ccdeck 3.27.6 → 3.28.0

package/dist/web/manifest.webmanifest

@@ -0,0 +1,17 @@
+{
+  "id": "/",
+  "name": "ccdeck",
+  "short_name": "ccdeck",
+  "description": "Live deck of Claude Code and Codex agents — tool calls, token spend and every subagent on one canvas.",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#0b0c10",
+  "theme_color": "#14161b",
+  "icons": [
+    { "src": "icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any" },
+    { "src": "icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any" },
+    { "src": "icon-maskable-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable" },
+    { "src": "icon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any" }
+  ]
+}

package/hook/hook.js

@@ -688,7 +688,13 @@ function forgetIfAbandoned(d, done) {
  */
 function post(d, body, persists, done) {
   let settled = false;
-  const finish = (ok, why = null) => { if (settled) return; settled = true; done(ok, why); };
+  let sendDeadline = null;
+  const finish = (ok, why = null) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(sendDeadline);
+    done(ok, why);
+  };
   // Whether the kernel has taken the whole body, and whether it was this
   // process's deadline rather than the writer that ended the exchange — the
   // two facts the last paragraph above sorts an error by.
@@ -707,7 +713,6 @@ function post(d, body, persists, done) {
     res.resume();
     finish(res.statusCode >= 200 && res.statusCode < 300);
   });
-  req.on("finish", () => { sent = true; });
   // `destroy()` on a timeout makes 'error' fire with ECONNRESET — the status
   // line has not arrived, or it would have settled this already — so `timedOut`
   // is what tells this process giving up apart from the writer hanging up.
@@ -730,9 +735,29 @@ function post(d, body, persists, done) {
   // written the line — was never asked. The snapshot is the rule that paragraph
   // states, taken at the only moment it is still true.
   let sentByDeadline = false;
+  const expire = () => {
+    if (settled) return;
+    timedOut = true;
+    sentByDeadline = sent;
+    req.destroy();
+  };
   req.on("error", () => finish(false, timedOut && sentByDeadline ? "deadline" : null));
-  req.on("timeout", () => { timedOut = true; sentByDeadline = sent; req.destroy(); });
+  req.on("timeout", expire);
+  req.on("finish", () => {
+    sent = true;
+    clearTimeout(sendDeadline);
+    sendDeadline = null;
+  });
   req.write(body);
+  // `http.request`'s timeout is an idle-socket timeout. While a large body is
+  // still being accepted into kernel buffers, those writes keep resetting it
+  // even if the peer application stopped reading. Bound the send phase itself
+  // so that a wedged writer can still hand the log to the next deck inside the
+  // hook's process cap. Once `finish` says the kernel took the whole body, this
+  // timer is cleared and the existing idle timeout remains the only deadline
+  // on a slow answer, preserving #1133's no-duplicate rule. (#1195)
+  sendDeadline = setTimeout(expire, POST_TIMEOUT_MS);
+  sendDeadline.unref?.();
   req.end();
 }
 
@@ -899,6 +924,32 @@ function discoverTargets(cwd, cb) {
   normPathAsync(cwd, scan);
 }
 
+// JSON.parse can accept nesting that older supported Node releases cannot
+// stringify again. Count structural nesting directly in the original text so
+// the hook never depends on a runtime-specific recursion limit. Strings are
+// skipped with their escapes, so braces inside tool output do not count.
+function exceedsJsonDepth(text, limit = 1000) {
+  let depth = 0;
+  let quoted = false;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (c === "\\") escaped = true;
+      else if (c === '"') quoted = false;
+      continue;
+    }
+    if (c === '"') { quoted = true; continue; }
+    if (c === "{" || c === "[") {
+      if (++depth > limit) return true;
+    } else if (c === "}" || c === "]") {
+      depth--;
+    }
+  }
+  return false;
+}
+
 function main() {
   // Hard cap so a stuck server can never wedge the host CLI: this process ends
   // itself rather than being killed. CAP_MS says what the budget is; this line
@@ -958,6 +1009,7 @@ function main() {
   process.stdin.on("end", () => {
     let parsed;
     try { parsed = JSON.parse(input); } catch { return process.exit(0); }
+    const tooDeepToSerialize = exceedsJsonDepth(input);
     const cwd = parsed && parsed.cwd;
     if (!cwd) return process.exit(0);
 
@@ -1008,7 +1060,26 @@ function main() {
       // Read or a Grep result arrives whole in `tool_response` and is routinely
       // megabytes.
       if (parsed && typeof parsed === "object") parsed.cwd = resolvedCwd;
-      const taggedInput = JSON.stringify(parsed);
+      let taggedInput;
+      try {
+        if (tooDeepToSerialize) throw new RangeError("JSON nesting exceeds safe serialization depth");
+        taggedInput = JSON.stringify(parsed);
+      } catch {
+        // JSON.parse accepts nesting much deeper than JSON.stringify can write
+        // back out. Keep the event instead of losing it silently: all scalar
+        // top-level metadata is safe to copy without walking the deep value,
+        // which preserves the event/session/tool identity, canonical cwd and
+        // provider while making the loss explicit to the deck. (#1180)
+        const shallow = {};
+        for (const [key, value] of Object.entries(parsed)) {
+          if (value === null || ["string", "number", "boolean"].includes(typeof value)) {
+            shallow[key] = value;
+          }
+        }
+        shallow.ccdeck_truncated = true;
+        shallow.ccdeck_truncation_reason = "serialization-depth";
+        taggedInput = JSON.stringify(shallow);
+      }
 
       // See proveTargets for what the other order cost. A record whose pid is
       // merely alive has established nothing: it may be a deck that died and had

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.27.6",
+  "version": "3.28.0",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -49,7 +49,9 @@
     "3.26.3",
     "3.26.4",
     "3.26.5",
-    "3.27.6"
+    "3.27.6",
+    "3.27.7",
+    "3.28.0"
   ],
   "3.27.0": [
     {

package/src/server/app-manifest.mjs

@@ -0,0 +1,55 @@
+// Whether this deck may be installed as an application, and why it usually may.
+//
+// WHAT THE MANIFEST BUYS. With `dist/web/manifest.webmanifest` served, Chrome
+// and Edge put their own install control in the address bar and the deck gets a
+// real icon: a Dock tile on macOS, a taskbar and Start entry on Windows, a
+// `.desktop` file in the application launcher on Linux — which is the one that
+// matters most, because a launcher entry works on Hyprland and Sway, where a
+// system tray, the other way people ask for this, does not exist at all.
+// Safari's File ▸ Add to Dock needs no manifest but honours the name and icons
+// in one. None of that is UI this deck has to draw, nag about, or maintain.
+//
+// WHY IT IS NOT ALWAYS OFFERED, which is the whole of this file. An installed
+// app is pinned to an ORIGIN, and an origin includes the port. So the icon is a
+// promise about a number, and there is exactly one case where this deck cannot
+// keep it: the random fallback.
+//
+// bin/deck.js asks for a port — 4317, or whatever `--port` said — and on a
+// refused bind takes a RANDOM one out of 4318–4400 instead. That fallback is
+// right and stays: 4317 is also the standard OTLP collector port, and Windows
+// reserves contiguous TCP blocks for Hyper-V, WSL2 and Docker, so a deck that
+// comes up on 4322 beats a deck that refuses to come up. But it draws a new
+// number on every start. An app installed against one of those would be a
+// broken shortcut by the next boot, and — because Chrome keys an installed app
+// by origin — a SECOND icon would appear beside it, then a third. Somebody on a
+// machine where 4317 is permanently taken would collect one dead tile per
+// launch, and every one of them would look like the deck's fault.
+//
+// So the rule is not "is this 4317". It is "is this the port that was ASKED
+// for", which is true for the default, true for an explicit `--port 4500` that
+// bound, and false only when a bind was refused and a number was invented. A
+// user who pins a port keeps their icon; a user who cannot have one never gets
+// offered a shortcut that will not work tomorrow.
+//
+// The deck says nothing about any of this. An install control that is simply
+// absent reads as a browser that has nothing to offer; a control that appeared
+// and then explained itself would be a paragraph about port allocation in a
+// place nobody asked a question.
+
+/** The one path this is all about. Served out of dist/web like any other file. */
+export const MANIFEST_PATH = "/manifest.webmanifest";
+
+/**
+ * May this deck be installed as an application?
+ *
+ * @param {object} [o]
+ * @param {number|null} [o.asked]  The port the launcher wanted.
+ * @param {number|null} [o.bound]  The port it actually got.
+ * @returns {boolean} False when the port was invented rather than chosen.
+ */
+export function offerManifest({ asked = null, bound = null } = {}) {
+  // Not yet listening, or a caller that never said — neither is a port anybody
+  // chose, and a manifest is the wrong thing to guess about.
+  if (!Number.isInteger(asked) || !Number.isInteger(bound)) return false;
+  return asked === bound;
+}

package/src/server/deck-prefs.mjs

@@ -72,8 +72,9 @@ export const prefsPath = (home = deckDataDir()) => join(prefsDir(home), "prefs.j
  */
 export const DEFAULTS = Object.freeze({
   notifications: false,
-  // The web tour is a deck-level marker, not browser-profile state. Electron
-  // may serve the same deck from a different loopback port after an update.
+  // The Electron window can open on a new localhost port after an update.
+  // Its tour marker must outlive that origin; browser tabs still use their
+  // own localStorage marker and never read this preference.
   tourSeen: false,
   // Whether the deck may update itself: restart into code already on disk once
   // it is idle, and — while nobody is looking — install a newer release and
@@ -86,7 +87,7 @@ export const DEFAULTS = Object.freeze({
   // write below names a mode. AGENTS_DECK_NO_LAN=1 keeps a deck off the network
   // whatever this file says — see lanEnabled.
   lan: Object.freeze({
-    enabled: true, name: "", secret: "", shared: [], manual: [], trusted: [], port: 0,
+    enabled: true, name: "", secret: "", shared: [], manual: [], trusted: [], unpaired: [], port: 0,
     // WHO PAIRS WITH WHOM, WITHOUT ANYBODY PRESSING ANYTHING. Asking is on, so
     // two decks on one network find each other and send each other a request —
     // which is what a person with three of their own machines wants and had to
@@ -178,8 +179,8 @@ function aliasesFrom(raw) {
 }
 
 /** One LAN section, coerced. Unknown keys dropped like everything else here,
- *  and the two lists forced to arrays of strings — they arrive from a page and
- *  are then compared against account keys and dialled as addresses. */
+ *  and string lists forced to arrays of strings before anything compares them
+ *  with account keys, addresses or fingerprints. */
 function normaliseLan(raw) {
   const src = raw && typeof raw === "object" ? raw : {};
   const strings = v => (Array.isArray(v) ? v.filter(x => typeof x === "string") : []);
@@ -206,6 +207,10 @@ function normaliseLan(raw) {
         // kept, and absent is drawn as "before" rather than guessed.
         ...(Number.isFinite(t.at) && t.at > 0 ? { at: t.at } : {}),
       })),
+    // Fingerprints somebody explicitly unpaired. Kept separately from trusted
+    // because manual dial rows survive the action and must not silently rebuild
+    // trust on the next round or restart.
+    unpaired: strings(src.unpaired),
     aliases: aliasesFrom(src.aliases),
     // The port this deck listened on last time, so an address somebody typed on
     // the other machine still works after a restart. It asked the OS for a new
@@ -566,7 +571,10 @@ async function save(mutate, home, deps) {
  */
 export function publicPrefs(prefs) {
   const p = normalise(prefs);
-  const { secret, trusted, ...lan } = p.lan;
+  // unpaired is engine-authored state too. No page draws or edits it; keeping
+  // it out also means a future whole-prefs form cannot replay a stale unpair
+  // list over a decision the engine made after the form loaded.
+  const { secret, trusted, unpaired: _unpaired, ...lan } = p.lan;
   return {
     ...p,
     lan: { ...lan, trusted: trusted.map(t => ({ fp: t.fp, name: t.name })) },

package/src/server/deck-probe.mjs

@@ -70,7 +70,13 @@ export function challengeProof(token, nonce) {
 export function challengeDeck(port, token) {
   return new Promise(resolve => {
     let settled = false;
-    const finish = ok => { if (settled) return; settled = true; resolve(ok); };
+    let deadline;
+    const finish = ok => {
+      if (settled) return;
+      settled = true;
+      if (deadline) clearTimeout(deadline);
+      resolve(ok);
+    };
     const nonce = randomBytes(16).toString("hex");
     const want = challengeProof(token, nonce);
     const req = httpRequest({
@@ -98,6 +104,14 @@ export function challengeDeck(port, token) {
     });
     req.on("error", () => finish(false));
     req.on("timeout", () => req.destroy());
+    // `http.request`'s timeout is an idle timeout: a listener can keep this
+    // request alive forever by trickling bytes, and once a response has begun
+    // destroying the request does not reliably emit `error`. Bound the whole
+    // challenge instead, and settle before closing the socket. (#1179)
+    deadline = setTimeout(() => {
+      finish(false);
+      req.destroy();
+    }, DECK_CHALLENGE_TIMEOUT_MS);
     req.end();
   });
 }

package/src/server/index.mjs

@@ -45,6 +45,7 @@ import { MAC_FW, PROBE_PS, UFW_CONF, UFW_DEFAULTS, isActive, localAliases, reach
 import { run } from "./exec.mjs";
 import { notify as osNotify } from "./browser-react.mjs";
 import { invokedName, renameNotice } from "./invoked-as.mjs";
+import { MANIFEST_PATH, offerManifest } from "./app-manifest.mjs";
 import { appendFailureStats, appendLogLine, appendsLanded, codexCwdInWorkspace, electWriters, emptyLog, flushAppends, foldsCase, writesCodexLog } from "./log-writer.mjs";
 import { historySnapshot, readProcesses, startSystemMetrics, systemSnapshot } from "./system-metrics.mjs";
 import { linesFromEnd, linesFromStart } from "./log-tail.mjs";
@@ -75,6 +76,11 @@ const MIME = {
   ".css":  "text/css; charset=utf-8",
   ".json": "application/json; charset=utf-8",
   ".svg":  "image/svg+xml",
+  // The type is the whole of how a browser recognises a manifest: served as
+  // application/octet-stream — which is what the fallback below hands anything
+  // unlisted — Chrome fetches it, declines to parse it, and offers no install,
+  // with nothing in the console that names the reason.
+  ".webmanifest": "application/manifest+json; charset=utf-8",
   ".png":  "image/png",
   ".jpg":  "image/jpeg",
   ".woff2": "font/woff2",
@@ -4015,6 +4021,13 @@ const lanEngine = createEngine({
     try { _prefs = await writePrefs({ lan: { trusted } }); }
     catch (err) { console.error(`${PRODUCT}: lan sync could not save the pairing:`, err?.message ?? err); }
   },
+  // An explicit unpair must outlive the process too. Manual dial rows are kept
+  // deliberately, so without this marker the next successful round could pin
+  // the same fingerprint again without another press.
+  onUnpaired: async unpaired => {
+    try { _prefs = await writePrefs({ lan: { unpaired } }); }
+    catch (err) { console.error(`${PRODUCT}: lan sync could not save the unpair decision:`, err?.message ?? err); }
+  },
   // An address this deck must keep dialling: the far end of a pairing that
   // happened over an invite. Kept in prefs, because setPeers replaces the dial
   // list wholesale on every settings write and a row that lives only in memory
@@ -4046,7 +4059,7 @@ const lanEngine = createEngine({
       // one it is given, so this settles after one pass rather than looping.
       //
       // The key is handed over HERE rather than read back off `_prefs`, because
-      // `applyLanPrefs` no longer round-trips the three fields the engine
+      // `applyLanPrefs` no longer round-trips the fields the engine
       // authors — see what it does and does not pass. This is the one caller
       // that legitimately changes one of them, and it is holding the new value.
       await applyLanPrefs({ secret });
@@ -4063,9 +4076,9 @@ const lanEngine = createEngine({
 /**
  * What prefs is entitled to tell the LAN engine, and what it is not.
  *
- * THREE FIELDS ARE THE ENGINE'S OWN AND ARE LOADED ONCE. `trusted`, `secret`
- * and `port` are written BY the engine, through `onTrust`, `onIdentity` and
- * `onPort` — prefs is where they are kept between runs, not where they are
+ * FOUR FIELDS ARE THE ENGINE'S OWN AND ARE LOADED ONCE. `trusted`, `unpaired`,
+ * `secret` and `port` are written BY the engine, through `onTrust`,
+ * `onUnpaired`, `onIdentity` and `onPort` — prefs is where they are kept between runs, not where they are
  * decided. Handing them back on every settings write round-trips the engine's
  * live state through a module-level copy of a file, and that copy is stale for
  * as long as one of those writes is queued.
@@ -4120,11 +4133,12 @@ export function lanApplyFields(prefs, { load = false, env = process.env } = {})
     ...page,
     secret: lan.secret || "",
     trusted: Array.isArray(lan.trusted) ? lan.trusted : [],
+    unpaired: Array.isArray(lan.unpaired) ? lan.unpaired : [],
     port: lan.port || 0,
   };
 }
 
-/** Whether the engine has already been handed the three fields it authors.
+/** Whether the engine has already been handed the fields it authors.
  *  Reset by `startServer`, because a boot is what reads them off the file. */
 let _lanLoaded = false;
 
@@ -7480,6 +7494,11 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
   // background quota poll hit a network error. Answer the request instead.
   const guard = (p, res) => Promise.resolve(p).catch(err => sendInternalError(res, err));
 
+  // Which of the eleven candidates below this deck ended up on, set the moment
+  // one of them binds. Declared here rather than beside the loop that fills it
+  // so it is above the route that reads it — see the manifest gate.
+  let boundPort = null;
+
   const route = (req, res) => {
     const url = requestUrl(req.url);
     // Unparseable request target. Nothing below can route it, and throwing here
@@ -7653,6 +7672,20 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
       return send(res, 404, { error: "not found" });
     }
 
+    // THE MANIFEST IS WITHDRAWN WHEN THE PORT WAS INVENTED, not served and
+    // then apologised for. An installed app is pinned to an origin and an
+    // origin includes the port, so offering one from a random fallback port
+    // promises a shortcut that the next boot breaks — and leaves a dead tile
+    // behind for every launch, because the browser keys an app by origin. See
+    // app-manifest.mjs, which is where the rule and its reasoning live.
+    //
+    // A 404 rather than a route that answers `{}`: an unparseable manifest is
+    // a console error on every page load, and "absent" is exactly what this
+    // means.
+    if (url.pathname === MANIFEST_PATH && !offerManifest({ asked: port, bound: boundPort })) {
+      return send(res, 404, { error: "not found" });
+    }
+
     if (req.method === "GET") return serveStatic(req, res, url);
     send(res, 405, { error: "method not allowed" });
   };
@@ -7692,6 +7725,13 @@ export async function startServer({ port = 4317, host = "127.0.0.1", persist = n
   for (const candidate of candidates) {
     try {
       await tryListen(server, candidate, host);
+      // What actually bound, read by the manifest gate above. `address()`
+      // rather than `candidate`, and the difference is the whole point of the
+      // gate: `port: 0` means "any ephemeral port", so the candidate and the
+      // request agree at 0 while the deck is listening on a number nobody chose
+      // and that will differ on the next boot. Every test in this suite boots
+      // that way. Comparing the candidate would hand those decks a manifest.
+      boundPort = server.address()?.port ?? candidate;
       // Codex has no working hooks on Windows — tail its rollout files instead.
       if (codex) startCodexWatcher(workspace);
       // What a session is producing between its tool calls. Claude only — it

package/src/server/lan-engine.mjs

@@ -213,7 +213,7 @@ export function ticksOnArrival(step, via) {
 
 export function createEngine({
   readAccounts, exportAccount, importAccount,
-  onChange, onError, onIdentity, onPort, onTrust, onDial, onShared, now = Date.now,
+  onChange, onError, onIdentity, onPort, onTrust, onUnpaired, onDial, onShared, now = Date.now,
   /**
    * The UDP socket the beacon shouts through, injectable for the same reason
    * lan-socket exposes it — and for one more that only showed up in use.
@@ -262,7 +262,7 @@ export function createEngine({
   routes = null,
 } = {}) {
   let cfg = {
-    enabled: false, name: defaultName(), secret: "", shared: [], trusted: [], port: 0,
+    enabled: false, name: defaultName(), secret: "", shared: [], trusted: [], unpaired: [], port: 0,
     autoAsk: true, autoAccept: true, aliases: {},
     // Tell paired decks which shared account this one is on — see currentFor.
     shareActive: true,
@@ -427,6 +427,21 @@ export function createEngine({
    *  — and always is on a deck with no Tailscale reader. */
   const routeTo = addr => routeOf(tailnet?.snapshot?.() ?? null, addr);
 
+  /** A pairing somebody explicitly removed. Unlike `declined`, this survives a
+   * restart because the old dial row survives too; forgetting the decision
+   * would let that row silently recreate the pairing on the next round. */
+  const wasUnpaired = fp => Array.isArray(cfg.unpaired) && cfg.unpaired.includes(fp);
+  const markUnpaired = (fp, value) => {
+    const before = Array.isArray(cfg.unpaired) ? cfg.unpaired : [];
+    const next = value
+      ? (before.includes(fp) ? before : [...before, fp])
+      : before.filter(x => x !== fp);
+    if (next.length === before.length && next.every((x, i) => x === before[i])) return false;
+    cfg = { ...cfg, unpaired: next };
+    onUnpaired?.(next);
+    return true;
+  };
+
   /** The two permissions that answer for one route. */
   const asksOn = via => (via === "tailscale" ? !!cfg.tailscale && cfg.tailscaleAsk !== false : !!cfg.autoAsk);
   const saysYesOn = via => (via === "tailscale" ? !!cfg.tailscale && cfg.tailscaleAccept !== false : !!cfg.autoAccept);
@@ -618,7 +633,10 @@ export function createEngine({
     const via = route ? "tailscale" : "lan";
     const own = !!route?.own;
     pending.set(entry.fp, { ...entry, via, own, at: had?.at ?? now(), lastAt: now() });
-    if (saysYesOn(via) && (via === "lan" || own)) { engine?.accept(entry.fp); return; }
+    if (!wasUnpaired(entry.fp) && saysYesOn(via) && (via === "lan" || own)) {
+      engine?.accept(entry.fp, { byHand: false });
+      return;
+    }
     if (!had) onChange?.();
   };
 
@@ -740,7 +758,7 @@ export function createEngine({
       // A deck we DO have a pin for was checked before this line: connectToPeer
       // was given expectPub and refuses a different key at that address.
       if (!trustedPeer(cfg.trusted, conn.peerFp)) {
-        if (!peer.typed) {
+        if (!peer.typed || wasUnpaired(conn.peerFp)) {
           // The same row the listener's own `onPending` draws, from the other
           // direction: this deck dialled rather than being dialled, and the
           // handshake it just finished is the same evidence either way — a real
@@ -996,11 +1014,11 @@ export function createEngine({
       const ask = c => ({ lan: !!c.autoAsk, tailscale: !!c.tailscale && c.tailscaleAsk !== false });
       const turnedOn = (f, via) => !f(was)[via] && f(cfg)[via];
       const mayAnswer = p => (p.via === "tailscale" ? turnedOn(yes, "tailscale") && p.own : turnedOn(yes, "lan"));
-      for (const [fp, p] of [...pending]) if (mayAnswer(p)) this.accept(fp);
+      for (const [fp, p] of [...pending]) if (!wasUnpaired(fp) && mayAnswer(p)) this.accept(fp, { byHand: false });
       // The same for the other direction: switching `ask` on with four machines
       // already listed asks those four.
       const mayAsk = p => (p.via === "tailscale" ? turnedOn(ask, "tailscale") && p.own : turnedOn(ask, "lan"));
-      for (const [fp, p] of [...strangers]) if (!declined.has(fp) && !p.pub && mayAsk(p)) this.accept(fp, { byHand: false });
+      for (const [fp, p] of [...strangers]) if (!declined.has(fp) && !wasUnpaired(fp) && !p.pub && mayAsk(p)) this.accept(fp, { byHand: false });
       // OFF MEANS THE TAILNET GOES QUIET HERE: nobody heard over it is offered,
       // and syncTailnet stops the reads. Decks already paired stay paired.
       if (was.tailscale && !cfg.tailscale) {
@@ -1037,6 +1055,7 @@ export function createEngine({
         onInviteUsed: entry => {
           const { list } = addTrusted(cfg.trusted, { fp: entry.fp, pub: entry.pub, name: entry.name, at: now() });
           cfg = { ...cfg, trusted: list };
+          markUnpaired(entry.fp, false);
           invite = null;
           // AND DIAL IT BACK, KEPT. Accepting made it welcome and left this
           // deck with no way to reach it: an inbound connection puts nothing in
@@ -1123,7 +1142,7 @@ export function createEngine({
           // Over the tailnet only a machine on this person's own account is
           // asked unprompted; any other is a row for somebody to decide on.
           const mayAsk = asksOn(entry.via) && (entry.via !== "tailscale" || own);
-          if (mayAsk && !had && !declined.has(entry.fp)) { self.accept(entry.fp, { byHand: false }); return; }
+          if (mayAsk && !had && !declined.has(entry.fp) && !wasUnpaired(entry.fp)) { self.accept(entry.fp, { byHand: false }); return; }
           // Only a deck that is new to us is news. A beacon every thirty
           // seconds from one already on the list is not a reason to redraw.
           if (!had) onChange?.();
@@ -1229,6 +1248,7 @@ export function createEngine({
             fp: conn.peerFp, pub: conn.peerPub, name: conn.peerName || inv.name, at: now(),
           });
           cfg = { ...cfg, trusted: list };
+          markUnpaired(conn.peerFp, false);
           this.addPeer(at.addr, at.port);
           onDial?.(`${at.addr}:${at.port}`);
           learned.set(`${at.addr}:${at.port}`, { fp: conn.peerFp, name: conn.peerName || inv.name });
@@ -1262,6 +1282,7 @@ export function createEngine({
       const heard = strangers.get(fp) ?? null;
       const seen = asked ?? heard;
       if (!seen) return null;
+      if (wasUnpaired(fp) && !byHand) return null;
       // TWO KINDS OF ROW, AND THEY ARE NOT THE SAME CLAIM.
       //
       // A deck that ASKED finished a handshake, so it held the private half of
@@ -1276,6 +1297,7 @@ export function createEngine({
       // is the same two presses, in the other order.
       if (!seen.pub) {
         if (!seen.addr || !seen.port) return null;
+        markUnpaired(fp, false);
         // `byHand` IS WHAT THE ROW WILL BE ALLOWED TO DO LATER. A press here is
         // a person naming a machine, so the row may be pinned on the round that
         // reaches it. `autoAsk` reaches this same line with byHand false — the
@@ -1288,6 +1310,7 @@ export function createEngine({
       }
       const { list, added } = addTrusted(cfg.trusted, { fp, pub: seen.pub, name: seen.name, at: now() });
       cfg = { ...cfg, trusted: list };
+      markUnpaired(fp, false);
       pending.delete(fp);
       strangers.delete(fp);
       onTrust?.(list);
@@ -1338,6 +1361,7 @@ export function createEngine({
       const list = dropTrusted(cfg.trusted, fp);
       if (list.length === cfg.trusted.length) return false;
       cfg = { ...cfg, trusted: list };
+      markUnpaired(fp, true);
       onTrust?.(list);
       onChange?.();
       return true;

package/src/server/self-update.mjs

@@ -132,9 +132,54 @@ export function mayAskNpm({ now, lastAskAt }) {
 
 // ── version comparison ───────────────────────────────────────────────────────
 
-/** True when `a` sorts before `b`. Numeric-segment compare — non-numeric
- *  segments count as 0, missing segments pad with 0, so "1.30" < "1.30.1" and
- *  "1.9.0" < "1.10.0".
+/** Numeric-segment compare of one version's parts: -1, 0 or 1. Non-numeric
+ *  segments count as 0 and missing segments pad with 0, so "1.30" sorts before
+ *  "1.30.1" and "1.9.0" before "1.10.0". */
+function cmpParts(x, y) {
+  for (let i = 0; i < Math.max(x.length, y.length); i++) {
+    const d = (x[i] ?? 0) - (y[i] ?? 0);
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  return 0;
+}
+
+/** A version split at the FIRST `-`: the release on one side, the prerelease
+ *  identifiers on the other, or null when there is no prerelease at all.
+ *
+ *  `+` stays inside the release half rather than starting a third part, which
+ *  keeps build metadata reading exactly as it read before — `1.0.0+build.7`
+ *  segments to [1,0,0,0,7] and therefore sorts above `1.0.0`. That is inherited
+ *  behaviour rather than a design, this repo has never published one, and a
+ *  change to it belongs in its own issue. */
+function versionParts(v) {
+  const nums = (s) => s.split(/[.+]/).map(n => parseInt(n, 10)).map(n => Number.isNaN(n) ? 0 : n);
+  const dash = v.indexOf("-");
+  if (dash === -1) return { release: nums(v), pre: null };
+  return { release: nums(v.slice(0, dash)), pre: nums(v.slice(dash + 1)) };
+}
+
+/** True when `a` sorts before `b`.
+ *
+ *  A PRERELEASE SORTS BELOW THE RELEASE IT PRECEDES (#976), which is semver's
+ *  rule and was not this function's. Splitting on `[.\-+]` and mapping
+ *  non-numeric segments to 0 made `3.23.0-rc.1` segment to [3,23,0,0,1] — five
+ *  numbers against the release's three, so it compared ABOVE `3.23.0` and the
+ *  release compared below the candidate it was meant to supersede:
+ *
+ *      isOlder("3.23.0-rc.1", "3.23.0") = false    ← the release never looked newer
+ *      isOlder("3.23.0", "3.23.0-rc.1") = true     ← and the deck would go backwards
+ *
+ *  What that costs is not a cosmetic ordering. `autoUpdate` defaults on, so a
+ *  deck that has ended up on a prerelease — installed by hand by a tester, or
+ *  by the dist-tag accident publish.yml now prevents — produces no upgrade
+ *  notice when the real release ships, shows nothing in the banner, and has no
+ *  way to come back off it from inside the product. A bad release can be
+ *  followed by a good one; a fleet that cannot SEE the good one cannot be
+ *  rescued by publishing it, which is why this half matters even with the
+ *  dist-tag half in place.
+ *
+ *  Ordinary numeric ordering is untouched — the release halves are compared
+ *  exactly as before — and so is build metadata; see versionParts.
  *
  *  cswap-install.mjs had this written out a second time, without the type guard
  *  below, and imports it from here now (#374). The two bodies were identical:
@@ -143,16 +188,20 @@ export function mayAskNpm({ now, lastAskAt }) {
  *  and threw a TypeError there. Nothing could reach that call with a non-string
  *  (both arguments are behind `typeof v === "string"` checks at the one call
  *  site), so this is the copy with a test behind it absorbing the one without,
- *  not a bug fix. */
+ *  not a bug fix. That sweep is now one-sided on prerelease pairs and
+ *  duplicated-helpers.test.ts says which, rather than asserting an equality
+ *  that has deliberately stopped holding. */
 export function isOlder(a, b) {
   if (typeof a !== "string" || typeof b !== "string") return false;
-  const seg = (v) => v.split(/[.\-+]/).map(n => parseInt(n, 10)).map(n => Number.isNaN(n) ? 0 : n);
-  const x = seg(a), y = seg(b);
-  for (let i = 0; i < Math.max(x.length, y.length); i++) {
-    const d = (x[i] ?? 0) - (y[i] ?? 0);
-    if (d !== 0) return d < 0;
-  }
-  return false;
+  const x = versionParts(a), y = versionParts(b);
+  const release = cmpParts(x.release, y.release);
+  if (release !== 0) return release < 0;
+  // Same release. A version carrying a prerelease is below the plain one, and
+  // never the other way round; two prereleases of one release compare on their
+  // own identifiers, so rc.2 is above rc.1.
+  if (x.pre && !y.pre) return true;
+  if (!x.pre || !y.pre) return false;
+  return cmpParts(x.pre, y.pre) < 0;
 }
 
 // ── what is on disk ──────────────────────────────────────────────────────────

package/src/server/static-cache.mjs

@@ -11,7 +11,7 @@
 import { brotliCompressSync, constants, gzipSync } from "node:zlib";
 
 /** The types worth compressing; images and fonts are compressed already. */
-const COMPRESSIBLE = new Set([".html", ".js", ".mjs", ".css", ".json", ".svg", ".map"]);
+const COMPRESSIBLE = new Set([".html", ".js", ".mjs", ".css", ".json", ".svg", ".map", ".webmanifest"]);
 
 /** Vite's output under assets/: `<name>-<hash>.<ext>`, the hash eight or more
  *  characters of base64url. */