ccdeck 3.26.1 → 3.26.4

package/dist/web/index.html

@@ -44,7 +44,7 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CO8B_qBe.js"></script>
+    <script type="module" crossorigin src="/assets/index-CPHonXg4.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DlaHgzye.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.26.1",
+  "version": "3.26.4",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -45,7 +45,9 @@
     "3.23.3",
     "3.23.4",
     "3.26.0",
-    "3.26.1"
+    "3.26.1",
+    "3.26.3",
+    "3.26.4"
   ],
   "3.25.0": [
     {

package/src/server/deck-prefs.mjs

@@ -415,6 +415,48 @@ export async function updatePrefs(mutate, home = deckDataDir(), deps = {}) {
   return queued(() => save(mutate, home, deps));
 }
 
+/**
+ * The two `mutate`s the three callers above hand updatePrefs, named so that the
+ * callers and prefs-update-1041.test.ts run the same function. The suite used to
+ * carry its own copy of each closure and test the copy (#1168), which stays
+ * green however the one in index.mjs is edited.
+ */
+
+/** `lan.manual` with `entry` on the end, or no change when it is there already.
+ *  What `onDial` and the accept route both write. */
+export function withManualEntry(entry) {
+  return prev => {
+    const manual = Array.isArray(prev?.lan?.manual) ? prev.lan.manual : [];
+    return manual.includes(entry) ? null : { lan: { manual: [...manual, entry] } };
+  };
+}
+
+/**
+ * `lan.shared` with `key` on the end, or no change when it is already there.
+ *
+ * The tick an account gets when it ARRIVES over the local network (#1188): the
+ * group already has that login, so a deck that was just given one is as useful
+ * to the next machine as the deck that gave it. Only on arrival — an untick
+ * afterwards is the person's answer and nothing re-ticks it, because an account
+ * this deck already holds is never added again.
+ */
+export function withShared(key) {
+  return prev => {
+    const shared = Array.isArray(prev?.lan?.shared) ? prev.lan.shared : [];
+    return !key || shared.includes(key) ? null : { lan: { shared: [...shared, key] } };
+  };
+}
+
+/** `lan.aliases` with `fp` called `name`, or without `fp` when the name is
+ *  empty. The alias route's write; the whole map, rebuilt from the one read. */
+export function withAlias(fp, name) {
+  return prev => {
+    const next = { ...(prev?.lan?.aliases ?? {}) };
+    if (name) next[fp] = name; else delete next[fp];
+    return { lan: { aliases: next } };
+  };
+}
+
 /** One read-modify-write, behind every other one. Both entry points go through
  *  here so there is a single queue and a single merge. */
 function queued(job) {

package/src/server/index.mjs

@@ -34,7 +34,7 @@ import { createOutputWatch } from "./output-watch.mjs";
 import { RECAP_MARK, foldRecapLine } from "./session-recap.mjs";
 import { AWAY_BOOT_GRACE_MS, AWAY_RECHECK_MS, AWAY_TICK_MS, awayGate, awayUpdateStep } from "./auto-update.mjs";
 import { createPresence } from "./presence.mjs";
-import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, writePrefs } from "./deck-prefs.mjs";
+import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, withAlias, withManualEntry, withShared, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
 import { createTailnet, IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
 import { portHolder } from "./port-holder.mjs";
@@ -3962,6 +3962,19 @@ const lanEngine = createEngine({
     // listener had one is missing half of them — see forgetReach.
     forgetReach();
   },
+  // An account arrived from a paired deck, and this deck now offers it too
+  // (#1188). Written before the engine hears it, so a restart between the two
+  // leaves the tick on disk rather than only in the running engine's copy.
+  onShared: async key => {
+    try {
+      const before = _prefs;
+      _prefs = await updatePrefs(withShared(key));
+      if (_prefs?.lan?.shared === before?.lan?.shared) return;   // it was already ticked
+      await lanEngine.apply({ shared: _prefs.lan.shared });
+    } catch (err) {
+      console.error(`${PRODUCT}: lan sync could not share the account it just received:`, err?.message ?? err);
+    }
+  },
   // A deck was accepted or unpaired. Written straight through, because the
   // trusted list is the whole of who this deck will talk to and a list that
   // only existed in memory would drop every pairing on restart.
@@ -3982,10 +3995,7 @@ const lanEngine = createEngine({
       // is the WHOLE array, so a stale one wins. Pressing accept on a heard deck
       // at the moment an invite round fires this dropped the dialled address out
       // of `lan.manual`, which is the failure the comment above describes.
-      _prefs = await updatePrefs(prev => {
-        const manual = Array.isArray(prev?.lan?.manual) ? prev.lan.manual : [];
-        return manual.includes(entry) ? null : { lan: { manual: [...manual, entry] } };
-      });
+      _prefs = await updatePrefs(withManualEntry(entry));
       // AND RECONCILE THE ENGINE'S DIAL LIST with what was just written. The
       // disk is now right, but `setPeers` replaces the list wholesale from
       // `_prefs` on every settings write — so a write that raced this one, and
@@ -4360,12 +4370,7 @@ async function handleLanPeer(req, res) {
         // Inside the job, like `onDial` — the same whole-array patch computed
         // from the same stale copy, and the same address lost when two of them
         // land in one turn.
-        try {
-          _prefs = await updatePrefs(prev => {
-            const manual = Array.isArray(prev?.lan?.manual) ? prev.lan.manual : [];
-            return manual.includes(entry) ? null : { lan: { manual: [...manual, entry] } };
-          });
-        }
+        try { _prefs = await updatePrefs(withManualEntry(entry)); }
         catch { /* it is dialled this session; the next accept re-adds it */ }
       }
       return send(res, 200, { ok: true, added, ...lanEngine.status() });
@@ -4391,11 +4396,7 @@ async function handleLanPeer(req, res) {
     case "alias": {
       if (!isAliasKey(fp)) return send(res, 400, { ok: false, reason: "bad_request" });
       const name = cleanAlias(body.name);
-      _prefs = await updatePrefs(prev => {
-        const next = { ...(prev?.lan?.aliases ?? {}) };
-        if (name) next[fp] = name; else delete next[fp];
-        return { lan: { aliases: next } };
-      });
+      _prefs = await updatePrefs(withAlias(fp, name));
       await lanEngine.apply({ aliases: _prefs.lan.aliases });
       return send(res, 200, { ok: true, ...lanEngine.status() });
     }
@@ -6756,10 +6757,25 @@ export function requestUrl(rawUrl) {
 // So the Host check runs for every method now. What it asks is only the
 // rebinding question — did this request arrive addressed to a name that can
 // only ever be this machine — and it asks it of browser-shaped requests alone,
-// meaning anything carrying an Origin or fetch metadata. A client sending
-// neither is not a page and has no ambient authority to borrow: that is
-// hook/hook.js, a plain Node http.request from the user's own machine, and it
-// keeps reaching the deck under whatever name it used before.
+// meaning anything carrying an Origin, fetch metadata or a Referer. A client
+// sending none of them is not a page and has no ambient authority to borrow:
+// that is hook/hook.js, a plain Node http.request from the user's own machine,
+// and it keeps reaching the deck under whatever name it used before.
+//
+// THE REFERER IS ON THAT LIST because on one browser it is the only mark a page
+// leaves (#1168). A same-origin GET carries no Origin, and Safari 16.0-16.3
+// sends no Sec-Fetch-Site — the premise isAuthorizedDataRead's fallback is
+// built on — so a rebound page on that browser sent `Host: attacker.example:
+// 4317` and `Referer: http://attacker.example:4317/` and nothing else, was not
+// browser-shaped by the test as it stood, and was answered. Measured against a
+// running deck before this line changed: /api/health (the absolute workspace
+// path), /api/hook-challenge (the proof oracle, which handleHookChallenge says
+// a rebound page cannot see), /api/system/processes and the page itself all
+// answered 200. The guarded reads held only because isAuthorizedDataRead
+// happens to test the Host before it reads the Referer. No client of this
+// server that is not a browser sends a Referer — hook.js, the desktop app and
+// bin/ send none — so nothing that reached the deck before is turned away by
+// this, and the deck's own page names a loopback Host whatever it sends.
 //
 // Deliberately not part of this: the Sec-Fetch-Site test that isTrustedMutation
 // applies. `cross-site` on a read is an ordinary top-level navigation — a link
@@ -6767,9 +6783,10 @@ export function requestUrl(rawUrl) {
 // the deck's own UI on the deck's own origin, which is not an attack and used
 // to work. Rebinding does not need that test either: a rebound page's requests
 // report `same-origin`, and it is the Host that gives it away.
-export function isTrustedRead({ origin, host, secFetchSite } = {}) {
+export function isTrustedRead({ origin, host, secFetchSite, referer } = {}) {
   const browserShaped = (typeof origin === "string" && origin !== "")
-    || (typeof secFetchSite === "string" && secFetchSite.trim() !== "");
+    || (typeof secFetchSite === "string" && secFetchSite.trim() !== "")
+    || (typeof referer === "string" && referer.trim() !== "");
   if (!browserShaped) return true;
   return isLoopbackHost(host);
 }
@@ -7377,6 +7394,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       origin: req.headers.origin,
       host: req.headers.host,
       secFetchSite: req.headers["sec-fetch-site"],
+      referer: req.headers.referer,
     })) {
       return send(res, 403, { error: "cross-site request blocked" });
     }

package/src/server/lan-engine.mjs

@@ -194,9 +194,26 @@ export function heardCurrent(raw, list) {
  * Injected rather than imported so a test can run a whole round — two engines,
  * two fake stores, one real socket pair — without claude-swap on the machine.
  */
+/**
+ * Whether an account this round just placed is ticked for sharing here (#1188).
+ *
+ * ONLY AN ADD: a heal needed the tick to happen at all — roundWith asks for a
+ * heal only for an account this deck already shares — so there is nothing to
+ * add for one, and an account healed after somebody unticked it must not be
+ * ticked again behind them.
+ *
+ * ONLY FROM THE LOCAL NETWORK: the reasoning for the default is that the login
+ * came from the group and the group therefore has it, and a tailnet can reach
+ * further than one person's own machines. Sharing there stays a decision
+ * somebody makes rather than one an arrival makes for them.
+ */
+export function ticksOnArrival(step, via) {
+  return !!step?.key && step.action === "add" && via !== "tailscale";
+}
+
 export function createEngine({
   readAccounts, exportAccount, importAccount,
-  onChange, onError, onIdentity, onPort, onTrust, onDial, now = Date.now,
+  onChange, onError, onIdentity, onPort, onTrust, onDial, onShared, now = Date.now,
   /**
    * The UDP socket the beacon shouts through, injectable for the same reason
    * lan-socket exposes it — and for one more that only showed up in use.
@@ -351,6 +368,13 @@ export function createEngine({
    *  still be said to come over the tailnet or the local network — it has no
    *  address of its own here, and without this its row could not say which. */
   const spokeFrom = new Map();
+  /** Addresses this deck added because a paired deck called in from them and
+   *  nothing here dialled it — see learnCaller. Kept until a round proves the
+   *  address answers: one that does is an ordinary dialled peer from then on
+   *  and leaves this set; one that does not is a caller this deck cannot reach
+   *  back (a strict NAT, a one-way path), and its row is taken away again so it
+   *  reverts to "calls in" rather than failing every round. */
+  const calledBack = new Set();
   /**
    * When a connection from ANOTHER MACHINE last arrived on the sync listener.
    *
@@ -457,13 +481,59 @@ export function createEngine({
    *  connection's — see sessionKey. `ctx.send` seals whatever it is handed when
    *  both ends said they seal, so nothing below has to know which kind of deck
    *  asked — see frameChannel. */
+  /** Does this deck already hold an address it dials for `fp`? A beacon row it
+   *  still hears, or a typed/learned row that answered as that deck. When
+   *  neither is true, the only way it ever reaches that deck is if the deck
+   *  keeps calling — and a called deck is never pulled from. */
+  const dialsAlready = fp => {
+    if (beacon && [...beacon.peers.values()].some(p => p.fp === fp && stillListed(p, now()))) return true;
+    for (const [at, met] of learned) if (met?.fp === fp && manual.has(at)) return true;
+    return false;
+  };
+
+  /**
+   * A PAIRED DECK THAT CALLS IN, AND NOTHING HERE DIALS IT.
+   *
+   * Accounts move only toward the deck that dials — roundWith pulls, serve only
+   * answers — so a deck this one holds no address for can offer everything and
+   * this one takes nothing. It is the exact state a deck falls into when it
+   * cannot hear beacons (a firewall, or Tailscale holding the discovery port):
+   * every peer becomes one that only calls, and no account ever arrives.
+   *
+   * The call itself is the address. The peer connected FROM somewhere and said
+   * in its hello which port it LISTENS on, and that pair is dialable. Adding it
+   * makes the next round reach the caller and pull — the same dial-back that
+   * accepting a deck and joining by invite already do, extended to a peer that
+   * simply calls. In memory, like those two: a settings write clears it and the
+   * next call re-adds it, and nothing here writes an address to disk.
+   */
+  const learnCaller = ctx => {
+    const fp = ctx?.peerFp;
+    const at = ctx?.peerAddr;
+    const port = ctx?.peerPort;
+    if (!fp || !at || !port || !engine) return;
+    if (!trustedPeer(cfg.trusted, fp)) return;
+    if (dialsAlready(fp)) return;
+    // As a row the deck ADDED ITSELF, not one a person typed: capped like every
+    // other automatic row, and — through calledBack — taken away again if the
+    // address turns out not to answer. The caller is already trusted, so the
+    // round dials and pulls without a press; `typed` decides only the cap and
+    // the undo, never the trust. See roundWith.
+    if (engine.addPeer(at, port, { typed: false })) {
+      learned.set(`${at}:${port}`, { fp, name: trustedPeer(cfg.trusted, fp)?.name || "" });
+      calledBack.add(`${at}:${port}`);
+      onChange?.();
+    }
+  };
+
   const serve = async (msg, ctx) => {
     // Before the verbs, and for every one of them: something that proved it
     // holds a key this deck accepted is talking, now.
     if (ctx?.peerFp) {
       spokeAt.set(ctx.peerFp, now());
-      const from = String(ctx.sock?.remoteAddress ?? "").replace(/^::ffff:/, "");
+      const from = ctx.peerAddr || String(ctx.sock?.remoteAddress ?? "").replace(/^::ffff:/, "");
       if (from) spokeFrom.set(ctx.peerFp, from);
+      learnCaller(ctx);
     }
     try {
       if (msg.t === "manifest") {
@@ -562,6 +632,10 @@ export function createEngine({
   const waitingOnSomebody = () =>
     [...lastRound.values()].some(r => r?.error === "waiting for the other deck to accept this one");
 
+  /** How this deck reached that peer. A beacon row says so; a typed address is
+   *  read from the routing table, the way the peer list reads it. */
+  const viaOf = peer => peer.via ?? (routeTo(peer.addr) ? "tailscale" : "lan");
+
   /** Ask one peer what it has, and heal whatever it can heal. */
   const roundWith = async peer => {
     let conn = null;
@@ -633,6 +707,10 @@ export function createEngine({
       // from then on, because "Constantin-PC" is what the person who typed the
       // address was trying to reach.
       learned.set(`${peer.addr}:${peer.port}`, { fp: conn.peerFp, name: conn.peerName || "" });
+      // A DIAL-BACK THAT ANSWERED IS AN ORDINARY PEER NOW. It was on trial only
+      // until it proved the deck can reach it; from here it is dialled like any
+      // other and is no longer a candidate for the undo below. See learnCaller.
+      calledBack.delete(`${peer.addr}:${peer.port}`);
 
       // TRUST ON FIRST USE, AND ONLY FOR AN ADDRESS SOMEBODY NAMED. Reaching a
       // deck we have no pin for used to mean the person at this keyboard put
@@ -738,6 +816,22 @@ export function createEngine({
         // than as a healthy one.
         const got = await importAccount(blob, step);
         const ok = got === true || got?.ok === true;
+        // AN ACCOUNT THAT ARRIVED HERE IS SHARED ONWARD (#1188). People forget
+        // to tick it, and a group where one machine can heal the others and the
+        // others can heal nobody is the shape that costs them: the second
+        // machine to lose the same login has to go back to the first, which may
+        // be asleep or on another network. Nothing new is exposed — the login
+        // came FROM the group, so the group has it.
+        //
+        // ONLY AN ADD, and only from the local network. A heal already needed
+        // the tick to happen at all (the filter above), so there is nothing to
+        // add for one; and a tailnet reaches further than the person's own
+        // machines, which is a decision they make for themselves rather than
+        // one an arrival makes for them.
+        if (ok && ticksOnArrival(step, viaOf(peer))) {
+          try { await onShared?.(step.key); }
+          catch { /* the account is here; the tick is retried the next time one arrives */ }
+        }
         done.push({ ...step, ok, why: ok ? null : (got?.why ?? "import failed") });
       }
       lastRound.set(peer.fp, { at: now(), name: peer.name, offered: theirs.accounts.length, done });
@@ -745,6 +839,20 @@ export function createEngine({
       return done;
     } catch (err) {
       lastRound.set(peer.fp, { at: now(), name: peer.name, error: err.message });
+      // A DIAL-BACK THAT NEVER ANSWERED IS TAKEN AWAY AGAIN. The address came
+      // from a paired deck's inbound call, and this round was the test of
+      // whether the call can be returned. It could not — a strict NAT, a
+      // one-way path — so the row is removed rather than left to fail every
+      // minute, and the peer goes back to "calls in". Its next call tries once
+      // more. A row that answered has already left calledBack above.
+      const at = `${peer.addr}:${peer.port}`;
+      if (calledBack.has(at)) {
+        calledBack.delete(at);
+        manual.delete(at);
+        learned.delete(at);
+        lastRound.delete(peer.fp);
+        onChange?.();
+      }
       return [];
     } finally {
       conn?.sock?.destroy();

package/src/server/lan-reach.mjs

@@ -31,25 +31,35 @@
 // suite can run it on any platform. That is the same division lan-sync.mjs and
 // lan-socket.mjs already keep, for the same reason.
 
-/** What the probe asks Windows for. Three reads, none of them privileged —
- *  measured: `Get-NetConnectionProfile`, `Get-NetFirewallProfile` and
- *  `Get-NetFirewallApplicationFilter` all answer for an ordinary user, while
- *  `Get-NetFirewallPortFilter` returns "Access is denied". So the rule this
- *  looks for is scoped to a PROGRAM rather than to a port, which is also the
- *  only kind that keeps working: the sync listener's port is ephemeral and is
- *  a different number after every restart. */
+/** What the probe asks Windows for. `Get-NetConnectionProfile` and
+ *  `Get-NetFirewallProfile` answer for an ordinary user; `Get-NetFirewallPortFilter`
+ *  returns "Access is denied", which is why the rule this looks for is scoped
+ *  to a PROGRAM rather than a port — also the only kind that keeps working,
+ *  since the sync listener's port is ephemeral and different after every
+ *  restart. `Get-NetFirewallApplicationFilter` answers on many machines but is
+ *  denied on some domain-managed ones, so it is wrapped and its failure carried
+ *  through as `rulesReadable=$false` rather than silently read as "no rule". */
 export const PROBE_PS = [
   "$ErrorActionPreference='SilentlyContinue'",
   "$nets = @(Get-NetConnectionProfile | ForEach-Object { [pscustomobject]@{ alias=$_.InterfaceAlias; category=[string]$_.NetworkCategory; v4=[string]$_.IPv4Connectivity } })",
   "$profiles = @(Get-NetFirewallProfile | ForEach-Object { [pscustomobject]@{ name=[string]$_.Name; enabled=[bool]$_.Enabled } })",
-  "$rules = @(Get-NetFirewallApplicationFilter | Where-Object { $_.Program -eq $env:CCDECK_EXE } | ForEach-Object { $_ | Get-NetFirewallRule } | ForEach-Object { [pscustomobject]@{ direction=[string]$_.Direction; action=[string]$_.Action; enabled=[bool]$_.Enabled; profile=[string]$_.Profile } })",
+  // AN EMPTY LIST HAS TWO MEANINGS, AND THEY ARE OPPOSITE. `Get-NetFirewallApplicationFilter`
+  // answers for an ordinary user on some machines and throws "Access is denied"
+  // on others (a domain-managed box, measured). With errors silenced it came
+  // back empty either way — and empty was read as "no rule", so a machine whose
+  // rule the deck simply could not see was told, wrongly, that it had none, and
+  // handed a command that added one more every time it was run. Wrapped so the
+  // throw is caught and reported as `rulesReadable=$false`: the difference
+  // between "there is no rule" and "I was not allowed to look".
+  "$rulesReadable=$true",
+  "try { $rules = @(Get-NetFirewallApplicationFilter -ErrorAction Stop | Where-Object { $_.Program -eq $env:CCDECK_EXE } | ForEach-Object { $_ | Get-NetFirewallRule } | ForEach-Object { [pscustomobject]@{ direction=[string]$_.Direction; action=[string]$_.Action; enabled=[bool]$_.Enabled; profile=[string]$_.Profile } }) } catch { $rulesReadable=$false; $rules=@() }",
   // WHICH INTERFACE IS THE LAN, asked of the routing table rather than guessed
   // from a name. The beacon goes to 255.255.255.255, so the interface that
   // carries the broadcast IS the one this feature lives or dies on — and on a
   // machine with Tailscale beside wifi the two have different categories, so
   // picking the wrong one reports Private and clears a machine that is blocked.
   "$bcast = [string](Find-NetRoute -RemoteIPAddress 255.255.255.255 | Select-Object -First 1 -ExpandProperty InterfaceAlias)",
-  "[pscustomobject]@{ nets=$nets; profiles=$profiles; rules=$rules; bcast=$bcast } | ConvertTo-Json -Depth 4 -Compress",
+  "[pscustomobject]@{ nets=$nets; profiles=$profiles; rules=$rules; rulesReadable=$rulesReadable; bcast=$bcast } | ConvertTo-Json -Depth 4 -Compress",
 ].join("; ");
 
 /**
@@ -88,6 +98,9 @@ export function readProbe(stdout) {
       enabled: r.enabled === true,
       profile: typeof r.profile === "string" ? r.profile : "",
     })),
+    // True unless the probe said it could not read the rules — and true for an
+    // older probe that did not report it, which kept working as it always did.
+    rulesReadable: raw.rulesReadable !== false,
     bcast: typeof raw.bcast === "string" ? raw.bcast.trim() : "",
   };
 }
@@ -479,6 +492,16 @@ export function reachability({ platform, probe, aliases = [], exePath = "", inbo
   if (ruleCovers(probe.rules, name)) {
     return { blocked: false, why: "rule present", category, alias: net?.alias ?? "" };
   }
+  // COULD NOT READ THE RULES, SO CANNOT SAY THERE IS NONE. An empty list here
+  // is "Access is denied", not "no rule" (see PROBE_PS), so claiming a missing
+  // rule would be a guess dressed as a read — and the command that guess hands
+  // over adds a duplicate rule on a machine that may already be covered. On a
+  // Public network the fix is the category, which was read reliably, so that
+  // verdict still stands; anywhere else the honest answer is the measurement,
+  // which `refreshReach` falls back to when this returns null.
+  // Only an EMPTY list is ambiguous — a rule in hand was plainly readable,
+  // whatever the flag says.
+  if (!probe.rulesReadable && probe.rules.length === 0 && name !== "Public") return null;
   return {
     blocked: true,
     why: "no inbound rule",

package/src/server/lan-socket.mjs

@@ -967,6 +967,15 @@ export function createSyncServer({
       if (!frame) return refuse("a sealed frame did not open");
       handlers?.(frame, {
         sock, peerFp, key, sealed: !!chan,
+        // Where this deck dials the caller BACK. A deck that only ever calls in
+        // is one this deck holds no address for, so it could receive nothing —
+        // accounts move only toward the deck that dials (see roundWith). The
+        // address the caller connected from, and the port it said it listens
+        // on, are a dialable pair the engine can add so the next round reaches
+        // it. `peerAddr` is the source of this very connection; `peerPort` came
+        // from the hello, not the ephemeral source port.
+        peerAddr: from(sock),
+        peerPort,
         send: obj => sendFrame(sock, chan ? chan.wrap(obj) : obj),
       });
     }, refuse));