = process.platform) =>
   spawnSpec(file, args, platform);
 
+/**
+ * The platform binary ccusage's own cli.js would run, resolved the way cli.js
+ * resolves it (`@ccusage/ccusage-<platform>-<arch>/bin/ccusage[.exe]`, from
+ * the package's own directory), or null when there is none.
+ *
+ * WINDOWS ONLY, and for one reason: cli.js starts that binary WITHOUT hiding
+ * its console. The deck runs with no console of its own (detached, or inside
+ * the desktop app), so the binary is given a new one — and with Windows
+ * Terminal as the default terminal that is a window flashing up on every
+ * usage read, measured on a Windows 10 box as a CASCADIA_HOSTING_WINDOW_CLASS
+ * hosting ccusage. Running the binary directly, with windowsHide, is what
+ * cli.js does minus the window. Elsewhere nothing flashes, and the wrapper
+ * stays in the path it has always been in.
+ *
+ * Exported for tests; `resolve` is injectable.
+ */
+export function nativeCcusage(entry, platform = process.platform, arch = process.arch, resolve = null) {
+  if (platform !== "win32" || typeof entry !== "string" || !entry) return null;
+  const pkg = arch === "arm64" ? "@ccusage/ccusage-win32-arm64" : arch === "x64" ? "@ccusage/ccusage-win32-x64" : null;
+  if (!pkg) return null;
+  try {
+    const req = resolve ?? createRequire(entry).resolve;
+    return req(`${pkg}/bin/ccusage.exe`);
+  } catch {
+    return null;
+  }
+}
+
 // One attempt with one runner. No branch gets a shell. The managed install is
 // `node <entry> …`, which never needed one; the user's own copy and the npx
 // fallback are routed through spawnSpec instead — see npxSpec and userSpec, and
 // note that `args` here ends in whatever /api/ccusage was asked for.
 function runOnce(runner, args) {
-  const { file, args: full, opts } = runner.kind === "node"
+  const native = runner.kind === "node" ? nativeCcusage(runner.entry) : null;
+  const { file, args: full, opts } = native
+    ? { file: native, args, opts: {} }
+    : runner.kind === "node"
     ? { file: process.execPath, args: [runner.entry, ...args], opts: {} }
     : runner.kind === "path"
       ? userSpec(runner.file, args)

package/src/server/deck-prefs.mjs

@@ -67,7 +67,8 @@ export const prefsPath = (home = deckDataDir()) => join(prefsDir(home), "prefs.j
  * `notifications` defaults OFF since 3.22.7. The deck's own sounds are how it
  * gets attention by default; a desktop notification is something a person
  * turns on. It defaulted on from 3.7.0 until then, and a deck that saved that
- * `true` keeps it.
+ * `true` keeps it. On, a CLOSED deck notifies wherever an open one would have
+ * played a sound (block-notify.mjs `isChimeEvent`).
  */
 export const DEFAULTS = Object.freeze({
   notifications: false,
@@ -109,6 +110,15 @@ export const DEFAULTS = Object.freeze({
     // of one person's machines show each other where they are working; off, and
     // paired decks read "current account hidden" instead.
     shareActive: true,
+    // FINDING THIS PERSON'S OTHER MACHINES OVER TAILSCALE, off until they turn
+    // it on: it is a new path off this machine, and the owner chooses it. Its
+    // two permissions ship on, like the local pair above, and they are narrower
+    // than those by construction — they only ever answer for a machine signed
+    // in to the same Tailscale account as this one (see tailscale.mjs), never
+    // for a colleague's node or one shared in from another tailnet.
+    tailscale: false,
+    tailscaleAsk: true,
+    tailscaleAccept: true,
     // What somebody HERE calls another deck, keyed by its fingerprint. The name
     // a deck gives itself is its owner's to choose; this is the other half.
     aliases: Object.freeze({}),
@@ -217,6 +227,11 @@ function normaliseLan(raw) {
     // Whether paired decks are told which shared account this one is on. Absent
     // is on — the default above — and only a real boolean turns it off.
     shareActive: typeof src.shareActive === "boolean" ? src.shareActive : DEFAULTS.lan.shareActive,
+    // The Tailscale switch and its two permissions. Only a real boolean
+    // overrides a default, as above.
+    tailscale: typeof src.tailscale === "boolean" ? src.tailscale : DEFAULTS.lan.tailscale,
+    tailscaleAsk: typeof src.tailscaleAsk === "boolean" ? src.tailscaleAsk : DEFAULTS.lan.tailscaleAsk,
+    tailscaleAccept: typeof src.tailscaleAccept === "boolean" ? src.tailscaleAccept : DEFAULTS.lan.tailscaleAccept,
   };
 }
 

package/src/server/index.mjs

@@ -36,6 +36,10 @@ import { AWAY_BOOT_GRACE_MS, AWAY_RECHECK_MS, AWAY_TICK_MS, awayGate, awayUpdate
 import { createPresence } from "./presence.mjs";
 import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
+import { createTailnet, IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
+import { portHolder } from "./port-holder.mjs";
+import { createRouteCheck } from "./route-via.mjs";
+import { DISCOVERY_PORT } from "./lan-socket.mjs";
 import { aboutThisDeck } from "./lan-about.mjs";
 import { MAC_FW, PROBE_PS, UFW_CONF, UFW_DEFAULTS, isActive, localAliases, reachability, readMacProbe, readProbe, readUfw, silentInbound } from "./lan-reach.mjs";
 import { run } from "./exec.mjs";
@@ -366,6 +370,28 @@ let nextSeq = 1;
 // duplicate" instead of silently dropping the live stream.
 const SEQ_EPOCH = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
 const sseClients = new Set();       // res handles
+// The desktop app's own connections (#1160): subscribed like any client, so
+// they receive every event, and ALSO kept here so they are never counted as a
+// page. The app reads the stream to draw its tray icon; if that counted as a
+// tab, the deck would believe a page was open whenever the app ran, and the
+// notifications a closed deck raises (block-notify.mjs) would never fire —
+// the one thing the app exists to deliver. See `pageCount`.
+const trayClients = new Set();
+
+/** Pages — deck tabs and the app's window — as opposed to the app's tray
+ *  connection, which is a reader and not somebody looking. */
+function pageCount() {
+  return sseClients.size - trayClients.size;
+}
+
+/** A notification for the desktop app to raise as itself, instead of the OS
+ *  helper raising it as Script Editor (osascript) or PowerShell. */
+function notifyTrays(title, body, { chime = null, who = null } = {}) {
+  // The app names itself above the notification, so the title is the session.
+  const line = `event: notify\ndata: ${JSON.stringify({ title: who ?? title, body, chime })}\n\n`;
+  for (const res of trayClients) writeSse(res, line);
+  return true;
+}
 
 let persistPath = null;             // absolute path to events.jsonl, or null
 
@@ -3438,6 +3464,7 @@ export function queuedBytes(res) {
  *  before they are subscribed — is a harmless no-op. */
 function dropSse(res) {
   sseClients.delete(res);
+  trayClients.delete(res);
   // Destroying the socket is what makes the request emit 'close', which is
   // where the ping interval is cleared.
   try { res.destroy(); } catch {}
@@ -3677,7 +3704,10 @@ let _prefs = { ...PREF_DEFAULTS };
 const _prefsRead = readPrefs().then(p => { _prefs = p; }).catch(() => {});
 
 const blockNotifier = createBlockNotifier({
-  notify: osNotify,
+  // The desktop app, while it is connected, raises the notification itself —
+  // under its own name, icon and permission, with a click that opens its
+  // window. Only when no app is listening does the OS helper speak.
+  notify: (title, body, meta) => (trayClients.size > 0 ? notifyTrays(title, body, meta) : osNotify(title, body)),
   product: PRODUCT,
   // A function, not a boolean: this is a switch a person flips from the sound
   // menu while the deck is running, and a mute that waited for a restart would
@@ -3815,7 +3845,17 @@ async function handlePresence(req, res) {
 // The engine is built once and told the settings; it opens and closes its own
 // sockets as those change. Nothing here touches a credential — see
 // lan-engine.mjs, which passes an opaque blob between two claude-swap commands.
+/** This machine's view of its tailnet, read through the Tailscale CLI — see
+ *  tailscale.mjs. Built whatever the switch says: the dialog asks it whether
+ *  Tailscale is here at all before anybody can turn discovery on. */
+const tailnet = createTailnet();
+
 const lanEngine = createEngine({
+  tailnet,
+  // Who holds the discovery port when it is taken, so the panel can say.
+  portHolder: () => portHolder(DISCOVERY_PORT),
+  // Where each broadcast would leave by, so none goes into a VPN tunnel.
+  routes: createRouteCheck(),
   // This deck's version and machine, for the decks it is paired with and
   // nobody else. RUNNING_VERSION rather than a fresh read, for the reason it
   // is read at import: it is what this process actually runs.
@@ -4023,6 +4063,11 @@ export function lanApplyFields(prefs, { load = false, env = process.env } = {})
     autoAccept: lan.autoAccept !== false,
     // Whether paired decks are told which shared account this one is on.
     shareActive: lan.shareActive !== false,
+    // Discovery over Tailscale, off unless somebody turned it on, and the two
+    // permissions that answer for the owner's own machines there.
+    tailscale: lan.tailscale === true,
+    tailscaleAsk: lan.tailscaleAsk !== false,
+    tailscaleAccept: lan.tailscaleAccept !== false,
     // Names somebody here gave other decks. The engine only hands them to
     // the page, so a change never restarts anything.
     aliases: lan.aliases && typeof lan.aliases === "object" ? lan.aliases : {},
@@ -4247,6 +4292,9 @@ function refreshReach() {
  *  else is in the group. No passphrase, for the reason prefsPayload gives. */
 function handleLanStatus(req, res) {
   refreshReach();
+  // Behind the answer, like the reach probe: the dialog's poll is what finds a
+  // Tailscale somebody installed while the deck was running.
+  if (lanEnabled(_prefs)) void tailnet.freshen(TAILNET_IDLE_MS);
   return send(res, 200, { ok: true, ...lanEngine.status(), reach: reachSaid });
 }
 
@@ -4547,7 +4595,7 @@ function pushEvent(raw, source, opts = {}) {
   // other means". The web notifier owns the case where a page exists, and this
   // owns the case where none does; the two never both fire, and neither has to
   // know the other exists. block-notify.mjs holds the gates and the cooldown.
-  blockNotifier.consider(raw, { clients: sseClients.size, replay: !!opts.replay });
+  blockNotifier.consider(raw, { clients: pageCount(), replay: !!opts.replay });
 
   // Whether a turn is running, for the away-update. Not from a replay: the log
   // is history, and a turn it shows open is one that ended in another process.
@@ -5300,7 +5348,7 @@ function handleSse(req, res) {
   // is already committed to a 200 and its own failure path is to hang up — so
   // start it, keep the router's contract of returning nothing, and make sure a
   // rejection ends the stream rather than the process.
-  resumeSse(req, res, lastId).catch(() => dropSse(res));
+  resumeSse(req, res, lastId, { tray: isTrayRequest(req) }).catch(() => dropSse(res));
 }
 
 /**
@@ -5314,7 +5362,17 @@ function handleSse(req, res) {
  * neither stream — a hole the client cannot even ask for again, its last id
  * having moved past it.
  */
-async function resumeSse(req, res, lastId) {
+/**
+ * Is this the desktop app's tray connection? Only with the deck's own token:
+ * a page cannot opt itself out of being counted, because that would let any
+ * tab switch on the closed-deck notifications over itself.
+ */
+function isTrayRequest(req) {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  return url.searchParams.get("role") === "tray" && presentsDeckToken(req.headers ?? {});
+}
+
+async function resumeSse(req, res, lastId, { tray = false } = {}) {
   let sentThrough = lastId;
   let ping = null;
   let closed = false;
@@ -5322,6 +5380,7 @@ async function resumeSse(req, res, lastId) {
     closed = true;
     if (ping) clearInterval(ping);
     sseClients.delete(res);
+    trayClients.delete(res);
   });
 
   for (;;) {
@@ -5393,6 +5452,7 @@ async function resumeSse(req, res, lastId) {
   // takes it back out of the set — the same exit writeSse uses.
   const flushed = writeResume(res, `event: replay-end\ndata: {}\n\n`);
   sseClients.add(res);
+  if (tray) trayClients.add(res);
   // Through writeSse like every other frame: on a client that has stopped
   // reading, the ping is the one thing still being written between events, and
   // it is what eventually reveals the socket as unrecoverable.
@@ -6576,7 +6636,9 @@ function handleHealth(_req, res) {
     ok: true,
     name: "agent-dag",
     seq: nextSeq - 1,
-    clients: sseClients.size,
+    clients: pageCount(),
+    // The desktop app's tray connections, which are not pages (#1160).
+    trays: trayClients.size,
     uptimeMs: Math.round(process.uptime() * 1000),
     workspace: _workspace,
     providers: _providers,

package/src/server/installer.mjs

@@ -5,6 +5,7 @@
 // sessions reach the same server through the rollout watcher instead, so one
 // running server still sees both CLIs. Re-runs are safe; entries are tagged
 // with __agent-dag and de-duped.
+import { hookRuntime } from "./app-host.mjs";
 import { readFile, mkdir, unlink, rename, open, stat, chmod, realpath, readlink, utimes } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { join, resolve, dirname } from "node:path";
@@ -464,7 +465,9 @@ export async function installHooks({ provider = "claude", beforeWrite = null } =
   const { settings: current, raw: before } = await readSettingsForWrite(cfg.settingsPath);
 
   const hookPath = await installHookScript(cfg.hookInstallDir);
-  const command = hookCommand(hookPath, provider);
+  // Through the desktop app's launcher when it started this deck — its own
+  // binary opens the app rather than running a script (app-host.mjs).
+  const command = hookCommand(hookPath, provider, hookRuntime());
   await ensureDir(cfg.ensureDir);
   // Discovery dir is shared across providers — always make sure it exists.
   await ensureDir(AGENT_DAG_DIR);