ccdeck 3.26.0 → 3.26.1

package/dist/web/index.html

@@ -44,7 +44,7 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DfvLgdJz.js"></script>
+    <script type="module" crossorigin src="/assets/index-CO8B_qBe.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DlaHgzye.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.26.0",
+  "version": "3.26.1",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -44,7 +44,8 @@
     "3.23.2",
     "3.23.3",
     "3.23.4",
-    "3.26.0"
+    "3.26.0",
+    "3.26.1"
   ],
   "3.25.0": [
     {

package/src/server/ccusage.mjs

@@ -11,6 +11,7 @@
 // the current call always serves from the already-installed copy. If the
 // managed install is missing/broken we fall back to the old npx path so the
 // feature still works on a fresh machine.
+import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
@@ -738,12 +739,43 @@ function discardDamagedInstall(runner, err) {
 export const userSpec = (file, args = [], platform = process.platform) =>
   spawnSpec(file, args, platform);
 
+/**
+ * The platform binary ccusage's own cli.js would run, resolved the way cli.js
+ * resolves it (`@ccusage/ccusage-<platform>-<arch>/bin/ccusage[.exe]`, from
+ * the package's own directory), or null when there is none.
+ *
+ * WINDOWS ONLY, and for one reason: cli.js starts that binary WITHOUT hiding
+ * its console. The deck runs with no console of its own (detached, or inside
+ * the desktop app), so the binary is given a new one — and with Windows
+ * Terminal as the default terminal that is a window flashing up on every
+ * usage read, measured on a Windows 10 box as a CASCADIA_HOSTING_WINDOW_CLASS
+ * hosting ccusage. Running the binary directly, with windowsHide, is what
+ * cli.js does minus the window. Elsewhere nothing flashes, and the wrapper
+ * stays in the path it has always been in.
+ *
+ * Exported for tests; `resolve` is injectable.
+ */
+export function nativeCcusage(entry, platform = process.platform, arch = process.arch, resolve = null) {
+  if (platform !== "win32" || typeof entry !== "string" || !entry) return null;
+  const pkg = arch === "arm64" ? "@ccusage/ccusage-win32-arm64" : arch === "x64" ? "@ccusage/ccusage-win32-x64" : null;
+  if (!pkg) return null;
+  try {
+    const req = resolve ?? createRequire(entry).resolve;
+    return req(`${pkg}/bin/ccusage.exe`);
+  } catch {
+    return null;
+  }
+}
+
 // One attempt with one runner. No branch gets a shell. The managed install is
 // `node <entry> …`, which never needed one; the user's own copy and the npx
 // fallback are routed through spawnSpec instead — see npxSpec and userSpec, and
 // note that `args` here ends in whatever /api/ccusage was asked for.
 function runOnce(runner, args) {
-  const { file, args: full, opts } = runner.kind === "node"
+  const native = runner.kind === "node" ? nativeCcusage(runner.entry) : null;
+  const { file, args: full, opts } = native
+    ? { file: native, args, opts: {} }
+    : runner.kind === "node"
     ? { file: process.execPath, args: [runner.entry, ...args], opts: {} }
     : runner.kind === "path"
       ? userSpec(runner.file, args)

package/src/server/lan-reach.mjs

@@ -171,15 +171,31 @@ export function ruleCovers(rules, profileName) {
  * wrong one for the router at home, and this module cannot tell which one
  * somebody is sitting in. The panel says so beside it.
  */
-export function fixSteps({ category, alias, exePath }) {
+export function fixSteps({ category, alias, exePath, rules = [] }) {
   const steps = [];
-  if (profileFor(category) === "Public" && alias) {
+  const name = profileFor(category);
+  if (name === "Public" && alias) {
     steps.push(`Set-NetConnectionProfile -InterfaceAlias "${alias}" -NetworkCategory Private`);
   }
-  steps.push(
-    "New-NetFirewallRule -DisplayName \"ccdeck (local network)\" -Direction Inbound"
-    + ` -Program "${exePath}" -Action Allow -Profile Private`,
-  );
+  // THE PROFILE OF THE NETWORK THE DECK IS ON, NOT ALWAYS PRIVATE. A company
+  // LAN joined to a domain is `DomainAuthenticated`, which the firewall answers
+  // with its Domain profile, and a rule scoped to Private never applies there.
+  // Measured on a Windows box whose Ethernet is DomainAuthenticated: the rule
+  // was pasted, the panel went on saying there was none — correctly — and a
+  // second paste made a second rule that did nothing either. Domain and
+  // Private together, so a laptop that goes home keeps working there too.
+  // Public is never added: a Public network gets the category line above.
+  const profile = name === "Domain" ? "Domain,Private" : "Private";
+  // AND A RULE THAT IS ALREADY THERE IS WIDENED, NOT JOINED BY ANOTHER. The
+  // probe only returns rules for this program, so an inbound allow rule in
+  // `rules` is one of ours on the wrong profile, and a new rule beside it is
+  // the duplicate this was reported with.
+  const ours = (Array.isArray(rules) ? rules : [])
+    .some(r => r?.enabled && String(r.direction).toLowerCase() === "inbound" && String(r.action).toLowerCase() === "allow");
+  steps.push(ours
+    ? `Get-NetFirewallApplicationFilter -Program "${exePath}" | Get-NetFirewallRule | Set-NetFirewallRule -Profile ${profile}`
+    : "New-NetFirewallRule -DisplayName \"ccdeck (local network)\" -Direction Inbound"
+      + ` -Program "${exePath}" -Action Allow -Profile ${profile}`);
   return steps;
 }
 
@@ -477,8 +493,10 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
     // workaround below obvious rather than magic.
     text: name === "Public"
       ? "This network is set to Public, and Windows drops what other decks send. They can still hear this deck — that is why one of them may already show it."
-      : "Windows has no inbound rule for this deck, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine.",
-    steps: fixSteps({ category, alias: net?.alias ?? "", exePath }),
+      : name === "Domain" && probe.rules.length
+        ? "Windows lets this deck in on Private networks only, and this one is a company (Domain) network, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine."
+        : "Windows has no inbound rule for this deck, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine.",
+    steps: fixSteps({ category, alias: net?.alias ?? "", exePath, rules: probe.rules }),
   };
 }