ccdeck 3.29.11 → 3.31.0

package/src/server/browser-watch-decks.mjs

@@ -0,0 +1,146 @@
+// Which decks are on this machine, as Browser Watch needs to know it: whose
+// tabs are the deck's own, and which deck is the one that writes.
+//
+// Two questions the snapshot asks of the discovery directory — the record
+// every running deck keeps in `~/.claude/agent-dag` — and of nothing else.
+// `deckOwnOrigins` and `registeredDeckPorts` answer the first: a deck opens its
+// own tab through `open`, Chrome marks that visit as a program's, and the watch
+// must not report ccdeck to its owner. `isReactingDeck` answers the second:
+// one machine, one store, usually more than one deck, and only one of them may
+// write the archive and react.
+//
+// Reading only. Neither question claims anything on disk to answer it, so
+// neither can leave a claim behind. browser-watch.mjs re-exports the two the
+// route imports, so browser-watch-routes.mjs and the tests that import them
+// from there are unchanged.
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { claudeConfigDir } from "./claude-dir.mjs";
+// Is that pid still running? The probe every other reader of this directory
+// uses, rather than the copy this module kept of it. A bare `catch { continue; }`
+// once stood where it is called, which threw away the one distinction that
+// matters: a process this account may not signal answers EPERM on POSIX and
+// EACCES on Windows, and both mean ALIVE. Treating them as gone made an
+// elevated deck invisible to the writer election below, which is how a machine
+// ends up with two elected writers — duplicate log lines, duplicate reactions,
+// and two writers racing the same rename. One probe is one rule to keep right.
+import { isProcessAlive } from "./deck-probe.mjs";
+
+/**
+ * Every loopback address a ccdeck could have opened a tab on.
+ *
+ * Not just this process's port. The deck asks for 4317 and, when something else
+ * already holds it, binds a RANDOM port in 4318-4400 instead (startServer's
+ * `portRange`), so a machine that has been running decks for a month has tabs
+ * on several. The real profile this feature was tuned against carried 41 visits
+ * to 127.0.0.1:4317 and 34 to 127.0.0.1:4399 — two ports, both this deck, both
+ * FROM_API because `open` is an API call, and every one of them a card the
+ * panel would have shown its owner about itself.
+ *
+ * The whole range rather than the ports seen: the alternative is to remember
+ * which ports past decks used, which is a file to keep, a file to migrate, and
+ * a file that is empty the first time it matters. Eighty-four loopback ports
+ * this program documents as its own are not a meaningful loss of coverage — a
+ * user's own dev server on 3000 or 44440 is still reported, which is the case
+ * that would have hurt.
+ */
+export function deckOwnOrigins(portRange = [4317, 4400], registered = []) {
+  const [lo, hi] = portRange;
+  const out = [];
+  for (let port = lo; port <= hi; port++) out.push(`http://127.0.0.1:${port}`);
+  // AND THE PORTS DECKS ACTUALLY REGISTERED, which the range cannot know about.
+  // The range covers the default and its fallback; an explicit `--port` lands
+  // anywhere. Measured: a deck running from a worktree on `--port 4793` opened
+  // its own tab, and this panel reported it to its owner as a program driving
+  // the browser — which it was, and the program was ccdeck.
+  //
+  // Read rather than guessed. The registry already holds a port per live deck
+  // for the election, so this is a fact the machine has, not a range somebody
+  // has to keep current.
+  //
+  // A deck that registered NOTHING is still reported, and that is right rather
+  // than a gap: from here it is a program driving the browser and nothing
+  // announces otherwise. The reader can dismiss it once and it stays dismissed.
+  for (const port of registered) {
+    if (!Number.isInteger(port) || port < 1 || port > 65535) continue;
+    if (port >= lo && port <= hi) continue;
+    out.push(`http://127.0.0.1:${port}`);
+  }
+  return out;
+}
+
+/** The port of every live deck that registered one. Same directory and the same
+ *  liveness check the election uses — a record whose process is gone is a
+ *  leftover, not a deck whose tabs should be excused. */
+export async function registeredDeckPorts(deps = {}) {
+  if (deps.registeredDeckPorts) return deps.registeredDeckPorts();
+  const dir = join(claudeConfigDir(), "agent-dag");
+  let files;
+  try { files = await readdir(dir); } catch { return []; }
+  const ports = [];
+  for (const f of files) {
+    if (!f.endsWith(".json")) continue;
+    try {
+      const d = JSON.parse(await readFile(join(dir, f), "utf8"));
+      if (typeof d?.pid !== "number" || typeof d?.port !== "number") continue;
+      if (!isProcessAlive(d.pid)) continue;
+      ports.push(d.port);
+    } catch { /* corrupt, or gone between listing and read */ }
+  }
+  return ports;
+}
+
+/**
+ * Whether THIS deck is the one that reacts and writes.
+ *
+ * ONE MACHINE, ONE STORE, AND USUALLY MORE THAN ONE DECK. The archive and the
+ * log live at a single path per machine, but running two decks is ordinary here
+ * — the repo has electWriters and a discovery directory precisely because it is.
+ * Both would read the same Chrome history, find the same new episode, and each
+ * write a line and fire a notification: one event, told twice.
+ *
+ * Verified rather than assumed: at the moment this was written, two decks were
+ * live on this machine (ports 4317 and 4393), so the collision is the ordinary
+ * case and not a corner.
+ *
+ * The rule is log-election.mjs's, reused rather than reinvented: among live
+ * decks, the LOWEST PORT wins, with the pid breaking a tie a stale discovery
+ * file could invent. Deterministic, needs no lock file, and cannot strand the
+ * feature — a deck that reads a directory it cannot open decides it is alone,
+ * which for the common case of one deck is the right answer anyway.
+ *
+ * Reading only, never writing: this is a question about who else is running, and
+ * a watcher that had to claim something to answer it could leave the claim
+ * behind. The shell tool this descends from lost its lock on SIGHUP and then
+ * refused to watch anything ever again.
+ */
+export async function isReactingDeck(deps = {}) {
+  if (deps.isReactingDeck) return deps.isReactingDeck();
+  const dir = join(claudeConfigDir(), "agent-dag");
+  let files;
+  try { files = await readdir(dir); } catch { return true; }   // cannot look — assume alone
+
+  let best = null;
+  for (const f of files) {
+    if (!f.endsWith(".json")) continue;
+    try {
+      const d = JSON.parse(await readFile(join(dir, f), "utf8"));
+      if (typeof d?.pid !== "number" || typeof d?.port !== "number") continue;
+      // ONLY DECKS THAT RUN THE WATCH GET A VOTE. This elected on port alone,
+      // so an older ccdeck that predates the feature won by holding the lower
+      // port and then wrote nothing — while the deck that has the watch stood
+      // down and also wrote nothing. Measured here: a v1.46 deck out of an npx
+      // cache held 4317, answered this route with the SPA's index.html, and the
+      // watch recorded nothing at all for as long as both were up. Findings on
+      // screen, an empty disk, and not one line anywhere saying why.
+      //
+      // An older deck has no such field, so it loses by construction rather
+      // than by a version comparison this would otherwise have to keep.
+      if (d.watch !== true) continue;
+      // A record whose process is gone is a leftover, not a rival.
+      if (!isProcessAlive(d.pid)) continue;
+      if (!best || d.port < best.port || (d.port === best.port && d.pid < best.pid)) best = d;
+    } catch { /* corrupt, or gone between listing and read */ }
+  }
+  return best === null || best.pid === process.pid;
+}

package/src/server/browser-watch-feed.mjs

@@ -0,0 +1,69 @@
+// What Browser Watch has been doing, as the lines the panel's feed shows.
+//
+// The snapshot writes a line when it finds something, when a profile cannot be
+// read, when a reaction ran or failed; the settings and dismiss routes write
+// one when the reader acts. Every line goes in through `note`, the buffer's one
+// writer, and comes back out through `watchLog` as a copy — the buffer itself
+// is private, so nothing else can reorder it, grow it past its bound, or keep
+// hold of it while it changes.
+//
+// browser-watch.mjs re-exports noteWatchSetting, which is the name the routes
+// import, so browser-watch-routes.mjs is unchanged.
+
+/**
+ * What the watch has been doing, newest first.
+ *
+ * The shell tool this descends from printed a running commentary — armed,
+ * standing down, still watching, nothing found — and that commentary was most
+ * of what made it trustworthy: you could see it working rather than take its
+ * silence on faith. A panel that only ever shows a list has no way to say "I
+ * looked, and there was nothing", which reads identically to "I am not looking".
+ *
+ * In memory and bounded. It is a record of what this process did since it
+ * started, not an audit trail — the archive on disk is the thing that must
+ * survive, and it already does.
+ */
+const LOG_MAX = 200;
+const logLines = [];
+
+/**
+ * One line of what the watch did.
+ *
+ * FIVE LEVELS, AND THEY ARE NOT SEVERITIES. `find` is the only one that means
+ * something was found; `act` is the reader themselves, changing a setting or
+ * the switch — the only lines in the file a person put there, and the ones they
+ * scan for when asking "what did I change and when"; `ok` is the deck working,
+ * `info` is the deck deciding not to work, and `warn` is the deck unable to.
+ *
+ * A log where every line is the same weight is a log nobody scans — and the one
+ * line worth catching here is a program having driven the browser, which is not
+ * an error and must not be dressed as one.
+ *
+ * @param {"find"|"act"|"ok"|"info"|"warn"} level
+ */
+export function note(level, text, atMs = Date.now(), parts = null) {
+  // `parts` is the same line said as columns, for the one shape that HAS
+  // columns: a profile read. The panel aligns those into a grid, where the
+  // count lands in the same place on every row instead of at the end of a
+  // sentence whose length depends on the browser's name. Composed here rather
+  // than parsed back out of `text` in the client — a program that has to
+  // reverse its own formatting has two spellings of one fact and will
+  // eventually disagree with itself.
+  //
+  // Null for every other line, and that is not a gap: "still watching 2
+  // profiles" and "closed the tab" are the deck talking, not events with a
+  // browser and a number, and the panel renders them as a different kind of
+  // row on purpose.
+  logLines.unshift(parts ? { atMs, level, text, parts } : { atMs, level, text });
+  if (logLines.length > LOG_MAX) logLines.length = LOG_MAX;
+}
+
+export function watchLog() {
+  return logLines.slice();
+}
+
+/** Called by the settings route, which is the one moment worth a line of its
+ *  own: everything else here is the deck reading, and this is the user acting. */
+export function noteWatchSetting(text) {
+  note("act", text);
+}

package/src/server/browser-watch-log.mjs

@@ -0,0 +1,173 @@
+// watch.log: the one Browser Watch file a person opens themselves.
+//
+// state.json (browser-watch-store.mjs) is the deck's own record, and JSON
+// because the deck reads it back. This is the same episodes in the shape
+// `tail -f` and `grep` want — one summary line per episode and every address
+// under it — written the way a log is written: appended to, never edited, and
+// rolled over whole at a cap (#989). It lives in the store's directory, which
+// is why `storeDir` comes from the store rather than from a second spelling of
+// the path.
+//
+// The snapshot appends to it once an episode is archived, and the panel names
+// it and its size. Neither asks anything else of this module.
+import { appendFile, mkdir, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { claudeConfigDir } from "./claude-dir.mjs";
+// The rename, with the Windows retry ladder atomic-write.mjs keeps for it — see
+// `rollIfFull` below, and #786.
+import { renameWithRetry } from "./atomic-write.mjs";
+import { storeDir } from "./browser-watch-store.mjs";
+
+/** The plain-text log, which is the one file here a person opens themselves.
+ *  state.json is the deck's own record and is JSON because the deck reads it
+ *  back; this is the same events in the shape `tail -f` wants. */
+export const logPath = (home = claudeConfigDir()) => join(storeDir(home), "watch.log");
+
+/** The one generation kept behind it. `.1` rather than a datestamp because this
+ *  is `tail -f`'s file and `logrotate`'s convention is the one a person reading
+ *  it already knows — and because a name that changes is a name nothing can
+ *  overwrite, which is how a rotation that bounds nothing gets written. */
+export const rolledLogPath = (home = claudeConfigDir()) => `${logPath(home)}.1`;
+
+/**
+ * How large watch.log may grow before it is rolled over (#989).
+ *
+ * EVERY OTHER STORE IN BROWSER WATCH HAS A CAP. `KEEP` holds the archive to 500
+ * episodes and `DISMISS_KEEP` holds dismissals to 2000, both in
+ * browser-watch-store.mjs, and the panel's feed is held to 200 lines — while
+ * this file, the one that writes out EVERY ADDRESS in full, grew for the life
+ * of the install and nothing ever trimmed it. With the watch on by default, a
+ * machine where something drives a browser in a loop builds a plaintext list of
+ * every address it touched, without end.
+ *
+ * TWO MEBIBYTES. An episode of twenty addresses with query strings is about
+ * 2 KB of this file, so the cap is on the order of a thousand episodes: twice
+ * the archive beside it, which `KEEP` sizes at about two years of the measured
+ * rate. It is only reached where something drives a browser far more often than
+ * that, and that machine must not fill its disk reporting it.
+ *
+ * ONE GENERATION, `watch.log.1`, so the most this costs on disk is a number a
+ * reader can state: twice the cap, plus one append that was larger on its own.
+ */
+const LOG_MAX_BYTES = 2 * 1024 * 1024;
+
+/**
+ * What the log holds on disk right now, both generations, in bytes — for the
+ * panel, which names the file and now its size. Never throws: 0 is the answer
+ * for a log never written, and a coverage field is not where a stat error goes.
+ */
+export async function logSize(home = claudeConfigDir(), deps = {}) {
+  const st = deps.stat ?? stat;
+  let total = 0;
+  for (const file of [logPath(home), rolledLogPath(home)]) {
+    try { total += (await st(file)).size; } catch { /* not there, or not readable */ }
+  }
+  return total;
+}
+
+/**
+ * Append one episode, and EVERY ADDRESS IN IT, oldest first.
+ *
+ * THE URLs ARE THE POINT OF THE FILE. A summary line — host, count, duration —
+ * says something happened and leaves the reader unable to act on it: the
+ * question three days later is not "did a program touch gitlab" but "WHICH
+ * pages", because a jobs list and a settings page mean different things. So
+ * every address is written in full, unshortened and unescaped, exactly as
+ * Chrome recorded it.
+ *
+ * Query strings and fragments included. They are frequently the whole content
+ * of the visit — `?scope=all`, `#servicii` — and a log that dropped them would
+ * be tidier and useless for the one job it has.
+ *
+ * Indented under their episode so the shape survives `grep`: a summary line
+ * starts at column zero, a URL line does not, which is what lets
+ * `grep -v '^ '` give the summary alone and `grep '^  '` give the addresses.
+ *
+ * Append-only and never rewritten: a log a program edits is not a log. It is
+ * the only part of this feature that outlives the process by design — the panel
+ * shows what this deck has seen, this file is what somebody reads three days
+ * later without opening the panel at all.
+ *
+ * ROLLED OVER, NOT EDITED, at LOG_MAX_BYTES (#989), which keeps that rule: the
+ * whole file moves to `watch.log.1` and the next append starts a new one. No
+ * line this function wrote is ever changed. Trimming the oldest lines out in
+ * place was the other way to bound it, and it is the edit the rule forbids.
+ */
+export async function appendLog(episodes, home = claudeConfigDir(), deps = {}) {
+  if (!episodes.length) return;
+  const mk = deps.mkdir ?? mkdir;
+  const add = deps.appendFile ?? appendFile;
+  await mk(storeDir(home), { recursive: true });
+  const text = episodes.map(logBlock).join("\n") + "\n";
+  await rollIfFull(home, Buffer.byteLength(text, "utf8"), deps);
+  await add(logPath(home), text, "utf8");
+}
+
+/**
+ * A moment as the log writes it, to the second: `2026-09-28 16:05:09`.
+ *
+ * Local time, not UTC. The reader's question is "what was happening at four
+ * yesterday afternoon", and their afternoon is not UTC's — the ISO stamp this
+ * replaced was off by the offset for everyone outside London.
+ */
+function localStamp(ms) {
+  const d = new Date(ms);
+  const p = n => String(n).padStart(2, "0");
+  return `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())} `
+       + `${p(d.getHours())}:${p(d.getMinutes())}:${p(d.getSeconds())}`;
+}
+
+/**
+ * One episode as the log writes it, without the newline that ends it.
+ *
+ * The summary line at column zero — when it started, the host, how many pages,
+ * how long it ran once that is a minute or more, and which browser — and then
+ * every address under it, indented, each with its time of day. `appendLog`
+ * above says why the addresses are written whole and why the indent is the
+ * shape `grep` needs.
+ *
+ * Exported for its test, which can pin the exact text a person reads without
+ * going through a file.
+ */
+export function logBlock(e) {
+  const span = e.endMs - e.startMs >= 60_000
+    ? ` over ${Math.round((e.endMs - e.startMs) / 60_000)}m`
+    : "";
+  const where = e.browser ? ` [${e.browser}]` : "";
+  const head = `${localStamp(e.startMs)}  ${e.host}  ${e.count} page${e.count === 1 ? "" : "s"}${span}${where}`;
+  const rows = (e.urls ?? []).map(u => `    ${localStamp(u.timeMs).slice(11)}  ${u.url}`);
+  return [head, ...rows].join("\n");
+}
+
+/**
+ * Move the log aside when this append would carry it past the cap.
+ *
+ * MEASURED BEFORE THE WRITE, so the cap is a ceiling rather than a line the file
+ * sits above until the next append. The one overshoot left is a single append
+ * larger than the whole cap, written whole on purpose: an episode split across
+ * two files would leave addresses under no summary line, and that line and its
+ * indented addresses are what `grep -v '^ '` and `grep '^  '` separate.
+ *
+ * A ROTATION THAT FAILS MUST NOT COST THE APPEND. This is the record of what a
+ * program did in somebody's browser. A full disk, a Windows handle still open on
+ * `watch.log.1`, a permission on the directory: each is a reason to write a
+ * larger file than intended, and none is a reason to write nothing. The next
+ * append tries again.
+ *
+ * `renameWithRetry` for the reason #786 gives over the store's `writeNow`: on
+ * Windows a rename loses to anything still holding a handle, and this is a file
+ * people open to read.
+ */
+async function rollIfFull(home, adding, deps) {
+  const st = deps.stat ?? stat;
+  const mv = deps.rename ?? renameWithRetry;
+  try {
+    const { size } = await st(logPath(home));
+    if (size === 0 || size + adding <= LOG_MAX_BYTES) return;
+    await mv(logPath(home), rolledLogPath(home));
+  } catch {
+    // No log yet (the ordinary first call), or the filesystem refused. Either
+    // way the append is the thing that matters and it is not this function's to
+    // cancel.
+  }
+}

package/src/server/browser-watch-mtime.mjs

@@ -0,0 +1,18 @@
+// The stamp both of Browser Watch's caches are keyed on: a file's modification
+// time.
+//
+// Moved out of browser-watch.mjs unchanged when the relay report left it for
+// browser-watch-relay.mjs, because both reads that cache ask this one question
+// — the History read in browser-watch.mjs and the Secure Preferences read in
+// browser-watch-relay.mjs — and two spellings of "not there" would be two
+// answers to it. It imports node:fs and nothing else, so either side reaches it
+// without reaching the other.
+import { statSync } from "node:fs";
+
+/** The file's modification time in ms, or null when it is not there at all —
+ *  an uninstalled browser, a profile that has never been opened, a home
+ *  directory on a volume that is not mounted. Never throws: one unreadable
+ *  profile must not take the other browsers' answers down with it. */
+export function mtimeMs(file, deps) {
+  try { return (deps.statSync ?? statSync)(file).mtimeMs; } catch { return null; }
+}

package/src/server/browser-watch-relay.mjs

@@ -0,0 +1,112 @@
+// Browser Watch's relay report: whether somebody else's Claude Code can drive
+// the browsers on this machine, read off disk for relay-guard.mjs to judge.
+//
+// Moved out of browser-watch.mjs unchanged. relay-guard.mjs holds every rule
+// and does no reading of its own; this file is the reading — the hosts file
+// once, and each profile's Secure Preferences behind a cache keyed on the
+// file's mtime (browser-watch-mtime.mjs, the stamp the History cache in
+// browser-watch.mjs keys on too). The snapshot calls relayGuard on every poll
+// that reads the browsers and puts its answer on the reply as `relay` (#799).
+import { readFile } from "node:fs/promises";
+import { mtimeMs } from "./browser-watch-mtime.mjs";
+import { RELAY_HOST, hostsPath, readKillswitch, extensionReport, killswitchCommand, verdict } from "./relay-guard.mjs";
+
+/** Secure Preferences reports, keyed on the file and its mtime — see
+ *  `relayGuard` for why this one needs a cache more than the History read
+ *  does. */
+const extCache = new Map();
+
+/**
+ * What relay-guard can say about this machine, from two reads it does not do
+ * itself.
+ *
+ * THE MODULE WAS BUILT AND NEVER PLUGGED IN (#799). Every export but
+ * `RELAY_HOST` greped to its own declaration and its test, so the header's
+ * promise — "the one command that closes it … hands back the command that would
+ * change it, as text, for the user to paste" — reached no surface. A reader
+ * auditing this repo's security posture would have believed the killswitch and
+ * the grant report ship. This is that promise kept: the panel now renders both.
+ *
+ * relay-guard imports node:path and nothing else, on purpose, so the reading is
+ * here. Two sources:
+ *
+ *   THE HOSTS FILE, once. Small, and the same file for every profile.
+ *
+ *   EACH PROFILE'S "Secure Preferences", only where `hasExtension` already said
+ *   the directory is there. This one is why there is a cache: it is a single
+ *   JSON document holding every extension's settings and it runs to megabytes
+ *   on a profile with a few installed, while the panel polls every ten seconds.
+ *   Keyed on mtime like the History cache in browser-watch.mjs, and for the
+ *   same reason — a browser that is closed cannot invalidate it.
+ *
+ * A read that fails is not a report of "nothing installed": `null` for that
+ * profile, and the aggregate says so. The difference matters here more than
+ * anywhere else in Browser Watch, because the reassuring answer and the
+ * unreadable answer are the same shape.
+ */
+export async function relayGuard(profiles, { platform, env, deps }) {
+  const readOne = async (file) => {
+    const stamp = mtimeMs(file, deps);
+    if (stamp === null) return null;
+    const hit = extCache.get(file);
+    if (hit && hit.stamp === stamp) return hit.report;
+    let report = null;
+    try {
+      report = extensionReport(JSON.parse(await (deps.readFile ?? readFile)(file, "utf8")));
+    } catch {
+      // Unreadable or not JSON — a profile being written as we looked, a
+      // hardened profile we cannot open. Not cached, so the next poll retries.
+      return null;
+    }
+    extCache.set(file, { stamp, report });
+    return report;
+  };
+
+  const seen = [];
+  for (const profile of profiles) {
+    // `hasClaudeExt` is an existsSync on `Extensions/<id>` and is already
+    // computed; it cannot see `enabled`, `allUrls` or `sensitiveApis`, which is
+    // the whole reason this reads the preferences at all. But it is a free way
+    // to skip every profile that has no extension to report on.
+    if (!profile.hasClaudeExt) continue;
+    const report = await readOne(profile.securePrefsPath);
+    seen.push({
+      browser: profile.browser,
+      name: profile.name,
+      profile: profile.profile,
+      // Null when the file could not be read, which the panel says out loud
+      // rather than rendering as an absence of permissions.
+      report,
+    });
+  }
+
+  let hostsText = null;
+  const hosts = (deps.hostsPath ?? hostsPath)(platform, env);
+  try { hostsText = await (deps.readFile ?? readFile)(hosts, "utf8"); } catch { /* no file, or no permission to read it */ }
+  const killswitch = readKillswitch(hostsText);
+
+  // ONE ENABLED COPY ANYWHERE IS ENOUGH, which is `verdict`'s own rule: the
+  // relay is registered per ANTHROPIC ACCOUNT, not per profile, so a second
+  // profile with the extension switched off protects nothing.
+  const anyExtension = seen.some(p => p.report?.present === true && p.report.enabled === true);
+
+  return {
+    relayHost: RELAY_HOST,
+    hostsPath: hosts,
+    // Whether the hosts file could be read at all. `blocked: false` from an
+    // unreadable file and `blocked: false` from a file with no entry are the
+    // same value and not the same fact.
+    hostsRead: typeof hostsText === "string",
+    profiles: seen,
+    anyExtension,
+    killswitch,
+    verdict: verdict({ anyExtension, blocked: killswitch.blocked }),
+    // Both, always, so the panel can offer the one that matches the state
+    // without having to know how either is spelled. Text only — nothing here
+    // runs it, and relay-guard could not if it tried.
+    command: {
+      block: killswitchCommand(platform, { on: true }),
+      unblock: killswitchCommand(platform, { on: false }),
+    },
+  };
+}