ccdeck 3.26.3 → 3.26.5

package/dist/web/index.html

@@ -44,7 +44,7 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-DZzBylIp.js"></script>
+    <script type="module" crossorigin src="/assets/index-D4fPrztm.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DlaHgzye.css">
   </head>
   <body>

package/hook/hook.js

@@ -357,13 +357,15 @@ function sameProof(got, want) {
 //
 // They are now separated by a barrier: every target is challenged, then the
 // election is decided, then the payload goes out (#695). The worst case is
-// unchanged — the challenges run in parallel, so it is still one 400ms deadline
-// followed by one 1000ms deadline. What the barrier does cost is that an honest
-// deck's POST waits for the slowest challenge in the set, which only matters
-// when some OTHER record's port accepts a connection and then says nothing. A
-// ghost port with nothing behind it refuses instantly and delays no one; one
-// with something silent behind it costs both deadlines once, and its record is
-// then forgotten if no deck has been keeping it — see forgetIfAbandoned.
+// unchanged — the challenges run in parallel, so it is still one challenge's
+// two 400ms attempts followed by one 1000ms deadline, and each 400ms bounds the
+// whole answer rather than a silence in it (see prove). What the barrier does
+// cost is that an honest deck's POST waits for the slowest challenge in the
+// set, which only matters when some OTHER record's port accepts a connection
+// and then does not answer in time. A ghost port with nothing behind it refuses
+// instantly and delays no one; one with something slow or silent behind it
+// costs both attempts once, and its record is then forgotten if no deck has
+// been keeping it — see forgetIfAbandoned.
 const CHALLENGE_TIMEOUT_MS = 400;
 const POST_TIMEOUT_MS = 1000;
 
@@ -423,6 +425,8 @@ const CAP_MS = 1900;
  */
 function prove(d, cb, attempt = 0) {
   let settled = false;
+  // Armed once the request is out, and cleared by whichever verdict comes first.
+  let deadline = null;
   // A DEADLINE IS NOT AN ANSWER, and the difference is worth one retry.
   //
   // A wrong proof, a refused connection and a 404 are all verdicts: that port
@@ -444,7 +448,12 @@ function prove(d, cb, attempt = 0) {
     settled = true;                        // this attempt is over; the next owns `cb`
     prove(d, cb, attempt + 1);
   };
-  const finish = (ok, why = null) => { if (settled) return; settled = true; cb(ok, why); };
+  const finish = (ok, why = null) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(deadline);
+    cb(ok, why);
+  };
 
   if (!requiresProof(d)) return finish(true);
 
@@ -456,7 +465,6 @@ function prove(d, cb, attempt = 0) {
     port: d.port,
     path: `/api/hook-challenge?nonce=${nonce}`,
     method: "GET",
-    timeout: CHALLENGE_TIMEOUT_MS,
   }, res => {
     if (res.statusCode !== 200) { res.resume(); return res.on("end", () => finish(false)); }
     let answer = "";
@@ -476,12 +484,26 @@ function prove(d, cb, attempt = 0) {
       finish(sameProof(proof, want));
     });
   });
-  // `destroy()` on a timeout makes 'error' fire with ECONNRESET, so the two
-  // handlers have to agree on which of them is speaking: `timedOut` is what
-  // tells a deadline apart from a refusal.
-  let timedOut = false;
-  req.on("error", () => { if (timedOut) retryOnTimeout(); else finish(false); });
-  req.on("timeout", () => { timedOut = true; req.destroy(); });
+  req.on("error", () => finish(false));
+  // THE DEADLINE IS ON THE WHOLE ANSWER, not on the silences in it (#1172).
+  //
+  // This was http.request's `timeout`, which is an IDLE timeout: it fires only
+  // after that long with no bytes either way. A port that answers one byte
+  // every 150ms is never idle and never reaches the 4096-byte cap above, so its
+  // prove() never settled — and proveTargets waits for every target before
+  // anything is posted. Measured with an honest deck beside such a port: the
+  // hook ran to CAP_MS at 1938ms and the deck saw its challenge and no event,
+  // on every tool call for as long as the record stood, and the record was
+  // never forgotten either, because the "deadline" verdict forgetIfAbandoned
+  // needs never came.
+  //
+  // The idle timeout had a second hole, and a port that sends its status line
+  // and then goes quiet fell into it: once a response has begun, destroying the
+  // request raises no 'error' on it, so the verdict that used to ride on that
+  // event never arrived either. So the timer gives the verdict itself, and
+  // gives it first: the destroy's own 'error', if it raises one, finds this
+  // attempt already over.
+  deadline = setTimeout(() => { retryOnTimeout(); req.destroy(); }, CHALLENGE_TIMEOUT_MS);
   req.end();
 }
 
@@ -686,11 +708,30 @@ function post(d, body, persists, done) {
     finish(res.statusCode >= 200 && res.statusCode < 300);
   });
   req.on("finish", () => { sent = true; });
-  // `destroy()` on a timeout makes 'error' fire with ECONNRESET, as it does in
-  // prove(), so `timedOut` is what tells this process giving up apart from the
-  // writer hanging up.
-  req.on("error", () => finish(false, timedOut && sent ? "deadline" : null));
-  req.on("timeout", () => { timedOut = true; req.destroy(); });
+  // `destroy()` on a timeout makes 'error' fire with ECONNRESET — the status
+  // line has not arrived, or it would have settled this already — so `timedOut`
+  // is what tells this process giving up apart from the writer hanging up.
+  //
+  // AND THE BODY'S STATE IS READ WHEN THE DEADLINE FIRES, NOT WHEN THE ERROR
+  // ARRIVES (#1172). `timedOut && sent` was evaluated in the 'error' handler,
+  // and by the time that runs the answer is always yes: destroying a request
+  // that has been end()ed finalises its writable, which emits 'finish' — so
+  // `sent` flips to true on the way out of req.destroy(), one tick before the
+  // 'error' it causes. Measured on Node 22 against a listener that takes the
+  // headers and then stops reading, with 256MB still queued:
+  //
+  //   TIMEOUT  sent=false  writableLength=268435608
+  //   FINISH   writableFinished=true  pending=0
+  //   ERROR    ECONNRESET  sent=true      <- verdict "deadline"
+  //
+  // which made every deadline a "deadline" and left the paragraph above
+  // describing a branch that could not be taken: a writer wedged mid-read kept
+  // a log it had not received, and the deck behind it — which could have
+  // written the line — was never asked. The snapshot is the rule that paragraph
+  // states, taken at the only moment it is still true.
+  let sentByDeadline = false;
+  req.on("error", () => finish(false, timedOut && sentByDeadline ? "deadline" : null));
+  req.on("timeout", () => { timedOut = true; sentByDeadline = sent; req.destroy(); });
   req.write(body);
   req.end();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.26.3",
+  "version": "3.26.5",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -46,7 +46,9 @@
     "3.23.4",
     "3.26.0",
     "3.26.1",
-    "3.26.3"
+    "3.26.3",
+    "3.26.4",
+    "3.26.5"
   ],
   "3.25.0": [
     {

package/src/server/deck-prefs.mjs

@@ -415,6 +415,48 @@ export async function updatePrefs(mutate, home = deckDataDir(), deps = {}) {
   return queued(() => save(mutate, home, deps));
 }
 
+/**
+ * The two `mutate`s the three callers above hand updatePrefs, named so that the
+ * callers and prefs-update-1041.test.ts run the same function. The suite used to
+ * carry its own copy of each closure and test the copy (#1168), which stays
+ * green however the one in index.mjs is edited.
+ */
+
+/** `lan.manual` with `entry` on the end, or no change when it is there already.
+ *  What `onDial` and the accept route both write. */
+export function withManualEntry(entry) {
+  return prev => {
+    const manual = Array.isArray(prev?.lan?.manual) ? prev.lan.manual : [];
+    return manual.includes(entry) ? null : { lan: { manual: [...manual, entry] } };
+  };
+}
+
+/**
+ * `lan.shared` with `key` on the end, or no change when it is already there.
+ *
+ * The tick an account gets when it ARRIVES over the local network (#1188): the
+ * group already has that login, so a deck that was just given one is as useful
+ * to the next machine as the deck that gave it. Only on arrival — an untick
+ * afterwards is the person's answer and nothing re-ticks it, because an account
+ * this deck already holds is never added again.
+ */
+export function withShared(key) {
+  return prev => {
+    const shared = Array.isArray(prev?.lan?.shared) ? prev.lan.shared : [];
+    return !key || shared.includes(key) ? null : { lan: { shared: [...shared, key] } };
+  };
+}
+
+/** `lan.aliases` with `fp` called `name`, or without `fp` when the name is
+ *  empty. The alias route's write; the whole map, rebuilt from the one read. */
+export function withAlias(fp, name) {
+  return prev => {
+    const next = { ...(prev?.lan?.aliases ?? {}) };
+    if (name) next[fp] = name; else delete next[fp];
+    return { lan: { aliases: next } };
+  };
+}
+
 /** One read-modify-write, behind every other one. Both entry points go through
  *  here so there is a single queue and a single merge. */
 function queued(job) {

package/src/server/index.mjs

@@ -34,7 +34,7 @@ import { createOutputWatch } from "./output-watch.mjs";
 import { RECAP_MARK, foldRecapLine } from "./session-recap.mjs";
 import { AWAY_BOOT_GRACE_MS, AWAY_RECHECK_MS, AWAY_TICK_MS, awayGate, awayUpdateStep } from "./auto-update.mjs";
 import { createPresence } from "./presence.mjs";
-import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, writePrefs } from "./deck-prefs.mjs";
+import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, withAlias, withManualEntry, withShared, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
 import { createTailnet, IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
 import { portHolder } from "./port-holder.mjs";
@@ -3962,6 +3962,19 @@ const lanEngine = createEngine({
     // listener had one is missing half of them — see forgetReach.
     forgetReach();
   },
+  // An account arrived from a paired deck, and this deck now offers it too
+  // (#1188). Written before the engine hears it, so a restart between the two
+  // leaves the tick on disk rather than only in the running engine's copy.
+  onShared: async key => {
+    try {
+      const before = _prefs;
+      _prefs = await updatePrefs(withShared(key));
+      if (_prefs?.lan?.shared === before?.lan?.shared) return;   // it was already ticked
+      await lanEngine.apply({ shared: _prefs.lan.shared });
+    } catch (err) {
+      console.error(`${PRODUCT}: lan sync could not share the account it just received:`, err?.message ?? err);
+    }
+  },
   // A deck was accepted or unpaired. Written straight through, because the
   // trusted list is the whole of who this deck will talk to and a list that
   // only existed in memory would drop every pairing on restart.
@@ -3982,10 +3995,7 @@ const lanEngine = createEngine({
       // is the WHOLE array, so a stale one wins. Pressing accept on a heard deck
       // at the moment an invite round fires this dropped the dialled address out
       // of `lan.manual`, which is the failure the comment above describes.
-      _prefs = await updatePrefs(prev => {
-        const manual = Array.isArray(prev?.lan?.manual) ? prev.lan.manual : [];
-        return manual.includes(entry) ? null : { lan: { manual: [...manual, entry] } };
-      });
+      _prefs = await updatePrefs(withManualEntry(entry));
       // AND RECONCILE THE ENGINE'S DIAL LIST with what was just written. The
       // disk is now right, but `setPeers` replaces the list wholesale from
       // `_prefs` on every settings write — so a write that raced this one, and
@@ -4360,12 +4370,7 @@ async function handleLanPeer(req, res) {
         // Inside the job, like `onDial` — the same whole-array patch computed
         // from the same stale copy, and the same address lost when two of them
         // land in one turn.
-        try {
-          _prefs = await updatePrefs(prev => {
-            const manual = Array.isArray(prev?.lan?.manual) ? prev.lan.manual : [];
-            return manual.includes(entry) ? null : { lan: { manual: [...manual, entry] } };
-          });
-        }
+        try { _prefs = await updatePrefs(withManualEntry(entry)); }
         catch { /* it is dialled this session; the next accept re-adds it */ }
       }
       return send(res, 200, { ok: true, added, ...lanEngine.status() });
@@ -4391,11 +4396,7 @@ async function handleLanPeer(req, res) {
     case "alias": {
       if (!isAliasKey(fp)) return send(res, 400, { ok: false, reason: "bad_request" });
       const name = cleanAlias(body.name);
-      _prefs = await updatePrefs(prev => {
-        const next = { ...(prev?.lan?.aliases ?? {}) };
-        if (name) next[fp] = name; else delete next[fp];
-        return { lan: { aliases: next } };
-      });
+      _prefs = await updatePrefs(withAlias(fp, name));
       await lanEngine.apply({ aliases: _prefs.lan.aliases });
       return send(res, 200, { ok: true, ...lanEngine.status() });
     }
@@ -6756,10 +6757,25 @@ export function requestUrl(rawUrl) {
 // So the Host check runs for every method now. What it asks is only the
 // rebinding question — did this request arrive addressed to a name that can
 // only ever be this machine — and it asks it of browser-shaped requests alone,
-// meaning anything carrying an Origin or fetch metadata. A client sending
-// neither is not a page and has no ambient authority to borrow: that is
-// hook/hook.js, a plain Node http.request from the user's own machine, and it
-// keeps reaching the deck under whatever name it used before.
+// meaning anything carrying an Origin, fetch metadata or a Referer. A client
+// sending none of them is not a page and has no ambient authority to borrow:
+// that is hook/hook.js, a plain Node http.request from the user's own machine,
+// and it keeps reaching the deck under whatever name it used before.
+//
+// THE REFERER IS ON THAT LIST because on one browser it is the only mark a page
+// leaves (#1168). A same-origin GET carries no Origin, and Safari 16.0-16.3
+// sends no Sec-Fetch-Site — the premise isAuthorizedDataRead's fallback is
+// built on — so a rebound page on that browser sent `Host: attacker.example:
+// 4317` and `Referer: http://attacker.example:4317/` and nothing else, was not
+// browser-shaped by the test as it stood, and was answered. Measured against a
+// running deck before this line changed: /api/health (the absolute workspace
+// path), /api/hook-challenge (the proof oracle, which handleHookChallenge says
+// a rebound page cannot see), /api/system/processes and the page itself all
+// answered 200. The guarded reads held only because isAuthorizedDataRead
+// happens to test the Host before it reads the Referer. No client of this
+// server that is not a browser sends a Referer — hook.js, the desktop app and
+// bin/ send none — so nothing that reached the deck before is turned away by
+// this, and the deck's own page names a loopback Host whatever it sends.
 //
 // Deliberately not part of this: the Sec-Fetch-Site test that isTrustedMutation
 // applies. `cross-site` on a read is an ordinary top-level navigation — a link
@@ -6767,9 +6783,10 @@ export function requestUrl(rawUrl) {
 // the deck's own UI on the deck's own origin, which is not an attack and used
 // to work. Rebinding does not need that test either: a rebound page's requests
 // report `same-origin`, and it is the Host that gives it away.
-export function isTrustedRead({ origin, host, secFetchSite } = {}) {
+export function isTrustedRead({ origin, host, secFetchSite, referer } = {}) {
   const browserShaped = (typeof origin === "string" && origin !== "")
-    || (typeof secFetchSite === "string" && secFetchSite.trim() !== "");
+    || (typeof secFetchSite === "string" && secFetchSite.trim() !== "")
+    || (typeof referer === "string" && referer.trim() !== "");
   if (!browserShaped) return true;
   return isLoopbackHost(host);
 }
@@ -7377,6 +7394,7 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       origin: req.headers.origin,
       host: req.headers.host,
       secFetchSite: req.headers["sec-fetch-site"],
+      referer: req.headers.referer,
     })) {
       return send(res, 403, { error: "cross-site request blocked" });
     }

package/src/server/installer.mjs

@@ -403,15 +403,37 @@ async function writeFileAtomic(rawTarget, text) {
  * identical content skips the write and the file is not replaced at all.
  */
 async function installScript(src, dst) {
-  const text = await readFile(src, "utf8");
+  return installText(await readFile(src, "utf8"), dst);
+}
+
+async function installText(text, dst) {
   const current = await readFile(dst, "utf8").catch(() => null);
   if (current === text) return false;
   await writeFileAtomic(dst, text);
   return true;
 }
 
+/**
+ * What makes the installed hook.js a CommonJS file wherever the config dir is.
+ *
+ * Node decides whether a `.js` file is CommonJS or an ES module from the nearest
+ * package.json above it, and hook.js is CommonJS. With none in agent-dag/, that
+ * nearest one is whatever the user has further up: a `"type": "module"` in
+ * ~/package.json, or in the repo a relocated CLAUDE_CONFIG_DIR lives in, loads
+ * the hook as an ES module, and it dies on its first `require` before main()
+ * has installed a single handler. Exit 1 and `require is not defined in ES
+ * module scope` on every tool call, and no deck receives anything (#1172). One
+ * file here answers the question before Node looks any further.
+ *
+ * Written before the hook, so a first install never has a hook.js without it,
+ * and through the same atomic write, because a half-written package.json is a
+ * load error of its own for every hook that starts while it is being written.
+ */
+const HOOK_PACKAGE_JSON = '{ "type": "commonjs" }\n';
+
 async function installHookScript(installDir) {
   await ensureDir(installDir);
+  await installText(HOOK_PACKAGE_JSON, join(installDir, "package.json"));
   const src = join(PKG_ROOT, "hook", "hook.js");
   const dst = join(installDir, "hook.js");
   await installScript(src, dst);

package/src/server/lan-engine.mjs

@@ -194,9 +194,26 @@ export function heardCurrent(raw, list) {
  * Injected rather than imported so a test can run a whole round — two engines,
  * two fake stores, one real socket pair — without claude-swap on the machine.
  */
+/**
+ * Whether an account this round just placed is ticked for sharing here (#1188).
+ *
+ * ONLY AN ADD: a heal needed the tick to happen at all — roundWith asks for a
+ * heal only for an account this deck already shares — so there is nothing to
+ * add for one, and an account healed after somebody unticked it must not be
+ * ticked again behind them.
+ *
+ * ONLY FROM THE LOCAL NETWORK: the reasoning for the default is that the login
+ * came from the group and the group therefore has it, and a tailnet can reach
+ * further than one person's own machines. Sharing there stays a decision
+ * somebody makes rather than one an arrival makes for them.
+ */
+export function ticksOnArrival(step, via) {
+  return !!step?.key && step.action === "add" && via !== "tailscale";
+}
+
 export function createEngine({
   readAccounts, exportAccount, importAccount,
-  onChange, onError, onIdentity, onPort, onTrust, onDial, now = Date.now,
+  onChange, onError, onIdentity, onPort, onTrust, onDial, onShared, now = Date.now,
   /**
    * The UDP socket the beacon shouts through, injectable for the same reason
    * lan-socket exposes it — and for one more that only showed up in use.
@@ -351,6 +368,13 @@ export function createEngine({
    *  still be said to come over the tailnet or the local network — it has no
    *  address of its own here, and without this its row could not say which. */
   const spokeFrom = new Map();
+  /** Addresses this deck added because a paired deck called in from them and
+   *  nothing here dialled it — see learnCaller. Kept until a round proves the
+   *  address answers: one that does is an ordinary dialled peer from then on
+   *  and leaves this set; one that does not is a caller this deck cannot reach
+   *  back (a strict NAT, a one-way path), and its row is taken away again so it
+   *  reverts to "calls in" rather than failing every round. */
+  const calledBack = new Set();
   /**
    * When a connection from ANOTHER MACHINE last arrived on the sync listener.
    *
@@ -457,13 +481,59 @@ export function createEngine({
    *  connection's — see sessionKey. `ctx.send` seals whatever it is handed when
    *  both ends said they seal, so nothing below has to know which kind of deck
    *  asked — see frameChannel. */
+  /** Does this deck already hold an address it dials for `fp`? A beacon row it
+   *  still hears, or a typed/learned row that answered as that deck. When
+   *  neither is true, the only way it ever reaches that deck is if the deck
+   *  keeps calling — and a called deck is never pulled from. */
+  const dialsAlready = fp => {
+    if (beacon && [...beacon.peers.values()].some(p => p.fp === fp && stillListed(p, now()))) return true;
+    for (const [at, met] of learned) if (met?.fp === fp && manual.has(at)) return true;
+    return false;
+  };
+
+  /**
+   * A PAIRED DECK THAT CALLS IN, AND NOTHING HERE DIALS IT.
+   *
+   * Accounts move only toward the deck that dials — roundWith pulls, serve only
+   * answers — so a deck this one holds no address for can offer everything and
+   * this one takes nothing. It is the exact state a deck falls into when it
+   * cannot hear beacons (a firewall, or Tailscale holding the discovery port):
+   * every peer becomes one that only calls, and no account ever arrives.
+   *
+   * The call itself is the address. The peer connected FROM somewhere and said
+   * in its hello which port it LISTENS on, and that pair is dialable. Adding it
+   * makes the next round reach the caller and pull — the same dial-back that
+   * accepting a deck and joining by invite already do, extended to a peer that
+   * simply calls. In memory, like those two: a settings write clears it and the
+   * next call re-adds it, and nothing here writes an address to disk.
+   */
+  const learnCaller = ctx => {
+    const fp = ctx?.peerFp;
+    const at = ctx?.peerAddr;
+    const port = ctx?.peerPort;
+    if (!fp || !at || !port || !engine) return;
+    if (!trustedPeer(cfg.trusted, fp)) return;
+    if (dialsAlready(fp)) return;
+    // As a row the deck ADDED ITSELF, not one a person typed: capped like every
+    // other automatic row, and — through calledBack — taken away again if the
+    // address turns out not to answer. The caller is already trusted, so the
+    // round dials and pulls without a press; `typed` decides only the cap and
+    // the undo, never the trust. See roundWith.
+    if (engine.addPeer(at, port, { typed: false })) {
+      learned.set(`${at}:${port}`, { fp, name: trustedPeer(cfg.trusted, fp)?.name || "" });
+      calledBack.add(`${at}:${port}`);
+      onChange?.();
+    }
+  };
+
   const serve = async (msg, ctx) => {
     // Before the verbs, and for every one of them: something that proved it
     // holds a key this deck accepted is talking, now.
     if (ctx?.peerFp) {
       spokeAt.set(ctx.peerFp, now());
-      const from = String(ctx.sock?.remoteAddress ?? "").replace(/^::ffff:/, "");
+      const from = ctx.peerAddr || String(ctx.sock?.remoteAddress ?? "").replace(/^::ffff:/, "");
       if (from) spokeFrom.set(ctx.peerFp, from);
+      learnCaller(ctx);
     }
     try {
       if (msg.t === "manifest") {
@@ -562,6 +632,10 @@ export function createEngine({
   const waitingOnSomebody = () =>
     [...lastRound.values()].some(r => r?.error === "waiting for the other deck to accept this one");
 
+  /** How this deck reached that peer. A beacon row says so; a typed address is
+   *  read from the routing table, the way the peer list reads it. */
+  const viaOf = peer => peer.via ?? (routeTo(peer.addr) ? "tailscale" : "lan");
+
   /** Ask one peer what it has, and heal whatever it can heal. */
   const roundWith = async peer => {
     let conn = null;
@@ -633,6 +707,10 @@ export function createEngine({
       // from then on, because "Constantin-PC" is what the person who typed the
       // address was trying to reach.
       learned.set(`${peer.addr}:${peer.port}`, { fp: conn.peerFp, name: conn.peerName || "" });
+      // A DIAL-BACK THAT ANSWERED IS AN ORDINARY PEER NOW. It was on trial only
+      // until it proved the deck can reach it; from here it is dialled like any
+      // other and is no longer a candidate for the undo below. See learnCaller.
+      calledBack.delete(`${peer.addr}:${peer.port}`);
 
       // TRUST ON FIRST USE, AND ONLY FOR AN ADDRESS SOMEBODY NAMED. Reaching a
       // deck we have no pin for used to mean the person at this keyboard put
@@ -738,6 +816,22 @@ export function createEngine({
         // than as a healthy one.
         const got = await importAccount(blob, step);
         const ok = got === true || got?.ok === true;
+        // AN ACCOUNT THAT ARRIVED HERE IS SHARED ONWARD (#1188). People forget
+        // to tick it, and a group where one machine can heal the others and the
+        // others can heal nobody is the shape that costs them: the second
+        // machine to lose the same login has to go back to the first, which may
+        // be asleep or on another network. Nothing new is exposed — the login
+        // came FROM the group, so the group has it.
+        //
+        // ONLY AN ADD, and only from the local network. A heal already needed
+        // the tick to happen at all (the filter above), so there is nothing to
+        // add for one; and a tailnet reaches further than the person's own
+        // machines, which is a decision they make for themselves rather than
+        // one an arrival makes for them.
+        if (ok && ticksOnArrival(step, viaOf(peer))) {
+          try { await onShared?.(step.key); }
+          catch { /* the account is here; the tick is retried the next time one arrives */ }
+        }
         done.push({ ...step, ok, why: ok ? null : (got?.why ?? "import failed") });
       }
       lastRound.set(peer.fp, { at: now(), name: peer.name, offered: theirs.accounts.length, done });
@@ -745,6 +839,20 @@ export function createEngine({
       return done;
     } catch (err) {
       lastRound.set(peer.fp, { at: now(), name: peer.name, error: err.message });
+      // A DIAL-BACK THAT NEVER ANSWERED IS TAKEN AWAY AGAIN. The address came
+      // from a paired deck's inbound call, and this round was the test of
+      // whether the call can be returned. It could not — a strict NAT, a
+      // one-way path — so the row is removed rather than left to fail every
+      // minute, and the peer goes back to "calls in". Its next call tries once
+      // more. A row that answered has already left calledBack above.
+      const at = `${peer.addr}:${peer.port}`;
+      if (calledBack.has(at)) {
+        calledBack.delete(at);
+        manual.delete(at);
+        learned.delete(at);
+        lastRound.delete(peer.fp);
+        onChange?.();
+      }
       return [];
     } finally {
       conn?.sock?.destroy();

package/src/server/lan-socket.mjs

@@ -967,6 +967,15 @@ export function createSyncServer({
       if (!frame) return refuse("a sealed frame did not open");
       handlers?.(frame, {
         sock, peerFp, key, sealed: !!chan,
+        // Where this deck dials the caller BACK. A deck that only ever calls in
+        // is one this deck holds no address for, so it could receive nothing —
+        // accounts move only toward the deck that dials (see roundWith). The
+        // address the caller connected from, and the port it said it listens
+        // on, are a dialable pair the engine can add so the next round reaches
+        // it. `peerAddr` is the source of this very connection; `peerPort` came
+        // from the hello, not the ephemeral source port.
+        peerAddr: from(sock),
+        peerPort,
         send: obj => sendFrame(sock, chan ? chan.wrap(obj) : obj),
       });
     }, refuse));

package/src/server/retire-sound-hook.mjs

@@ -91,8 +91,17 @@ const EVENT = "Stop";
 // writes this any more; retirement reads it once and deletes it.
 const PARKED_PATH = join(homedir(), ".agents-deck", "parked-sound-hooks.json");
 
+// `Array.isArray`, not `?? []`, and that is a crash fix rather than a style
+// choice. A group whose `hooks` is not an array — hand-edited settings.json,
+// something else's schema, a half-finished edit — made this `.map` throw
+// `TypeError: … .map is not a function`, out of `retireSoundHookIn`, out of
+// `installHooks`, on the unconditional install every boot runs: the deck would
+// not start at all until the user found and fixed the entry, with nothing but a
+// stack to say which one. installer.mjs's own `isOurEntry` has always read the
+// same field with the same guard, and its answer for a group it cannot read is
+// to leave it exactly where it is.
 const commandsOf = (entry) =>
-  (entry?.hooks ?? []).map(h => (typeof h?.command === "string" ? h.command : ""));
+  (Array.isArray(entry?.hooks) ? entry.hooks : []).map(h => (typeof h?.command === "string" ? h.command : ""));
 
 /**
  * THE TAIL, NOT THE WHOLE PATH — and this is a data-loss fix, not a tidy-up.