ccdeck 3.29.1 → 3.29.3

package/dist/web/index.html

@@ -62,7 +62,7 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-7mOqoJ3Y.js"></script>
+    <script type="module" crossorigin src="/assets/index-C7djiYSc.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-FeNTTJ0x.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.29.1",
+  "version": "3.29.3",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -52,7 +52,8 @@
     "3.27.6",
     "3.27.7",
     "3.28.0",
-    "3.28.1"
+    "3.28.1",
+    "3.29.3"
   ],
   "3.29.1": [
     {

package/src/server/deck-prefs.mjs

@@ -285,6 +285,24 @@ function unreadablePrefs(path, why) {
   return err;
 }
 
+/** The errors a filesystem raises for a place this user may not write — most
+ *  often a settings folder a `sudo` run left owned by root (#1335). */
+const NOT_WRITABLE = new Set(["EACCES", "EPERM", "EROFS"]);
+
+/**
+ * Why a settings write failed, as a reason the panel can name — or null when
+ * the failure is not one of the two a person can fix from outside the deck.
+ *
+ * A code, never the message: the message carries the absolute path, and a
+ * route's body is readable by a DNS-rebound page (see sendInternalError). The
+ * deck's log keeps the path for the person who has to go and look.
+ */
+export function prefsWriteRefusal(err) {
+  if (err?.code === "PREFS_UNREADABLE") return "prefs_unreadable";
+  if (NOT_WRITABLE.has(err?.code)) return "prefs_not_writable";
+  return null;
+}
+
 /**
  * Read prefs.json, and say WHICH of four things happened — because three of
  * them hand back the same object and only one of them means it.

package/src/server/index.mjs

@@ -37,7 +37,7 @@ import { createOutputWatch } from "./output-watch.mjs";
 import { RECAP_MARK, foldRecapLine } from "./session-recap.mjs";
 import { AWAY_BOOT_GRACE_MS, AWAY_RECHECK_MS, AWAY_TICK_MS, awayGate, awayUpdateStep } from "./auto-update.mjs";
 import { createPresence } from "./presence.mjs";
-import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, publicPrefs, readPrefs, updatePrefs, withAlias, withManualEntry, withShared, writePrefs } from "./deck-prefs.mjs";
+import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, prefsWriteRefusal, publicPrefs, readPrefs, updatePrefs, withAlias, withManualEntry, withShared, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
 import { createTailnet, IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
 import { portHolder } from "./port-holder.mjs";
@@ -3821,7 +3821,17 @@ async function handlePrefsWrite(req, res) {
   let body = null;
   try { body = JSON.parse(raw ?? ""); } catch { /* handled below */ }
   if (!body || typeof body !== "object") return send(res, 400, { ok: false, reason: "bad_request" });
-  _prefs = await writePrefs(body);
+  try {
+    _prefs = await writePrefs(body);
+  } catch (err) {
+    // A settings file or folder this user cannot reach is the machine's to fix,
+    // not the deck's, and `guard`'s bare 500 left the panel with nothing to say
+    // about it (#1335). Anything else is still a bug and still goes to `guard`.
+    const reason = prefsWriteRefusal(err);
+    if (!reason) throw err;
+    console.error(`${PRODUCT}: settings were not saved:`, err?.message ?? err);
+    return send(res, 500, { ok: false, reason });
+  }
   // The engine reads its settings from here rather than holding its own copy,
   // so turning the switch off in the panel really does stop the sockets rather
   // than only changing what the panel says.