ccdeck 3.29.3 → 3.29.6

package/dist/web/index.html

@@ -62,7 +62,7 @@
           stored === "light" || (stored !== "dark" && light) ? "light" : "dark");
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-C7djiYSc.js"></script>
+    <script type="module" crossorigin src="/assets/index-6Mi0L2Ks.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-FeNTTJ0x.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccdeck",
-  "version": "3.29.3",
+  "version": "3.29.6",
   "description": "Live dashboard for Claude Code and Codex — which agent is waiting on you, tool calls, token spend and every Claude Code subagent on one calm canvas. Run it with npx ccdeck.",
   "type": "module",
   "bin": {

package/release-notes.json

@@ -53,7 +53,9 @@
     "3.27.7",
     "3.28.0",
     "3.28.1",
-    "3.29.3"
+    "3.29.3",
+    "3.29.4",
+    "3.29.6"
   ],
   "3.29.1": [
     {

package/src/server/deck-prefs.mjs

@@ -33,7 +33,7 @@
 // write defaults over it, destroying the LAN key every paired machine had
 // pinned. A file that cannot be parsed is now moved aside and said out loud;
 // only a genuinely ABSENT file starts clean. See loadPrefs.
-import { chmod, mkdir, readFile, unlink } from "node:fs/promises";
+import { chmod, mkdir, readFile, stat, unlink } from "node:fs/promises";
 // The rename, with the Windows retry ladder installer.mjs wrote for exactly
 // this call. See the note over the write below (#786). `stripBom` and
 // `createTemp` come from the same module for the reason its export block gives:
@@ -273,7 +273,7 @@ export const quarantinePath = (home = deckDataDir(), at = Date.now()) =>
  *  not the user's. Shaped like installer.mjs's SETTINGS_UNREADABLE, which is
  *  the same policy on the other file this deck rewrites: a file we cannot
  *  reproduce is never treated as an empty one. */
-function unreadablePrefs(path, why) {
+function unreadablePrefs(path, why, blocked) {
   const err = new Error(
     `${path} could not be read (${why}). Refusing to overwrite it — this deck's ` +
     `LAN key and its pairings are in there and cannot be re-derived. Fix the ` +
@@ -282,6 +282,7 @@ function unreadablePrefs(path, why) {
   err.code = "PREFS_UNREADABLE";
   err.prefsPath = path;
   err.why = why;
+  err.blocked = blocked;
   return err;
 }
 
@@ -303,8 +304,112 @@ export function prefsWriteRefusal(err) {
   return null;
 }
 
+/** What blocked a prefs.json that is not JSON and could not be moved aside —
+ *  no errno for it, so a name of the deck's own in the same shape. */
+const NOT_JSON = Object.freeze({ code: "BADJSON", owner: "unknown", on: "file" });
+
+const OWNERS = new Set(["you", "other", "unknown"]);
+/** An errno as Node spells one, or the deck's BADJSON. Anything else — which
+ *  nothing here produces — is dropped rather than echoed to the page. */
+const ERRNO = /^E?[A-Z][A-Z0-9]{1,15}$/;
+
+/**
+ * The same refusal, told precisely enough to act on from a screenshot (#1335).
+ *
+ * 3.29.3's panel could only guess — "the file may belong to another user" — and
+ * the one Mac it was written for turned out not to be the case 3.29.4 repairs,
+ * with nothing on the screen to say which case it was. So the page now gets the
+ * errno, who owns what blocked the read (`you`, `other`, `unknown`), and whether
+ * that is the `file` or its `folder`.
+ *
+ * Every field is picked from a closed set. Still no path and no uid: the route's
+ * body is readable by a DNS-rebound page (see prefsWriteRefusal), and a path
+ * names the user. Null when there is nothing precise to add.
+ */
+export function prefsRefusalDetail(err) {
+  const blocked = err?.code === "PREFS_UNREADABLE" ? err.blocked
+    : NOT_WRITABLE.has(err?.code) ? { code: err.code, owner: "unknown", on: "folder" }
+    : null;
+  if (!blocked || typeof blocked !== "object") return null;
+  return {
+    code: ERRNO.test(blocked.code ?? "") ? blocked.code : "",
+    owner: OWNERS.has(blocked.owner) ? blocked.owner : "unknown",
+    on: blocked.on === "folder" ? "folder" : "file",
+  };
+}
+
+/** The read errors that can mean "not yours" rather than "broken". Only these
+ *  send a read to setAsideForeign; EISDIR, EIO and EMFILE never do. */
+const DENIED = new Set(["EACCES", "EPERM"]);
+
+/** Where a prefs.json another user owns is put. Beside the file, like
+ *  quarantinePath, and stamped in milliseconds for the same Windows reason —
+ *  but a name of its own, because nothing is wrong with these bytes. */
+export const foreignPath = (home = deckDataDir(), at = Date.now()) =>
+  `${prefsPath(home)}.foreign-${at}`;
+
 /**
- * Read prefs.json, and say WHICH of four things happened — because three of
+ * Move a prefs.json that ANOTHER USER OWNS out of the way, or say why not.
+ *
+ * #1335. A `sudo ccdeck` that kept the user's HOME writes a root-owned 0600
+ * prefs.json into the user's own folder. From then on every
+ * deck that user starts is refused the read, refuses every settings write on
+ * top of it — rightly — and so can never keep anything: a new LAN identity on
+ * every start, a share tick that says "Could not share that account", and no
+ * way out from inside the deck.
+ *
+ * WHY MOVING IT IS SAFE HERE WHEN IT IS NOT FOR "unreadable". The refusal
+ * exists so the deck never loses a key it could still have read. A file owned
+ * by somebody else is not one this user's deck will ever read — waiting does
+ * not help, and the deck is already running on defaults. A rename reads and
+ * changes nothing: owner and mode travel with the file, so the key in it stays
+ * private and whole, and `sudo chown` plus a move puts it back.
+ *
+ * Only when the owner is KNOWN to be somebody else. A file this user owns and
+ * still cannot read (a mode bit, a lock, a sandbox) is left exactly where it
+ * is, and so is anything on Windows, where there is no uid to compare and
+ * EPERM is usually another program holding the file.
+ *
+ * Answers `{ moved, uid }`, `{ gone }` when the file vanished under it, or,
+ * when it stayed, `{ why, owner, on }`: a sentence for the log, possibly empty,
+ * and who owns what blocked the read — "you", "other" or "unknown" — and
+ * whether that is the "file" or its "folder". The last two are what the panel
+ * is told (see prefsRefusalDetail); the sentence, which has the path, is not.
+ */
+async function setAsideForeign(path, home, deps) {
+  const uid = deps.getuid ? deps.getuid() : process.getuid?.();
+  if (uid === undefined) return { why: "", owner: "unknown", on: "file" };
+  const look = deps.stat ?? stat;
+  let st;
+  try {
+    st = await look(path);
+  } catch (err) {
+    if (err?.code === "ENOENT") return { gone: true };
+    // The folder itself is out of reach, so nothing in it can be looked at, let
+    // alone moved. Name the folder and its owner, which is what a person needs.
+    const folder = prefsDir(home);
+    const owner = await look(folder).then(s => s.uid, () => undefined);
+    if (owner === undefined) return { why: "", owner: "unknown", on: "folder" };
+    if (owner === uid) return { why: "", owner: "you", on: "folder" };
+    return {
+      why: ` The folder ${folder} belongs to another user (uid ${owner}), most likely from a run with sudo; sudo chown -R "$(id -un)" "${folder}" gives it back.`,
+      owner: "other",
+      on: "folder",
+    };
+  }
+  if (st.uid === uid) return { why: "", owner: "you", on: "file" };
+  const to = foreignPath(home);
+  try {
+    await (deps.rename ?? renameWithRetry)(path, to);
+  } catch (err) {
+    if (err?.code === "ENOENT") return { gone: true };
+    return { why: ` It belongs to another user (uid ${st.uid}) and could not be moved aside either: ${err?.message ?? err}.`, owner: "other", on: "file" };
+  }
+  return { moved: to, uid: st.uid };
+}
+
+/**
+ * Read prefs.json, and say WHICH of five things happened — because four of
  * them hand back the same object and only one of them means it.
  *
  * WHY THE SOURCE IS PART OF THE ANSWER. The old read collapsed "no file yet"
@@ -322,9 +427,14 @@ export function prefsWriteRefusal(err) {
  *                defaults, silently, which is what a first start is.
  *   "corrupt"    bytes that are not JSON. Moved aside to `quarantined` BEFORE
  *                this returns, so nothing can merge over them.
+ *   "foreign"    a file ANOTHER USER owns and this one may not read — what a
+ *                `sudo` run leaves (#1335). Moved aside to `quarantined`, still
+ *                theirs and unread, BEFORE this returns. See setAsideForeign.
  *   "unreadable" the read itself failed for some reason other than absence — a
- *                permission, a directory in the way. The file is still there
- *                and still unread, which is exactly when a write must not land.
+ *                permission on a file this user owns, a directory in the way,
+ *                a folder another user owns. The file is still there and still
+ *                unread, which is exactly when a write must not land. `blocked`
+ *                says what stopped it; see prefsRefusalDetail.
  *
  * A BYTE-ORDER MARK IS NOT DAMAGE. Notepad and `Set-Content` write one, and
  * `JSON.parse` throws on it — so stripping it here is what keeps a perfectly
@@ -342,8 +452,17 @@ export async function loadPrefs(home = deckDataDir(), deps = {}) {
     raw = await read(path, "utf8");
   } catch (err) {
     if (err?.code === "ENOENT") return { prefs: defaults(), source: "missing", quarantined: "" };
-    warn(`${PRODUCT}: could not read ${path}: ${err?.message ?? err}. Leaving it alone — settings will not be saved until it can be read.`);
-    return { prefs: defaults(), source: "unreadable", quarantined: "" };
+    const aside = DENIED.has(err?.code) ? await setAsideForeign(path, home, deps) : {};
+    // Somebody else moved it between the read and the look — a second deck on
+    // this machine doing this same thing. What is at `path` now is nothing.
+    if (aside.gone) return { prefs: defaults(), source: "missing", quarantined: "" };
+    if (aside.moved) {
+      warn(`${PRODUCT}: ${path} belongs to another user (uid ${aside.uid}) — most likely left by a run with sudo — so this deck could not read it. It has been kept as ${aside.moved}, unread and still theirs, and this deck is starting with fresh settings: paired decks will need to accept it again. To have the old key back instead, stop the deck and run: sudo chown "$(id -un)" "${aside.moved}" && mv "${aside.moved}" "${path}"`);
+      return { prefs: defaults(), source: "foreign", quarantined: aside.moved };
+    }
+    warn(`${PRODUCT}: could not read ${path}: ${err?.message ?? err}.${aside.why ?? ""} Leaving it alone — settings will not be saved until it can be read.`);
+    const blocked = { code: err?.code ?? "", owner: aside.owner ?? "unknown", on: aside.on ?? "file" };
+    return { prefs: defaults(), source: "unreadable", quarantined: "", blocked };
   }
 
   try {
@@ -507,10 +626,10 @@ async function save(mutate, home, deps) {
   // stick. POSIX rename(2) has no such rule, which is why this shipped green.
   const mv = deps.rename ?? renameWithRetry;
   const target = prefsPath(home);
-  const { prefs: prev, source, quarantined } = await loadPrefs(home, deps);
-  if (source === "unreadable") throw unreadablePrefs(target, "the read failed");
+  const { prefs: prev, source, quarantined, blocked } = await loadPrefs(home, deps);
+  if (source === "unreadable") throw unreadablePrefs(target, "the read failed", blocked);
   if (source === "corrupt" && !quarantined) {
-    throw unreadablePrefs(target, "it is not JSON and could not be moved aside");
+    throw unreadablePrefs(target, "it is not JSON and could not be moved aside", NOT_JSON);
   }
   // INSIDE THE JOB, after the read above and after the two guards that
   // decide whether this file may be written at all — see `updatePrefs`.

package/src/server/index.mjs

@@ -37,7 +37,7 @@ import { createOutputWatch } from "./output-watch.mjs";
 import { RECAP_MARK, foldRecapLine } from "./session-recap.mjs";
 import { AWAY_BOOT_GRACE_MS, AWAY_RECHECK_MS, AWAY_TICK_MS, awayGate, awayUpdateStep } from "./auto-update.mjs";
 import { createPresence } from "./presence.mjs";
-import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, prefsWriteRefusal, publicPrefs, readPrefs, updatePrefs, withAlias, withManualEntry, withShared, writePrefs } from "./deck-prefs.mjs";
+import { DEFAULTS as PREF_DEFAULTS, cleanAlias, isAliasKey, lanEnabled, notificationsOn, notificationsVetoed, prefsRefusalDetail, prefsWriteRefusal, publicPrefs, readPrefs, updatePrefs, withAlias, withManualEntry, withShared, writePrefs } from "./deck-prefs.mjs";
 import { createEngine, defaultName } from "./lan-engine.mjs";
 import { createTailnet, IDLE_MS as TAILNET_IDLE_MS } from "./tailscale.mjs";
 import { portHolder } from "./port-holder.mjs";
@@ -3830,7 +3830,10 @@ async function handlePrefsWrite(req, res) {
     const reason = prefsWriteRefusal(err);
     if (!reason) throw err;
     console.error(`${PRODUCT}: settings were not saved:`, err?.message ?? err);
-    return send(res, 500, { ok: false, reason });
+    // What blocked it, from closed sets and without the path, so a screenshot
+    // of the panel is enough to tell the cases apart (#1335).
+    const detail = prefsRefusalDetail(err);
+    return send(res, 500, detail ? { ok: false, reason, detail } : { ok: false, reason });
   }
   // The engine reads its settings from here rather than holding its own copy,
   // so turning the switch off in the panel really does stop the sockets rather