ccdeck 3.26.0 → 3.26.3

package/dist/web/index.html

@@ -44,7 +44,7 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DfvLgdJz.js"></script>
+    <script type="module" crossorigin src="/assets/index-DZzBylIp.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DlaHgzye.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.26.0",
+  "version": "3.26.3",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -44,7 +44,9 @@
     "3.23.2",
     "3.23.3",
     "3.23.4",
-    "3.26.0"
+    "3.26.0",
+    "3.26.1",
+    "3.26.3"
   ],
   "3.25.0": [
     {

package/src/server/ccusage.mjs

@@ -11,6 +11,7 @@
 // the current call always serves from the already-installed copy. If the
 // managed install is missing/broken we fall back to the old npx path so the
 // feature still works on a fresh machine.
+import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path from "node:path";
@@ -738,12 +739,43 @@ function discardDamagedInstall(runner, err) {
 export const userSpec = (file, args = [], platform = process.platform) =>
   spawnSpec(file, args, platform);
 
+/**
+ * The platform binary ccusage's own cli.js would run, resolved the way cli.js
+ * resolves it (`@ccusage/ccusage-<platform>-<arch>/bin/ccusage[.exe]`, from
+ * the package's own directory), or null when there is none.
+ *
+ * WINDOWS ONLY, and for one reason: cli.js starts that binary WITHOUT hiding
+ * its console. The deck runs with no console of its own (detached, or inside
+ * the desktop app), so the binary is given a new one — and with Windows
+ * Terminal as the default terminal that is a window flashing up on every
+ * usage read, measured on a Windows 10 box as a CASCADIA_HOSTING_WINDOW_CLASS
+ * hosting ccusage. Running the binary directly, with windowsHide, is what
+ * cli.js does minus the window. Elsewhere nothing flashes, and the wrapper
+ * stays in the path it has always been in.
+ *
+ * Exported for tests; `resolve` is injectable.
+ */
+export function nativeCcusage(entry, platform = process.platform, arch = process.arch, resolve = null) {
+  if (platform !== "win32" || typeof entry !== "string" || !entry) return null;
+  const pkg = arch === "arm64" ? "@ccusage/ccusage-win32-arm64" : arch === "x64" ? "@ccusage/ccusage-win32-x64" : null;
+  if (!pkg) return null;
+  try {
+    const req = resolve ?? createRequire(entry).resolve;
+    return req(`${pkg}/bin/ccusage.exe`);
+  } catch {
+    return null;
+  }
+}
+
 // One attempt with one runner. No branch gets a shell. The managed install is
 // `node <entry> …`, which never needed one; the user's own copy and the npx
 // fallback are routed through spawnSpec instead — see npxSpec and userSpec, and
 // note that `args` here ends in whatever /api/ccusage was asked for.
 function runOnce(runner, args) {
-  const { file, args: full, opts } = runner.kind === "node"
+  const native = runner.kind === "node" ? nativeCcusage(runner.entry) : null;
+  const { file, args: full, opts } = native
+    ? { file: native, args, opts: {} }
+    : runner.kind === "node"
     ? { file: process.execPath, args: [runner.entry, ...args], opts: {} }
     : runner.kind === "path"
       ? userSpec(runner.file, args)

package/src/server/lan-reach.mjs

@@ -31,25 +31,35 @@
 // suite can run it on any platform. That is the same division lan-sync.mjs and
 // lan-socket.mjs already keep, for the same reason.
 
-/** What the probe asks Windows for. Three reads, none of them privileged —
- *  measured: `Get-NetConnectionProfile`, `Get-NetFirewallProfile` and
- *  `Get-NetFirewallApplicationFilter` all answer for an ordinary user, while
- *  `Get-NetFirewallPortFilter` returns "Access is denied". So the rule this
- *  looks for is scoped to a PROGRAM rather than to a port, which is also the
- *  only kind that keeps working: the sync listener's port is ephemeral and is
- *  a different number after every restart. */
+/** What the probe asks Windows for. `Get-NetConnectionProfile` and
+ *  `Get-NetFirewallProfile` answer for an ordinary user; `Get-NetFirewallPortFilter`
+ *  returns "Access is denied", which is why the rule this looks for is scoped
+ *  to a PROGRAM rather than a port — also the only kind that keeps working,
+ *  since the sync listener's port is ephemeral and different after every
+ *  restart. `Get-NetFirewallApplicationFilter` answers on many machines but is
+ *  denied on some domain-managed ones, so it is wrapped and its failure carried
+ *  through as `rulesReadable=$false` rather than silently read as "no rule". */
 export const PROBE_PS = [
   "$ErrorActionPreference='SilentlyContinue'",
   "$nets = @(Get-NetConnectionProfile | ForEach-Object { [pscustomobject]@{ alias=$_.InterfaceAlias; category=[string]$_.NetworkCategory; v4=[string]$_.IPv4Connectivity } })",
   "$profiles = @(Get-NetFirewallProfile | ForEach-Object { [pscustomobject]@{ name=[string]$_.Name; enabled=[bool]$_.Enabled } })",
-  "$rules = @(Get-NetFirewallApplicationFilter | Where-Object { $_.Program -eq $env:CCDECK_EXE } | ForEach-Object { $_ | Get-NetFirewallRule } | ForEach-Object { [pscustomobject]@{ direction=[string]$_.Direction; action=[string]$_.Action; enabled=[bool]$_.Enabled; profile=[string]$_.Profile } })",
+  // AN EMPTY LIST HAS TWO MEANINGS, AND THEY ARE OPPOSITE. `Get-NetFirewallApplicationFilter`
+  // answers for an ordinary user on some machines and throws "Access is denied"
+  // on others (a domain-managed box, measured). With errors silenced it came
+  // back empty either way — and empty was read as "no rule", so a machine whose
+  // rule the deck simply could not see was told, wrongly, that it had none, and
+  // handed a command that added one more every time it was run. Wrapped so the
+  // throw is caught and reported as `rulesReadable=$false`: the difference
+  // between "there is no rule" and "I was not allowed to look".
+  "$rulesReadable=$true",
+  "try { $rules = @(Get-NetFirewallApplicationFilter -ErrorAction Stop | Where-Object { $_.Program -eq $env:CCDECK_EXE } | ForEach-Object { $_ | Get-NetFirewallRule } | ForEach-Object { [pscustomobject]@{ direction=[string]$_.Direction; action=[string]$_.Action; enabled=[bool]$_.Enabled; profile=[string]$_.Profile } }) } catch { $rulesReadable=$false; $rules=@() }",
   // WHICH INTERFACE IS THE LAN, asked of the routing table rather than guessed
   // from a name. The beacon goes to 255.255.255.255, so the interface that
   // carries the broadcast IS the one this feature lives or dies on — and on a
   // machine with Tailscale beside wifi the two have different categories, so
   // picking the wrong one reports Private and clears a machine that is blocked.
   "$bcast = [string](Find-NetRoute -RemoteIPAddress 255.255.255.255 | Select-Object -First 1 -ExpandProperty InterfaceAlias)",
-  "[pscustomobject]@{ nets=$nets; profiles=$profiles; rules=$rules; bcast=$bcast } | ConvertTo-Json -Depth 4 -Compress",
+  "[pscustomobject]@{ nets=$nets; profiles=$profiles; rules=$rules; rulesReadable=$rulesReadable; bcast=$bcast } | ConvertTo-Json -Depth 4 -Compress",
 ].join("; ");
 
 /**
@@ -88,6 +98,9 @@ export function readProbe(stdout) {
       enabled: r.enabled === true,
       profile: typeof r.profile === "string" ? r.profile : "",
     })),
+    // True unless the probe said it could not read the rules — and true for an
+    // older probe that did not report it, which kept working as it always did.
+    rulesReadable: raw.rulesReadable !== false,
     bcast: typeof raw.bcast === "string" ? raw.bcast.trim() : "",
   };
 }
@@ -171,15 +184,31 @@ export function ruleCovers(rules, profileName) {
  * wrong one for the router at home, and this module cannot tell which one
  * somebody is sitting in. The panel says so beside it.
  */
-export function fixSteps({ category, alias, exePath }) {
+export function fixSteps({ category, alias, exePath, rules = [] }) {
   const steps = [];
-  if (profileFor(category) === "Public" && alias) {
+  const name = profileFor(category);
+  if (name === "Public" && alias) {
     steps.push(`Set-NetConnectionProfile -InterfaceAlias "${alias}" -NetworkCategory Private`);
   }
-  steps.push(
-    "New-NetFirewallRule -DisplayName \"ccdeck (local network)\" -Direction Inbound"
-    + ` -Program "${exePath}" -Action Allow -Profile Private`,
-  );
+  // THE PROFILE OF THE NETWORK THE DECK IS ON, NOT ALWAYS PRIVATE. A company
+  // LAN joined to a domain is `DomainAuthenticated`, which the firewall answers
+  // with its Domain profile, and a rule scoped to Private never applies there.
+  // Measured on a Windows box whose Ethernet is DomainAuthenticated: the rule
+  // was pasted, the panel went on saying there was none — correctly — and a
+  // second paste made a second rule that did nothing either. Domain and
+  // Private together, so a laptop that goes home keeps working there too.
+  // Public is never added: a Public network gets the category line above.
+  const profile = name === "Domain" ? "Domain,Private" : "Private";
+  // AND A RULE THAT IS ALREADY THERE IS WIDENED, NOT JOINED BY ANOTHER. The
+  // probe only returns rules for this program, so an inbound allow rule in
+  // `rules` is one of ours on the wrong profile, and a new rule beside it is
+  // the duplicate this was reported with.
+  const ours = (Array.isArray(rules) ? rules : [])
+    .some(r => r?.enabled && String(r.direction).toLowerCase() === "inbound" && String(r.action).toLowerCase() === "allow");
+  steps.push(ours
+    ? `Get-NetFirewallApplicationFilter -Program "${exePath}" | Get-NetFirewallRule | Set-NetFirewallRule -Profile ${profile}`
+    : "New-NetFirewallRule -DisplayName \"ccdeck (local network)\" -Direction Inbound"
+      + ` -Program "${exePath}" -Action Allow -Profile ${profile}`);
   return steps;
 }
 
@@ -463,6 +492,16 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
   if (ruleCovers(probe.rules, name)) {
     return { blocked: false, why: "rule present", category, alias: net?.alias ?? "" };
   }
+  // COULD NOT READ THE RULES, SO CANNOT SAY THERE IS NONE. An empty list here
+  // is "Access is denied", not "no rule" (see PROBE_PS), so claiming a missing
+  // rule would be a guess dressed as a read — and the command that guess hands
+  // over adds a duplicate rule on a machine that may already be covered. On a
+  // Public network the fix is the category, which was read reliably, so that
+  // verdict still stands; anywhere else the honest answer is the measurement,
+  // which `refreshReach` falls back to when this returns null.
+  // Only an EMPTY list is ambiguous — a rule in hand was plainly readable,
+  // whatever the flag says.
+  if (!probe.rulesReadable && probe.rules.length === 0 && name !== "Public") return null;
   return {
     blocked: true,
     why: "no inbound rule",
@@ -477,8 +516,10 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
     // workaround below obvious rather than magic.
     text: name === "Public"
       ? "This network is set to Public, and Windows drops what other decks send. They can still hear this deck — that is why one of them may already show it."
-      : "Windows has no inbound rule for this deck, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine.",
-    steps: fixSteps({ category, alias: net?.alias ?? "", exePath }),
+      : name === "Domain" && probe.rules.length
+        ? "Windows lets this deck in on Private networks only, and this one is a company (Domain) network, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine."
+        : "Windows has no inbound rule for this deck, so it drops what other decks send. They can still hear it — that is why one of them may already show this machine.",
+    steps: fixSteps({ category, alias: net?.alias ?? "", exePath, rules: probe.rules }),
   };
 }